@kya-os/mcp 1.2.0

package/dist/auth/types.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Authorization types for the auth module.
+ *
+ * Minimal interfaces required by the auth handshake.
+ */
+import type { DelegationRecord } from '../types/protocol.js';
+export interface VerifyDelegationResult {
+    valid: boolean;
+    delegation?: DelegationRecord;
+    credential?: {
+        agent_did: string;
+        user_did: string;
+        scopes: string[];
+        authorization: {
+            type: 'oauth' | 'oauth2' | 'password' | 'credential' | 'webauthn' | 'siwe' | 'none';
+            provider?: string;
+            credentialType?: string;
+            rpId?: string;
+            userVerification?: 'required' | 'preferred' | 'discouraged';
+            chainId?: number;
+            domain?: string;
+        };
+        [key: string]: unknown;
+    };
+    reason?: string;
+    cached?: boolean;
+}
+export interface DelegationVerifier {
+    verify(agentDid: string, scopes: string[]): Promise<VerifyDelegationResult>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,UAAU,CAAC,EAAE;QACX,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,aAAa,EAAE;YACb,IAAI,EACA,OAAO,GACP,QAAQ,GACR,UAAU,GACV,YAAY,GACZ,UAAU,GACV,MAAM,GACN,MAAM,CAAC;YACX,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,cAAc,CAAC,EAAE,MAAM,CAAC;YACxB,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,gBAAgB,CAAC,EAAE,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;YAC5D,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,MAAM,CAAC,EAAE,MAAM,CAAC;SACjB,CAAC;QACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAC7E"}

package/dist/auth/types.js

@@ -0,0 +1,7 @@
+/**
+ * Authorization types for the auth module.
+ *
+ * Minimal interfaces required by the auth handshake.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/delegation/audience-validator.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Delegation Audience Validation
+ *
+ * Validates if a delegation's audience matches the server DID.
+ * Supports both single server DID and multiple server DIDs.
+ */
+import type { DelegationRecord } from '../types/protocol.js';
+export declare function verifyDelegationAudience(delegation: DelegationRecord, serverDid: string): boolean;
+//# sourceMappingURL=audience-validator.d.ts.map

package/dist/delegation/audience-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audience-validator.d.ts","sourceRoot":"","sources":["../../src/delegation/audience-validator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,gBAAgB,EAC5B,SAAS,EAAE,MAAM,GAChB,OAAO,CAWT"}

package/dist/delegation/audience-validator.js

@@ -0,0 +1,17 @@
+/**
+ * Delegation Audience Validation
+ *
+ * Validates if a delegation's audience matches the server DID.
+ * Supports both single server DID and multiple server DIDs.
+ */
+export function verifyDelegationAudience(delegation, serverDid) {
+    if (!delegation.constraints.audience) {
+        return true;
+    }
+    const audience = delegation.constraints.audience;
+    if (typeof audience === 'string') {
+        return audience === serverDid;
+    }
+    return audience.includes(serverDid);
+}
+//# sourceMappingURL=audience-validator.js.map

package/dist/delegation/audience-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audience-validator.js","sourceRoot":"","sources":["../../src/delegation/audience-validator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,UAAU,wBAAwB,CACtC,UAA4B,EAC5B,SAAiB;IAEjB,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC;IACjD,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,QAAQ,KAAK,SAAS,CAAC;IAChC,CAAC;IAED,OAAO,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AACtC,CAAC"}

