@kya-os/mcp 1.2.0

package/dist/delegation/outbound-headers.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Outbound Delegation Headers
+ *
+ * Builds the full set of outbound delegation headers for forwarding
+ * delegation context to downstream services.
+ *
+ * Headers (MCP-I §7):
+ * - KYA-Agent-DID: the original agent's DID
+ * - KYA-Delegation-Chain: the delegation chain ID (vcId of the root delegation)
+ * - KYA-Session-Id: the current session ID
+ * - KYA-Delegation-Proof: a signed JWT proving the delegation is being forwarded
+ *
+ * Related Spec: MCP-I §7 — Outbound Delegation Propagation
+ */
+import type { SessionContext, DelegationRecord } from '../types/protocol.js';
+/**
+ * Header names for outbound delegation propagation
+ */
+export declare const OUTBOUND_HEADER_NAMES: {
+    readonly AGENT_DID: "KYA-Agent-DID";
+    readonly DELEGATION_CHAIN: "KYA-Delegation-Chain";
+    readonly SESSION_ID: "KYA-Session-Id";
+    readonly DELEGATION_PROOF: "KYA-Delegation-Proof";
+};
+/**
+ * Context required to build outbound delegation headers
+ */
+export interface OutboundDelegationContext {
+    /** The current session context */
+    session: SessionContext;
+    /** The delegation record being forwarded */
+    delegation: DelegationRecord;
+    /** The MCP server's identity for signing the proof */
+    serverIdentity: {
+        did: string;
+        kid: string;
+        privateKey: string;
+    };
+    /** The downstream URL being called */
+    targetUrl: string;
+}
+/**
+ * Outbound delegation headers to attach to downstream requests
+ */
+export interface OutboundDelegationHeaders {
+    'KYA-Agent-DID': string;
+    'KYA-Delegation-Chain': string;
+    'KYA-Session-Id': string;
+    'KYA-Delegation-Proof': string;
+}
+/**
+ * Build outbound delegation headers for forwarding to downstream services.
+ *
+ * When an MCP server calls a downstream service on behalf of an agent,
+ * it MUST forward the delegation context using these headers so the
+ * downstream service can independently verify the delegation chain.
+ *
+ * @param context - The delegation context including session, delegation, and server identity
+ * @returns Headers object to attach to the outbound request
+ *
+ * @throws {Error} If session is missing agentDid or sessionId
+ * @throws {Error} If delegation is missing vcId
+ * @throws {Error} If serverIdentity.did is not a valid Ed25519 did:key
+ *
+ * @example
+ * ```typescript
+ * const headers = await buildOutboundDelegationHeaders({
+ *   session,
+ *   delegation,
+ *   serverIdentity: { did: serverDid, kid: serverKid, privateKey },
+ *   targetUrl: 'https://downstream-api.example.com/resource',
+ * });
+ *
+ * // Attach headers to your HTTP request
+ * fetch(targetUrl, { headers });
+ * ```
+ */
+export declare function buildOutboundDelegationHeaders(context: OutboundDelegationContext): Promise<OutboundDelegationHeaders>;
+//# sourceMappingURL=outbound-headers.d.ts.map

package/dist/delegation/outbound-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-headers.d.ts","sourceRoot":"","sources":["../../src/delegation/outbound-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAM7E;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;CAKxB,CAAC;AAEX;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,kCAAkC;IAClC,OAAO,EAAE,cAAc,CAAC;IACxB,4CAA4C;IAC5C,UAAU,EAAE,gBAAgB,CAAC;IAC7B,sDAAsD;IACtD,cAAc,EAAE;QACd,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,eAAe,EAAE,MAAM,CAAC;IACxB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAgDD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,yBAAyB,CAAC,CAuDpC"}

