@metalabel/dfos-protocol 0.50.0 → 0.52.0

package/dist/{chunk-JGFFADPR.js → chunk-OU2DPHCN.js}

@@ -6,16 +6,16 @@ import {
   matchesResource,
   verifyDFOSCredential,
   verifyDelegationChain
-} from "./chunk-MHSBBYDO.js";
+} from "./chunk-IV3TIYKP.js";
 import {
   KEY_ADD_JWS_TYP,
   KEY_ROLES,
   unsafeKeyProofSubject,
   verifyChainKeyProof
-} from "./chunk-JVSC67DC.js";
+} from "./chunk-QRCOMLAP.js";
 import {
-  decodeMultikey
-} from "./chunk-IDVYITX7.js";
+  decodeEd25519PublicMultikey
+} from "./chunk-F7RHI2CK.js";
 import {
   assertJwsProfile,
   base64urlDecode,
@@ -25,13 +25,13 @@ import {
   decodeJwsUnsafe,
   generateIdNoPrefix,
   verifyJws
-} from "./chunk-4LG2GEB2.js";
+} from "./chunk-QTJZGXMH.js";
 
 // src/chain/schemas.ts
 import { z } from "zod";
 var MAX_KEYS_PER_ROLE = 256;
 var MAX_KEY_PROOFS = 256;
-var MAX_RELATION = 64;
+var MAX_RELATION_BYTES = 64;
 var MAX_SERVICES_ENTRIES = 256;
 var MAX_SERVICES_PAYLOAD_SIZE = 32768;
 var MAX_OPERATION_SIZE = 65536;
@@ -78,7 +78,7 @@ var parseProtocolTimestampUnix = (value) => {
   const ms = Date.parse(value);
   return Number.isFinite(ms) ? Math.floor(ms / 1e3) : null;
 };
-var CIDString = z.string();
+var CIDString = z.string().min(1, "CID must not be empty");
 var IdentityCreate = z.looseObject({
   version: z.literal(1),
   type: z.literal("create"),
@@ -102,7 +102,7 @@ var IdentityUpdate = z.looseObject({
   createdAt: Iso8601,
   /**
    * POSSESSION PROOFS FOR THE KEYS THIS OPERATION INTRODUCES — compact key-proof
-   * JWS strings (specs/KEY-PROOF.md), each signed by the key it speaks for.
+   * JWS strings (specs/PROTOCOL.md § Key possession), each signed by the key it speaks for.
    *
    * Optional, and optional in the CID-neutral sense: omitting it encodes
    * identically to an operation that never had it (undefined strips under
@@ -188,7 +188,31 @@ var VerifiedIdentity = z.strictObject({
    * re-deriving it from the raw log under a declared-state rule that quietly
    * disagrees with this one.
    */
-  provedKeys: DeclaredKeyState.optional()
+  provedKeys: DeclaredKeyState.optional(),
+  /**
+   * HAS-EVER-BEEN-DECLARED, as a key-id-to-material binding: one entry per key
+   * id the chain has ever written, carrying the Multikey that id went in with,
+   * in the order the walk first saw it.
+   *
+   * A KEY ID IS BOUND TO ONE KEY FOR THE LIFE OF A CHAIN. The full walk enforces
+   * that chain-wide and rejects the operation that breaks it — the id is a
+   * stable name, so re-pointing it at new material would silently re-aim every
+   * artifact that ever referenced it. The incremental extension verifier has no
+   * log to re-scan, so it needs the binding handed to it, and this member is how
+   * it arrives: with it, the fast path returns the SAME verdict as a full replay
+   * on the same operation, which is the property that keeps a relay's linear
+   * path from accepting a chain its own re-verification would refuse.
+   *
+   * Broader than `declared` and than `provedKeys` on purpose. The rule covers
+   * every id the chain wrote, including one declared into a void membership and
+   * later dropped — neither of the other two members remembers that id, and it
+   * is exactly the id an attacker would reuse.
