@kya-os/mcp 1.2.0

package/dist/delegation/did-key-resolver.d.ts

@@ -0,0 +1,64 @@
+/**
+ * DID:key Resolver
+ *
+ * Resolves did:key DIDs to DID Documents with verification methods.
+ * Supports Ed25519 keys (multicodec prefix 0xed01).
+ *
+ * did:key format: did:key:z<multibase-base58btc(<multicodec-prefix><public-key>)>
+ *
+ * For Ed25519:
+ * - Multicodec prefix: 0xed 0x01
+ * - Public key: 32 bytes
+ * - Multibase prefix: 'z' (base58btc)
+ *
+ * @see https://w3c-ccg.github.io/did-method-key/
+ */
+import type { DIDResolver, DIDDocument } from './vc-verifier.js';
+/**
+ * Check if a DID is a valid did:key with Ed25519 key
+ *
+ * Ed25519 keys in did:key start with 'z6Mk' after the method prefix.
+ * The 'z' is the multibase prefix for base58btc, and '6Mk' is the
+ * base58-encoded prefix for Ed25519 (0xed 0x01).
+ *
+ * @param did - The DID to check
+ * @returns true if it's a valid did:key with Ed25519 key
+ */
+export declare function isEd25519DidKey(did: string): boolean;
+/**
+ * Extract the public key bytes from a did:key DID
+ *
+ * @param did - The did:key DID
+ * @returns Public key bytes or null if invalid
+ */
+export declare function extractPublicKeyFromDidKey(did: string): Uint8Array | null;
+/**
+ * Convert Ed25519 public key bytes to JWK format
+ *
+ * @param publicKeyBytes - 32-byte Ed25519 public key
+ * @returns JWK object
+ */
+export declare function publicKeyToJwk(publicKeyBytes: Uint8Array): {
+    kty: string;
+    crv: string;
+    x: string;
+};
+/**
+ * Create a DID:key resolver
+ *
+ * Returns a DIDResolver that can resolve did:key DIDs to DID Documents.
+ * Currently supports only Ed25519 keys.
+ *
+ * @returns DIDResolver implementation for did:key
+ */
+export declare function createDidKeyResolver(): DIDResolver;
+/**
+ * Resolve a did:key DID synchronously
+ *
+ * Convenience function for cases where async is not needed.
+ *
+ * @param did - The did:key DID to resolve
+ * @returns DID Document or null if invalid
+ */
+export declare function resolveDidKeySync(did: string): DIDDocument | null;
+//# sourceMappingURL=did-key-resolver.d.ts.map

package/dist/delegation/did-key-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"did-key-resolver.d.ts","sourceRoot":"","sources":["../../src/delegation/did-key-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAsB,MAAM,kBAAkB,CAAC;AASrF;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CA8BzE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,cAAc,EAAE,UAAU,GAAG;IAC1D,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,EAAE,MAAM,CAAC;CACX,CAMA;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,IAAI,WAAW,CAwClD;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CA6BjE"}