package/dist/delegation/outbound-headers.js

@@ -0,0 +1,138 @@
+/**
+ * Outbound Delegation Headers
+ *
+ * Builds the full set of outbound delegation headers for forwarding
+ * delegation context to downstream services.
+ *
+ * Headers (MCP-I §7):
+ * - KYA-Agent-DID: the original agent's DID
+ * - KYA-Delegation-Chain: the delegation chain ID (vcId of the root delegation)
+ * - KYA-Session-Id: the current session ID
+ * - KYA-Delegation-Proof: a signed JWT proving the delegation is being forwarded
+ *
+ * Related Spec: MCP-I §7 — Outbound Delegation Propagation
+ */
+import { buildDelegationProofJWT } from './outbound-proof.js';
+import { extractPublicKeyFromDidKey, isEd25519DidKey } from './did-key-resolver.js';
+import { base64ToBytes, base64urlEncodeFromBytes } from '../utils/base64.js';
+import { logger } from '../logging/index.js';
+/**
+ * Header names for outbound delegation propagation
+ */
+export const OUTBOUND_HEADER_NAMES = {
+    AGENT_DID: 'KYA-Agent-DID',
+    DELEGATION_CHAIN: 'KYA-Delegation-Chain',
+    SESSION_ID: 'KYA-Session-Id',
+    DELEGATION_PROOF: 'KYA-Delegation-Proof',
+};
+/**
+ * Extract hostname from a URL
+ */
+function extractHostname(url) {
+    try {
+        const parsed = new URL(url);
+        return parsed.hostname;
+    }
+    catch {
+        logger.warn('Failed to parse target URL, using as-is', { url });
+        return url;
+    }
+}
+/**
+ * Convert base64 private key and DID to Ed25519 JWK format
+ */
+function buildPrivateKeyJwk(privateKeyBase64, serverDid) {
+    // Decode the private key from base64
+    const privateKeyBytes = base64ToBytes(privateKeyBase64);
+    // Extract the 32-byte seed (handle both 32-byte and 64-byte formats)
+    const seed = privateKeyBytes.length === 64
+        ? privateKeyBytes.subarray(0, 32)
+        : privateKeyBytes;
+    // Extract public key from did:key
+    if (!isEd25519DidKey(serverDid)) {
+        throw new Error(`Server DID must be did:key with Ed25519: ${serverDid}`);
+    }
+    const publicKeyBytes = extractPublicKeyFromDidKey(serverDid);
+    if (!publicKeyBytes) {
+        throw new Error(`Failed to extract public key from DID: ${serverDid}`);
+    }
+    return {
+        kty: 'OKP',
+        crv: 'Ed25519',
+        x: base64urlEncodeFromBytes(publicKeyBytes),
+        d: base64urlEncodeFromBytes(seed),
+    };
+}
+/**
+ * Build outbound delegation headers for forwarding to downstream services.
+ *
+ * When an MCP server calls a downstream service on behalf of an agent,
+ * it MUST forward the delegation context using these headers so the
+ * downstream service can independently verify the delegation chain.
+ *
+ * @param context - The delegation context including session, delegation, and server identity
+ * @returns Headers object to attach to the outbound request
+ *
+ * @throws {Error} If session is missing agentDid or sessionId
+ * @throws {Error} If delegation is missing vcId
+ * @throws {Error} If serverIdentity.did is not a valid Ed25519 did:key
+ *
+ * @example
+ * ```typescript
+ * const headers = await buildOutboundDelegationHeaders({
+ *   session,
+ *   delegation,
+ *   serverIdentity: { did: serverDid, kid: serverKid, privateKey },
+ *   targetUrl: 'https://downstream-api.example.com/resource',
+ * });
+ *
+ * // Attach headers to your HTTP request
+ * fetch(targetUrl, { headers });
+ * ```
+ */
+export async function buildOutboundDelegationHeaders(context) {
+    const { session, delegation, serverIdentity, targetUrl } = context;
+    // Validate required fields
+    if (!session.agentDid) {
+        throw new Error('Session must have agentDid for outbound delegation');
+    }
+    if (!session.sessionId) {
+        throw new Error('Session must have sessionId for outbound delegation');
+    }
+    if (!delegation.vcId) {
+        throw new Error('Delegation must have vcId for outbound delegation');
+    }
+    // Extract hostname for JWT audience
+    const targetHostname = extractHostname(targetUrl);
+    // Build the private key JWK from the server identity
+    const privateKeyJwk = buildPrivateKeyJwk(serverIdentity.privateKey, serverIdentity.did);
+    // Build the delegation proof JWT
+    // Per MCP-I §7, the JWT has:
+    // - iss: serverDid (the MCP server forwarding the request)
+    // - sub: agentDid (the original agent)
+    // - aud: targetHostname (the downstream service)
+    // - scope: "delegation:propagate"
+    const jwt = await buildDelegationProofJWT({
+        agentDid: serverIdentity.did, // becomes iss (server forwarding)
+        userDid: session.agentDid, // becomes sub (original agent)
+        delegationId: delegation.id,
+        delegationChain: delegation.vcId,
+        scopes: ['delegation:propagate'],
+        privateKeyJwk,
+        kid: serverIdentity.kid,
+        targetHostname,
+    });
+    logger.debug('Built outbound delegation headers', {
+        agentDid: session.agentDid,
+        delegationChain: delegation.vcId,
+        sessionId: session.sessionId,
+        targetHostname,
+    });
+    return {
+        'KYA-Agent-DID': session.agentDid,
+        'KYA-Delegation-Chain': delegation.vcId,
+        'KYA-Session-Id': session.sessionId,
+        'KYA-Delegation-Proof': jwt,
+    };
+}
+//# sourceMappingURL=outbound-headers.js.map