+   *
+   * Optional because a caller may hand the extension verifier a hand-built or
+   * older state. Absent, the binding is read off `declared` and `provedKeys`,
+   * which is complete for any chain that never dropped an unproved key id.
+   */
+  seenKeys: z.array(MultikeyPublicKey).optional()
 });
 var ContentCreate = z.looseObject({
   version: z.literal(1),
@@ -237,7 +261,9 @@ var CountersignPayload = z.looseObject({
   type: z.literal("countersign"),
   did: z.string(),
   targetCID: CIDString,
-  relation: z.string().min(1).max(MAX_RELATION).optional(),
+  relation: z.string().min(1).refine((value) => new TextEncoder().encode(value).length <= MAX_RELATION_BYTES, {
+    message: `relation exceeds ${MAX_RELATION_BYTES} bytes`
+  }).optional(),
   createdAt: Iso8601
 });
 var RevocationPayload = z.looseObject({
@@ -333,7 +359,9 @@ var unionProved = (into, next) => {
   return merged;
 };
 var foldEffectiveKeyState = (input) => {
-  const carried = (role, key) => input.priorEffective[ROLE_ARRAY[role]].some((prior) => prior.id === key.id);
+  const carried = (role, key) => input.priorEffective[ROLE_ARRAY[role]].some(
+    (prior) => prior.id === key.id && prior.type === key.type && prior.publicKeyMultibase === key.publicKeyMultibase
+  );
   const introduced = /* @__PURE__ */ new Map();
   for (const role of KEY_ROLES) {
     for (const key of input.declared[ROLE_ARRAY[role]]) {
@@ -379,6 +407,26 @@ var foldEffectiveKeyState = (input) => {
   }
   return { effective, voidKeys };
 };
+var admitKeyMaterial = (index, keys) => {
+  for (const key of keys) {
+    const existing = index.get(key.id);
+    if (!existing) {
+      index.set(key.id, key);
+    } else if (existing.publicKeyMultibase !== key.publicKeyMultibase || existing.type !== key.type) {
+      throw new Error(`key ${key.id} type or public key inconsistency`);
+    }
+  }
+};
+var keyMaterialIndex = (keys) => {
+  const index = /* @__PURE__ */ new Map();
+  for (const key of keys) if (!index.has(key.id)) index.set(key.id, key);
+  return index;
+};
+var flatKeys = (state) => [
+  ...state.authKeys,
+  ...state.assertKeys,
+  ...state.controllerKeys
+];
 var assertSingleKeyGenesis = (op) => {
   if (op.authKeys.length !== 1 || op.assertKeys.length !== 1 || op.controllerKeys.length !== 1) {
     throw new Error("create must declare exactly one key in each of auth, assert and controller");
@@ -407,6 +455,7 @@ var signIdentityOperation = async (input) => {
 };
 var verifyIdentityChain = async (input) => {
   if (input.log.length === 0) throw new Error("log must have at least one operation");
+  if (input.asOf === "") throw new Error("basis must not be empty");
   const state = {
     did: void 0,
     isDeleted: false,
@@ -422,6 +471,7 @@ var verifyIdentityChain = async (input) => {
     services: [],
     seenKeys: /* @__PURE__ */ new Map()
   };
+  let asOfState;
   for (const [idx, jwsToken] of input.log.entries()) {
     const decoded = decodeJwsUnsafe(jwsToken);
     if (!decoded) throw new Error(`log[${idx}]: failed to decode JWS`);
@@ -472,19 +522,15 @@ var verifyIdentityChain = async (input) => {
       }
     }