package/dist/delegation/did-key-resolver.js

@@ -0,0 +1,157 @@
+/**
+ * DID:key Resolver
+ *
+ * Resolves did:key DIDs to DID Documents with verification methods.
+ * Supports Ed25519 keys (multicodec prefix 0xed01).
+ *
+ * did:key format: did:key:z<multibase-base58btc(<multicodec-prefix><public-key>)>
+ *
+ * For Ed25519:
+ * - Multicodec prefix: 0xed 0x01
+ * - Public key: 32 bytes
+ * - Multibase prefix: 'z' (base58btc)
+ *
+ * @see https://w3c-ccg.github.io/did-method-key/
+ */
+import { base58Decode } from '../utils/base58.js';
+import { didKeyFragment } from '../utils/did-helpers.js';
+import { base64urlEncodeFromBytes } from '../utils/base64.js';
+import { logger } from '../logging/index.js';
+/** Ed25519 multicodec prefix (0xed 0x01) */
+const ED25519_MULTICODEC_PREFIX = new Uint8Array([0xed, 0x01]);
+/** Ed25519 public key length */
+const ED25519_PUBLIC_KEY_LENGTH = 32;
+/**
+ * Check if a DID is a valid did:key with Ed25519 key
+ *
+ * Ed25519 keys in did:key start with 'z6Mk' after the method prefix.
+ * The 'z' is the multibase prefix for base58btc, and '6Mk' is the
+ * base58-encoded prefix for Ed25519 (0xed 0x01).
+ *
+ * @param did - The DID to check
+ * @returns true if it's a valid did:key with Ed25519 key
+ */
+export function isEd25519DidKey(did) {
+    return did.startsWith('did:key:z6Mk');
+}
+/**
+ * Extract the public key bytes from a did:key DID
+ *
+ * @param did - The did:key DID
+ * @returns Public key bytes or null if invalid
+ */
+export function extractPublicKeyFromDidKey(did) {
+    if (!did.startsWith('did:key:z')) {
+        return null;
+    }
+    try {
+        // Extract the multibase-encoded part (after 'did:key:')
+        const multibaseKey = did.replace('did:key:', '');
+        // Remove the 'z' multibase prefix (base58btc)
+        const base58Encoded = multibaseKey.slice(1);
+        // Decode from base58
+        const multicodecBytes = base58Decode(base58Encoded);
+        // Check for Ed25519 multicodec prefix (0xed 0x01)
+        if (multicodecBytes.length < ED25519_MULTICODEC_PREFIX.length + ED25519_PUBLIC_KEY_LENGTH ||
+            multicodecBytes[0] !== ED25519_MULTICODEC_PREFIX[0] ||
+            multicodecBytes[1] !== ED25519_MULTICODEC_PREFIX[1]) {
+            return null;
+        }
+        // Extract the public key (bytes after the prefix)
+        return multicodecBytes.slice(ED25519_MULTICODEC_PREFIX.length);
+    }
+    catch (error) {
+        logger.debug('Failed to extract public key from did:key', error);
+        return null;
+    }
+}
+/**
+ * Convert Ed25519 public key bytes to JWK format
+ *
+ * @param publicKeyBytes - 32-byte Ed25519 public key
+ * @returns JWK object
+ */
+export function publicKeyToJwk(publicKeyBytes) {
+    return {
+        kty: 'OKP',
+        crv: 'Ed25519',
+        x: base64urlEncodeFromBytes(publicKeyBytes),
+    };
+}
+/**
+ * Create a DID:key resolver
+ *
+ * Returns a DIDResolver that can resolve did:key DIDs to DID Documents.
+ * Currently supports only Ed25519 keys.
+ *
+ * @returns DIDResolver implementation for did:key
+ */
+export function createDidKeyResolver() {
+    return {
+        resolve: async (did) => {
+            // Check if it's a did:key with Ed25519
+            if (!isEd25519DidKey(did)) {
+                return null;
+            }
+            // Extract the public key
+            const publicKeyBytes = extractPublicKeyFromDidKey(did);
+            if (!publicKeyBytes) {
+                return null;
+            }
+            // Convert to JWK
+            const publicKeyJwk = publicKeyToJwk(publicKeyBytes);
+            // Get the multibase-encoded key for publicKeyMultibase
+            const multibaseKey = did.replace('did:key:', '');
+            // Construct the verification method
+            const fragment = didKeyFragment(did);
+            const verificationMethod = {
+                id: `${did}#${fragment}`,
+                type: 'Ed25519VerificationKey2020',
+                controller: did,
+                publicKeyJwk,
+                publicKeyMultibase: multibaseKey,
+            };
+            // Construct and return the DID Document
+            return {
+                id: did,
+                verificationMethod: [verificationMethod],
+                authentication: [`${did}#${fragment}`],
+                assertionMethod: [`${did}#${fragment}`],
+            };
+        },
+    };
+}
+/**
+ * Resolve a did:key DID synchronously
+ *
+ * Convenience function for cases where async is not needed.
+ *
+ * @param did - The did:key DID to resolve
+ * @returns DID Document or null if invalid
+ */
+export function resolveDidKeySync(did) {
+    if (!isEd25519DidKey(did)) {
+        return null;
+    }
+    const publicKeyBytes = extractPublicKeyFromDidKey(did);
+    if (!publicKeyBytes) {
+        return null;
+    }
+    const publicKeyJwk = publicKeyToJwk(publicKeyBytes);
+    const multibaseKey = did.replace('did:key:', '');
+    const fragment = didKeyFragment(did);
+    const verificationMethod = {
+        id: `${did}#${fragment}`,
+        type: 'Ed25519VerificationKey2020',
+        controller: did,
+        publicKeyJwk,
+        publicKeyMultibase: multibaseKey,
+    };
+    return {
+        id: did,
+        verificationMethod: [verificationMethod],
+        authentication: [`${did}#${fragment}`],
+        assertionMethod: [`${did}#${fragment}`],
+    };
+}
+//# sourceMappingURL=did-key-resolver.js.map

