@metalabel/dfos-protocol 0.49.0 → 0.51.0

package/README.md

@@ -38,17 +38,14 @@ import { signKeyProof, verifyKeyProof } from '@metalabel/dfos-protocol/key-proof
 
 ## Specifications
 
-| Document                                         | Description                                                                       |
-| ------------------------------------------------ | --------------------------------------------------------------------------------- |
-| [PROTOCOL.md](../../specs/PROTOCOL.md)           | Core protocol — chains, signatures, verification, test vectors                    |
-| [DID-METHOD.md](../../specs/DID-METHOD.md)       | W3C DID method specification for `did:dfos`                                       |
-| [CONTENT-MODEL.md](../../specs/CONTENT-MODEL.md) | Standard content schemas (post, profile)                                          |
-| [CREDENTIALS.md](../../specs/CREDENTIALS.md)     | UCAN-style authorization credentials for the DFOS protocol                        |
-| [CREDITS.md](../../specs/CREDITS.md)             | Verifiable attribution for DFOS content                                           |
-| [SIGNING.md](../../specs/SIGNING.md)             | A transport-agnostic way for one party to ask another to produce a DFOS signature |
-| [SIWD.md](../../specs/SIWD.md)                   | Sign In With DFOS — cryptographic identity verification for third-party apps      |
-| [API-AUTH.md](../../specs/API-AUTH.md)           | Proof-of-possession authentication for credential-gated HTTP APIs                 |
-| [KEY-PROOF.md](../../specs/KEY-PROOF.md)         | Challenge-bound, single-shot proof that a candidate key is held                   |
+| Document                                         | Description                                                                     |
+| ------------------------------------------------ | ------------------------------------------------------------------------------- |
+| [PROTOCOL.md](../../specs/PROTOCOL.md)           | Core protocol — chains, signatures, key possession, verification, test vectors  |
+| [DID-METHOD.md](../../specs/DID-METHOD.md)       | W3C DID method specification for `did:dfos`                                     |
+| [CONTENT-MODEL.md](../../specs/CONTENT-MODEL.md) | Standard content schemas (post, profile) and verifiable attribution             |
+| [CREDENTIALS.md](../../specs/CREDENTIALS.md)     | UCAN-style authorization credentials for the DFOS protocol                      |
+| [RELAY.md](../../specs/RELAY.md)                 | The relay HTTP surface, including the sign-request envelope and signing mailbox |
+| [INTEGRATIONS.md](../../specs/INTEGRATIONS.md)   | Sign in, API authentication, origin binding, and key ceremonies                 |
 
 Release history lives at https://github.com/metalabel/dfos/releases.
 

package/dist/chain/index.d.ts

@@ -1,5 +1,5 @@
-import { I as IdentityOperation, u as Signer, w as VerifiedIdentity, S as ServiceEntry, c as ContentOperation, R as RevocationChecker, d as CountersignPayload, a as ArtifactPayload } from '../dfos-credential-BtiYPqBT.js';
-export { A as ARTIFACT_CID_ANCHOR_RE, C as CONTENT_ID_ANCHOR_RE, f as CreditClaimPayload, g as DeclaredKeyState, h as Iso8601, M as MAX_ARTIFACT_PAYLOAD_SIZE, j as MAX_CREDIT_CLAIM_SIZE, k as MAX_KEY_PROOFS, l as MAX_OPERATION_SIZE, m as MAX_SERVICES_ENTRIES, n as MAX_SERVICES_PAYLOAD_SIZE, o as MAX_SIGN_REQUEST_PAYLOAD_SIZE, p as MAX_SIGN_REQUEST_SIZE, q as MultikeyPublicKey, r as RevocationPayload, s as ServicesArray, t as SignRequestPayload, x as VoidKeyMembership, F as parseProtocolTimestampUnix } from '../dfos-credential-BtiYPqBT.js';
+import { I as IdentityOperation, v as Signer, x as VerifiedIdentity, S as ServiceEntry, c as ContentOperation, R as ResolvedIdentity, r as RevocationChecker, d as CountersignPayload, a as ArtifactPayload } from '../dfos-credential-CtG0_n4P.js';
+export { A as ARTIFACT_CID_ANCHOR_RE, C as CONTENT_ID_ANCHOR_RE, f as CreditClaimPayload, g as DeclaredKeyState, h as Iso8601, M as MAX_ARTIFACT_PAYLOAD_SIZE, j as MAX_CREDIT_CLAIM_SIZE, k as MAX_KEY_PROOFS, l as MAX_OPERATION_SIZE, m as MAX_SERVICES_ENTRIES, n as MAX_SERVICES_PAYLOAD_SIZE, o as MAX_SIGN_REQUEST_PAYLOAD_SIZE, p as MAX_SIGN_REQUEST_SIZE, q as MultikeyPublicKey, s as RevocationPayload, t as ServicesArray, u as SignRequestPayload, y as VoidKeyMembership, G as parseProtocolTimestampUnix } from '../dfos-credential-CtG0_n4P.js';
 import 'zod';
 
