@kya-os/mcp 1.2.0 → 1.3.1

package/CHANGELOG.md

@@ -7,14 +7,107 @@ Versioning: https://semver.org/spec/v2.0.0.html
 
 ## [Unreleased]
 
+### Added
+
+- Export the byte-variant base64url helpers (`base64urlEncodeFromBytes`, `base64urlDecodeToBytes`) from the package entry point. They existed in `src/utils/base64.ts` but were not on the public API; downstream consumers need them for DID/JWK key encoding.
+
+### Docs
+
+- Tightened two capability-language hits inside the spec that survived the Responsible Party rename: §8.2 `DelegationProofJWT.sub` comment now describes the Responsible Party explicitly (was "User DID (on whose behalf)"), and the `userDid` field description in `schemas/delegation-credential.json` now reads "whose delegated authority the agent exercises" instead of "on whose behalf the delegation acts."
+
+### Spec
+
+- Added §11.0 (Trust Model) naming the three trust boundaries explicitly: the agent process, the verifier (with the Edge Verifier called out as a TCB component at L1), and the service / resource owner. Includes key custody options (software, proxy-managed, hardware-attested) and a mutual-authentication recommendation for services.
+- Added §11.1 (Threat Model Summary) as a structured table: threat → mitigation → residual risk. Covers impersonation, replay, scope escalation, confused deputy, credential theft, agent abuse, key compromise, revocation race, downgrade, and DoS — with cross-references to detailed sections and to the cap-sec invariants in §6.4.1 / §6.5.
+- Renumbered §11 subsections to fit the new structure (Revocation Freshness moved to §11.10; previous §11.1–§11.5 shifted by one).
+- Introduced **Principal** and **Responsible Party** as first-class terms (§2). The Responsible Party is the entity ultimately accountable for actions taken under a delegation chain — the root issuer of the chain. Distinguished from the Principal (the immediate human delegator) to support organizational deployments where the operating human is not the accountable entity.
+- Added a normative invariant to §6.4: every delegation chain MUST terminate at a Responsible Party, identified by the `issuerDid` of the root `DelegationCredential`.
+- Reworded the Abstract to drop "on whose behalf" (impersonation framing) in favor of "what authority they hold (a delegation chain rooted at a Responsible Party)" — capability-security framing that matches the protocol's actual semantics.
+- Added normative _meta hash exclusion paragraph and `session.metaPolicy` opt-in (default: `strict`).
+- Documented anonymous handshake nonce-dedupe boundary; reference impl now uses a 60s TTL for anonymous nonces.
+- Added `clockSkewSeconds` field to `.well-known/mcp` for server-advertised skew negotiation.
+- Added the **designation invariant** to §6.4.1 as a normative MUST: invocations must designate the specific resource being exercised, even when the delegation authorizes multiple resources. The reference implementation already enforces this via the per-tool `scopeId` check; this change makes the behavior normative and cross-references it from §11.6 (Confused Deputy Attacks).
+- Added §6.5.1 (Revocation Rights) defining who may revoke a delegation in v1.0: direct issuer, any ancestor issuer in the chain, and the responsible party at the root. Subject-side revocation is explicitly disallowed in v1.0; UCAN-style "revocation as a delegatable permission" is tracked for v1.1.
+- Added §6.5.2 (Concurrency and the Revocation Race) acknowledging the Lamport-concurrent race between revocation issuance and propagation, with implementation guidance on bounding the window.
+
+### Security
+
+- **BREAKING (default flip): `requireAudienceOnRedelegation` now defaults to `true`.**
+  Every non-root credential in a delegation chain must carry an `audience`
+  constraint. Closes the confused-deputy class flagged by Alan Karp's
+  transitive-access analysis and matches `SPEC.md` §11.6. Integrations that
+  cannot yet bind audience on every re-delegation can set the flag to `false`
+  explicitly to preserve legacy behavior; doing so logs a one-time
+  per-process warning so the configuration is auditable in production logs.
+- **Unsafe-mode warning:** setting `allowLegacyUnsafeDelegation` to `true`
+  now emits a one-time per-process `console.warn` on first use. Default
+  is unchanged (`false` / strict). The warning surfaces accidental
+  configuration in production logs without spamming per-session.
+- `SECURITY.md` gained a "Secure Defaults & Unsafe Delegation Modes" section
+  documenting both flags, when to opt out, and the migration path back to
+  safe defaults.
+- Added test coverage pinning the warn-once behavior on both unsafe-mode
+  flags: warns exactly once per process on opt-in, silent on safe defaults,
+  no duplicate warnings across repeated `wrapWithDelegation` calls.
+
+### Added
+
+- **Generic `Identity` interface** exported from the root entry point.
+  Captures the shape shared by every subject the protocol speaks about
+  (DID + verification-method id + key material). `AgentIdentity` now
+  extends `Identity`; the agent-flavoured shape is unchanged for
+  existing consumers.
+- **`buildDidWebDocument(identity, options?)`** in
+  `delegation/did-web-resolver`. Produces the DID Document a `did:web`
+  controller serves at its resolution URL (see `didWebToUrl`),
+  completing the producer/consumer round-trip with `DidWebResolver`.
+  Emits both `publicKeyJwk` and `publicKeyMultibase` for cross-format
+  interop, matching the `Ed25519VerificationKey2020` form used by the
+  did:key resolver.
+- Optional `@context` field on `DIDDocument` so produced documents can
+  declare the JSON-LD contexts they reference.
+
 ### Changed
 