package/dist/delegation/did-key-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"did-key-resolver.js","sourceRoot":"","sources":["../../src/delegation/did-key-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,4CAA4C;AAC5C,MAAM,yBAAyB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAE/D,gCAAgC;AAChC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,wDAAwD;QACxD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAEjD,8CAA8C;QAC9C,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAE5C,qBAAqB;QACrB,MAAM,eAAe,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;QAEpD,kDAAkD;QAClD,IACE,eAAe,CAAC,MAAM,GAAG,yBAAyB,CAAC,MAAM,GAAG,yBAAyB;YACrF,eAAe,CAAC,CAAC,CAAC,KAAK,yBAAyB,CAAC,CAAC,CAAC;YACnD,eAAe,CAAC,CAAC,CAAC,KAAK,yBAAyB,CAAC,CAAC,CAAC,EACnD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,kDAAkD;QAClD,OAAO,eAAe,CAAC,KAAK,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,cAA0B;IAKvD,OAAO;QACL,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,SAAS;QACd,CAAC,EAAE,wBAAwB,CAAC,cAAc,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,OAAO,EAAE,KAAK,EAAE,GAAW,EAA+B,EAAE;YAC1D,uCAAuC;YACvC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,yBAAyB;YACzB,MAAM,cAAc,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;YACvD,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,iBAAiB;YACjB,MAAM,YAAY,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;YAEpD,uDAAuD;YACvD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAEjD,oCAAoC;YACpC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YAErC,MAAM,kBAAkB,GAAuB;gBAC7C,EAAE,EAAE,GAAG,GAAG,IAAI,QAAQ,EAAE;gBACxB,IAAI,EAAE,4BAA4B;gBAClC,UAAU,EAAE,GAAG;gBACf,YAAY;gBACZ,kBAAkB,EAAE,YAAY;aACjC,CAAC;YAEF,wCAAwC;YACxC,OAAO;gBACL,EAAE,EAAE,GAAG;gBACP,kBAAkB,EAAE,CAAC,kBAAkB,CAAC;gBACxC,cAAc,EAAE,CAAC,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;gBACtC,eAAe,EAAE,CAAC,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;aACxC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,cAAc,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAEjD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAErC,MAAM,kBAAkB,GAAuB;QAC7C,EAAE,EAAE,GAAG,GAAG,IAAI,QAAQ,EAAE;QACxB,IAAI,EAAE,4BAA4B;QAClC,UAAU,EAAE,GAAG;QACf,YAAY;QACZ,kBAAkB,EAAE,YAAY;KACjC,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,GAAG;QACP,kBAAkB,EAAE,CAAC,kBAAkB,CAAC;QACxC,cAAc,EAAE,CAAC,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;QACtC,eAAe,EAAE,CAAC,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC"}