     if (op.type === "create" || op.type === "update") {
-      const incomingKeys = [...op.authKeys, ...op.assertKeys, ...op.controllerKeys];
-      const currentKeys = [
-        ...state.declared.authKeys,
-        ...state.declared.assertKeys,
-        ...state.declared.controllerKeys
-      ];
-      for (const k of [...currentKeys, ...incomingKeys]) {
-        const existing = state.seenKeys.get(k.id);
-        if (!existing) {
-          state.seenKeys.set(k.id, k);
-        } else if (existing.publicKeyMultibase !== k.publicKeyMultibase || existing.type !== k.type) {
-          throw new Error(`log[${idx}]: key ${k.id} type or public key inconsistency`);
-        }
+      try {
+        admitKeyMaterial(state.seenKeys, [
+          ...flatKeys(state.declared),
+          ...op.authKeys,
+          ...op.assertKeys,
+          ...op.controllerKeys
+        ]);
+      } catch (e) {
+        throw new Error(`log[${idx}]: ${e.message}`);
       }
       [op.authKeys, op.assertKeys, op.controllerKeys].forEach((keys) => {
         const set = new Set(keys.map((k) => k.id));
@@ -500,7 +546,7 @@ var verifyIdentityChain = async (input) => {
         }
       }
     }
-    const encoded = await dagCborCanonicalEncode(op);
+    const encoded = await dagCborCanonicalEncode(decoded.payload);
     if (encoded.bytes.length > MAX_OPERATION_SIZE) {
       throw new Error(
         `log[${idx}]: operation exceeds max size: ${encoded.bytes.length} > ${MAX_OPERATION_SIZE}`
@@ -531,7 +577,7 @@ var verifyIdentityChain = async (input) => {
     if (!signingKey) {
       throw new Error(`log[${idx}]: kid references unknown key: ${signingKeyId}`);
     }
-    const { keyBytes } = decodeMultikey(signingKey.publicKeyMultibase);
+    const keyBytes = decodeEd25519PublicMultikey(signingKey.publicKeyMultibase);
     try {
       verifyJws({ token: jwsToken, publicKey: keyBytes });
     } catch {
@@ -578,8 +624,26 @@ var verifyIdentityChain = async (input) => {
         state.isDeleted = false;
         break;
     }
+    if (input.asOf !== void 0 && op.createdAt <= input.asOf) {
+      asOfState = {
+        did,
+        isDeleted: state.isDeleted,
+        authKeys: state.effective.authKeys,
+        assertKeys: state.effective.assertKeys,
+        controllerKeys: state.effective.controllerKeys,
+        services: state.services,
+        declared: state.declared,
+        voidKeys: state.voidKeys,
+        provedKeys: state.provedKeys,
+        seenKeys: [...state.seenKeys.values()]
+      };
+    }
   }
   if (!state.did) throw new Error("did is not set");
+  if (input.asOf !== void 0) {
+    if (!asOfState) throw new Error(`identity has no state as of ${input.asOf}`);
+    return asOfState;
+  }
   return {
     did: state.did,
     isDeleted: state.isDeleted,
@@ -590,7 +654,10 @@ var verifyIdentityChain = async (input) => {
     services: state.services,
     declared: state.declared,
     voidKeys: state.voidKeys,
-    provedKeys: state.provedKeys
+    provedKeys: state.provedKeys,
+    // The id-to-material binding the walk enforced, handed on so an incremental
+    // extension of this state can enforce the identical rule without the log.
