@metalabel/dfos-protocol 0.50.0 → 0.52.0

package/dist/{chunk-4LG2GEB2.js → chunk-QTJZGXMH.js}

@@ -79,6 +79,68 @@ var normalizedId = (prefix, id) => {
   return `${prefixLowered}_${idLowered}`;
 };
 
+// src/crypto/json-scan.ts
+var assertCanonicalJsonText = (text) => {
+  const frames = [];
+  let i = 0;
+  while (i < text.length) {
+    const ch = text[i];
+    if (ch === '"') {
+      const end = scanStringToken(text, i);
+      if (end < 0) return;
+      const value = decodeStringToken(text.slice(i, end));
+      if (value === null) return;
+      if (LONE_SURROGATE_RE.test(value)) {
+        throw new Error("string with an unpaired surrogate is not canonicalizable");
+      }
+      const frame = frames[frames.length - 1];
+      if (frame && frame.isObject && frame.awaitingKey) {
+        if (frame.keys.has(value)) {
+          throw new Error(`duplicate JSON key is malformed: ${JSON.stringify(value)}`);
+        }
+        frame.keys.add(value);
+        frame.awaitingKey = false;
+      }
+      i = end;
+      continue;
+    }
+    if (ch === "{") {
+      frames.push({ isObject: true, keys: /* @__PURE__ */ new Set(), awaitingKey: true });
+    } else if (ch === "[") {
+      frames.push({ isObject: false, keys: /* @__PURE__ */ new Set(), awaitingKey: false });
+    } else if (ch === "}" || ch === "]") {
+      frames.pop();
+    } else if (ch === ",") {
+      const frame = frames[frames.length - 1];
+      if (frame && frame.isObject) frame.awaitingKey = true;
+    }
+    i++;
+  }
+};
+var scanStringToken = (text, start) => {
+  let i = start + 1;
+  while (i < text.length) {
+    const ch = text[i];
+    if (ch === "\\") {
+      i += 2;
+      continue;
+    }
+    if (ch === '"') return i + 1;
+    i++;
+  }
+  return -1;
+};
+var decodeStringToken = (raw) => {
+  if (!raw.includes("\\")) return raw.slice(1, -1);
+  try {
+    const value = JSON.parse(raw);
+    return typeof value === "string" ? value : null;
+  } catch {
+    return null;
+  }
+};
+var LONE_SURROGATE_RE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+
 // src/crypto/jws-profile.ts
 var assertJwsProfile = (header, makeError) => {
   if (header.alg !== "EdDSA") {
@@ -96,6 +158,30 @@ var assertJwsProfile = (header, makeError) => {
 };
 