package/dist/delegation/bitstring.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Bitstring Utilities for StatusList2021
+ *
+ * Implements GZIP compression + base64url encoding for efficient status lists.
+ * Per W3C StatusList2021 spec, each bit represents credential status:
+ * - 0: Not revoked/suspended
+ * - 1: Revoked/suspended
+ *
+ * Related Spec: W3C StatusList2021
+ */
+export interface CompressionFunction {
+    compress(data: Uint8Array): Promise<Uint8Array>;
+}
+export interface DecompressionFunction {
+    decompress(data: Uint8Array): Promise<Uint8Array>;
+}
+export declare class BitstringManager {
+    private compressor;
+    private decompressor;
+    private bits;
+    private size;
+    constructor(size: number, compressor: CompressionFunction, decompressor: DecompressionFunction);
+    setBit(index: number, value: boolean): void;
+    getBit(index: number): boolean;
+    getSetBits(): number[];
+    encode(): Promise<string>;
+    static decode(encodedList: string, compressor: CompressionFunction, decompressor: DecompressionFunction): Promise<BitstringManager>;
+    getRawBits(): Uint8Array;
+    getSize(): number;
+    private base64urlEncode;
+    private static base64urlDecode;
+    private bytesToBase64;
+    private static base64ToBytes;
+    static fromSetBits(size: number, setBits: number[], compressor: CompressionFunction, decompressor: DecompressionFunction): BitstringManager;
+}
+export declare function isIndexSet(encodedList: string, index: number, decompressor: DecompressionFunction): Promise<boolean>;
+//# sourceMappingURL=bitstring.d.ts.map

package/dist/delegation/bitstring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bitstring.d.ts","sourceRoot":"","sources":["../../src/delegation/bitstring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACnD;AAED,qBAAa,gBAAgB;IAMzB,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,YAAY;IANtB,OAAO,CAAC,IAAI,CAAa;IACzB,OAAO,CAAC,IAAI,CAAS;gBAGnB,IAAI,EAAE,MAAM,EACJ,UAAU,EAAE,mBAAmB,EAC/B,YAAY,EAAE,qBAAqB;IAO7C,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAe3C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAW9B,UAAU,IAAI,MAAM,EAAE;IAUhB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;WAKlB,MAAM,CACjB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,mBAAmB,EAC/B,YAAY,EAAE,qBAAqB,GAClC,OAAO,CAAC,gBAAgB,CAAC;IAU5B,UAAU,IAAI,UAAU;IAIxB,OAAO,IAAI,MAAM;IAIjB,OAAO,CAAC,eAAe;IAKvB,OAAO,CAAC,MAAM,CAAC,eAAe;IAQ9B,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,MAAM,CAAC,aAAa;IAa5B,MAAM,CAAC,WAAW,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EAAE,EACjB,UAAU,EAAE,mBAAmB,EAC/B,YAAY,EAAE,qBAAqB,GAClC,gBAAgB;CAOpB;AAED,wBAAsB,UAAU,CAC9B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,qBAAqB,GAClC,OAAO,CAAC,OAAO,CAAC,CAYlB"}