package/dist/delegation/did-web-resolver.d.ts

@@ -0,0 +1,83 @@
+/**
+ * DID:web Resolver
+ *
+ * Resolves did:web DIDs by fetching /.well-known/did.json from the domain.
+ * Supports both root domain DIDs and path-based DIDs.
+ *
+ * Examples:
+ *   did:web:example.com → https://example.com/.well-known/did.json
+ *   did:web:example.com:agents:bot1 → https://example.com/agents/bot1/did.json
+ *
+ * @see https://w3c-ccg.github.io/did-method-web/
+ */
+import type { FetchProvider } from '../providers/base.js';
+import type { DIDResolver, DIDDocument } from './vc-verifier.js';
+/**
+ * Parsed components of a did:web DID
+ */
+interface ParsedDidWeb {
+    domain: string;
+    path: string[];
+}
+/**
+ * Check if a DID is a did:web DID
+ *
+ * @param did - The DID to check
+ * @returns true if it's a did:web DID
+ */
+export declare function isDidWeb(did: string): boolean;
+/**
+ * Parse a did:web DID into its components
+ *
+ * @param did - The did:web DID to parse
+ * @returns Parsed components or null if invalid
+ */
+export declare function parseDidWeb(did: string): ParsedDidWeb | null;
+/**
+ * Convert a did:web DID to its resolution URL
+ *
+ * did:web:example.com → https://example.com/.well-known/did.json
+ * did:web:example.com:path:to:doc → https://example.com/path/to/doc/did.json
+ *
+ * @param did - The did:web DID
+ * @returns The resolution URL or null if invalid
+ */
+export declare function didWebToUrl(did: string): string | null;
+/**
+ * DID:web resolver implementation
+ */
+export declare class DidWebResolver implements DIDResolver {
+    private fetchProvider;
+    private cache;
+    private cacheTtl;
+    constructor(fetchProvider: FetchProvider, options?: {
+        cacheTtl?: number;
+    });
+    /**
+     * Resolve a did:web DID to its DID Document
+     *
+     * @param did - The did:web DID to resolve
+     * @returns The DID Document or null if resolution fails
+     */
+    resolve(did: string): Promise<DIDDocument | null>;
+    /**
+     * Clear the resolution cache
+     */
+    clearCache(): void;
+    /**
+     * Clear a specific entry from the cache
+     */
+    clearCacheEntry(did: string): void;
+}
+/**
+ * Create a did:web resolver with the given fetch provider
+ *
+ * @param fetchProvider - Provider for making HTTP requests
+ * @param options - Optional configuration
+ * @returns DIDResolver implementation for did:web
+ */
+export declare function createDidWebResolver(fetchProvider: FetchProvider, options?: {
+    cacheTtl?: number;
+}): DIDResolver;
+export {};
+//# sourceMappingURL=did-web-resolver.d.ts.map

package/dist/delegation/did-web-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"did-web-resolver.d.ts","sourceRoot":"","sources":["../../src/delegation/did-web-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAsB,MAAM,kBAAkB,CAAC;AAGrF;;GAEG;AACH,UAAU,YAAY;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AA0DD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE7C;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CA0B5D;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAsBtD;AAED;;GAEG;AACH,qBAAa,cAAe,YAAW,WAAW;IAChD,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,KAAK,CAA4D;IACzE,OAAO,CAAC,QAAQ,CAAS;gBAEb,aAAa,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;IAMzE;;;;;OAKG;IACG,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAgEvD;;OAEG;IACH,UAAU,IAAI,IAAI;IAIlB;;OAEG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;CAGnC;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,aAAa,EAAE,aAAa,EAC5B,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9B,WAAW,CAEb"}