 /** Ed25519 public key multicodec value */
@@ -54,13 +54,26 @@ declare const signIdentityOperation: (input: {
  * Verify a log of JWS identity operations and derive the identity
  *
  * Walks the chain from genesis, verifying signatures and chain integrity, and
- * folds the possession proofs alongside. Returns the final verified identity
- * state: EFFECTIVE key arrays, with the declared arrays and the void memberships
+ * folds the possession proofs alongside. Returns the verified identity state:
+ * EFFECTIVE key arrays, with the declared arrays and the void memberships
  * beside them.
+ *
+ * THE BASIS SELECTS WHICH STATE COMES BACK, never how much of the log is
+ * verified. With `asOf` set, the whole log is walked and validated exactly as
+ * without it, and the state returned is the one the last operation dated at or
+ * before the basis folds to — the identity's state as of that instant
+ * (PROTOCOL, Time basis). The comparison is byte-wise on the `createdAt`
+ * strings, per PROTOCOL's Comparison basis. A basis earlier than genesis has no
+ * state to name and throws, and so does an empty basis.
  */
 declare const verifyIdentityChain: (input: {
     didPrefix: string;
     log: string[];
+    /**
+     * Basis time, in the `createdAt` grammar. Omitted = the chain head, which is
+     * the state as of now.
+     */
+    asOf?: string;
 }) => Promise<VerifiedIdentity>;
 /**
  * Verify a single new operation against already-verified identity state
@@ -70,10 +83,13 @@ declare const verifyIdentityChain: (input: {
  * verified genesis). This function performs one signature verification and one
  * state transition — constant time regardless of chain length.
  *
- * Note: key-ID consistency across the full chain history is NOT checked here.
- * That invariant is established during genesis verification and maintained by
- * the protocol's key consistency rules. Periodic full re-verification can
- * audit this property.
+ * KEY-ID CONSISTENCY IS CHECKED HERE, on the same terms as the full walk. The
+ * trusted state carries `seenKeys` — the id-to-material binding the walk already
+ * enforced — so an operation that re-points an existing key id at new material
+ * is REJECTED on this path exactly as a replay of the same two operations would
+ * reject it. Without that the fast path would accept a chain its own
+ * re-verification refuses, and a relay's linear path is the path almost every
+ * operation takes.
  *
  * THE POSSESSION FOLD RUNS HERE TOO, and it needs both halves of the trusted
  * state: the EFFECTIVE arrays (to know what an introduction is a transition out
@@ -164,8 +180,11 @@ declare const signContentOperation: (input: {
  */
 declare const verifyContentChain: (input: {
     log: string[];
-    /** Resolve a kid (DID URL) to the raw Ed25519 public key bytes */
-    resolveKey: (kid: string) => Promise<Uint8Array>;
+    /**
+     * Resolve a kid (DID URL) to the raw Ed25519 public key bytes, in the signing
+     * identity's state as of `basis` — each operation's own `createdAt`.
+     */
+    resolveKey: (kid: string, basis?: string) => Promise<Uint8Array>;
     /**
      * Enforce creator-sovereignty authorization. When true, non-creator signers
      * must include a DFOS credential in the operation's `authorization` field
@@ -173,10 +192,11 @@ declare const verifyContentChain: (input: {
      */
     enforceAuthorization?: boolean;
     /**
-     * Resolve a DID to a VerifiedIdentity. Required when `enforceAuthorization`
-     * is true, as credential verification needs identity resolution.
+     * Resolve a DID to a ResolvedIdentity as of `basis`. Required when
+     * `enforceAuthorization` is true, as credential verification needs identity
+     * resolution.
      */
-    resolveIdentity?: (did: string) => Promise<VerifiedIdentity | undefined>;
+    resolveIdentity?: (did: string, basis?: string) => Promise<ResolvedIdentity | undefined>;
     /**
      * Check whether a credential (leaf or parent) has been revoked. Called with
      * `asOfUnix` = each operation's own `createdAt`, so a fold of committed
@@ -198,12 +218,15 @@ declare const verifyContentExtensionFromTrustedState: (input: {
     lastCreatedAt: string;
     /** The new JWS operation to verify */
     newOp: string;
-    /** Resolve a kid (DID URL) to the raw Ed25519 public key bytes */
-    resolveKey: (kid: string) => Promise<Uint8Array>;
+    /**
+     * Resolve a kid (DID URL) to the raw Ed25519 public key bytes, in the signing
+     * identity's state as of `basis` — the new operation's own `createdAt`.
+     */
+    resolveKey: (kid: string, basis?: string) => Promise<Uint8Array>;
     /** Enforce creator-sovereignty authorization (see verifyContentChain) */
     enforceAuthorization?: boolean;
-    /** Resolve a DID to a VerifiedIdentity. Required when enforceAuthorization is true. */
-    resolveIdentity?: (did: string) => Promise<VerifiedIdentity | undefined>;
+    /** Resolve a DID to a ResolvedIdentity as of `basis`. Required when enforceAuthorization is true. */
+    resolveIdentity?: (did: string, basis?: string) => Promise<ResolvedIdentity | undefined>;
     /**
      * Check whether a credential (leaf or parent) has been revoked. Called with
      * `asOfUnix` = the new operation's own `createdAt`. See `RevocationChecker`.
@@ -242,10 +265,15 @@ declare const signCountersignature: (input: {
  * Checks: valid signature, CID integrity, payload schema. Does NOT check
  * whether the target exists or whether the witness differs from the target
  * author — those are relay-level semantic checks.
+ *
+ * The countersignature's own `createdAt` is the basis: a committed statement
+ * resolves its signer in the state that held when it was signed (PROTOCOL, Time
+ * basis).
  */
 declare const verifyCountersignature: (input: {
     jwsToken: string;
-    resolveKey: (kid: string) => Promise<Uint8Array>;
+    /** Resolve a kid to key bytes in the signer's state as of `basis`. */
+    resolveKey: (kid: string, basis?: string) => Promise<Uint8Array>;
 }) => Promise<VerifiedCountersignature>;
 
 interface VerifiedArtifact {
@@ -267,10 +295,14 @@ declare const signArtifact: (input: {
 }>;
 /**
  * Verify an artifact JWS — signature, CID, payload schema, size limit
+ *
+ * The artifact's own `createdAt` is the basis: a committed statement resolves
+ * its signer in the state that held when it was signed (PROTOCOL, Time basis).
  */
 declare const verifyArtifact: (input: {
     jwsToken: string;
-    resolveKey: (kid: string) => Promise<Uint8Array>;
+    /** Resolve a kid to key bytes in the signer's state as of `basis`. */
+    resolveKey: (kid: string, basis?: string) => Promise<Uint8Array>;
 }) => Promise<VerifiedArtifact>;
 
 interface VerifiedRevocation {
@@ -299,10 +331,14 @@ declare const signRevocation: (input: {
 }>;
 /**
  * Verify a revocation JWS — signature, CID, payload schema, signer match
+ *
+ * The revocation's own `createdAt` is the basis: a committed statement resolves
+ * its signer in the state that held when it was signed (PROTOCOL, Time basis).
  */
 declare const verifyRevocation: (input: {
     jwsToken: string;
-    resolveKey: (kid: string) => Promise<Uint8Array>;
+    /** Resolve a kid to key bytes in the signer's state as of `basis`. */
+    resolveKey: (kid: string, basis?: string) => Promise<Uint8Array>;
 }) => Promise<VerifiedRevocation>;
 
 interface VerifiedCreditClaim {
@@ -322,7 +358,7 @@ interface VerifiedCreditClaim {
     claimCID: string;
 }
 /**
- * The four states a `credits[]` entry resolves to (see `specs/CREDITS.md`).
+ * The four states a `credits[]` entry resolves to (see `specs/CONTENT-MODEL.md`).
  *
  * `invalid` and `unverifiable` are deliberately distinct and MUST NOT be
  * collapsed: `invalid` means "checked and failed" (a positive signal that

package/dist/chain/index.js

@@ -52,8 +52,8 @@ import {
   verifyIdentityExtensionFromTrustedState,
   verifyRevocation,
   verifySignRequest
-} from "../chunk-ZRA7FRBE.js";
-import "../chunk-D4IZXFPM.js";
+} from "../chunk-LMAPBTDW.js";
+import "../chunk-T2YR5KWQ.js";
 import "../chunk-JVSC67DC.js";
 import {
   ED25519_PRIV_MULTICODEC,

