@metalabel/dfos-protocol 0.24.0 → 0.26.0

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { JwsHeader, JwsVerificationError, JwtClaims, JwtCreateOptions, JwtHeader, JwtVerificationError, JwtVerifyOptions, PrefixedID, assertJwsProfile, base64urlDecode, base64urlEncode, createJws, createJwt, createNewEd25519Keypair, dagCborCanonicalEncode, decodeJwsUnsafe, decodeJwtUnsafe, generateId, generateIdNoPrefix, importEd25519Keypair, isCanonicallyEqual, isValidEd25519Signature, isValidId, normalizedId, parseDagCborCID, signPayloadEd25519, verifyJws, verifyJwt } from './crypto/index.js';
-export { A as ARTIFACT_CID_ANCHOR_RE, a as ArtifactPayload, C as CONTENT_ID_ANCHOR_RE, b as ContentOperation, c as CountersignPayload, I as IdentityOperation, M as MAX_ARTIFACT_PAYLOAD_SIZE, d as MAX_OPERATION_SIZE, e as MAX_SERVICES_ENTRIES, f as MAX_SERVICES_PAYLOAD_SIZE, g as MultikeyPublicKey, R as RevocationPayload, S as ServiceEntry, h as ServicesArray, i as Signer, V as VerifiedIdentity } from './schemas-BXye25k7.js';
-export { AnchorKind, ED25519_PRIV_MULTICODEC, ED25519_PUB_MULTICODEC, RECOGNIZED_SERVICE_TYPES, VerifiedArtifact, VerifiedContentChain, VerifiedCountersignature, VerifiedRevocation, anchorsByLabel, assertServicesWithinCap, classifyAnchor, decodeMultikey, deriveChainIdentifier, deriveContentId, encodeEd25519Multikey, isRecognizedServiceType, relayEndpoints, signArtifact, signContentOperation, signCountersignature, signIdentityOperation, signRevocation, verifyArtifact, verifyContentChain, verifyContentExtensionFromTrustedState, verifyCountersignature, verifyIdentityChain, verifyIdentityExtensionFromTrustedState, verifyRevocation } from './chain/index.js';
-export { Attenuation, AuthTokenClaims, AuthTokenCreateOptions, AuthTokenVerificationError, AuthTokenVerifyOptions, CredentialVerificationError, DFOSCredentialPayload, MAX_CREDENTIAL_SIZE, VerifiedAuthToken, VerifiedDFOSCredential, VerifiedDelegationChain, createAuthToken, createDFOSCredential, decodeDFOSCredentialUnsafe, isAttenuated, matchesResource, verifyAuthToken, verifyDFOSCredential, verifyDelegationChain } from './credentials/index.js';
+export { A as ARTIFACT_CID_ANCHOR_RE, a as ArtifactPayload, b as Attenuation, c as AuthTokenClaims, C as CONTENT_ID_ANCHOR_RE, d as ContentOperation, e as CountersignPayload, f as CredentialVerificationError, g as CreditClaimPayload, D as DFOSCredentialPayload, I as IdentityOperation, h as Iso8601, M as MAX_ARTIFACT_PAYLOAD_SIZE, i as MAX_CREDENTIAL_SIZE, j as MAX_CREDIT_CLAIM_SIZE, k as MAX_OPERATION_SIZE, l as MAX_SERVICES_ENTRIES, m as MAX_SERVICES_PAYLOAD_SIZE, n as MultikeyPublicKey, R as RevocationChecker, o as RevocationPayload, S as ServiceEntry, p as ServicesArray, q as Signer, V as VerifiedDFOSCredential, r as VerifiedDelegationChain, s as VerifiedIdentity, t as createDFOSCredential, u as decodeDFOSCredentialUnsafe, v as isAttenuated, w as matchesResource, x as parseProtocolTimestampUnix, y as verifyDFOSCredential, z as verifyDelegationChain } from './dfos-credential-CAYCqUCP.js';
