@kya-os/mcp 1.16.2 → 1.18.0

package/dist/delegation/chain-enforcement.js

@@ -13,6 +13,8 @@
  */
 import { extractDelegationFromVC, } from "../types/protocol.js";
 import { verifyDelegationAudience } from "./audience-validator.js";
+import { authorityContains, crispScopes, scopeAuthority } from "./scope-matcher.js";
+import { credentialIssuerDid } from "./vc-jwt-verify.js";
 /** Union of a credential's delegation scopes and its constraint scopes. */
 export function getDelegationScopes(credential) {
     const scopes = new Set();
@@ -25,44 +27,46 @@ export function getDelegationScopes(credential) {
     return Array.from(scopes);
 }
 /**
- * A child re-delegation may only narrow (attenuate) its parent's authority.
- * Enforces flat-scope subset AND crisp-matcher subset (by matcher+resource),
- * failing closed on any widening. Pure; never throws.
+ * A child re-delegation may only narrow (attenuate) its parent's authority
+ * (SPEC.md §6.4). Scope authority comes in two representations (SPEC.md §6.3):
+ * flat scopes, matched exactly, and CRISP scope matchers. Both credentials are
+ * read as one typed authority ({@link scopeAuthority}), and every flat scope and
+ * matcher the child grants must be proven inside the parent's authority
+ * ({@link authorityContains}), whichever representation either side uses;
+ * anything unprovable, including a malformed entry, fails closed. A credential
+ * with no scopes of either kind is not scope-restricted: such a parent accepts
+ * any child, and such a child never attenuates a restricted parent. Pure.
  */
 export function validateScopeAttenuation(parentCredential, childCredential) {
-    const parentScopes = getDelegationScopes(parentCredential);
+    const parentId = parentCredential.credentialSubject.delegation.id;
+    const childId = childCredential.credentialSubject.delegation.id;
+    const parentAuthority = scopeAuthority(parentCredential);
+    if (parentAuthority.length === 0) {
+        return { valid: true };
+    }
     const childScopes = getDelegationScopes(childCredential);
-    const childDelegation = childCredential.credentialSubject.delegation;
-    // CRISP matcher attenuation: getDelegationScopes does NOT see constraints.crisp.scopes,
-    // so a re-delegation could otherwise widen authority by introducing a broad
-    // prefix/regex matcher (e.g. resource:"" matches every scope). Require the child's
-    // crisp matchers to be a subset of the parent's (by matcher+resource). Fail closed.
-    const crispKey = (s) => `${s.matcher}\u0000${s.resource}`;
-    const parentCrisp = new Set((parentCredential.credentialSubject.delegation.constraints.crisp?.scopes ?? []).map(crispKey));
-    const widenedCrisp = (childDelegation.constraints.crisp?.scopes ?? []).filter((s) => !parentCrisp.has(crispKey(s)));
-    if (widenedCrisp.length > 0) {
+    const childMatchers = crispScopes(childCredential);
+    if (childScopes.length === 0 && childMatchers.length === 0) {
         return {
             valid: false,
-            reason: `Delegation ${childDelegation.id} introduces crisp scope matcher(s) absent from parent ${parentCredential.credentialSubject.delegation.id}: ${widenedCrisp
-                .map((s) => `${s.matcher}:${s.resource}`)
-                .join(", ")}`,
+            reason: `Delegation ${childId} omits scopes required to prove attenuation from parent ${parentId}`,
         };
     }
-    if (parentScopes.length === 0) {
-        return { valid: true };
-    }
-    if (childScopes.length === 0) {
+    const withinParent = authorityContains(parentAuthority);
+    const widenedMatchers = childMatchers.filter((scope) => !withinParent(scope));
+    if (widenedMatchers.length > 0) {
         return {
             valid: false,
-            reason: `Delegation ${childDelegation.id} omits scopes required to prove attenuation from parent ${parentCredential.credentialSubject.delegation.id}`,
+            reason: `Delegation ${childId} introduces crisp scope matcher(s) outside parent ${parentId}: ${widenedMatchers
+                .map((s) => `${s?.matcher}:${s?.resource}`)
+                .join(", ")}`,
         };
     }
-    const parentScopeSet = new Set(parentScopes);
-    const widenedScopes = childScopes.filter((scope) => !parentScopeSet.has(scope));
+    const widenedScopes = childScopes.filter((scope) => !withinParent({ resource: scope, matcher: "exact" }));
     if (widenedScopes.length > 0) {
         return {
             valid: false,
-            reason: `Delegation ${childDelegation.id} widens scopes beyond parent ${parentCredential.credentialSubject.delegation.id}: ${widenedScopes.join(", ")}`,
+            reason: `Delegation ${childId} widens scopes beyond parent ${parentId}: ${widenedScopes.join(", ")}`,
         };
     }
     return { valid: true };
@@ -73,7 +77,13 @@ export function validateScopeAttenuation(parentCredential, childCredential) {
  * the §11.6 re-delegation audience-constraint requirement, parent↔child linkage
  * (parentId + issuerDid==parent.subjectDid), cycle detection, scope attenuation,
  * and — when a {@link RevocationChecker} is supplied — graph-backed ancestor
- * revocation. Never throws on a malformed input; returns `{ valid, reason }`.
+ * revocation. `skipSignature` applies only to the presented leaf whose JWT
+ * envelope the caller has verified; ancestors always require verification.
+ * Each child must also be signed by its parent's subject: the claimed
+ * `issuerDid` alone is not signed evidence of who issued it. When
+ * `trustedRootIssuers` is set, the root must be signed by one of them.
+ * Success includes the earliest applicable expiry for downstream grant storage.
+ * Never throws on a malformed input; returns `{ valid, reason }`.
  */
 export async function validateDelegationChain(leafCredential, deps, options) {
     // Shape guard (validate* never-throw contract): a structurally malformed leaf
@@ -122,8 +132,32 @@ export async function validateDelegationChain(leafCredential, deps, options) {
                 reason: `Resolved delegation chain for ${leafDelegation.id} must end with the leaf credential`,
             };
         }
-        chain = leafIndex === -1 ? [...resolvedChain, leafCredential] : resolvedChain;
+        // Always validate the presented leaf. A resolver may return a copy, but it
+        // must not replace the credential whose JWT envelope was authenticated.
+        chain = [
+            ...(leafIndex === -1 ? resolvedChain : resolvedChain.slice(0, -1)),
+            leafCredential,
+        ];
     }
+    // Checked before any credential is verified, so an over-long chain costs no
+    // signature checks or DID resolutions.
+    const { maxChainLength } = deps;
+    if (maxChainLength !== undefined) {
+        if (!Number.isInteger(maxChainLength) || maxChainLength < 1) {
+            return {
+                valid: false,
+                reason: `maxChainLength must be a positive integer (got ${String(maxChainLength)})`,
+            };
+        }
