@mcp-i/core 0.1.0

package/dist/delegation/vc-issuer.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Delegation Credential Issuer (Platform-Agnostic)
+ *
+ * Issues W3C Verifiable Credentials for delegations with Ed25519 signatures.
+ * Follows the Python POC design (Delegation-Service.md:136-163) where
+ * delegations are issued AS W3C VCs.
+ *
+ * Related Spec: MCP-I §4.1, §4.2, W3C VC Data Model 1.1
+ */
+import type { DelegationCredential, DelegationRecord, CredentialStatus, Proof } from '../types/protocol.js';
+export interface IssueDelegationOptions {
+    id?: string;
+    issuanceDate?: string;
+    expirationDate?: string;
+    credentialStatus?: CredentialStatus;
+    additionalContexts?: string[];
+}
+export interface VCSigningFunction {
+    (canonicalVC: string, issuerDid: string, kid: string): Promise<Proof>;
+}
+export interface IdentityProvider {
+    getDid(): string;
+    getKeyId(): string;
+    getPrivateKey(): string;
+}
+export declare class DelegationCredentialIssuer {
+    private identity;
+    private signingFunction;
+    constructor(identity: IdentityProvider, signingFunction: VCSigningFunction);
+    issueDelegationCredential(delegation: DelegationRecord, options?: IssueDelegationOptions): Promise<DelegationCredential>;
+    /**
+     * Create and issue a delegation credential in one step.
+     *
+     * Constructs a DelegationRecord from the provided parameters and wraps it
+     * in a signed W3C Verifiable Credential.
+     *
+     * @param params - Delegation parameters including issuer/subject DIDs, constraints, etc.
+     * @param options - Optional VC issuance options (id, dates, status, contexts)
+     * @returns Signed W3C Delegation Credential
+     */
+    createAndIssueDelegation(params: {
+        id: string;
+        issuerDid: string;
+        subjectDid: string;
+        controller?: string;
+        parentId?: string;
+        constraints: DelegationRecord['constraints'];
+        status?: DelegationRecord['status'];
+        metadata?: Record<string, unknown>;
+    }, options?: IssueDelegationOptions): Promise<DelegationCredential>;
+    private canonicalizeVC;
+    getIssuerDid(): string;
+    getIssuerKeyId(): string;
+}
+export declare function createDelegationIssuer(identity: IdentityProvider, signingFunction: VCSigningFunction): DelegationCredentialIssuer;
+//# sourceMappingURL=vc-issuer.d.ts.map

package/dist/delegation/vc-issuer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vc-issuer.d.ts","sourceRoot":"","sources":["../../src/delegation/vc-issuer.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,EACN,MAAM,sBAAsB,CAAC;AAI9B,MAAM,WAAW,sBAAsB;IACrC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;CACvE;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,IAAI,MAAM,CAAC;IACjB,QAAQ,IAAI,MAAM,CAAC;IACnB,aAAa,IAAI,MAAM,CAAC;CACzB;AAED,qBAAa,0BAA0B;IAEnC,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,eAAe;gBADf,QAAQ,EAAE,gBAAgB,EAC1B,eAAe,EAAE,iBAAiB;IAGtC,yBAAyB,CAC7B,UAAU,EAAE,gBAAgB,EAC5B,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,oBAAoB,CAAC;IA8BhC;;;;;;;;;OASG;IACG,wBAAwB,CAC5B,MAAM,EAAE;QACN,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAC7C,MAAM,CAAC,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACpC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,EACD,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,oBAAoB,CAAC;IAoBhC,OAAO,CAAC,cAAc;IAItB,YAAY,IAAI,MAAM;IAItB,cAAc,IAAI,MAAM;CAGzB;AAED,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,gBAAgB,EAC1B,eAAe,EAAE,iBAAiB,GACjC,0BAA0B,CAE5B"}

package/dist/delegation/vc-issuer.js

@@ -0,0 +1,80 @@
+/**
+ * Delegation Credential Issuer (Platform-Agnostic)
+ *
+ * Issues W3C Verifiable Credentials for delegations with Ed25519 signatures.
+ * Follows the Python POC design (Delegation-Service.md:136-163) where
+ * delegations are issued AS W3C VCs.