package/dist/{chunk-ZRA7FRBE.js → chunk-LMAPBTDW.js}

@@ -1,10 +1,12 @@
 import {
   MAX_CREDENTIAL_SIZE,
+  carryDependencyMissing,
   decodeDFOSCredentialUnsafe,
+  markDependencyMissing,
   matchesResource,
   verifyDFOSCredential,
   verifyDelegationChain
-} from "./chunk-D4IZXFPM.js";
+} from "./chunk-T2YR5KWQ.js";
 import {
   KEY_ADD_JWS_TYP,
   KEY_ROLES,
@@ -100,7 +102,7 @@ var IdentityUpdate = z.looseObject({
   createdAt: Iso8601,
   /**
    * POSSESSION PROOFS FOR THE KEYS THIS OPERATION INTRODUCES — compact key-proof
-   * JWS strings (specs/KEY-PROOF.md), each signed by the key it speaks for.
+   * JWS strings (specs/PROTOCOL.md § Key possession), each signed by the key it speaks for.
    *
    * Optional, and optional in the CID-neutral sense: omitting it encodes
    * identically to an operation that never had it (undefined strips under
@@ -186,7 +188,31 @@ var VerifiedIdentity = z.strictObject({
    * re-deriving it from the raw log under a declared-state rule that quietly
    * disagrees with this one.
    */
-  provedKeys: DeclaredKeyState.optional()
+  provedKeys: DeclaredKeyState.optional(),
+  /**
+   * HAS-EVER-BEEN-DECLARED, as a key-id-to-material binding: one entry per key
+   * id the chain has ever written, carrying the Multikey that id went in with,
+   * in the order the walk first saw it.
+   *
+   * A KEY ID IS BOUND TO ONE KEY FOR THE LIFE OF A CHAIN. The full walk enforces
+   * that chain-wide and rejects the operation that breaks it — the id is a
+   * stable name, so re-pointing it at new material would silently re-aim every
+   * artifact that ever referenced it. The incremental extension verifier has no
+   * log to re-scan, so it needs the binding handed to it, and this member is how
+   * it arrives: with it, the fast path returns the SAME verdict as a full replay
+   * on the same operation, which is the property that keeps a relay's linear
+   * path from accepting a chain its own re-verification would refuse.
+   *
+   * Broader than `declared` and than `provedKeys` on purpose. The rule covers
+   * every id the chain wrote, including one declared into a void membership and
+   * later dropped — neither of the other two members remembers that id, and it
+   * is exactly the id an attacker would reuse.
+   *
+   * Optional because a caller may hand the extension verifier a hand-built or
+   * older state. Absent, the binding is read off `declared` and `provedKeys`,
+   * which is complete for any chain that never dropped an unproved key id.
+   */
+  seenKeys: z.array(MultikeyPublicKey).optional()
 });
 var ContentCreate = z.looseObject({
   version: z.literal(1),
@@ -331,7 +357,9 @@ var unionProved = (into, next) => {
   return merged;
 };
 var foldEffectiveKeyState = (input) => {
-  const carried = (role, key) => input.priorEffective[ROLE_ARRAY[role]].some((prior) => prior.id === key.id);
+  const carried = (role, key) => input.priorEffective[ROLE_ARRAY[role]].some(
+    (prior) => prior.id === key.id && prior.type === key.type && prior.publicKeyMultibase === key.publicKeyMultibase
+  );
   const introduced = /* @__PURE__ */ new Map();
   for (const role of KEY_ROLES) {
     for (const key of input.declared[ROLE_ARRAY[role]]) {
@@ -377,6 +405,26 @@ var foldEffectiveKeyState = (input) => {
   }
   return { effective, voidKeys };
 };
+var admitKeyMaterial = (index, keys) => {
+  for (const key of keys) {
+    const existing = index.get(key.id);
+    if (!existing) {
+      index.set(key.id, key);
+    } else if (existing.publicKeyMultibase !== key.publicKeyMultibase || existing.type !== key.type) {
+      throw new Error(`key ${key.id} type or public key inconsistency`);
+    }
+  }
+};
+var keyMaterialIndex = (keys) => {
+  const index = /* @__PURE__ */ new Map();
+  for (const key of keys) if (!index.has(key.id)) index.set(key.id, key);
+  return index;
+};
+var flatKeys = (state) => [
+  ...state.authKeys,
+  ...state.assertKeys,
+  ...state.controllerKeys
+];
 var assertSingleKeyGenesis = (op) => {
   if (op.authKeys.length !== 1 || op.assertKeys.length !== 1 || op.controllerKeys.length !== 1) {
     throw new Error("create must declare exactly one key in each of auth, assert and controller");
@@ -405,6 +453,7 @@ var signIdentityOperation = async (input) => {
 };
 var verifyIdentityChain = async (input) => {
   if (input.log.length === 0) throw new Error("log must have at least one operation");
+  if (input.asOf === "") throw new Error("basis must not be empty");
   const state = {
     did: void 0,
     isDeleted: false,
@@ -420,6 +469,7 @@ var verifyIdentityChain = async (input) => {
     services: [],
     seenKeys: /* @__PURE__ */ new Map()
   };
+  let asOfState;
   for (const [idx, jwsToken] of input.log.entries()) {
     const decoded = decodeJwsUnsafe(jwsToken);
     if (!decoded) throw new Error(`log[${idx}]: failed to decode JWS`);
@@ -470,19 +520,15 @@ var verifyIdentityChain = async (input) => {
       }
     }
     if (op.type === "create" || op.type === "update") {
-      const incomingKeys = [...op.authKeys, ...op.assertKeys, ...op.controllerKeys];
-      const currentKeys = [
-        ...state.declared.authKeys,
-        ...state.declared.assertKeys,
-        ...state.declared.controllerKeys
-      ];
-      for (const k of [...currentKeys, ...incomingKeys]) {
-        const existing = state.seenKeys.get(k.id);
-        if (!existing) {
-          state.seenKeys.set(k.id, k);
-        } else if (existing.publicKeyMultibase !== k.publicKeyMultibase || existing.type !== k.type) {
-          throw new Error(`log[${idx}]: key ${k.id} type or public key inconsistency`);
-        }
+      try {
+        admitKeyMaterial(state.seenKeys, [
+          ...flatKeys(state.declared),
+          ...op.authKeys,
+          ...op.assertKeys,
+          ...op.controllerKeys
+        ]);
+      } catch (e) {
+        throw new Error(`log[${idx}]: ${e.message}`);
       }
       [op.authKeys, op.assertKeys, op.controllerKeys].forEach((keys) => {
         const set = new Set(keys.map((k) => k.id));
@@ -576,8 +622,26 @@ var verifyIdentityChain = async (input) => {
         state.isDeleted = false;
         break;
     }
+    if (input.asOf !== void 0 && op.createdAt <= input.asOf) {
+      asOfState = {
+        did,
+        isDeleted: state.isDeleted,
+        authKeys: state.effective.authKeys,
+        assertKeys: state.effective.assertKeys,
+        controllerKeys: state.effective.controllerKeys,
+        services: state.services,
+        declared: state.declared,
+        voidKeys: state.voidKeys,
+        provedKeys: state.provedKeys,
+        seenKeys: [...state.seenKeys.values()]
+      };
+    }
   }
   if (!state.did) throw new Error("did is not set");
+  if (input.asOf !== void 0) {
+    if (!asOfState) throw new Error(`identity has no state as of ${input.asOf}`);
+    return asOfState;
+  }
   return {
     did: state.did,
     isDeleted: state.isDeleted,
@@ -588,7 +652,10 @@ var verifyIdentityChain = async (input) => {
     services: state.services,
     declared: state.declared,
     voidKeys: state.voidKeys,
-    provedKeys: state.provedKeys
+    provedKeys: state.provedKeys,
