@metalabel/dfos-protocol 0.27.0 → 0.28.1

package/README.md

@@ -26,19 +26,25 @@ import { createJws, dagCborCanonicalEncode, verifyJws } from '@metalabel/dfos-pr
 
 ## Subpath Exports
 
-| Export                                 | Description                                                                              |
-| -------------------------------------- | ---------------------------------------------------------------------------------------- |
-| `@metalabel/dfos-protocol/chain`       | Identity & content chains, services, artifacts, countersigns, revocations, credit claims |
-| `@metalabel/dfos-protocol/credentials` | Auth tokens (DID-signed JWT) and DFOS credentials for authorization                      |
-| `@metalabel/dfos-protocol/crypto`      | Ed25519, JWS, JWT, dag-cbor, base64url, ID generation                                    |
+| Export                                 | Description                                                                                             |
+| -------------------------------------- | ------------------------------------------------------------------------------------------------------- |
+| `@metalabel/dfos-protocol/chain`       | Identity & content chains, services, artifacts, countersigns, revocations, credit claims, sign requests |
+| `@metalabel/dfos-protocol/credentials` | Auth tokens (DID-signed JWT) and DFOS credentials for authorization                                     |
+| `@metalabel/dfos-protocol/crypto`      | Ed25519, JWS, JWT, dag-cbor, base64url, ID generation                                                   |
+| `@metalabel/dfos-protocol/fold`        | Canonical linearization and LWW-map folds for index documents                                           |
 
 ## Specifications
 
-| Document                                         | Description                                                    |
-| ------------------------------------------------ | -------------------------------------------------------------- |
-| [PROTOCOL.md](../../specs/PROTOCOL.md)           | Core protocol — chains, signatures, verification, test vectors |
-| [DID-METHOD.md](../../specs/DID-METHOD.md)       | W3C DID method specification for `did:dfos`                    |
-| [CONTENT-MODEL.md](../../specs/CONTENT-MODEL.md) | Standard content schemas (post, profile)                       |
+| Document                                         | Description                                                                       |
+| ------------------------------------------------ | --------------------------------------------------------------------------------- |
+| [PROTOCOL.md](../../specs/PROTOCOL.md)           | Core protocol — chains, signatures, verification, test vectors                    |
+| [DID-METHOD.md](../../specs/DID-METHOD.md)       | W3C DID method specification for `did:dfos`                                       |
+| [CONTENT-MODEL.md](../../specs/CONTENT-MODEL.md) | Standard content schemas (post, profile)                                          |
+| [CREDENTIALS.md](../../specs/CREDENTIALS.md)     | UCAN-style authorization credentials for the DFOS protocol                        |
+| [CREDITS.md](../../specs/CREDITS.md)             | Verifiable attribution for DFOS content                                           |
+| [SIGNING.md](../../specs/SIGNING.md)             | A transport-agnostic way for one party to ask another to produce a DFOS signature |
+
+Release history lives at https://github.com/metalabel/dfos/releases.
 
 ## Examples
 

package/dist/chain/index.d.ts

@@ -1,5 +1,5 @@
-import { I as IdentityOperation, t as Signer, v as VerifiedIdentity, S as ServiceEntry, d as ContentOperation, R as RevocationChecker, e as CountersignPayload, a as ArtifactPayload } from '../dfos-credential-DFZRl0FD.js';
-export { A as ARTIFACT_CID_ANCHOR_RE, C as CONTENT_ID_ANCHOR_RE, g as CreditClaimPayload, h as Iso8601, M as MAX_ARTIFACT_PAYLOAD_SIZE, j as MAX_CREDIT_CLAIM_SIZE, k as MAX_OPERATION_SIZE, l as MAX_SERVICES_ENTRIES, m as MAX_SERVICES_PAYLOAD_SIZE, n as MAX_SIGN_REQUEST_PAYLOAD_SIZE, o as MAX_SIGN_REQUEST_SIZE, p as MultikeyPublicKey, q as RevocationPayload, r as ServicesArray, s as SignRequestPayload, B as parseProtocolTimestampUnix } from '../dfos-credential-DFZRl0FD.js';
+import { I as IdentityOperation, t as Signer, v as VerifiedIdentity, S as ServiceEntry, d as ContentOperation, R as RevocationChecker, e as CountersignPayload, a as ArtifactPayload } from '../dfos-credential-DU7WvoHE.js';
+export { A as ARTIFACT_CID_ANCHOR_RE, C as CONTENT_ID_ANCHOR_RE, g as CreditClaimPayload, h as Iso8601, M as MAX_ARTIFACT_PAYLOAD_SIZE, j as MAX_CREDIT_CLAIM_SIZE, k as MAX_OPERATION_SIZE, l as MAX_SERVICES_ENTRIES, m as MAX_SERVICES_PAYLOAD_SIZE, n as MAX_SIGN_REQUEST_PAYLOAD_SIZE, o as MAX_SIGN_REQUEST_SIZE, p as MultikeyPublicKey, q as RevocationPayload, r as ServicesArray, s as SignRequestPayload, B as parseProtocolTimestampUnix } from '../dfos-credential-DU7WvoHE.js';
 import 'zod';
 
