@kya-os/mcp 1.2.0

package/dist/delegation/storage/memory-graph-storage.js

@@ -0,0 +1,145 @@
+/**
+ * In-Memory Delegation Graph Storage Provider
+ *
+ * Memory-based implementation for testing and development.
+ * NOT suitable for production (no persistence).
+ *
+ * SOLID: Implements DelegationGraphStorageProvider interface
+ */
+/**
+ * Memory-based Delegation Graph storage
+ *
+ * Stores delegation nodes in memory with efficient graph queries.
+ * Useful for:
+ * - Unit tests
+ * - Integration tests
+ * - Development/debugging
+ * - Examples
+ */
+export class MemoryDelegationGraphStorage {
+    nodes = new Map();
+    /**
+     * Get a delegation node by ID
+     */
+    async getNode(delegationId) {
+        return this.nodes.get(delegationId) || null;
+    }
+    /**
+     * Save a delegation node
+     */
+    async setNode(node) {
+        this.nodes.set(node.id, node);
+    }
+    /**
+     * Get all children of a delegation
+     */
+    async getChildren(delegationId) {
+        const parent = this.nodes.get(delegationId);
+        if (!parent)
+            return [];
+        return parent.children
+            .map((childId) => this.nodes.get(childId))
+            .filter((node) => node !== undefined);
+    }
+    /**
+     * Get the full chain from root to this delegation
+     */
+    async getChain(delegationId) {
+        const chain = [];
+        let currentId = delegationId;
+        // Walk up the tree to root
+        while (currentId) {
+            const node = this.nodes.get(currentId);
+            if (!node)
+                break;
+            chain.unshift(node); // Add to front (root first)
+            currentId = node.parentId;
+        }
+        return chain;
+    }
+    /**
+     * Get all descendants (children, grandchildren, etc.)
+     *
+     * Uses BFS for efficiency.
+     */
+    async getDescendants(delegationId) {
+        const descendants = [];
+        const queue = [delegationId];
+        const visited = new Set();
+        while (queue.length > 0) {
+            const currentId = queue.shift();
+            // Skip if already visited (prevent infinite loops)
+            if (visited.has(currentId))
+                continue;
+            visited.add(currentId);
+            const node = this.nodes.get(currentId);
+            if (!node)
+                continue;
+            // Add children to queue
+            for (const childId of node.children) {
+                if (!visited.has(childId)) {
+                    queue.push(childId);
+                    const childNode = this.nodes.get(childId);
+                    if (childNode) {
+                        descendants.push(childNode);
+                    }
+                }
+            }
+        }
+        return descendants;
+    }
+    /**
+     * Delete a node
+     */
+    async deleteNode(delegationId) {
+        this.nodes.delete(delegationId);
+    }
+    /**
+     * Clear all data (for testing)
+     */
+    clear() {
+        this.nodes.clear();
+    }
+    /**
+     * Get all node IDs (for testing)
+     */
+    getAllNodeIds() {
+        return Array.from(this.nodes.keys());
+    }
+    /**
+     * Get graph statistics (for testing/debugging)
+     */
+    getStats() {
+        const nodes = Array.from(this.nodes.values());
+        const rootNodes = nodes.filter((n) => n.parentId === null).length;
+        const leafNodes = nodes.filter((n) => n.children.length === 0).length;
+        // Calculate max depth
+        let maxDepth = 0;
+        for (const node of nodes) {
+            const chain = this.getChainSync(node.id);
+            maxDepth = Math.max(maxDepth, chain.length - 1);
+        }
+        return {
+            totalNodes: nodes.length,
+            rootNodes,
+            leafNodes,
+            maxDepth,
+        };
+    }
+    /**
+     * Synchronous chain retrieval (for stats)
+     */
+    getChainSync(delegationId) {
+        const chain = [];
+        let currentId = delegationId;
+        while (currentId) {
+            const node = this.nodes.get(currentId);
+            if (!node)
+                break;
+            chain.unshift(node);
+            currentId = node.parentId;
+        }
+        return chain;
+    }
+}
+//# sourceMappingURL=memory-graph-storage.js.map

