@metalabel/dfos-client 0.51.0 → 0.52.0

package/dist/api-auth.d.ts

@@ -1,5 +1,5 @@
 export { ApiRequestVerifyError, DEFAULT_PROOF_SKEW_SECONDS, DEFAULT_PROOF_WINDOW_SECONDS, DFOS_AUTH_SCHEME, EMPTY_BODY_SHA256, IDENTITY_PROOF_JWS_TYP, IdentityProofPayload, MAX_BODY_BYTES, MAX_PROOF_FRESHNESS_SPAN_SECONDS, MAX_REQUEST_PROOF_SIZE, ProofExtraMembers, REQUEST_PROOF_JWS_TYP, RequestProofFailurePhase, RequestProofFailureReason, RequestProofPayload, SignApiIdentityRequestInput, SignApiRequestInput, apiIdentitySigningInput, apiRequestSigningInput, assertProofVerifierConfig, buildApiAuthHeaders, buildApiIdentityHeaders, parseDfosAuthorization, sha256BodyHash, signApiIdentityRequest, signApiRequest } from '@metalabel/dfos-protocol/credentials';
-import { a as Client } from './types-CSKl-wYe.js';
+import { a as Client } from './types-BbIEz7BN.js';
 import '@metalabel/dfos-protocol/chain';
 import '@metalabel/dfos-web-relay/peer-client';
 
@@ -36,7 +36,7 @@ interface CreateApiAuthFetchOptions {
  *
  * `signApiRequest` stays exported for the backends that must NOT proxy. A
  * signing backend fronting a browser MUST authorize the coordinates it is about
- * to sign against its own session (API-AUTH.md, Security Considerations) — it
+ * to sign against its own session (INTEGRATIONS.md, API security notes) — it
  * describes the one request it is willing to make rather than receiving one, so
  * there is no `Request` for this adapter to cover.
  *
@@ -118,7 +118,8 @@ interface VerifiedRequestProof {
     credentialCID: string;
 }
 /**
- * Verify a credential-gated request — API-AUTH.md's eleven steps, in an order
+ * Verify a credential-gated request — INTEGRATIONS.md, Verification algorithm's
+ * eleven steps, in an order
  * that honors both load-bearing ordering rules: the proof signature gates every
  * credential-chain step, and body hashing runs after the cheaper binding checks.
  *
@@ -132,24 +133,10 @@ interface VerifiedRequestProof {
  * message text. `status` is the recommended HTTP code (401 proof-invalid, 403
  * credential-invalid, 503 unverifiable, 500 config).
  *
- * REVOCATION AND RESOLUTION AVAILABILITY — read before deploying. This helper
- * rejects a credential it KNOWS is revoked (`isRevoked` true at any chain level).
- * It does NOT, with the default client, fail closed when the revocation source is
- * unreachable: the stock `createRevocationChecker` is fail-open by design
- * ("no revocation found" and "could not reach any relay" both return false), the
- * system-wide v1 stance that "non-revocation is never provable." Likewise a
- * credential-issuer that is unresolvable because relays are down surfaces from the
- * protocol verifier as a `CredentialVerificationError` and is reported here as
- * `invalid` (403), not `unverifiable` (503) — the underlying callback cannot
- * distinguish "genuinely absent" from "transiently unreachable." The PRESENTER
- * side is availability-aware (a resolution failure or unverified/stale tip is
- * `unverifiable`, failing closed unless `allowStale`); the CREDENTIAL side inherits
- * the v1 primitives' limitation. A deployment that needs fail-closed-on-outage for
- * the credential/revocation phase MUST inject an availability-aware `isRevoked`
- * (one that THROWS when it reaches zero sources — the throw is surfaced here as
- * `unverifiable`) via the client config. Tightening the default is a client-level
- * change to the shared revocation/resolution contract (it governs SIWD and relay
- * verification too), tracked outside this kit.
+ * Missing issuer dependencies and an unavailable revocation source are
+ * unverifiable (503). The default checker throws when no relay answers; an
+ * answered negative still cannot prove non-revocation. Custom checkers must
+ * likewise throw when status cannot be obtained.
  */
 declare const verifyApiRequest: (client: Client, input: VerifyApiRequestInput) => Promise<VerifiedRequestProof>;
 interface VerifyApiIdentityRequestInput {
@@ -212,7 +199,8 @@ interface VerifiedIdentityProof {
     rawPayload: Record<string, unknown>;
 }
 /**
- * Verify an identity-proven request — API-AUTH.md's PROOF PHASE (steps 1–7) with
+ * Verify an identity-proven request — INTEGRATIONS.md, Verification algorithm's
+ * PROOF PHASE (steps 1–7) with
  * the identity `typ`, and nothing more. Steps 8–11 do not exist for this
  * artifact: there is no credential to walk, so there is no chain, no revocation
  * lookup, and no attenuation coverage.

