@kya-os/mcp 1.17.0 → 1.20.0

package/SPEC.md

@@ -513,6 +513,33 @@ Delegations are issued as W3C Verifiable Credentials:
 }
 ```
 
+**The proof.** The example's `proof.type` is `Ed25519Signature2020`, but this
+profile does not use the W3C suite of that name, and a W3C Data Integrity
+verifier will not verify it. A conformant issuer produces, and a conformant
+verifier checks, exactly this:
+
+- **Signing input.** The UTF-8 bytes of the RFC 8785 (JCS) canonicalization of
+  the credential with its `proof` member removed. There is no RDF
+  canonicalization and no hash of the proof options.
+- **Signature.** Ed25519 (RFC 8032), 64 bytes.
+- **`proofValue`.** The signature as base64url without padding (86 characters),
+  with no multibase prefix.
+- **Key.** The verification method in the issuer's DID document whose `id`
+  equals `proof.verificationMethod`.
+- **`proof.type`.** Issuers set `Ed25519Signature2020`. A verifier MAY also
+  accept `DataIntegrityProof` for the same construction, and MUST reject any
+  other `proof.type`.
+
+The other `proof` members (`type`, `created`, `verificationMethod`,
+`proofPurpose`) are not covered by the signature; a verifier uses
+`verificationMethod` only to select the key. The `StatusList2021Credential` of
+§6.6 is signed the same way. The delegation credentials in the
+`delegation-chain` and `status-list` conformance vectors, and the status
+lists in the `status-list` vectors, carry this construction. Whether 2.0
+moves this profile to a standard cryptosuite is tracked in [#184](https://github.com/decentralized-identity/kya-os-mcp/issues/184).
+The §6.10 profile uses `DataIntegrityProof` with `eddsa-jcs-2022` and is not
+affected.
+
 A `DelegationCredential` carries a _permission_, not a _claim_. To keep claim
 semantics out of an authorization decision — a confused-deputy vector (§11.6) —
 the `credentialSubject` MUST contain only two properties: `id` (the delegate's
@@ -604,6 +631,12 @@ Delegations form a directed acyclic graph (DAG):
 - Scope constraints MUST be equal to or narrower than parent's constraints
 - Every chain MUST terminate at a Responsible Party. The Responsible Party's DID is the `issuerDid` of the root `DelegationCredential` and is the entity ultimately accountable for actions taken under any descendant delegation. In personal use the Responsible Party equals the Principal; in organizational use the Responsible Party is the parent organization while the Principal is the immediate human delegator (see §2).
 
+**Chain length (non-normative).** The §6.2 profile does not limit how many times authority may be
+re-delegated. Separately, a verifier may cap how many credentials it will verify for one request, as
+a local resource limit: each credential costs a signature check and possibly a DID resolution. The
+reference implementation exposes this as `maxChainLength`, unset by default. Such a cap is the
+verifier's policy, not a protocol rule, and a chain it refuses is not thereby invalid elsewhere.
+
 ### 6.4.1 Designation Invariant
 
 A `DelegationCredential` may authorize multiple resources, either via a list
@@ -712,6 +745,10 @@ KYA-OS uses the W3C StatusList2021 specification for revocation:
 }
 ```
 
+A verifier that reads a `StatusList2021Credential` MUST verify its proof, as
+§6.2 states, before reading any bit. A list whose proof does not verify is
+unresolvable: the credential it covers is rejected, never read as active.
+
 L1 implementations do not require revocation support; revocation checking is available at L3 only.
 
 Revocation does not require a globally accessible list. A verifier only needs to
@@ -792,6 +829,11 @@ profile issues and verifies, this profile is what the Entity Card path issues an
 implementation encountering one never needs to accept the other in its place. The JSON Schema is
 published at `schemas/card-delegation-credential.json`.
 
+**Telling the profiles apart (non-normative).** Neither profile carries a separate profile
+identifier; the first `@context` entry selects the rule set. `https://www.w3.org/2018/credentials/v1`
+marks a §6.2 credential, and `https://www.w3.org/ns/credentials/v2`, with the ZCAP-LD context,
+marks a credential of this profile.
+
 **Credential shape.** One `DelegationCredential` per delegation **hop**; a chain runs `root → … → leaf`. A
 `DelegationCredential` is a VC 2.0 whose `credentialSubject` IS an attenuated ZCAP-LD capability:
 
@@ -839,11 +881,19 @@ chain:
   re-delegate what was delegated to YOUR key), and child `parentCapability` MUST reference the
   parent capability `id`;
 - **constant `invocationTarget`** along the chain;
-- **depth** MUST NOT exceed **10** hops (`MAX_DELEGATION_DEPTH`);
 - **root** - root `parentCapability` MUST equal its `invocationTarget` (the resource); when a
   resource owner / resource is asserted, root `issuer` MUST equal the resource owner and root
   `invocationTarget` MUST equal the resource.
 
+**Chain length (non-normative).** As in §6.4, this profile does not limit how many times a
+capability may be re-delegated. Earlier drafts listed a 10-hop cap among the invariants above,
+but a longer chain broadens nothing, so it was never an attenuation rule. A verifier may cap how
+many credentials it evaluates for one chain as a local resource limit: each hop may cost a
+signature check and a status-list fetch. The reference implementation takes the same
+`maxChainLength` option here, unset by default, and exports `MAX_DELEGATION_DEPTH` (10) as a
+suggested value. Such a cap is the verifier's policy, not a protocol rule, and a chain it refuses
+is not thereby invalid elsewhere.
+
 A verifying resource SHOULD assert its own identity as the expected resource when it evaluates a
 chain (the `resource` context of `evaluateDelegationChain`), so that a chain minted for a
 different resource fails at the root check instead of being accepted by an unrelated Verifier.
@@ -852,9 +902,12 @@ different resource fails at the root check instead of being accepted by an unrel
 (`BitstringStatusListEntry`) - the **successor to** the deprecated StatusList2021 - behind a
 pluggable `RevocationChecker` seam so status-list churn never reaches callers. The default checker
 resolves `statusListCredential` via SafeFetch (§6.6), inflates the multibase (`u` = base64url) +
-GZIP `encodedList`, and reads the bit at `statusListIndex` MSB-first within each byte. It is
-**fail-closed**: an unreachable list, malformed credential, mismatched `statusPurpose`, or
-out-of-range index all resolve to `{ revoked: true }`. Each verdict also reports `fresh` - `true`
+GZIP `encodedList`, and reads the bit at `statusListIndex` MSB-first within each byte. A verifier
+MUST verify the status list credential's proof before it reads a bit, as Bitstring Status List
+v1.0 requires. The reference checker does so when given its `verifyStatusList` seam (optional
+until 2.0) and ships a verifier for `eddsa-jcs-2022` lists. It is **fail-closed**: an unreachable
+list, malformed credential, rejected list proof, mismatched `statusPurpose`, or out-of-range index
+all resolve to `{ revoked: true }`. Each verdict also reports `fresh` - `true`
 only when read from a live, in-validity-window (`validFrom`/`validUntil`, or
 `issuanceDate`/`expirationDate`) status list. The chain walk is **cascading**: root→leaf,
 short-circuiting on the first revoked/unresolvable hop (a revoked ancestor invalidates the subtree),