-- **Package renamed from `@mcp-i/core` to `@kya-os/mcp`.** Reframed under
-  the KYA-OS taxonomy: MCP-I is the identity surface of KYA-OS (Know
-  Your Agent Operating System), the umbrella protocol for agent
-  identity, authorization, and observability. Version stays at 1.2.0 —
-  the wire format, exports (`MCPI*`), and behavior are unchanged. The
-  old `@mcp-i/core` package is deprecated and points at this one.
+- **Package renamed from `@mcp-i/core` to `@kya-os/mcp`.** Renamed
+  under the KYA-OS protocol (Know Your Agent Operating System), the
+  agent identity, authorization, and observability protocol donated
+  to DIF TAAWG. Version stays at 1.2.0 — the wire format, public
+  exports, and behavior are unchanged. The old `@mcp-i/core` package
+  is deprecated and points at this one.
+- **Spec renamed from MCP-I to KYA-OS** across `SPEC.md`,
+  `CONFORMANCE.md`, `GOVERNANCE.md`, and example READMEs. Wire-format
+  identifiers (`_kyaos` tool name, well-known path, JSON Schema
+  files, JSON-LD context URLs) are deferred to a later cutover so
+  this doc-only rename doesn't break running implementations.
+
+  Why the rename: two forces.
+
+  First, MCP is Anthropic's trademark and lives under Anthropic's
+  governance. Calling a DIF-track identity protocol "MCP-Identity"
+  suggested an official extension of MCP and tied the protocol to a
+  single vendor's roadmap. The Linux Foundation flagged this during
+  pre-donation review and we agreed: a foundation-owned identity
+  protocol should not carry another foundation's (or vendor's)
+  trademark in its name.
+
+  Second, the protocol was never going to be MCP-only. The design
+  intent was a primitive layer for identity, authority, and
+  accountability that other agent-facing protocols adopt, analogous
+  to how TLS is a security layer that transports adopt rather than
+  a transport itself. KYA-OS primitives are intended to embed in
+  three kinds of host surface: transport bindings (wire protocols
+  an agent's calls ride over, e.g. MCP, HTTPS, gRPC, SMTP, Matrix,
+  browser-driven actions), runtime bindings (agent harnesses where
+  the loop runs and tool invocations can be wrapped uniformly), and
+  manifest / assertion embeddings (host formats like C2PA manifests
+  that already carry signed assertions and can carry a KYA-OS proof
+  as one assertion type). Naming the protocol after one binding
+  undersold the surface.
+
+  The MCP binding ships first because MCP is the most concentrated
+  agent-to-tool RPC surface today. Additional bindings will be
+  specified in the working group as they reach consensus.
 - **Spec cut to `1.0.0`** (was `0.1.0-draft` in `SPEC.md`, `1.0.0-draft`
   in `CONFORMANCE.md`). The wire format was already pinned at `1.0.0`
   in the handshake protocol-version field; the spec docs now match.
@@ -22,14 +115,25 @@ Versioning: https://semver.org/spec/v2.0.0.html
   semver is independent of package semver: the spec describes the wire
   protocol, the package describes the implementation shipping it.
 - Delegation middleware remains strict by default for chain and status-list validation.
-- Added `delegation.allowLegacyUnsafeDelegation` to `createMCPIMiddleware` as a temporary migration escape hatch for legacy integrations.
+- Added `delegation.allowLegacyUnsafeDelegation` to `createKyaOsMiddleware` as a temporary migration escape hatch for legacy integrations.
 - Added middleware tests covering legacy-compatibility behavior for parent-linked and status-list credentials.
 
+### Docs
+
+- L1 revocation terminology clarified (verifier-local, not global CRL).
+- Orchestration directory scope explicitly narrowed from global to service-local.
+- Nonce lifetime documented to prevent early-eviction replay class.
+- Multi-level audit record example added.
+- Conformance-tiered audit-logging requirements added.
+- Registry types (Delegation / Credential / Trust) disambiguated.
+- Broken link to Protocol Registry fixed.
+- Key Topics ordering aligned with site navigation.
+
 ## [1.0.0-draft] - 2026-03-12
 
 ### Added
 
-- SPEC.md protocol specification defining MCP-I extension for cryptographic identity
+- SPEC.md protocol specification defining KYA-OS extension for cryptographic identity
 - Supported DID methods: `did:key` (ephemeral/dev) and `did:web` (production)
 - Ed25519/EdDSA cryptography for signing and verification
 - Delegation module with W3C Verifiable Credential issuance and verification
@@ -46,14 +150,14 @@ Versioning: https://semver.org/spec/v2.0.0.html
 - Auth module with `verifyOrHints` orchestration and sensitive scope detection
 - Resume token storage for authorization flows
 - `needs_authorization` hint response pattern
-- MCP SDK middleware wrapper (`createMCPIMiddleware`)
+- MCP SDK middleware wrapper (`createKyaOsMiddleware`)
 - Tool wrapping with automatic proof generation
 - Handshake tool registration and handling
 - Provider abstractions: CryptoProvider, ClockProvider, FetchProvider, StorageProvider, NonceCacheProvider, IdentityProvider
 - In-memory implementations for all providers (testing)
 - Configurable logging with debug, info, warn, error levels
 - Pure TypeScript protocol type definitions (zero runtime dependencies)
-- Well-known endpoint (`/.well-known/mcpi`) for server discovery
+- Well-known endpoint (`/.well-known/mcp`) for server discovery
 - Outbound delegation proof JWT builder for downstream API calls
 - Three-tier conformance levels:
   - Level 1: Core Crypto (key generation, signing, hashing, DID resolution)

