@metalabel/dfos-client 0.29.0

package/dist/index.js

@@ -0,0 +1,766 @@
+import {
+  memoryStore
+} from "./chunk-63XCFYOE.js";
+
+// src/client.ts
+import {
+  CONTENT_ID_ANCHOR_RE,
+  verifyRevocation as verifyRevocation2
+} from "@metalabel/dfos-protocol/chain";
+import { verifyDFOSCredential } from "@metalabel/dfos-protocol/credentials";
+import { dagCborCanonicalEncode, decodeJwsUnsafe as decodeJwsUnsafe2 } from "@metalabel/dfos-protocol/crypto";
+import { createHttpPeerClient } from "@metalabel/dfos-web-relay/peer-client";
+
+// src/transport.ts
+var PAGE_LIMIT = 1e3;
+var MAX_PAGES = 1e4;
+var normalizeRelays = (relays) => {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const raw of relays) {
+    const url = raw.trim().replace(/\/+$/, "");
+    if (url.length === 0 || seen.has(url)) continue;
+    seen.add(url);
+    out.push(url);
+  }
+  return out;
+};
+var digestOps = (ops) => {
+  let h = 2166136261;
+  const joined = ops.map((o) => `${o.cid}	${o.jwsToken}`).join("\n");
+  for (let i = 0; i < joined.length; i++) {
+    h ^= joined.charCodeAt(i);
+    h = Math.imul(h, 16777619);
+  }
+  return (h >>> 0).toString(16).padStart(8, "0");
+};
+var drainRelay = async (fetchPage, url) => {
+  const out = [];
+  let cursor;
+  let restarted = false;
+  for (let page = 0; page < MAX_PAGES; page++) {
+    const params = cursor ? { after: cursor, limit: PAGE_LIMIT } : { limit: PAGE_LIMIT };
+    const res = await fetchPage(url, params);
+    if (res === "invalid-cursor") {
+      if (!cursor || restarted) return null;
+      out.length = 0;
+      cursor = void 0;
+      restarted = true;
+      continue;
+    }
+    if (res === null) return null;
+    out.push(...res.entries);
+    if (!res.next || res.entries.length === 0) break;
+    cursor = res.next;
+  }
+  return out;
+};
+var StaleAnswerError = class extends Error {
+};
+var fanOutLog = async (fetchPage, relays, quorum, verifyCandidate) => {
+  const responses = [];
+  const byDigest = /* @__PURE__ */ new Map();
+  const badDigests = /* @__PURE__ */ new Set();
+  let lastVerifyError;
+  for (const url of relays) {
+    let entries = null;
+    try {
+      entries = await drainRelay(fetchPage, url);
+    } catch {
+      entries = null;
+    }
+    if (entries === null) {
+      responses.push({ url, ok: false, digest: "" });
+      continue;
+    }
+    const digest = digestOps(entries);
+    responses.push({ url, ok: true, digest });
+    if (badDigests.has(digest)) continue;
+    const group = byDigest.get(digest) ?? { url, entries, count: 0 };
+    group.count += 1;
+    byDigest.set(digest, group);
+    if (group.count >= quorum) {
+      try {
+        const value = await verifyCandidate(group.entries);
+        return {
+          outcome: "verified",
+          value,
+          entries: group.entries,
+          provenance: { answeredBy: group.url, responses, agreed: true, fromCache: false }
+        };
+      } catch (err) {
+        if (!(err instanceof StaleAnswerError)) lastVerifyError = err;
+        badDigests.add(digest);
+      }
+    }
+  }
+  const remaining = [...byDigest.entries()].filter(([digest]) => !badDigests.has(digest)).sort((a, b) => b[1].count - a[1].count);
+  for (const [digest, group] of remaining) {
+    try {
+      const value = await verifyCandidate(group.entries);
+      return {
+        outcome: "verified",
+        value,
+        entries: group.entries,
+        provenance: { answeredBy: group.url, responses, agreed: false, fromCache: false }
+      };
+    } catch (err) {
+      if (!(err instanceof StaleAnswerError)) lastVerifyError = err;
+      badDigests.add(digest);
+    }
+  }
+  if (lastVerifyError !== void 0) {
+    const message = lastVerifyError instanceof Error ? lastVerifyError.message : "unknown error";
+    throw new Error(`all candidate logs failed verification: ${message}`);