package/dist/card/cimd.js

@@ -27,6 +27,7 @@
  * no runtime (mcp-i-core) dependency leaks into `@kya-os/mcp`.
  */
 import { isRecord } from '../utils/guards.js';
+import { verificationMethodJwk } from '../delegation/verification-method-key.js';
 import { parseCard } from './resolve.js';
 /** The OAuth `client_id` metadata-document prefix this module transforms. */
 const DID_WEB_PREFIX = 'did:web:';
@@ -208,11 +209,14 @@ function urlOrigin(url) {
         return null;
     }
 }
-/** Project one verification method to a public OKP JWK (Ed25519 only; `d` stripped), or null. */
+/**
+ * Project one verification method to a public OKP JWK (Ed25519 only; `d` stripped), or null.
+ * The key may be published as `publicKeyJwk`, `publicKeyMultibase`, or `publicKeyBase58`.
+ */
 function vmToOkpJwk(vm) {
     if (!isRecord(vm))
         return null;
-    const jwk = vm.publicKeyJwk;
+    const jwk = verificationMethodJwk(vm);
     if (!isRecord(jwk) || jwk.kty !== 'OKP' || jwk.crv !== 'Ed25519' || typeof jwk.x !== 'string') {
         return null;
     }

package/dist/card/cimd.js.map

@@ -1 +1 @@
-{"version":3,"file":"cimd.js","sourceRoot":"","sources":["../../src/card/cimd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,6EAA6E;AAC7E,MAAM,cAAc,GAAG,UAAU,CAAC;AAElC,kFAAkF;AAClF,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAEjD,gFAAgF;AAChF,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAwBpD,iFAAiF;AAEjF;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,gEAAgE,GAAG,IAAI,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,CAAC,SAAS,EAAE,GAAG,QAAQ,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,yBAAyB,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,OAAO,WAAW,SAAS,GAAG,IAAI,EAAE,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mDAAmD,QAAQ,IAAI,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,kDAAkD,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC7F,OAAO,GAAG,cAAc,GAAG,CAAC,SAAS,EAAE,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,kFAAkF;AAElF;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,MAAe;IAC1C,MAAM,GAAG,GACP,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;IAChG,MAAM,IAAI,GAAuB,EAAE,CAAC;IACpC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,GAAG;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAED,kFAAkF;AAElF;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAgB,EAAE,IAAyB;IAC1E,OAAO;QACL,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,WAAW,EAAE,IAAI,CAAC,IAAI;QACtB,0BAA0B,EAAE,eAAe;QAC3C,QAAQ,EAAE,IAAI,CAAC,OAAO;QACtB,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE;KAC1C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAa;IAClD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;IAChC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,MAAM,IAAI,GAA4B;QACpC,EAAE,EAAE,GAAG;QACP,UAAU,EAAE,QAAQ;QACpB,IAAI,EAAE,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG;KACnG,CAAC;IACF,IAAI,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC7D,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,kFAAkF;AAElF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,IAAiB,EAAE,MAAe,EAAE,WAAoB;IACrF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,IAAI,WAAW,KAAK,SAAS,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC,oBAAoB,KAAK,4BAA4B,WAAW,GAAG,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,IAAI,KAAK,CAAC;IAEjC,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAEjE,IAAI,SAAS,IAAI,YAAY,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,6BAA6B,SAAS,oBAAoB,YAAY,GAAG,CAAC,CAAC;IAC1F,CAAC;SAAM,IAAI,WAAW,KAAK,SAAS,IAAI,SAAS,IAAI,YAAY,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChH,OAAO,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,QAAQ,8BAA8B,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,YAAY,IAAI,UAAU,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,+BAA+B,YAAY,mBAAmB,UAAU,GAAG,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,OAAO,CAAC,IAAI,CACV,qDAAqD,IAAI,CAAC,QAAQ,wBAAwB,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,kFAAkF;AAElF,gGAAgG;AAChG,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,IAA6B,EAAE,QAAgB;IAClE,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAC9C,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACxC,MAAM,cAAc,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/D,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,YAAY,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CACb,oCAAoC,mBAAmB,KAAK,QAAQ,4BAA4B;gBAC9F,cAAc,QAAQ,uDAAuD,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,kGAAkG;AAClG,SAAS,SAAS,CAAC,GAAiB;IAClC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,SAAS,UAAU,CAAC,EAAW;IAC7B,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC;IAC5B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC9F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAqB,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,IAAI,GAAG,KAAK,SAAS;QAAE,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC;IACrC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wFAAwF;AACxF,SAAS,aAAa,CAAC,GAAW,EAAE,OAAiB;IACnD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,sCAAsC,GAAG,IAAI,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,8CAA8C,GAAG,IAAI,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,UAAU,CAAC,GAAW,EAAE,KAAa,EAAE,OAAiB;IAC/D,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,yBAAyB,GAAG,IAAI,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,wBAAwB,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,uFAAuF;AACvF,SAAS,WAAW,CAAC,WAAoB,EAAE,QAAgB;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,gGAAgG;AAChG,SAAS,OAAO,CAAC,CAAS,EAAE,CAAS;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"cimd.js","sourceRoot":"","sources":["../../src/card/cimd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,6EAA6E;AAC7E,MAAM,cAAc,GAAG,UAAU,CAAC;AAElC,kFAAkF;AAClF,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAEjD,gFAAgF;AAChF,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAwBpD,iFAAiF;AAEjF;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,gEAAgE,GAAG,IAAI,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,CAAC,SAAS,EAAE,GAAG,QAAQ,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,yBAAyB,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,OAAO,WAAW,SAAS,GAAG,IAAI,EAAE,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mDAAmD,QAAQ,IAAI,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,kDAAkD,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC7F,OAAO,GAAG,cAAc,GAAG,CAAC,SAAS,EAAE,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,kFAAkF;AAElF;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,MAAe;IAC1C,MAAM,GAAG,GACP,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;IAChG,MAAM,IAAI,GAAuB,EAAE,CAAC;IACpC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,GAAG;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAED,kFAAkF;AAElF;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAgB,EAAE,IAAyB;IAC1E,OAAO;QACL,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,WAAW,EAAE,IAAI,CAAC,IAAI;QACtB,0BAA0B,EAAE,eAAe;QAC3C,QAAQ,EAAE,IAAI,CAAC,OAAO;QACtB,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE;KAC1C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAa;IAClD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;IAChC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,MAAM,IAAI,GAA4B;QACpC,EAAE,EAAE,GAAG;QACP,UAAU,EAAE,QAAQ;QACpB,IAAI,EAAE,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG;KACnG,CAAC;IACF,IAAI,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC7D,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,kFAAkF;AAElF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,IAAiB,EAAE,MAAe,EAAE,WAAoB;IACrF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,IAAI,WAAW,KAAK,SAAS,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC,oBAAoB,KAAK,4BAA4B,WAAW,GAAG,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,IAAI,KAAK,CAAC;IAEjC,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAEjE,IAAI,SAAS,IAAI,YAAY,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,6BAA6B,SAAS,oBAAoB,YAAY,GAAG,CAAC,CAAC;IAC1F,CAAC;SAAM,IAAI,WAAW,KAAK,SAAS,IAAI,SAAS,IAAI,YAAY,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChH,OAAO,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,QAAQ,8BAA8B,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,YAAY,IAAI,UAAU,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,+BAA+B,YAAY,mBAAmB,UAAU,GAAG,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,OAAO,CAAC,IAAI,CACV,qDAAqD,IAAI,CAAC,QAAQ,wBAAwB,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,kFAAkF;AAElF,gGAAgG;AAChG,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,IAA6B,EAAE,QAAgB;IAClE,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAC9C,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACxC,MAAM,cAAc,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/D,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,YAAY,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CACb,oCAAoC,mBAAmB,KAAK,QAAQ,4BAA4B;gBAC9F,cAAc,QAAQ,uDAAuD,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,kGAAkG;AAClG,SAAS,SAAS,CAAC,GAAiB;IAClC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,EAAW;IAC7B,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,GAAG,GAAY,qBAAqB,CAAC,EAAiD,CAAC,CAAC;IAC9F,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC9F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAqB,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,IAAI,GAAG,KAAK,SAAS;QAAE,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC;IACrC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wFAAwF;AACxF,SAAS,aAAa,CAAC,GAAW,EAAE,OAAiB;IACnD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,sCAAsC,GAAG,IAAI,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,8CAA8C,GAAG,IAAI,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,UAAU,CAAC,GAAW,EAAE,KAAa,EAAE,OAAiB;IAC/D,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,yBAAyB,GAAG,IAAI,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,wBAAwB,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,uFAAuF;AACvF,SAAS,WAAW,CAAC,WAAoB,EAAE,QAAgB;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,gGAAgG;AAChG,SAAS,OAAO,CAAC,CAAS,EAAE,CAAS;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/card/delegation.d.ts