+export { AnchorKind, CreditClaimFailureReason, CreditClaimVerifyError, CreditEntry, CreditEntryState, ED25519_PRIV_MULTICODEC, ED25519_PUB_MULTICODEC, RECOGNIZED_SERVICE_TYPES, VerifiedArtifact, VerifiedContentChain, VerifiedCountersignature, VerifiedCreditClaim, VerifiedCreditEntry, VerifiedRevocation, anchorsByLabel, assertServicesWithinCap, classifyAnchor, decodeMultikey, deriveChainIdentifier, deriveContentId, encodeEd25519Multikey, isRecognizedServiceType, relayEndpoints, signArtifact, signContentOperation, signCountersignature, signCreditClaim, signIdentityOperation, signRevocation, verifyArtifact, verifyContentChain, verifyContentExtensionFromTrustedState, verifyCountersignature, verifyCreditClaim, verifyCreditEntry, verifyIdentityChain, verifyIdentityExtensionFromTrustedState, verifyRevocation } from './chain/index.js';
+export { AuthTokenCreateOptions, AuthTokenVerificationError, AuthTokenVerifyOptions, VerifiedAuthToken, createAuthToken, verifyAuthToken } from './credentials/index.js';
 export { FoldOperation, INDEX_V1_SCHEMA, IndexDelta, IndexDocument, IndexEntry, LwwDelta, OrderKey, byteCompare, compareHeadPreference, compareLinear, foldIndexV1, foldLwwMap, linearize } from './fold/index.js';
 import 'multiformats';
 import 'multiformats/cid';

package/dist/index.js

@@ -4,8 +4,12 @@ import {
   CONTENT_ID_ANCHOR_RE,
   ContentOperation,
   CountersignPayload,
+  CreditClaimPayload,
+  CreditClaimVerifyError,
   IdentityOperation,
+  Iso8601,
   MAX_ARTIFACT_PAYLOAD_SIZE,
+  MAX_CREDIT_CLAIM_SIZE,
   MAX_OPERATION_SIZE,
   MAX_SERVICES_ENTRIES,
   MAX_SERVICES_PAYLOAD_SIZE,
@@ -21,20 +25,24 @@ import {
   deriveChainIdentifier,
   deriveContentId,
   isRecognizedServiceType,
+  parseProtocolTimestampUnix,
   relayEndpoints,
   signArtifact,
   signContentOperation,
   signCountersignature,
+  signCreditClaim,
   signIdentityOperation,
   signRevocation,
   verifyArtifact,
   verifyContentChain,
   verifyContentExtensionFromTrustedState,
   verifyCountersignature,
+  verifyCreditClaim,
+  verifyCreditEntry,
   verifyIdentityChain,
   verifyIdentityExtensionFromTrustedState,
   verifyRevocation
-} from "./chunk-4EJCATUC.js";
+} from "./chunk-3USIENKC.js";
 import {
   Attenuation,
   AuthTokenClaims,
@@ -54,7 +62,7 @@ import {
   verifyAuthToken,
   verifyDFOSCredential,
   verifyDelegationChain
-} from "./chunk-FMHROCFH.js";
+} from "./chunk-PGFHCBGH.js";
 import {
   JwsVerificationError,
   JwtVerificationError,
@@ -98,15 +106,19 @@ export {
   ContentOperation,
   CountersignPayload,
   CredentialVerificationError,
+  CreditClaimPayload,
+  CreditClaimVerifyError,
   DFOSCredentialPayload,
   ED25519_PRIV_MULTICODEC,
   ED25519_PUB_MULTICODEC,
   INDEX_V1_SCHEMA,
   IdentityOperation,
+  Iso8601,
   JwsVerificationError,
   JwtVerificationError,
   MAX_ARTIFACT_PAYLOAD_SIZE,
   MAX_CREDENTIAL_SIZE,
+  MAX_CREDIT_CLAIM_SIZE,
   MAX_OPERATION_SIZE,
   MAX_SERVICES_ENTRIES,
   MAX_SERVICES_PAYLOAD_SIZE,
@@ -152,10 +164,12 @@ export {
   matchesResource,
   normalizedId,
   parseDagCborCID,
+  parseProtocolTimestampUnix,
   relayEndpoints,
   signArtifact,
   signContentOperation,
   signCountersignature,
+  signCreditClaim,
   signIdentityOperation,
   signPayloadEd25519,
   signRevocation,
@@ -164,6 +178,8 @@ export {
   verifyContentChain,
   verifyContentExtensionFromTrustedState,
   verifyCountersignature,
+  verifyCreditClaim,
+  verifyCreditEntry,
   verifyDFOSCredential,
   verifyDelegationChain,
   verifyIdentityChain,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metalabel/dfos-protocol",
-  "version": "0.24.0",
+  "version": "0.26.0",