package/dist/delegation/outbound-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-headers.js","sourceRoot":"","sources":["../../src/delegation/outbound-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,uBAAuB,EAA0B,MAAM,qBAAqB,CAAC;AACtF,OAAO,EAAE,0BAA0B,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,SAAS,EAAE,eAAe;IAC1B,gBAAgB,EAAE,sBAAsB;IACxC,UAAU,EAAE,gBAAgB;IAC5B,gBAAgB,EAAE,sBAAsB;CAChC,CAAC;AA8BX;;GAEG;AACH,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAChE,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CACzB,gBAAwB,EACxB,SAAiB;IAEjB,qCAAqC;IACrC,MAAM,eAAe,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAExD,qEAAqE;IACrE,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,KAAK,EAAE;QACxC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;QACjC,CAAC,CAAC,eAAe,CAAC;IAEpB,kCAAkC;IAClC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,4CAA4C,SAAS,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,cAAc,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;IAC7D,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,0CAA0C,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,OAAO;QACL,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,SAAS;QACd,CAAC,EAAE,wBAAwB,CAAC,cAAc,CAAC;QAC3C,CAAC,EAAE,wBAAwB,CAAC,IAAI,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,OAAkC;IAElC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAEnE,2BAA2B;IAC3B,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,oCAAoC;IACpC,MAAM,cAAc,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAElD,qDAAqD;IACrD,MAAM,aAAa,GAAG,kBAAkB,CACtC,cAAc,CAAC,UAAU,EACzB,cAAc,CAAC,GAAG,CACnB,CAAC;IAEF,iCAAiC;IACjC,6BAA6B;IAC7B,2DAA2D;IAC3D,uCAAuC;IACvC,iDAAiD;IACjD,kCAAkC;IAClC,MAAM,GAAG,GAAG,MAAM,uBAAuB,CAAC;QACxC,QAAQ,EAAE,cAAc,CAAC,GAAG,EAAM,kCAAkC;QACpE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAS,+BAA+B;QACjE,YAAY,EAAE,UAAU,CAAC,EAAE;QAC3B,eAAe,EAAE,UAAU,CAAC,IAAI;QAChC,MAAM,EAAE,CAAC,sBAAsB,CAAC;QAChC,aAAa;QACb,GAAG,EAAE,cAAc,CAAC,GAAG;QACvB,cAAc;KACf,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE;QAChD,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,eAAe,EAAE,UAAU,CAAC,IAAI;QAChC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc;KACf,CAAC,CAAC;IAEH,OAAO;QACL,eAAe,EAAE,OAAO,CAAC,QAAQ;QACjC,sBAAsB,EAAE,UAAU,CAAC,IAAI;QACvC,gBAAgB,EAAE,OAAO,CAAC,SAAS;QACnC,sBAAsB,EAAE,GAAG;KAC5B,CAAC;AACJ,CAAC"}

package/dist/delegation/outbound-proof.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Outbound Delegation Proof
+ *
+ * Builds signed delegation proof JWTs for injection on outbound HTTP requests.
+ * Enables downstream services to independently verify the delegation chain.
+ *
+ * Wire format: signed compact EdDSA JWT (60s TTL, per-call jti)
+ * Header injection: KYA-Delegation-Id, KYA-Delegation-Chain, KYA-Delegation-Proof, KYA-Granted-Scopes
+ *
+ * Related Spec: MCP-I §2 — Outbound Delegation Propagation
+ */
+import type { DelegationRecord } from '../types/protocol.js';
+export interface Ed25519PrivateJWK {
+    kty: 'OKP';
+    crv: 'Ed25519';
+    x: string;
+    d: string;
+    kid?: string;
+    use?: string;
+}
+export interface DelegationProofOptions {
+    agentDid: string;
+    userDid: string;
+    delegationId: string;
+    delegationChain: string;
+    scopes: string[];
+    privateKeyJwk: Ed25519PrivateJWK;
+    kid: string;
+    targetHostname: string;
+}
+/**
+ * Build a signed delegation proof JWT for outbound HTTP requests.
+ *
+ * Creates a short-lived (60s) EdDSA-signed JWT containing delegation context
+ * that can be verified by downstream services without access to the MCP server.
+ *
+ * @param options - Proof options including DIDs, delegation info, scopes, and signing key
+ * @returns Compact JWS string (header.payload.signature)
+ * @throws {Error} If key import or signing fails
+ */
+export declare function buildDelegationProofJWT(options: DelegationProofOptions): Promise<string>;
+export declare function buildChainString(delegation: DelegationRecord): string;
+//# sourceMappingURL=outbound-proof.d.ts.map