 // src/crypto/jws.ts
+var decodeJwsSegment = (segmentB64) => {
+  let text;
+  try {
+    text = new TextDecoder("utf-8", { fatal: true }).decode(base64urlDecode(segmentB64));
+  } catch {
+    return null;
+  }
+  assertCanonicalJsonText(text);
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+  return value;
+};
+var asJwsHeader = (raw) => {
+  if (typeof raw["alg"] !== "string") return null;
+  if (typeof raw["typ"] !== "string") return null;
+  if (typeof raw["kid"] !== "string") return null;
+  if ("cid" in raw && typeof raw["cid"] !== "string") return null;
+  return raw;
+};
 var createJws = async (options) => {
   const headerB64 = base64urlEncode(JSON.stringify(options.header));
   const payloadB64 = base64urlEncode(JSON.stringify(options.payload));
@@ -111,18 +197,22 @@ var verifyJws = (options) => {
     throw new JwsVerificationError("Invalid token format");
   }
   const [headerB64, payloadB64, signatureB64] = parts;
-  let header;
+  let rawHeader;
   let payload;
   try {
-    header = JSON.parse(new TextDecoder().decode(base64urlDecode(headerB64)));
-    payload = JSON.parse(new TextDecoder().decode(base64urlDecode(payloadB64)));
-  } catch {
+    rawHeader = decodeJwsSegment(headerB64);
+    payload = decodeJwsSegment(payloadB64);
+  } catch (e) {
+    throw new JwsVerificationError(e.message);
+  }
+  if (!rawHeader || !payload) {
     throw new JwsVerificationError("Failed to decode token");
   }
-  assertJwsProfile(
-    header,
-    (m) => new JwsVerificationError(m)
-  );
+  assertJwsProfile(rawHeader, (m) => new JwsVerificationError(m));
+  const header = asJwsHeader(rawHeader);
+  if (!header) {
+    throw new JwsVerificationError("Invalid protected header");
+  }
   const signingInput = `${headerB64}.${payloadB64}`;
   const signingInputBytes = new TextEncoder().encode(signingInput);
   const signatureBytes = base64urlDecode(signatureB64);
@@ -135,14 +225,19 @@ var verifyJws = (options) => {
 var decodeJwsUnsafe = (token) => {
   const parts = token.split(".");
   if (parts.length !== 3) return null;
+  const [headerB64, payloadB64] = parts;
+  let rawHeader;
+  let payload;
   try {
-    const [headerB64, payloadB64] = parts;
-    const header = JSON.parse(new TextDecoder().decode(base64urlDecode(headerB64)));
-    const payload = JSON.parse(new TextDecoder().decode(base64urlDecode(payloadB64)));
-    return { header, payload };
+    rawHeader = decodeJwsSegment(headerB64);
+    payload = decodeJwsSegment(payloadB64);
   } catch {
     return null;
   }
+  if (!rawHeader || !payload) return null;
+  const header = asJwsHeader(rawHeader);
+  if (!header) return null;
+  return { header, payload };
 };
 var JwsVerificationError = class extends Error {
   constructor(message) {
@@ -203,7 +298,7 @@ var verifyJwt = (options) => {
   const isValid = isValidEd25519Signature(signingInputBytes, signatureBytes, options.publicKey);
   if (!isValid) throw new JwtVerificationError("Invalid signature");
   const currentTime = options.currentTime ?? Math.floor(Date.now() / 1e3);
-  if (payload.exp <= currentTime) {
+  if (!Number.isSafeInteger(payload.exp) || payload.exp <= currentTime) {
     throw new JwtVerificationError("Token expired");
   }
   if (options.issuer !== void 0 && payload.iss !== options.issuer) {
@@ -231,20 +326,25 @@ import * as Block from "multiformats/block";
 import { CID } from "multiformats/cid";
 import { sha256 as sha2562 } from "multiformats/hashes/sha2";
 var dagCborCanonicalEncode = async (value) => {
-  assertCanonicalNumbers(value);
+  assertCanonicalValue(value);
   const serialized = JSON.parse(JSON.stringify(value));
-  assertCanonicalNumbers(serialized);
-  return await Block.encode({
-    // removes any undefineds or other non-serializable values (and normalizes
-    // -0 to 0)
-    value: serialized,
-    codec: dagCborCodec,
-    hasher: sha2562
-  });
+  assertCanonicalValue(serialized);
+  try {
+    return await Block.encode({
+      // removes any undefineds or other non-serializable values (and normalizes
+      // -0 to 0)
+      value: serialized,
+      codec: dagCborCodec,
+      hasher: sha2562
+    });
+  } catch (e) {
+    throw new Error(`value is not canonically encodable: ${e.message}`);
+  }
 };
 var MAX_SAFE_CANONICAL_INTEGER = 9007199254740991;
 var MAX_CANONICAL_DEPTH = 1024;
-var assertCanonicalNumbers = (value, depth = 0) => {
+var LONE_SURROGATE_RE2 = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+var assertCanonicalValue = (value, depth = 0) => {
   if (depth > MAX_CANONICAL_DEPTH) {
     throw new Error(`value nesting exceeds max depth ${MAX_CANONICAL_DEPTH}`);
   }
@@ -264,12 +364,26 @@ var assertCanonicalNumbers = (value, depth = 0) => {
     }
     return;
   }
+  if (typeof value === "string") {
+    if (LONE_SURROGATE_RE2.test(value)) {
+      throw new Error("string with an unpaired surrogate is not canonicalizable");
+    }
+    return;
+  }
   if (Array.isArray(value)) {
-    for (const entry of value) assertCanonicalNumbers(entry, depth + 1);
+    for (const entry of value) assertCanonicalValue(entry, depth + 1);
     return;
   }
   if (value !== null && typeof value === "object") {
-    for (const entry of Object.values(value)) assertCanonicalNumbers(entry, depth + 1);
+    if ("/" in value && "bytes" in value) {
+      throw new Error('object carrying both "/" and "bytes" members is not canonicalizable');
+    }
+    for (const [key, entry] of Object.entries(value)) {
+      if (LONE_SURROGATE_RE2.test(key)) {
+        throw new Error("string with an unpaired surrogate is not canonicalizable");
+      }
+      assertCanonicalValue(entry, depth + 1);
+    }
   }
 };
 var parseDagCborCID = (cid) => {
@@ -293,6 +407,7 @@ export {
   generateId,
   isValidId,
   normalizedId,
+  assertCanonicalJsonText,
   assertJwsProfile,
   createJws,
   verifyJws,

package/dist/credentials/index.d.ts

@@ -1,15 +1,16 @@
-export { b as Attenuation, e as CredentialVerificationError, D as DFOSCredentialPayload, i as MAX_CREDENTIAL_SIZE, R as RevocationChecker, V as VerifiedDFOSCredential, v as VerifiedDelegationChain, y as createDFOSCredential, z as decodeDFOSCredentialUnsafe, B as isAttenuated, E as matchesResource, G as verifyDFOSCredential, H as verifyDelegationChain } from '../dfos-credential-BtiYPqBT.js';
+export { b as Attenuation, e as CredentialVerificationError, D as DFOSCredentialPayload, i as MAX_CREDENTIAL_SIZE, R as ResolvedIdentity, r as RevocationChecker, V as VerifiedDFOSCredential, w as VerifiedDelegationChain, z as createDFOSCredential, B as decodeDFOSCredentialUnsafe, E as isAttenuated, F as matchesResource, H as verifyDFOSCredential, J as verifyDelegationChain } from '../dfos-credential-j-kHtFvG.js';
 import 'zod';
 