package/dist/delegation/storage/memory-graph-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-graph-storage.js","sourceRoot":"","sources":["../../../src/delegation/storage/memory-graph-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH;;;;;;;;;GASG;AACH,MAAM,OAAO,4BAA4B;IAG/B,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAElD;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,YAAoB;QAChC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,IAAoB;QAChC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,YAAoB;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QAEvB,OAAO,MAAM,CAAC,QAAQ;aACnB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;aACzC,MAAM,CAAC,CAAC,IAAI,EAA0B,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,YAAoB;QACjC,MAAM,KAAK,GAAqB,EAAE,CAAC;QACnC,IAAI,SAAS,GAAkB,YAAY,CAAC;QAE5C,2BAA2B;QAC3B,OAAO,SAAS,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,CAAC,IAAI;gBAAE,MAAM;YAEjB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,4BAA4B;YACjD,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC5B,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,YAAoB;QACvC,MAAM,WAAW,GAAqB,EAAE,CAAC;QACzC,MAAM,KAAK,GAAa,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAElC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;YAEjC,mDAAmD;YACnD,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,SAAS;YACrC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAEvB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,CAAC,IAAI;gBAAE,SAAS;YAEpB,wBAAwB;YACxB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACpC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1B,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBAEpB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAC1C,IAAI,SAAS,EAAE,CAAC;wBACd,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAC9B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,YAAoB;QACnC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,aAAa;QACX,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,QAAQ;QAMN,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAE9C,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;QAClE,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAEtE,sBAAsB;QACtB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAClD,CAAC;QAED,OAAO;YACL,UAAU,EAAE,KAAK,CAAC,MAAM;YACxB,SAAS;YACT,SAAS;YACT,QAAQ;SACT,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,YAAoB;QACvC,MAAM,KAAK,GAAqB,EAAE,CAAC;QACnC,IAAI,SAAS,GAAkB,YAAY,CAAC;QAE5C,OAAO,SAAS,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,CAAC,IAAI;gBAAE,MAAM;YAEjB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACpB,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC5B,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/delegation/storage/memory-statuslist-storage.d.ts

@@ -0,0 +1,19 @@
+/**
+ * In-Memory StatusList Storage Provider
+ *
+ * Memory-based implementation for testing and development.
+ * NOT suitable for production (no persistence).
+ */
+import type { StatusList2021Credential } from '../../types/protocol.js';
+import type { StatusListStorageProvider } from '../statuslist-manager.js';
+export declare class MemoryStatusListStorage implements StatusListStorageProvider {
+    private statusLists;
+    private indexCounters;
+    getStatusList(statusListId: string): Promise<StatusList2021Credential | null>;
+    setStatusList(statusListId: string, credential: StatusList2021Credential): Promise<void>;
+    allocateIndex(statusListId: string): Promise<number>;
+    getIndexCount(statusListId: string): number;
+    clear(): void;
+    getAllStatusListIds(): string[];
+}
+//# sourceMappingURL=memory-statuslist-storage.d.ts.map

package/dist/delegation/storage/memory-statuslist-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-statuslist-storage.d.ts","sourceRoot":"","sources":["../../../src/delegation/storage/memory-statuslist-storage.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAE1E,qBAAa,uBAAwB,YAAW,yBAAyB;IACvE,OAAO,CAAC,WAAW,CAA+C;IAClE,OAAO,CAAC,aAAa,CAA6B;IAE5C,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;IAI7E,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxF,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAO1D,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAI3C,KAAK,IAAI,IAAI;IAKb,mBAAmB,IAAI,MAAM,EAAE;CAGhC"}