+    seenKeys: [...state.seenKeys.values()]
   };
 };
 var verifyIdentityExtensionFromTrustedState = async (input) => {
@@ -598,6 +665,10 @@ var verifyIdentityExtensionFromTrustedState = async (input) => {
   const priorEffective = keyStateOf(currentState);
   const priorDeclared = currentState.declared ?? priorEffective;
   const priorProved = currentState.provedKeys ?? priorEffective;
+  const seenKeys = keyMaterialIndex(
+    currentState.seenKeys ?? [...flatKeys(priorDeclared), ...flatKeys(priorProved)]
+  );
+  const priorSeenKeys = [...seenKeys.values()];
   const decoded = decodeJwsUnsafe(newOp);
   if (!decoded) throw new Error("failed to decode JWS");
   const result = IdentityOperation.safeParse(decoded.payload);
@@ -625,7 +696,7 @@ var verifyIdentityExtensionFromTrustedState = async (input) => {
   if (op.createdAt <= lastCreatedAt) {
     throw new Error("createdAt must be after last op");
   }
-  const encoded = await dagCborCanonicalEncode(op);
+  const encoded = await dagCborCanonicalEncode(decoded.payload);
   if (encoded.bytes.length > MAX_OPERATION_SIZE) {
     throw new Error(`operation exceeds max size: ${encoded.bytes.length} > ${MAX_OPERATION_SIZE}`);
   }
@@ -646,13 +717,14 @@ var verifyIdentityExtensionFromTrustedState = async (input) => {
   if (!signingKey) {
     throw new Error(`kid references unknown key: ${signingKeyId}`);
   }
-  const { keyBytes } = decodeMultikey(signingKey.publicKeyMultibase);
+  const keyBytes = decodeEd25519PublicMultikey(signingKey.publicKeyMultibase);
   try {
     verifyJws({ token: newOp, publicKey: keyBytes });
   } catch {
     throw new Error("invalid signature");
   }
   if (op.type === "update") {
+    admitKeyMaterial(seenKeys, [...op.authKeys, ...op.assertKeys, ...op.controllerKeys]);
     [op.authKeys, op.assertKeys, op.controllerKeys].forEach((keys) => {
       const set = new Set(keys.map((k) => k.id));
       if (set.size !== keys.length) {
@@ -682,7 +754,8 @@ var verifyIdentityExtensionFromTrustedState = async (input) => {
           services: op.services ?? [],
           declared,
           voidKeys: folded.voidKeys,
-          provedKeys: unionProved(priorProved, folded.effective)
+          provedKeys: unionProved(priorProved, folded.effective),
+          seenKeys: [...seenKeys.values()]
         };
       }
       // delete and restore introduce nothing, so both key states — and the void
@@ -697,7 +770,8 @@ var verifyIdentityExtensionFromTrustedState = async (input) => {
           services: currentState.services,
           declared: priorDeclared,
           voidKeys: currentState.voidKeys ?? [],
-          provedKeys: priorProved
+          provedKeys: priorProved,
+          seenKeys: priorSeenKeys
         };
       case "restore":
         return {
@@ -709,7 +783,8 @@ var verifyIdentityExtensionFromTrustedState = async (input) => {
           services: currentState.services,
           declared: priorDeclared,
           voidKeys: currentState.voidKeys ?? [],
-          provedKeys: priorProved
+          provedKeys: priorProved,
+          seenKeys: priorSeenKeys
         };
     }
   })();
@@ -718,11 +793,13 @@ var verifyIdentityExtensionFromTrustedState = async (input) => {
 
 // src/chain/content-chain.ts
 var operationSizeForCap = async (op, fullByteLength) => {
+  if (op.type === "create") return fullByteLength;
   const auth = op.authorization;
   if (typeof auth !== "string") return fullByteLength;
-  if (auth.length > MAX_CREDENTIAL_SIZE) {
+  const authByteLength = new TextEncoder().encode(auth).length;
+  if (authByteLength > MAX_CREDENTIAL_SIZE) {
     throw new Error(