+    // The id-to-material binding the walk enforced, handed on so an incremental
+    // extension of this state can enforce the identical rule without the log.
+    seenKeys: [...state.seenKeys.values()]
   };
 };
 var verifyIdentityExtensionFromTrustedState = async (input) => {
@@ -596,6 +663,10 @@ var verifyIdentityExtensionFromTrustedState = async (input) => {
   const priorEffective = keyStateOf(currentState);
   const priorDeclared = currentState.declared ?? priorEffective;
   const priorProved = currentState.provedKeys ?? priorEffective;
+  const seenKeys = keyMaterialIndex(
+    currentState.seenKeys ?? [...flatKeys(priorDeclared), ...flatKeys(priorProved)]
+  );
+  const priorSeenKeys = [...seenKeys.values()];
   const decoded = decodeJwsUnsafe(newOp);
   if (!decoded) throw new Error("failed to decode JWS");
   const result = IdentityOperation.safeParse(decoded.payload);
@@ -651,6 +722,7 @@ var verifyIdentityExtensionFromTrustedState = async (input) => {
     throw new Error("invalid signature");
   }
   if (op.type === "update") {
+    admitKeyMaterial(seenKeys, [...op.authKeys, ...op.assertKeys, ...op.controllerKeys]);
     [op.authKeys, op.assertKeys, op.controllerKeys].forEach((keys) => {
       const set = new Set(keys.map((k) => k.id));
       if (set.size !== keys.length) {
@@ -680,7 +752,8 @@ var verifyIdentityExtensionFromTrustedState = async (input) => {
           services: op.services ?? [],
           declared,
           voidKeys: folded.voidKeys,
-          provedKeys: unionProved(priorProved, folded.effective)
+          provedKeys: unionProved(priorProved, folded.effective),
+          seenKeys: [...seenKeys.values()]
         };
       }
       // delete and restore introduce nothing, so both key states — and the void
@@ -695,7 +768,8 @@ var verifyIdentityExtensionFromTrustedState = async (input) => {
           services: currentState.services,
           declared: priorDeclared,
           voidKeys: currentState.voidKeys ?? [],
-          provedKeys: priorProved
+          provedKeys: priorProved,
+          seenKeys: priorSeenKeys
         };
       case "restore":
         return {
@@ -707,7 +781,8 @@ var verifyIdentityExtensionFromTrustedState = async (input) => {
           services: currentState.services,
           declared: priorDeclared,
           voidKeys: currentState.voidKeys ?? [],
-          provedKeys: priorProved
+          provedKeys: priorProved,
+          seenKeys: priorSeenKeys
         };
     }
   })();
@@ -748,7 +823,7 @@ var verifyOperationAuthorization = async (input) => {
   const opCreatedAtUnix = Math.floor(new Date(input.createdAt).getTime() / 1e3);
   const credential = await verifyDFOSCredential(input.authorization, {
     resolveIdentity: input.resolveIdentity,
-    now: opCreatedAtUnix
+    basis: input.createdAt
   });
   if (input.isRevoked && await input.isRevoked(credential.iss, credential.credentialCID, opCreatedAtUnix)) {
     throw new Error("credential is revoked");
@@ -756,8 +831,8 @@ var verifyOperationAuthorization = async (input) => {
   await verifyDelegationChain(credential, {
     resolveIdentity: input.resolveIdentity,
     rootDID: input.creatorDID,
-    now: opCreatedAtUnix,
-    ...input.isRevoked ? { isRevoked: input.isRevoked, asOfUnix: opCreatedAtUnix } : {}
+    basis: input.createdAt,
+    ...input.isRevoked ? { isRevoked: input.isRevoked } : {}
   });
   if (credential.aud !== "*" && credential.aud !== input.operationDID) {
     throw new Error(
@@ -819,7 +894,7 @@ var verifyContentChain = async (input) => {
     if (kidDid !== op.did) {
       throw new Error(`log[${idx}]: kid DID does not match operation did`);
     }
-    const publicKey = await input.resolveKey(kid);
+    const publicKey = await input.resolveKey(kid, op.createdAt);
     try {
       verifyJws({ token: jwsToken, publicKey });
     } catch {
@@ -846,7 +921,10 @@ var verifyContentChain = async (input) => {
         });
       } catch (err) {
         const message = err instanceof Error ? err.message : "unknown error";
-        throw new Error(`log[${idx}]: authorization verification failed: ${message}`);
+        throw carryDependencyMissing(
+          err,
+          new Error(`log[${idx}]: authorization verification failed: ${message}`)
+        );
       }
     }
     const encoded = await dagCborCanonicalEncode(op);
@@ -926,7 +1004,7 @@ var verifyContentExtensionFromTrustedState = async (input) => {
   if (kidDid !== op.did) {
     throw new Error("kid DID does not match operation did");
   }
-  const publicKey = await resolveKey(kid);
+  const publicKey = await resolveKey(kid, op.createdAt);
   try {
     verifyJws({ token: newOp, publicKey });
   } catch {
@@ -951,7 +1029,7 @@ var verifyContentExtensionFromTrustedState = async (input) => {
       });
     } catch (err) {
       const message = err instanceof Error ? err.message : "unknown error";
-      throw new Error(`authorization verification failed: ${message}`);
+      throw carryDependencyMissing(err, new Error(`authorization verification failed: ${message}`));
     }
   }
   const encoded = await dagCborCanonicalEncode(op);
@@ -1004,7 +1082,7 @@ var verifyCountersignature = async (input) => {
   if (kidDid !== payload.did) {
     throw new Error("countersignature kid DID does not match payload did");
   }
-  const publicKey = await input.resolveKey(kid);
+  const publicKey = await input.resolveKey(kid, payload.createdAt);
   try {
     verifyJws({ token: input.jwsToken, publicKey });
   } catch {
@@ -1057,7 +1135,7 @@ var verifyArtifact = async (input) => {
   if (kidDid !== payload.did) {
     throw new Error("artifact kid DID does not match payload did");
   }
-  const publicKey = await input.resolveKey(kid);
+  const publicKey = await input.resolveKey(kid, payload.createdAt);
   try {
     verifyJws({ token: input.jwsToken, publicKey });
   } catch {
@@ -1114,7 +1192,7 @@ var verifyRevocation = async (input) => {
   if (kidDid !== payload.did) {
     throw new Error("revocation kid DID does not match payload did");
   }
-  const publicKey = await input.resolveKey(kid);
+  const publicKey = await input.resolveKey(kid, payload.createdAt);
   try {
     verifyJws({ token: input.jwsToken, publicKey });
   } catch {
@@ -1151,7 +1229,7 @@ var resolveKeyFromIdentity = (identity, kid) => {
   const allKeys = [...identity.authKeys, ...identity.assertKeys, ...identity.controllerKeys];
   const key = allKeys.find((k) => k.id === keyId);
   if (!key) {
-    throw invalid(`key ${keyId} not found on identity ${identity.did}`);
+    throw markDependencyMissing(invalid(`key ${keyId} not found on identity ${identity.did}`));
   }
   const { keyBytes } = decodeMultikey(key.publicKeyMultibase);
   return keyBytes;
@@ -1241,7 +1319,7 @@ var verifyCreditClaim = async (jwsToken, options) => {
     throw unverifiable(`could not resolve claimant identity ${payload.did}: ${detail}`);
   }
   if (!identity) {
-    throw unverifiable(`claimant identity not found: ${payload.did}`);
+    throw markDependencyMissing(unverifiable(`claimant identity not found: ${payload.did}`));
   }
   const publicKey = resolveKeyFromIdentity(identity, kid);
   try {