+  }
+  return {
+    outcome: "unreachable",
+    entries: [],
+    provenance: { answeredBy: "", responses, agreed: false, fromCache: false }
+  };
+};
+var identityPager = (peerClient, did) => (url, params) => peerClient.getIdentityLog(url, did, params);
+var contentPager = (peerClient, contentId) => (url, params) => peerClient.getContentLog(url, contentId, params);
+var operationPager = (peerClient) => (url, params) => peerClient.getOperationLog(url, params);
+
+// src/index-query.ts
+var INDEX_BASE_PATH = "/index/v0";
+var setParam = (url, key, value) => {
+  if (value === void 0) return;
+  url.searchParams.set(key, String(value));
+};
+var fetchIndexPage = async (relays, fetchImpl, build, empty, throwOnDecline = false) => {
+  for (const url of relays) {
+    try {
+      const res = await fetchImpl(build(url).toString());
+      if (!res.ok) continue;
+      return await res.json();
+    } catch {
+      continue;
+    }
+  }
+  if (throwOnDecline) throw new Error("no index-capable relay served the requested route");
+  return empty;
+};
+var createIndexQueries = (relays, fetchImpl) => {
+  const relaysFor = (o) => normalizeRelays(o?.relays ?? relays);
+  const indexIdentities = (params, options) => fetchIndexPage(
+    relaysFor(options),
+    fetchImpl,
+    (base) => {
+      const url = new URL(`${INDEX_BASE_PATH}/identities`, base);
+      setParam(url, "did", params?.did);
+      setParam(url, "hasPublicProfile", params?.hasPublicProfile);
+      setParam(url, "nameContains", params?.nameContains);
+      setParam(url, "order", params?.order);
+      setParam(url, "after", params?.after);
+      setParam(url, "limit", params?.limit);
+      return url;
+    },
+    { identities: [], next: null }
+  );
+  const indexContent = (params, options) => fetchIndexPage(
+    relaysFor(options),
+    fetchImpl,
+    (base) => {
+      const url = new URL(`${INDEX_BASE_PATH}/content`, base);
+      setParam(url, "contentId", params?.contentId);
+      setParam(url, "creator", params?.creator);
+      setParam(url, "signer", params?.signer);
+      setParam(url, "docSchema", params?.docSchema);
+      setParam(url, "documentCID", params?.documentCID);
+      setParam(url, "publicRead", params?.publicRead);
+      setParam(url, "isDeleted", params?.isDeleted);
+      setParam(url, "titleContains", params?.titleContains);
+      setParam(url, "order", params?.order);
+      setParam(url, "after", params?.after);
+      setParam(url, "limit", params?.limit);
+      return url;
+    },
+    { content: [], next: null }
+  );
+  const indexCountersignatures = (witness, params, options) => fetchIndexPage(
+    relaysFor(options),
+    fetchImpl,
+    (base) => {
+      const url = new URL(`${INDEX_BASE_PATH}/countersignatures`, base);
+      setParam(url, "witness", witness);
+      setParam(url, "relation", params?.relation);
+      setParam(url, "order", params?.order);
+      setParam(url, "after", params?.after);
+      setParam(url, "limit", params?.limit);
+      return url;
+    },
+    { witness, countersignatures: [], next: null }
+  );
+  const indexCredentials = (params, options) => fetchIndexPage(
+    relaysFor(options),
+    fetchImpl,
+    (base) => {
+      const url = new URL(`${INDEX_BASE_PATH}/credentials`, base);
+      setParam(url, "issuer", params?.issuer);
+      setParam(url, "resource", params?.resource);
+      setParam(url, "action", params?.action);
+      setParam(url, "after", params?.after);
+      setParam(url, "limit", params?.limit);
+      return url;
+    },
+    { credentials: [], next: null },
+    // route is newer than the `index` capability flag: throw on all-declined so a
+    // relay that advertises index but predates /credentials makes the caller fall
+    // back to its local fold instead of rendering a false-empty.