package/dist/delegation/bitstring.js

@@ -0,0 +1,117 @@
+/**
+ * Bitstring Utilities for StatusList2021
+ *
+ * Implements GZIP compression + base64url encoding for efficient status lists.
+ * Per W3C StatusList2021 spec, each bit represents credential status:
+ * - 0: Not revoked/suspended
+ * - 1: Revoked/suspended
+ *
+ * Related Spec: W3C StatusList2021
+ */
+export class BitstringManager {
+    compressor;
+    decompressor;
+    bits;
+    size;
+    constructor(size, compressor, decompressor) {
+        this.compressor = compressor;
+        this.decompressor = decompressor;
+        this.size = size;
+        const byteCount = Math.ceil(size / 8);
+        this.bits = new Uint8Array(byteCount);
+    }
+    setBit(index, value) {
+        if (index < 0 || index >= this.size) {
+            throw new Error(`Bit index ${index} out of range (0-${this.size - 1})`);
+        }
+        const byteIndex = Math.floor(index / 8);
+        const bitIndex = index % 8;
+        if (value) {
+            this.bits[byteIndex] |= 1 << bitIndex;
+        }
+        else {
+            this.bits[byteIndex] &= ~(1 << bitIndex);
+        }
+    }
+    getBit(index) {
+        if (index < 0 || index >= this.size) {
+            throw new Error(`Bit index ${index} out of range (0-${this.size - 1})`);
+        }
+        const byteIndex = Math.floor(index / 8);
+        const bitIndex = index % 8;
+        return (this.bits[byteIndex] & (1 << bitIndex)) !== 0;
+    }
+    getSetBits() {
+        const setBits = [];
+        for (let i = 0; i < this.size; i++) {
+            if (this.getBit(i)) {
+                setBits.push(i);
+            }
+        }
+        return setBits;
+    }
+    async encode() {
+        const compressed = await this.compressor.compress(this.bits);
+        return this.base64urlEncode(compressed);
+    }
+    static async decode(encodedList, compressor, decompressor) {
+        const compressed = BitstringManager.base64urlDecode(encodedList);
+        const decompressed = await decompressor.decompress(compressed);
+        const size = decompressed.length * 8;
+        const manager = new BitstringManager(size, compressor, decompressor);
+        manager.bits = decompressed;
+        return manager;
+    }
+    getRawBits() {
+        return this.bits;
+    }
+    getSize() {
+        return this.size;
+    }
+    base64urlEncode(data) {
+        const base64 = this.bytesToBase64(data);
+        return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+    }
+    static base64urlDecode(encoded) {
+        let base64 = encoded.replace(/-/g, '+').replace(/_/g, '/');
+        while (base64.length % 4 !== 0) {
+            base64 += '=';
+        }
+        return BitstringManager.base64ToBytes(base64);
+    }
+    bytesToBase64(bytes) {
+        const binary = Array.from(bytes)
+            .map((byte) => String.fromCharCode(byte))
+            .join('');
+        return btoa(binary);
+    }
+    static base64ToBytes(base64) {
+        let standardBase64 = base64.replace(/-/g, '+').replace(/_/g, '/');
+        const paddingNeeded = (4 - (standardBase64.length % 4)) % 4;
+        standardBase64 += '='.repeat(paddingNeeded);
+        const binary = atob(standardBase64);
+        const bytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++) {
+            bytes[i] = binary.charCodeAt(i);
+        }
+        return bytes;
+    }
+    static fromSetBits(size, setBits, compressor, decompressor) {
+        const manager = new BitstringManager(size, compressor, decompressor);
+        for (const index of setBits) {
+            manager.setBit(index, true);
+        }
+        return manager;
+    }
+}
+export async function isIndexSet(encodedList, index, decompressor) {
+    const compressed = BitstringManager['base64urlDecode'](encodedList);
+    const decompressed = await decompressor.decompress(compressed);
+    const byteIndex = Math.floor(index / 8);
+    const bitIndex = index % 8;
+    if (byteIndex >= decompressed.length) {
+        return false;
+    }
+    return (decompressed[byteIndex] & (1 << bitIndex)) !== 0;
+}
+//# sourceMappingURL=bitstring.js.map

package/dist/delegation/bitstring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bitstring.js","sourceRoot":"","sources":["../../src/delegation/bitstring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAUH,MAAM,OAAO,gBAAgB;IAMjB;IACA;IANF,IAAI,CAAa;IACjB,IAAI,CAAS;IAErB,YACE,IAAY,EACJ,UAA+B,EAC/B,YAAmC;QADnC,eAAU,GAAV,UAAU,CAAqB;QAC/B,iBAAY,GAAZ,YAAY,CAAuB;QAE3C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,CAAC,KAAa,EAAE,KAAc;QAClC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,oBAAoB,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,KAAK,GAAG,CAAC,CAAC;QAE3B,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,IAAI,CAAC,SAAS,CAAE,IAAI,CAAC,IAAI,QAAQ,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,SAAS,CAAE,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,oBAAoB,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,KAAK,GAAG,CAAC,CAAC;QAE3B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAE,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC;IAED,UAAU;QACR,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,WAAmB,EACnB,UAA+B,EAC/B,YAAmC;QAEnC,MAAM,UAAU,GAAG,gBAAgB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAE/D,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC;QAC5B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAEO,eAAe,CAAC,IAAgB;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IAEO,MAAM,CAAC,eAAe,CAAC,OAAe;QAC5C,IAAI,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3D,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,CAAC;QAChB,CAAC;QACD,OAAO,gBAAgB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAEO,aAAa,CAAC,KAAiB;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;aAC7B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;aACxC,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAEO,MAAM,CAAC,aAAa,CAAC,MAAc;QACzC,IAAI,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAClE,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5D,cAAc,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAE5C,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,CAAC,WAAW,CAChB,IAAY,EACZ,OAAiB,EACjB,UAA+B,EAC/B,YAAmC;QAEnC,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;QACrE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,WAAmB,EACnB,KAAa,EACb,YAAmC;IAEnC,MAAM,UAAU,GAAI,gBAA8E,CAAC,iBAAiB,CAAC,CAAC,WAAW,CAAC,CAAC;IACnI,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAE/D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,KAAK,GAAG,CAAC,CAAC;IAE3B,IAAI,SAAS,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,YAAY,CAAC,SAAS,CAAE,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC"}