package/dist/delegation/did-web-resolver.js

@@ -0,0 +1,218 @@
+/**
+ * DID:web Resolver
+ *
+ * Resolves did:web DIDs by fetching /.well-known/did.json from the domain.
+ * Supports both root domain DIDs and path-based DIDs.
+ *
+ * Examples:
+ *   did:web:example.com → https://example.com/.well-known/did.json
+ *   did:web:example.com:agents:bot1 → https://example.com/agents/bot1/did.json
+ *
+ * @see https://w3c-ccg.github.io/did-method-web/
+ */
+import { logger } from '../logging/index.js';
+/**
+ * Type guard for checking if value is a valid DID Document structure
+ */
+function isValidDIDDocument(value) {
+    if (typeof value !== 'object' || value === null) {
+        return false;
+    }
+    const doc = value;
+    // id is required and must be a string
+    if (typeof doc['id'] !== 'string' || doc['id'].length === 0) {
+        return false;
+    }
+    // verificationMethod is optional but if present must be an array
+    if (doc['verificationMethod'] !== undefined) {
+        if (!Array.isArray(doc['verificationMethod'])) {
+            return false;
+        }
+        // Each verification method must have required fields
+        for (const vm of doc['verificationMethod']) {
+            if (!isValidVerificationMethod(vm)) {
+                return false;
+            }
+        }
+    }
+    return true;
+}
+/**
+ * Type guard for checking if value is a valid VerificationMethod
+ */
+function isValidVerificationMethod(value) {
+    if (typeof value !== 'object' || value === null) {
+        return false;
+    }
+    const vm = value;
+    // id, type, and controller are required strings
+    if (typeof vm['id'] !== 'string' || vm['id'].length === 0) {
+        return false;
+    }
+    if (typeof vm['type'] !== 'string' || vm['type'].length === 0) {
+        return false;
+    }
+    if (typeof vm['controller'] !== 'string' || vm['controller'].length === 0) {
+        return false;
+    }
+    return true;
+}
+/**
+ * Check if a DID is a did:web DID
+ *
+ * @param did - The DID to check
+ * @returns true if it's a did:web DID
+ */
+export function isDidWeb(did) {
+    return did.startsWith('did:web:');
+}
+/**
+ * Parse a did:web DID into its components
+ *
+ * @param did - The did:web DID to parse
+ * @returns Parsed components or null if invalid
+ */
+export function parseDidWeb(did) {
+    if (!isDidWeb(did)) {
+        return null;
+    }
+    // Remove the 'did:web:' prefix
+    const remainder = did.slice(8);
+    if (remainder.length === 0) {
+        return null;
+    }
+    // Split by ':' to get domain and path components
+    const parts = remainder.split(':');
+    // First part is the domain (URL-decoded)
+    const domain = decodeURIComponent(parts[0]);
+    if (domain.length === 0) {
+        return null;
+    }
+    // Remaining parts form the path
+    const path = parts.slice(1).map((p) => decodeURIComponent(p));
+    return { domain, path };
+}
+/**
+ * Convert a did:web DID to its resolution URL
+ *
+ * did:web:example.com → https://example.com/.well-known/did.json
+ * did:web:example.com:path:to:doc → https://example.com/path/to/doc/did.json
+ *
+ * @param did - The did:web DID
+ * @returns The resolution URL or null if invalid
+ */
+export function didWebToUrl(did) {
+    const parsed = parseDidWeb(did);
+    if (!parsed) {
+        return null;
+    }
+    const { domain, path } = parsed;
+    // Build the URL
+    // Note: did:web specification requires HTTPS
+    let url = `https://${domain}`;
+    if (path.length === 0) {
+        // Root domain: use /.well-known/did.json
+        url += '/.well-known/did.json';
+    }
+    else {
+        // Path-based: use /path/to/resource/did.json
+        url += '/' + path.join('/') + '/did.json';
+    }
+    return url;
+}
+/**
+ * DID:web resolver implementation
+ */
+export class DidWebResolver {
+    fetchProvider;
+    cache;
+    cacheTtl;
+    constructor(fetchProvider, options) {
+        this.fetchProvider = fetchProvider;
+        this.cache = new Map();
+        this.cacheTtl = options?.cacheTtl ?? 300_000; // 5 minutes default
+    }
+    /**
+     * Resolve a did:web DID to its DID Document
+     *
+     * @param did - The did:web DID to resolve
+     * @returns The DID Document or null if resolution fails
+     */
+    async resolve(did) {
+        // Check if it's a did:web
+        if (!isDidWeb(did)) {
+            return null;
+        }
+        // Check cache
+        const cached = this.cache.get(did);
+        if (cached && Date.now() < cached.expiresAt) {
+            return cached.document;
+        }
+        // Convert to URL
+        const url = didWebToUrl(did);
+        if (!url) {
+            logger.warn(`[DidWebResolver] Invalid did:web format: ${did}`);
+            return null;
+        }
+        try {
+            // Fetch the DID document
+            const response = await this.fetchProvider.fetch(url);
+            if (!response.ok) {
+                logger.warn(`[DidWebResolver] HTTP ${response.status} fetching ${url}`);
+                return null;
+            }
+            // Parse JSON
+            let json;
+            try {
+                json = await response.json();
+            }
+            catch {
+                logger.warn(`[DidWebResolver] Invalid JSON from ${url}`);
+                return null;
+            }
+            // Validate structure
+            if (!isValidDIDDocument(json)) {
+                logger.warn(`[DidWebResolver] Invalid DID Document structure from ${url}`);
+                return null;
+            }
+            // Verify the id matches the DID
+            if (json.id !== did) {
+                logger.warn(`[DidWebResolver] DID Document id mismatch: expected ${did}, got ${json.id}`);
+                return null;
+            }
+            // Cache the result
+            this.cache.set(did, {
+                document: json,
+                expiresAt: Date.now() + this.cacheTtl,
+            });
+            return json;
+        }
+        catch (error) {
+            logger.warn(`[DidWebResolver] Error resolving ${did}: ${error instanceof Error ? error.message : 'Unknown error'}`);
+            return null;
+        }
+    }
+    /**
+     * Clear the resolution cache
+     */
+    clearCache() {
+        this.cache.clear();
+    }
+    /**
+     * Clear a specific entry from the cache
+     */
+    clearCacheEntry(did) {
+        this.cache.delete(did);
+    }
+}
+/**
+ * Create a did:web resolver with the given fetch provider
+ *
+ * @param fetchProvider - Provider for making HTTP requests
+ * @param options - Optional configuration
+ * @returns DIDResolver implementation for did:web
+ */
+export function createDidWebResolver(fetchProvider, options) {
+    return new DidWebResolver(fetchProvider, options);
+}
+//# sourceMappingURL=did-web-resolver.js.map