@@ -10,9 +10,9 @@
  * `MaxAmount`/`ValidUntil` ≤ parent, no parent caveat silently dropped, unknown caveats replicated
  * verbatim); top-level `validUntil` narrowing; CONTINUITY (the parent's delegate `invoker` MUST be
  * the child's `issuer` — you only re-delegate what was delegated to YOUR key — and
- * `child.parentCapability` references the parent `id`); a constant `invocationTarget`; depth ≤
- * {@link MAX_DELEGATION_DEPTH}; ROOT `parentCapability` = the resource, `issuer`/`invocationTarget`
- * = (optional) resource owner / resource. THE JOIN (recomputed, asserted nowhere):
+ * `child.parentCapability` references the parent `id`); a constant `invocationTarget`; at most
+ * `ctx.maxChainLength` credentials, when the caller sets one; ROOT `parentCapability` = the resource,
+ * `issuer`/`invocationTarget` = (optional) resource owner / resource. THE JOIN (recomputed, asserted nowhere):
  * {@link responsiblePartyOf} = `issuer(rootVC)`, {@link leafInvokerOf} = the leaf delegate a verifier
  * asserts equals `proof.did`. Revocation reuses the injected {@link BitstringRevocationChecker} seam from
  * `./revocation` (no status-list churn reaches callers; NO `mcp-i-core` runtime dep). Per-hop
@@ -119,6 +119,15 @@ export declare function attenuates(parent: DelegationCredential, child: Delegati
 export interface DelegationChainContext {
     resourceOwner?: string;
     resource?: string;
+    /**
+     * Local cost limit: the most credentials to accept in one chain, root to leaf inclusive. Each hop
+     * may cost a signature check and a status-list fetch. It bounds the verifier's own work, not how far
+     * authority may be delegated. Unset accepts any length; a value that is not a positive integer
+     * rejects every chain. {@link MAX_DELEGATION_DEPTH} is a suggested value. The base profile's
+     * `validateDelegationChain` (`@kya-os/mcp/delegation`) takes the same option and counts the same way.
+     */
+    maxChainLength?: number;
+    /** @deprecated Use `maxChainLength`, which takes precedence when both are set. */
     maxDepth?: number;
     /** Injectable clock (epoch ms) for the wall-clock expiry gate; default `Date.now` (deterministic tests inject it). */
     now?: () => number;

package/dist/card/delegation.js

@@ -10,9 +10,9 @@
  * `MaxAmount`/`ValidUntil` ≤ parent, no parent caveat silently dropped, unknown caveats replicated
  * verbatim); top-level `validUntil` narrowing; CONTINUITY (the parent's delegate `invoker` MUST be
  * the child's `issuer` — you only re-delegate what was delegated to YOUR key — and
- * `child.parentCapability` references the parent `id`); a constant `invocationTarget`; depth ≤
- * {@link MAX_DELEGATION_DEPTH}; ROOT `parentCapability` = the resource, `issuer`/`invocationTarget`
- * = (optional) resource owner / resource. THE JOIN (recomputed, asserted nowhere):
+ * `child.parentCapability` references the parent `id`); a constant `invocationTarget`; at most
+ * `ctx.maxChainLength` credentials, when the caller sets one; ROOT `parentCapability` = the resource,
+ * `issuer`/`invocationTarget` = (optional) resource owner / resource. THE JOIN (recomputed, asserted nowhere):
  * {@link responsiblePartyOf} = `issuer(rootVC)`, {@link leafInvokerOf} = the leaf delegate a verifier
  * asserts equals `proof.did`. Revocation reuses the injected {@link BitstringRevocationChecker} seam from
  * `./revocation` (no status-list churn reaches callers; NO `mcp-i-core` runtime dep). Per-hop
@@ -25,7 +25,7 @@ export const DELEGATION_CONTEXT_V2 = 'https://www.w3.org/ns/credentials/v2'; //
 export const ZCAP_CONTEXT = 'https://w3id.org/security/zcap/v1'; // ZCAP-LD capability context
 export const KYA_OS_DELEGATION_CONTEXT = 'https://kya-os.org/ns/delegation/v1'; // KYA-OS ns
 export const DELEGATION_CREDENTIAL_TYPE = 'DelegationCredential'; // 2nd `type` after VerifiableCredential
-export const MAX_DELEGATION_DEPTH = 10; // fail-closed beyond this
+export const MAX_DELEGATION_DEPTH = 10; // a suggested `maxChainLength`; applied only when a caller passes it
 /** A monotone-narrowing constraint: `{type:'ValidUntil',date}` or `{type:'MaxAmount',limit,currency}`.
  *  The flat shape keeps typing clean; unknown caveat types are compared verbatim (fail-closed). */
 export const CaveatSchema = z
@@ -256,15 +256,21 @@ function rootReasons(root, ctx) {
  *  are separate injected concerns (see {@link evaluateDelegationChain}). */
 export function validateDelegationChain(chain, ctx = {}) {
     const depth = chain.length;
-    const maxDepth = ctx.maxDepth ?? MAX_DELEGATION_DEPTH;
+    const maxChainLength = ctx.maxChainLength ?? ctx.maxDepth;
     if (depth === 0) {
         return { ok: false, reasons: ['empty delegation chain'], allowedAction: [], depth };
     }
     const root = chain[0];
     const leaf = chain[depth - 1];
     const reasons = [];
-    if (depth > maxDepth)
-        reasons.push(`delegation chain depth ${depth} exceeds the maximum of ${maxDepth}`);
+    if (maxChainLength !== undefined) {
+        if (!Number.isInteger(maxChainLength) || maxChainLength < 1) {
+            reasons.push(`maxChainLength must be a positive integer (got ${String(maxChainLength)})`);
+        }
+        else if (depth > maxChainLength) {
+            reasons.push(`delegation chain depth ${depth} exceeds the maximum of ${maxChainLength}`);
+        }
+    }
     reasons.push(...rootReasons(root, ctx));
     for (let i = 1; i < depth; i += 1) {
         reasons.push(...attenuates(chain[i - 1], chain[i]));