+    true
+  );
+  const capabilities = async (options) => {
+    const merged = { index: false };
+    for (const url of relaysFor(options)) {
+      try {
+        const res = await fetchImpl(new URL("/.well-known/dfos-relay", url).toString());
+        if (!res.ok) continue;
+        const body = await res.json();
+        if (body.capabilities?.["index"] === true) merged.index = true;
+      } catch {
+        continue;
+      }
+    }
+    return merged;
+  };
+  return { indexIdentities, indexContent, indexCountersignatures, indexCredentials, capabilities };
+};
+
+// src/resolvers.ts
+import {
+  decodeMultikey,
+  verifyContentChain,
+  verifyContentExtensionFromTrustedState,
+  verifyIdentityChain,
+  verifyIdentityExtensionFromTrustedState
+} from "@metalabel/dfos-protocol/chain";
+import { decodeJwsUnsafe } from "@metalabel/dfos-protocol/crypto";
+var DID_PREFIX = "did:dfos";
+var opMeta = (jws) => {
+  const decoded = decodeJwsUnsafe(jws);
+  const cid = typeof decoded?.header.cid === "string" ? decoded.header.cid : "";
+  const createdAt = typeof decoded?.payload?.["createdAt"] === "string" ? (decoded?.payload)["createdAt"] : "";
+  return { cid, createdAt };
+};
+var allCurrentKeys = (state) => [
+  ...state.authKeys,
+  ...state.assertKeys,
+  ...state.controllerKeys
+];
+var mergeHistoricalIdentity = (state, log) => {
+  const maps = {
+    authKeys: new Map(state.authKeys.map((k) => [k.id, k])),
+    assertKeys: new Map(state.assertKeys.map((k) => [k.id, k])),
+    controllerKeys: new Map(state.controllerKeys.map((k) => [k.id, k]))
+  };
+  for (const jws of log) {
+    const decoded = decodeJwsUnsafe(jws);
+    if (!decoded) continue;
+    const payload = decoded.payload;
+    if (payload["type"] !== "create" && payload["type"] !== "update") continue;
+    for (const field of ["authKeys", "assertKeys", "controllerKeys"]) {
+      const keys = payload[field];
+      if (!Array.isArray(keys)) continue;
+      for (const k of keys) {
+        if (k && typeof k === "object" && "id" in k && "publicKeyMultibase" in k) {
+          const id = k.id;
+          if (!maps[field].has(id)) maps[field].set(id, k);
+        }
+      }
+    }
+  }
+  return {
+    ...state,
+    authKeys: [...maps.authKeys.values()],
+    assertKeys: [...maps.assertKeys.values()],
+    controllerKeys: [...maps.controllerKeys.values()]
+  };
+};
+var keyBytesFor = (state, log, keyId) => {
+  const current = allCurrentKeys(state).find((k) => k.id === keyId);
+  if (current) return decodeMultikey(current.publicKeyMultibase).keyBytes;
+  for (const jws of log) {
+    const decoded = decodeJwsUnsafe(jws);
+    if (!decoded) continue;
+    const payload = decoded.payload;
+    if (payload["type"] !== "create" && payload["type"] !== "update") continue;
+    for (const field of ["authKeys", "assertKeys", "controllerKeys"]) {
+      const keys = payload[field];
+      if (!Array.isArray(keys)) continue;
+      for (const k of keys) {
+        if (k && typeof k === "object" && "id" in k && k.id === keyId && "publicKeyMultibase" in k) {
+          return decodeMultikey(k.publicKeyMultibase).keyBytes;
+        }
+      }
+    }
+  }
+  return null;
+};
+var createResolvers = (deps) => {
+  const relaysFor = (o) => normalizeRelays(o?.relays ?? deps.relays);
+  const getIdentityChain = async (did, options) => {
+    const key = `identity:${did}`;
+    const cached = options?.fresh ? void 0 : await deps.store.get(key);
+    const verifyCandidate = async (entries) => {
+      if (!cached) {
+        const log2 = entries.map((e) => e.jwsToken);
+        if (log2.length === 0) throw new Error(`identity not found: ${did}`);
+        const state2 = await verifyIdentityChain({ didPrefix: DID_PREFIX, log: log2 });
+        if (state2.did !== did) {
+          throw new Error(`relay served a mismatched identity: asked ${did}, got ${state2.did}`);
+        }
+        const last = opMeta(log2[log2.length - 1]);
+        return { state: state2, log: log2, headCID: last.cid, lastCreatedAt: last.createdAt };
+      }
+      if (cached.log.some((jws, index) => index < entries.length && entries[index].jwsToken !== jws)) {
+        throw new Error(`identity log diverges from the verified cached prefix: ${did}`);
+      }