package/dist/api-auth.js

@@ -1,4 +1,5 @@
 // src/api-auth.ts
+import { isDependencyMissing } from "@metalabel/dfos-protocol";
 import {
   apiIdentitySigningInput,
   apiRequestSigningInput,
@@ -145,6 +146,9 @@ var verifyApiRequest = async (client, input) => {
     chain = verifiedChain.chain;
   } catch (err) {
     if (err instanceof ApiRequestVerifyError) throw err;
+    if (isDependencyMissing(err)) {
+      throw unverifiableCredential(err instanceof Error ? err.message : String(err));
+    }
     if (err instanceof CredentialVerificationError) throw invalidCredential(err.message);
     throw unverifiableCredential(
       `credential verification could not complete: ${err instanceof Error ? err.message : String(err)}`

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-import { C as ClientConfig, a as Client, b as Callbacks, R as RevChecker } from './types-CSKl-wYe.js';
-export { c as CallOptions, D as DocumentBlob, G as GlobalLogOptions, d as GlobalLogPage, e as GlobalLogResult, I as IndexCapabilities, f as IndexContentPage, g as IndexContentRow, h as IndexCountersignatureRow, i as IndexCountersignaturesPage, j as IndexCredentialRow, k as IndexCredentialsPage, l as IndexIdentitiesPage, m as IndexIdentityProfile, n as IndexIdentityRow, o as IndexOrder, p as IndexRecencyOrder, L as LogOp, P as Provenance, q as RelayHealth, r as RelayResponse, s as Resolution, t as Resolved, u as ResolvedContent, v as ResolvedCredential, S as Store, T as Trust, U as UnverifiableAxis, V as VerifyResult } from './types-CSKl-wYe.js';
-export { m as memoryStore } from './memory-Ca1F2EBW.js';
+import { C as ClientConfig, a as Client, b as Callbacks, R as RevChecker } from './types-BbIEz7BN.js';
+export { c as CallOptions, D as DocumentBlob, E as EffectiveIdentity, d as EverProvedIdentity, G as GlobalLogOptions, e as GlobalLogPage, f as GlobalLogResult, I as IndexCapabilities, g as IndexContentPage, h as IndexContentRow, i as IndexCountersignatureRow, j as IndexCountersignaturesPage, k as IndexCredentialRow, l as IndexCredentialsPage, m as IndexIdentitiesPage, n as IndexIdentityProfile, o as IndexIdentityRow, p as IndexOrder, q as IndexRecencyOrder, L as LogOp, P as Provenance, r as RelayHealth, s as RelayResponse, t as Resolution, u as Resolved, v as ResolvedContent, w as ResolvedCredential, S as Store, T as Trust, U as UnverifiableAxis, V as VerifyResult } from './types-BbIEz7BN.js';
+export { m as memoryStore } from './memory-B5WMnEUQ.js';
 import '@metalabel/dfos-protocol/chain';
 import '@metalabel/dfos-protocol/credentials';
 import '@metalabel/dfos-web-relay/peer-client';
@@ -64,7 +64,8 @@ declare const divergenceErrorFrom: (err: unknown) => DivergenceError | undefined
  * (`verifyRevocation`: signature, CID integrity, issuer-only rule) and whose
  * payload binds exactly the queried (issuerDID, credentialCID). Anything less —
  * unreachable relay, negative answer, forged or mismatched proof — moves on to
- * the next relay; false only after the full set has been consulted.
+ * the next relay; false only after the full set has been consulted and at least
+ * one relay answered with a parseable status body. Zero answers throws.
  *
  * When the caller supplies `asOfUnix` (the protocol does, on every cold fold, with
  * each operation's own `createdAt`), a verified revocation only counts if its own