+        if (chain.length > maxChainLength) {
+            return {
+                valid: false,
+                reason: `Delegation chain of ${chain.length} credentials exceeds the maximum of ${maxChainLength}`,
+            };
+        }
+    }
+    let expiresAt;
+    const warnings = [];
     const seenIds = new Set();
     let previousDelegation;
     let previousCredential;
@@ -143,7 +177,9 @@ export async function validateDelegationChain(leafCredential, deps, options) {
             };
         }
         const credentialVerification = await deps.verifier.verifyDelegationCredential(credential, {
-            ...(options?.skipSignature ? { skipSignature: true } : {}),
+            ...(options?.skipSignature && credential === leafCredential
+                ? { skipSignature: true }
+                : {}),
         });
         if (!credentialVerification.valid) {
             return {
@@ -151,6 +187,19 @@ export async function validateDelegationChain(leafCredential, deps, options) {
                 reason: `Delegation ${delegation.id} invalid: ${credentialVerification.reason}`,
             };
         }
+        // Use the already-verified walk so grant lifetime cannot outlive a shorter
+        // ancestor or constraint. Expiry/status are still rechecked on every call.
+        const deadlines = [
+            credential.expirationDate ? Date.parse(credential.expirationDate) : undefined,
+            delegation.constraints.notAfter !== undefined
+                ? delegation.constraints.notAfter * 1000
+                : undefined,
+        ];
+        for (const deadline of deadlines) {
+            if (deadline !== undefined && Number.isFinite(deadline)) {
+                expiresAt = Math.min(expiresAt ?? deadline, deadline);
+            }
+        }
         if (!verifyDelegationAudience(delegation, deps.serverDid)) {
             return {
                 valid: false,
@@ -167,6 +216,10 @@ export async function validateDelegationChain(leafCredential, deps, options) {
                 reason: `Delegation ${delegation.id} is a re-delegation (parentId: ${delegation.parentId}) but has no audience constraint. Re-delegations MUST include an audience constraint (KYA-OS §11.6)`,
             };
         }
+        // The DID whose key the verifier checked this credential against. Unlike
+        // `delegation.issuerDid`, which is only a claim inside the signed body,
+        // this is who actually issued it.
+        const signerDid = credentialIssuerDid(credential);
         if (!previousDelegation || !previousCredential) {
             if (delegation.parentId) {
                 return {
@@ -174,6 +227,16 @@ export async function validateDelegationChain(leafCredential, deps, options) {
                     reason: `Resolved delegation chain is incomplete: root delegation ${delegation.id} still references parent ${delegation.parentId}`,
                 };
             }
+            if (deps.trustedRootIssuers &&
+                (signerDid === undefined || !deps.trustedRootIssuers.includes(signerDid))) {
+                return {
+                    valid: false,
+                    reason: `Root delegation ${delegation.id} is issued by ${signerDid ?? "an unidentified issuer"}, which is not a trusted root issuer`,
+                };
+            }
+            if (signerDid !== delegation.issuerDid) {
+                warnings.push(`Root delegation ${delegation.id} names issuerDid ${delegation.issuerDid} but is signed by ${signerDid ?? "an unidentified issuer"}`);
+            }
             previousDelegation = delegation;
             previousCredential = credential;
             continue;
@@ -190,6 +253,14 @@ export async function validateDelegationChain(leafCredential, deps, options) {
                 reason: `Delegation ${delegation.id} issued by ${delegation.issuerDid} but parent subject is ${previousDelegation.subjectDid}`,
             };
         }
+        // Only the parent's delegate may re-delegate. Without this, anyone could
+        // sign a child that merely claims the parent's subject as its issuer.
+        if (signerDid !== previousDelegation.subjectDid) {
+            return {
+                valid: false,
+                reason: `Delegation ${delegation.id} is signed by ${signerDid ?? "an unidentified issuer"} but parent subject is ${previousDelegation.subjectDid}`,
+            };
+        }
         const scopeValidation = validateScopeAttenuation(previousCredential, credential);
         if (!scopeValidation.valid) {
             return scopeValidation;
@@ -206,19 +277,41 @@ export async function validateDelegationChain(leafCredential, deps, options) {
     }
     // E3.1: graph-backed ancestor revocation. Independent of how the chain above
     // was resolved — catches a cascade-revoked ANCESTOR even when the leaf's own
-    // credentialStatus bit was never flipped. Opt-in: only runs when a checker is
-    // wired, so existing callers are unaffected.
+    // credentialStatus bit was never flipped. Every credential in the verified
+    // chain is asked about, root first: a leaf minted after its ancestor was
+    // revoked was never registered, so the graph cannot reach the ancestor
+    // from the leaf's id alone. Opt-in: only runs when a checker is wired, so
+    // existing callers are unaffected.
     if (deps.revocationChecker) {
-        const revocation = await deps.revocationChecker.isRevoked(leafDelegation.id);
-        if (revocation.revoked) {
+        for (const credential of chain) {
+            const delegationId = credential.credentialSubject.delegation.id;
+            let revocation;
+            try {
+                revocation = await deps.revocationChecker.isRevoked(delegationId);
+            }
+            catch (error) {
+                return {
+                    valid: false,
+                    reason: `Revocation check failed for delegation ${delegationId}: ${error instanceof Error ? error.message : "Unknown error"}`,
+                };
+            }
+            if (!revocation.revoked) {
+                continue;
+            }
+            const revokedAncestor = revocation.revokedAncestor ??
+                (delegationId === leafDelegation.id ? undefined : delegationId);
             return {
                 valid: false,
-                reason: revocation.revokedAncestor
-                    ? `Delegation ${leafDelegation.id} is revoked via ancestor ${revocation.revokedAncestor}`
+                reason: revokedAncestor
+                    ? `Delegation ${leafDelegation.id} is revoked via ancestor ${revokedAncestor}`
                     : `Delegation ${leafDelegation.id} is revoked${revocation.reason ? `: ${revocation.reason}` : ""}`,
             };
         }
     }
-    return { valid: true };
+    return {
+        valid: true,
+        ...(expiresAt !== undefined ? { expiresAt } : {}),
+        ...(warnings.length > 0 ? { warnings } : {}),
+    };
 }
 //# sourceMappingURL=chain-enforcement.js.map