package/dist/delegation/cascading-revocation.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Cascading Revocation Manager
+ *
+ * Implements cascading revocation per Python POC design.
+ * When a parent delegation is revoked, all children are automatically revoked.
+ *
+ * Related Spec: MCP-I §4.4, Delegation Chains
+ */
+import { DelegationGraphManager } from './delegation-graph.js';
+import { StatusList2021Manager } from './statuslist-manager.js';
+export interface RevocationEvent {
+    delegationId: string;
+    isRoot: boolean;
+    parentId?: string;
+    timestamp: number;
+    reason?: string;
+}
+export type RevocationHook = (event: RevocationEvent) => Promise<void> | void;
+export interface CascadingRevocationOptions {
+    reason?: string;
+    onRevoke?: RevocationHook;
+    maxDepth?: number;
+    dryRun?: boolean;
+}
+export declare class CascadingRevocationManager {
+    private graph;
+    private statusList;
+    constructor(graph: DelegationGraphManager, statusList: StatusList2021Manager);
+    revokeDelegation(delegationId: string, options?: CascadingRevocationOptions): Promise<RevocationEvent[]>;
+    private revokeNode;
+    restoreDelegation(delegationId: string): Promise<RevocationEvent>;
+    isRevoked(delegationId: string): Promise<{
+        revoked: boolean;
+        reason?: string;
+        revokedAncestor?: string;
+    }>;
+    getRevokedInSubtree(rootId: string): Promise<string[]>;
+    private parseCredentialStatus;
+    validateDelegation(delegationId: string): Promise<{
+        valid: boolean;
+        reason?: string;
+    }>;
+}
+export declare function createCascadingRevocationManager(graph: DelegationGraphManager, statusList: StatusList2021Manager): CascadingRevocationManager;
+//# sourceMappingURL=cascading-revocation.d.ts.map

package/dist/delegation/cascading-revocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cascading-revocation.d.ts","sourceRoot":"","sources":["../../src/delegation/cascading-revocation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,sBAAsB,EAAuB,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAE9E,MAAM,WAAW,0BAA0B;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,0BAA0B;IAEnC,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,UAAU;gBADV,KAAK,EAAE,sBAAsB,EAC7B,UAAU,EAAE,qBAAqB;IAGrC,gBAAgB,CACpB,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,eAAe,EAAE,CAAC;YA8Cf,UAAU;IA6BlB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAuBjE,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAC7C,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IAwBI,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAmB5D,OAAO,CAAC,qBAAqB;IAgBvB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAkB7F;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,sBAAsB,EAC7B,UAAU,EAAE,qBAAqB,GAChC,0BAA0B,CAE5B"}