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 MCP-Identity
+Copyright (c) 2026 KYA-OS
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -1,35 +1,52 @@
 <p align="center">
-  <a href="https://modelcontextprotocol-identity.io">
+  <a href="https://kya-os.ai">
     <picture>
       <source media="(prefers-color-scheme: dark)" srcset="https://modelcontextprotocol-identity.io/images/logo-mark_white.svg">
-      <img alt="MCP-I" src="https://modelcontextprotocol-identity.io/images/logo-mark_black.svg" width="64">
+      <img alt="" src="https://modelcontextprotocol-identity.io/images/logo-mark_black.svg" width="64">
     </picture>
   </a>
 </p>
 
 <p align="center">
-  <strong>Identity, delegation, and proof for the Model Context Protocol.</strong>
+  <strong>KYA-OS: agent identity, delegation, and proof. This repo is the MCP binding.</strong>
 </p>
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@kya-os/mcp"><img src="https://img.shields.io/npm/v/@kya-os/mcp" alt="npm"></a>
-  <a href="https://modelcontextprotocol-identity.io"><img src="https://img.shields.io/badge/spec-modelcontextprotocol--identity.io-blue" alt="spec"></a>
+  <a href="https://modelcontextprotocol-identity.io"><img src="https://img.shields.io/badge/spec-KYA--OS-blue" alt="spec"></a>
   <a href="https://identity.foundation/working-groups/agent-and-authorization.html"><img src="https://img.shields.io/badge/DIF-TAAWG-purple" alt="DIF TAAWG"></a>
-  <a href="./LICENSE"><img src="https://img.shields.io/github/license/modelcontextprotocol-identity/mcp-i-core" alt="license"></a>
-</p>
-
-<p align="center">
-  <em><code>@kya-os/mcp</code> is the reference implementation of <strong>MCP-I</strong>, the identity surface of <strong>KYA-OS</strong> (Know Your Agent Operating System). KYA-OS is the umbrella protocol for agent identity, authorization, and observability; MCP-I is its first surface, binding those primitives to Model Context Protocol servers.</em>
+  <a href="./LICENSE"><img src="https://img.shields.io/github/license/decentralized-identity/kya-os-mcp" alt="license"></a>
 </p>
 
 ---
 
-AI agents call tools on your behalf. But today, there's no way to know *who* called, *whether they were allowed to*, or *what actually happened*. MCP-I fixes that for Model Context Protocol servers.
+## What KYA-OS is
+
+**KYA-OS** (Know Your Agent Operating System) is an identity, authority, and accountability layer that other agent-facing protocols adopt, so that any time an agent acts you can verify *who* called (agent identity), *under what authority* (delegation chain rooted at a Responsible Party, plus consent where required), and *what they did* (signed proofs composing into audit trails).
+
+The shape of the contribution is roughly analogous to TLS. TLS is not a transport, it is a security layer that transports adopt. KYA-OS is not a transport or a runtime, it is an identity and accountability layer that host protocols embed.
+
+Three jobs, six primitives:
+
+- **Identity.** Every agent and every server holds a Decentralized Identifier (`did:key`, `did:web`): a stable, cryptographically-controlled identifier that the agent can prove it owns, and that credentials can be issued against. Without this, there is nothing to bind authority to or hold accountable.
+- **Authority.** W3C Verifiable Credentials carrying scoped, revocable delegation chains rooted at a Responsible Party. Per-tool consent gating for actions that require explicit human approval.
+- **Accountability.** Detached JWS proofs over canonicalized request/response hashes, composing into tamper-evident audit trails. Invisible to the LLM, verifiable by anyone holding the agent's DID.
+
+> **Note on the name.** This protocol was previously known as **MCP-Identity** / **MCP-I**. The rename to KYA-OS reflects the protocol's binding-agnostic scope. See the [`[Unreleased]` entry in `CHANGELOG.md`](./CHANGELOG.md#unreleased) for the full rationale.
+
+## What this repo is
+
+`@kya-os/mcp` is the **MCP binding** of KYA-OS, the reference implementation for [Model Context Protocol](https://modelcontextprotocol.io) servers, and the first binding to ship.
+
+KYA-OS primitives are intended to embed in three kinds of host surface:
+
+1. **Transport bindings.** Wire protocols an agent's calls ride over (e.g. MCP, HTTPS, gRPC, SMTP).
+2. **Runtime bindings.** Agent harnesses where the loop runs and tool invocations can be wrapped uniformly.
+3. **Manifest / assertion embeddings.** Host formats that already carry signed assertions, where a KYA-OS proof can serve as one assertion type (e.g. C2PA-track content provenance manifests).
+
+The MCP binding ships first because MCP is the most concentrated agent-to-tool RPC surface today. Additional bindings will be specified in the working group as they reach consensus.
 