+      if (entries.length < cached.log.length) {
+        throw new StaleAnswerError(`identity log is behind the verified cached prefix: ${did}`);
+      }
+      let state = cached.state;
+      let headCID = cached.headCID;
+      let lastCreatedAt = cached.lastCreatedAt;
+      const log = [...cached.log];
+      for (const entry of entries.slice(cached.log.length)) {
+        const r = await verifyIdentityExtensionFromTrustedState({
+          currentState: state,
+          headCID,
+          lastCreatedAt,
+          newOp: entry.jwsToken
+        });
+        state = r.state;
+        headCID = r.operationCID;
+        lastCreatedAt = r.createdAt;
+        log.push(entry.jwsToken);
+      }
+      return { state, log, headCID, lastCreatedAt };
+    };
+    const fetched = await fanOutLog(
+      identityPager(deps.peerClient, did),
+      relaysFor(options),
+      deps.quorum,
+      verifyCandidate
+    );
+    if (fetched.outcome === "unreachable") {
+      if (cached) {
+        return {
+          state: cached.state,
+          log: cached.log,
+          provenance: { ...fetched.provenance, fromCache: true },
+          tipUnverified: true
+        };
+      }
+      throw new Error(`identity not found on any relay: ${did}`);
+    }
+    const candidate = fetched.value;
+    if (fetched.provenance.agreed && (!cached || candidate.log.length > cached.log.length)) {
+      await deps.store.set(key, {
+        log: candidate.log,
+        state: candidate.state,
+        headCID: candidate.headCID,
+        lastCreatedAt: candidate.lastCreatedAt
+      });
+    }
+    return {
+      state: candidate.state,
+      log: candidate.log,
+      provenance: fetched.provenance,
+      // an unchanged full answer is still a relay CLAIM of freshness, not proof
+      tipUnverified: cached !== void 0 && candidate.log.length === cached.log.length
+    };
+  };
+  const resolveIdentity = async (did) => {
+    try {
+      const { state, log } = await getIdentityChain(did);
+      return mergeHistoricalIdentity(state, log);
+    } catch {
+      return void 0;
+    }
+  };
+  const resolveKey = async (kid) => {
+    const hashIdx = kid.indexOf("#");
+    if (hashIdx < 0) throw new Error(`kid must be a DID URL: ${kid}`);
+    const did = kid.substring(0, hashIdx);
+    const keyId = kid.substring(hashIdx + 1);
+    const { state, log } = await getIdentityChain(did);
+    const bytes = keyBytesFor(state, log, keyId);
+    if (!bytes) throw new Error(`unknown key ${keyId} on identity ${did}`);
+    return bytes;
+  };
+  const callbacks = () => ({
+    resolveKey,
+    resolveIdentity,
+    isRevoked: deps.isRevoked
+  });
+  const getContentChain = async (contentId, options) => {
+    const key = `content:${contentId}`;
+    const cached = options?.fresh ? void 0 : await deps.store.get(key);
+    const verifyCandidate = async (entries) => {
+      if (!cached) {
+        const log2 = entries.map((e) => e.jwsToken);
+        if (log2.length === 0) throw new Error(`content not found: ${contentId}`);
+        const state2 = await verifyContentChain({
+          log: log2,
+          resolveKey,
+          enforceAuthorization: true,
+          resolveIdentity,
+          isRevoked: deps.isRevoked
+        });
+        if (state2.contentId !== contentId) {
+          throw new Error(
+            `relay served a mismatched content chain: asked ${contentId}, got ${state2.contentId}`
+          );
+        }
+        const last = opMeta(log2[log2.length - 1]);
+        return { state: state2, log: log2, headCID: last.cid, lastCreatedAt: last.createdAt };
+      }
+      if (cached.log.some((jws, index) => index < entries.length && entries[index].jwsToken !== jws)) {
+        throw new Error(`content log diverges from the verified cached prefix: ${contentId}`);
+      }
+      if (entries.length < cached.log.length) {
+        throw new StaleAnswerError(
+          `content log is behind the verified cached prefix: ${contentId}`
+        );
+      }
+      let state = cached.state;
+      let lastCreatedAt = cached.lastCreatedAt;
+      const log = [...cached.log];
+      for (const entry of entries.slice(cached.log.length)) {
+        const r = await verifyContentExtensionFromTrustedState({