package/dist/delegation/cascading-revocation.js

@@ -0,0 +1,150 @@
+/**
+ * Cascading Revocation Manager
+ *
+ * Implements cascading revocation per Python POC design.
+ * When a parent delegation is revoked, all children are automatically revoked.
+ *
+ * Related Spec: MCP-I §4.4, Delegation Chains
+ */
+export class CascadingRevocationManager {
+    graph;
+    statusList;
+    constructor(graph, statusList) {
+        this.graph = graph;
+        this.statusList = statusList;
+    }
+    async revokeDelegation(delegationId, options = {}) {
+        const maxDepth = options.maxDepth || 100;
+        const events = [];
+        const targetNode = await this.graph.getNode(delegationId);
+        if (!targetNode) {
+            throw new Error(`Delegation not found: ${delegationId}`);
+        }
+        const depth = await this.graph.getDepth(delegationId);
+        if (depth > maxDepth) {
+            throw new Error(`Delegation depth ${depth} exceeds maximum ${maxDepth}`);
+        }
+        const rootEvent = await this.revokeNode(targetNode, true, options.reason, options.dryRun);
+        events.push(rootEvent);
+        if (options.onRevoke) {
+            await options.onRevoke(rootEvent);
+        }
+        const descendants = await this.graph.getDescendants(delegationId);
+        for (const descendant of descendants) {
+            const event = await this.revokeNode(descendant, false, `Cascaded from ${delegationId}`, options.dryRun, delegationId);
+            events.push(event);
+            if (options.onRevoke) {
+                await options.onRevoke(event);
+            }
+        }
+        return events;
+    }
+    async revokeNode(node, isRoot, reason, dryRun, parentId) {
+        const event = {
+            delegationId: node.id,
+            isRoot,
+            parentId,
+            timestamp: Date.now(),
+            reason,
+        };
+        if (dryRun) {
+            return event;
+        }
+        if (node.credentialStatusId) {
+            const credentialStatus = this.parseCredentialStatus(node.credentialStatusId);
+            if (credentialStatus) {
+                await this.statusList.updateStatus(credentialStatus, true);
+            }
+        }
+        return event;
+    }
+    async restoreDelegation(delegationId) {
+        const node = await this.graph.getNode(delegationId);
+        if (!node) {
+            throw new Error(`Delegation not found: ${delegationId}`);
+        }
+        const event = {
+            delegationId: node.id,
+            isRoot: true,
+            timestamp: Date.now(),
+            reason: 'Restored',
+        };
+        if (node.credentialStatusId) {
+            const credentialStatus = this.parseCredentialStatus(node.credentialStatusId);
+            if (credentialStatus) {
+                await this.statusList.updateStatus(credentialStatus, false);
+            }
+        }
+        return event;
+    }
+    async isRevoked(delegationId) {
+        // Walk root → target so ancestor revocation is detected before the
+        // target's own (cascade-set) bit. getChain() already returns root-first order.
+        const chain = await this.graph.getChain(delegationId);
+        for (const node of chain) {
+            if (node.credentialStatusId) {
+                const credentialStatus = this.parseCredentialStatus(node.credentialStatusId);
+                if (credentialStatus) {
+                    const isRevoked = await this.statusList.checkStatus(credentialStatus);
+                    if (isRevoked) {
+                        return {
+                            revoked: true,
+                            reason: node.id === delegationId ? 'Directly revoked' : 'Ancestor revoked',
+                            revokedAncestor: node.id === delegationId ? undefined : node.id,
+                        };
+                    }
+                }
+            }
+        }
+        return { revoked: false };
+    }
+    async getRevokedInSubtree(rootId) {
+        const descendants = await this.graph.getDescendants(rootId);
+        const revoked = [];
+        const rootRevoked = await this.isRevoked(rootId);
+        if (rootRevoked.revoked) {
+            revoked.push(rootId);
+        }
+        for (const node of descendants) {
+            const isRevoked = await this.isRevoked(node.id);
+            if (isRevoked.revoked) {
+                revoked.push(node.id);
+            }
+        }
+        return revoked;
+    }
+    parseCredentialStatus(credentialStatusId) {
+        const match = credentialStatusId.match(/^(.+)#(\d+)$/);
+        if (!match)
+            return null;
+        const [, statusListCredential, indexStr] = match;
+        const index = parseInt(indexStr, 10);
+        return {
+            id: credentialStatusId,
+            type: 'StatusList2021Entry',
+            statusPurpose: 'revocation',
+            statusListIndex: index.toString(),
+            statusListCredential: statusListCredential,
+        };
+    }
+    async validateDelegation(delegationId) {
+        const revokedCheck = await this.isRevoked(delegationId);
+        if (revokedCheck.revoked) {
+            return {
+                valid: false,
+                reason: revokedCheck.revokedAncestor
+                    ? `Ancestor ${revokedCheck.revokedAncestor} is revoked`
+                    : 'Delegation is revoked',
+            };
+        }
+        const chainValidation = await this.graph.validateChain(delegationId);
+        if (!chainValidation.valid) {
+            return chainValidation;
+        }
+        return { valid: true };
+    }
+}
+export function createCascadingRevocationManager(graph, statusList) {
+    return new CascadingRevocationManager(graph, statusList);
+}
+//# sourceMappingURL=cascading-revocation.js.map