package/dist/card/delegation.js.map

@@ -1 +1 @@
-{"version":3,"file":"delegation.js","sourceRoot":"","sources":["../../src/card/delegation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,GAAG,EAAiC,MAAM,aAAa,CAAC;AACjE,OAAO,EACL,uBAAuB,GAGxB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,CAAC,MAAM,qBAAqB,GAAG,sCAAsC,CAAC,CAAC,yBAAyB;AACtG,MAAM,CAAC,MAAM,YAAY,GAAG,mCAAmC,CAAC,CAAC,6BAA6B;AAC9F,MAAM,CAAC,MAAM,yBAAyB,GAAG,qCAAqC,CAAC,CAAC,YAAY;AAC5F,MAAM,CAAC,MAAM,0BAA0B,GAAG,sBAAsB,CAAC,CAAC,wCAAwC;AAC1G,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC,CAAC,0BAA0B;AAElE;mGACmG;AACnG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,GAAG,CAAC,QAAQ,EAAE;IAC1B,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE;IACvB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,WAAW,EAAE;KACb,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE;IACjD,OAAO,EAAE,kEAAkE;CAC5E,CAAC,CAAC;AAEL,8FAA8F;AAC9F,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;IAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxC,CAAC,CAAC;AAEH,iGAAiG;AACjG,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;KAC3F,WAAW,EAAE,CAAC;AACjB,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAEzE;;;;GAIG;AACH,MAAM,8BAA8B,GAAG,CAAC;KACrC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KACjB,GAAG,CAAC,CAAC,CAAC;KACN,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAAE;IACvG,OAAO,EAAE,iDAAiD,0BAA0B,GAAG;CACxF,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,+FAA+F;IAC/F,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,IAAI,EAAE,8BAA8B;IACpC,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,iBAAiB,EAAE,oBAAoB;IACvC,gBAAgB,EAAE,gCAAgC,CAAC,QAAQ,EAAE;IAC7D,KAAK,EAAE,wBAAwB,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,WAAW,EAAE,CAAC;AAQjB,yFAAyF;AACzF,MAAM,UAAU,SAAS,CAAC,EAAwB;IAChD,OAAO,OAAO,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;AAClE,CAAC;AACD,0FAA0F;AAC1F,MAAM,UAAU,UAAU,CAAC,EAAwB;IACjD,OAAO,EAAE,CAAC,iBAAiB,CAAC,OAAO,IAAI,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC;AACzE,CAAC;AACD,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,KAAsB;IACvD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AACD,qEAAqE;AACrE,MAAM,UAAU,aAAa,CAAC,KAAsB;IAClD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AACD,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAAC,EAAwB;IACpD,MAAM,MAAM,GAAG,EAAE,CAAC,gBAAgB,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC;AACxG,CAAC;AAED,8FAA8F;AAC9F,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAChF,CAAC;AAED,kGAAkG;AAClG,kGAAkG;AAClG,kGAAkG;AAClG,SAAS,UAAU,CAAC,KAAa,EAAE,MAAc;IAC/C,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAuC,EAAU,EAAE,CAClF,MAAM,CAAC,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;AAChC,CAAC;AACD,SAAS,OAAO,CAAC,KAAa,EAAE,MAAc;IAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,uFAAuF;AACvF,SAAS,SAAS,CAAC,CAAU,EAAE,CAAU;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACrE,CAAC;AACD,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,SAAS,aAAa,CAAC,MAAc,EAAE,KAAa;IAClD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjC,OAAO,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,iGAAiG;QACjG,mGAAmG;QACnG,iGAAiG;QACjG,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC;QAC5F,OAAO,CACL,eAAe;YACf,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAChC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;YAC/B,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CACtC,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,oDAAoD;AACvF,CAAC;AACD,SAAS,aAAa,CAAC,MAAyB,EAAE,KAAwB;IACxE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,8BAA8B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AACxG,CAAC;AACD,SAAS,aAAa,CAAC,MAAyB,EAAE,KAAwB;IACxE,OAAO,MAAM;SACV,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;SAC1D,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,+DAA+D,CAAC,CAAC;AACpG,CAAC;AAED;;mCAEmC;AACnC,MAAM,UAAU,UAAU,CAAC,MAA4B,EAAE,KAA2B;IAClF,MAAM,CAAC,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACnC,MAAM,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAClC,MAAM,OAAO,GAAa;QACxB,GAAG,aAAa,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,aAAa,CAAC;QAClD,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;KACnD,CAAC;IACF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACzH,OAAO,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,sFAAsF,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,CAAC,CAAC,gBAAgB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,CAAC,gBAAgB,KAAK,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAUD;;;;;GAKG;AACH,SAAS,aAAa,CAAC,KAAsB,EAAE,KAAa;IAC1D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;QACtB,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;YACpC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,6BAA6B,EAAE,CAAC,UAAU,GAAG,CAAC,CAAC;iBACpF,IAAI,CAAC,GAAG,KAAK;gBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC,UAAU,kBAAkB,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,EAAE,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;iBAClF,IAAI,CAAC,GAAG,KAAK;gBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,8BAA8B,EAAE,CAAC,SAAS,oBAAoB,CAAC,CAAC;QAC3G,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,EAAE,CAAC,iBAAiB,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YACxD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACpE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAClC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,oCAAoC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;qBACzF,IAAI,CAAC,GAAG,KAAK;oBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gCAAgC,MAAM,CAAC,IAAI,kBAAkB,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAYD,SAAS,WAAW,CAAC,IAA0B,EAAE,GAA2B;IAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC;IACvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,gBAAgB,KAAK,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,gBAAgB,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,aAAa,EAAE,CAAC;QAC7E,OAAO,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,uBAAuB,CACrC,KAAsB,EACtB,MAA8B,EAAE;IAEhC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;IAC3B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,oBAAoB,CAAC;IACtD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,wBAAwB,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACtF,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACvB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC;IAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,KAAK,GAAG,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,0BAA0B,KAAK,2BAA2B,QAAQ,EAAE,CAAC,CAAC;IACzG,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,+FAA+F;IAC/F,sFAAsF;IACtF,OAAO,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/D,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;QACxB,OAAO;QACP,gBAAgB,EAAE,kBAAkB,CAAC,KAAK,CAAC;QAC3C,WAAW,EAAE,aAAa,CAAC,KAAK,CAAC;QACjC,gBAAgB,EAAE,IAAI,CAAC,iBAAiB,CAAC,gBAAgB;QACzD,aAAa,EAAE,IAAI,CAAC,iBAAiB,CAAC,aAAa;QACnD,KAAK;KACN,CAAC;AACJ,CAAC;AAMD;;mFAEmF;AACnF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAsB,EACtB,KAAiC,EACjC,MAA8B,EAAE;IAEhC,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC3D,MAAM,OAAO,GAAG,KAAK;SAClB,GAAG,CAAC,aAAa,CAAC;SAClB,MAAM,CAAC,CAAC,KAAK,EAAqC,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC7E,MAAM,UAAU,GAA0B,MAAM,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxF,OAAO;QACL,GAAG,UAAU;QACb,EAAE,EAAE,UAAU,CAAC,EAAE,IAAI,UAAU,CAAC,EAAE;QAClC,OAAO,EAAE,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC;QACvD,KAAK,EAAE,UAAU,CAAC,KAAK;KACxB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