 /** Ed25519 public key multicodec value */

package/dist/chain/index.js

@@ -49,7 +49,7 @@ import {
   verifyIdentityExtensionFromTrustedState,
   verifyRevocation,
   verifySignRequest
-} from "../chunk-Q376VG5Z.js";
+} from "../chunk-W4ESJVMO.js";
 import {
   ED25519_PRIV_MULTICODEC,
   ED25519_PUB_MULTICODEC,

package/dist/{chunk-Q376VG5Z.js → chunk-W4ESJVMO.js}

@@ -96,10 +96,17 @@ var IdentityDelete = z.looseObject({
   previousOperationCID: CIDString,
   createdAt: Iso8601
 });
+var IdentityRestore = z.looseObject({
+  version: z.literal(1),
+  type: z.literal("restore"),
+  previousOperationCID: CIDString,
+  createdAt: Iso8601
+});
 var IdentityOperation = z.discriminatedUnion("type", [
   IdentityCreate,
   IdentityUpdate,
-  IdentityDelete
+  IdentityDelete,
+  IdentityRestore
 ]);
 var VerifiedIdentity = z.strictObject({
   did: z.string(),
@@ -257,7 +264,12 @@ var verifyIdentityChain = async (input) => {
     if (decoded.header.typ !== "did:dfos:identity-op") {
       throw new Error(`log[${idx}]: invalid typ: ${decoded.header.typ}`);
     }
-    if (state.isDeleted) throw new Error(`log[${idx}]: cannot modify a deleted identity`);
+    if (state.isDeleted && op.type !== "restore") {
+      throw new Error(`log[${idx}]: cannot modify a deleted identity`);
+    }
+    if (!state.isDeleted && op.type === "restore") {
+      throw new Error(`log[${idx}]: restore must immediately follow delete`);
+    }
     if (idx === 0 && op.type !== "create") {
       throw new Error(`log[${idx}]: first operation must be create`);
     }
@@ -273,7 +285,7 @@ var verifyIdentityChain = async (input) => {
       state.controllerKeys = op.controllerKeys;
       state.services = op.services ?? [];
     }
-    if (op.type === "update" || op.type === "delete") {
+    if (op.type !== "create") {
       if (op.previousOperationCID !== state.previousOperationCID) {
         throw new Error(`log[${idx}]: previousCID is incorrect`);
       }
@@ -370,6 +382,9 @@ var verifyIdentityChain = async (input) => {
       case "delete":
         state.isDeleted = true;
         break;
+      case "restore":
+        state.isDeleted = false;
+        break;
     }
   }
   if (!state.did) throw new Error("did is not set");
@@ -384,9 +399,6 @@ var verifyIdentityChain = async (input) => {
 };
 var verifyIdentityExtensionFromTrustedState = async (input) => {
   const { currentState, headCID, lastCreatedAt, newOp } = input;
-  if (currentState.isDeleted) {
-    throw new Error("cannot extend a deleted identity");
-  }
   const decoded = decodeJwsUnsafe(newOp);
   if (!decoded) throw new Error("failed to decode JWS");
   const result = IdentityOperation.safeParse(decoded.payload);
@@ -395,6 +407,12 @@ var verifyIdentityExtensionFromTrustedState = async (input) => {
     throw new Error(messages);
   }
   const op = result.data;
+  if (currentState.isDeleted && op.type !== "restore") {
+    throw new Error("cannot extend a deleted identity");
+  }
+  if (!currentState.isDeleted && op.type === "restore") {
+    throw new Error("restore must immediately follow delete");
+  }
   if (decoded.header.typ !== "did:dfos:identity-op") {
     throw new Error(`invalid typ: ${decoded.header.typ}`);
   }
@@ -443,21 +461,37 @@ var verifyIdentityExtensionFromTrustedState = async (input) => {
     });
     if (op.services) await assertServicesWithinCap(op.services);
   }
-  const newState = op.type === "update" ? {
-    did: currentState.did,
-    isDeleted: false,
-    authKeys: op.authKeys,
-    assertKeys: op.assertKeys,
-    controllerKeys: op.controllerKeys,
-    services: op.services ?? []
-  } : {
-    did: currentState.did,
-    isDeleted: true,
-    authKeys: currentState.authKeys,
-    assertKeys: currentState.assertKeys,
-    controllerKeys: currentState.controllerKeys,
-    services: currentState.services
-  };
+  const newState = (() => {
+    switch (op.type) {
+      case "update":
+        return {
+          did: currentState.did,
+          isDeleted: false,
+          authKeys: op.authKeys,
+          assertKeys: op.assertKeys,
+          controllerKeys: op.controllerKeys,
+          services: op.services ?? []
+        };
+      case "delete":
+        return {
+          did: currentState.did,
+          isDeleted: true,
+          authKeys: currentState.authKeys,
+          assertKeys: currentState.assertKeys,
+          controllerKeys: currentState.controllerKeys,
+          services: currentState.services
+        };
+      case "restore":
+        return {
+          did: currentState.did,
+          isDeleted: false,
+          authKeys: currentState.authKeys,
+          assertKeys: currentState.assertKeys,
+          controllerKeys: currentState.controllerKeys,
+          services: currentState.services
+        };
+    }
+  })();
   return { state: newState, operationCID, createdAt: op.createdAt };
 };
 