package/dist/delegation/outbound-proof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-proof.d.ts","sourceRoot":"","sources":["../../src/delegation/outbound-proof.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,KAAK,CAAC;IACX,GAAG,EAAE,SAAS,CAAC;IACf,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,EAAE,iBAAiB,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,MAAM,CAAC,CAgCjB;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,gBAAgB,GAAG,MAAM,CAQrE"}

package/dist/delegation/outbound-proof.js

@@ -0,0 +1,52 @@
+/**
+ * Outbound Delegation Proof
+ *
+ * Builds signed delegation proof JWTs for injection on outbound HTTP requests.
+ * Enables downstream services to independently verify the delegation chain.
+ *
+ * Wire format: signed compact EdDSA JWT (60s TTL, per-call jti)
+ * Header injection: KYA-Delegation-Id, KYA-Delegation-Chain, KYA-Delegation-Proof, KYA-Granted-Scopes
+ *
+ * Related Spec: MCP-I §2 — Outbound Delegation Propagation
+ */
+import { SignJWT, importJWK } from 'jose';
+/**
+ * Build a signed delegation proof JWT for outbound HTTP requests.
+ *
+ * Creates a short-lived (60s) EdDSA-signed JWT containing delegation context
+ * that can be verified by downstream services without access to the MCP server.
+ *
+ * @param options - Proof options including DIDs, delegation info, scopes, and signing key
+ * @returns Compact JWS string (header.payload.signature)
+ * @throws {Error} If key import or signing fails
+ */
+export async function buildDelegationProofJWT(options) {
+    const { agentDid, userDid, delegationId, delegationChain, scopes, privateKeyJwk, kid, targetHostname, } = options;
+    const privateKey = await importJWK(privateKeyJwk, 'EdDSA');
+    const iat = Math.floor(Date.now() / 1000);
+    const exp = iat + 60;
+    const jwt = await new SignJWT({
+        delegation_id: delegationId,
+        delegation_chain: delegationChain,
+        scope: scopes.join(','),
+    })
+        .setProtectedHeader({ alg: 'EdDSA', kid })
+        .setIssuer(agentDid)
+        .setSubject(userDid)
+        .setJti(crypto.randomUUID())
+        .setAudience(targetHostname)
+        .setIssuedAt(iat)
+        .setExpirationTime(exp)
+        .sign(privateKey);
+    return jwt;
+}
+export function buildChainString(delegation) {
+    if (!delegation.id && !delegation.vcId) {
+        return '';
+    }
+    if (!delegation.vcId) {
+        return delegation.id;
+    }
+    return `${delegation.vcId}>${delegation.id}`;
+}
+//# sourceMappingURL=outbound-proof.js.map

package/dist/delegation/outbound-proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-proof.js","sourceRoot":"","sources":["../../src/delegation/outbound-proof.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAuB1C;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAA+B;IAE/B,MAAM,EACJ,QAAQ,EACR,OAAO,EACP,YAAY,EACZ,eAAe,EACf,MAAM,EACN,aAAa,EACb,GAAG,EACH,cAAc,GACf,GAAG,OAAO,CAAC;IAEZ,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAE3D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC;IAErB,MAAM,GAAG,GAAG,MAAM,IAAI,OAAO,CAAC;QAC5B,aAAa,EAAE,YAAY;QAC3B,gBAAgB,EAAE,eAAe;QACjC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;KACxB,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;SACzC,SAAS,CAAC,QAAQ,CAAC;SACnB,UAAU,CAAC,OAAO,CAAC;SACnB,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;SAC3B,WAAW,CAAC,cAAc,CAAC;SAC3B,WAAW,CAAC,GAAG,CAAC;SAChB,iBAAiB,CAAC,GAAG,CAAC;SACtB,IAAI,CAAC,UAAU,CAAC,CAAC;IAEpB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,UAA4B;IAC3D,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACvC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACrB,OAAO,UAAU,CAAC,EAAE,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;AAC/C,CAAC"}