package/dist/{chunk-D4IZXFPM.js → chunk-T2YR5KWQ.js}

@@ -364,19 +364,32 @@ var verifyProofEnvelope = async (input, shape, resolvePresenter) => {
 var verifyIdentityProofEnvelope = (input, resolvePresenter) => verifyProofEnvelope(input, IDENTITY_PROOF_SHAPE, resolvePresenter);
 var verifyRequestProofEnvelope = (input, resolvePresenter) => verifyProofEnvelope(input, REQUEST_PROOF_SHAPE, resolvePresenter);
 
+// src/dependency.ts
+var markDependencyMissing = (err) => Object.assign(err, { dependencyMissing: true });
+var isDependencyMissing = (err) => err instanceof Error && err.dependencyMissing === true;
+var carryDependencyMissing = (cause, wrapped) => isDependencyMissing(cause) ? markDependencyMissing(wrapped) : wrapped;
+
 // src/credentials/dfos-credential.ts
-var resolveKeyFromIdentity = (identity, kid) => {
+var resolveKeyFromIdentity = (identity, kid, determinate) => {
   const hashIdx = kid.indexOf("#");
   if (hashIdx < 0) throw new CredentialVerificationError("kid must be a DID URL");
   const keyId = kid.substring(hashIdx + 1);
   const allKeys = [...identity.authKeys, ...identity.assertKeys, ...identity.controllerKeys];
   const key = allKeys.find((k) => k.id === keyId);
   if (!key) {
-    throw new CredentialVerificationError(`key ${keyId} not found on identity ${identity.did}`);
+    const miss = new CredentialVerificationError(
+      `unknown key ${keyId} on identity ${identity.did}`
+    );
+    throw determinate ? miss : markDependencyMissing(miss);
   }
   const { keyBytes } = decodeMultikey(key.publicKeyMultibase);
   return keyBytes;
 };
+var basisUnixSeconds = (basis) => {
+  const ms = Date.parse(basis);
+  if (Number.isNaN(ms)) throw new CredentialVerificationError(`invalid basis time: ${basis}`);
+  return Math.floor(ms / 1e3);
+};
 var createDFOSCredential = async (options) => {
   const kid = `${options.issuerDID}#${options.keyId}`;
   const now = options.iat ?? Math.floor(Date.now() / 1e3);
@@ -428,14 +441,16 @@ var verifyDFOSCredential = async (jwsToken, options) => {
   if (kidDid !== payload.iss) {
     throw new CredentialVerificationError("credential kid DID does not match iss");
   }
-  const identity = await options.resolveIdentity(payload.iss);
+  const identity = await options.resolveIdentity(payload.iss, options.basis);
   if (!identity) {
-    throw new CredentialVerificationError(`issuer identity not found: ${payload.iss}`);
+    throw markDependencyMissing(
+      new CredentialVerificationError(`issuer identity not found: ${payload.iss}`)
+    );
   }
   if (identity.isDeleted) {
     throw new CredentialVerificationError(`issuer identity is deleted: ${payload.iss}`);
   }
-  const publicKey = resolveKeyFromIdentity(identity, kid);
+  const publicKey = resolveKeyFromIdentity(identity, kid, identity.basisDeterminate === true);
   try {
     verifyJws({ token: jwsToken, publicKey });
   } catch {
@@ -449,11 +464,8 @@ var verifyDFOSCredential = async (jwsToken, options) => {
   if (decoded.header.cid !== credentialCID) {
     throw new CredentialVerificationError("credential cid mismatch");
   }
-  const now = options.now ?? Math.floor(Date.now() / 1e3);
-  if (payload.iat > now) {
-    throw new CredentialVerificationError("credential not yet valid (iat is in the future)");
-  }
-  if (payload.exp <= now) {
+  const basisSeconds = options.basis !== void 0 ? basisUnixSeconds(options.basis) : options.nowUnix ?? Math.floor(Date.now() / 1e3);
+  if (payload.exp <= basisSeconds) {
     throw new CredentialVerificationError("credential expired");
   }
   return {
@@ -469,6 +481,7 @@ var verifyDFOSCredential = async (jwsToken, options) => {
 };
 var verifyDelegationChain = async (credential, options) => {
   const chain = [credential];
+  const revocationBasis = options.basis !== void 0 ? basisUnixSeconds(options.basis) : void 0;
   let current = credential;
   const maxDepth = 16;
   for (let depth = 0; depth < maxDepth; depth++) {
@@ -487,10 +500,11 @@ var verifyDelegationChain = async (credential, options) => {
     }
     const parent = await verifyDFOSCredential(current.prf[0], {
       resolveIdentity: options.resolveIdentity,
-      ...options.now !== void 0 ? { now: options.now } : {}
+      ...options.basis !== void 0 ? { basis: options.basis } : {},
+      ...options.nowUnix !== void 0 ? { nowUnix: options.nowUnix } : {}
     });
     if (options.isRevoked) {
-      const revoked = await options.isRevoked(parent.iss, parent.credentialCID, options.asOfUnix);
+      const revoked = await options.isRevoked(parent.iss, parent.credentialCID, revocationBasis);
       if (revoked) {
         throw new CredentialVerificationError("parent credential in delegation chain is revoked");
       }
@@ -594,6 +608,9 @@ var CredentialVerificationError = class extends Error {
 };
 
 export {
+  markDependencyMissing,
+  isDependencyMissing,
+  carryDependencyMissing,
   MAX_CREDENTIAL_SIZE,
   Attenuation,
   DFOSCredentialPayload,

package/dist/credentials/index.d.ts

@@ -1,4 +1,4 @@
-export { b as Attenuation, e as CredentialVerificationError, D as DFOSCredentialPayload, i as MAX_CREDENTIAL_SIZE, R as RevocationChecker, V as VerifiedDFOSCredential, v as VerifiedDelegationChain, y as createDFOSCredential, z as decodeDFOSCredentialUnsafe, B as isAttenuated, E as matchesResource, G as verifyDFOSCredential, H as verifyDelegationChain } from '../dfos-credential-BtiYPqBT.js';
+export { b as Attenuation, e as CredentialVerificationError, D as DFOSCredentialPayload, i as MAX_CREDENTIAL_SIZE, R as ResolvedIdentity, r as RevocationChecker, V as VerifiedDFOSCredential, w as VerifiedDelegationChain, z as createDFOSCredential, B as decodeDFOSCredentialUnsafe, E as isAttenuated, F as matchesResource, H as verifyDFOSCredential, J as verifyDelegationChain } from '../dfos-credential-CtG0_n4P.js';
 import 'zod';
 
 /**

package/dist/credentials/index.js

@@ -34,7 +34,7 @@ import {
   verifyDelegationChain,
   verifyIdentityProofEnvelope,
   verifyRequestProofEnvelope
-} from "../chunk-D4IZXFPM.js";
+} from "../chunk-T2YR5KWQ.js";
 import "../chunk-IDVYITX7.js";
 import "../chunk-4LG2GEB2.js";
 export {