package/dist/delegation/chain-enforcement.js.map

@@ -1 +1 @@
-{"version":3,"file":"chain-enforcement.js","sourceRoot":"","sources":["../../src/delegation/chain-enforcement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,uBAAuB,GAGxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAEnE,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,UAAgC;IAClE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACzE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;QACtF,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,gBAAsC,EACtC,eAAqC;IAErC,MAAM,YAAY,GAAG,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;IACzD,MAAM,eAAe,GAAG,eAAe,CAAC,iBAAiB,CAAC,UAAU,CAAC;IAErE,wFAAwF;IACxF,4EAA4E;IAC5E,mFAAmF;IACnF,oFAAoF;IACpF,MAAM,QAAQ,GAAG,CAAC,CAAwC,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzG,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC9F,CAAC;IACF,MAAM,YAAY,GAAG,CAAC,eAAe,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAC3E,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CACrC,CAAC;IACF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,cAAc,eAAe,CAAC,EAAE,yDAAyD,gBAAgB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,YAAY;iBAC/J,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;iBACxC,IAAI,CAAC,IAAI,CAAC,EAAE;SAChB,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,cAAc,eAAe,CAAC,EAAE,2DAA2D,gBAAgB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,EAAE;SACtJ,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAChF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,cAAc,eAAe,CAAC,EAAE,gCAAgC,gBAAgB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACxJ,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAuDD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,cAAoC,EACpC,IAA0B,EAC1B,OAAqC;IAErC,8EAA8E;IAC9E,iFAAiF;IACjF,qDAAqD;IACrD,gFAAgF;IAChF,MAAM,iBAAiB,GACrB,cAAc,EAAE,iBAGjB,EAAE,UAAU,CAAC;IACd,IACE,CAAC,iBAAiB;QAClB,OAAO,iBAAiB,KAAK,QAAQ;QACrC,CAAC,iBAAiB,CAAC,WAAW;QAC9B,OAAO,iBAAiB,CAAC,WAAW,KAAK,QAAQ,EACjD,CAAC;QACD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EACJ,0FAA0F;SAC7F,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,uBAAuB,CAAC,cAAc,CAAC,CAAC;IAC/D,IAAI,KAAK,GAA2B,CAAC,cAAc,CAAC,CAAC;IAErD,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACjC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,cAAc,CAAC,EAAE,sBAAsB,cAAc,CAAC,QAAQ,sDAAsD;aAC3I,CAAC;QACJ,CAAC;QAED,IAAI,aAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uCAAuC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;aAC1G,CAAC;QACJ,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,cAAc,CAAC,EAAE,sBAAsB,cAAc,CAAC,QAAQ,kCAAkC;aACvH,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CACvC,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,cAAc,CAAC,EAAE,CACnE,CAAC;QACF,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,SAAS,KAAK,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,iCAAiC,cAAc,CAAC,EAAE,oCAAoC;aAC/F,CAAC;QACJ,CAAC;QAED,KAAK,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IAChF,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,kBAAgD,CAAC;IACrD,IAAI,kBAAoD,CAAC;IAEzD,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;QAEvD,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,qDAAqD,UAAU,CAAC,EAAE,EAAE;aAC7E,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE3B,IAAI,UAAU,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC9D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,+DAA+D;aACnG,CAAC;QACJ,CAAC;QAED,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAC3E,UAAU,EACV;YACE,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CACF,CAAC;QACF,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,CAAC;YAClC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,aAAa,sBAAsB,CAAC,MAAM,EAAE;aAChF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,wBAAwB,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,yCAAyC,IAAI,CAAC,SAAS,EAAE;aAC7F,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,4EAA4E;QAC5E,uEAAuE;QACvE,6CAA6C;QAC7C,IAAI,UAAU,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;YAC5D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,kCAAkC,UAAU,CAAC,QAAQ,qGAAqG;aAC9L,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,kBAAkB,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC/C,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,4DAA4D,UAAU,CAAC,EAAE,4BAA4B,UAAU,CAAC,QAAQ,EAAE;iBACnI,CAAC;YACJ,CAAC;YAED,kBAAkB,GAAG,UAAU,CAAC;YAChC,kBAAkB,GAAG,UAAU,CAAC;YAChC,SAAS;QACX,CAAC;QAED,IAAI,UAAU,CAAC,QAAQ,KAAK,kBAAkB,CAAC,EAAE,EAAE,CAAC;YAClD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,sBAAsB,UAAU,CAAC,QAAQ,iBAAiB,kBAAkB,CAAC,EAAE,EAAE;aACrH,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,CAAC,SAAS,KAAK,kBAAkB,CAAC,UAAU,EAAE,CAAC;YAC3D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,cAAc,UAAU,CAAC,SAAS,0BAA0B,kBAAkB,CAAC,UAAU,EAAE;aAC/H,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,wBAAwB,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;QACjF,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,kBAAkB,GAAG,UAAU,CAAC;QAChC,kBAAkB,GAAG,UAAU,CAAC;IAClC,CAAC;IAED,MAAM,eAAe,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,CAAC;IAC1E,IAAI,eAAe,CAAC,EAAE,KAAK,cAAc,CAAC,EAAE,EAAE,CAAC;QAC7C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,sCAAsC,eAAe,CAAC,EAAE,oBAAoB,cAAc,CAAC,EAAE,EAAE;SACxG,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,8EAA8E;IAC9E,6CAA6C;IAC7C,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QAC7E,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,UAAU,CAAC,eAAe;oBAChC,CAAC,CAAC,cAAc,cAAc,CAAC,EAAE,4BAA4B,UAAU,CAAC,eAAe,EAAE;oBACzF,CAAC,CAAC,cAAc,cAAc,CAAC,EAAE,cAAc,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACrG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC"}