   "type": "module",
   "description": "DFOS Protocol — Ed25519 signed chain primitives, services, credentials, and verification",
   "license": "MIT",
@@ -57,7 +57,9 @@
     "@ipld/dag-cbor": "^10.0.1",
     "@noble/curves": "^2.2.0",
     "@noble/hashes": "^2.2.0",
-    "multiformats": "^14.0.0",
+    "multiformats": "^14.0.0"
+  },
+  "peerDependencies": {
     "zod": "^4.4.3"
   },
   "devDependencies": {
@@ -66,7 +68,8 @@
     "ajv-formats": "^3.0.1",
     "tsup": "^8.5.1",
     "tsx": "^4.22.4",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.8",
+    "zod": "^4.4.3"
   },
   "scripts": {
     "build": "tsup",

package/schemas/credit-claim.v1.json

@@ -0,0 +1,75 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.dfos.com/credit-claim/v1",
+  "title": "Credit Claim",
+  "description": "The payload of a did:dfos:credit-claim JWS — a claimant's own signed assertion that it holds a named role on a content chain. Unlike post/v1, profile/v1, and index/v1, this is NOT a document committed to a chain by CID: it is an envelope payload carried inside document bytes, in the claim field of a credits entry (see $defs/creditEntry). Attribution, not authorization — a credit claim grants nothing. Unknown top-level fields are deliberately NOT rejected here (no additionalProperties: false, unlike the document schemas): this is a wire payload under the protocol's MUST-ignore-unknown rule, and the CID commits to the exact bytes, so a verifier that stripped unknown keys would fail its own CID check. Full semantics, the two-way bind, and the four verification states: https://protocol.dfos.com/credits",
+  "type": "object",
+  "required": ["version", "type", "contentId", "did", "role", "createdAt"],
+  "properties": {
+    "version": {
+      "const": 1,
+      "description": "Schema version."
+    },
+    "type": {
+      "const": "credit-claim",
+      "description": "Literal discriminator."
+    },
+    "contentId": {
+      "type": "string",
+      "pattern": "^[2346789acdefhknrtvz]{31}$",
+      "description": "The content chain this claim binds to — the binder. A 31-char content chain id, never a documentCID and never a chain head CID: binding the chain is what lets a claim survive edits verbatim and avoids circularity with the document that embeds it. Naming the chain in the signed bytes is also what makes a claim anti-replay — it cannot be lifted into another chain's document."
+    },
+    "did": {
+      "type": "string",
+      "pattern": "^did:",
+      "description": "The claimant DID. MUST equal the DID portion of the JWS header's kid — only the claimant can claim its own credit."
+    },
+    "role": {
+      "type": "string",
+      "minLength": 1,
+      "description": "The claimed role — open vocabulary, compared by exact, case-sensitive byte equality with no normalization of any kind (not case folding, not Unicode normalization, not whitespace trimming). One component of the bind, so any normalization would let implementations disagree about whether an entry is claimed."
+    },
+    "createdAt": {
+      "type": "string",
+      "format": "date-time",
+      "description": "When the claimant signed (ISO 8601, millisecond precision, UTC). Provenance metadata only — unlike an operation's createdAt it orders nothing and gates nothing, and a claim has no expiry."