-- **Every server gets a cryptographic identity** (DID) — no accounts, no API keys, no central registry
-- **Every tool call gets a signed proof** — a tamper-evident receipt the agent can't forge or deny
-- **Protected tools require human consent** — per-tool authorization via W3C Delegation Credentials
-- **The AI never knows** — identity, proofs, and consent happen transparently in the protocol layer
+The KYA-OS protocol itself is defined in [`SPEC.md`](./SPEC.md). Binding-specific behavior is called out so future bindings can diverge cleanly where they need to.
 
 ```
 npm install @kya-os/mcp
@@ -37,9 +54,9 @@ npm install @kya-os/mcp
 
 ---
 
-## Migrate Any MCP Server in 2 Lines
+## Migrate any MCP server in 2 lines
 
-**Before** — a standard MCP server with no identity or proofs:
+**Before**, a standard MCP server with no identity or proofs:
 
 ```typescript
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
@@ -51,51 +68,51 @@ server.registerTool('greet', { description: 'Say hello' }, async (args) => ({
 }));
 ```
 
-**After** — every tool response now carries a signed cryptographic proof:
+**After**, every tool response now carries a signed cryptographic proof:
 
 ```typescript
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { withMCPI, NodeCryptoProvider } from '@kya-os/mcp';  // +1 line
+import { withKyaOs, NodeCryptoProvider } from '@kya-os/mcp';  // +1 line
 
 const server = new McpServer({ name: 'my-server', version: '1.0.0' });
-await withMCPI(server, { crypto: new NodeCryptoProvider() }); // +1 line
+await withKyaOs(server, { crypto: new NodeCryptoProvider() }); // +1 line
 
 server.registerTool('greet', { description: 'Say hello' }, async (args) => ({
   content: [{ type: 'text', text: `Hello, ${args.name}!` }],
 }));
 ```
 
-That's it. `withMCPI` auto-generates an Ed25519 identity, registers the `_mcpi` protocol tool, and wraps the transport so every tool response includes a detached JWS proof in `_meta` — invisible to the LLM, verifiable by anyone.
+That's it. `withKyaOs` auto-generates an Ed25519 identity, registers the `_kyaos` protocol tool, and wraps the transport so every tool response includes a detached JWS proof in `_meta`. Invisible to the LLM, verifiable by anyone.
 
-> See the full working example: [examples/context7-with-mcpi](./examples/context7-with-mcpi/) — a real MCP server (Context7) migrated with exactly 2 lines of code.
+> See the full working example: [examples/context7-with-kya-os](./examples/context7-with-kya-os/), a real MCP server (Context7) migrated with exactly 2 lines of code.
 
 ---
 
-## Protect Tools with Human Consent
+## Protect tools with human consent
 
-Some tools shouldn't run without a human saying "yes." MCP-I adds per-tool authorization using W3C Verifiable Credentials:
+Some tools shouldn't run without a human saying "yes." KYA-OS adds per-tool authorization using W3C Verifiable Credentials:
 
 ```typescript
-const checkout = mcpi.wrapWithDelegation(
+const checkout = kyaos.wrapWithDelegation(
   'checkout',
   { scopeId: 'cart:write', consentUrl: 'https://example.com/consent' },
-  mcpi.wrapWithProof('checkout', async (args) => ({
+  kyaos.wrapWithProof('checkout', async (args) => ({
     content: [{ type: 'text', text: `Order placed: ${args.item}` }],
   })),
 );
 ```
 
-When an agent calls `checkout` without a delegation credential, it gets back a `needs_authorization` response with a consent URL. The human approves, a scoped credential is issued, and the agent retries — now authorized.
+When an agent calls `checkout` without a delegation credential, it gets back a `needs_authorization` response with a consent URL. The human approves, a scoped credential is issued, and the agent retries, now authorized.
 
 > Try it yourself: [examples/consent-basic](./examples/consent-basic/) walks through the full consent flow end-to-end.
 
 ---
 
-## See It in Action
+## See it in action
 