+{"version":3,"file":"chain-enforcement.js","sourceRoot":"","sources":["../../src/delegation/chain-enforcement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,uBAAuB,GAGxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,UAAgC;IAClE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACzE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;QACtF,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CACtC,gBAAsC,EACtC,eAAqC;IAErC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,eAAe,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;IAChE,MAAM,eAAe,GAAG,cAAc,CAAC,gBAAgB,CAAC,CAAC;IACzD,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,MAAM,WAAW,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,cAAc,OAAO,2DAA2D,QAAQ,EAAE;SACnG,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;IACxD,MAAM,eAAe,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9E,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,cAAc,OAAO,qDAAqD,QAAQ,KAAK,eAAe;iBAC3G,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC;iBAC1C,IAAI,CAAC,IAAI,CAAC,EAAE;SAChB,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC1G,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,cAAc,OAAO,gCAAgC,QAAQ,KAAK,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACrG,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAiFD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,cAAoC,EACpC,IAA0B,EAC1B,OAAqC;IAErC,8EAA8E;IAC9E,iFAAiF;IACjF,qDAAqD;IACrD,gFAAgF;IAChF,MAAM,iBAAiB,GACrB,cAAc,EAAE,iBAGjB,EAAE,UAAU,CAAC;IACd,IACE,CAAC,iBAAiB;QAClB,OAAO,iBAAiB,KAAK,QAAQ;QACrC,CAAC,iBAAiB,CAAC,WAAW;QAC9B,OAAO,iBAAiB,CAAC,WAAW,KAAK,QAAQ,EACjD,CAAC;QACD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EACJ,0FAA0F;SAC7F,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,uBAAuB,CAAC,cAAc,CAAC,CAAC;IAC/D,IAAI,KAAK,GAA2B,CAAC,cAAc,CAAC,CAAC;IAErD,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACjC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,cAAc,CAAC,EAAE,sBAAsB,cAAc,CAAC,QAAQ,sDAAsD;aAC3I,CAAC;QACJ,CAAC;QAED,IAAI,aAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uCAAuC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;aAC1G,CAAC;QACJ,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,cAAc,CAAC,EAAE,sBAAsB,cAAc,CAAC,QAAQ,kCAAkC;aACvH,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CACvC,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,cAAc,CAAC,EAAE,CACnE,CAAC;QACF,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,SAAS,KAAK,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,iCAAiC,cAAc,CAAC,EAAE,oCAAoC;aAC/F,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,wEAAwE;QACxE,KAAK,GAAG;YACN,GAAG,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAClE,cAAc;SACf,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,uCAAuC;IACvC,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAChC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;YAC5D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,kDAAkD,MAAM,CAAC,cAAc,CAAC,GAAG;aACpF,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;YAClC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uBAAuB,KAAK,CAAC,MAAM,uCAAuC,cAAc,EAAE;aACnG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,SAA6B,CAAC;IAClC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,kBAAgD,CAAC;IACrD,IAAI,kBAAoD,CAAC;IAEzD,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;QAEvD,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,qDAAqD,UAAU,CAAC,EAAE,EAAE;aAC7E,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE3B,IAAI,UAAU,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC9D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,+DAA+D;aACnG,CAAC;QACJ,CAAC;QAED,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAC3E,UAAU,EACV;YACE,GAAG,CAAC,OAAO,EAAE,aAAa,IAAI,UAAU,KAAK,cAAc;gBACzD,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE;gBACzB,CAAC,CAAC,EAAE,CAAC;SACR,CACF,CAAC;QACF,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,CAAC;YAClC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,aAAa,sBAAsB,CAAC,MAAM,EAAE;aAChF,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,2EAA2E;QAC3E,MAAM,SAAS,GAAG;YAChB,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS;YAC7E,UAAU,CAAC,WAAW,CAAC,QAAQ,KAAK,SAAS;gBAC3C,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,GAAG,IAAI;gBACxC,CAAC,CAAC,SAAS;SACd,CAAC;QACF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxD,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,IAAI,CAAC,wBAAwB,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,yCAAyC,IAAI,CAAC,SAAS,EAAE;aAC7F,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,4EAA4E;QAC5E,uEAAuE;QACvE,6CAA6C;QAC7C,IAAI,UAAU,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;YAC5D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,kCAAkC,UAAU,CAAC,QAAQ,qGAAqG;aAC9L,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,wEAAwE;QACxE,kCAAkC;QAClC,MAAM,SAAS,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAElD,IAAI,CAAC,kBAAkB,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC/C,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,4DAA4D,UAAU,CAAC,EAAE,4BAA4B,UAAU,CAAC,QAAQ,EAAE;iBACnI,CAAC;YACJ,CAAC;YAED,IACE,IAAI,CAAC,kBAAkB;gBACvB,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EACzE,CAAC;gBACD,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,mBAAmB,UAAU,CAAC,EAAE,iBAAiB,SAAS,IAAI,wBAAwB,sCAAsC;iBACrI,CAAC;YACJ,CAAC;YAED,IAAI,SAAS,KAAK,UAAU,CAAC,SAAS,EAAE,CAAC;gBACvC,QAAQ,CAAC,IAAI,CACX,mBAAmB,UAAU,CAAC,EAAE,oBAAoB,UAAU,CAAC,SAAS,qBAAqB,SAAS,IAAI,wBAAwB,EAAE,CACrI,CAAC;YACJ,CAAC;YAED,kBAAkB,GAAG,UAAU,CAAC;YAChC,kBAAkB,GAAG,UAAU,CAAC;YAChC,SAAS;QACX,CAAC;QAED,IAAI,UAAU,CAAC,QAAQ,KAAK,kBAAkB,CAAC,EAAE,EAAE,CAAC;YAClD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,sBAAsB,UAAU,CAAC,QAAQ,iBAAiB,kBAAkB,CAAC,EAAE,EAAE;aACrH,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,CAAC,SAAS,KAAK,kBAAkB,CAAC,UAAU,EAAE,CAAC;YAC3D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,cAAc,UAAU,CAAC,SAAS,0BAA0B,kBAAkB,CAAC,UAAU,EAAE;aAC/H,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,sEAAsE;QACtE,IAAI,SAAS,KAAK,kBAAkB,CAAC,UAAU,EAAE,CAAC;YAChD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,iBAAiB,SAAS,IAAI,wBAAwB,0BAA0B,kBAAkB,CAAC,UAAU,EAAE;aACnJ,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,wBAAwB,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;QACjF,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,kBAAkB,GAAG,UAAU,CAAC;QAChC,kBAAkB,GAAG,UAAU,CAAC;IAClC,CAAC;IAED,MAAM,eAAe,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,CAAC;IAC1E,IAAI,eAAe,CAAC,EAAE,KAAK,cAAc,CAAC,EAAE,EAAE,CAAC;QAC7C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,sCAAsC,eAAe,CAAC,EAAE,oBAAoB,cAAc,CAAC,EAAE,EAAE;SACxG,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,0EAA0E;IAC1E,mCAAmC;IACnC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;YAC/B,MAAM,YAAY,GAAG,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;YAChE,IAAI,UAA+D,CAAC;YACpE,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,0CAA0C,YAAY,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;iBAC9H,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,MAAM,eAAe,GACnB,UAAU,CAAC,eAAe;gBAC1B,CAAC,YAAY,KAAK,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YAClE,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,eAAe;oBACrB,CAAC,CAAC,cAAc,cAAc,CAAC,EAAE,4BAA4B,eAAe,EAAE;oBAC9E,CAAC,CAAC,cAAc,cAAc,CAAC,EAAE,cAAc,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACrG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACJ,CAAC"}