+ *
+ * Related Spec: MCP-I §4.1, §4.2, W3C VC Data Model 1.1
+ */
+import { wrapDelegationAsVC } from '../types/protocol.js';
+import { canonicalizeJSON } from './utils.js';
+export class DelegationCredentialIssuer {
+    identity;
+    signingFunction;
+    constructor(identity, signingFunction) {
+        this.identity = identity;
+        this.signingFunction = signingFunction;
+    }
+    async issueDelegationCredential(delegation, options = {}) {
+        let unsignedVC = wrapDelegationAsVC(delegation, {
+            id: options.id,
+            issuanceDate: options.issuanceDate,
+            expirationDate: options.expirationDate,
+            credentialStatus: options.credentialStatus,
+        });
+        if (options.additionalContexts && options.additionalContexts.length > 0) {
+            const existingContexts = unsignedVC['@context'];
+            unsignedVC = {
+                ...unsignedVC,
+                '@context': [...existingContexts, ...options.additionalContexts],
+            };
+        }
+        const canonicalVC = this.canonicalizeVC(unsignedVC);
+        const proof = await this.signingFunction(canonicalVC, this.identity.getDid(), this.identity.getKeyId());
+        return {
+            ...unsignedVC,
+            proof,
+        };
+    }
+    /**
+     * Create and issue a delegation credential in one step.
+     *
+     * Constructs a DelegationRecord from the provided parameters and wraps it
+     * in a signed W3C Verifiable Credential.
+     *
+     * @param params - Delegation parameters including issuer/subject DIDs, constraints, etc.
+     * @param options - Optional VC issuance options (id, dates, status, contexts)
+     * @returns Signed W3C Delegation Credential
+     */
+    async createAndIssueDelegation(params, options = {}) {
+        const now = Date.now();
+        const delegation = {
+            id: params.id,
+            issuerDid: params.issuerDid,
+            subjectDid: params.subjectDid,
+            controller: params.controller,
+            vcId: options.id || `urn:uuid:${params.id}`,
+            parentId: params.parentId,
+            constraints: params.constraints,
+            signature: '',
+            status: params.status || 'active',
+            createdAt: now,
+            metadata: params.metadata,
+        };
+        return this.issueDelegationCredential(delegation, options);
+    }
+    canonicalizeVC(vc) {
+        return canonicalizeJSON(vc);
+    }
+    getIssuerDid() {
+        return this.identity.getDid();
+    }
+    getIssuerKeyId() {
+        return this.identity.getKeyId();
+    }
+}
+export function createDelegationIssuer(identity, signingFunction) {
+    return new DelegationCredentialIssuer(identity, signingFunction);
+}
+//# sourceMappingURL=vc-issuer.js.map

package/dist/delegation/vc-issuer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vc-issuer.js","sourceRoot":"","sources":["../../src/delegation/vc-issuer.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAoB9C,MAAM,OAAO,0BAA0B;IAE3B;IACA;IAFV,YACU,QAA0B,EAC1B,eAAkC;QADlC,aAAQ,GAAR,QAAQ,CAAkB;QAC1B,oBAAe,GAAf,eAAe,CAAmB;IACzC,CAAC;IAEJ,KAAK,CAAC,yBAAyB,CAC7B,UAA4B,EAC5B,UAAkC,EAAE;QAEpC,IAAI,UAAU,GAAG,kBAAkB,CAAC,UAAU,EAAE;YAC9C,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;SAC3C,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxE,MAAM,gBAAgB,GAAG,UAAU,CAAC,UAAU,CAA4C,CAAC;YAC3F,UAAU,GAAG;gBACX,GAAG,UAAU;gBACb,UAAU,EAAE,CAAC,GAAG,gBAAgB,EAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;aACjE,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAEpD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CACtC,WAAW,EACX,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EACtB,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CACzB,CAAC;QAEF,OAAO;YACL,GAAG,UAAU;YACb,KAAK;SACkB,CAAC;IAC5B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,wBAAwB,CAC5B,MASC,EACD,UAAkC,EAAE;QAEpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,MAAM,UAAU,GAAqB;YACnC,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,YAAY,MAAM,CAAC,EAAE,EAAE;YAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,EAAE;YACb,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,QAAQ;YACjC,SAAS,EAAE,GAAG;YACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC;QAEF,OAAO,IAAI,CAAC,yBAAyB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAEO,cAAc,CAAC,EAAuC;QAC5D,OAAO,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;IAChC,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAClC,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB,CACpC,QAA0B,EAC1B,eAAkC;IAElC,OAAO,IAAI,0BAA0B,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;AACnE,CAAC"}

package/dist/delegation/vc-verifier.d.ts

@@ -0,0 +1,112 @@
+/**
+ * Dylan Hobbs
+ * Delegation Credential Verifier (Platform-Agnostic)
+ *
+ * Progressive enhancement verification for W3C Delegation Credentials.