package/dist/credentials/index.d.ts

@@ -1,4 +1,4 @@
-export { b as Attenuation, c as AuthTokenClaims, f as CredentialVerificationError, D as DFOSCredentialPayload, i as MAX_CREDENTIAL_SIZE, R as RevocationChecker, V as VerifiedDFOSCredential, u as VerifiedDelegationChain, w as createDFOSCredential, x as decodeDFOSCredentialUnsafe, y as isAttenuated, z as matchesResource, E as verifyDFOSCredential, F as verifyDelegationChain } from '../dfos-credential-DFZRl0FD.js';
+export { b as Attenuation, c as AuthTokenClaims, f as CredentialVerificationError, D as DFOSCredentialPayload, i as MAX_CREDENTIAL_SIZE, R as RevocationChecker, V as VerifiedDFOSCredential, u as VerifiedDelegationChain, w as createDFOSCredential, x as decodeDFOSCredentialUnsafe, y as isAttenuated, z as matchesResource, E as verifyDFOSCredential, F as verifyDelegationChain } from '../dfos-credential-DU7WvoHE.js';
 import 'zod';
 
 interface AuthTokenCreateOptions {

package/dist/{dfos-credential-DFZRl0FD.d.ts → dfos-credential-DU7WvoHE.d.ts}

@@ -148,6 +148,11 @@ declare const IdentityOperation: z.ZodDiscriminatedUnion<[z.ZodObject<{
     type: z.ZodLiteral<"delete">;
     previousOperationCID: z.ZodString;
     createdAt: z.ZodISODateTime;
+}, z.core.$loose>, z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    type: z.ZodLiteral<"restore">;
+    previousOperationCID: z.ZodString;
+    createdAt: z.ZodISODateTime;
 }, z.core.$loose>], "type">;
 type IdentityOperation = z.infer<typeof IdentityOperation>;
 declare const VerifiedIdentity: z.ZodObject<{