package/dist/delegation/statuslist-manager.d.ts

@@ -0,0 +1,47 @@
+/**
+ * StatusList2021 Manager
+ *
+ * Manages StatusList2021 credentials for efficient delegation revocation.
+ *
+ * Related Spec: W3C StatusList2021
+ */
+import type { StatusList2021Credential, CredentialStatus } from '../types/protocol.js';
+import { type CompressionFunction, type DecompressionFunction } from './bitstring.js';
+import type { VCSigningFunction } from './vc-issuer.js';
+export interface StatusListStorageProvider {
+    getStatusList(statusListId: string): Promise<StatusList2021Credential | null>;
+    setStatusList(statusListId: string, credential: StatusList2021Credential): Promise<void>;
+    allocateIndex(statusListId: string): Promise<number>;
+}
+export interface StatusListIdentityProvider {
+    getDid(): string;
+    getKeyId(): string;
+}
+export declare class StatusList2021Manager {
+    private storage;
+    private identity;
+    private signingFunction;
+    private compressor;
+    private decompressor;
+    private statusListBaseUrl;
+    private defaultListSize;
+    /** Per-status-list mutex to serialize updateStatus calls and prevent race conditions. */
+    private updateLocks;
+    constructor(storage: StatusListStorageProvider, identity: StatusListIdentityProvider, signingFunction: VCSigningFunction, compressor: CompressionFunction, decompressor: DecompressionFunction, options?: {
+        statusListBaseUrl?: string;
+        defaultListSize?: number;
+    });
+    allocateStatusEntry(purpose: 'revocation' | 'suspension'): Promise<CredentialStatus>;
+    updateStatus(credentialStatus: CredentialStatus, revoked: boolean): Promise<void>;
+    private doUpdateStatus;
+    checkStatus(credentialStatus: CredentialStatus): Promise<boolean>;
+    getRevokedIndices(statusListId: string): Promise<number[]>;
+    private ensureStatusListExists;
+    getStatusListBaseUrl(): string;
+    getDefaultListSize(): number;
+}
+export declare function createStatusListManager(storage: StatusListStorageProvider, identity: StatusListIdentityProvider, signingFunction: VCSigningFunction, compressor: CompressionFunction, decompressor: DecompressionFunction, options?: {
+    statusListBaseUrl?: string;
+    defaultListSize?: number;
+}): StatusList2021Manager;
+//# sourceMappingURL=statuslist-manager.d.ts.map

package/dist/delegation/statuslist-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"statuslist-manager.d.ts","sourceRoot":"","sources":["../../src/delegation/statuslist-manager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,wBAAwB,EACxB,gBAAgB,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAoB,KAAK,mBAAmB,EAAE,KAAK,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACxG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGxD,MAAM,WAAW,yBAAyB;IACxC,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAAC;IAC9E,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,IAAI,MAAM,CAAC;IACjB,QAAQ,IAAI,MAAM,CAAC;CACpB;AAED,qBAAa,qBAAqB;IAO9B,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,eAAe;IACvB,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,YAAY;IAVtB,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,eAAe,CAAS;IAChC,yFAAyF;IACzF,OAAO,CAAC,WAAW,CAAoC;gBAG7C,OAAO,EAAE,yBAAyB,EAClC,QAAQ,EAAE,0BAA0B,EACpC,eAAe,EAAE,iBAAiB,EAClC,UAAU,EAAE,mBAAmB,EAC/B,YAAY,EAAE,qBAAqB,EAC3C,OAAO,CAAC,EAAE;QACR,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B;IAMG,mBAAmB,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAkBpF,YAAY,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;YAezE,cAAc;IA6CtB,WAAW,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBjE,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAelD,sBAAsB;IAgDpC,oBAAoB,IAAI,MAAM;IAI9B,kBAAkB,IAAI,MAAM;CAG7B;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,yBAAyB,EAClC,QAAQ,EAAE,0BAA0B,EACpC,eAAe,EAAE,iBAAiB,EAClC,UAAU,EAAE,mBAAmB,EAC/B,YAAY,EAAE,qBAAqB,EACnC,OAAO,CAAC,EAAE;IACR,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GACA,qBAAqB,CASvB"}