package/dist/index.js

@@ -279,6 +279,7 @@ var opMeta = (jws) => {
 };
 var historicalIdentity = (state) => ({
   ...state,
+  resolution: "ever-proved",
   ...state.provedKeys ?? {
     authKeys: state.authKeys,
     assertKeys: state.assertKeys,
@@ -510,6 +511,7 @@ import { REVOCATIONS_BASE_PATH } from "@metalabel/dfos-web-relay/peer-client";
 var createRevocationChecker = (relays, fetchImpl, resolveKey) => {
   const relaySet = normalizeRelays(relays);
   return async (issuerDID, credentialCID, asOfUnix) => {
+    let answered = false;
     for (const url of relaySet) {
       let body = null;
       try {
@@ -521,6 +523,10 @@ var createRevocationChecker = (relays, fetchImpl, resolveKey) => {
         if (res.status === 501) continue;
         if (!res.ok) continue;
         body = await res.json();
+        if (body === null || typeof body !== "object" || typeof body.revoked !== "boolean") {
+          continue;
+        }
+        answered = true;
       } catch {
         continue;
       }
@@ -536,6 +542,7 @@ var createRevocationChecker = (relays, fetchImpl, resolveKey) => {
       } catch {
       }
     }
+    if (!answered) throw new Error("revocation status unavailable: no relay answered");
     return false;
   };
 };
@@ -620,7 +627,11 @@ var createClient = (config) => {
       resolveIdentity: resolvers2.callbacks().resolveIdentity,
       nowUnix: Math.floor(nowMs() / 1e3)
     });
-    const revoked = await isRevoked(verified.iss, verified.credentialCID);
+    let revoked = false;
+    try {
+      revoked = await isRevoked(verified.iss, verified.credentialCID);
+    } catch {
+    }
     const axes = [];
     if (issuer.tipUnverified) axes.push("tip");
     if (!revoked) axes.push("revocation");
@@ -666,7 +677,11 @@ var createClient = (config) => {
           resolveIdentity: cb.resolveIdentity,
           nowUnix: Math.floor(nowMs() / 1e3)
         });
-        const revoked = await isRevoked(verified.iss, verified.credentialCID);
+        let revoked = false;
+        try {
+          revoked = await isRevoked(verified.iss, verified.credentialCID);
+        } catch {
+        }
         if (revoked) return { ok: false, error: "credential revoked", value: verified };
         return { ok: true, value: verified, unverifiable: ["revocation"] };
       }

package/dist/{memory-Ca1F2EBW.d.ts → memory-B5WMnEUQ.d.ts}

@@ -1,4 +1,4 @@
-import { S as Store } from './types-CSKl-wYe.js';
+import { S as Store } from './types-BbIEz7BN.js';
 
 declare const memoryStore: () => Store;
 

package/dist/siwd.d.ts

@@ -1,10 +1,11 @@
 import { Signer, VerifiedIdentity, VerifiedSignRequest } from '@metalabel/dfos-protocol/chain';
-import { a as Client, V as VerifyResult } from './types-CSKl-wYe.js';
+import { a as Client, V as VerifyResult } from './types-BbIEz7BN.js';
 import '@metalabel/dfos-protocol/credentials';
 import '@metalabel/dfos-web-relay/peer-client';
 