-      `authorization credential exceeds max size: ${auth.length} > ${MAX_CREDENTIAL_SIZE}`
+      `authorization credential exceeds max size: ${authByteLength} > ${MAX_CREDENTIAL_SIZE}`
     );
   }
   const { authorization: _omit, ...rest } = op;
@@ -750,7 +827,7 @@ var verifyOperationAuthorization = async (input) => {
   const opCreatedAtUnix = Math.floor(new Date(input.createdAt).getTime() / 1e3);
   const credential = await verifyDFOSCredential(input.authorization, {
     resolveIdentity: input.resolveIdentity,
-    now: opCreatedAtUnix
+    basis: input.createdAt
   });
   if (input.isRevoked && await input.isRevoked(credential.iss, credential.credentialCID, opCreatedAtUnix)) {
     throw new Error("credential is revoked");
@@ -758,8 +835,8 @@ var verifyOperationAuthorization = async (input) => {
   await verifyDelegationChain(credential, {
     resolveIdentity: input.resolveIdentity,
     rootDID: input.creatorDID,
-    now: opCreatedAtUnix,
-    ...input.isRevoked ? { isRevoked: input.isRevoked, asOfUnix: opCreatedAtUnix } : {}
+    basis: input.createdAt,
+    ...input.isRevoked ? { isRevoked: input.isRevoked } : {}
   });
   if (credential.aud !== "*" && credential.aud !== input.operationDID) {
     throw new Error(
@@ -821,7 +898,7 @@ var verifyContentChain = async (input) => {
     if (kidDid !== op.did) {
       throw new Error(`log[${idx}]: kid DID does not match operation did`);
     }
-    const publicKey = await input.resolveKey(kid);
+    const publicKey = await input.resolveKey(kid, op.createdAt);
     try {
       verifyJws({ token: jwsToken, publicKey });
     } catch {
@@ -854,8 +931,8 @@ var verifyContentChain = async (input) => {
         );
       }
     }
-    const encoded = await dagCborCanonicalEncode(op);
-    const opSize = await operationSizeForCap(op, encoded.bytes.length);
+    const encoded = await dagCborCanonicalEncode(decoded.payload);
+    const opSize = await operationSizeForCap(decoded.payload, encoded.bytes.length);
     if (opSize > MAX_OPERATION_SIZE) {
       throw new Error(`operation exceeds max size: ${opSize} > ${MAX_OPERATION_SIZE}`);
     }
@@ -931,7 +1008,7 @@ var verifyContentExtensionFromTrustedState = async (input) => {
   if (kidDid !== op.did) {
     throw new Error("kid DID does not match operation did");
   }
-  const publicKey = await resolveKey(kid);
+  const publicKey = await resolveKey(kid, op.createdAt);
   try {
     verifyJws({ token: newOp, publicKey });
   } catch {
@@ -959,8 +1036,8 @@ var verifyContentExtensionFromTrustedState = async (input) => {
       throw carryDependencyMissing(err, new Error(`authorization verification failed: ${message}`));
     }
   }
-  const encoded = await dagCborCanonicalEncode(op);
-  const opSize = await operationSizeForCap(op, encoded.bytes.length);
+  const encoded = await dagCborCanonicalEncode(decoded.payload);
+  const opSize = await operationSizeForCap(decoded.payload, encoded.bytes.length);
   if (opSize > MAX_OPERATION_SIZE) {
     throw new Error(`operation exceeds max size: ${opSize} > ${MAX_OPERATION_SIZE}`);
   }
@@ -1009,7 +1086,7 @@ var verifyCountersignature = async (input) => {
   if (kidDid !== payload.did) {
     throw new Error("countersignature kid DID does not match payload did");
   }
-  const publicKey = await input.resolveKey(kid);
+  const publicKey = await input.resolveKey(kid, payload.createdAt);
   try {
     verifyJws({ token: input.jwsToken, publicKey });
   } catch {
@@ -1062,7 +1139,7 @@ var verifyArtifact = async (input) => {
   if (kidDid !== payload.did) {
     throw new Error("artifact kid DID does not match payload did");
   }
-  const publicKey = await input.resolveKey(kid);