"delegation.js","sourceRoot":"","sources":["../../src/card/delegation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,GAAG,EAAiC,MAAM,aAAa,CAAC;AACjE,OAAO,EACL,uBAAuB,GAGxB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,CAAC,MAAM,qBAAqB,GAAG,sCAAsC,CAAC,CAAC,yBAAyB;AACtG,MAAM,CAAC,MAAM,YAAY,GAAG,mCAAmC,CAAC,CAAC,6BAA6B;AAC9F,MAAM,CAAC,MAAM,yBAAyB,GAAG,qCAAqC,CAAC,CAAC,YAAY;AAC5F,MAAM,CAAC,MAAM,0BAA0B,GAAG,sBAAsB,CAAC,CAAC,wCAAwC;AAC1G,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC,CAAC,qEAAqE;AAE7G;mGACmG;AACnG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,GAAG,CAAC,QAAQ,EAAE;IAC1B,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE;IACvB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,WAAW,EAAE;KACb,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE;IACjD,OAAO,EAAE,kEAAkE;CAC5E,CAAC,CAAC;AAEL,8FAA8F;AAC9F,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;IAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxC,CAAC,CAAC;AAEH,iGAAiG;AACjG,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;KAC3F,WAAW,EAAE,CAAC;AACjB,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAEzE;;;;GAIG;AACH,MAAM,8BAA8B,GAAG,CAAC;KACrC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KACjB,GAAG,CAAC,CAAC,CAAC;KACN,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAAE;IACvG,OAAO,EAAE,iDAAiD,0BAA0B,GAAG;CACxF,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,+FAA+F;IAC/F,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,IAAI,EAAE,8BAA8B;IACpC,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,iBAAiB,EAAE,oBAAoB;IACvC,gBAAgB,EAAE,gCAAgC,CAAC,QAAQ,EAAE;IAC7D,KAAK,EAAE,wBAAwB,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,WAAW,EAAE,CAAC;AAQjB,yFAAyF;AACzF,MAAM,UAAU,SAAS,CAAC,EAAwB;IAChD,OAAO,OAAO,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;AAClE,CAAC;AACD,0FAA0F;AAC1F,MAAM,UAAU,UAAU,CAAC,EAAwB;IACjD,OAAO,EAAE,CAAC,iBAAiB,CAAC,OAAO,IAAI,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC;AACzE,CAAC;AACD,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,KAAsB;IACvD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AACD,qEAAqE;AACrE,MAAM,UAAU,aAAa,CAAC,KAAsB;IAClD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AACD,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAAC,EAAwB;IACpD,MAAM,MAAM,GAAG,EAAE,CAAC,gBAAgB,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC;AACxG,CAAC;AAED,8FAA8F;AAC9F,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAChF,CAAC;AAED,kGAAkG;AAClG,kGAAkG;AAClG,kGAAkG;AAClG,SAAS,UAAU,CAAC,KAAa,EAAE,MAAc;IAC/C,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAuC,EAAU,EAAE,CAClF,MAAM,CAAC,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;AAChC,CAAC;AACD,SAAS,OAAO,CAAC,KAAa,EAAE,MAAc;IAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,uFAAuF;AACvF,SAAS,SAAS,CAAC,CAAU,EAAE,CAAU;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACrE,CAAC;AACD,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,SAAS,aAAa,CAAC,MAAc,EAAE,KAAa;IAClD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjC,OAAO,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,iGAAiG;QACjG,mGAAmG;QACnG,iGAAiG;QACjG,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC;QAC5F,OAAO,CACL,eAAe;YACf,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAChC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;YAC/B,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CACtC,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,oDAAoD;AACvF,CAAC;AACD,SAAS,aAAa,CAAC,MAAyB,EAAE,KAAwB;IACxE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,8BAA8B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AACxG,CAAC;AACD,SAAS,aAAa,CAAC,MAAyB,EAAE,KAAwB;IACxE,OAAO,MAAM;SACV,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;SAC1D,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,+DAA+D,CAAC,CAAC;AACpG,CAAC;AAED;;mCAEmC;AACnC,MAAM,UAAU,UAAU,CAAC,MAA4B,EAAE,KAA2B;IAClF,MAAM,CAAC,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACnC,MAAM,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAClC,MAAM,OAAO,GAAa;QACxB,GAAG,aAAa,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,aAAa,CAAC;QAClD,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;KACnD,CAAC;IACF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACzH,OAAO,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,sFAAsF,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,CAAC,CAAC,gBAAgB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,CAAC,gBAAgB,KAAK,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAmBD;;;;;GAKG;AACH,SAAS,aAAa,CAAC,KAAsB,EAAE,KAAa;IAC1D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;QACtB,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;YACpC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,6BAA6B,EAAE,CAAC,UAAU,GAAG,CAAC,CAAC;iBACpF,IAAI,CAAC,GAAG,KAAK;gBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC,UAAU,kBAAkB,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,EAAE,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;iBAClF,IAAI,CAAC,GAAG,KAAK;gBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,8BAA8B,EAAE,CAAC,SAAS,oBAAoB,CAAC,CAAC;QAC3G,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,EAAE,CAAC,iBAAiB,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YACxD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACpE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAClC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,oCAAoC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;qBACzF,IAAI,CAAC,GAAG,KAAK;oBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gCAAgC,MAAM,CAAC,IAAI,kBAAkB,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAYD,SAAS,WAAW,CAAC,IAA0B,EAAE,GAA2B;IAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC;IACvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,gBAAgB,KAAK,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,gBAAgB,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,aAAa,EAAE,CAAC;QAC7E,OAAO,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,uBAAuB,CACrC,KAAsB,EACtB,MAA8B,EAAE;IAEhC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;IAC3B,MAAM,cAAc,GAAG,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,QAAQ,CAAC;IAC1D,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,wBAAwB,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACtF,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACvB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC;IAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC,kDAAkD,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAC5F,CAAC;aAAM,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,0BAA0B,KAAK,2BAA2B,cAAc,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,+FAA+F;IAC/F,sFAAsF;IACtF,OAAO,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/D,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;QACxB,OAAO;QACP,gBAAgB,EAAE,kBAAkB,CAAC,KAAK,CAAC;QAC3C,WAAW,EAAE,aAAa,CAAC,KAAK,CAAC;QACjC,gBAAgB,EAAE,IAAI,CAAC,iBAAiB,CAAC,gBAAgB;QACzD,aAAa,EAAE,IAAI,CAAC,iBAAiB,CAAC,aAAa;QACnD,KAAK;KACN,CAAC;AACJ,CAAC;AAMD;;mFAEmF;AACnF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAsB,EACtB,KAAiC,EACjC,MAA8B,EAAE;IAEhC,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC3D,MAAM,OAAO,GAAG,KAAK;SAClB,GAAG,CAAC,aAAa,CAAC;SAClB,MAAM,CAAC,CAAC,KAAK,EAAqC,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC7E,MAAM,UAAU,GAA0B,MAAM,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxF,OAAO;QACL,GAAG,UAAU;QACb,EAAE,EAAE,UAAU,CAAC,EAAE,IAAI,UAAU,CAAC,EAAE;QAClC,OAAO,EAAE,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC;QACvD,KAAK,EAAE,UAAU,CAAC,KAAK;KACxB,CAAC;AACJ,CAAC"}