package/dist/delegation/storage/memory-statuslist-storage.js

@@ -0,0 +1,33 @@
+/**
+ * In-Memory StatusList Storage Provider
+ *
+ * Memory-based implementation for testing and development.
+ * NOT suitable for production (no persistence).
+ */
+export class MemoryStatusListStorage {
+    statusLists = new Map();
+    indexCounters = new Map();
+    async getStatusList(statusListId) {
+        return this.statusLists.get(statusListId) || null;
+    }
+    async setStatusList(statusListId, credential) {
+        this.statusLists.set(statusListId, credential);
+    }
+    async allocateIndex(statusListId) {
+        const current = this.indexCounters.get(statusListId) || 0;
+        const allocated = current;
+        this.indexCounters.set(statusListId, current + 1);
+        return allocated;
+    }
+    getIndexCount(statusListId) {
+        return this.indexCounters.get(statusListId) || 0;
+    }
+    clear() {
+        this.statusLists.clear();
+        this.indexCounters.clear();
+    }
+    getAllStatusListIds() {
+        return Array.from(this.statusLists.keys());
+    }
+}
+//# sourceMappingURL=memory-statuslist-storage.js.map

package/dist/delegation/storage/memory-statuslist-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-statuslist-storage.js","sourceRoot":"","sources":["../../../src/delegation/storage/memory-statuslist-storage.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,MAAM,OAAO,uBAAuB;IAC1B,WAAW,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC1D,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAElD,KAAK,CAAC,aAAa,CAAC,YAAoB;QACtC,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,YAAoB,EAAE,UAAoC;QAC5E,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,YAAoB;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,OAAO,CAAC;QAC1B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;QAClD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,aAAa,CAAC,YAAoB;QAChC,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IAED,KAAK;QACH,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,mBAAmB;QACjB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;CACF"}

package/dist/delegation/utils.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Delegation Utilities
+ *
+ * Shared utility functions for delegation credential operations.
+ */
+/**
+ * Canonicalize a JSON value using RFC 8785 (JSON Canonicalization Scheme).
+ *
+ * Wraps `json-canonicalize` with input validation to reject values that are
+ * not representable in JSON (Infinity, NaN, undefined, functions, symbols,
+ * bigints). The underlying library silently coerces these to `"null"` or
+ * `"undefined"`, which is dangerous for cryptographic canonicalization where
+ * distinct inputs must produce distinct outputs.
+ *
+ * @throws {TypeError} If `obj` is not a valid JSON value
+ */
+export declare function canonicalizeJSON(obj: unknown): string;
+export interface VCJWTHeader {
+    alg: 'EdDSA';
+    typ: 'JWT' | 'vc+jwt';
+    kid?: string;
+}
+export interface VCJWTPayload {
+    iss: string;
+    sub?: string;
+    aud?: string | string[];
+    exp?: number;
+    iat?: number;
+    jti?: string;
+    vc: Record<string, unknown>;
+}
+export interface EncodeVCAsJWTOptions {
+    keyId?: string;
+}
+export declare function createUnsignedVCJWT(vc: Record<string, unknown>, options?: EncodeVCAsJWTOptions): {
+    header: VCJWTHeader;
+    payload: VCJWTPayload;
+    encodedHeader: string;
+    encodedPayload: string;
+    signingInput: string;
+};
+export declare function completeVCJWT(signingInput: string, signature: string): string;
+export declare function parseVCJWT(jwt: string): {
+    header: VCJWTHeader;
+    payload: VCJWTPayload;
+    signature: string;
+    signingInput: string;
+} | null;
+//# sourceMappingURL=utils.d.ts.map

package/dist/delegation/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/delegation/utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAGrD;AAmDD,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,KAAK,GAAG,QAAQ,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3B,OAAO,GAAE,oBAAyB,GACjC;IACD,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,YAAY,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;CACtB,CAmDA;AAED,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG;IACvC,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,YAAY,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,IAAI,CAsBP"}