+    },
+    "asOfDocumentCID": {
+      "type": "string",
+      "description": "Optional content-strength flavor — the document state the claimant pins its credit to. When the key IS present it MUST be a non-empty string: an empty string is a distinct, CID-changing encoding from an absent field, so accepting it would mean two claim CIDs for the same statement. NOT part of the bind; consumers that ignore it are conformant. Omission is the default and is CID-neutral.",
+      "minLength": 1
+    }
+  },
+  "$defs": {
+    "creditEntry": {
+      "title": "Credit Entry",
+      "description": "The canonical credits[] entry shape — the document-plane site that hosts a credit claim. Schemas carrying credits inline this shape (post/v1 does). Array order is display order; the first entry is the primary author.",
+      "type": "object",
+      "required": ["did"],
+      "dependentRequired": {
+        "claim": ["role"]
+      },
+      "properties": {
+        "did": {
+          "type": "string",
+          "pattern": "^did:",
+          "description": "DID of the credited identity."
+        },
+        "role": {
+          "type": "string",
+          "description": "Free-text role — open vocabulary, not an enum (e.g. \"author\", \"editor\", \"photography\"). Compared byte-exact against the claim payload's role, so it is REQUIRED whenever claim is present: an entry with a claim but no role — or an empty role, which can never equal the payload's non-empty one — has nothing to bind to and is invalid, not unclaimed.",
+          "minLength": 1
+        },
+        "name": {
+          "type": "string",
+          "description": "Credited party's display name at time of publication — a rendering convenience so a document reads without resolving every credited DID. Never authoritative (the credited DID's profile is) and never compared during verification."
+        },
+        "claim": {
+          "type": "string",
+          "description": "A did:dfos:credit-claim JWS asserting this same credit, bound to the entry by exact match of (contentId, did, role). Absent is the ordinary \"unclaimed\" state, not a defect — the credited party may hold no keys. A claim present but failing verification or the bind is \"invalid\" and MUST NOT be rendered as unclaimed."
+        }
+      },
+      "additionalProperties": false
+    }
+  }
+}

package/schemas/post.v1.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://schemas.dfos.com/post/v1",
   "title": "Post",
-  "description": "A post \u2014 the primary content type in DFOS. Covers short posts and long-form posts via the format discriminator.",
+  "description": "A post — the primary content type in DFOS. Covers short posts and long-form posts via the format discriminator.",
   "type": "object",
   "required": ["$schema", "format"],
   "properties": {
@@ -12,12 +12,12 @@
     "format": {
       "type": "string",
       "enum": ["short-post", "long-post"],
-      "description": "Immutable content format \u2014 set at creation, never changes. Determines rendering and interaction semantics. Comments and replies are deliberately NOT post/v1 surface \u2014 threaded content arrives as its own schema (with signed target linkage), not as additional format values."
+      "description": "Immutable content format — set at creation, never changes. Determines rendering and interaction semantics. Comments and replies are deliberately NOT post/v1 surface — threaded content arrives as its own schema (with signed target linkage), not as additional format values."
     },
     "publishedAt": {
       "type": "string",
       "format": "date-time",
-      "description": "Asserted original publication time of the content (ISO 8601). Distinct from the operation's createdAt, which records when the operation was signed: a chain anchored after the fact carries the original publication time here while its genesis operation truthfully records the later anchoring time. Assertion-tier like credits \u2014 the operation signer asserts it; the protocol verifies the signer, not the claim. Author-revisable: a later revision may change it (deliberate back-dating or correction) \u2014 the operation log preserves every previously committed value, so re-dating is always auditable."
+      "description": "Asserted original publication time of the content (ISO 8601). Distinct from the operation's createdAt, which records when the operation was signed: a chain anchored after the fact carries the original publication time here while its genesis operation truthfully records the later anchoring time. Assertion-tier like credits — the operation signer asserts it; the protocol verifies the signer, not the claim. Author-revisable: a later revision may change it (deliberate back-dating or correction) — the operation log preserves every previously committed value, so re-dating is always auditable."