package/dist/{dfos-credential-BtiYPqBT.d.ts → dfos-credential-CtG0_n4P.d.ts}

@@ -294,6 +294,11 @@ declare const VerifiedIdentity: z.ZodObject<{
             publicKeyMultibase: z.ZodString;
         }, z.core.$loose>>;
     }, z.core.$strict>>;
+    seenKeys: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        type: z.ZodLiteral<"Multikey">;
+        publicKeyMultibase: z.ZodString;
+    }, z.core.$loose>>>;
 }, z.core.$strict>;
 type VerifiedIdentity = z.infer<typeof VerifiedIdentity>;
 declare const ContentOperation: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -377,7 +382,7 @@ declare const MAX_CREDIT_CLAIM_SIZE = 4096;
  * Credit claim: a claimant's signed assertion that it holds a named role on a
  * content chain. A document-plane artifact — it is NOT gossiped and relays are not
  * credit-claim aware; a claim travels inside the document bytes that embed it (see
- * `specs/CREDITS.md`).
+ * `specs/CONTENT-MODEL.md`).
  *
  * `contentId` is the binder — the STABLE 31-char content chain id, never a
  * documentCID or a chain head CID. Binding to the chain (not a document) is what
@@ -500,6 +505,24 @@ interface VerifiedDFOSCredential {
     /** kid from the JWS header */
     signerKeyId: string;
 }
+/**
+ * The identity a resolver answers with, plus the one fact about that answer only
+ * the resolver knows: whether it is FINAL for the basis it was asked about.
+ *
+ * A resolver whose copy of the chain runs past the basis answers determinately,
+ * and a key missing from that state is a verdict. A resolver answering from a
+ * copy that ends at or before the basis does not: an operation dated at or
+ * before the basis can still arrive and add the key, so the miss is a dependency
+ * miss the caller retries. Absent is the retryable reading, which is the safe
+ * default: only a resolver that can say its answer is final gets a verdict.
+ */
+type ResolvedIdentity = VerifiedIdentity & {
+    /**
+     * True when no operation dated at or before the basis can still arrive and
+     * change this key state.
+     */
+    basisDeterminate?: boolean;
+};
 interface VerifiedDelegationChain {
     /** The leaf credential */
     credential: VerifiedDFOSCredential;
@@ -512,8 +535,8 @@ interface VerifiedDelegationChain {
  * Check whether a credential (leaf or any parent) has been revoked.
  *
  * `asOfUnix` selects WHICH question is being asked, and the two are different
- * decisions: **acceptance is a freshness decision; verification of committed
- * history is a validity decision.**
+ * decisions: **acceptance is a freshness decision; verification at a basis is a
+ * validity decision.**
  *
  * - **Omitted, or `<= 0` (timeless)** — "is this credential revoked as far as you
  *   know right now?". The freshness question. Used by acceptance gates: relay
@@ -524,10 +547,10 @@ interface VerifiedDelegationChain {
  *   1970) therefore gets the stricter answer in both languages.
  * - **Positive (as-of)** — "was this credential already revoked at `asOfUnix`?".
  *   The validity question. Return true only if a revocation exists AND its
- *   signed `createdAt` is ≤ `asOfUnix`. Used when verifying operations already
- *   committed to a chain, where `asOfUnix` is the operation's own `createdAt`.
- *   A revocation signed AFTER an operation does not invalidate it — see
- *   CREDENTIALS.md "Revocation Scope".
+ *   signed `createdAt` is ≤ `asOfUnix`. Used when verifying an artifact against
+ *   a basis, where `asOfUnix` is the basis in integer Unix seconds. A revocation
+ *   signed AFTER the basis does not invalidate the artifact — see CREDENTIALS.md
+ *   "Revocation against the basis".
  *
  * An implementation that ignores `asOfUnix` degrades to the timeless answer,
  * which is always the stricter (safe) direction — it can only reject history
@@ -559,13 +582,35 @@ declare const createDFOSCredential: (options: {
 /**
  * Verify a DFOS credential — signature, schema, expiry, CID integrity
  *
+ * Every check runs against ONE basis time (PROTOCOL, Time basis): the issuer's
+ * key must be effective in the identity's state as of the basis, and `exp` must
+ * be strictly greater than the basis in integer Unix seconds. `iat` is
+ * informational and gates nothing.
+ *
  * Does NOT verify the delegation chain. Use `verifyDelegationChain` for full
  * chain verification including attenuation enforcement.
  */
 declare const verifyDFOSCredential: (jwsToken: string, options: {
-    resolveIdentity: (did: string) => Promise<VerifiedIdentity | undefined>;
-    /** Current time in seconds (defaults to Date.now() / 1000) */
-    now?: number;
+    /**
+     * Resolve a DID to its verified identity state AS OF `basis`. Called with
+     * the basis this verification runs at, or with none when the presentation is
+     * ephemeral and the answer is head state. A resolver that knows its answer
+     * is final for the basis says so on the result (`ResolvedIdentity`).
+     */
+    resolveIdentity: (did: string, basis?: string) => Promise<ResolvedIdentity | undefined>;
+    /**
+     * The basis time, in the `createdAt` grammar — the operation's own
+     * `createdAt` for a credential carried inline in a committed operation.
+     * Omitted for an ephemeral presentation, where the basis is now.
+     */
+    basis?: string;
+    /**
+     * The ephemeral clock in integer Unix seconds, for a caller that carries its
+     * own. It reaches `exp` and nothing else: key resolution on the ephemeral
+     * path is head state, which is what "the basis is now" means. Ignored when
+     * `basis` is present, and defaults to `floor(Date.now() / 1000)`.
+     */
+    nowUnix?: number;
 }) => Promise<VerifiedDFOSCredential>;
 /**
  * Verify a full delegation chain — walk `prf`, confirm monotonic attenuation,
@@ -578,23 +623,29 @@ declare const verifyDFOSCredential: (jwsToken: string, options: {
  *
  * The chain terminates when a credential has `prf: []` (root credential). The
  * root credential's `iss` must equal `rootDID`.
+ *
+ * ONE BASIS FOR THE WHOLE WALK. Every hop — each parent's signing key, each
+ * `exp`, each revocation — resolves against the same basis the leaf did, so a
+ * chain either held at that instant or it did not.
  */
 declare const verifyDelegationChain: (credential: VerifiedDFOSCredential, options: {
-    resolveIdentity: (did: string) => Promise<VerifiedIdentity | undefined>;
+    /** Resolve a DID to its verified identity state as of `basis`. */
+    resolveIdentity: (did: string, basis?: string) => Promise<ResolvedIdentity | undefined>;
     /** The expected root authority DID (e.g., content chain creator) */
     rootDID: string;
-    /** Current time in seconds (defaults to Date.now() / 1000) */
-    now?: number;
     /** Check if a credential has been revoked (checked at every level of the chain) */
     isRevoked?: RevocationChecker;
     /**
-     * As-of basis for the revocation check, unix seconds. Kept SEPARATE from
-     * `now` (the expiry basis) on purpose: expiry and revocation are two
-     * different decisions, and a caller evaluating expiry against a deterministic
-     * basis does not automatically want history-relative revocation. Omitted =
-     * timeless revocation (current knowledge). See `RevocationChecker`.
+     * The basis time, in the `createdAt` grammar. Omitted for an ephemeral
+     * presentation: `exp` runs against the wall clock and revocation is asked
+     * timelessly, which is the stricter direction (see `RevocationChecker`).
+     */
+    basis?: string;
+    /**
+     * The ephemeral clock in integer Unix seconds, threaded to every hop's `exp`
+     * and nothing else. Ignored when `basis` is present.
      */
-    asOfUnix?: number;
+    nowUnix?: number;
 }) => Promise<VerifiedDelegationChain>;
 /**
  * Check if `childAtt` is a valid attenuation of `parentAtt`
@@ -639,4 +690,4 @@ declare class CredentialVerificationError extends Error {
     constructor(message: string);
 }
 