 ```bash
-git clone https://github.com/modelcontextprotocol-identity/mcp-i-core.git
-cd mcp-i-core && npm install
+git clone https://github.com/decentralized-identity/kya-os-mcp.git
+cd kya-os-mcp && npm install
 bash scripts/demo.sh
 ```
 
@@ -106,19 +123,19 @@ This starts all example servers and opens [MCP Inspector](https://github.com/mod
 | 3001 | [node-server](./examples/node-server/) | Proofs + restricted tools (low-level API) |
 | 3002 | [consent-basic](./examples/consent-basic/) | Human consent flow with built-in UI |
 | 3003 | [consent-full](./examples/consent-full/) | Production consent UI ([@kya-os/consent](https://www.npmjs.com/package/@kya-os/consent)) |
-| 3004 | [context7-with-mcpi](./examples/context7-with-mcpi/) | 2-line migration of a real MCP server |
+| 3004 | [context7-with-kya-os](./examples/context7-with-kya-os/) | 2-line migration of a real MCP server |
 
 Also available: [outbound-delegation](./examples/outbound-delegation/) (gateway pattern), [verify-proof](./examples/verify-proof/) (standalone verification), [statuslist](./examples/statuslist/) (revocation lifecycle).
 
 ---
 
-## What's Under the Hood
+## What's under the hood
 
 | Capability | How it works |
 |-----------|-------------|
 | **Cryptographic identity** | Ed25519 key pairs, `did:key` and `did:web` resolution |
 | **Signed proofs** | Detached JWS over JCS-canonicalized request/response hashes |
-| **Delegation credentials** | W3C Verifiable Credentials with scope constraints |
+| **Delegation credentials** | W3C Verifiable Credentials with scope constraints, rooted at a Responsible Party |
 | **Revocation** | StatusList2021 bitstring with cascading revocation |
 | **Replay prevention** | Nonce-based handshake with timestamp skew validation |
 | **Extensible** | Bring your own KMS, HSM, nonce cache (Redis, DynamoDB, KV), or DID method |
@@ -127,7 +144,7 @@ Also available: [outbound-delegation](./examples/outbound-delegation/) (gateway
 
 ## Links
 
-- [Spec](https://modelcontextprotocol-identity.io) | [DIF TAAWG](https://identity.foundation/working-groups/agent-and-authorization.html) | [npm](https://www.npmjs.com/package/@kya-os/mcp)
+- [Spec](./SPEC.md) | [Changelog](./CHANGELOG.md) | [DIF TAAWG](https://identity.foundation/working-groups/agent-and-authorization.html) | [npm](https://www.npmjs.com/package/@kya-os/mcp)
 - [CONTRIBUTING.md](./CONTRIBUTING.md) | [CONFORMANCE.md](./CONFORMANCE.md) | [SECURITY.md](./SECURITY.md) | [GOVERNANCE.md](./GOVERNANCE.md)
 
 ## License

package/dist/auth/handshake.d.ts

@@ -1,7 +1,7 @@
 /**
  * Authorization Handshake — Platform-agnostic Protocol Reference
  *
- * Orchestrates the MCP-I authorization flow:
+ * Orchestrates the KYA-OS authorization flow:
  * 1. Check agent reputation (optional)
  * 2. Verify delegation exists
  * 3. Return needs_authorization error if missing

package/dist/auth/handshake.js

@@ -1,7 +1,7 @@
 /**
  * Authorization Handshake — Platform-agnostic Protocol Reference
  *
- * Orchestrates the MCP-I authorization flow:
+ * Orchestrates the KYA-OS authorization flow:
  * 1. Check agent reputation (optional)
  * 2. Verify delegation exists
  * 3. Return needs_authorization error if missing

package/dist/delegation/cascading-revocation.d.ts

@@ -4,7 +4,7 @@
  * Implements cascading revocation per Python POC design.
  * When a parent delegation is revoked, all children are automatically revoked.
  *
- * Related Spec: MCP-I §4.4, Delegation Chains
+ * Related Spec: KYA-OS §4.4, Delegation Chains
  */
 import { DelegationGraphManager } from './delegation-graph.js';
 import { StatusList2021Manager } from './statuslist-manager.js';

package/dist/delegation/cascading-revocation.js

@@ -4,7 +4,7 @@
  * Implements cascading revocation per Python POC design.
  * When a parent delegation is revoked, all children are automatically revoked.
  *
- * Related Spec: MCP-I §4.4, Delegation Chains
+ * Related Spec: KYA-OS §4.4, Delegation Chains
  */
 export class CascadingRevocationManager {
     graph;

package/dist/delegation/delegation-graph.d.ts

@@ -4,7 +4,7 @@
  * Tracks parent-child relationships between delegation credentials.
  * Critical for cascading revocation per Delegation-Revocation.md.
  *
- * Related Spec: MCP-I §4.4, Delegation Chains
+ * Related Spec: KYA-OS §4.4, Delegation Chains
  */
 export interface DelegationNode {
     id: string;

package/dist/delegation/delegation-graph.js

@@ -4,7 +4,7 @@
  * Tracks parent-child relationships between delegation credentials.
  * Critical for cascading revocation per Delegation-Revocation.md.
  *
- * Related Spec: MCP-I §4.4, Delegation Chains
+ * Related Spec: KYA-OS §4.4, Delegation Chains
  */
 export class DelegationGraphManager {
     storage;

package/dist/delegation/did-web-resolver.d.ts

@@ -10,7 +10,7 @@
  *
  * @see https://w3c-ccg.github.io/did-method-web/
  */
-import type { FetchProvider } from '../providers/base.js';
+import type { FetchProvider, Identity } from '../providers/base.js';
 import type { DIDResolver, DIDDocument } from './vc-verifier.js';
 /**
  * Parsed components of a did:web DID
@@ -79,5 +79,55 @@ export declare class DidWebResolver implements DIDResolver {
 export declare function createDidWebResolver(fetchProvider: FetchProvider, options?: {
     cacheTtl?: number;
 }): DIDResolver;
+/**
+ * Options for {@link buildDidWebDocument}.
+ */
+export interface BuildDidWebDocumentOptions {
+    /**
+     * Additional JSON-LD contexts appended after the defaults
+     * (`did/v1`, `ed25519-2020/v1`). Use to declare credential or
+     * service contexts the controller publishes alongside its keys.
+     */
+    additionalContexts?: readonly string[];
+}
+/**