+ *
+ * Stage 1: Fast basic checks (no network, early rejection)
+ * Stage 2: Parallel advanced checks (signature, status)
+ * Stage 3: Combined results
+ *
+ * Related Spec: MCP-I §4.3, W3C VC Data Model 1.1
+ */
+import type { DelegationCredential, CredentialStatus } from "../types/protocol.js";
+export interface DelegationVCVerificationResult {
+    valid: boolean;
+    reason?: string;
+    stage: "basic" | "signature" | "status" | "complete";
+    cached?: boolean;
+    metrics?: {
+        basicCheckMs?: number;
+        signatureCheckMs?: number;
+        statusCheckMs?: number;
+        totalMs: number;
+    };
+    checks?: {
+        basicValid?: boolean;
+        signatureValid?: boolean;
+        statusValid?: boolean;
+    };
+}
+export interface VerifyDelegationVCOptions {
+    skipCache?: boolean;
+    skipSignature?: boolean;
+    skipStatus?: boolean;
+    didResolver?: DIDResolver;
+    statusListResolver?: StatusListResolver;
+}
+export interface DIDResolver {
+    resolve(did: string): Promise<DIDDocument | null>;
+}
+export interface DIDDocument {
+    id: string;
+    verificationMethod?: VerificationMethod[];
+    authentication?: (string | VerificationMethod)[];
+    assertionMethod?: (string | VerificationMethod)[];
+}
+export interface VerificationMethod {
+    id: string;
+    type: string;
+    controller: string;
+    publicKeyJwk?: unknown;
+    publicKeyBase58?: string;
+    publicKeyMultibase?: string;
+}
+export interface StatusListResolver {
+    checkStatus(status: CredentialStatus): Promise<boolean>;
+}
+export interface SignatureVerificationFunction {
+    (vc: DelegationCredential, publicKeyJwk: unknown): Promise<{
+        valid: boolean;
+        reason?: string;
+    }>;
+}
+export declare class DelegationCredentialVerifier {
+    private didResolver?;
+    private statusListResolver?;
+    private signatureVerifier?;
+    private cache;
+    private cacheInsertionOrder;
+    private cacheTtl;
+    /**
+     * Maximum number of entries in the verification cache.
+     * In production deployments, configure maxCacheSize based on expected concurrent delegations.
+     * Default of 1000 is suitable for most use cases.
+     */
+    private maxCacheSize;
+    constructor(options?: {
+        didResolver?: DIDResolver;
+        statusListResolver?: StatusListResolver;
+        signatureVerifier?: SignatureVerificationFunction;
+        cacheTtl?: number;
+        /** Maximum cache entries. Default: 1000 */
+        maxCacheSize?: number;
+    });
+    /**
+     * Verify a delegation credential through progressive enhancement.
+     *
+     * Stage 1: Fast basic checks (schema, expiry, status field)
+     * Stage 2: Parallel signature and status list checks (if resolvers configured)
+     * Stage 3: Combined result with timing metrics
+     *
+     * @param vc - The W3C Delegation Credential to verify
+     * @param options - Verification options (skip cache/signature/status, custom resolvers)
+     * @returns Verification result with validity, reason, stage reached, and metrics
+     */
+    verifyDelegationCredential(vc: DelegationCredential, options?: VerifyDelegationVCOptions): Promise<DelegationVCVerificationResult>;
+    private validateBasicProperties;
+    private verifySignature;
+    private checkCredentialStatus;
+    private findVerificationMethod;
+    private getFromCache;
+    private setInCache;
+    clearCache(): void;
+    clearCacheEntry(id: string): void;
+}
+export declare function createDelegationVerifier(options?: {
+    didResolver?: DIDResolver;
+    statusListResolver?: StatusListResolver;
+    signatureVerifier?: SignatureVerificationFunction;
+    cacheTtl?: number;
+}): DelegationCredentialVerifier;
+//# sourceMappingURL=vc-verifier.d.ts.map

package/dist/delegation/vc-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vc-verifier.d.ts","sourceRoot":"","sources":["../../src/delegation/vc-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,sBAAsB,CAAC;AAO9B,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,QAAQ,GAAG,UAAU,CAAC;IACrD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE;QACR,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,MAAM,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;CACH;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CACzC;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,kBAAkB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC1C,cAAc,CAAC,EAAE,CAAC,MAAM,GAAG,kBAAkB,CAAC,EAAE,CAAC;IACjD,eAAe,CAAC,EAAE,CAAC,MAAM,GAAG,kBAAkB,CAAC,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,6BAA6B;IAC5C,CACE,EAAE,EAAE,oBAAoB,EACxB,YAAY,EAAE,OAAO,GACpB,OAAO,CAAC;QACT,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;CACJ;AAED,qBAAa,4BAA4B;IACvC,OAAO,CAAC,WAAW,CAAC,CAAc;IAClC,OAAO,CAAC,kBAAkB,CAAC,CAAqB;IAChD,OAAO,CAAC,iBAAiB,CAAC,CAAgC;IAC1D,OAAO,CAAC,KAAK,CAGT;IACJ,OAAO,CAAC,mBAAmB,CAAgB;IAC3C,OAAO,CAAC,QAAQ,CAAS;IACzB;;;;OAIG;IACH,OAAO,CAAC,YAAY,CAAS;gBAEjB,OAAO,CAAC,EAAE;QACpB,WAAW,CAAC,EAAE,WAAW,CAAC;QAC1B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;QACxC,iBAAiB,CAAC,EAAE,6BAA6B,CAAC;QAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,2CAA2C;QAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB;IAQD;;;;;;;;;;OAUG;IACG,0BAA0B,CAC9B,EAAE,EAAE,oBAAoB,EACxB,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,8BAA8B,CAAC;IA6F1C,OAAO,CAAC,uBAAuB;YAuCjB,eAAe;YAkFf,qBAAqB;IAsCnC,OAAO,CAAC,sBAAsB;IAS9B,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,UAAU;IAgBlB,UAAU,IAAI,IAAI;IAKlB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;CAOlC;AAED,wBAAgB,wBAAwB,CAAC,OAAO,CAAC,EAAE;IACjD,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,iBAAiB,CAAC,EAAE,6BAA6B,CAAC;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,4BAA4B,CAE/B"}