package/dist/delegation/statuslist-manager.js

@@ -0,0 +1,139 @@
+/**
+ * StatusList2021 Manager
+ *
+ * Manages StatusList2021 credentials for efficient delegation revocation.
+ *
+ * Related Spec: W3C StatusList2021
+ */
+import { BitstringManager } from './bitstring.js';
+import { canonicalizeJSON } from './utils.js';
+export class StatusList2021Manager {
+    storage;
+    identity;
+    signingFunction;
+    compressor;
+    decompressor;
+    statusListBaseUrl;
+    defaultListSize;
+    /** Per-status-list mutex to serialize updateStatus calls and prevent race conditions. */
+    updateLocks = new Map();
+    constructor(storage, identity, signingFunction, compressor, decompressor, options) {
+        this.storage = storage;
+        this.identity = identity;
+        this.signingFunction = signingFunction;
+        this.compressor = compressor;
+        this.decompressor = decompressor;
+        this.statusListBaseUrl = options?.statusListBaseUrl || 'https://status.example.com';
+        this.defaultListSize = options?.defaultListSize || 131072;
+    }
+    async allocateStatusEntry(purpose) {
+        const statusListId = `${this.statusListBaseUrl}/${purpose}/v1`;
+        const index = await this.storage.allocateIndex(statusListId);
+        await this.ensureStatusListExists(statusListId, purpose);
+        const credentialStatus = {
+            id: `${statusListId}#${index}`,
+            type: 'StatusList2021Entry',
+            statusPurpose: purpose,
+            statusListIndex: index.toString(),
+            statusListCredential: statusListId,
+        };
+        return credentialStatus;
+    }
+    async updateStatus(credentialStatus, revoked) {
+        const { statusListCredential } = credentialStatus;
+        // Serialize updates per status list to prevent concurrent read-modify-write races.
+        // Each call chains on the previous operation for the same list.
+        const previous = this.updateLocks.get(statusListCredential) ?? Promise.resolve();
+        const operation = previous.then(() => this.doUpdateStatus(credentialStatus, revoked));
+        // Store a non-rejecting version so the chain continues even if one update fails
+        this.updateLocks.set(statusListCredential, operation.catch(() => { }));
+        // Propagate the actual error to the caller
+        await operation;
+    }
+    async doUpdateStatus(credentialStatus, revoked) {
+        const { statusListCredential, statusListIndex } = credentialStatus;
+        const statusList = await this.storage.getStatusList(statusListCredential);
+        if (!statusList) {
+            throw new Error(`Status list not found: ${statusListCredential}`);
+        }
+        const manager = await BitstringManager.decode(statusList.credentialSubject.encodedList, this.compressor, this.decompressor);
+        const index = parseInt(statusListIndex, 10);
+        manager.setBit(index, revoked);
+        const encodedList = await manager.encode();
+        const updatedCredential = {
+            ...statusList,
+            credentialSubject: {
+                ...statusList.credentialSubject,
+                encodedList,
+            },
+        };
+        const unsignedCredential = { ...updatedCredential };
+        delete unsignedCredential['proof'];
+        const canonicalVC = canonicalizeJSON(unsignedCredential);
+        const proof = await this.signingFunction(canonicalVC, this.identity.getDid(), this.identity.getKeyId());
+        const signedCredential = {
+            ...updatedCredential,
+            proof,
+        };
+        await this.storage.setStatusList(statusListCredential, signedCredential);
+    }
+    async checkStatus(credentialStatus) {
+        const { statusListCredential, statusListIndex } = credentialStatus;
+        const statusList = await this.storage.getStatusList(statusListCredential);
+        if (!statusList) {
+            throw new Error(`Status list not found: ${statusListCredential} — cannot determine revocation status`);
+        }
+        const manager = await BitstringManager.decode(statusList.credentialSubject.encodedList, this.compressor, this.decompressor);
+        const index = parseInt(statusListIndex, 10);
+        return manager.getBit(index);
+    }
+    async getRevokedIndices(statusListId) {
+        const statusList = await this.storage.getStatusList(statusListId);
+        if (!statusList) {
+            return [];
+        }
+        const manager = await BitstringManager.decode(statusList.credentialSubject.encodedList, this.compressor, this.decompressor);
+        return manager.getSetBits();
+    }
+    async ensureStatusListExists(statusListId, purpose) {
+        const existing = await this.storage.getStatusList(statusListId);
+        if (existing) {
+            return;
+        }
+        const manager = new BitstringManager(this.defaultListSize, this.compressor, this.decompressor);
+        const encodedList = await manager.encode();
+        const unsignedCredential = {
+            '@context': [
+                'https://www.w3.org/2018/credentials/v1',
+                'https://w3id.org/vc/status-list/2021/v1',
+            ],
+            id: statusListId,
+            type: ['VerifiableCredential', 'StatusList2021Credential'],
+            issuer: this.identity.getDid(),
+            issuanceDate: new Date().toISOString(),
+            credentialSubject: {
+                id: `${statusListId}#list`,
+                type: 'StatusList2021',
+                statusPurpose: purpose,
+                encodedList,
+            },
+        };
+        const canonicalVC = canonicalizeJSON(unsignedCredential);
+        const proof = await this.signingFunction(canonicalVC, this.identity.getDid(), this.identity.getKeyId());
+        const signedCredential = {
+            ...unsignedCredential,
+            proof,
+        };
+        await this.storage.setStatusList(statusListId, signedCredential);
+    }
+    getStatusListBaseUrl() {
+        return this.statusListBaseUrl;
+    }
+    getDefaultListSize() {
+        return this.defaultListSize;
+    }
+}
+export function createStatusListManager(storage, identity, signingFunction, compressor, decompressor, options) {
+    return new StatusList2021Manager(storage, identity, signingFunction, compressor, decompressor, options);
+}
+//# sourceMappingURL=statuslist-manager.js.map