 /**
- * The normative JWS header `typ` for a request proof (API-AUTH.md). Signers MUST
- * set it; the request-proof verifier rejects anything else — it is also what lets
- * typ-routing dispatchers tell a proof apart from credentials and chain ops.
+ * The normative JWS header `typ` for a request proof (INTEGRATIONS.md, The
+ * request proof). Signers MUST set it; the request-proof verifier rejects
+ * anything else — it is also what lets typ-routing dispatchers tell a proof
+ * apart from credentials and chain ops.
  */
 declare const REQUEST_PROOF_JWS_TYP = "did:dfos:request-proof";
 /**
- * The normative JWS header `typ` for an identity proof (API-AUTH.md) — the
- * request proof's credential-less sibling.
+ * The normative JWS header `typ` for an identity proof (INTEGRATIONS.md, The
+ * identity proof) — the request proof's credential-less sibling.
  *
  * THE TYP GATE IS ABSOLUTE, IN BOTH DIRECTIONS. "Possession of a grant's
  * audience key" and "possession of a bare identity's key" are different claims,
@@ -84,10 +85,10 @@ interface IdentityProofPayload {
 /**
  * ADDITIVE MEMBERS, appended AFTER the canonical order.
  *
- * API-AUTH.md's growth rule is additive members on this envelope, never a new
- * envelope: "additional members register additively, appended to the canonical
- * order". `jti` — the per-request uniqueness member a write-gating deployment
- * requires — is the named one.
+ * INTEGRATIONS.md, One envelope, optional credential's growth rule is additive
+ * members on this envelope, never a new envelope: "additional members register
+ * additively, appended to the canonical order". `jti` — the per-request
+ * uniqueness member a write-gating deployment requires — is the named one.
  *
  * TWO RULES MAKE THIS A BYTE-TWIN. (1) Extra members are emitted AFTER every
  * canonical member, so a verifier that ignores them still reconstructs the same
@@ -173,7 +174,7 @@ interface SignApiRequestInput {
     /**
      * ADDITIVE members, appended after the canonical order in lexicographic name
      * order. `{ jti }` is the registered one — required by a deployment that gates
-     * WRITES with this envelope (API-AUTH.md, Security Considerations).
+     * WRITES with this envelope (INTEGRATIONS.md, API security notes).
      */
     extraMembers?: ProofExtraMembers;
 }
@@ -211,7 +212,7 @@ interface SignApiIdentityRequestInput {
     /**
      * ADDITIVE members, appended after the canonical order in lexicographic name
      * order. `{ jti }` is the registered one, and a WRITE-SHAPED surface — relay
-     * ingestion, blob upload — REQUIRES it (WEB-RELAY.md, Authentication).
+     * ingestion, blob upload — REQUIRES it (INTEGRATIONS.md, API security notes).
      */
     extraMembers?: ProofExtraMembers;
 }
@@ -247,8 +248,8 @@ declare const buildApiAuthHeaders: (input: {
  * On an `api:<host>` surface an accompanying `X-Credential` is MALFORMED: the
  * two headers would assert two different claims at once. A relay content-plane
  * read is NOT that case — there the identity proof is the AuthN half and a DFOS
- * credential presentation is a separate authorization artifact (WEB-RELAY.md,
- * Authentication) — so that refusal belongs to the middleware of the surface
+ * credential presentation is a separate authorization artifact (RELAY.md,
+ * Access) — so that refusal belongs to the middleware of the surface
  * being served, never to this builder.
  */
 declare const buildApiIdentityHeaders: (input: {
@@ -317,7 +318,7 @@ interface ProofPresenterState {
 type ResolveProofPresenter = (did: string) => Promise<ProofPresenterState | null>;
 /**
  * What the PROOF PHASE reads — the subset of a verifier's inputs that
- * API-AUTH.md steps 1–7 touch.
+ * INTEGRATIONS.md, Verification algorithm steps 1–7 touch.
  */
 interface ProofEnvelopeInput {
     /** The proof JWS — the `Authorization: DFOS <token>` token, scheme stripped. */
@@ -346,8 +347,8 @@ interface ProofEnvelopeInput {
     now?: () => number;
 }
 /**
- * API-AUTH.md step 4's CONFIG half, hoisted so a caller can run it BEFORE any
- * request-dependent gate.
+ * INTEGRATIONS.md, Verification algorithm step 4's freshness configuration,
+ * hoisted so a caller can run it BEFORE any request-dependent gate.
  *
  * ORDER IS LOAD-BEARING. A deployment whose freshness span is out of bounds must
  * never verify anything, and its misconfiguration must never be REPORTED as a
@@ -399,9 +400,9 @@ interface VerifiedProofEnvelope {
  */
 declare const verifyIdentityProofEnvelope: (input: ProofEnvelopeInput, resolvePresenter: ResolveProofPresenter) => Promise<VerifiedProofEnvelope>;
 /**
- * Verify a REQUEST proof's envelope — API-AUTH.md steps 1–7 with the request
- * `typ`. The caller then performs steps 8–11 (the credential walk), for which a
- * verified proof signature is the gate.
+ * Verify a REQUEST proof's envelope — INTEGRATIONS.md, Verification algorithm
+ * steps 1–7 with the request `typ`. The caller then performs steps 8–11 (the
+ * credential walk), for which a verified proof signature is the gate.
  */
 declare const verifyRequestProofEnvelope: (input: ProofEnvelopeInput, resolvePresenter: ResolveProofPresenter) => Promise<VerifiedProofEnvelope>;
 

package/dist/credentials/index.js

@@ -34,9 +34,9 @@ import {
   verifyDelegationChain,
   verifyIdentityProofEnvelope,
   verifyRequestProofEnvelope
-} from "../chunk-MHSBBYDO.js";
-import "../chunk-IDVYITX7.js";
-import "../chunk-4LG2GEB2.js";
+} from "../chunk-IV3TIYKP.js";
+import "../chunk-F7RHI2CK.js";
+import "../chunk-QTJZGXMH.js";
 export {
   ApiRequestVerifyError,
   Attenuation,

package/dist/crypto/index.d.ts

@@ -128,6 +128,28 @@ declare class JwsVerificationError extends Error {
     constructor(message: string);
 }
 