package/dist/delegation/delegation-graph.d.ts

@@ -6,13 +6,27 @@
  *
  * Related Spec: KYA-OS §4.4, Delegation Chains
  */
+import type { CredentialStatus } from '../types/protocol.js';
 export interface DelegationNode {
     id: string;
     parentId: string | null;
     children: string[];
     issuerDid: string;
     subjectDid: string;
+    /**
+     * Reference to the node's status list entry. Revocation flips a status bit
+     * only when it has the form `<statusListCredential>#<index>`; prefer
+     * {@link credentialStatus}, which needs no parsing.
+     */
     credentialStatusId?: string;
+    /** The node's status list entry, as carried in the credential. */
+    credentialStatus?: CredentialStatus;
+    /**
+     * Set when the delegation is revoked in the graph (SPEC.md §6.5 step 1).
+     * Recorded independently of the status list bit, so revocation holds even
+     * for a delegation that has no status list entry.
+     */
+    revoked?: boolean;
 }
 export interface DelegationGraphStorageProvider {
     getNode(delegationId: string): Promise<DelegationNode | null>;
@@ -24,6 +38,13 @@ export interface DelegationGraphStorageProvider {
 }
 /** Optional transaction seam for providers that can link parent and child atomically. */
 export interface AtomicDelegationGraphStorageProvider extends DelegationGraphStorageProvider {
+    /**
+     * Insert `node` and link it under its parent in one step. When the id is
+     * already stored, a node identical in every registered field is a no-op,
+     * and any other SHOULD be rejected: overwriting would drop the stored node's
+     * revocation state and children. `DelegationGraphManager` checks first, but
+     * only the provider can close the race between that check and the write.
+     */
     registerNodeAtomic(node: DelegationNode): Promise<void>;
 }
 export declare class DelegationGraphManager {
@@ -35,9 +56,18 @@ export declare class DelegationGraphManager {
         issuerDid: string;
         subjectDid: string;
         credentialStatusId?: string;
+        credentialStatus?: CredentialStatus;
     }): Promise<DelegationNode>;
     private addChildToParent;
     getNode(delegationId: string): Promise<DelegationNode | null>;
+    /**
+     * Record (or clear) the graph's revocation mark on one node, and report
+     * whether the stored node now carries it. The node is read back because a
+     * provider that persists a fixed set of node fields may silently drop
+     * `revoked`. Descendants are left to the caller; cascading revocation walks
+     * the subtree itself.
+     */
+    setRevoked(delegationId: string, revoked: boolean): Promise<boolean>;
     getChildren(delegationId: string): Promise<DelegationNode[]>;
     getDescendants(delegationId: string): Promise<DelegationNode[]>;
     getChain(delegationId: string): Promise<DelegationNode[]>;
@@ -50,4 +80,3 @@ export declare class DelegationGraphManager {
     removeDelegation(delegationId: string): Promise<void>;
 }
 export declare function createDelegationGraph(storage: DelegationGraphStorageProvider): DelegationGraphManager;
-//# sourceMappingURL=delegation-graph.d.ts.map