package/dist/delegation/cascading-revocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cascading-revocation.js","sourceRoot":"","sources":["../../src/delegation/cascading-revocation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAuBH,MAAM,OAAO,0BAA0B;IAE3B;IACA;IAFV,YACU,KAA6B,EAC7B,UAAiC;QADjC,UAAK,GAAL,KAAK,CAAwB;QAC7B,eAAU,GAAV,UAAU,CAAuB;IACxC,CAAC;IAEJ,KAAK,CAAC,gBAAgB,CACpB,YAAoB,EACpB,UAAsC,EAAE;QAExC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC;QACzC,MAAM,MAAM,GAAsB,EAAE,CAAC;QAErC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,oBAAoB,QAAQ,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CACrC,UAAU,EACV,IAAI,EACJ,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,MAAM,CACf,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEvB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QAElE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CACjC,UAAU,EACV,KAAK,EACL,iBAAiB,YAAY,EAAE,EAC/B,OAAO,CAAC,MAAM,EACd,YAAY,CACb,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAEnB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,IAAoB,EACpB,MAAe,EACf,MAAe,EACf,MAAgB,EAChB,QAAiB;QAEjB,MAAM,KAAK,GAAoB;YAC7B,YAAY,EAAE,IAAI,CAAC,EAAE;YACrB,MAAM;YACN,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM;SACP,CAAC;QAEF,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC7E,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,YAAoB;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,KAAK,GAAoB;YAC7B,YAAY,EAAE,IAAI,CAAC,EAAE;YACrB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,UAAU;SACnB,CAAC;QAEF,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC7E,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,YAAoB;QAKlC,mEAAmE;QACnE,+EAA+E;QAC/E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAEtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC5B,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBAC7E,IAAI,gBAAgB,EAAE,CAAC;oBACrB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;oBACtE,IAAI,SAAS,EAAE,CAAC;wBACd,OAAO;4BACL,OAAO,EAAE,IAAI;4BACb,MAAM,EAAE,IAAI,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB;4BAC1E,eAAe,EAAE,IAAI,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;yBAChE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAc;QACtC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChD,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,qBAAqB,CAAC,kBAA0B;QACtD,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,MAAM,CAAC,EAAE,oBAAoB,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC;QACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAS,EAAE,EAAE,CAAC,CAAC;QAEtC,OAAO;YACL,EAAE,EAAE,kBAAkB;YACtB,IAAI,EAAE,qBAAqB;YAC3B,aAAa,EAAE,YAAY;YAC3B,eAAe,EAAE,KAAK,CAAC,QAAQ,EAAE;YACjC,oBAAoB,EAAE,oBAAqB;SAC5C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,YAAoB;QAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,YAAY,CAAC,eAAe;oBAClC,CAAC,CAAC,YAAY,YAAY,CAAC,eAAe,aAAa;oBACvD,CAAC,CAAC,uBAAuB;aAC5B,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACrE,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;CACF;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAA6B,EAC7B,UAAiC;IAEjC,OAAO,IAAI,0BAA0B,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;AAC3D,CAAC"}