+  const publicKey = await input.resolveKey(kid, payload.createdAt);
   try {
     verifyJws({ token: input.jwsToken, publicKey });
   } catch {
@@ -1119,13 +1196,13 @@ var verifyRevocation = async (input) => {
   if (kidDid !== payload.did) {
     throw new Error("revocation kid DID does not match payload did");
   }
-  const publicKey = await input.resolveKey(kid);
+  const publicKey = await input.resolveKey(kid, payload.createdAt);
   try {
     verifyJws({ token: input.jwsToken, publicKey });
   } catch {
     throw new Error("invalid revocation signature");
   }
-  const encoded = await dagCborCanonicalEncode(payload);
+  const encoded = await dagCborCanonicalEncode(decoded.payload);
   const revocationCID = encoded.cid.toString();
   if (!decoded.header.cid) throw new Error("missing cid in revocation header");
   if (decoded.header.cid !== revocationCID) throw new Error("revocation cid mismatch");
@@ -1158,7 +1235,7 @@ var resolveKeyFromIdentity = (identity, kid) => {
   if (!key) {
     throw markDependencyMissing(invalid(`key ${keyId} not found on identity ${identity.did}`));
   }
-  const { keyBytes } = decodeMultikey(key.publicKeyMultibase);
+  const keyBytes = decodeEd25519PublicMultikey(key.publicKeyMultibase);
   return keyBytes;
 };
 var normalizeClaimCreatedAt = (createdAt) => {
@@ -1254,7 +1331,7 @@ var verifyCreditClaim = async (jwsToken, options) => {
   } catch {
     throw invalid("invalid credit claim signature");
   }
-  const encoded = await dagCborCanonicalEncode(payload);
+  const encoded = await dagCborCanonicalEncode(decoded.payload);
   const claimCID = encoded.cid.toString();
   if (!decoded.header.cid) throw invalid("missing cid in credit claim header");
   if (decoded.header.cid !== claimCID) throw invalid("credit claim cid mismatch");
@@ -1381,7 +1458,7 @@ var resolveCurrentKey = (identity, kid) => {
   );
   if (!key) throw invalid2(`key ${keyId} not found on current identity ${identity.did}`);
   try {
-    return decodeMultikey(key.publicKeyMultibase).keyBytes;
+    return decodeEd25519PublicMultikey(key.publicKeyMultibase);
   } catch {
     throw invalid2(`key ${keyId} on identity ${identity.did} is not a valid Ed25519 multikey`);
   }
@@ -1481,7 +1558,7 @@ var verifySignRequest = async (jwsToken, options) => {
     }
     let encoded;
     try {
-      encoded = await dagCborCanonicalEncode(payload);
+      encoded = await dagCborCanonicalEncode(decoded.payload);
     } catch (error) {
       const detail = error instanceof Error ? error.message : String(error);
       throw invalid2(`failed to derive sign request CID: ${detail}`);

package/dist/{chunk-JVSC67DC.js → chunk-QRCOMLAP.js}

@@ -1,8 +1,7 @@
 import {
-  ED25519_PUB_MULTICODEC,
-  decodeMultikey,
+  decodeEd25519PublicMultikey,
   encodeEd25519Multikey
-} from "./chunk-IDVYITX7.js";
+} from "./chunk-F7RHI2CK.js";
 import {
   base64urlDecode,
   base64urlEncode,
@@ -10,7 +9,7 @@ import {
   isValidEd25519Signature,
   sha256,
   signPayloadEd25519
-} from "./chunk-4LG2GEB2.js";
+} from "./chunk-QTJZGXMH.js";
 
 // src/key-proof/role-set.ts
 var KEY_ROLES = ["auth", "assert", "controller"];
@@ -205,11 +204,7 @@ var decodeKeyProof = (jws, expectedTyp) => {
 var verifyKeyProofSignature = (decoded) => {
   let keyBytes;
   try {
-    const key = decodeMultikey(decoded.payload.publicKeyMultibase);
-    if (key.codec !== ED25519_PUB_MULTICODEC) {
-      throw new Error("publicKeyMultibase is not an Ed25519 public key");
-    }
-    keyBytes = key.keyBytes;
+    keyBytes = decodeEd25519PublicMultikey(decoded.payload.publicKeyMultibase);
   } catch (err) {
     throw invalid(
       "signature",