+          currentState: state,
+          lastCreatedAt,
+          newOp: entry.jwsToken,
+          resolveKey,
+          enforceAuthorization: true,
+          resolveIdentity,
+          isRevoked: deps.isRevoked
+        });
+        state = r.state;
+        lastCreatedAt = r.createdAt;
+        log.push(entry.jwsToken);
+      }
+      return { state, log, headCID: state.headCID, lastCreatedAt };
+    };
+    const fetched = await fanOutLog(
+      contentPager(deps.peerClient, contentId),
+      relaysFor(options),
+      deps.quorum,
+      verifyCandidate
+    );
+    if (fetched.outcome === "unreachable") {
+      if (cached) {
+        return {
+          state: cached.state,
+          log: cached.log,
+          provenance: { ...fetched.provenance, fromCache: true },
+          tipUnverified: true
+        };
+      }
+      throw new Error(`content not found on any relay: ${contentId}`);
+    }
+    const candidate = fetched.value;
+    if (fetched.provenance.agreed && (!cached || candidate.log.length > cached.log.length)) {
+      await deps.store.set(key, {
+        log: candidate.log,
+        state: candidate.state,
+        headCID: candidate.headCID,
+        lastCreatedAt: candidate.lastCreatedAt
+      });
+    }
+    return {
+      state: candidate.state,
+      log: candidate.log,
+      provenance: fetched.provenance,
+      tipUnverified: cached !== void 0 && candidate.log.length === cached.log.length
+    };
+  };
+  return { getIdentityChain, getContentChain, callbacks };
+};
+
+// src/revocation.ts
+import { parseProtocolTimestampUnix, verifyRevocation } from "@metalabel/dfos-protocol/chain";
+import { REVOCATIONS_BASE_PATH } from "@metalabel/dfos-web-relay/peer-client";
+var createRevocationChecker = (relays, fetchImpl, resolveKey) => {
+  const relaySet = normalizeRelays(relays);
+  return async (issuerDID, credentialCID, asOfUnix) => {
+    for (const url of relaySet) {
+      let body = null;
+      try {
+        const target = new URL(
+          `${REVOCATIONS_BASE_PATH}/credential/${encodeURIComponent(credentialCID)}`,
+          url
+        ).toString();
+        const res = await fetchImpl(target);
+        if (res.status === 501) continue;
+        if (!res.ok) continue;
+        body = await res.json();
+      } catch {
+        continue;
+      }
+      if (!body?.revoked || !body.revocation) continue;
+      try {
+        const verified = await verifyRevocation({ jwsToken: body.revocation, resolveKey });
+        if (verified.did === issuerDID && verified.credentialCID === credentialCID) {
+          if (asOfUnix === void 0 || asOfUnix <= 0) return true;
+          const revokedAtUnix = parseProtocolTimestampUnix(verified.createdAt);
+          if (revokedAtUnix === null || revokedAtUnix <= asOfUnix) return true;
+          continue;
+        }
+      } catch {
+      }
+    }
+    return false;
+  };
+};
+
+// src/client.ts
+var DEFAULT_TIMEOUT_MS = 1e4;
+var RETRY_BACKOFF_MS = 250;
+var isAbortError = (err) => err instanceof Error && (err.name === "AbortError" || err.name === "TimeoutError");
+var delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var withFetchPolicy = (base, timeoutMs) => {
+  const attempt = (input, init) => {
+    const timeoutSignal = AbortSignal.timeout(timeoutMs);
+    const signal = init?.signal ? AbortSignal.any([init.signal, timeoutSignal]) : timeoutSignal;
+    return base(input, { ...init, signal });
+  };
+  return async (input, init) => {
+    try {
+      const res = await attempt(input, init);
+      if (res.status >= 500 && res.status !== 501) {
+        await delay(RETRY_BACKOFF_MS);
+        return await attempt(input, init);
+      }
+      return res;
+    } catch (err) {
+      if (isAbortError(err)) throw err;
+      await delay(RETRY_BACKOFF_MS);
+      return attempt(input, init);
+    }
+  };
+};
+var trust = (ok, axes) => axes.length > 0 ? { ok, unverifiable: axes } : { ok };
+var hasDelegatedOps = (log) => log.some((jws) => {
+  const decoded = decodeJwsUnsafe2(jws);
+  return typeof decoded?.payload?.["authorization"] === "string";
+});
+var opMeta2 = (jws) => {
+  const decoded = decodeJwsUnsafe2(jws);
+  return { cid: typeof decoded?.header.cid === "string" ? decoded.header.cid : "", jwsToken: jws };