package/dist/delegation/vc-verifier.js

@@ -0,0 +1,280 @@
+/**
+ * Dylan Hobbs
+ * Delegation Credential Verifier (Platform-Agnostic)
+ *
+ * Progressive enhancement verification for W3C Delegation Credentials.
+ *
+ * Stage 1: Fast basic checks (no network, early rejection)
+ * Stage 2: Parallel advanced checks (signature, status)
+ * Stage 3: Combined results
+ *
+ * Related Spec: MCP-I §4.3, W3C VC Data Model 1.1
+ */
+import { isDelegationCredentialExpired, isDelegationCredentialNotYetValid, validateDelegationCredential, } from "../types/protocol.js";
+export class DelegationCredentialVerifier {
+    didResolver;
+    statusListResolver;
+    signatureVerifier;
+    cache = new Map();
+    cacheInsertionOrder = [];
+    cacheTtl;
+    /**
+     * Maximum number of entries in the verification cache.
+     * In production deployments, configure maxCacheSize based on expected concurrent delegations.
+     * Default of 1000 is suitable for most use cases.
+     */
+    maxCacheSize;
+    constructor(options) {
+        this.didResolver = options?.didResolver;
+        this.statusListResolver = options?.statusListResolver;
+        this.signatureVerifier = options?.signatureVerifier;
+        this.cacheTtl = options?.cacheTtl || 60_000;
+        this.maxCacheSize = options?.maxCacheSize ?? 1000;
+    }
+    /**
+     * Verify a delegation credential through progressive enhancement.
+     *
+     * Stage 1: Fast basic checks (schema, expiry, status field)
+     * Stage 2: Parallel signature and status list checks (if resolvers configured)
+     * Stage 3: Combined result with timing metrics
+     *
+     * @param vc - The W3C Delegation Credential to verify
+     * @param options - Verification options (skip cache/signature/status, custom resolvers)
+     * @returns Verification result with validity, reason, stage reached, and metrics
+     */
+    async verifyDelegationCredential(vc, options = {}) {
+        const startTime = Date.now();
+        if (!options.skipCache) {
+            const cached = this.getFromCache(vc.id || "");
+            if (cached) {
+                return { ...cached, cached: true };
+            }
+        }
+        const basicCheckStart = Date.now();
+        const basicValidation = this.validateBasicProperties(vc);
+        const basicCheckMs = Date.now() - basicCheckStart;
+        if (!basicValidation.valid) {
+            const result = {
+                valid: false,
+                reason: basicValidation.reason,
+                stage: "basic",
+                metrics: {
+                    basicCheckMs,
+                    totalMs: Date.now() - startTime,
+                },
+                checks: {
+                    basicValid: false,
+                },
+            };
+            return result;
+        }
+        const signaturePromise = !options.skipSignature
+            ? this.verifySignature(vc, options.didResolver || this.didResolver)
+            : Promise.resolve({
+                valid: true,
+                durationMs: 0,
+            });
+        const statusPromise = !options.skipStatus && vc.credentialStatus
+            ? this.checkCredentialStatus(vc.credentialStatus, options.statusListResolver || this.statusListResolver)
+            : Promise.resolve({
+                valid: true,
+                durationMs: 0,
+            });
+        const [signatureResult, statusResult] = await Promise.all([
+            signaturePromise,
+            statusPromise,
+        ]);
+        const signatureCheckMs = signatureResult.durationMs || 0;
+        const statusCheckMs = statusResult.durationMs || 0;
+        const allValid = basicValidation.valid && signatureResult.valid && statusResult.valid;
+        const result = {
+            valid: allValid,
+            reason: !allValid
+                ? signatureResult.reason || statusResult.reason || "Unknown failure"
+                : undefined,
+            stage: "complete",
+            metrics: {
+                basicCheckMs,
+                signatureCheckMs,
+                statusCheckMs,
+                totalMs: Date.now() - startTime,
+            },
+            checks: {
+                basicValid: basicValidation.valid,
+                signatureValid: signatureResult.valid,
+                statusValid: statusResult.valid,