package/dist/card/index.d.ts

@@ -39,4 +39,5 @@ export * from './delegation.js';
 export * from './builder.js';
 export * from './middleware.js';
 export * from './revocation.js';
+export * from './status-list-proof.js';
 export { createSafeFetch, fetchTransport, isBlockedAddress, type SafeFetch, type SafeFetchOptions, type SafeFetchResponse, type SafeFetchTransport, type TransportInit, type DnsLookup, type DnsAddress, } from '../utils/safe-fetch.js';

package/dist/card/index.js

@@ -39,6 +39,7 @@ export * from './delegation.js';
 export * from './builder.js';
 export * from './middleware.js';
 export * from './revocation.js';
+export * from './status-list-proof.js';
 // The SSRF-hardened fetch is the card's production wiring for resolveCard / status-list
 // resolution — export it (and the address classifier) so consumers can actually reach it,
 // not just the mocked-transport unit tests.

package/dist/card/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/card/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAEhC,wFAAwF;AACxF,0FAA0F;AAC1F,4CAA4C;AAC5C,OAAO,EACL,eAAe,EACf,cAAc,EACd,gBAAgB,GAQjB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/card/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AAEvC,wFAAwF;AACxF,0FAA0F;AAC1F,4CAA4C;AAC5C,OAAO,EACL,eAAe,EACf,cAAc,EACd,gBAAgB,GAQjB,MAAM,wBAAwB,CAAC"}

package/dist/card/revocation.d.ts

@@ -10,11 +10,13 @@
  *
  * `createRevocationChecker` is the DEFAULT implementation over W3C Bitstring Status List v1.0
  * (`BitstringStatusListEntry` — the StatusList2021 SUCCESSOR). It resolves the entry's
- * `statusListCredential` through the injected, SSRF-hardened {@link SafeFetch} seam, inflates
- * the multibase / GZIP `encodedList` bitstring, and reads the bit at `statusListIndex`.
+ * `statusListCredential` through the injected, SSRF-hardened {@link SafeFetch} seam, checks the
+ * list's proof through the injected `verifyStatusList` seam when one is given, inflates the
+ * multibase / GZIP `encodedList` bitstring, and reads the bit at `statusListIndex`.
  *
- * FAIL-CLOSED is the invariant: an unreachable status list, a malformed credential, a
- * mismatched `statusPurpose`, or an out-of-range index all resolve to `{ revoked: true }` —
+ * FAIL-CLOSED is the invariant: an unreachable status list, a malformed credential, a list whose
+ * proof is rejected, a mismatched `statusPurpose`, or an out-of-range index all resolve to
+ * `{ revoked: true }` —
  * the absence of proof-of-liveness is treated as revoked, never as "probably fine".
  *
  * Each verdict also reports `fresh`: `true` only when read from a LIVE, in-validity-window
@@ -27,6 +29,7 @@
  */
 import type { SafeFetch } from '../utils/safe-fetch.js';
 import type { BitstringStatusListEntry } from './schema.js';
+import type { StatusListProofVerifier } from './status-list-proof.js';
 /** The `statusPurpose` this checker evaluates by default (revocation, not suspension). */
 export declare const STATUS_PURPOSE_REVOCATION = "revocation";
 /**
@@ -72,6 +75,14 @@ export interface RevocationCheckerDeps {
     now?: () => number;
     /** `statusPurpose` to honour; default {@link STATUS_PURPOSE_REVOCATION}. */
     statusPurpose?: string;
+    /**
+     * Checks the fetched status-list credential's proof before any bit is read, as W3C Bitstring
+     * Status List v1.0 requires (SPEC.md §6.10). A list it rejects (`false` or a throw) resolves
+     * {@link FAIL_CLOSED}. {@link createStatusListProofVerifier} covers `eddsa-jcs-2022` lists.
+     * Without it the bits are read unchecked, so whoever serves the list can clear a revocation;
+     * it stays optional until 2.0 only so existing callers keep working.
+     */
+    verifyStatusList?: StatusListProofVerifier;
     /**
      * Injectable GZIP inflation seam ({@link Decompress}). DEFAULT = `node:zlib` `gunzipSync` bounded
      * to the 16 MiB {@link MAX_STATUS_LIST_BYTES} `maxOutputLength` cap (so a decompression bomb

package/dist/card/revocation.js

@@ -10,11 +10,13 @@
  *
  * `createRevocationChecker` is the DEFAULT implementation over W3C Bitstring Status List v1.0
  * (`BitstringStatusListEntry` — the StatusList2021 SUCCESSOR). It resolves the entry's
- * `statusListCredential` through the injected, SSRF-hardened {@link SafeFetch} seam, inflates
- * the multibase / GZIP `encodedList` bitstring, and reads the bit at `statusListIndex`.
+ * `statusListCredential` through the injected, SSRF-hardened {@link SafeFetch} seam, checks the
+ * list's proof through the injected `verifyStatusList` seam when one is given, inflates the
+ * multibase / GZIP `encodedList` bitstring, and reads the bit at `statusListIndex`.
  *
- * FAIL-CLOSED is the invariant: an unreachable status list, a malformed credential, a
- * mismatched `statusPurpose`, or an out-of-range index all resolve to `{ revoked: true }` —
+ * FAIL-CLOSED is the invariant: an unreachable status list, a malformed credential, a list whose
+ * proof is rejected, a mismatched `statusPurpose`, or an out-of-range index all resolve to
+ * `{ revoked: true }` —
  * the absence of proof-of-liveness is treated as revoked, never as "probably fine".
  *
  * Each verdict also reports `fresh`: `true` only when read from a LIVE, in-validity-window
@@ -44,6 +46,9 @@ export function createRevocationChecker(deps) {
     return async function check(entry) {
         try {
             const credential = await fetchStatusList(entry.statusListCredential, deps.fetch);
+            if (deps.verifyStatusList && (await deps.verifyStatusList(credential)) !== true) {
+                throw new Error('revocation: status-list proof rejected');
+            }
             assertStatusPurpose(statusListSubject(credential).statusPurpose, wantedPurpose);
             const bits = await decodeStatusList(credential, decompress);
             const revoked = readStatusBit(bits, parseStatusListIndex(entry.statusListIndex));