package/dist/delegation/utils.js

@@ -0,0 +1,131 @@
+/**
+ * Delegation Utilities
+ *
+ * Shared utility functions for delegation credential operations.
+ */
+import { base64urlEncodeFromString, base64urlDecodeToString } from '../utils/base64.js';
+import { canonicalize } from 'json-canonicalize';
+/**
+ * Canonicalize a JSON value using RFC 8785 (JSON Canonicalization Scheme).
+ *
+ * Wraps `json-canonicalize` with input validation to reject values that are
+ * not representable in JSON (Infinity, NaN, undefined, functions, symbols,
+ * bigints). The underlying library silently coerces these to `"null"` or
+ * `"undefined"`, which is dangerous for cryptographic canonicalization where
+ * distinct inputs must produce distinct outputs.
+ *
+ * @throws {TypeError} If `obj` is not a valid JSON value
+ */
+export function canonicalizeJSON(obj) {
+    assertJsonSafe(obj);
+    return canonicalize(obj);
+}
+/**
+ * Recursively validates that a value is JSON-safe.
+ * Throws TypeError for Infinity, NaN, undefined, functions, symbols, bigints.
+ */
+function assertJsonSafe(value, path = '$') {
+    if (value === null || typeof value === 'boolean' || typeof value === 'string') {
+        return;
+    }
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value)) {
+            throw new TypeError(`Cannot canonicalize non-finite number at ${path}: ${value}`);
+        }
+        return;
+    }
+    if (typeof value === 'undefined') {
+        throw new TypeError(`Cannot canonicalize undefined at ${path}`);
+    }
+    if (typeof value === 'function') {
+        throw new TypeError(`Cannot canonicalize function at ${path}`);
+    }
+    if (typeof value === 'symbol') {
+        throw new TypeError(`Cannot canonicalize symbol at ${path}`);
+    }
+    if (typeof value === 'bigint') {
+        throw new TypeError(`Cannot canonicalize bigint at ${path}`);
+    }
+    if (Array.isArray(value)) {
+        for (let i = 0; i < value.length; i++) {
+            assertJsonSafe(value[i], `${path}[${i}]`);
+        }
+        return;
+    }
+    if (typeof value === 'object') {
+        for (const [key, val] of Object.entries(value)) {
+            assertJsonSafe(val, `${path}.${key}`);
+        }
+        return;
+    }
+}
+export function createUnsignedVCJWT(vc, options = {}) {
+    const header = {
+        alg: 'EdDSA',
+        typ: 'JWT',
+    };
+    if (options.keyId) {
+        header.kid = options.keyId;
+    }
+    const issuer = typeof vc['issuer'] === 'string'
+        ? vc['issuer']
+        : vc['issuer']?.['id'];
+    const subject = vc['credentialSubject']?.['id'];
+    let exp;
+    let iat;
+    if (vc['expirationDate'] && typeof vc['expirationDate'] === 'string') {
+        exp = Math.floor(new Date(vc['expirationDate']).getTime() / 1000);
+    }
+    if (vc['issuanceDate'] && typeof vc['issuanceDate'] === 'string') {
+        iat = Math.floor(new Date(vc['issuanceDate']).getTime() / 1000);
+    }
+    const vcWithoutProof = { ...vc };
+    delete vcWithoutProof['proof'];
+    const payload = {
+        iss: issuer,
+        vc: vcWithoutProof,
+    };
+    if (subject)
+        payload.sub = subject;
+    if (exp)
+        payload.exp = exp;
+    if (iat)
+        payload.iat = iat;
+    if (vc['id'] && typeof vc['id'] === 'string')
+        payload.jti = vc['id'];
+    const encodedHeader = base64urlEncodeFromString(JSON.stringify(header));
+    const encodedPayload = base64urlEncodeFromString(JSON.stringify(payload));
+    const signingInput = `${encodedHeader}.${encodedPayload}`;
+    return {
+        header,
+        payload,
+        encodedHeader,
+        encodedPayload,
+        signingInput,
+    };
+}
+export function completeVCJWT(signingInput, signature) {
+    return `${signingInput}.${signature}`;
+}
+export function parseVCJWT(jwt) {
+    const parts = jwt.split('.');
+    if (parts.length !== 3) {
+        return null;
+    }
+    try {
+        const headerJson = base64urlDecodeToString(parts[0]);
+        const payloadJson = base64urlDecodeToString(parts[1]);
+        const header = JSON.parse(headerJson);
+        const payload = JSON.parse(payloadJson);
+        return {
+            header,
+            payload,
+            signature: parts[2],
+            signingInput: `${parts[0]}.${parts[1]}`,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=utils.js.map