     },
     "title": {
       "type": "string",
@@ -25,7 +25,7 @@
     },
     "body": {
       "type": "string",
-      "description": "Post body content \u2014 markdown (CommonMark) text. May embed attachment://<id> refs inline; each should have a corresponding attachments entry carrying the verifiable reference."
+      "description": "Post body content — markdown (CommonMark) text. May embed attachment://<id> refs inline; each should have a corresponding attachments entry carrying the verifiable reference."
     },
     "cover": {
       "$ref": "#/$defs/media",
@@ -43,7 +43,7 @@
       "items": {
         "$ref": "#/$defs/credit"
       },
-      "description": "Ordered authorship credits. Array order is display order; the first entry is the primary author. Omit entirely for unattributed content. Credits are the assertion tier of the authorship lattice \u2014 the operation signer asserts them; a credited DID may upgrade its credit to proof via a claim operation."
+      "description": "Ordered authorship credits. Array order is display order; the first entry is the primary author. Omit entirely for unattributed content. A bare entry is the assertion tier of the authorship lattice — the operation signer asserts it; a credited DID upgrades its credit to proof by adding a credit claim in the entry's claim field (see https://protocol.dfos.com/credits)."
     }
   },
   "additionalProperties": false,
@@ -55,33 +55,47 @@
         "uri": {
           "type": "string",
           "format": "uri",
-          "description": "Canonical reference to the media \u2014 an attachment://<id> ref (opaque, host-scoped) or any other URI. Always present."
+          "description": "Canonical reference to the media — an attachment://<id> ref (opaque, host-scoped) or any other URI. Always present."
         },
         "cid": {
           "type": "string",
           "pattern": "^bafkrei[a-z2-7]{52}$",
-          "description": "Optional content commitment \u2014 CIDv1, raw codec (0x55), sha2-256, base32 lowercase, computed over the media bytes exactly as stored/served. May be absent when no cid has been computed for the media."
+          "description": "Optional content commitment — CIDv1, raw codec (0x55), sha2-256, base32 lowercase, computed over the media bytes exactly as stored/served. May be absent when no cid has been computed for the media."
         },
         "href": {
           "type": "string",
           "format": "uri",
-          "description": "Optional resolution hint \u2014 a plain URL where the bytes may currently be fetched. Implementation-dependent and non-normative; carries no integrity promise."
+          "description": "Optional resolution hint — a plain URL where the bytes may currently be fetched. Implementation-dependent and non-normative; carries no integrity promise."
         }
       },
       "additionalProperties": false
     },
     "credit": {
+      "title": "Credit Entry",
+      "description": "The canonical credits[] entry shape — the document-plane site that hosts a credit claim. Schemas carrying credits inline this shape (post/v1 does). Array order is display order; the first entry is the primary author.",
       "type": "object",
       "required": ["did"],
+      "dependentRequired": {
+        "claim": ["role"]
+      },
       "properties": {
         "did": {
           "type": "string",
           "pattern": "^did:",
           "description": "DID of the credited identity."
         },
-        "label": {
+        "role": {
+          "type": "string",
+          "description": "Free-text role — open vocabulary, not an enum (e.g. \"author\", \"editor\", \"photography\"). Compared byte-exact against the claim payload's role, so it is REQUIRED whenever claim is present: an entry with a claim but no role — or an empty role, which can never equal the payload's non-empty one — has nothing to bind to and is invalid, not unclaimed.",
+          "minLength": 1
+        },
+        "name": {
+          "type": "string",
+          "description": "Credited party's display name at time of publication — a rendering convenience so a document reads without resolving every credited DID. Never authoritative (the credited DID's profile is) and never compared during verification."
+        },
+        "claim": {
           "type": "string",
-          "description": "Free-text role label \u2014 display vocabulary, not an enum (e.g. \"author\", \"editor\", \"photography\")."
+          "description": "A did:dfos:credit-claim JWS asserting this same credit, bound to the entry by exact match of (contentId, did, role). Absent is the ordinary \"unclaimed\" state, not a defect — the credited party may hold no keys. A claim present but failing verification or the bind is \"invalid\" and MUST NOT be rendered as unclaimed."