 /**
- * The normative JWS header `typ` for a signed SIWD challenge (SIWD.md). Signers
+ * The normative JWS header `typ` for a signed SIWD challenge (INTEGRATIONS.md,
+ * Challenge schema). Signers
  * MUST set it; `verifySiwd` rejects anything else — it is also what lets typ-
  * routing dispatchers tell a SIWD proof apart from credentials and chain ops.
  */
@@ -12,7 +13,7 @@ declare const SIWD_JWS_TYP = "did:dfos:siwd";
 /**
  * The normative JWS header `typ` for a client ASK PROOF — the artifact a
  * loopback client signs to prove key control at ask-time, registered alongside
- * `SIWD_JWS_TYP` by SIWD.md §The ask proof.
+ * `SIWD_JWS_TYP` by INTEGRATIONS.md, The ask proof.
  *
  * The two artifacts cover the SAME canonical challenge bytes, so the distinct
  * `typ` is the only thing keeping them from being fungible: without it, an ask
@@ -191,8 +192,8 @@ declare const createSiwdLoginRequest: (input: SiwdLoginRequestInput) => SiwdLogi
 /**
  * Sign the ask proof for a loopback authorize request: a JWS over the exact
  * canonical bytes of the request's own challenge, under `SIWD_ASK_JWS_TYP`,
- * signed by a CURRENT auth key of the client identity's chain (SIWD.md §The ask
- * proof). It is what makes a `client_did` on a loopback request mean something
+ * signed by a CURRENT auth key of the client identity's chain (INTEGRATIONS.md,
+ * The ask proof). It is what makes a `client_did` on a loopback request mean something
  * — the host verifies it against the chain's current state before rendering any
  * consent, so key control is established at ask-time, not just at spend-time.
  *
@@ -209,11 +210,9 @@ declare const createSiwdLoginRequest: (input: SiwdLoginRequestInput) => SiwdLogi
  * because a proof that names a key it was not signed with is a lie the wire
  * format has no reason to carry.
  *
- * The `client_proof` param that carries this is the REFERENCE wire surface, not
- * a normative name: SIWD.md defers how the ask proof travels to the hosted
- * endpoint's reference implementation, exactly as it does the endpoint itself.
- * What is normative is that it arrives WITH the ask and verifies BEFORE any
- * consent is rendered.
+ * The `client_proof` param that carries this is the parameter the spec names
+ * (INTEGRATIONS.md, The ask proof): the proof arrives WITH the ask and verifies
+ * BEFORE any consent is rendered.
  */
 declare const signSiwdAskProof: (input: {
     challenge: SiwdChallenge;
@@ -221,7 +220,8 @@ declare const signSiwdAskProof: (input: {
     kid: string;
     signer: Signer;
 }) => Promise<string>;
-/** SIWD.md carriage cap — an identity that has outgrown it has outgrown carriage. */
+/** The carriage cap of INTEGRATIONS.md, `identity_chain`: chain carriage — an
+ *  identity that has outgrown it has outgrown carriage. */
 declare const MAX_SIWD_CLIENT_CHAIN_OPS = 100;
 /**
  * Encode a client identity chain for carriage on the authorize request: the
@@ -231,7 +231,7 @@ declare const MAX_SIWD_CLIENT_CHAIN_OPS = 100;
  * THIS IS THE LOOPBACK CARRIAGE FORM, and only that. An application that holds a
  * domain encodes nothing: it publishes the very same log as the raw JSON array
  * of the `identity_chain` member of its `/.well-known/dfos-app.json` app
- * description (SIWD.md §`identity_chain` — chain carriage), where the origin
+ * description (INTEGRATIONS.md, `identity_chain`: chain carriage), where the origin
  * serving the file is what associates the domain with the DID. Same chain, same
  * carriage rules — a URL is simply the carrier available to software that holds
  * no origin to publish from.
@@ -239,7 +239,7 @@ declare const MAX_SIWD_CLIENT_CHAIN_OPS = 100;