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { JwsHeader, JwsVerificationError, JwtClaims, JwtCreateOptions, JwtHeader, JwtVerificationError, JwtVerifyOptions, PrefixedID, assertJwsProfile, base64urlDecode, base64urlEncode, createJws, createJwt, createNewEd25519Keypair, dagCborCanonicalEncode, decodeJwsUnsafe, decodeJwtUnsafe, generateId, generateIdNoPrefix, importEd25519Keypair, isCanonicallyEqual, isValidEd25519Signature, isValidId, normalizedId, parseDagCborCID, signPayloadEd25519, verifyJws, verifyJwt } from './crypto/index.js';
-export { A as ARTIFACT_CID_ANCHOR_RE, a as ArtifactPayload, b as Attenuation, c as AuthTokenClaims, C as CONTENT_ID_ANCHOR_RE, d as ContentOperation, e as CountersignPayload, f as CredentialVerificationError, g as CreditClaimPayload, D as DFOSCredentialPayload, I as IdentityOperation, h as Iso8601, M as MAX_ARTIFACT_PAYLOAD_SIZE, i as MAX_CREDENTIAL_SIZE, j as MAX_CREDIT_CLAIM_SIZE, k as MAX_OPERATION_SIZE, l as MAX_SERVICES_ENTRIES, m as MAX_SERVICES_PAYLOAD_SIZE, n as MAX_SIGN_REQUEST_PAYLOAD_SIZE, o as MAX_SIGN_REQUEST_SIZE, p as MultikeyPublicKey, R as RevocationChecker, q as RevocationPayload, S as ServiceEntry, r as ServicesArray, s as SignRequestPayload, t as Signer, V as VerifiedDFOSCredential, u as VerifiedDelegationChain, v as VerifiedIdentity, w as createDFOSCredential, x as decodeDFOSCredentialUnsafe, y as isAttenuated, z as matchesResource, B as parseProtocolTimestampUnix, E as verifyDFOSCredential, F as verifyDelegationChain } from './dfos-credential-DFZRl0FD.js';
+export { A as ARTIFACT_CID_ANCHOR_RE, a as ArtifactPayload, b as Attenuation, c as AuthTokenClaims, C as CONTENT_ID_ANCHOR_RE, d as ContentOperation, e as CountersignPayload, f as CredentialVerificationError, g as CreditClaimPayload, D as DFOSCredentialPayload, I as IdentityOperation, h as Iso8601, M as MAX_ARTIFACT_PAYLOAD_SIZE, i as MAX_CREDENTIAL_SIZE, j as MAX_CREDIT_CLAIM_SIZE, k as MAX_OPERATION_SIZE, l as MAX_SERVICES_ENTRIES, m as MAX_SERVICES_PAYLOAD_SIZE, n as MAX_SIGN_REQUEST_PAYLOAD_SIZE, o as MAX_SIGN_REQUEST_SIZE, p as MultikeyPublicKey, R as RevocationChecker, q as RevocationPayload, S as ServiceEntry, r as ServicesArray, s as SignRequestPayload, t as Signer, V as VerifiedDFOSCredential, u as VerifiedDelegationChain, v as VerifiedIdentity, w as createDFOSCredential, x as decodeDFOSCredentialUnsafe, y as isAttenuated, z as matchesResource, B as parseProtocolTimestampUnix, E as verifyDFOSCredential, F as verifyDelegationChain } from './dfos-credential-DU7WvoHE.js';
 export { AnchorKind, CreditClaimFailureReason, CreditClaimVerifyError, CreditEntry, CreditEntryState, ED25519_PRIV_MULTICODEC, ED25519_PUB_MULTICODEC, RECOGNIZED_SERVICE_TYPES, SignRequestFailureReason, SignRequestVerifyError, VerifiedArtifact, VerifiedContentChain, VerifiedCountersignature, VerifiedCreditClaim, VerifiedCreditEntry, VerifiedRevocation, VerifiedSignRequest, anchorsByLabel, assertCanonicalSignRequestPayload, assertServicesWithinCap, buildSignRequest, classifyAnchor, decodeMultikey, deriveChainIdentifier, deriveContentId, encodeEd25519Multikey, isRecognizedServiceType, relayEndpoints, signArtifact, signContentOperation, signCountersignature, signCreditClaim, signIdentityOperation, signRevocation, verifyArtifact, verifyContentChain, verifyContentExtensionFromTrustedState, verifyCountersignature, verifyCreditClaim, verifyCreditEntry, verifyIdentityChain, verifyIdentityExtensionFromTrustedState, verifyRevocation, verifySignRequest } from './chain/index.js';
 export { AuthTokenCreateOptions, AuthTokenVerificationError, AuthTokenVerifyOptions, VerifiedAuthToken, createAuthToken, verifyAuthToken } from './credentials/index.js';
 export { FoldOperation, INDEX_V1_SCHEMA, IndexDelta, IndexDocument, IndexEntry, LwwDelta, OrderKey, byteCompare, compareHeadPreference, compareLinear, foldIndexV1, foldLwwMap, linearize } from './fold/index.js';