         }
       },
       "additionalProperties": false

package/dist/schemas-BXye25k7.d.ts

@@ -1,220 +0,0 @@
-import { z } from 'zod';
-
-/** Function that signs a byte array and returns a signature */
-type Signer = (message: Uint8Array) => Promise<Uint8Array>;
-/**
- * Max number of service entries in an identity's services state — a generous
- * cardinality ceiling on resolution fan-out. Individual entry fields are NOT
- * separately length-capped (no per-field length zoo): the aggregate byte cap
- * below, plus the operation-size cap, bound entry size. The op-size cap is the
- * real arbiter when services and keys are both large.
- */
-declare const MAX_SERVICES_ENTRIES = 256;
-/**
- * Max CBOR-encoded size of the services array (bytes) — the SINGLE aggregate that
- * bounds the services manifest, replacing the former per-field length caps (the
- * same collapse the op-size cap applied at the operation level). Sized so the
- * 256-entry ceiling is genuinely reachable with realistic entries.
- */
-declare const MAX_SERVICES_PAYLOAD_SIZE = 32768;
-/**
- * Max dag-cbor-encoded size of a single protocol operation payload (bytes) — the
- * one aggregate validity bound on operation size, measured over the exact bytes
- * the CID commits to. Generously set (64 KiB) so it never binds a legitimate
- * proof-layer operation while bounding decode/verify cost (a DoS + determinism
- * invariant). This is a VALIDITY-determining cap: it MUST be identical across
- * implementations. Large binary media does NOT travel in operation payloads —
- * it is referenced, not inlined — so this bound is about proof-layer ops only.
- */
-declare const MAX_OPERATION_SIZE = 65536;
-declare const MultikeyPublicKey: z.ZodObject<{
-    id: z.ZodString;
-    type: z.ZodLiteral<"Multikey">;
-    publicKeyMultibase: z.ZodString;
-}, z.core.$loose>;
-type MultikeyPublicKey = z.infer<typeof MultikeyPublicKey>;
-/**
- * Anchor target shapes — a ContentAnchor references a STABLE content
- * identifier, dispatched by structural form:
- *   - 31-char contentId (content chain) → mutable, gateable
- *   - CIDv1 dag-cbor+sha256 (artifact)  → immutable, public
- * Both are stable; a chain HEAD CID (also a `bafyrei…` CID but resolves to a
- * non-artifact op) is rejected by the shape-dispatch + resolution type check,
- * never anchored.
- *
- * The artifact form is the EXACT 59-char CIDv1(dag-cbor 0x71 + sha256 0x12 0x20)
- * base32 string — 36 raw bytes → 58 base32 chars + the `b` multibase prefix,
- * fixed `bafyrei` head + 52 base32 chars. Artifact payloads are ALWAYS dag-cbor +
- * sha256 (ArtifactPayload below), so every real artifact CID is `bafyrei…`. The
- * regex is pinned to that exact length (not a loose `baf…{20,}`) so an anchor of
- * any other shape — wrong codec, wrong length — is rejected uniformly across
- * implementations. New anchor KINDS arrive via a new service `type`, never a new
- * anchor shape.
- */
-declare const CONTENT_ID_ANCHOR_RE: RegExp;
-declare const ARTIFACT_CID_ANCHOR_RE: RegExp;
-/**
- * Service entry — discovery vocabulary in identity-chain state.
- *
- * Open namespace: `type` is an arbitrary bounded string. Recognized types
- * (`DfosRelay`, `ContentAnchor`) are structurally validated; UNRECOGNIZED types
- * are preserved verbatim and ignored (MUST-ignore-unknown) — only the common
- * envelope (id + type) and the byte cap apply. New service types therefore
- * never require a protocol/cross-language change.