+/**
+ * Reject a signed JSON document whose raw text carries something its decoded
+ * value can no longer show:
+ *
+ * 1. DUPLICATE KEYS — PROTOCOL: "A payload containing duplicate keys is
+ *    malformed: the signature commits to the raw payload bytes while the CID
+ *    derives from the decoded value." Every JSON parser silently resolves a
+ *    duplicate (last wins), so the only place to see one is the text.
+ * 2. LONE SURROGATE ESCAPES — a `\uD800`-class escape with no pair. TypeScript
+ *    keeps it; Go's decoder replaces it with U+FFFD. Two verifiers would derive
+ *    two different CIDs from the same signed bytes, so refusing the escape is
+ *    the one verdict both can reach.
+ *
+ * This is a tokenizer, not a parser: it does not validate the grammar — the
+ * caller's `JSON.parse` is the grammar judge, and this walk simply stops at the
+ * first thing it cannot read. It tracks only enough structure to know which
+ * strings are member names of which object.
+ *
+ * MUST match the Go reference (AssertCanonicalJSONText in json_scan.go).
+ */
+declare const assertCanonicalJsonText: (text: string) => void;
+
 /**
  * Apply the DFOS signature verification profile to a decoded protected header.
  *
@@ -214,4 +236,4 @@ declare const parseDagCborCID: (cid: string) => CID<unknown, number, number, mul
  */
 declare const isCanonicallyEqual: (data1: unknown, data2: unknown) => Promise<boolean>;
 
-export { type JwsHeader, JwsVerificationError, type JwtClaims, type JwtCreateOptions, type JwtHeader, JwtVerificationError, type JwtVerifyOptions, type PrefixedID, assertJwsProfile, base64urlDecode, base64urlEncode, createJws, createJwt, createNewEd25519Keypair, dagCborCanonicalEncode, decodeJwsUnsafe, decodeJwtUnsafe, generateId, generateIdNoPrefix, importEd25519Keypair, isCanonicallyEqual, isValidEd25519Signature, isValidId, normalizedId, parseDagCborCID, sha256, signPayloadEd25519, verifyJws, verifyJwt };
+export { type JwsHeader, JwsVerificationError, type JwtClaims, type JwtCreateOptions, type JwtHeader, JwtVerificationError, type JwtVerifyOptions, type PrefixedID, assertCanonicalJsonText, assertJwsProfile, base64urlDecode, base64urlEncode, createJws, createJwt, createNewEd25519Keypair, dagCborCanonicalEncode, decodeJwsUnsafe, decodeJwtUnsafe, generateId, generateIdNoPrefix, importEd25519Keypair, isCanonicallyEqual, isValidEd25519Signature, isValidId, normalizedId, parseDagCborCID, sha256, signPayloadEd25519, verifyJws, verifyJwt };

package/dist/crypto/index.js

@@ -1,6 +1,7 @@
 import {
   JwsVerificationError,
   JwtVerificationError,
+  assertCanonicalJsonText,
   assertJwsProfile,
   base64urlDecode,
   base64urlEncode,
@@ -22,10 +23,11 @@ import {
   signPayloadEd25519,
   verifyJws,
   verifyJwt
-} from "../chunk-4LG2GEB2.js";
+} from "../chunk-QTJZGXMH.js";
 export {
   JwsVerificationError,
   JwtVerificationError,
+  assertCanonicalJsonText,
   assertJwsProfile,
   base64urlDecode,
   base64urlEncode,