package/dist/card/revocation.js.map

@@ -1 +1 @@
-{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../../src/card/revocation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EACpB,aAAa,GACd,MAAM,6BAA6B,CAAC;AAIrC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,yBAAyB,GAAG,YAAY,CAAC;AAsEtD,kFAAkF;AAClF,MAAM,WAAW,GAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAEtE;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAA2B;IAE3B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7C,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,yBAAyB,CAAC;IACtE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,OAAO,KAAK,UAAU,KAAK,CAAC,KAA+B;QACzD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,oBAAoB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACjF,mBAAmB,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;YAChF,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,oBAAoB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;YACjF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,WAAW,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAA4C,EAC5C,KAAiC;IAEjC,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,+DAA+D;IAC/F,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;QAClC,KAAK,GAAG,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC;QAC9B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE;oBACP,mBAAmB,GAAG,KAAK,KAAK,CAAC,oBAAoB,IAAI,KAAK,CAAC,eAAe,IAAI;wBAChF,+DAA+D;iBAClE;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAC1C,CAAC;AAED,kFAAkF;AAElF,8FAA8F;AAC9F,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,KAAgB;IAC1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAC5F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,SAAS,iBAAiB,CAAC,UAAmC;IAC5D,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAC5F,OAAO,OAAO,CAAC;AACjB,CAAC;AAGD;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAAC,KAAiB;IAChD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACjD,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAC7B,UAAmC,EACnC,UAAsB;IAEtB,MAAM,OAAO,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC;IAC1D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,uBAAuB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,UAAmC,EAAE,KAAa;IAChE,MAAM,UAAU,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IACzF,IAAI,UAAU,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,CAAC,qCAAqC;IAClG,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,GAAG,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,+BAA+B;IACjG,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,GAAG,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,gBAAgB;IAChF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sFAAsF;AACtF,SAAS,YAAY,CAAC,OAAgB,EAAE,MAAe;IACrD,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAClD,CAAC;AAED,wGAAwG;AACxG,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC"}
+{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../../src/card/revocation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EACpB,aAAa,GACd,MAAM,6BAA6B,CAAC;AAKrC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,yBAAyB,GAAG,YAAY,CAAC;AA8EtD,kFAAkF;AAClF,MAAM,WAAW,GAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAEtE;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAA2B;IAE3B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7C,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,yBAAyB,CAAC;IACtE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,OAAO,KAAK,UAAU,KAAK,CAAC,KAA+B;QACzD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,oBAAoB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACjF,IAAI,IAAI,CAAC,gBAAgB,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAChF,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5D,CAAC;YACD,mBAAmB,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;YAChF,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,oBAAoB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;YACjF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,WAAW,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAA4C,EAC5C,KAAiC;IAEjC,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,+DAA+D;IAC/F,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;QAClC,KAAK,GAAG,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC;QAC9B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE;oBACP,mBAAmB,GAAG,KAAK,KAAK,CAAC,oBAAoB,IAAI,KAAK,CAAC,eAAe,IAAI;wBAChF,+DAA+D;iBAClE;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAC1C,CAAC;AAED,kFAAkF;AAElF,8FAA8F;AAC9F,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,KAAgB;IAC1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAC5F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,SAAS,iBAAiB,CAAC,UAAmC;IAC5D,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAC5F,OAAO,OAAO,CAAC;AACjB,CAAC;AAGD;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAAC,KAAiB;IAChD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACjD,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAC7B,UAAmC,EACnC,UAAsB;IAEtB,MAAM,OAAO,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC;IAC1D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,uBAAuB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,UAAmC,EAAE,KAAa;IAChE,MAAM,UAAU,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IACzF,IAAI,UAAU,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,CAAC,qCAAqC;IAClG,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,GAAG,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,+BAA+B;IACjG,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,GAAG,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,gBAAgB;IAChF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sFAAsF;AACtF,SAAS,YAAY,CAAC,OAAgB,EAAE,MAAe;IACrD,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAClD,CAAC;AAED,wGAAwG;AACxG,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC"}

package/dist/card/status-list-proof.d.ts

@@ -0,0 +1,32 @@
+/**
+ * KYA-OS Entity Card — status-list PROOF check (W3C Data Integrity, `eddsa-jcs-2022`).
+ *
+ * W3C Bitstring Status List v1.0 has a verifier check every proof on the status-list credential
+ * before it reads a bit: the list is what says a credential is revoked, so a list nobody verified
+ * lets whoever serves it clear a revocation. {@link createRevocationChecker} takes that check as
+ * its `verifyStatusList` seam, the way the rest of the card layer takes credential proofs, and
+ * {@link createStatusListProofVerifier} is a ready implementation for lists signed with
+ * `DataIntegrityProof` / `eddsa-jcs-2022` by an Ed25519 key in the list issuer's DID document.
+ *
+ * The construction is the cryptosuite's, step for step: the proof options without `proofValue`,
+ * carrying the document's `@context`, and the document without `proof`, each RFC 8785-canonicalized
+ * and SHA-256 hashed; the signature is Ed25519 over the two hashes concatenated, `proofValue` is
+ * base58btc multibase. The key is the issuer's verification method `proof.verificationMethod`
+ * names, and that method must belong to the list's `issuer`. Every failure returns `false`.
+ */
+import type { DIDResolver } from '../delegation/vc-verifier.types.js';
+/**
+ * Checks a fetched status-list credential's proof. Resolves `true` only when the proof verifies;
+ * `false` or a throw rejects the list, and the revocation checker then fails closed.
+ */
+export type StatusListProofVerifier = (credential: Record<string, unknown>) => boolean | Promise<boolean>;
+/** Dependencies for {@link createStatusListProofVerifier}. */
+export interface StatusListProofVerifierDeps {
+    /** Resolves the list issuer's DID document, e.g. `createDidWebResolver` or `createDidKeyResolver`. */
+    didResolver: DIDResolver;
+}
+/**
+ * Build a {@link StatusListProofVerifier} for `DataIntegrityProof` / `eddsa-jcs-2022` status lists.
+ * Pass it to {@link createRevocationChecker} as `verifyStatusList`.
+ */
+export declare function createStatusListProofVerifier(deps: StatusListProofVerifierDeps): StatusListProofVerifier;