+};
+var createClient = (config) => {
+  const relays = normalizeRelays(config.relays);
+  if (relays.length === 0) throw new Error("createClient requires at least one relay");
+  const quorum = config.quorum ?? 1;
+  const store = config.store ?? memoryStore();
+  const timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const baseFetch = config.fetch ?? ((input, init) => globalThis.fetch(input, init));
+  const fetchImpl = withFetchPolicy(baseFetch, timeoutMs);
+  const nowMs = config.now ?? Date.now;
+  const peerClient = config.peerClient ?? createHttpPeerClient({ fetch: fetchImpl });
+  let isRevokedImpl = async () => false;
+  const isRevoked = (issuerDID, credentialCID, asOfUnix) => isRevokedImpl(issuerDID, credentialCID, asOfUnix);
+  const resolvers2 = createResolvers({ relays, quorum, store, peerClient, isRevoked });
+  isRevokedImpl = config.isRevoked ?? createRevocationChecker(relays, fetchImpl, (kid) => resolvers2.callbacks().resolveKey(kid));
+  const relaysFor = (o) => normalizeRelays(o?.relays ?? relays);
+  const identity = async (did, options) => {
+    const { state, provenance, tipUnverified } = await resolvers2.getIdentityChain(did, options);
+    const axes = tipUnverified ? ["tip"] : [];
+    return { value: state, trust: trust(true, axes), provenance };
+  };
+  const content = async (contentId, options) => {
+    const { state, log: log2, provenance, tipUnverified } = await resolvers2.getContentChain(
+      contentId,
+      options
+    );
+    const creator = await resolvers2.getIdentityChain(state.creatorDID, options);
+    const axes = [];
+    if (tipUnverified) axes.push("tip");
+    if (hasDelegatedOps(log2)) axes.push("revocation");
+    const value = { chain: state, creator: creator.state };
+    return { value, trust: trust(true, axes), provenance };
+  };
+  const credential = async (jws, options) => {
+    const decoded = decodeJwsUnsafe2(jws);
+    const iss = decoded?.payload?.["iss"];
+    if (typeof iss !== "string") throw new Error("credential payload missing iss");
+    const issuer = await resolvers2.getIdentityChain(iss, options);
+    const verified = await verifyDFOSCredential(jws, {
+      resolveIdentity: resolvers2.callbacks().resolveIdentity,
+      now: Math.floor(nowMs() / 1e3)
+    });
+    const revoked = await isRevoked(verified.iss, verified.credentialCID);
+    const axes = [];
+    if (issuer.tipUnverified) axes.push("tip");
+    if (!revoked) axes.push("revocation");
+    const value = { credential: verified, issuer: issuer.state, revoked };
+    return { value, trust: trust(!revoked, axes), provenance: issuer.provenance };
+  };
+  const document = async (contentId, options) => {
+    const { state, provenance, tipUnverified } = await resolvers2.getContentChain(
+      contentId,
+      options
+    );
+    const documentCID = state.currentDocumentCID;
+    if (!documentCID) throw new Error(`content ${contentId} has no current document`);
+    const blob = await fetchBlob(contentId, relaysFor(options), fetchImpl);
+    if (!blob) throw new Error(`no relay served the blob for ${contentId}`);
+    let decodedDoc;
+    let integrity = false;
+    try {
+      decodedDoc = JSON.parse(new TextDecoder().decode(blob.bytes));
+      const encoded = await dagCborCanonicalEncode(decodedDoc);
+      integrity = encoded.cid.toString() === documentCID;
+    } catch {
+      integrity = false;
+    }
+    const value = {
+      bytes: blob.bytes,
+      documentCID,
+      integrity,
+      ...blob.mediaType ? { mediaType: blob.mediaType } : {},
+      ...decodedDoc !== void 0 ? { decoded: decodedDoc } : {}
+    };
+    const axes = tipUnverified ? ["tip"] : [];
+    return { value, trust: trust(integrity, axes), provenance };
+  };
+  const verify = async (jws) => {
+    try {
+      const decoded = decodeJwsUnsafe2(jws);
+      if (!decoded) return { ok: false, error: "failed to decode JWS" };
+      const typ = decoded.header.typ;
+      const cb = resolvers2.callbacks();
+      if (typ === "did:dfos:credential") {
+        const verified = await verifyDFOSCredential(jws, {
+          resolveIdentity: cb.resolveIdentity,
+          now: Math.floor(nowMs() / 1e3)
+        });
+        const revoked = await isRevoked(verified.iss, verified.credentialCID);