package/dist/delegation/did-web-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"did-web-resolver.js","sourceRoot":"","sources":["../../src/delegation/did-web-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAU7C;;GAEG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,GAAG,GAAG,KAAgC,CAAC;IAE7C,sCAAsC;IACtC,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iEAAiE;IACjE,IAAI,GAAG,CAAC,oBAAoB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qDAAqD;QACrD,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,yBAAyB,CAAC,EAAE,CAAC,EAAE,CAAC;gBACnC,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,EAAE,GAAG,KAAgC,CAAC;IAE5C,gDAAgD;IAChD,IAAI,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,EAAE,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,OAAO,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+BAA+B;IAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE/B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iDAAiD;IACjD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEnC,yCAAyC;IACzC,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAE7C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gCAAgC;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9D,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAEhC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAEhC,gBAAgB;IAChB,6CAA6C;IAC7C,IAAI,GAAG,GAAG,WAAW,MAAM,EAAE,CAAC;IAE9B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,yCAAyC;QACzC,GAAG,IAAI,uBAAuB,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,6CAA6C;QAC7C,GAAG,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC;IAC5C,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,cAAc;IACjB,aAAa,CAAgB;IAC7B,KAAK,CAA4D;IACjE,QAAQ,CAAS;IAEzB,YAAY,aAA4B,EAAE,OAA+B;QACvE,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,CAAC,oBAAoB;IACpE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,GAAW;QACvB,0BAA0B;QAC1B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,cAAc;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QAED,iBAAiB;QACjB,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,4CAA4C,GAAG,EAAE,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,yBAAyB;YACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAErD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,yBAAyB,QAAQ,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,CAAC;gBACxE,OAAO,IAAI,CAAC;YACd,CAAC;YAED,aAAa;YACb,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAC;gBACzD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,qBAAqB;YACrB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,wDAAwD,GAAG,EAAE,CAAC,CAAC;gBAC3E,OAAO,IAAI,CAAC;YACd,CAAC;YAED,gCAAgC;YAChC,IAAI,IAAI,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,uDAAuD,GAAG,SAAS,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1F,OAAO,IAAI,CAAC;YACd,CAAC;YAED,mBAAmB;YACnB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;gBAClB,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ;aACtC,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,oCAAoC,GAAG,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACvG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,GAAW;QACzB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,aAA4B,EAC5B,OAA+B;IAE/B,OAAO,IAAI,cAAc,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC"}