- */
-declare const ServiceEntry: z.ZodObject<{
-    id: z.ZodString;
-    type: z.ZodString;
-}, z.core.$catchall<z.ZodUnknown>>;
-type ServiceEntry = z.infer<typeof ServiceEntry>;
-/** Identity services state — full-state, bounded, unique entry ids */
-declare const ServicesArray: z.ZodArray<z.ZodObject<{
-    id: z.ZodString;
-    type: z.ZodString;
-}, z.core.$catchall<z.ZodUnknown>>>;
-type ServicesArray = z.infer<typeof ServicesArray>;
-declare const IdentityOperation: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    version: z.ZodLiteral<1>;
-    type: z.ZodLiteral<"create">;
-    authKeys: z.ZodArray<z.ZodObject<{
-        id: z.ZodString;
-        type: z.ZodLiteral<"Multikey">;
-        publicKeyMultibase: z.ZodString;
-    }, z.core.$loose>>;
-    assertKeys: z.ZodArray<z.ZodObject<{
-        id: z.ZodString;
-        type: z.ZodLiteral<"Multikey">;
-        publicKeyMultibase: z.ZodString;
-    }, z.core.$loose>>;
-    controllerKeys: z.ZodArray<z.ZodObject<{
-        id: z.ZodString;
-        type: z.ZodLiteral<"Multikey">;
-        publicKeyMultibase: z.ZodString;
-    }, z.core.$loose>>;
-    services: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        id: z.ZodString;
-        type: z.ZodString;
-    }, z.core.$catchall<z.ZodUnknown>>>>;
-    createdAt: z.ZodISODateTime;
-}, z.core.$loose>, z.ZodObject<{
-    version: z.ZodLiteral<1>;
-    type: z.ZodLiteral<"update">;
-    previousOperationCID: z.ZodString;
-    authKeys: z.ZodArray<z.ZodObject<{
-        id: z.ZodString;
-        type: z.ZodLiteral<"Multikey">;
-        publicKeyMultibase: z.ZodString;
-    }, z.core.$loose>>;
-    assertKeys: z.ZodArray<z.ZodObject<{
-        id: z.ZodString;
-        type: z.ZodLiteral<"Multikey">;
-        publicKeyMultibase: z.ZodString;
-    }, z.core.$loose>>;
-    controllerKeys: z.ZodArray<z.ZodObject<{
-        id: z.ZodString;
-        type: z.ZodLiteral<"Multikey">;
-        publicKeyMultibase: z.ZodString;
-    }, z.core.$loose>>;
-    services: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        id: z.ZodString;
-        type: z.ZodString;
-    }, z.core.$catchall<z.ZodUnknown>>>>;
-    createdAt: z.ZodISODateTime;
-}, z.core.$loose>, z.ZodObject<{
-    version: z.ZodLiteral<1>;
-    type: z.ZodLiteral<"delete">;
-    previousOperationCID: z.ZodString;
-    createdAt: z.ZodISODateTime;
-}, z.core.$loose>], "type">;
-type IdentityOperation = z.infer<typeof IdentityOperation>;
-declare const VerifiedIdentity: z.ZodObject<{
-    did: z.ZodString;
-    isDeleted: z.ZodBoolean;
-    authKeys: z.ZodArray<z.ZodObject<{
-        id: z.ZodString;
-        type: z.ZodLiteral<"Multikey">;
-        publicKeyMultibase: z.ZodString;
-    }, z.core.$loose>>;
-    assertKeys: z.ZodArray<z.ZodObject<{
-        id: z.ZodString;
-        type: z.ZodLiteral<"Multikey">;
-        publicKeyMultibase: z.ZodString;
-    }, z.core.$loose>>;
-    controllerKeys: z.ZodArray<z.ZodObject<{
-        id: z.ZodString;
-        type: z.ZodLiteral<"Multikey">;
-        publicKeyMultibase: z.ZodString;
-    }, z.core.$loose>>;
-    services: z.ZodArray<z.ZodObject<{
-        id: z.ZodString;
-        type: z.ZodString;
-    }, z.core.$catchall<z.ZodUnknown>>>;