package/dist/delegation/delegation-graph.js

@@ -6,6 +6,7 @@
  *
  * Related Spec: KYA-OS §4.4, Delegation Chains
  */
+import { registrationConflict } from './delegation-registration.js';
 function supportsAtomicRegistration(storage) {
     return 'registerNodeAtomic' in storage &&
         typeof storage.registerNodeAtomic === 'function';
@@ -23,13 +24,29 @@ export class DelegationGraphManager {
             issuerDid: params.issuerDid,
             subjectDid: params.subjectDid,
             credentialStatusId: params.credentialStatusId,
+            ...(params.credentialStatus ? { credentialStatus: params.credentialStatus } : {}),
         };
+        if (params.parentId === params.id) {
+            throw new Error(`Delegation ${params.id} cannot be its own parent`);
+        }
         if (params.parentId) {
             const parent = await this.storage.getNode(params.parentId);
             if (!parent) {
                 throw new Error(`Parent delegation not found: ${params.parentId}`);
             }
         }
+        // Registering an id again is a no-op when nothing registered changes, so
+        // a retry is safe. Anything else would replace the stored node, losing its
+        // revocation state and children or relinking it under its own descendant,
+        // so it is refused.
+        const existing = await this.storage.getNode(params.id);
+        if (existing) {
+            const conflict = registrationConflict(existing, node);
+            if (conflict === undefined) {
+                return existing;
+            }
+            throw new Error(`Delegation ${params.id} is already registered with a different ${conflict}`);
+        }
         if (supportsAtomicRegistration(this.storage)) {
             await this.storage.registerNodeAtomic(node);
         }
@@ -65,6 +82,22 @@ export class DelegationGraphManager {
     async getNode(delegationId) {
         return this.storage.getNode(delegationId);
     }
+    /**
+     * Record (or clear) the graph's revocation mark on one node, and report
+     * whether the stored node now carries it. The node is read back because a
+     * provider that persists a fixed set of node fields may silently drop
+     * `revoked`. Descendants are left to the caller; cascading revocation walks
+     * the subtree itself.
+     */
+    async setRevoked(delegationId, revoked) {
+        const node = await this.storage.getNode(delegationId);
+        if (!node) {
+            throw new Error(`Delegation not found: ${delegationId}`);
+        }
+        await this.storage.setNode({ ...node, revoked });
+        const stored = await this.storage.getNode(delegationId);
+        return (stored?.revoked ?? false) === revoked;
+    }
     async getChildren(delegationId) {
         return this.storage.getChildren(delegationId);
     }

package/dist/delegation/delegation-graph.js.map

@@ -1 +1 @@
-{"version":3,"file":"delegation-graph.js","sourceRoot":"","sources":["../../src/delegation/delegation-graph.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAyBH,SAAS,0BAA0B,CACjC,OAAuC;IAEvC,OAAO,oBAAoB,IAAI,OAAO;QACpC,OAAO,OAAO,CAAC,kBAAkB,KAAK,UAAU,CAAC;AACrD,CAAC;AAED,MAAM,OAAO,sBAAsB;IACb;IAApB,YAAoB,OAAuC;QAAvC,YAAO,GAAP,OAAO,CAAgC;IAAG,CAAC;IAE/D,KAAK,CAAC,kBAAkB,CAAC,MAMxB;QACC,MAAM,IAAI,GAAmB;YAC3B,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;SAC9C,CAAC;QAEF,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QAED,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC1D,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAC3C,CAAC;oBAAC,OAAO,aAAa,EAAE,CAAC;wBACvB,MAAM,IAAI,cAAc,CACtB,CAAC,KAAK,EAAE,aAAa,CAAC,EACtB,wEAAwE,EACxE,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;oBACJ,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,QAAgB,EAAE,OAAe;QAC9D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAoB;QAChC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,YAAoB;QACpC,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,YAAoB;QACvC,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,YAAoB;QACjC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAAkB,EAAE,YAAoB;QACvD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,YAAoB;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,YAAoB;QACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAEhD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QAC1D,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YAExB,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC1C,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,kBAAkB,KAAK,CAAC,EAAE,cAAc,KAAK,CAAC,SAAS,eAAe,MAAM,CAAC,EAAE,eAAe,MAAM,CAAC,UAAU,EAAE;iBAC1H,CAAC;YACJ,CAAC;YAED,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;gBACjC,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,kBAAkB,KAAK,CAAC,EAAE,aAAa,KAAK,CAAC,QAAQ,yBAAyB,MAAM,CAAC,EAAE,EAAE;iBAClG,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,YAAoB;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;gBACtE,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAuC;IAEvC,OAAO,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"delegation-graph.js","sourceRoot":"","sources":["../../src/delegation/delegation-graph.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AA6CpE,SAAS,0BAA0B,CACjC,OAAuC;IAEvC,OAAO,oBAAoB,IAAI,OAAO;QACpC,OAAO,OAAO,CAAC,kBAAkB,KAAK,UAAU,CAAC;AACrD,CAAC;AAED,MAAM,OAAO,sBAAsB;IACb;IAApB,YAAoB,OAAuC;QAAvC,YAAO,GAAP,OAAO,CAAgC;IAAG,CAAC;IAE/D,KAAK,CAAC,kBAAkB,CAAC,MAOxB;QACC,MAAM,IAAI,GAAmB;YAC3B,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClF,CAAC;QAEF,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,cAAc,MAAM,CAAC,EAAE,2BAA2B,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,oBAAoB;QACpB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACtD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,MAAM,IAAI,KAAK,CACb,cAAc,MAAM,CAAC,EAAE,2CAA2C,QAAQ,EAAE,CAC7E,CAAC;QACJ,CAAC;QAED,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC1D,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAC3C,CAAC;oBAAC,OAAO,aAAa,EAAE,CAAC;wBACvB,MAAM,IAAI,cAAc,CACtB,CAAC,KAAK,EAAE,aAAa,CAAC,EACtB,wEAAwE,EACxE,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;oBACJ,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,QAAgB,EAAE,OAAe;QAC9D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAoB;QAChC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,YAAoB,EAAE,OAAgB;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACxD,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,KAAK,OAAO,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,YAAoB;QACpC,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,YAAoB;QACvC,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,YAAoB;QACjC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAAkB,EAAE,YAAoB;QACvD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,YAAoB;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,YAAoB;QACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAEhD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QAC1D,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YAExB,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC1C,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,kBAAkB,KAAK,CAAC,EAAE,cAAc,KAAK,CAAC,SAAS,eAAe,MAAM,CAAC,EAAE,eAAe,MAAM,CAAC,UAAU,EAAE;iBAC1H,CAAC;YACJ,CAAC;YAED,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;gBACjC,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,kBAAkB,KAAK,CAAC,EAAE,aAAa,KAAK,CAAC,QAAQ,yBAAyB,MAAM,CAAC,EAAE,EAAE;iBAClG,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,YAAoB;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;gBACtE,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAuC;IAEvC,OAAO,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC"}