package/dist/delegation/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/delegation/utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,KAAc,EAAE,IAAI,GAAG,GAAG;IAChD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9E,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,SAAS,CACjB,4CAA4C,IAAI,KAAK,KAAK,EAAE,CAC7D,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,SAAS,CAAC,oCAAoC,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,SAAS,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YAC1E,cAAc,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,OAAO;IACT,CAAC;AACH,CAAC;AAsBD,MAAM,UAAU,mBAAmB,CACjC,EAA2B,EAC3B,UAAgC,EAAE;IAQlC,MAAM,MAAM,GAAgB;QAC1B,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;KACX,CAAC;IACF,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC;IAC7B,CAAC;IAED,MAAM,MAAM,GACV,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,QAAQ;QAC9B,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC;QACd,CAAC,CAAG,EAAE,CAAC,QAAQ,CAA6B,EAAE,CAAC,IAAI,CAAY,CAAC;IACpE,MAAM,OAAO,GAAI,EAAE,CAAC,mBAAmB,CAA6B,EAAE,CAAC,IAAI,CAE9D,CAAC;IAEd,IAAI,GAAuB,CAAC;IAC5B,IAAI,GAAuB,CAAC;IAE5B,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,OAAO,EAAE,CAAC,gBAAgB,CAAC,KAAK,QAAQ,EAAE,CAAC;QACrE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,EAAE,CAAC,cAAc,CAAC,IAAI,OAAO,EAAE,CAAC,cAAc,CAAC,KAAK,QAAQ,EAAE,CAAC;QACjE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;IACjC,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;IAE/B,MAAM,OAAO,GAAiB;QAC5B,GAAG,EAAE,MAAM;QACX,EAAE,EAAE,cAAc;KACnB,CAAC;IAEF,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC;IACnC,IAAI,GAAG;QAAE,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;IAC3B,IAAI,GAAG;QAAE,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;IAC3B,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAErE,MAAM,aAAa,GAAG,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACxE,MAAM,cAAc,GAAG,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1E,MAAM,YAAY,GAAG,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC;IAE1D,OAAO;QACL,MAAM;QACN,OAAO;QACP,aAAa;QACb,cAAc;QACd,YAAY;KACb,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,YAAoB,EAAE,SAAiB;IACnE,OAAO,GAAG,YAAY,IAAI,SAAS,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW;IAMpC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QACtD,MAAM,WAAW,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAgB,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAiB,CAAC;QAExD,OAAO;YACL,MAAM;YACN,OAAO;YACP,SAAS,EAAE,KAAK,CAAC,CAAC,CAAE;YACpB,YAAY,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE;SACxC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/delegation/vc-issuer.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Delegation Credential Issuer (Platform-Agnostic)
+ *
+ * Issues W3C Verifiable Credentials for delegations with Ed25519 signatures.
+ * Follows the Python POC design (Delegation-Service.md:136-163) where
+ * delegations are issued AS W3C VCs.
+ *
+ * Related Spec: MCP-I §4.1, §4.2, W3C VC Data Model 1.1
+ */
+import type { DelegationCredential, DelegationRecord, CredentialStatus, Proof } from '../types/protocol.js';
+export interface IssueDelegationOptions {
+    id?: string;
+    issuanceDate?: string;
+    expirationDate?: string;
+    credentialStatus?: CredentialStatus;
+    additionalContexts?: string[];
+}
+export interface VCSigningFunction {
+    (canonicalVC: string, issuerDid: string, kid: string): Promise<Proof>;
+}
+export interface IdentityProvider {
+    getDid(): string;
+    getKeyId(): string;
+    getPrivateKey(): string;
+}
+export declare class DelegationCredentialIssuer {
+    private identity;
+    private signingFunction;
+    constructor(identity: IdentityProvider, signingFunction: VCSigningFunction);
+    issueDelegationCredential(delegation: DelegationRecord, options?: IssueDelegationOptions): Promise<DelegationCredential>;
+    /**
+     * Create and issue a delegation credential in one step.
+     *
+     * Constructs a DelegationRecord from the provided parameters and wraps it
+     * in a signed W3C Verifiable Credential.
+     *
+     * @param params - Delegation parameters including issuer/subject DIDs, constraints, etc.
+     * @param options - Optional VC issuance options (id, dates, status, contexts)
+     * @returns Signed W3C Delegation Credential
+     */
+    createAndIssueDelegation(params: {
+        id: string;
+        issuerDid: string;
+        subjectDid: string;
+        controller?: string;
+        parentId?: string;
+        constraints: DelegationRecord['constraints'];
+        status?: DelegationRecord['status'];
+        metadata?: Record<string, unknown>;
+    }, options?: IssueDelegationOptions): Promise<DelegationCredential>;
+    private canonicalizeVC;
+    getIssuerDid(): string;
+    getIssuerKeyId(): string;
+}
+export declare function createDelegationIssuer(identity: IdentityProvider, signingFunction: VCSigningFunction): DelegationCredentialIssuer;
+//# sourceMappingURL=vc-issuer.d.ts.map