package/dist/card/status-list-proof.js

@@ -0,0 +1,102 @@
+/**
+ * KYA-OS Entity Card — status-list PROOF check (W3C Data Integrity, `eddsa-jcs-2022`).
+ *
+ * W3C Bitstring Status List v1.0 has a verifier check every proof on the status-list credential
+ * before it reads a bit: the list is what says a credential is revoked, so a list nobody verified
+ * lets whoever serves it clear a revocation. {@link createRevocationChecker} takes that check as
+ * its `verifyStatusList` seam, the way the rest of the card layer takes credential proofs, and
+ * {@link createStatusListProofVerifier} is a ready implementation for lists signed with
+ * `DataIntegrityProof` / `eddsa-jcs-2022` by an Ed25519 key in the list issuer's DID document.
+ *
+ * The construction is the cryptosuite's, step for step: the proof options without `proofValue`,
+ * carrying the document's `@context`, and the document without `proof`, each RFC 8785-canonicalized
+ * and SHA-256 hashed; the signature is Ed25519 over the two hashes concatenated, `proofValue` is
+ * base58btc multibase. The key is the issuer's verification method `proof.verificationMethod`
+ * names, and that method must belong to the list's `issuer`. Every failure returns `false`.
+ */
+import { canonicalize } from 'json-canonicalize';
+import { isRecord } from '../utils/guards.js';
+import { base58Decode } from '../utils/base58.js';
+import { verificationMethodJwk } from '../delegation/verification-method-key.js';
+import { ed25519VerifyRaw, sha256 } from './proof/canonical.js';
+const ED25519_SIGNATURE_LENGTH = 64;
+/** A 64-byte signature is at most 88 base58 characters; bound the decode before it runs. */
+const MAX_PROOF_VALUE_BASE58 = 100;
+/**
+ * Build a {@link StatusListProofVerifier} for `DataIntegrityProof` / `eddsa-jcs-2022` status lists.
+ * Pass it to {@link createRevocationChecker} as `verifyStatusList`.
+ */
+export function createStatusListProofVerifier(deps) {
+    return async function verifyStatusList(credential) {
+        try {
+            return await verifyEddsaJcs2022(credential, deps.didResolver);
+        }
+        catch {
+            return false;
+        }
+    };
+}
+async function verifyEddsaJcs2022(document, didResolver) {
+    const proof = document.proof;
+    // One proof object: a proof set or chain is not a shape this check reads.
+    if (!isRecord(proof))
+        return false;
+    if (proof.type !== 'DataIntegrityProof' || proof.cryptosuite !== 'eddsa-jcs-2022')
+        return false;
+    if (proof.proofPurpose !== 'assertionMethod')
+        return false;
+    const { proofValue, verificationMethod } = proof;
+    if (typeof proofValue !== 'string' || !proofValue.startsWith('z'))
+        return false;
+    if (typeof verificationMethod !== 'string')
+        return false;
+    const issuer = issuerOf(document);
+    const did = verificationMethod.split('#')[0];
+    if (issuer === undefined || did !== issuer)
+        return false;
+    const signature = base58Decode(proofValue.slice(1), MAX_PROOF_VALUE_BASE58);
+    if (signature.length !== ED25519_SIGNATURE_LENGTH)
+        return false;
+    const didDocument = await didResolver.resolve(did);
+    const method = didDocument?.verificationMethod?.find((vm) => methodId(vm, did) === verificationMethod);
+    const jwk = method ? verificationMethodJwk(method) : undefined;
+    if (!jwk || jwk.kty !== 'OKP' || jwk.crv !== 'Ed25519')
+        return false;
+    const unsecured = { ...document };
+    delete unsecured.proof;
+    const options = { ...proof };
+    delete options.proofValue;
+    if (options['@context'] !== undefined) {
+        // The proof may name its own @context only as a prefix of the document's.
+        if (!startsWith(contexts(document['@context']), contexts(options['@context'])))
+            return false;
+        unsecured['@context'] = options['@context'];
+    }
+    if (unsecured['@context'] !== undefined)
+        options['@context'] = unsecured['@context'];
+    const encoder = new TextEncoder();
+    const proofHash = await sha256(encoder.encode(canonicalize(options)));
+    const documentHash = await sha256(encoder.encode(canonicalize(unsecured)));
+    const hashData = new Uint8Array(proofHash.length + documentHash.length);
+    hashData.set(proofHash, 0);
+    hashData.set(documentHash, proofHash.length);
+    return ed25519VerifyRaw(jwk, signature, hashData);
+}
+/** The credential's `issuer` DID, whether a bare string or an `{ id }` object. */
+function issuerOf(document) {
+    const issuer = document.issuer;
+    if (typeof issuer === 'string')
+        return issuer;
+    return isRecord(issuer) && typeof issuer.id === 'string' ? issuer.id : undefined;
+}
+/** A verification method's absolute id: DID documents may write it relative (`#key-1`). */
+function methodId(method, did) {
+    return method.id.startsWith('#') ? `${did}${method.id}` : method.id;
+}
+function contexts(value) {
+    return Array.isArray(value) ? value : value === undefined ? [] : [value];
+}
+function startsWith(whole, prefix) {
+    return prefix.length <= whole.length && prefix.every((entry, i) => canonicalize(entry) === canonicalize(whole[i]));
+}
+//# sourceMappingURL=status-list-proof.js.map

package/dist/card/status-list-proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-list-proof.js","sourceRoot":"","sources":["../../src/card/status-list-proof.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAEjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAchE,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,4FAA4F;AAC5F,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAAiC;IAC7E,OAAO,KAAK,UAAU,gBAAgB,CAAC,UAAmC;QACxE,IAAI,CAAC;YACH,OAAO,MAAM,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,QAAiC,EAAE,WAAwB;IAC3F,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC7B,0EAA0E;IAC1E,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,IAAI,KAAK,CAAC,WAAW,KAAK,gBAAgB;QAAE,OAAO,KAAK,CAAC;IAChG,IAAI,KAAK,CAAC,YAAY,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAC3D,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,GAAG,KAAK,CAAC;IACjD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChF,IAAI,OAAO,kBAAkB,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEzD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAEzD,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC5E,IAAI,SAAS,CAAC,MAAM,KAAK,wBAAwB;QAAE,OAAO,KAAK,CAAC;IAEhE,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,WAAW,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,kBAAkB,CAAC,CAAC;IACvG,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAErE,MAAM,SAAS,GAA4B,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC3D,OAAO,SAAS,CAAC,KAAK,CAAC;IACvB,MAAM,OAAO,GAA4B,EAAE,GAAG,KAAK,EAAE,CAAC;IACtD,OAAO,OAAO,CAAC,UAAU,CAAC;IAC1B,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;QACtC,0EAA0E;QAC1E,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7F,SAAS,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAErF,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACxE,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC3B,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED,kFAAkF;AAClF,SAAS,QAAQ,CAAC,QAAiC;IACjD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACnF,CAAC;AAED,2FAA2F;AAC3F,SAAS,QAAQ,CAAC,MAA0B,EAAE,GAAW;IACvD,OAAO,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,UAAU,CAAC,KAAgB,EAAE,MAAiB;IACrD,OAAO,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrH,CAAC"}

package/dist/delegation/chain-enforcement.d.ts

@@ -79,6 +79,22 @@ export interface ChainEnforcementDeps {
      * root issuer.
      */
     trustedRootIssuers?: readonly string[];
+    /**
+     * Local cost limit: the most credentials this verifier will verify in one
+     * chain, root to leaf inclusive. Each credential costs a signature check and
+     * possibly a DID resolution, and a resolver may return a chain of any length.
+     * This bounds the verifier's own work; it is not a protocol rule about how far
+     * authority may be delegated, which the base profile leaves unbounded. Omit to
+     * verify any length. A value that is not a positive integer rejects every
+     * chain.
+     *
+     * It is checked after `resolveDelegationChain` returns, so it does not bound
+     * the resolver itself: a resolver that walks `parentId` one fetch at a time
+     * should apply its own limit. The Entity Card profile's
+     * `validateDelegationChain` (`@kya-os/mcp/card`) takes the same option and
+     * counts the same way.
+     */
+    maxChainLength?: number;
 }
 export interface ChainValidationResult {
     valid: boolean;

package/dist/delegation/chain-enforcement.js

@@ -139,6 +139,23 @@ export async function validateDelegationChain(leafCredential, deps, options) {
             leafCredential,
         ];
     }
+    // Checked before any credential is verified, so an over-long chain costs no
+    // signature checks or DID resolutions.
+    const { maxChainLength } = deps;
+    if (maxChainLength !== undefined) {
+        if (!Number.isInteger(maxChainLength) || maxChainLength < 1) {
+            return {
+                valid: false,
+                reason: `maxChainLength must be a positive integer (got ${String(maxChainLength)})`,
+            };
+        }
+        if (chain.length > maxChainLength) {
+            return {
+                valid: false,
+                reason: `Delegation chain of ${chain.length} credentials exceeds the maximum of ${maxChainLength}`,
+            };
+        }
+    }
     let expiresAt;
     const warnings = [];
     const seenIds = new Set();