  * The DID derived from the genesis operation MUST equal the `client_did` the
  * request names; a request where the two disagree makes no claim at all and the
  * host refuses it WHOLE rather than ingesting the chain and ignoring the
- * mismatch (SIWD.md §Chain residence). Carriage is only needed when the DID is
+ * mismatch (INTEGRATIONS.md, Chain residence). Carriage is only needed when the DID is
  * not already resident on the verifying host.
  *
  * The 100-operation cap is spec-normative and enforced here. Hosts MAY
@@ -248,10 +248,10 @@ declare const MAX_SIWD_CLIENT_CHAIN_OPS = 100;
  * protocol, so it is not a client-side throw; the practical reading is that a
  * chain anywhere near the op cap belongs on relays, not in a URL.
  *
- * As with the ask proof, the `client_chain` param is the REFERENCE wire surface
- * rather than a normative name — SIWD.md leaves the carriage encoding to the
- * hosted endpoint's reference implementation and pins only that the chain
- * arrives with the ask and verifies before any consent is rendered.
+ * As with the ask proof, the `client_chain` param is the parameter the spec
+ * names (INTEGRATIONS.md, Chain residence): base64url of the JSON array of the
+ * verbatim operation JWS strings, genesis first, arriving with the ask and
+ * verifying before any consent is rendered.
  */
 declare const encodeSiwdClientChain: (log: string[]) => string;
 interface SiwdClientIdentity {
@@ -345,14 +345,16 @@ interface SiwdLoopbackLoginRequestInput {
  * Build a loopback authorize URL under the LOOPBACK CREDENTIAL TIER — the
  * outbound half of what `createSiwdLoginRequest` alone cannot produce. It is
  * that function plus the two things that back the `client_did` it now carries:
- * an ask proof (SIWD.md §The ask proof) and, unless the DID is already resident
- * on the host, the client's identity chain (SIWD.md §Chain residence).
+ * an ask proof (INTEGRATIONS.md, The ask proof) and, unless the DID is already
+ * resident on the host, the client's identity chain (INTEGRATIONS.md, Chain
+ * residence).
  *
- * `domain` is DERIVED, not accepted. SIWD.md pins a loopback challenge's domain
- * to the BARE loopback host — the port is not part of the binding, because a
- * local application cannot reserve one — and the host compares that value
- * literally against the redirect's host. Taking a `domain` input here would be
- * an invitation to a mismatch that fails only after the redirect.
+ * `domain` is DERIVED, not accepted. INTEGRATIONS.md, Loopback redirect targets
+ * pins a loopback challenge's domain to the BARE loopback host — the port is
+ * not part of the binding, because a local application cannot reserve one — and
+ * the host compares that value literally against the redirect's host. Taking a
+ * `domain` input here would be an invitation to a mismatch that fails only
+ * after the redirect.
  *
  * WHAT THIS PROVES IS KEY CONTROL, NOT PROVENANCE. The chain says which keys
  * the asking party holds; nothing about a loopback client's origin or authorship
@@ -404,7 +406,7 @@ type SiwdCallbackResult = {
  * THAT SAME PROPERTY IS A PROBLEM FOR A CLI, and this tier's primary consumer is
  * a CLI. A browser does not send the fragment to the loopback listener either,
  * so the request line a local HTTP server sees carries the query and nothing
- * else. The standard resolution (SIWD.md §4's loopback note) is for the listener
+ * else. The standard resolution (INTEGRATIONS.md, 4. Callback) is for the listener
  * to answer with a small page whose script reads `location.href` and posts the
  * whole URL back to the local server; feed THAT to this function. A browser RP
  * passes `location.href` directly and needs no relay.