package/dist/delegation/statuslist-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"statuslist-manager.js","sourceRoot":"","sources":["../../src/delegation/statuslist-manager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EAAE,gBAAgB,EAAwD,MAAM,gBAAgB,CAAC;AAExG,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAa9C,MAAM,OAAO,qBAAqB;IAOtB;IACA;IACA;IACA;IACA;IAVF,iBAAiB,CAAS;IAC1B,eAAe,CAAS;IAChC,yFAAyF;IACjF,WAAW,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEvD,YACU,OAAkC,EAClC,QAAoC,EACpC,eAAkC,EAClC,UAA+B,EAC/B,YAAmC,EAC3C,OAGC;QARO,YAAO,GAAP,OAAO,CAA2B;QAClC,aAAQ,GAAR,QAAQ,CAA4B;QACpC,oBAAe,GAAf,eAAe,CAAmB;QAClC,eAAU,GAAV,UAAU,CAAqB;QAC/B,iBAAY,GAAZ,YAAY,CAAuB;QAM3C,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,IAAI,4BAA4B,CAAC;QACpF,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,eAAe,IAAI,MAAM,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,OAAoC;QAC5D,MAAM,YAAY,GAAG,GAAG,IAAI,CAAC,iBAAiB,IAAI,OAAO,KAAK,CAAC;QAE/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAE7D,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAEzD,MAAM,gBAAgB,GAAqB;YACzC,EAAE,EAAE,GAAG,YAAY,IAAI,KAAK,EAAE;YAC9B,IAAI,EAAE,qBAAqB;YAC3B,aAAa,EAAE,OAAO;YACtB,eAAe,EAAE,KAAK,CAAC,QAAQ,EAAE;YACjC,oBAAoB,EAAE,YAAY;SACnC,CAAC;QAEF,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,gBAAkC,EAAE,OAAgB;QACrE,MAAM,EAAE,oBAAoB,EAAE,GAAG,gBAAgB,CAAC;QAElD,mFAAmF;QACnF,gEAAgE;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACjF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;QAEtF,gFAAgF;QAChF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,oBAAoB,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC;QAEtE,2CAA2C;QAC3C,MAAM,SAAS,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,gBAAkC,EAAE,OAAgB;QAC/E,MAAM,EAAE,oBAAoB,EAAE,eAAe,EAAE,GAAG,gBAAgB,CAAC;QAEnE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,0BAA0B,oBAAoB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAC3C,UAAU,CAAC,iBAAiB,CAAC,WAAW,EACxC,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QAEF,MAAM,KAAK,GAAG,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE/B,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;QAE3C,MAAM,iBAAiB,GAA6B;YAClD,GAAG,UAAU;YACb,iBAAiB,EAAE;gBACjB,GAAG,UAAU,CAAC,iBAAiB;gBAC/B,WAAW;aACZ;SACF,CAAC;QAEF,MAAM,kBAAkB,GAAG,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACpD,OAAQ,kBAA8C,CAAC,OAAO,CAAC,CAAC;QAEhE,MAAM,WAAW,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CACtC,WAAW,EACX,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EACtB,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CACzB,CAAC;QAEF,MAAM,gBAAgB,GAA6B;YACjD,GAAG,iBAAiB;YACpB,KAAK;SACN,CAAC;QAEF,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,gBAAkC;QAClD,MAAM,EAAE,oBAAoB,EAAE,eAAe,EAAE,GAAG,gBAAgB,CAAC;QAEnE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,0BAA0B,oBAAoB,uCAAuC,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAC3C,UAAU,CAAC,iBAAiB,CAAC,WAAW,EACxC,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QAEF,MAAM,KAAK,GAAG,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QAC5C,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,YAAoB;QAC1C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAC3C,UAAU,CAAC,iBAAiB,CAAC,WAAW,EACxC,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QAEF,OAAO,OAAO,CAAC,UAAU,EAAE,CAAC;IAC9B,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,YAAoB,EACpB,OAAoC;QAEpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAChE,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAClC,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;QAE3C,MAAM,kBAAkB,GAAG;YACzB,UAAU,EAAE;gBACV,wCAAwC;gBACxC,yCAAyC;aACtB;YACrB,EAAE,EAAE,YAAY;YAChB,IAAI,EAAE,CAAC,sBAAsB,EAAE,0BAA0B,CAAqB;YAC9E,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YAC9B,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACtC,iBAAiB,EAAE;gBACjB,EAAE,EAAE,GAAG,YAAY,OAAO;gBAC1B,IAAI,EAAE,gBAAyB;gBAC/B,aAAa,EAAE,OAAO;gBACtB,WAAW;aACZ;SACF,CAAC;QAEF,MAAM,WAAW,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CACtC,WAAW,EACX,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EACtB,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CACzB,CAAC;QAEF,MAAM,gBAAgB,GAA6B;YACjD,GAAG,kBAAkB;YACrB,KAAK;SACN,CAAC;QAEF,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;IACnE,CAAC;IAED,oBAAoB;QAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAkC,EAClC,QAAoC,EACpC,eAAkC,EAClC,UAA+B,EAC/B,YAAmC,EACnC,OAGC;IAED,OAAO,IAAI,qBAAqB,CAC9B,OAAO,EACP,QAAQ,EACR,eAAe,EACf,UAAU,EACV,YAAY,EACZ,OAAO,CACR,CAAC;AACJ,CAAC"}