-export { ARTIFACT_CID_ANCHOR_RE as A, isAttenuated as B, CONTENT_ID_ANCHOR_RE as C, DFOSCredentialPayload as D, matchesResource as E, parseProtocolTimestampUnix as F, verifyDFOSCredential as G, verifyDelegationChain as H, IdentityOperation as I, MAX_ARTIFACT_PAYLOAD_SIZE as M, type RevocationChecker as R, ServiceEntry as S, type VerifiedDFOSCredential as V, ArtifactPayload as a, Attenuation as b, ContentOperation as c, CountersignPayload as d, CredentialVerificationError as e, CreditClaimPayload as f, DeclaredKeyState as g, Iso8601 as h, MAX_CREDENTIAL_SIZE as i, MAX_CREDIT_CLAIM_SIZE as j, MAX_KEY_PROOFS as k, MAX_OPERATION_SIZE as l, MAX_SERVICES_ENTRIES as m, MAX_SERVICES_PAYLOAD_SIZE as n, MAX_SIGN_REQUEST_PAYLOAD_SIZE as o, MAX_SIGN_REQUEST_SIZE as p, MultikeyPublicKey as q, RevocationPayload as r, ServicesArray as s, SignRequestPayload as t, type Signer as u, type VerifiedDelegationChain as v, VerifiedIdentity as w, VoidKeyMembership as x, createDFOSCredential as y, decodeDFOSCredentialUnsafe as z };
+export { ARTIFACT_CID_ANCHOR_RE as A, decodeDFOSCredentialUnsafe as B, CONTENT_ID_ANCHOR_RE as C, DFOSCredentialPayload as D, isAttenuated as E, matchesResource as F, parseProtocolTimestampUnix as G, verifyDFOSCredential as H, IdentityOperation as I, verifyDelegationChain as J, MAX_ARTIFACT_PAYLOAD_SIZE as M, type ResolvedIdentity as R, ServiceEntry as S, type VerifiedDFOSCredential as V, ArtifactPayload as a, Attenuation as b, ContentOperation as c, CountersignPayload as d, CredentialVerificationError as e, CreditClaimPayload as f, DeclaredKeyState as g, Iso8601 as h, MAX_CREDENTIAL_SIZE as i, MAX_CREDIT_CLAIM_SIZE as j, MAX_KEY_PROOFS as k, MAX_OPERATION_SIZE as l, MAX_SERVICES_ENTRIES as m, MAX_SERVICES_PAYLOAD_SIZE as n, MAX_SIGN_REQUEST_PAYLOAD_SIZE as o, MAX_SIGN_REQUEST_SIZE as p, MultikeyPublicKey as q, type RevocationChecker as r, RevocationPayload as s, ServicesArray as t, SignRequestPayload as u, type Signer as v, type VerifiedDelegationChain as w, VerifiedIdentity as x, VoidKeyMembership as y, createDFOSCredential as z };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { JwsHeader, JwsVerificationError, JwtClaims, JwtCreateOptions, JwtHeader, JwtVerificationError, JwtVerifyOptions, PrefixedID, assertJwsProfile, base64urlDecode, base64urlEncode, createJws, createJwt, createNewEd25519Keypair, dagCborCanonicalEncode, decodeJwsUnsafe, decodeJwtUnsafe, generateId, generateIdNoPrefix, importEd25519Keypair, isCanonicallyEqual, isValidEd25519Signature, isValidId, normalizedId, parseDagCborCID, sha256, signPayloadEd25519, verifyJws, verifyJwt } from './crypto/index.js';
-export { A as ARTIFACT_CID_ANCHOR_RE, a as ArtifactPayload, b as Attenuation, C as CONTENT_ID_ANCHOR_RE, c as ContentOperation, d as CountersignPayload, e as CredentialVerificationError, f as CreditClaimPayload, D as DFOSCredentialPayload, g as DeclaredKeyState, I as IdentityOperation, h as Iso8601, M as MAX_ARTIFACT_PAYLOAD_SIZE, i as MAX_CREDENTIAL_SIZE, j as MAX_CREDIT_CLAIM_SIZE, k as MAX_KEY_PROOFS, l as MAX_OPERATION_SIZE, m as MAX_SERVICES_ENTRIES, n as MAX_SERVICES_PAYLOAD_SIZE, o as MAX_SIGN_REQUEST_PAYLOAD_SIZE, p as MAX_SIGN_REQUEST_SIZE, q as MultikeyPublicKey, R as RevocationChecker, r as RevocationPayload, S as ServiceEntry, s as ServicesArray, t as SignRequestPayload, u as Signer, V as VerifiedDFOSCredential, v as VerifiedDelegationChain, w as VerifiedIdentity, x as VoidKeyMembership, y as createDFOSCredential, z as decodeDFOSCredentialUnsafe, B as isAttenuated, E as matchesResource, F as parseProtocolTimestampUnix, G as verifyDFOSCredential, H as verifyDelegationChain } from './dfos-credential-BtiYPqBT.js';
+export { A as ARTIFACT_CID_ANCHOR_RE, a as ArtifactPayload, b as Attenuation, C as CONTENT_ID_ANCHOR_RE, c as ContentOperation, d as CountersignPayload, e as CredentialVerificationError, f as CreditClaimPayload, D as DFOSCredentialPayload, g as DeclaredKeyState, I as IdentityOperation, h as Iso8601, M as MAX_ARTIFACT_PAYLOAD_SIZE, i as MAX_CREDENTIAL_SIZE, j as MAX_CREDIT_CLAIM_SIZE, k as MAX_KEY_PROOFS, l as MAX_OPERATION_SIZE, m as MAX_SERVICES_ENTRIES, n as MAX_SERVICES_PAYLOAD_SIZE, o as MAX_SIGN_REQUEST_PAYLOAD_SIZE, p as MAX_SIGN_REQUEST_SIZE, q as MultikeyPublicKey, R as ResolvedIdentity, r as RevocationChecker, s as RevocationPayload, S as ServiceEntry, t as ServicesArray, u as SignRequestPayload, v as Signer, V as VerifiedDFOSCredential, w as VerifiedDelegationChain, x as VerifiedIdentity, y as VoidKeyMembership, z as createDFOSCredential, B as decodeDFOSCredentialUnsafe, E as isAttenuated, F as matchesResource, G as parseProtocolTimestampUnix, H as verifyDFOSCredential, J as verifyDelegationChain } from './dfos-credential-CtG0_n4P.js';
 export { AnchorKind, CreditClaimFailureReason, CreditClaimVerifyError, CreditEntry, CreditEntryState, ED25519_PRIV_MULTICODEC, ED25519_PUB_MULTICODEC, RECOGNIZED_SERVICE_TYPES, SignRequestFailureReason, SignRequestVerifyError, VerifiedArtifact, VerifiedContentChain, VerifiedCountersignature, VerifiedCreditClaim, VerifiedCreditEntry, VerifiedRevocation, VerifiedSignRequest, anchorsByLabel, assertCanonicalSignRequestPayload, assertServicesWithinCap, buildSignRequest, classifyAnchor, decodeMultikey, deriveChainIdentifier, deriveContentId, encodeEd25519Multikey, isRecognizedServiceType, relayEndpoints, signArtifact, signContentOperation, signCountersignature, signCreditClaim, signIdentityOperation, signRevocation, verifyArtifact, verifyContentChain, verifyContentExtensionFromTrustedState, verifyCountersignature, verifyCreditClaim, verifyCreditEntry, verifyIdentityChain, verifyIdentityExtensionFromTrustedState, verifyRevocation, verifySignRequest } from './chain/index.js';
 export { ApiRequestVerifyError, DEFAULT_PROOF_SKEW_SECONDS, DEFAULT_PROOF_WINDOW_SECONDS, DFOS_AUTH_SCHEME, EMPTY_BODY_SHA256, IDENTITY_PROOF_JWS_TYP, IdentityProofPayload, MAX_BODY_BYTES, MAX_PROOF_FRESHNESS_SPAN_SECONDS, MAX_REQUEST_PROOF_SIZE, ParsedProofPayload, ProofEnvelopeInput, ProofExtraMembers, ProofPresenterState, REQUEST_PROOF_JWS_TYP, RequestProofFailurePhase, RequestProofFailureReason, RequestProofPayload, ResolveProofPresenter, SignApiIdentityRequestInput, SignApiRequestInput, VerifiedProofEnvelope, apiIdentitySigningInput, apiRequestSigningInput, assertProofVerifierConfig, buildApiAuthHeaders, buildApiIdentityHeaders, canonicalExtraMembers, invalidProof, misconfiguredProof, parseDfosAuthorization, sha256BodyHash, signApiIdentityRequest, signApiRequest, unverifiableProof, verifyIdentityProofEnvelope, verifyRequestProofEnvelope } from './credentials/index.js';
 export { DEFAULT_KEY_PROOF_SKEW_SECONDS, KEY_ADD_JWS_TYP, KEY_ROLES, KeyProofFailureReason, KeyProofPayload, KeyProofVerifyError, KeyRole, MAX_KEY_PROOF_SIZE, SignKeyProofInput, VerifiedKeyProof, VerifyChainKeyProofOptions, VerifyKeyProofOptions, isCanonicalRoleSet, keyProofSigningInput, keyWordFingerprint, parseRoleSet, roleSetCovers, serializeRoleSet, signKeyProof, unsafeKeyProofSubject, verifyChainKeyProof, verifyKeyProof } from './key-proof/index.js';
@@ -7,3 +7,24 @@ export { FoldOperation, INDEX_V1_SCHEMA, IndexDelta, IndexDocument, IndexEntry,
 import 'multiformats';
 import 'multiformats/cid';
 import 'zod';
+
+/**
+ * Mark an error as "a referenced identity or key is not resolvable HERE".
+ *
+ * Returns the same error so it can be marked inline at a throw site:
+ * `throw markDependencyMissing(new CredentialVerificationError(...))`.
+ */
+declare const markDependencyMissing: <E extends Error>(err: E) => E;
+/** True if `err` carries the marker. */
+declare const isDependencyMissing: (err: unknown) => boolean;
+/**
+ * Carry the marker from a caught error onto the error that replaces it.
+ *
+ * This is the TypeScript spelling of Go's `%w`: a layer that re-throws with more
+ * context must not eat the one fact only the inner layer knew. Every re-wrap
+ * between a resolver and a relay's classifier goes through this, or the marker
+ * is lost at that boundary and the classification silently reverts to a guess.
+ */
+declare const carryDependencyMissing: <E extends Error>(cause: unknown, wrapped: E) => E;
+
+export { carryDependencyMissing, isDependencyMissing, markDependencyMissing };