+ * Build the DID Document a did:web controller serves at its
+ * resolution URL (see {@link didWebToUrl}).
+ *
+ * Emits a single Ed25519 verification method derived from
+ * `identity.publicKey` (base64-encoded raw bytes — the
+ * {@link Identity} convention). Both `publicKeyJwk` and
+ * `publicKeyMultibase` are included for cross-format interop with
+ * verifiers that prefer one over the other.
+ *
+ * The verification method is published in both `authentication` and
+ * `assertionMethod`, matching the {@link createDidKeyResolver} output
+ * and the most common verifier expectations.
+ *
+ * The function is purely synchronous and performs no I/O. Hosts
+ * publish the returned object verbatim (e.g. as the body of a
+ * `/.well-known/did.json` route).
+ *
+ * @param identity - Subject identity. `did` must be a `did:web:` DID;
+ *   `kid` must reference the same DID (`<did>#<fragment>`).
+ * @param options - Optional context extensions.
+ * @returns DID Document satisfying the W3C DID Core data model.
+ * @throws Error when `identity.did` is not a `did:web:` DID, when
+ *   `identity.kid` does not reference `identity.did`, or when
+ *   `identity.publicKey` is not a valid base64 string of the
+ *   expected length.
+ *
+ * @example
+ * ```typescript
+ * const document = buildDidWebDocument({
+ *   did: 'did:web:example.com:agents:bot1',
+ *   kid: 'did:web:example.com:agents:bot1#keys-1',
+ *   publicKey: agent.publicKey, // base64-encoded Ed25519
+ *   createdAt: new Date().toISOString(),
+ * });
+ * // Serve `document` at https://example.com/agents/bot1/did.json
+ * ```
+ */
+export declare function buildDidWebDocument(identity: Identity, options?: BuildDidWebDocumentOptions): DIDDocument;
 export {};
 //# sourceMappingURL=did-web-resolver.d.ts.map

package/dist/delegation/did-web-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"did-web-resolver.d.ts","sourceRoot":"","sources":["../../src/delegation/did-web-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAsB,MAAM,kBAAkB,CAAC;AAGrF;;GAEG;AACH,UAAU,YAAY;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AA0DD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE7C;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CA0B5D;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAsBtD;AAED;;GAEG;AACH,qBAAa,cAAe,YAAW,WAAW;IAChD,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,KAAK,CAA4D;IACzE,OAAO,CAAC,QAAQ,CAAS;gBAEb,aAAa,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;IAMzE;;;;;OAKG;IACG,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAgEvD;;OAEG;IACH,UAAU,IAAI,IAAI;IAIlB;;OAEG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;CAGnC;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,aAAa,EAAE,aAAa,EAC5B,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9B,WAAW,CAEb"}
+{"version":3,"file":"did-web-resolver.d.ts","sourceRoot":"","sources":["../../src/delegation/did-web-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAsB,MAAM,kBAAkB,CAAC;AAMrF;;GAEG;AACH,UAAU,YAAY;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AA0DD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE7C;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CA0B5D;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAsBtD;AAED;;GAEG;AACH,qBAAa,cAAe,YAAW,WAAW;IAChD,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,KAAK,CAA4D;IACzE,OAAO,CAAC,QAAQ,CAAS;gBAEb,aAAa,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;IAMzE;;;;;OAKG;IACG,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAgEvD;;OAEG;IACH,UAAU,IAAI,IAAI;IAIlB;;OAEG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;CAGnC;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,aAAa,EAAE,aAAa,EAC5B,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9B,WAAW,CAEb;AAeD;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,0BAA0B,GACnC,WAAW,CAoCb"}

package/dist/delegation/did-web-resolver.js

@@ -11,6 +11,9 @@
  * @see https://w3c-ccg.github.io/did-method-web/
  */
 import { logger } from '../logging/index.js';
+import { base58Encode } from '../utils/base58.js';
+import { base64ToBytes } from '../utils/base64.js';
+import { publicKeyToJwk } from './did-key-resolver.js';
 /**
  * Type guard for checking if value is a valid DID Document structure
  */
@@ -215,4 +218,109 @@ export class DidWebResolver {
 export function createDidWebResolver(fetchProvider, options) {
     return new DidWebResolver(fetchProvider, options);
 }
+/** Ed25519 multicodec prefix (0xed 0x01) used for `publicKeyMultibase`. */
+const ED25519_MULTICODEC_PREFIX = new Uint8Array([0xed, 0x01]);
+/**
+ * Default JSON-LD contexts for an Ed25519-keyed did:web Document.
+ * `did/v1` is required by DID Core; `ed25519-2020/v1` defines the
+ * `Ed25519VerificationKey2020` type emitted below.
+ */
+const DEFAULT_DID_WEB_CONTEXTS = [
+    'https://www.w3.org/ns/did/v1',
+    'https://w3id.org/security/suites/ed25519-2020/v1',
+];
+/**
+ * Build the DID Document a did:web controller serves at its
+ * resolution URL (see {@link didWebToUrl}).
+ *
+ * Emits a single Ed25519 verification method derived from
+ * `identity.publicKey` (base64-encoded raw bytes — the
+ * {@link Identity} convention). Both `publicKeyJwk` and
+ * `publicKeyMultibase` are included for cross-format interop with
+ * verifiers that prefer one over the other.
+ *
+ * The verification method is published in both `authentication` and
+ * `assertionMethod`, matching the {@link createDidKeyResolver} output
+ * and the most common verifier expectations.
+ *
+ * The function is purely synchronous and performs no I/O. Hosts
+ * publish the returned object verbatim (e.g. as the body of a
+ * `/.well-known/did.json` route).
+ *
+ * @param identity - Subject identity. `did` must be a `did:web:` DID;