package/dist/delegation/storage/memory-graph-storage.d.ts

@@ -0,0 +1,70 @@
+/**
+ * In-Memory Delegation Graph Storage Provider
+ *
+ * Memory-based implementation for testing and development.
+ * NOT suitable for production (no persistence).
+ *
+ * SOLID: Implements DelegationGraphStorageProvider interface
+ */
+import type { DelegationGraphStorageProvider, DelegationNode } from '../delegation-graph.js';
+/**
+ * Memory-based Delegation Graph storage
+ *
+ * Stores delegation nodes in memory with efficient graph queries.
+ * Useful for:
+ * - Unit tests
+ * - Integration tests
+ * - Development/debugging
+ * - Examples
+ */
+export declare class MemoryDelegationGraphStorage implements DelegationGraphStorageProvider {
+    private nodes;
+    /**
+     * Get a delegation node by ID
+     */
+    getNode(delegationId: string): Promise<DelegationNode | null>;
+    /**
+     * Save a delegation node
+     */
+    setNode(node: DelegationNode): Promise<void>;
+    /**
+     * Get all children of a delegation
+     */
+    getChildren(delegationId: string): Promise<DelegationNode[]>;
+    /**
+     * Get the full chain from root to this delegation
+     */
+    getChain(delegationId: string): Promise<DelegationNode[]>;
+    /**
+     * Get all descendants (children, grandchildren, etc.)
+     *
+     * Uses BFS for efficiency.
+     */
+    getDescendants(delegationId: string): Promise<DelegationNode[]>;
+    /**
+     * Delete a node
+     */
+    deleteNode(delegationId: string): Promise<void>;
+    /**
+     * Clear all data (for testing)
+     */
+    clear(): void;
+    /**
+     * Get all node IDs (for testing)
+     */
+    getAllNodeIds(): string[];
+    /**
+     * Get graph statistics (for testing/debugging)
+     */
+    getStats(): {
+        totalNodes: number;
+        rootNodes: number;
+        leafNodes: number;
+        maxDepth: number;
+    };
+    /**
+     * Synchronous chain retrieval (for stats)
+     */
+    private getChainSync;
+}
+//# sourceMappingURL=memory-graph-storage.d.ts.map

package/dist/delegation/storage/memory-graph-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-graph-storage.d.ts","sourceRoot":"","sources":["../../../src/delegation/storage/memory-graph-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,8BAA8B,EAC9B,cAAc,EACf,MAAM,wBAAwB,CAAC;AAEhC;;;;;;;;;GASG;AACH,qBAAa,4BACX,YAAW,8BAA8B;IAEzC,OAAO,CAAC,KAAK,CAAqC;IAElD;;OAEG;IACG,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAInE;;OAEG;IACG,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlD;;OAEG;IACG,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IASlE;;OAEG;IACG,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAgB/D;;;;OAIG;IACG,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IA+BrE;;OAEG;IACG,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrD;;OAEG;IACH,KAAK,IAAI,IAAI;IAIb;;OAEG;IACH,aAAa,IAAI,MAAM,EAAE;IAIzB;;OAEG;IACH,QAAQ,IAAI;QACV,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;KAClB;IAqBD;;OAEG;IACH,OAAO,CAAC,YAAY;CAcrB"}