-}, z.core.$strict>;
-type VerifiedIdentity = z.infer<typeof VerifiedIdentity>;
-declare const ContentOperation: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    version: z.ZodLiteral<1>;
-    type: z.ZodLiteral<"create">;
-    did: z.ZodString;
-    documentCID: z.ZodString;
-    baseDocumentCID: z.ZodNullable<z.ZodString>;
-    createdAt: z.ZodISODateTime;
-}, z.core.$loose>, z.ZodObject<{
-    version: z.ZodLiteral<1>;
-    type: z.ZodLiteral<"update">;
-    did: z.ZodString;
-    previousOperationCID: z.ZodString;
-    documentCID: z.ZodNullable<z.ZodString>;
-    baseDocumentCID: z.ZodNullable<z.ZodString>;
-    createdAt: z.ZodISODateTime;
-    authorization: z.ZodOptional<z.ZodString>;
-}, z.core.$loose>, z.ZodObject<{
-    version: z.ZodLiteral<1>;
-    type: z.ZodLiteral<"delete">;
-    did: z.ZodString;
-    previousOperationCID: z.ZodString;
-    createdAt: z.ZodISODateTime;
-    authorization: z.ZodOptional<z.ZodString>;
-}, z.core.$loose>], "type">;
-type ContentOperation = z.infer<typeof ContentOperation>;
-/** Max CBOR-encoded payload size for artifacts (bytes) — protocol constant */
-declare const MAX_ARTIFACT_PAYLOAD_SIZE = 16384;
-/** Artifact: standalone signed inline document, immutable, CID-addressable */
-declare const ArtifactPayload: z.ZodObject<{
-    version: z.ZodLiteral<1>;
-    type: z.ZodLiteral<"artifact">;
-    did: z.ZodString;
-    content: z.ZodObject<{
-        $schema: z.ZodString;
-    }, z.core.$catchall<z.ZodUnknown>>;
-    createdAt: z.ZodISODateTime;
-}, z.core.$loose>;
-type ArtifactPayload = z.infer<typeof ArtifactPayload>;
-/**
- * Countersign: standalone witness attestation referencing a target operation by CID.
- *
- * `relation` is an OPEN-namespace tag naming the nature of the attestation
- * (e.g. `coauthors`, `endorses`, `witnessed`, `holds`, `received`). It is an
- * arbitrary bounded string — recognized values carry social meaning to clients,
- * unrecognized values MUST be preserved and ignored. Optional, so a bare witness
- * attestation (no relation) encodes identically (CID-neutral).
- */
-declare const CountersignPayload: z.ZodObject<{
-    version: z.ZodLiteral<1>;
-    type: z.ZodLiteral<"countersign">;
-    did: z.ZodString;
-    targetCID: z.ZodString;
-    relation: z.ZodOptional<z.ZodString>;
-    createdAt: z.ZodISODateTime;
-}, z.core.$loose>;
-type CountersignPayload = z.infer<typeof CountersignPayload>;
-/** Revocation: signed credential revocation artifact, gossiped on the proof plane */
-declare const RevocationPayload: z.ZodObject<{
-    version: z.ZodLiteral<1>;
-    type: z.ZodLiteral<"revocation">;
-    did: z.ZodString;
-    credentialCID: z.ZodString;
-    createdAt: z.ZodISODateTime;
-}, z.core.$loose>;
-type RevocationPayload = z.infer<typeof RevocationPayload>;
-
-export { ARTIFACT_CID_ANCHOR_RE as A, CONTENT_ID_ANCHOR_RE as C, IdentityOperation as I, MAX_ARTIFACT_PAYLOAD_SIZE as M, RevocationPayload as R, ServiceEntry as S, VerifiedIdentity as V, ArtifactPayload as a, ContentOperation as b, CountersignPayload as c, MAX_OPERATION_SIZE as d, MAX_SERVICES_ENTRIES as e, MAX_SERVICES_PAYLOAD_SIZE as f, MultikeyPublicKey as g, ServicesArray as h, type Signer as i };