package/dist/index.js

@@ -49,7 +49,7 @@ import {
   verifyIdentityExtensionFromTrustedState,
   verifyRevocation,
   verifySignRequest
-} from "./chunk-Q376VG5Z.js";
+} from "./chunk-W4ESJVMO.js";
 import {
   Attenuation,
   AuthTokenClaims,

package/examples/identity-restore.json

@@ -0,0 +1,21 @@
+{
+  "description": "Identity chain: genesis + key rotation + delete + restore",
+  "type": "identity",
+  "chain": [
+    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmlkZW50aXR5LW9wIiwia2lkIjoia2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgzbm4yOXp2aGUiLCJjaWQiOiJiYWZ5cmVpY29naHZqem52bGl1bG94eG1iZjU0dHB6cXdhaG5xcGlsazduY3hlcGppbmVkcGtnYTNuZSJ9.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiY3JlYXRlIiwiYXV0aEtleXMiOlt7ImlkIjoia2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgzbm4yOXp2aGUiLCJ0eXBlIjoiTXVsdGlrZXkiLCJwdWJsaWNLZXlNdWx0aWJhc2UiOiJ6Nk1rcnpMTU53b0pTVjRQM1ljY1djYnRrOHZkOUx0Z01LbkxlYURMVXFMdUFTamIifV0sImFzc2VydEtleXMiOlt7ImlkIjoia2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgzbm4yOXp2aGUiLCJ0eXBlIjoiTXVsdGlrZXkiLCJwdWJsaWNLZXlNdWx0aWJhc2UiOiJ6Nk1rcnpMTU53b0pTVjRQM1ljY1djYnRrOHZkOUx0Z01LbkxlYURMVXFMdUFTamIifV0sImNvbnRyb2xsZXJLZXlzIjpbeyJpZCI6ImtleV9yOWV2MzRmdmMyM3o5OTl2ZWFhZnQ4M25uMjl6dmhlIiwidHlwZSI6Ik11bHRpa2V5IiwicHVibGljS2V5TXVsdGliYXNlIjoiejZNa3J6TE1Od29KU1Y0UDNZY2NXY2J0azh2ZDlMdGdNS25MZWFETFVxTHVBU2piIn1dLCJjcmVhdGVkQXQiOiIyMDI2LTAzLTA3VDAwOjAwOjAwLjAwMFoifQ.TeznHnzrtKOGTr0FzkDL2z-luMWnAbKXrmDbi-Exgw_xMPCnYwGHORMjw-BM28f0RoTirIAeD7d20W5RSuGuBg",
+    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmlkZW50aXR5LW9wIiwia2lkIjoiZGlkOmRmb3M6Y25ubmZ0OWY4YTJybjkzOGQ2bmt6MzhyODQ3djJrciNrZXlfcjlldjM0ZnZjMjN6OTk5dmVhYWZ0ODNubjI5enZoZSIsImNpZCI6ImJhZnlyZWliZnVoNjN1djMzaTJpNWVvb2UzYm9pdDJydXlqZWh1YnNyeWVtdXV6Nm1ydGxlajI2cmVpIn0.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoidXBkYXRlIiwicHJldmlvdXNPcGVyYXRpb25DSUQiOiJiYWZ5cmVpY29naHZqem52bGl1bG94eG1iZjU0dHB6cXdhaG5xcGlsazduY3hlcGppbmVkcGtnYTNuZSIsImF1dGhLZXlzIjpbeyJpZCI6ImtleV9lejlhODc0dGNrcjNkdjkzM2QzY2tkbjd6NnpyY3Q4IiwidHlwZSI6Ik11bHRpa2V5IiwicHVibGljS2V5TXVsdGliYXNlIjoiejZNa2ZVZDY1SnJBaGZkZ0Z1TUNjY1U5VGhRdmpCMmZKQU1VSGt1dWFqRjk5MmdLIn1dLCJhc3NlcnRLZXlzIjpbeyJpZCI6ImtleV9lejlhODc0dGNrcjNkdjkzM2QzY2tkbjd6NnpyY3Q4IiwidHlwZSI