package/dist/{dfos-credential-BtiYPqBT.d.ts → dfos-credential-j-kHtFvG.d.ts}

@@ -294,6 +294,11 @@ declare const VerifiedIdentity: z.ZodObject<{
             publicKeyMultibase: z.ZodString;
         }, z.core.$loose>>;
     }, z.core.$strict>>;
+    seenKeys: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        type: z.ZodLiteral<"Multikey">;
+        publicKeyMultibase: z.ZodString;
+    }, z.core.$loose>>>;
 }, z.core.$strict>;
 type VerifiedIdentity = z.infer<typeof VerifiedIdentity>;
 declare const ContentOperation: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -377,7 +382,7 @@ declare const MAX_CREDIT_CLAIM_SIZE = 4096;
  * Credit claim: a claimant's signed assertion that it holds a named role on a
  * content chain. A document-plane artifact — it is NOT gossiped and relays are not
  * credit-claim aware; a claim travels inside the document bytes that embed it (see
- * `specs/CREDITS.md`).
+ * `specs/CONTENT-MODEL.md`).
  *
  * `contentId` is the binder — the STABLE 31-char content chain id, never a
  * documentCID or a chain head CID. Binding to the chain (not a document) is what
@@ -435,7 +440,8 @@ declare const MAX_SIGN_REQUEST_PAYLOAD_SIZE = 4096;
  *
  * Unknown envelope fields are preserved-and-ignored, matching every other wire
  * payload in this file. The signer-side target-payload check is deliberately
- * strict instead: a signer refuses fields it cannot render (see SIGNING.md).
+ * strict instead: a signer refuses fields it cannot render (see RELAY.md,
+ * Signer obligations).
  */
 declare const SignRequestPayload: z.ZodObject<{
     version: z.ZodLiteral<1>;
@@ -500,6 +506,24 @@ interface VerifiedDFOSCredential {
     /** kid from the JWS header */
     signerKeyId: string;
 }
+/**
+ * The identity a resolver answers with, plus the one fact about that answer only
+ * the resolver knows: whether it is FINAL for the basis it was asked about.
+ *
+ * A resolver whose copy of the chain runs past the basis answers determinately,
+ * and a key missing from that state is a verdict. A resolver answering from a
+ * copy that ends at or before the basis does not: an operation dated at or
+ * before the basis can still arrive and add the key, so the miss is a dependency
+ * miss the caller retries. Absent is the retryable reading, which is the safe
+ * default: only a resolver that can say its answer is final gets a verdict.
+ */
+type ResolvedIdentity = VerifiedIdentity & {
+    /**
+     * True when no operation dated at or before the basis can still arrive and
+     * change this key state.
+     */
+    basisDeterminate?: boolean;
+};
 interface VerifiedDelegationChain {
     /** The leaf credential */
     credential: VerifiedDFOSCredential;
@@ -512,8 +536,8 @@ interface VerifiedDelegationChain {
  * Check whether a credential (leaf or any parent) has been revoked.
  *
  * `asOfUnix` selects WHICH question is being asked, and the two are different
- * decisions: **acceptance is a freshness decision; verification of committed
- * history is a validity decision.**
+ * decisions: **acceptance is a freshness decision; verification at a basis is a
+ * validity decision.**
  *
  * - **Omitted, or `<= 0` (timeless)** — "is this credential revoked as far as you
  *   know right now?". The freshness question. Used by acceptance gates: relay
@@ -524,10 +548,10 @@ interface VerifiedDelegationChain {
  *   1970) therefore gets the stricter answer in both languages.
  * - **Positive (as-of)** — "was this credential already revoked at `asOfUnix`?".
  *   The validity question. Return true only if a revocation exists AND its
- *   signed `createdAt` is ≤ `asOfUnix`. Used when verifying operations already
- *   committed to a chain, where `asOfUnix` is the operation's own `createdAt`.
- *   A revocation signed AFTER an operation does not invalidate it — see
- *   CREDENTIALS.md "Revocation Scope".
+ *   signed `createdAt` is ≤ `asOfUnix`. Used when verifying an artifact against
+ *   a basis, where `asOfUnix` is the basis in integer Unix seconds. A revocation
+ *   signed AFTER the basis does not invalidate the artifact — see CREDENTIALS.md
+ *   "Revocation against the basis".
  *
  * An implementation that ignores `asOfUnix` degrades to the timeless answer,
  * which is always the stricter (safe) direction — it can only reject history
@@ -559,13 +583,35 @@ declare const createDFOSCredential: (options: {
 /**
  * Verify a DFOS credential — signature, schema, expiry, CID integrity
  *
+ * Every check runs against ONE basis time (PROTOCOL, Time basis): the issuer's
+ * key must be effective in the identity's state as of the basis, and `exp` must
+ * be strictly greater than the basis in integer Unix seconds. `iat` is
+ * informational and gates nothing.
+ *
  * Does NOT verify the delegation chain. Use `verifyDelegationChain` for full
  * chain verification including attenuation enforcement.
  */
 declare const verifyDFOSCredential: (jwsToken: string, options: {
-    resolveIdentity: (did: string) => Promise<VerifiedIdentity | undefined>;
-    /** Current time in seconds (defaults to Date.now() / 1000) */
-    now?: number;
+    /**
+     * Resolve a DID to its verified identity state AS OF `basis`. Called with
+     * the basis this verification runs at, or with none when the presentation is
+     * ephemeral and the answer is head state. A resolver that knows its answer
+     * is final for the basis says so on the result (`ResolvedIdentity`).
+     */
+    resolveIdentity: (did: string, basis?: string) => Promise<ResolvedIdentity | undefined>;
+    /**
+     * The basis time, in the `createdAt` grammar — the operation's own
+     * `createdAt` for a credential carried inline in a committed operation.
+     * Omitted for an ephemeral presentation, where the basis is now.
+     */
+    basis?: string;
+    /**
+     * The ephemeral clock in integer Unix seconds, for a caller that carries its
+     * own. It reaches `exp` and nothing else: key resolution on the ephemeral
+     * path is head state, which is what "the basis is now" means. Ignored when
+     * `basis` is present, and defaults to `floor(Date.now() / 1000)`.
+     */
+    nowUnix?: number;
 }) => Promise<VerifiedDFOSCredential>;
 /**
  * Verify a full delegation chain — walk `prf`, confirm monotonic attenuation,
@@ -578,23 +624,29 @@ declare const verifyDFOSCredential: (jwsToken: string, options: {
  *
  * The chain terminates when a credential has `prf: []` (root credential). The
  * root credential's `iss` must equal `rootDID`.
+ *
+ * ONE BASIS FOR THE WHOLE WALK. Every hop — each parent's signing key, each
+ * `exp`, each revocation — resolves against the same basis the leaf did, so a
+ * chain either held at that instant or it did not.
  */
 declare const verifyDelegationChain: (credential: VerifiedDFOSCredential, options: {
-    resolveIdentity: (did: string) => Promise<VerifiedIdentity | undefined>;
+    /** Resolve a DID to its verified identity state as of `basis`. */
+    resolveIdentity: (did: string, basis?: string) => Promise<ResolvedIdentity | undefined>;
     /** The expected root authority DID (e.g., content chain creator) */
     rootDID: string;
-    /** Current time in seconds (defaults to Date.now() / 1000) */
-    now?: number;
     /** Check if a credential has been revoked (checked at every level of the chain) */
     isRevoked?: RevocationChecker;
     /**
-     * As-of basis for the revocation check, unix seconds. Kept SEPARATE from
-     * `now` (the expiry basis) on purpose: expiry and revocation are two
-     * different decisions, and a caller evaluating expiry against a deterministic
-     * basis does not automatically want history-relative revocation. Omitted =
-     * timeless revocation (current knowledge). See `RevocationChecker`.
+     * The basis time, in the `createdAt` grammar. Omitted for an ephemeral
+     * presentation: `exp` runs against the wall clock and revocation is asked
+     * timelessly, which is the stricter direction (see `RevocationChecker`).
+     */
+    basis?: string;
+    /**
+     * The ephemeral clock in integer Unix seconds, threaded to every hop's `exp`
+     * and nothing else. Ignored when `basis` is present.
      */
-    asOfUnix?: number;
+    nowUnix?: number;
 }) => Promise<VerifiedDelegationChain>;
 /**
  * Check if `childAtt` is a valid attenuation of `parentAtt`
@@ -639,4 +691,4 @@ declare class CredentialVerificationError extends Error {
     constructor(message: string);
 }
 