+            },
+        };
+        if (result.valid && vc.id) {
+            this.setInCache(vc.id, result);
+        }
+        return result;
+    }
+    validateBasicProperties(vc) {
+        const schemaValidation = validateDelegationCredential(vc);
+        if (!schemaValidation.success) {
+            return {
+                valid: false,
+                reason: `Schema validation failed: ${schemaValidation.error?.message}`,
+            };
+        }
+        if (isDelegationCredentialExpired(vc)) {
+            return { valid: false, reason: "Delegation credential expired" };
+        }
+        if (isDelegationCredentialNotYetValid(vc)) {
+            return { valid: false, reason: "Delegation credential not yet valid" };
+        }
+        const delegation = vc.credentialSubject.delegation;
+        if (delegation.status === "revoked") {
+            return { valid: false, reason: "Delegation status is revoked" };
+        }
+        if (delegation.status === "expired") {
+            return { valid: false, reason: "Delegation status is expired" };
+        }
+        if (!delegation.issuerDid || !delegation.subjectDid) {
+            return { valid: false, reason: "Missing issuer or subject DID" };
+        }
+        if (!vc.proof) {
+            return { valid: false, reason: "Missing proof" };
+        }
+        return { valid: true };
+    }
+    async verifySignature(vc, didResolver) {
+        const startTime = Date.now();
+        try {
+            const issuerDid = typeof vc.issuer === "string" ? vc.issuer : vc.issuer.id;
+            if (!didResolver || !this.signatureVerifier) {
+                return {
+                    valid: false,
+                    reason: "No DID resolver or signature verifier configured — signature cannot be verified",
+                    durationMs: Date.now() - startTime,
+                };
+            }
+            const didDoc = await didResolver.resolve(issuerDid);
+            if (!didDoc) {
+                return {
+                    valid: false,
+                    reason: `Could not resolve issuer DID: ${issuerDid}`,
+                    durationMs: Date.now() - startTime,
+                };
+            }
+            if (!vc.proof) {
+                return {
+                    valid: false,
+                    reason: "Proof is missing",
+                    durationMs: Date.now() - startTime,
+                };
+            }
+            const verificationMethodId = vc.proof["verificationMethod"];
+            if (!verificationMethodId) {
+                return {
+                    valid: false,
+                    reason: "Proof missing verificationMethod",
+                    durationMs: Date.now() - startTime,
+                };
+            }
+            const verificationMethod = this.findVerificationMethod(didDoc, verificationMethodId);
+            if (!verificationMethod) {
+                return {
+                    valid: false,
+                    reason: `Verification method ${verificationMethodId} not found`,
+                    durationMs: Date.now() - startTime,
+                };
+            }
+            const publicKeyJwk = verificationMethod.publicKeyJwk;
+            if (!publicKeyJwk) {
+                return {
+                    valid: false,
+                    reason: "Verification method missing publicKeyJwk",
+                    durationMs: Date.now() - startTime,
+                };
+            }
+            const verificationResult = await this.signatureVerifier(vc, publicKeyJwk);
+            return {
+                valid: verificationResult.valid,
+                reason: verificationResult.reason,
+                durationMs: Date.now() - startTime,
+            };
+        }
+        catch (error) {
+            return {
+                valid: false,
+                reason: `Signature verification error: ${error instanceof Error ? error.message : "Unknown error"}`,
+                durationMs: Date.now() - startTime,
+            };
+        }
+    }
+    async checkCredentialStatus(status, statusListResolver) {
+        const startTime = Date.now();
+        try {
+            if (!statusListResolver) {
+                return {
+                    valid: true,
+                    reason: "No status list resolver available, skipping status check",
+                    durationMs: Date.now() - startTime,
+                };
+            }
+            const isRevoked = await statusListResolver.checkStatus(status);
+            if (isRevoked) {
+                return {
+                    valid: false,
+                    reason: `Credential revoked via StatusList2021 (${status.statusPurpose})`,
+                    durationMs: Date.now() - startTime,
+                };
+            }
+            return {
+                valid: true,
+                durationMs: Date.now() - startTime,
+            };
+        }
+        catch (error) {
+            return {
+                valid: false,