package/dist/delegation/delegation-registration.d.ts

@@ -0,0 +1,22 @@
+/**
+ * When registering an already-registered delegation id is a harmless repeat
+ * and when it is a conflict — one rule shared by `DelegationGraphManager` and
+ * the memory store's atomic path.
+ *
+ * Internal: not re-exported from the delegation barrel.
+ */
+import type { DelegationNode } from './delegation-graph.js';
+/**
+ * The first caller-supplied field on which `incoming` differs from the stored
+ * node, or `undefined` when registering it again would change nothing.
+ *
+ * Compared: every field a caller passes to `registerDelegation` — `parentId`,
+ * `issuerDid`, `subjectDid`, `credentialStatusId` and `credentialStatus`. An
+ * absent field, `undefined` and `null` are the same, since a store that
+ * persists nodes may drop or null out any of them. Not compared: `children`,
+ * which later registrations of other nodes derive, and `revoked`, which
+ * revocation sets. A repeat registration supplies neither, so it must leave
+ * both as stored: overwriting them is what read a revoked subtree as live
+ * again.
+ */
+export declare function registrationConflict(stored: DelegationNode, incoming: DelegationNode): string | undefined;

package/dist/delegation/delegation-registration.js

@@ -0,0 +1,51 @@
+/**
+ * When registering an already-registered delegation id is a harmless repeat
+ * and when it is a conflict — one rule shared by `DelegationGraphManager` and
+ * the memory store's atomic path.
+ *
+ * Internal: not re-exported from the delegation barrel.
+ */
+/**
+ * The first caller-supplied field on which `incoming` differs from the stored
+ * node, or `undefined` when registering it again would change nothing.
+ *
+ * Compared: every field a caller passes to `registerDelegation` — `parentId`,
+ * `issuerDid`, `subjectDid`, `credentialStatusId` and `credentialStatus`. An
+ * absent field, `undefined` and `null` are the same, since a store that
+ * persists nodes may drop or null out any of them. Not compared: `children`,
+ * which later registrations of other nodes derive, and `revoked`, which
+ * revocation sets. A repeat registration supplies neither, so it must leave
+ * both as stored: overwriting them is what read a revoked subtree as live
+ * again.
+ */
+export function registrationConflict(stored, incoming) {
+    if ((stored.parentId ?? null) !== (incoming.parentId ?? null))
+        return 'parentId';
+    if (stored.issuerDid !== incoming.issuerDid)
+        return 'issuerDid';
+    if (stored.subjectDid !== incoming.subjectDid)
+        return 'subjectDid';
+    if ((stored.credentialStatusId ?? undefined) !== (incoming.credentialStatusId ?? undefined)) {
+        return 'credentialStatusId';
+    }
+    if (!sameStatusEntry(stored.credentialStatus, incoming.credentialStatus)) {
+        return 'credentialStatus';
+    }
+    return undefined;
+}
+/**
+ * Member-wise equality of two status entries, in any member order. Members are
+ * compared by value when they are strings, as every standard member is;
+ * anything nested compares by identity, so an unusual entry reads as a
+ * conflict rather than a repeat.
+ */
+function sameStatusEntry(a, b) {
+    if (!a || !b) {
+        return !a && !b;
+    }
+    const left = a;
+    const right = b;
+    const keys = new Set([...Object.keys(left), ...Object.keys(right)]);
+    return [...keys].every((key) => (left[key] ?? undefined) === (right[key] ?? undefined));
+}
+//# sourceMappingURL=delegation-registration.js.map

package/dist/delegation/delegation-registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-registration.js","sourceRoot":"","sources":["../../src/delegation/delegation-registration.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAsB,EACtB,QAAwB;IAExB,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,IAAI,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IACjF,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;QAAE,OAAO,WAAW,CAAC;IAChE,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;QAAE,OAAO,YAAY,CAAC;IACnE,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,IAAI,SAAS,CAAC,EAAE,CAAC;QAC5F,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzE,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CACtB,CAAsC,EACtC,CAAsC;IAEtC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACb,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,CAAuC,CAAC;IACrD,MAAM,KAAK,GAAG,CAAuC,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC;AAC1F,CAAC"}