package/dist/delegation/vc-issuer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vc-issuer.d.ts","sourceRoot":"","sources":["../../src/delegation/vc-issuer.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,EACN,MAAM,sBAAsB,CAAC;AAI9B,MAAM,WAAW,sBAAsB;IACrC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;CACvE;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,IAAI,MAAM,CAAC;IACjB,QAAQ,IAAI,MAAM,CAAC;IACnB,aAAa,IAAI,MAAM,CAAC;CACzB;AAED,qBAAa,0BAA0B;IAEnC,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,eAAe;gBADf,QAAQ,EAAE,gBAAgB,EAC1B,eAAe,EAAE,iBAAiB;IAGtC,yBAAyB,CAC7B,UAAU,EAAE,gBAAgB,EAC5B,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,oBAAoB,CAAC;IA8BhC;;;;;;;;;OASG;IACG,wBAAwB,CAC5B,MAAM,EAAE;QACN,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAC7C,MAAM,CAAC,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACpC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,EACD,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,oBAAoB,CAAC;IAoBhC,OAAO,CAAC,cAAc;IAItB,YAAY,IAAI,MAAM;IAItB,cAAc,IAAI,MAAM;CAGzB;AAED,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,gBAAgB,EAC1B,eAAe,EAAE,iBAAiB,GACjC,0BAA0B,CAE5B"}