+                reason: `Status check error: ${error instanceof Error ? error.message : "Unknown error"}`,
+                durationMs: Date.now() - startTime,
+            };
+        }
+    }
+    findVerificationMethod(didDoc, verificationMethodId) {
+        return didDoc.verificationMethod?.find((vm) => vm.id === verificationMethodId);
+    }
+    getFromCache(id) {
+        const entry = this.cache.get(id);
+        if (!entry)
+            return null;
+        if (Date.now() > entry.expiresAt) {
+            this.cache.delete(id);
+            return null;
+        }
+        return entry.result;
+    }
+    setInCache(id, result) {
+        // Evict oldest entry if cache exceeds maxCacheSize (simple FIFO)
+        while (this.cache.size >= this.maxCacheSize && this.cacheInsertionOrder.length > 0) {
+            const oldestId = this.cacheInsertionOrder.shift();
+            if (oldestId) {
+                this.cache.delete(oldestId);
+            }
+        }
+        this.cache.set(id, {
+            result,
+            expiresAt: Date.now() + this.cacheTtl,
+        });
+        this.cacheInsertionOrder.push(id);
+    }
+    clearCache() {
+        this.cache.clear();
+        this.cacheInsertionOrder = [];
+    }
+    clearCacheEntry(id) {
+        this.cache.delete(id);
+        const idx = this.cacheInsertionOrder.indexOf(id);
+        if (idx !== -1) {
+            this.cacheInsertionOrder.splice(idx, 1);
+        }
+    }
+}
+export function createDelegationVerifier(options) {
+    return new DelegationCredentialVerifier(options);
+}
+//# sourceMappingURL=vc-verifier.js.map

package/dist/delegation/vc-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vc-verifier.js","sourceRoot":"","sources":["../../src/delegation/vc-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,EACL,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AA8D9B,MAAM,OAAO,4BAA4B;IAC/B,WAAW,CAAe;IAC1B,kBAAkB,CAAsB;IACxC,iBAAiB,CAAiC;IAClD,KAAK,GAAG,IAAI,GAAG,EAGpB,CAAC;IACI,mBAAmB,GAAa,EAAE,CAAC;IACnC,QAAQ,CAAS;IACzB;;;;OAIG;IACK,YAAY,CAAS;IAE7B,YAAY,OAOX;QACC,IAAI,CAAC,WAAW,GAAG,OAAO,EAAE,WAAW,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,OAAO,EAAE,kBAAkB,CAAC;QACtD,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,CAAC;QACpD,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,MAAM,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,IAAI,CAAC;IACpD,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,0BAA0B,CAC9B,EAAwB,EACxB,UAAqC,EAAE;QAEvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACrC,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,eAAe,GAAG,IAAI,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;QACzD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;QAElD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAmC;gBAC7C,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,eAAe,CAAC,MAAM;gBAC9B,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE;oBACP,YAAY;oBACZ,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBAChC;gBACD,MAAM,EAAE;oBACN,UAAU,EAAE,KAAK;iBAClB;aACF,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,gBAAgB,GAAG,CAAC,OAAO,CAAC,aAAa;YAC7C,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC;YACnE,CAAC,CAAC,OAAO,CAAC,OAAO,CAIZ;gBACD,KAAK,EAAE,IAAI;gBACX,UAAU,EAAE,CAAC;aACd,CAAC,CAAC;QAEP,MAAM,aAAa,GACjB,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,gBAAgB;YACxC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CACxB,EAAE,CAAC,gBAAgB,EACnB,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC,kBAAkB,CACtD;YACH,CAAC,CAAC,OAAO,CAAC,OAAO,CAIZ;gBACD,KAAK,EAAE,IAAI;gBACX,UAAU,EAAE,CAAC;aACd,CAAC,CAAC;QAET,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxD,gBAAgB;YAChB,aAAa;SACd,CAAC,CAAC;QAEH,MAAM,gBAAgB,GAAG,eAAe,CAAC,UAAU,IAAI,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,YAAY,CAAC,UAAU,IAAI,CAAC,CAAC;QAEnD,MAAM,QAAQ,GACZ,eAAe,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC;QAEvE,MAAM,MAAM,GAAmC;YAC7C,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,CAAC,QAAQ;gBACf,CAAC,CAAC,eAAe,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,IAAI,iBAAiB;gBACpE,CAAC,CAAC,SAAS;YACb,KAAK,EAAE,UAAU;YACjB,OAAO,EAAE;gBACP,YAAY;gBACZ,gBAAgB;gBAChB,aAAa;gBACb,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aAChC;YACD,MAAM,EAAE;gBACN,UAAU,EAAE,eAAe,CAAC,KAAK;gBACjC,cAAc,EAAE,eAAe,CAAC,KAAK;gBACrC,WAAW,EAAE,YAAY,CAAC,KAAK;aAChC;SACF,CAAC;QAEF,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1B,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,uBAAuB,CAAC,EAAwB;QAItD,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,6BAA6B,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE;aACvE,CAAC;QACJ,CAAC;QAED,IAAI,6BAA6B,CAAC,EAAE,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;QACnE,CAAC;QAED,IAAI,iCAAiC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;QACzE,CAAC;QAED,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC;QACnD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QAClE,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QAClE,