package/dist/store/index.d.ts

@@ -1,5 +1,5 @@
-export { m as memoryStore } from '../memory-Ca1F2EBW.js';
-import { S as Store } from '../types-CSKl-wYe.js';
+export { m as memoryStore } from '../memory-B5WMnEUQ.js';
+import { S as Store } from '../types-BbIEz7BN.js';
 import '@metalabel/dfos-protocol/chain';
 import '@metalabel/dfos-protocol/credentials';
 import '@metalabel/dfos-web-relay/peer-client';

package/dist/{types-CSKl-wYe.d.ts → types-BbIEz7BN.d.ts}

@@ -2,6 +2,14 @@ import { VerifiedIdentity, VerifiedContentChain } from '@metalabel/dfos-protocol
 import { VerifiedDFOSCredential, Attenuation } from '@metalabel/dfos-protocol/credentials';
 import { PeerClient } from '@metalabel/dfos-web-relay/peer-client';
 
+/** Head/as-of state; excludes the credit-claim projection. */
+type EffectiveIdentity = VerifiedIdentity & {
+    readonly resolution?: 'effective';
+};
+/** Every key ever proved, including memberships absent from effective state. */
+type EverProvedIdentity = VerifiedIdentity & {
+    readonly resolution: 'ever-proved';
+};
 /**
  * The two axes v1 genuinely cannot check:
  * - `revocation` — non-revocation is never provable (a relay can only attest to
@@ -48,14 +56,14 @@ interface VerifyResult<T> {
 interface ResolvedContent {
     chain: VerifiedContentChain;
     /** The creator identity — resolved as a side effect of key resolution. */
-    creator: VerifiedIdentity;
+    creator: EffectiveIdentity;
     /** The current document blob, when fetched. */
     document?: DocumentBlob;
 }
 interface ResolvedCredential {
     credential: VerifiedDFOSCredential;
     /** The issuer identity, verified. */
-    issuer: VerifiedIdentity;
+    issuer: EffectiveIdentity;
     /** Revocation status per the effective revocation checker (see Trust.unverifiable). */
     revoked: boolean;
 }
@@ -71,13 +79,13 @@ interface DocumentBlob {
 /** Discriminated result of the paste-a-string dispatcher. */
 type Resolution = ({
     kind: 'identity';
-} & Resolved<VerifiedIdentity>) | ({
+} & Resolved<EffectiveIdentity>) | ({
     kind: 'content';
 } & Resolved<ResolvedContent>) | ({
     kind: 'credential';
 } & Resolved<ResolvedCredential>);
 /**
- * Check whether a credential has been revoked. Default: `() => false` (honest).
+ * Check whether a credential has been revoked. The default queries relays and throws when none answers.
  *
  * `asOfUnix` is the protocol's revocation as-of basis (see the protocol's
  * `RevocationChecker`): supplied when folding committed history, so a credential
@@ -99,12 +107,12 @@ interface Callbacks {
      */
     resolveKey: (kid: string, basis?: string) => Promise<Uint8Array>;
     /** Resolve a DID to its verified identity state as of `basis`. */
-    resolveIdentity: (did: string, basis?: string) => Promise<VerifiedIdentity | undefined>;
+    resolveIdentity: (did: string, basis?: string) => Promise<EffectiveIdentity | undefined>;
     /**
      * Resolve a DID to its identity with every key it has ever proved — the
      * credit-claim carve-out, which runs no temporal check and so has no basis.
      */
-    resolveClaimantIdentity: (did: string) => Promise<VerifiedIdentity | undefined>;
+    resolveClaimantIdentity: (did: string) => Promise<EverProvedIdentity | undefined>;
     isRevoked: RevChecker;
 }
 /**
@@ -267,7 +275,7 @@ interface ClientConfig {
     store?: Store;
     /** Distinct-digest agreement threshold. Default 1 (first-wins). */
     quorum?: number;
-    /** Revocation checker. Default `() => false` (honest — status is unverifiable). */
+    /** Revocation checker. Default queries relays; throws when none answers. */
     isRevoked?: RevChecker;
     /** Injected fetch for blob/health/revocation calls. Default `globalThis.fetch`. */
     fetch?: typeof fetch;
@@ -287,7 +295,7 @@ interface Client {
     callbacks(options?: CallOptions): Callbacks;
     /** Paste-a-string dispatcher → a typed, trust-wrapped resolution. */
     resolve(ref: string, options?: CallOptions): Promise<Resolution>;
-    identity(did: string, options?: CallOptions): Promise<Resolved<VerifiedIdentity>>;
+    identity(did: string, options?: CallOptions): Promise<Resolved<EffectiveIdentity>>;
     content(contentId: string, options?: CallOptions): Promise<Resolved<ResolvedContent>>;
     credential(jws: string, options?: CallOptions): Promise<Resolved<ResolvedCredential>>;
     document(contentId: string, options?: CallOptions): Promise<Resolved<DocumentBlob>>;
@@ -351,4 +359,4 @@ interface Client {
     }, options?: CallOptions): Promise<IndexCredentialsPage>;
 }
 