6Ik11bHRpa2V5IiwicHVibGljS2V5TXVsdGliYXNlIjoiejZNa2ZVZDY1SnJBaGZkZ0Z1TUNjY1U5VGhRdmpCMmZKQU1VSGt1dWFqRjk5MmdLIn1dLCJjb250cm9sbGVyS2V5cyI6W3siaWQiOiJrZXlfZXo5YTg3NHRja3IzZHY5MzNkM2NrZG43ejZ6cmN0OCIsInR5cGUiOiJNdWx0aWtleSIsInB1YmxpY0tleU11bHRpYmFzZSI6Ino2TWtmVWQ2NUpyQWhmZGdGdU1DY2NVOVRoUXZqQjJmSkFNVUhrdXVhakY5OTJnSyJ9XSwiY3JlYXRlZEF0IjoiMjAyNi0wMy0wN1QwMDowMTowMC4wMDBaIn0.7fqvWGEVYW9atA1uqpp7lIUOWp4dATLpLjOmFWzJN-8gTL-QnXDCeyGcBu5AXhHzO52fauwUavh1KrB6wBYuCw",
+    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmlkZW50aXR5LW9wIiwia2lkIjoiZGlkOmRmb3M6Y25ubmZ0OWY4YTJybjkzOGQ2bmt6MzhyODQ3djJrciNrZXlfZXo5YTg3NHRja3IzZHY5MzNkM2NrZG43ejZ6cmN0OCIsImNpZCI6ImJhZnlyZWljbDNhMnQ2dmh6NXZndnM1b2pkdzV3Y3dnb3ozdGF4cXF3ZXhwYnBsdG0yZ2gzcTQyenlpIn0.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiZGVsZXRlIiwicHJldmlvdXNPcGVyYXRpb25DSUQiOiJiYWZ5cmVpYmZ1aDYzdXYzM2kyaTVlb29lM2JvaXQycnV5amVodWJzcnllbXV1ejZtcnRsZWoyNnJlaSIsImNyZWF0ZWRBdCI6IjIwMjYtMDMtMDdUMDA6MDI6MDAuMDAwWiJ9.00Dy7qeK7I0hC3P1yvERLJINBLNiEV9LhG8BXdUMIGGLTsxuMcuhn3Yquq96SQa8mzl-BztzD5LMxBohYZxQAg",
+    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmlkZW50aXR5LW9wIiwia2lkIjoiZGlkOmRmb3M6Y25ubmZ0OWY4YTJybjkzOGQ2bmt6MzhyODQ3djJrciNrZXlfZXo5YTg3NHRja3IzZHY5MzNkM2NrZG43ejZ6cmN0OCIsImNpZCI6ImJhZnlyZWlleWF2dWU2dnh6dDYzdWxrcXB3ZXRmd3F2Znpka2VxNnQzcTNnd3JqbnFnaG1panJneWJhIn0.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoicmVzdG9yZSIsInByZXZpb3VzT3BlcmF0aW9uQ0lEIjoiYmFmeXJlaWNsM2EydDZ2aHo1dmd2czVvamR3NXdjd2dvejN0YXhxcXdleHBicGx0bTJnaDNxNDJ6eWkiLCJjcmVhdGVkQXQiOiIyMDI2LTAzLTA3VDAwOjAzOjAwLjAwMFoifQ.lVKZj34IGmyf-0Un7TELSPP3i57gWMe8j5d4d06gFnh8r4hpf5_1VHMUrwwkt7CFnWcd4Ui4CdeXPKS8jpIeAg"
+  ],
+  "expected": {
+    "did": "did:dfos:cnnnft9f8a2rn938d6nkz38r847v2kr",
+    "isDeleted": false,
+    "controllerKeys": [
+      {
+        "id": "key_ez9a874tckr3dv933d3ckdn7z6zrct8",
+        "type": "Multikey",
+        "publicKeyMultibase": "z6MkfUd65JrAhfdgFuMCccU9ThQvjB2fJAMUHkuuajF992gK"
+      }
+    ]
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metalabel/dfos-protocol",
-  "version": "0.27.0",
+  "version": "0.28.1",
   "type": "module",
   "description": "DFOS Protocol — Ed25519 signed chain primitives, services, credentials, and verification",
   "license": "MIT",