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;YACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YACd,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACnD,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,EAAwB,EACxB,WAAyB;QAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,SAAS,GACb,OAAO,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;YAE3D,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC5C,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EACJ,iFAAiF;oBACnF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,iCAAiC,SAAS,EAAE;oBACpD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBACd,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,kBAAkB;oBAC1B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GAAG,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAC5D,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC1B,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,kCAAkC;oBAC1C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,MAAM,kBAAkB,GAAG,IAAI,CAAC,sBAAsB,CACpD,MAAM,EACN,oBAA8B,CAC/B,CAAC;YACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,uBAAuB,oBAAoB,YAAY;oBAC/D,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,MAAM,YAAY,GAAG,kBAAkB,CAAC,YAAY,CAAC;YACrD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,0CAA0C;oBAClD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;YAE1E,OAAO;gBACL,KAAK,EAAE,kBAAkB,CAAC,KAAK;gBAC/B,MAAM,EAAE,kBAAkB,CAAC,MAAM;gBACjC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;gBACnG,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,MAAwB,EACxB,kBAAuC;QAEvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,0DAA0D;oBAClE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAE/D,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,0CAA0C,MAAM,CAAC,aAAa,GAAG;oBACzE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;gBACzF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,sBAAsB,CAC5B,MAAmB,EACnB,oBAA4B;QAE5B,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,CACpC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,oBAAoB,CACvC,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,EAAU;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IAEO,UAAU,CAAC,EAAU,EAAE,MAAsC;QACnE,iEAAiE;QACjE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnF,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAClD,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE;YACjB,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ;SACtC,CAAC,CAAC;QACH,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,UAAU;QACR,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,mBAAmB,GAAG,EAAE,CAAC;IAChC,CAAC;IAED,eAAe,CAAC,EAAU;QACxB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjD,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YACf,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,wBAAwB,CAAC,OAKxC;IACC,OAAO,IAAI,4BAA4B,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,45 @@
+/**
+ * @mcp-i/core — MCP-I Protocol Reference Implementation
+ *
+ * Delegation, proof, and session for Model Context Protocol Identity.
+ * This package is a DIF TAAWG protocol reference implementation.
+ *
+ * Related Spec: https://modelcontextprotocol-identity.io
+ *
+ * ## Error handling strategy
+ *
+ * - **Validation functions** (`verify*`, `validate*`) return result objects `{ valid, reason }` — never throw
+ * - **Construction/setup functions** throw `Error` on invalid configuration
+ * - **Resolution functions** (`resolve*`, `fetch*`) return `null` on failure — never throw
+ *
+ * This ensures callers can always handle failures without try/catch on validation paths.
+ */
+export type { DelegationConstraints, DelegationRecord, DelegationCredential, DelegationStatus, CredentialStatus, StatusList2021Credential, Proof, HandshakeRequest, SessionContext, NonceCache, MCPClientInfo, MCPClientSessionInfo, SessionIdentityState, DetachedProof, ProofMeta, CanonicalHashes, AuditRecord, AuditContext, AuditEventContext, NeedsAuthorizationError, AuthorizationDisplay, CrispBudget, CrispScope, } from './types/protocol.js';
+export { wrapDelegationAsVC, extractDelegationFromVC, isDelegationCredentialExpired, isDelegationCredentialNotYetValid, validateDelegationCredential, validateDetachedProof, createNeedsAuthorizationError, isNeedsAuthorizationError, DELEGATION_CREDENTIAL_CONTEXT, DEFAULT_SESSION_TTL_MINUTES, DEFAULT_TIMESTAMP_SKEW_SECONDS, NONCE_LENGTH_BYTES, } from './types/protocol.js';
+export { DelegationCredentialIssuer, createDelegationIssuer, type IssueDelegationOptions, type VCSigningFunction, type IdentityProvider as DelegationIdentityProvider, } from './delegation/vc-issuer.js';
+export { DelegationCredentialVerifier, createDelegationVerifier, type DelegationVCVerificationResult, type VerifyDelegationVCOptions, type DIDResolver, type DIDDocument, type VerificationMethod, type StatusListResolver, type SignatureVerificationFunction, } from './delegation/vc-verifier.js';
+export { DelegationGraphManager, createDelegationGraph, type DelegationNode, type DelegationGraphStorageProvider, } from './delegation/delegation-graph.js';