package/dist/delegation/delegation-graph.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Delegation Graph Manager
+ *
+ * Tracks parent-child relationships between delegation credentials.
+ * Critical for cascading revocation per Delegation-Revocation.md.
+ *
+ * Related Spec: MCP-I §4.4, Delegation Chains
+ */
+export interface DelegationNode {
+    id: string;
+    parentId: string | null;
+    children: string[];
+    issuerDid: string;
+    subjectDid: string;
+    credentialStatusId?: string;
+}
+export interface DelegationGraphStorageProvider {
+    getNode(delegationId: string): Promise<DelegationNode | null>;
+    setNode(node: DelegationNode): Promise<void>;
+    getChildren(delegationId: string): Promise<DelegationNode[]>;
+    getChain(delegationId: string): Promise<DelegationNode[]>;
+    getDescendants(delegationId: string): Promise<DelegationNode[]>;
+    deleteNode(delegationId: string): Promise<void>;
+}
+export declare class DelegationGraphManager {
+    private storage;
+    constructor(storage: DelegationGraphStorageProvider);
+    registerDelegation(params: {
+        id: string;
+        parentId: string | null;
+        issuerDid: string;
+        subjectDid: string;
+        credentialStatusId?: string;
+    }): Promise<DelegationNode>;
+    private addChildToParent;
+    getNode(delegationId: string): Promise<DelegationNode | null>;
+    getChildren(delegationId: string): Promise<DelegationNode[]>;
+    getDescendants(delegationId: string): Promise<DelegationNode[]>;
+    getChain(delegationId: string): Promise<DelegationNode[]>;
+    isAncestor(ancestorId: string, descendantId: string): Promise<boolean>;
+    getDepth(delegationId: string): Promise<number>;
+    validateChain(delegationId: string): Promise<{
+        valid: boolean;
+        reason?: string;
+    }>;
+    removeDelegation(delegationId: string): Promise<void>;
+}
+export declare function createDelegationGraph(storage: DelegationGraphStorageProvider): DelegationGraphManager;
+//# sourceMappingURL=delegation-graph.d.ts.map

package/dist/delegation/delegation-graph.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-graph.d.ts","sourceRoot":"","sources":["../../src/delegation/delegation-graph.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,8BAA8B;IAC7C,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC9D,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC7D,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC1D,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAChE,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED,qBAAa,sBAAsB;IACrB,OAAO,CAAC,OAAO;gBAAP,OAAO,EAAE,8BAA8B;IAErD,kBAAkB,CAAC,MAAM,EAAE;QAC/B,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC,cAAc,CAAC;YAmBb,gBAAgB;IAYxB,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAI7D,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAI5D,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAI/D,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAIzD,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKtE,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK/C,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA6BjF,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAc5D;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,8BAA8B,GACtC,sBAAsB,CAExB"}