package/dist/delegation/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Delegation Module Exports (Platform-Agnostic)
+ *
+ * W3C VC-based delegation issuance and verification.
+ * Platform-specific adapters (Node.js, Cloudflare) provide signing/verification functions.
+ */
+export * from './vc-issuer.js';
+export * from './vc-verifier.js';
+export * from './bitstring.js';
+export * from './statuslist-manager.js';
+export * from './delegation-graph.js';
+export * from './cascading-revocation.js';
+export * from './utils.js';
+export * from './outbound-proof.js';
+export * from './outbound-headers.js';
+export * from './audience-validator.js';
+export { createDidKeyResolver, resolveDidKeySync, isEd25519DidKey, extractPublicKeyFromDidKey, publicKeyToJwk, } from './did-key-resolver.js';
+export { DidWebResolver, createDidWebResolver, isDidWeb, parseDidWeb, didWebToUrl, } from './did-web-resolver.js';
+export { MemoryStatusListStorage } from './storage/memory-statuslist-storage.js';
+export { MemoryDelegationGraphStorage } from './storage/memory-graph-storage.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/delegation/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,GACZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC"}

package/dist/delegation/index.js

@@ -0,0 +1,21 @@
+/**
+ * Delegation Module Exports (Platform-Agnostic)
+ *
+ * W3C VC-based delegation issuance and verification.
+ * Platform-specific adapters (Node.js, Cloudflare) provide signing/verification functions.
+ */
+export * from './vc-issuer.js';
+export * from './vc-verifier.js';
+export * from './bitstring.js';
+export * from './statuslist-manager.js';
+export * from './delegation-graph.js';
+export * from './cascading-revocation.js';
+export * from './utils.js';
+export * from './outbound-proof.js';
+export * from './outbound-headers.js';
+export * from './audience-validator.js';
+export { createDidKeyResolver, resolveDidKeySync, isEd25519DidKey, extractPublicKeyFromDidKey, publicKeyToJwk, } from './did-key-resolver.js';
+export { DidWebResolver, createDidWebResolver, isDidWeb, parseDidWeb, didWebToUrl, } from './did-web-resolver.js';
+export { MemoryStatusListStorage } from './storage/memory-statuslist-storage.js';
+export { MemoryDelegationGraphStorage } from './storage/memory-graph-storage.js';
+//# sourceMappingURL=index.js.map

package/dist/delegation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,GACZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC"}