-export type { ClientConfig as C, DocumentBlob as D, GlobalLogOptions as G, IndexCapabilities as I, LogOp as L, Provenance as P, RevChecker as R, Store as S, Trust as T, UnverifiableAxis as U, VerifyResult as V, Client as a, Callbacks as b, CallOptions as c, GlobalLogPage as d, GlobalLogResult as e, IndexContentPage as f, IndexContentRow as g, IndexCountersignatureRow as h, IndexCountersignaturesPage as i, IndexCredentialRow as j, IndexCredentialsPage as k, IndexIdentitiesPage as l, IndexIdentityProfile as m, IndexIdentityRow as n, IndexOrder as o, IndexRecencyOrder as p, RelayHealth as q, RelayResponse as r, Resolution as s, Resolved as t, ResolvedContent as u, ResolvedCredential as v };
+export type { ClientConfig as C, DocumentBlob as D, EffectiveIdentity as E, GlobalLogOptions as G, IndexCapabilities as I, LogOp as L, Provenance as P, RevChecker as R, Store as S, Trust as T, UnverifiableAxis as U, VerifyResult as V, Client as a, Callbacks as b, CallOptions as c, EverProvedIdentity as d, GlobalLogPage as e, GlobalLogResult as f, IndexContentPage as g, IndexContentRow as h, IndexCountersignatureRow as i, IndexCountersignaturesPage as j, IndexCredentialRow as k, IndexCredentialsPage as l, IndexIdentitiesPage as m, IndexIdentityProfile as n, IndexIdentityRow as o, IndexOrder as p, IndexRecencyOrder as q, RelayHealth as r, RelayResponse as s, Resolution as t, Resolved as u, ResolvedContent as v, ResolvedCredential as w };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metalabel/dfos-client",
-  "version": "0.51.0",
+  "version": "0.52.0",
   "type": "module",
   "description": "DFOS Client — the client-side kit for participating in the protocol: resolve, verify, prove. Fetch, resolve, verify-orchestration and cache over untrusted relays, plus the SIWD and API-AUTH proof surfaces. Holds no keys; all crypto truth comes from @metalabel/dfos-protocol",
   "license": "MIT",
@@ -47,16 +47,16 @@
     "README.md"
   ],
   "peerDependencies": {
-    "@metalabel/dfos-protocol": "^0.51.0",
-    "@metalabel/dfos-web-relay": "^0.51.0"
+    "@metalabel/dfos-protocol": "^0.52.0",
+    "@metalabel/dfos-web-relay": "^0.52.0"
   },
   "devDependencies": {
     "@types/node": "^24.10.4",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
     "vitest": "^4.1.8",
-    "@metalabel/dfos-protocol": "0.51.0",
-    "@metalabel/dfos-web-relay": "0.51.0"
+    "@metalabel/dfos-protocol": "0.52.0",
+    "@metalabel/dfos-web-relay": "0.52.0"
   },
   "scripts": {
     "build": "tsup",