+ *   `kid` must reference the same DID (`<did>#<fragment>`).
+ * @param options - Optional context extensions.
+ * @returns DID Document satisfying the W3C DID Core data model.
+ * @throws Error when `identity.did` is not a `did:web:` DID, when
+ *   `identity.kid` does not reference `identity.did`, or when
+ *   `identity.publicKey` is not a valid base64 string of the
+ *   expected length.
+ *
+ * @example
+ * ```typescript
+ * const document = buildDidWebDocument({
+ *   did: 'did:web:example.com:agents:bot1',
+ *   kid: 'did:web:example.com:agents:bot1#keys-1',
+ *   publicKey: agent.publicKey, // base64-encoded Ed25519
+ *   createdAt: new Date().toISOString(),
+ * });
+ * // Serve `document` at https://example.com/agents/bot1/did.json
+ * ```
+ */
+export function buildDidWebDocument(identity, options) {
+    if (!isDidWeb(identity.did)) {
+        throw new Error(`buildDidWebDocument: identity.did must be a did:web DID (got "${identity.did}")`);
+    }
+    if (!identity.kid.startsWith(`${identity.did}#`)) {
+        throw new Error(`buildDidWebDocument: identity.kid "${identity.kid}" does not reference identity.did "${identity.did}"`);
+    }
+    const publicKeyBytes = decodePublicKey(identity.publicKey);
+    const publicKeyJwk = publicKeyToJwk(publicKeyBytes);
+    const publicKeyMultibase = encodeEd25519Multibase(publicKeyBytes);
+    const verificationMethod = {
+        id: identity.kid,
+        type: 'Ed25519VerificationKey2020',
+        controller: identity.did,
+        publicKeyJwk,
+        publicKeyMultibase,
+    };
+    const contexts = options?.additionalContexts?.length
+        ? [...DEFAULT_DID_WEB_CONTEXTS, ...options.additionalContexts]
+        : [...DEFAULT_DID_WEB_CONTEXTS];
+    return {
+        '@context': contexts,
+        id: identity.did,
+        verificationMethod: [verificationMethod],
+        authentication: [identity.kid],
+        assertionMethod: [identity.kid],
+    };
+}
+/**
+ * Decode a base64-encoded Ed25519 public key to raw bytes.
+ *
+ * The {@link Identity} contract documents `publicKey` as base64 of the
+ * 32-byte Ed25519 public key. We accept that length only — anything
+ * else is a programming error and surfaces as a thrown construction
+ * exception (per the repository error contract: construction throws,
+ * verification/resolution returns).
+ */
+function decodePublicKey(publicKeyBase64) {
+    const bytes = base64ToBytes(publicKeyBase64);
+    if (bytes.length !== 32) {
+        throw new Error(`buildDidWebDocument: expected 32-byte Ed25519 public key, got ${bytes.length} bytes after base64 decode`);
+    }
+    return bytes;
+}
+/**
+ * Encode raw Ed25519 public key bytes as `publicKeyMultibase`
+ * (multicodec-tagged, base58btc-encoded, `z`-prefixed). Matches the
+ * encoding used by {@link createDidKeyResolver} for the equivalent
+ * field on did:key documents.
+ */
+function encodeEd25519Multibase(publicKeyBytes) {
+    const multicodec = new Uint8Array(ED25519_MULTICODEC_PREFIX.length + publicKeyBytes.length);
+    multicodec.set(ED25519_MULTICODEC_PREFIX);
+    multicodec.set(publicKeyBytes, ED25519_MULTICODEC_PREFIX.length);
+    return `z${base58Encode(multicodec)}`;
+}
 //# sourceMappingURL=did-web-resolver.js.map

package/dist/delegation/did-web-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"did-web-resolver.js","sourceRoot":"","sources":["../../src/delegation/did-web-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAU7C;;GAEG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,GAAG,GAAG,KAAgC,CAAC;IAE7C,sCAAsC;IACtC,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iEAAiE;IACjE,IAAI,GAAG,CAAC,oBAAoB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qDAAqD;QACrD,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,yBAAyB,CAAC,EAAE,CAAC,EAAE,CAAC;gBACnC,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,EAAE,GAAG,KAAgC,CAAC;IAE5C,gDAAgD;IAChD,IAAI,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,EAAE,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,OAAO,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+BAA+B;IAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE/B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iDAAiD;IACjD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEnC,yCAAyC;IACzC,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAE7C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gCAAgC;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9D,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAEhC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAEhC,gBAAgB;IAChB,6CAA6C;IAC7C,IAAI,GAAG,GAAG,WAAW,MAAM,EAAE,CAAC;IAE9B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,yCAAyC;QACzC,GAAG,IAAI,uBAAuB,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,6CAA6C;QAC7C,GAAG,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC;IAC5C,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,cAAc;IACjB,aAAa,CAAgB;IAC7B,KAAK,CAA4D;IACjE,QAAQ,CAAS;IAEzB,YAAY,aAA4B,EAAE,OAA+B;QACvE,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,CAAC,oBAAoB;IACpE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,GAAW;QACvB,0BAA0B;QAC1B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,cAAc;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QAED,iBAAiB;QACjB,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,4CAA4C,GAAG,EAAE,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,yBAAyB;YACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAErD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,yBAAyB,QAAQ,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,CAAC;gBACxE,OAAO,IAAI,CAAC;YACd,CAAC;YAED,aAAa;YACb,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAC;gBACzD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,qBAAqB;YACrB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,wDAAwD,GAAG,EAAE,CAAC,CAAC;gBAC3E,OAAO,IAAI,CAAC;YACd,CAAC;YAED,gCAAgC;YAChC,IAAI,IAAI,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,uDAAuD,GAAG,SAAS,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1F,OAAO,IAAI,CAAC;YACd,CAAC;YAED,mBAAmB;YACnB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;gBAClB,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ;aACtC,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,oCAAoC,GAAG,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACvG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,GAAW;QACzB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,aAA4B,EAC5B,OAA+B;IAE/B,OAAO,IAAI,cAAc,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"did-web-resolver.js","sourceRoot":"","sources":["../../src/delegation/did-web-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAUvD;;GAEG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,GAAG,GAAG,KAAgC,CAAC;IAE7C,sCAAsC;IACtC,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iEAAiE;IACjE,IAAI,GAAG,CAAC,oBAAoB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qDAAqD;QACrD,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,yBAAyB,CAAC,EAAE,CAAC,EAAE,CAAC;gBACnC,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,EAAE,GAAG,KAAgC,CAAC;IAE5C,gDAAgD;IAChD,IAAI,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,EAAE,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,OAAO,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+BAA+B;IAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE/B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iDAAiD;IACjD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEnC,yCAAyC;IACzC,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAE7C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gCAAgC;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9D,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAEhC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAEhC,gBAAgB;IAChB,6CAA6C;IAC7C,IAAI,GAAG,GAAG,WAAW,MAAM,EAAE,CAAC;IAE9B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,yCAAyC;QACzC,GAAG,IAAI,uBAAuB,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,6CAA6C;QAC7C,GAAG,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC;IAC5C,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,cAAc;IACjB,aAAa,CAAgB;IAC7B,KAAK,CAA4D;IACjE,QAAQ,CAAS;IAEzB,YAAY,aAA4B,EAAE,OAA+B;QACvE,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,CAAC,oBAAoB;IACpE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,GAAW;QACvB,0BAA0B;QAC1B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,cAAc;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QAED,iBAAiB;QACjB,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,4CAA4C,GAAG,EAAE,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,yBAAyB;YACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAErD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,yBAAyB,QAAQ,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,CAAC;gBACxE,OAAO,IAAI,CAAC;YACd,CAAC;YAED,aAAa;YACb,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAC;gBACzD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,qBAAqB;YACrB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,wDAAwD,GAAG,EAAE,CAAC,CAAC;gBAC3E,OAAO,IAAI,CAAC;YACd,CAAC;YAED,gCAAgC;YAChC,IAAI,IAAI,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,uDAAuD,GAAG,SAAS,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1F,OAAO,IAAI,CAAC;YACd,CAAC;YAED,mBAAmB;YACnB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;gBAClB,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ;aACtC,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,oCAAoC,GAAG,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACvG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,GAAW;QACzB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,aAA4B,EAC5B,OAA+B;IAE/B,OAAO,IAAI,cAAc,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,2EAA2E;AAC3E,MAAM,yBAAyB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAE/D;;;;GAIG;AACH,MAAM,wBAAwB,GAAsB;IAClD,8BAA8B;IAC9B,kDAAkD;CACnD,CAAC;AAcF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAkB,EAClB,OAAoC;IAEpC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,iEAAiE,QAAQ,CAAC,GAAG,IAAI,CAClF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,sCAAsC,QAAQ,CAAC,GAAG,sCAAsC,QAAQ,CAAC,GAAG,GAAG,CACxG,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;IACpD,MAAM,kBAAkB,GAAG,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAElE,MAAM,kBAAkB,GAAuB;QAC7C,EAAE,EAAE,QAAQ,CAAC,GAAG;QAChB,IAAI,EAAE,4BAA4B;QAClC,UAAU,EAAE,QAAQ,CAAC,GAAG;QACxB,YAAY;QACZ,kBAAkB;KACnB,CAAC;IAEF,MAAM,QAAQ,GAAG,OAAO,EAAE,kBAAkB,EAAE,MAAM;QAClD,CAAC,CAAC,CAAC,GAAG,wBAAwB,EAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAC9D,CAAC,CAAC,CAAC,GAAG,wBAAwB,CAAC,CAAC;IAElC,OAAO;QACL,UAAU,EAAE,QAAQ;QACpB,EAAE,EAAE,QAAQ,CAAC,GAAG;QAChB,kBAAkB,EAAE,CAAC,kBAAkB,CAAC;QACxC,cAAc,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC9B,eAAe,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;KAChC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,eAAuB;IAC9C,MAAM,KAAK,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,iEAAiE,KAAK,CAAC,MAAM,4BAA4B,CAC1G,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,cAA0B;IACxD,MAAM,UAAU,GAAG,IAAI,UAAU,CAC/B,yBAAyB,CAAC,MAAM,GAAG,cAAc,CAAC,MAAM,CACzD,CAAC;IACF,UAAU,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC1C,UAAU,CAAC,GAAG,CAAC,cAAc,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACjE,OAAO,IAAI,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;AACxC,CAAC"}