-export { ARTIFACT_CID_ANCHOR_RE as A, isAttenuated as B, CONTENT_ID_ANCHOR_RE as C, DFOSCredentialPayload as D, matchesResource as E, parseProtocolTimestampUnix as F, verifyDFOSCredential as G, verifyDelegationChain as H, IdentityOperation as I, MAX_ARTIFACT_PAYLOAD_SIZE as M, type RevocationChecker as R, ServiceEntry as S, type VerifiedDFOSCredential as V, ArtifactPayload as a, Attenuation as b, ContentOperation as c, CountersignPayload as d, CredentialVerificationError as e, CreditClaimPayload as f, DeclaredKeyState as g, Iso8601 as h, MAX_CREDENTIAL_SIZE as i, MAX_CREDIT_CLAIM_SIZE as j, MAX_KEY_PROOFS as k, MAX_OPERATION_SIZE as l, MAX_SERVICES_ENTRIES as m, MAX_SERVICES_PAYLOAD_SIZE as n, MAX_SIGN_REQUEST_PAYLOAD_SIZE as o, MAX_SIGN_REQUEST_SIZE as p, MultikeyPublicKey as q, RevocationPayload as r, ServicesArray as s, SignRequestPayload as t, type Signer as u, type VerifiedDelegationChain as v, VerifiedIdentity as w, VoidKeyMembership as x, createDFOSCredential as y, decodeDFOSCredentialUnsafe as z };
+export { ARTIFACT_CID_ANCHOR_RE as A, decodeDFOSCredentialUnsafe as B, CONTENT_ID_ANCHOR_RE as C, DFOSCredentialPayload as D, isAttenuated as E, matchesResource as F, parseProtocolTimestampUnix as G, verifyDFOSCredential as H, IdentityOperation as I, verifyDelegationChain as J, MAX_ARTIFACT_PAYLOAD_SIZE as M, type ResolvedIdentity as R, ServiceEntry as S, type VerifiedDFOSCredential as V, ArtifactPayload as a, Attenuation as b, ContentOperation as c, CountersignPayload as d, CredentialVerificationError as e, CreditClaimPayload as f, DeclaredKeyState as g, Iso8601 as h, MAX_CREDENTIAL_SIZE as i, MAX_CREDIT_CLAIM_SIZE as j, MAX_KEY_PROOFS as k, MAX_OPERATION_SIZE as l, MAX_SERVICES_ENTRIES as m, MAX_SERVICES_PAYLOAD_SIZE as n, MAX_SIGN_REQUEST_PAYLOAD_SIZE as o, MAX_SIGN_REQUEST_SIZE as p, MultikeyPublicKey as q, type RevocationChecker as r, RevocationPayload as s, ServicesArray as t, SignRequestPayload as u, type Signer as v, type VerifiedDelegationChain as w, VerifiedIdentity as x, VoidKeyMembership as y, createDFOSCredential as z };