+        if (revoked) return { ok: false, error: "credential revoked", value: verified };
+        return { ok: true, value: verified, unverifiable: ["revocation"] };
+      }
+      if (typ === "did:dfos:revocation") {
+        const verified = await verifyRevocation2({ jwsToken: jws, resolveKey: cb.resolveKey });
+        return { ok: true, value: verified };
+      }
+      return { ok: false, error: `unsupported token type for standalone verify: ${typ}` };
+    } catch (err) {
+      return { ok: false, error: err instanceof Error ? err.message : "verification failed" };
+    }
+  };
+  const resolve = async (ref, options) => {
+    const trimmed = ref.trim();
+    if (trimmed.startsWith("did:dfos:") && !trimmed.includes(".")) {
+      const r = await identity(trimmed, options);
+      return { kind: "identity", ...r };
+    }
+    if (CONTENT_ID_ANCHOR_RE.test(trimmed)) {
+      const r = await content(trimmed, options);
+      return { kind: "content", ...r };
+    }
+    if (trimmed.split(".").length === 3) {
+      const decoded = decodeJwsUnsafe2(trimmed);
+      const typ = decoded?.header.typ;
+      if (typ === "did:dfos:credential") {
+        const r = await credential(trimmed, options);
+        return { kind: "credential", ...r };
+      }
+      throw new Error(`unsupported JWS type for resolve: ${typ}`);
+    }
+    throw new Error(`unrecognized reference: ${ref}`);
+  };
+  const log = async (kind, id, options) => {
+    const res = kind === "identity" ? await resolvers2.getIdentityChain(id, options) : await resolvers2.getContentChain(id, options);
+    const value = res.log.map(opMeta2);
+    const axes = res.tipUnverified ? ["tip"] : [];
+    return { value, trust: trust(true, axes), provenance: res.provenance };
+  };
+  const globalLog = async (after, options) => {
+    const pager = operationPager(peerClient);
+    const limit = Math.max(1, Math.min(1e3, Math.floor(options?.limit ?? 100)));
+    for (const url of relaysFor(options)) {
+      let page = null;
+      try {
+        page = await pager(url, after ? { after, limit } : { limit });
+      } catch {
+        page = null;
+      }
+      if (page === "invalid-cursor") {
+        return "invalid-cursor";
+      }
+      if (page === null) continue;
+      const provenance = {
+        answeredBy: url,
+        responses: [{ url, ok: true, digest: "" }],
+        agreed: true,
+        fromCache: false
+      };
+      return { entries: page.entries, next: page.next, provenance };
+    }
+    return {
+      entries: [],
+      next: null,
+      provenance: { answeredBy: "", responses: [], agreed: false, fromCache: false }
+    };
+  };
+  const health = async (options) => {
+    const out = [];
+    for (const url of relaysFor(options)) {
+      try {
+        const res = await fetchImpl(new URL("/.well-known/dfos-relay", url).toString());
+        if (!res.ok) {
+          out.push({ url, ok: false });
+          continue;
+        }
+        const body = await res.json();
+        out.push({ url, ok: true, ...body });
+      } catch {
+        out.push({ url, ok: false });
+      }
+    }
+    return out;
+  };
+  const callbacks = () => resolvers2.callbacks();
+  const { indexIdentities, indexContent, indexCountersignatures, indexCredentials, capabilities } = createIndexQueries(relays, fetchImpl);
+  return {
+    callbacks,
+    resolve,
+    identity,
+    content,
+    credential,
+    document,
+    verify,
+    log,
+    globalLog,
+    health,
+    capabilities,
+    indexIdentities,
+    indexContent,
+    indexCountersignatures,
+    indexCredentials
+  };
+};
+var fetchBlob = async (contentId, relays, fetchImpl) => {
+  for (const url of relays) {
+    try {
+      const target = new URL(`/content/${encodeURIComponent(contentId)}/blob`, url).toString();
+      const res = await fetchImpl(target);
+      if (!res.ok) continue;
+      const bytes = new Uint8Array(await res.arrayBuffer());
+      return { bytes, mediaType: res.headers.get("content-type") };
+    } catch {
+      continue;
+    }
+  }
+  return null;
+};
+var resolvers = (relays) => createClient({ relays }).callbacks();
+export {
+  createClient,
+  createRevocationChecker,
+  memoryStore,
+  resolvers
+};