package/dist/delegation/vc-issuer.js

@@ -0,0 +1,80 @@
+/**
+ * Delegation Credential Issuer (Platform-Agnostic)
+ *
+ * Issues W3C Verifiable Credentials for delegations with Ed25519 signatures.
+ * Follows the Python POC design (Delegation-Service.md:136-163) where
+ * delegations are issued AS W3C VCs.
+ *
+ * Related Spec: MCP-I §4.1, §4.2, W3C VC Data Model 1.1
+ */
+import { wrapDelegationAsVC } from '../types/protocol.js';
+import { canonicalizeJSON } from './utils.js';
+export class DelegationCredentialIssuer {
+    identity;
+    signingFunction;
+    constructor(identity, signingFunction) {
+        this.identity = identity;
+        this.signingFunction = signingFunction;
+    }
+    async issueDelegationCredential(delegation, options = {}) {
+        let unsignedVC = wrapDelegationAsVC(delegation, {
+            id: options.id,
+            issuanceDate: options.issuanceDate,
+            expirationDate: options.expirationDate,
+            credentialStatus: options.credentialStatus,
+        });
+        if (options.additionalContexts && options.additionalContexts.length > 0) {
+            const existingContexts = unsignedVC['@context'];
+            unsignedVC = {
+                ...unsignedVC,
+                '@context': [...existingContexts, ...options.additionalContexts],
+            };
+        }
+        const canonicalVC = this.canonicalizeVC(unsignedVC);
+        const proof = await this.signingFunction(canonicalVC, this.identity.getDid(), this.identity.getKeyId());
+        return {
+            ...unsignedVC,
+            proof,
+        };
+    }
+    /**
+     * Create and issue a delegation credential in one step.
+     *
+     * Constructs a DelegationRecord from the provided parameters and wraps it
+     * in a signed W3C Verifiable Credential.
+     *
+     * @param params - Delegation parameters including issuer/subject DIDs, constraints, etc.
+     * @param options - Optional VC issuance options (id, dates, status, contexts)
+     * @returns Signed W3C Delegation Credential
+     */
+    async createAndIssueDelegation(params, options = {}) {
+        const now = Date.now();
+        const delegation = {
+            id: params.id,
+            issuerDid: params.issuerDid,
+            subjectDid: params.subjectDid,
+            controller: params.controller,
+            vcId: options.id || `urn:uuid:${params.id}`,
+            parentId: params.parentId,
+            constraints: params.constraints,
+            signature: '',
+            status: params.status || 'active',
+            createdAt: now,
+            metadata: params.metadata,
+        };
+        return this.issueDelegationCredential(delegation, options);
+    }
+    canonicalizeVC(vc) {
+        return canonicalizeJSON(vc);
+    }
+    getIssuerDid() {
+        return this.identity.getDid();
+    }
+    getIssuerKeyId() {
+        return this.identity.getKeyId();
+    }
+}
+export function createDelegationIssuer(identity, signingFunction) {
+    return new DelegationCredentialIssuer(identity, signingFunction);
+}
+//# sourceMappingURL=vc-issuer.js.map

package/dist/delegation/vc-issuer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vc-issuer.js","sourceRoot":"","sources":["../../src/delegation/vc-issuer.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAoB9C,MAAM,OAAO,0BAA0B;IAE3B;IACA;IAFV,YACU,QAA0B,EAC1B,eAAkC;QADlC,aAAQ,GAAR,QAAQ,CAAkB;QAC1B,oBAAe,GAAf,eAAe,CAAmB;IACzC,CAAC;IAEJ,KAAK,CAAC,yBAAyB,CAC7B,UAA4B,EAC5B,UAAkC,EAAE;QAEpC,IAAI,UAAU,GAAG,kBAAkB,CAAC,UAAU,EAAE;YAC9C,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;SAC3C,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxE,MAAM,gBAAgB,GAAG,UAAU,CAAC,UAAU,CAA4C,CAAC;YAC3F,UAAU,GAAG;gBACX,GAAG,UAAU;gBACb,UAAU,EAAE,CAAC,GAAG,gBAAgB,EAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;aACjE,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAEpD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CACtC,WAAW,EACX,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EACtB,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CACzB,CAAC;QAEF,OAAO;YACL,GAAG,UAAU;YACb,KAAK;SACkB,CAAC;IAC5B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,wBAAwB,CAC5B,MASC,EACD,UAAkC,EAAE;QAEpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,MAAM,UAAU,GAAqB;YACnC,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,YAAY,MAAM,CAAC,EAAE,EAAE;YAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,EAAE;YACb,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,QAAQ;YACjC,SAAS,EAAE,GAAG;YACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC;QAEF,OAAO,IAAI,CAAC,yBAAyB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAEO,cAAc,CAAC,EAAuC;QAC5D,OAAO,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;IAChC,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAClC,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB,CACpC,QAA0B,EAC1B,eAAkC;IAElC,OAAO,IAAI,0BAA0B,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;AACnE,CAAC"}