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-export { JwsHeader, JwsVerificationError, JwtClaims, JwtCreateOptions, JwtHeader, JwtVerificationError, JwtVerifyOptions, PrefixedID, assertJwsProfile, base64urlDecode, base64urlEncode, createJws, createJwt, createNewEd25519Keypair, dagCborCanonicalEncode, decodeJwsUnsafe, decodeJwtUnsafe, generateId, generateIdNoPrefix, importEd25519Keypair, isCanonicallyEqual, isValidEd25519Signature, isValidId, normalizedId, parseDagCborCID, sha256, signPayloadEd25519, verifyJws, verifyJwt } from './crypto/index.js';
-export { A as ARTIFACT_CID_ANCHOR_RE, a as ArtifactPayload, b as Attenuation, C as CONTENT_ID_ANCHOR_RE, c as ContentOperation, d as CountersignPayload, e as CredentialVerificationError, f as CreditClaimPayload, D as DFOSCredentialPayload, g as DeclaredKeyState, I as IdentityOperation, h as Iso8601, M as MAX_ARTIFACT_PAYLOAD_SIZE, i as MAX_CREDENTIAL_SIZE, j as MAX_CREDIT_CLAIM_SIZE, k as MAX_KEY_PROOFS, l as MAX_OPERATION_SIZE, m as MAX_SERVICES_ENTRIES, n as MAX_SERVICES_PAYLOAD_SIZE, o as MAX_SIGN_REQUEST_PAYLOAD_SIZE, p as MAX_SIGN_REQUEST_SIZE, q as MultikeyPublicKey, R as RevocationChecker, r as RevocationPayload, S as ServiceEntry, s as ServicesArray, t as SignRequestPayload, u as Signer, V as VerifiedDFOSCredential, v as VerifiedDelegationChain, w as VerifiedIdentity, x as VoidKeyMembership, y as createDFOSCredential, z as decodeDFOSCredentialUnsafe, B as isAttenuated, E as matchesResource, F as parseProtocolTimestampUnix, G as verifyDFOSCredential, H as verifyDelegationChain } from './dfos-credential-BtiYPqBT.js';
-export { AnchorKind, CreditClaimFailureReason, CreditClaimVerifyError, CreditEntry, CreditEntryState, ED25519_PRIV_MULTICODEC, ED25519_PUB_MULTICODEC, RECOGNIZED_SERVICE_TYPES, SignRequestFailureReason, SignRequestVerifyError, VerifiedArtifact, VerifiedContentChain, VerifiedCountersignature, VerifiedCreditClaim, VerifiedCreditEntry, VerifiedRevocation, VerifiedSignRequest, anchorsByLabel, assertCanonicalSignRequestPayload, assertServicesWithinCap, buildSignRequest, classifyAnchor, decodeMultikey, deriveChainIdentifier, deriveContentId, encodeEd25519Multikey, isRecognizedServiceType, relayEndpoints, signArtifact, signContentOperation, signCountersignature, signCreditClaim, signIdentityOperation, signRevocation, verifyArtifact, verifyContentChain, verifyContentExtensionFromTrustedState, verifyCountersignature, verifyCreditClaim, verifyCreditEntry, verifyIdentityChain, verifyIdentityExtensionFromTrustedState, verifyRevocation, verifySignRequest } from './chain/index.js';
+export { JwsHeader, JwsVerificationError, JwtClaims, JwtCreateOptions, JwtHeader, JwtVerificationError, JwtVerifyOptions, PrefixedID, assertCanonicalJsonText, assertJwsProfile, base64urlDecode, base64urlEncode, createJws, createJwt, createNewEd25519Keypair, dagCborCanonicalEncode, decodeJwsUnsafe, decodeJwtUnsafe, generateId, generateIdNoPrefix, importEd25519Keypair, isCanonicallyEqual, isValidEd25519Signature, isValidId, normalizedId, parseDagCborCID, sha256, signPayloadEd25519, verifyJws, verifyJwt } from './crypto/index.js';
+export { A as ARTIFACT_CID_ANCHOR_RE, a as ArtifactPayload, b as Attenuation, C as CONTENT_ID_ANCHOR_RE, c as ContentOperation, d as CountersignPayload, e as CredentialVerificationError, f as CreditClaimPayload, D as DFOSCredentialPayload, g as DeclaredKeyState, I as IdentityOperation, h as Iso8601, M as MAX_ARTIFACT_PAYLOAD_SIZE, i as MAX_CREDENTIAL_SIZE, j as MAX_CREDIT_CLAIM_SIZE, k as MAX_KEY_PROOFS, l as MAX_OPERATION_SIZE, m as MAX_SERVICES_ENTRIES, n as MAX_SERVICES_PAYLOAD_SIZE, o as MAX_SIGN_REQUEST_PAYLOAD_SIZE, p as MAX_SIGN_REQUEST_SIZE, q as MultikeyPublicKey, R as ResolvedIdentity, r as RevocationChecker, s as RevocationPayload, S as ServiceEntry, t as ServicesArray, u as SignRequestPayload, v as Signer, V as VerifiedDFOSCredential, w as VerifiedDelegationChain, x as VerifiedIdentity, y as VoidKeyMembership, z as createDFOSCredential, B as decodeDFOSCredentialUnsafe, E as isAttenuated, F as matchesResource, G as parseProtocolTimestampUnix, H as verifyDFOSCredential, J as verifyDelegationChain } from './dfos-credential-j-kHtFvG.js';
+export { AnchorKind, CreditClaimFailureReason, CreditClaimVerifyError, CreditEntry, CreditEntryState, ED25519_PRIV_MULTICODEC, ED25519_PUB_MULTICODEC, RECOGNIZED_SERVICE_TYPES, SignRequestFailureReason, SignRequestVerifyError, VerifiedArtifact, VerifiedContentChain, VerifiedCountersignature, VerifiedCreditClaim, VerifiedCreditEntry, VerifiedRevocation, VerifiedSignRequest, anchorsByLabel, assertCanonicalSignRequestPayload, assertServicesWithinCap, buildSignRequest, classifyAnchor, decodeEd25519PublicMultikey, decodeMultikey, deriveChainIdentifier, deriveContentId, encodeEd25519Multikey, isRecognizedServiceType, relayEndpoints, signArtifact, signContentOperation, signCountersignature, signCreditClaim, signIdentityOperation, signRevocation, verifyArtifact, verifyContentChain, verifyContentExtensionFromTrustedState, verifyCountersignature, verifyCreditClaim, verifyCreditEntry, verifyIdentityChain, verifyIdentityExtensionFromTrustedState, verifyRevocation, verifySignRequest } from './chain/index.js';
 export { ApiRequestVerifyError, DEFAULT_PROOF_SKEW_SECONDS, DEFAULT_PROOF_WINDOW_SECONDS, DFOS_AUTH_SCHEME, EMPTY_BODY_SHA256, IDENTITY_PROOF_JWS_TYP, IdentityProofPayload, MAX_BODY_BYTES, MAX_PROOF_FRESHNESS_SPAN_SECONDS, MAX_REQUEST_PROOF_SIZE, ParsedProofPayload, ProofEnvelopeInput, ProofExtraMembers, ProofPresenterState, REQUEST_PROOF_JWS_TYP, RequestProofFailurePhase, RequestProofFailureReason, RequestProofPayload, ResolveProofPresenter, SignApiIdentityRequestInput, SignApiRequestInput, VerifiedProofEnvelope, apiIdentitySigningInput, apiRequestSigningInput, assertProofVerifierConfig, buildApiAuthHeaders, buildApiIdentityHeaders, canonicalExtraMembers, invalidProof, misconfiguredProof, parseDfosAuthorization, sha256BodyHash, signApiIdentityRequest, signApiRequest, unverifiableProof, verifyIdentityProofEnvelope, verifyRequestProofEnvelope } from './credentials/index.js';
 export { DEFAULT_KEY_PROOF_SKEW_SECONDS, KEY_ADD_JWS_TYP, KEY_ROLES, KeyProofFailureReason, KeyProofPayload, KeyProofVerifyError, KeyRole, MAX_KEY_PROOF_SIZE, SignKeyProofInput, VerifiedKeyProof, VerifyChainKeyProofOptions, VerifyKeyProofOptions, isCanonicalRoleSet, keyProofSigningInput, keyWordFingerprint, parseRoleSet, roleSetCovers, serializeRoleSet, signKeyProof, unsafeKeyProofSubject, verifyChainKeyProof, verifyKeyProof } from './key-proof/index.js';
 export { FoldOperation, INDEX_V1_SCHEMA, IndexDelta, IndexDocument, IndexEntry, LwwDelta, OrderKey, byteCompare, compareHeadPreference, compareLinear, foldIndexV1, foldLwwMap, linearize } from './fold/index.js';