+export { StatusList2021Manager, createStatusListManager, type StatusListStorageProvider, type StatusListIdentityProvider, } from './delegation/statuslist-manager.js';
+export { CascadingRevocationManager, createCascadingRevocationManager, type RevocationEvent, type RevocationHook, type CascadingRevocationOptions, } from './delegation/cascading-revocation.js';
+export { BitstringManager, isIndexSet, type CompressionFunction, type DecompressionFunction, } from './delegation/bitstring.js';
+export { verifyDelegationAudience, } from './delegation/audience-validator.js';
+export { buildDelegationProofJWT, buildChainString, type DelegationProofOptions, type Ed25519PrivateJWK, } from './delegation/outbound-proof.js';
+export { buildOutboundDelegationHeaders, OUTBOUND_HEADER_NAMES, type OutboundDelegationContext, type OutboundDelegationHeaders, } from './delegation/outbound-headers.js';
+export { canonicalizeJSON, createUnsignedVCJWT, completeVCJWT, parseVCJWT, type VCJWTHeader, type VCJWTPayload, } from './delegation/utils.js';
+export { MemoryStatusListStorage } from './delegation/storage/memory-statuslist-storage.js';
+export { MemoryDelegationGraphStorage } from './delegation/storage/memory-graph-storage.js';
+export { createDidKeyResolver, resolveDidKeySync, isEd25519DidKey, extractPublicKeyFromDidKey, publicKeyToJwk, } from './delegation/did-key-resolver.js';
+export { DidWebResolver, createDidWebResolver, isDidWeb, parseDidWeb, didWebToUrl, } from './delegation/did-web-resolver.js';
+export { base58Encode, base58Decode, isValidBase58, } from './utils/base58.js';
+export { isValidDid, getDidMethod, normalizeDid, compareDids, getServerDid, extractAgentId, extractAgentSlug, generateDidKeyFromBytes, generateDidKeyFromBase64, } from './utils/did-helpers.js';
+export { verifyOrHints, hasSensitiveScopes, MemoryResumeTokenStore, type AuthHandshakeConfig, type VerifyOrHintsResult, type AgentReputation, type ResumeTokenStore, type DelegationVerifier, type VerifyDelegationResult, } from './auth/index.js';
+export { ProofGenerator, createProofResponse, extractCanonicalData, type ProofAgentIdentity, type ToolRequest, type ToolResponse, type ProofOptions, } from './proof/index.js';
+export { ProofVerifier, type ProofVerifierConfig, type ProofVerificationResult, } from './proof/verifier.js';
+export { ProofVerificationError, PROOF_VERIFICATION_ERROR_CODES, createProofVerificationError, type ProofVerificationErrorCode, } from './proof/errors.js';
+export { SessionManager, createHandshakeRequest, validateHandshakeFormat, type SessionConfig, type HandshakeResult, } from './session/index.js';
+export { CryptoProvider, ClockProvider, FetchProvider, StorageProvider, NonceCacheProvider, IdentityProvider, type AgentIdentity, } from './providers/base.js';
+export { MemoryStorageProvider, MemoryNonceCacheProvider, MemoryIdentityProvider, } from './providers/memory.js';
+export { createMCPIMiddleware, type MCPIConfig, type MCPIDelegationConfig, type MCPIIdentityConfig, type MCPIMiddleware, type MCPIToolDefinition, type MCPIToolHandler, type MCPIServer, } from './middleware/index.js';
+export { logger, createDefaultConsoleLogger, type Logger, type Level, } from './logging/index.js';
+export { ED25519_PKCS8_DER_HEADER, ED25519_SPKI_DER_HEADER_LENGTH, ED25519_KEY_SIZE, } from './utils/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,YAAY,EACV,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,EACL,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,SAAS,EACT,eAAe,EACf,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,uBAAuB,EACvB,oBAAoB,EACpB,WAAW,EACX,UAAU,GACX,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,IAAI,0BAA0B,GACpD,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,KAAK,8BAA8B,EACnC,KAAK,yBAAyB,EAC9B,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,GACnC,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,cAAc,EACnB,KAAK,8BAA8B,GACpC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,GAChC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,EAChC,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,0BAA0B,GAChC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,wBAAwB,GACzB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,GAC/B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAE5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAE5F,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,GACZ,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,GAC5B,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,YAAY,GAClB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,EAC5B,KAAK,0BAA0B,GAChC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,aAAa,EAClB,KAAK,eAAe,GACrB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,oBAAoB,EACpB,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,UAAU,GAChB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,MAAM,EACN,0BAA0B,EAC1B,KAAK,MAAM,EACX,KAAK,KAAK,GACX,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,kBAAkB,CAAC"}