package/dist/delegation/vc-verifier.d.ts

@@ -0,0 +1,112 @@
+/**
+ * Dylan Hobbs
+ * Delegation Credential Verifier (Platform-Agnostic)
+ *
+ * Progressive enhancement verification for W3C Delegation Credentials.
+ *
+ * Stage 1: Fast basic checks (no network, early rejection)
+ * Stage 2: Parallel advanced checks (signature, status)
+ * Stage 3: Combined results
+ *
+ * Related Spec: MCP-I §4.3, W3C VC Data Model 1.1
+ */
+import type { DelegationCredential, CredentialStatus } from "../types/protocol.js";
+export interface DelegationVCVerificationResult {
+    valid: boolean;
+    reason?: string;
+    stage: "basic" | "signature" | "status" | "complete";
+    cached?: boolean;
+    metrics?: {
+        basicCheckMs?: number;
+        signatureCheckMs?: number;
+        statusCheckMs?: number;
+        totalMs: number;
+    };
+    checks?: {
+        basicValid?: boolean;
+        signatureValid?: boolean;
+        statusValid?: boolean;
+    };
+}
+export interface VerifyDelegationVCOptions {
+    skipCache?: boolean;
+    skipSignature?: boolean;
+    skipStatus?: boolean;
+    didResolver?: DIDResolver;
+    statusListResolver?: StatusListResolver;
+}
+export interface DIDResolver {
+    resolve(did: string): Promise<DIDDocument | null>;
+}
+export interface DIDDocument {
+    id: string;
+    verificationMethod?: VerificationMethod[];
+    authentication?: (string | VerificationMethod)[];
+    assertionMethod?: (string | VerificationMethod)[];
+}
+export interface VerificationMethod {
+    id: string;
+    type: string;
+    controller: string;
+    publicKeyJwk?: unknown;
+    publicKeyBase58?: string;
+    publicKeyMultibase?: string;
+}
+export interface StatusListResolver {
+    checkStatus(status: CredentialStatus): Promise<boolean>;
+}
+export interface SignatureVerificationFunction {
+    (vc: DelegationCredential, publicKeyJwk: unknown): Promise<{
+        valid: boolean;
+        reason?: string;
+    }>;
+}
+export declare class DelegationCredentialVerifier {
+    private didResolver?;
+    private statusListResolver?;
+    private signatureVerifier?;
+    private cache;
+    private cacheInsertionOrder;
+    private cacheTtl;
+    /**
+     * Maximum number of entries in the verification cache.
+     * In production deployments, configure maxCacheSize based on expected concurrent delegations.
+     * Default of 1000 is suitable for most use cases.
+     */
+    private maxCacheSize;
+    constructor(options?: {
+        didResolver?: DIDResolver;
+        statusListResolver?: StatusListResolver;
+        signatureVerifier?: SignatureVerificationFunction;
+        cacheTtl?: number;
+        /** Maximum cache entries. Default: 1000 */
+        maxCacheSize?: number;
+    });
+    /**
+     * Verify a delegation credential through progressive enhancement.
+     *
+     * Stage 1: Fast basic checks (schema, expiry, status field)
+     * Stage 2: Parallel signature and status list checks (if resolvers configured)
+     * Stage 3: Combined result with timing metrics
+     *
+     * @param vc - The W3C Delegation Credential to verify
+     * @param options - Verification options (skip cache/signature/status, custom resolvers)
+     * @returns Verification result with validity, reason, stage reached, and metrics
+     */
+    verifyDelegationCredential(vc: DelegationCredential, options?: VerifyDelegationVCOptions): Promise<DelegationVCVerificationResult>;
+    private validateBasicProperties;
+    private verifySignature;
+    private checkCredentialStatus;
+    private findVerificationMethod;
+    private getFromCache;
+    private setInCache;
+    clearCache(): void;
+    clearCacheEntry(id: string): void;
+}
+export declare function createDelegationVerifier(options?: {
+    didResolver?: DIDResolver;
+    statusListResolver?: StatusListResolver;
+    signatureVerifier?: SignatureVerificationFunction;
+    cacheTtl?: number;
+}): DelegationCredentialVerifier;
+//# sourceMappingURL=vc-verifier.d.ts.map