package/dist/delegation/delegation-status-entry.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The status list entry behind a delegation graph node — one reading shared by
+ * cascading revocation, which flips and reads it.
+ *
+ * Internal: not re-exported from the delegation barrel.
+ */
+import type { CredentialStatus } from '../types/protocol.js';
+import type { DelegationNode } from './delegation-graph.js';
+/**
+ * Read a legacy `credentialStatusId` as a revocation status list entry, or
+ * `undefined` when it does not name a list and an index. A W3C
+ * `credentialStatus.id` may be any URI (`urn:uuid:…`, say); such a node has no
+ * bit to flip, and the graph's own `revoked` mark carries its revocation. An
+ * index past the safe integer range throws: it names an entry, just not one
+ * any list can hold, so it must not read as "no entry".
+ */
+export declare function parseCredentialStatusId(credentialStatusId: string): CredentialStatus | undefined;
+/**
+ * The node's status list entry: the structured `credentialStatus` when stored,
+ * else the parsed legacy `credentialStatusId`, else `undefined` (no entry).
+ */
+export declare function nodeStatusEntry(node: DelegationNode): CredentialStatus | undefined;

package/dist/delegation/delegation-status-entry.js

@@ -0,0 +1,42 @@
+/**
+ * The status list entry behind a delegation graph node — one reading shared by
+ * cascading revocation, which flips and reads it.
+ *
+ * Internal: not re-exported from the delegation barrel.
+ */
+import { parseStatusListIndex } from '../utils/statuslist-bits.js';
+/** `<statusListCredential>#<index>`, the form the status list manager mints. */
+const STATUS_ENTRY_ID = /^(.+)#(\d+)$/;
+/**
+ * Read a legacy `credentialStatusId` as a revocation status list entry, or
+ * `undefined` when it does not name a list and an index. A W3C
+ * `credentialStatus.id` may be any URI (`urn:uuid:…`, say); such a node has no
+ * bit to flip, and the graph's own `revoked` mark carries its revocation. An
+ * index past the safe integer range throws: it names an entry, just not one
+ * any list can hold, so it must not read as "no entry".
+ */
+export function parseCredentialStatusId(credentialStatusId) {
+    const match = STATUS_ENTRY_ID.exec(credentialStatusId);
+    if (!match) {
+        return undefined;
+    }
+    const [, statusListCredential, index] = match;
+    return {
+        id: credentialStatusId,
+        type: 'StatusList2021Entry',
+        statusPurpose: 'revocation',
+        statusListIndex: String(parseStatusListIndex(index)),
+        statusListCredential: statusListCredential,
+    };
+}
+/**
+ * The node's status list entry: the structured `credentialStatus` when stored,
+ * else the parsed legacy `credentialStatusId`, else `undefined` (no entry).
+ */
+export function nodeStatusEntry(node) {
+    if (node.credentialStatus) {
+        return node.credentialStatus;
+    }
+    return node.credentialStatusId ? parseCredentialStatusId(node.credentialStatusId) : undefined;
+}
+//# sourceMappingURL=delegation-status-entry.js.map

package/dist/delegation/delegation-status-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-status-entry.js","sourceRoot":"","sources":["../../src/delegation/delegation-status-entry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGnE,gFAAgF;AAChF,MAAM,eAAe,GAAG,cAAc,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,kBAA0B;IAChE,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC;IAC9C,OAAO;QACL,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,qBAAqB;QAC3B,aAAa,EAAE,YAAY;QAC3B,eAAe,EAAE,MAAM,CAAC,oBAAoB,CAAC,KAAM,CAAC,CAAC;QACrD,oBAAoB,EAAE,oBAAqB;KAC5C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAoB;IAClD,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChG,CAAC"}

package/dist/delegation/did-key-resolver.d.ts

@@ -65,4 +65,3 @@ export declare function createDidKeyResolver(): DIDResolver;
  * @returns DID Document or null if invalid
  */
 export declare function resolveDidKeySync(did: string): DIDDocument | null;
-//# sourceMappingURL=did-key-resolver.d.ts.map

package/dist/delegation/did-key-resolver.js

@@ -21,6 +21,14 @@ import { logger } from '../logging/index.js';
 export const ED25519_MULTICODEC_PREFIX = new Uint8Array([0xed, 0x01]);
 /** Ed25519 public key length */
 export const ED25519_PUBLIC_KEY_LENGTH = 32;
+/**
+ * Longest base58btc part (after `did:key:z`) worth decoding. Every Ed25519
+ * did:key encodes exactly 34 bytes (the 0xed01 prefix and the 32-byte key),
+ * which is always 47 characters, so a longer string cannot be one. The bound
+ * leaves headroom over 47 while keeping an attacker-sized DID (a proof's
+ * `meta.did`, a credential's issuer or subject) away from the decoder.
+ */
+const MAX_DID_KEY_BASE58_LENGTH = 64;
 /**
  * Check if a DID is a valid did:key with Ed25519 key
  *
@@ -49,10 +57,13 @@ export function extractPublicKeyFromDidKey(did) {
         const multibaseKey = did.replace('did:key:', '');
         // Remove the 'z' multibase prefix (base58btc)
         const base58Encoded = multibaseKey.slice(1);
-        // Decode from base58
-        const multicodecBytes = base58Decode(base58Encoded);
-        // Check for Ed25519 multicodec prefix (0xed 0x01)
-        if (multicodecBytes.length < ED25519_MULTICODEC_PREFIX.length + ED25519_PUBLIC_KEY_LENGTH ||
+        // Bounded before decoding (base58 decoding is quadratic in input length):
+        // anything longer than an Ed25519 did:key throws here, unread, and the
+        // catch below returns null.
+        const multicodecBytes = base58Decode(base58Encoded, MAX_DID_KEY_BASE58_LENGTH);
+        // Exactly the Ed25519 multicodec prefix (0xed 0x01) and a 32-byte key:
+        // trailing bytes are not part of any key.
+        if (multicodecBytes.length !== ED25519_MULTICODEC_PREFIX.length + ED25519_PUBLIC_KEY_LENGTH ||
             multicodecBytes[0] !== ED25519_MULTICODEC_PREFIX[0] ||
             multicodecBytes[1] !== ED25519_MULTICODEC_PREFIX[1]) {
             return null;