package/dist/index.js

@@ -52,7 +52,7 @@ import {
   verifyIdentityExtensionFromTrustedState,
   verifyRevocation,
   verifySignRequest
-} from "./chunk-ZRA7FRBE.js";
+} from "./chunk-LMAPBTDW.js";
 import {
   ApiRequestVerifyError,
   Attenuation,
@@ -74,10 +74,13 @@ import {
   buildApiAuthHeaders,
   buildApiIdentityHeaders,
   canonicalExtraMembers,
+  carryDependencyMissing,
   createDFOSCredential,
   decodeDFOSCredentialUnsafe,
   invalidProof,
   isAttenuated,
+  isDependencyMissing,
+  markDependencyMissing,
   matchesResource,
   misconfiguredProof,
   parseDfosAuthorization,
@@ -89,7 +92,7 @@ import {
   verifyDelegationChain,
   verifyIdentityProofEnvelope,
   verifyRequestProofEnvelope
-} from "./chunk-D4IZXFPM.js";
+} from "./chunk-T2YR5KWQ.js";
 import {
   DEFAULT_KEY_PROOF_SKEW_SECONDS,
   KEY_ADD_JWS_TYP,
@@ -213,6 +216,7 @@ export {
   buildSignRequest,
   byteCompare,
   canonicalExtraMembers,
+  carryDependencyMissing,
   classifyAnchor,
   compareHeadPreference,
   compareLinear,
@@ -237,12 +241,14 @@ export {
   isAttenuated,
   isCanonicalRoleSet,
   isCanonicallyEqual,
+  isDependencyMissing,
   isRecognizedServiceType,
   isValidEd25519Signature,
   isValidId,
   keyProofSigningInput,
   keyWordFingerprint,
   linearize,
+  markDependencyMissing,
   matchesResource,
   misconfiguredProof,
   normalizedId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metalabel/dfos-protocol",
-  "version": "0.49.0",
+  "version": "0.51.0",
   "type": "module",
   "description": "DFOS Protocol — Ed25519 signed chain primitives, services, credentials, and verification",
   "license": "MIT",

package/schemas/credit-claim.v1.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://schemas.dfos.com/credit-claim/v1",
   "title": "Credit Claim",
-  "description": "The payload of a did:dfos:credit-claim JWS — a claimant's own signed assertion that it holds a named role on a content chain. Unlike post/v1, profile/v1, and index/v1, this is NOT a document committed to a chain by CID: it is an envelope payload carried inside document bytes, in the claim field of a credits entry (see $defs/creditEntry). Attribution, not authorization — a credit claim grants nothing. Unknown top-level fields are deliberately NOT rejected here (no additionalProperties: false, unlike the document schemas): this is a wire payload under the protocol's MUST-ignore-unknown rule, and the CID commits to the exact bytes, so a verifier that stripped unknown keys would fail its own CID check. Full semantics, the two-way bind, and the four verification states: https://protocol.dfos.com/credits",
+  "description": "The payload of a did:dfos:credit-claim JWS — a claimant's own signed assertion that it holds a named role on a content chain. Unlike post/v1, profile/v1, and index/v1, this is NOT a document committed to a chain by CID: it is an envelope payload carried inside document bytes, in the claim field of a credits entry (see $defs/creditEntry). Attribution, not authorization — a credit claim grants nothing. Unknown top-level fields are deliberately NOT rejected here (no additionalProperties: false, unlike the document schemas): this is a wire payload under the protocol's MUST-ignore-unknown rule, and the CID commits to the exact bytes, so a verifier that stripped unknown keys would fail its own CID check. Full semantics, the two-way bind, and the four verification states: https://protocol.dfos.com/content-model#credits",
   "type": "object",
   "required": ["version", "type", "contentId", "did", "role", "createdAt"],
   "properties": {

package/schemas/post.v1.json

@@ -43,7 +43,7 @@
       "items": {
         "$ref": "#/$defs/credit"
       },
-      "description": "Ordered authorship credits. Array order is display order; the first entry is the primary author. Omit entirely for unattributed content. A bare entry is the assertion tier of the authorship lattice — the operation signer asserts it; a credited DID upgrades its credit to proof by adding a credit claim in the entry's claim field (see https://protocol.dfos.com/credits)."
+      "description": "Ordered authorship credits. Array order is display order; the first entry is the primary author. Omit entirely for unattributed content. A bare entry is the assertion tier of the authorship lattice — the operation signer asserts it; a credited DID upgrades its credit to proof by adding a credit claim in the entry's claim field (see https://protocol.dfos.com/content-model#credits)."
     }
   },
   "additionalProperties": false,