package/dist/index.js

@@ -52,7 +52,7 @@ import {
   verifyIdentityExtensionFromTrustedState,
   verifyRevocation,
   verifySignRequest
-} from "./chunk-JGFFADPR.js";
+} from "./chunk-OU2DPHCN.js";
 import {
   ApiRequestVerifyError,
   Attenuation,
@@ -92,7 +92,7 @@ import {
   verifyDelegationChain,
   verifyIdentityProofEnvelope,
   verifyRequestProofEnvelope
-} from "./chunk-MHSBBYDO.js";
+} from "./chunk-IV3TIYKP.js";
 import {
   DEFAULT_KEY_PROOF_SKEW_SECONDS,
   KEY_ADD_JWS_TYP,
@@ -109,16 +109,18 @@ import {
   unsafeKeyProofSubject,
   verifyChainKeyProof,
   verifyKeyProof
-} from "./chunk-JVSC67DC.js";
+} from "./chunk-QRCOMLAP.js";
 import {
   ED25519_PRIV_MULTICODEC,
   ED25519_PUB_MULTICODEC,
+  decodeEd25519PublicMultikey,
   decodeMultikey,
   encodeEd25519Multikey
-} from "./chunk-IDVYITX7.js";
+} from "./chunk-F7RHI2CK.js";
 import {
   JwsVerificationError,
   JwtVerificationError,
+  assertCanonicalJsonText,
   assertJwsProfile,
   base64urlDecode,
   base64urlEncode,
@@ -140,7 +142,7 @@ import {
   signPayloadEd25519,
   verifyJws,
   verifyJwt
-} from "./chunk-4LG2GEB2.js";
+} from "./chunk-QTJZGXMH.js";
 import {
   INDEX_V1_SCHEMA,
   byteCompare,
@@ -205,6 +207,7 @@ export {
   anchorsByLabel,
   apiIdentitySigningInput,
   apiRequestSigningInput,
+  assertCanonicalJsonText,
   assertCanonicalSignRequestPayload,
   assertJwsProfile,
   assertProofVerifierConfig,
@@ -226,6 +229,7 @@ export {
   createNewEd25519Keypair,
   dagCborCanonicalEncode,
   decodeDFOSCredentialUnsafe,
+  decodeEd25519PublicMultikey,
   decodeJwsUnsafe,
   decodeJwtUnsafe,
   decodeMultikey,