package/dist/delegation/delegation-graph.js

@@ -0,0 +1,99 @@
+/**
+ * Delegation Graph Manager
+ *
+ * Tracks parent-child relationships between delegation credentials.
+ * Critical for cascading revocation per Delegation-Revocation.md.
+ *
+ * Related Spec: MCP-I §4.4, Delegation Chains
+ */
+export class DelegationGraphManager {
+    storage;
+    constructor(storage) {
+        this.storage = storage;
+    }
+    async registerDelegation(params) {
+        const node = {
+            id: params.id,
+            parentId: params.parentId,
+            children: [],
+            issuerDid: params.issuerDid,
+            subjectDid: params.subjectDid,
+            credentialStatusId: params.credentialStatusId,
+        };
+        await this.storage.setNode(node);
+        if (params.parentId) {
+            await this.addChildToParent(params.parentId, params.id);
+        }
+        return node;
+    }
+    async addChildToParent(parentId, childId) {
+        const parent = await this.storage.getNode(parentId);
+        if (!parent) {
+            throw new Error(`Parent delegation not found: ${parentId}`);
+        }
+        if (!parent.children.includes(childId)) {
+            parent.children.push(childId);
+            await this.storage.setNode(parent);
+        }
+    }
+    async getNode(delegationId) {
+        return this.storage.getNode(delegationId);
+    }
+    async getChildren(delegationId) {
+        return this.storage.getChildren(delegationId);
+    }
+    async getDescendants(delegationId) {
+        return this.storage.getDescendants(delegationId);
+    }
+    async getChain(delegationId) {
+        return this.storage.getChain(delegationId);
+    }
+    async isAncestor(ancestorId, descendantId) {
+        const chain = await this.getChain(descendantId);
+        return chain.some((node) => node.id === ancestorId);
+    }
+    async getDepth(delegationId) {
+        const chain = await this.getChain(delegationId);
+        return chain.length - 1;
+    }
+    async validateChain(delegationId) {
+        const chain = await this.getChain(delegationId);
+        if (chain.length === 0) {
+            return { valid: false, reason: 'Delegation not found' };
+        }
+        for (let i = 1; i < chain.length; i++) {
+            const parent = chain[i - 1];
+            const child = chain[i];
+            if (child.issuerDid !== parent.subjectDid) {
+                return {
+                    valid: false,
+                    reason: `Invalid chain: ${child.id} issued by ${child.issuerDid} but parent ${parent.id} subject is ${parent.subjectDid}`,
+                };
+            }
+            if (child.parentId !== parent.id) {
+                return {
+                    valid: false,
+                    reason: `Invalid chain: ${child.id} parentId=${child.parentId} but actual parent is ${parent.id}`,
+                };
+            }
+        }
+        return { valid: true };
+    }
+    async removeDelegation(delegationId) {
+        const node = await this.storage.getNode(delegationId);
+        if (!node)
+            return;
+        if (node.parentId) {
+            const parent = await this.storage.getNode(node.parentId);
+            if (parent) {
+                parent.children = parent.children.filter((id) => id !== delegationId);
+                await this.storage.setNode(parent);
+            }
+        }
+        await this.storage.deleteNode(delegationId);
+    }
+}
+export function createDelegationGraph(storage) {
+    return new DelegationGraphManager(storage);
+}
+//# sourceMappingURL=delegation-graph.js.map

package/dist/delegation/delegation-graph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-graph.js","sourceRoot":"","sources":["../../src/delegation/delegation-graph.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAoBH,MAAM,OAAO,sBAAsB;IACb;IAApB,YAAoB,OAAuC;QAAvC,YAAO,GAAP,OAAO,CAAgC;IAAG,CAAC;IAE/D,KAAK,CAAC,kBAAkB,CAAC,MAMxB;QACC,MAAM,IAAI,GAAmB;YAC3B,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;SAC9C,CAAC;QAEF,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEjC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,QAAgB,EAAE,OAAe;QAC9D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAoB;QAChC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,YAAoB;QACpC,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,YAAoB;QACvC,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,YAAoB;QACjC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAAkB,EAAE,YAAoB;QACvD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,YAAoB;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,YAAoB;QACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAEhD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QAC1D,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YAExB,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC1C,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,kBAAkB,KAAK,CAAC,EAAE,cAAc,KAAK,CAAC,SAAS,eAAe,MAAM,CAAC,EAAE,eAAe,MAAM,CAAC,UAAU,EAAE;iBAC1H,CAAC;YACJ,CAAC;YAED,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;gBACjC,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,kBAAkB,KAAK,CAAC,EAAE,aAAa,KAAK,CAAC,QAAQ,yBAAyB,MAAM,CAAC,EAAE,EAAE;iBAClG,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,YAAoB;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;gBACtE,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAuC;IAEvC,OAAO,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC"}