@metalabel/dfos-protocol 0.51.0 → 0.52.1

package/dist/chain/index.d.ts

@@ -1,5 +1,5 @@
-import { I as IdentityOperation, v as Signer, x as VerifiedIdentity, S as ServiceEntry, c as ContentOperation, R as ResolvedIdentity, r as RevocationChecker, d as CountersignPayload, a as ArtifactPayload } from '../dfos-credential-CtG0_n4P.js';
-export { A as ARTIFACT_CID_ANCHOR_RE, C as CONTENT_ID_ANCHOR_RE, f as CreditClaimPayload, g as DeclaredKeyState, h as Iso8601, M as MAX_ARTIFACT_PAYLOAD_SIZE, j as MAX_CREDIT_CLAIM_SIZE, k as MAX_KEY_PROOFS, l as MAX_OPERATION_SIZE, m as MAX_SERVICES_ENTRIES, n as MAX_SERVICES_PAYLOAD_SIZE, o as MAX_SIGN_REQUEST_PAYLOAD_SIZE, p as MAX_SIGN_REQUEST_SIZE, q as MultikeyPublicKey, s as RevocationPayload, t as ServicesArray, u as SignRequestPayload, y as VoidKeyMembership, G as parseProtocolTimestampUnix } from '../dfos-credential-CtG0_n4P.js';
+import { I as IdentityOperation, v as Signer, x as VerifiedIdentity, S as ServiceEntry, c as ContentOperation, R as ResolvedIdentity, r as RevocationChecker, d as CountersignPayload, a as ArtifactPayload } from '../dfos-credential-j-kHtFvG.js';
+export { A as ARTIFACT_CID_ANCHOR_RE, C as CONTENT_ID_ANCHOR_RE, f as CreditClaimPayload, g as DeclaredKeyState, h as Iso8601, M as MAX_ARTIFACT_PAYLOAD_SIZE, j as MAX_CREDIT_CLAIM_SIZE, k as MAX_KEY_PROOFS, l as MAX_OPERATION_SIZE, m as MAX_SERVICES_ENTRIES, n as MAX_SERVICES_PAYLOAD_SIZE, o as MAX_SIGN_REQUEST_PAYLOAD_SIZE, p as MAX_SIGN_REQUEST_SIZE, q as MultikeyPublicKey, s as RevocationPayload, t as ServicesArray, u as SignRequestPayload, y as VoidKeyMembership, G as parseProtocolTimestampUnix } from '../dfos-credential-j-kHtFvG.js';
 import 'zod';
 
 /** Ed25519 public key multicodec value */
@@ -22,6 +22,17 @@ declare const decodeMultikey: (multibase: string) => {
     keyBytes: Uint8Array;
     codec: number;
 };
+/**
+ * Decode a Multikey multibase string that MUST carry an Ed25519 PUBLIC key
+ *
+ * `decodeMultikey` also accepts the `ed25519-priv` prefix and reports it in
+ * `codec`, which a caller that destructures only `{ keyBytes }` silently
+ * discards — so a private-key-tagged multibase string would verify as if it were
+ * a public key, where the Go reference (DecodeMultikey) accepts the 0xed01
+ * prefix and nothing else. This is the decode every signature path takes, so the
+ * codec assertion cannot be forgotten at the next call site.
+ */
+declare const decodeEd25519PublicMultikey: (multibase: string) => Uint8Array;
 
 /**
  * Derive a prefixed chain identifier from CID bytes
@@ -529,7 +540,8 @@ declare const buildSignRequest: (input: {
     requestCID: string;
 }>;
 /**
- * Verify a sign-request envelope in SIGNING.md's exact 1–9 order.
+ * Verify a sign-request envelope in RELAY.md, Envelope verification's exact 1–9
+ * order.
  *
  * `resolveIdentity` supplies CURRENT identity state. A missing identity or
  * resolver failure is `unverifiable`; a deleted identity, missing current key,
@@ -548,4 +560,4 @@ declare const assertCanonicalSignRequestPayload: (payloadTyp: string, payloadByt
     subject: string;
 }) => void;
 
-export { type AnchorKind, ArtifactPayload, ContentOperation, CountersignPayload, type CreditClaimFailureReason, CreditClaimVerifyError, type CreditEntry, type CreditEntryState, ED25519_PRIV_MULTICODEC, ED25519_PUB_MULTICODEC, IdentityOperation, RECOGNIZED_SERVICE_TYPES, ServiceEntry, type SignRequestFailureReason, SignRequestVerifyError, Signer, type VerifiedArtifact, type VerifiedContentChain, type VerifiedCountersignature, type VerifiedCreditClaim, type VerifiedCreditEntry, VerifiedIdentity, type VerifiedRevocation, type VerifiedSignRequest, anchorsByLabel, assertCanonicalSignRequestPayload, assertServicesWithinCap, buildSignRequest, classifyAnchor, decodeMultikey, deriveChainIdentifier, deriveContentId, encodeEd25519Multikey, isRecognizedServiceType, relayEndpoints, signArtifact, signContentOperation, signCountersignature, signCreditClaim, signIdentityOperation, signRevocation, verifyArtifact, verifyContentChain, verifyContentExtensionFromTrustedState, verifyCountersignature, verifyCreditClaim, verifyCreditEntry, verifyIdentityChain, verifyIdentityExtensionFromTrustedState, verifyRevocation, verifySignRequest };
+export { type AnchorKind, ArtifactPayload, ContentOperation, CountersignPayload, type CreditClaimFailureReason, CreditClaimVerifyError, type CreditEntry, type CreditEntryState, ED25519_PRIV_MULTICODEC, ED25519_PUB_MULTICODEC, IdentityOperation, RECOGNIZED_SERVICE_TYPES, ServiceEntry, type SignRequestFailureReason, SignRequestVerifyError, Signer, type VerifiedArtifact, type VerifiedContentChain, type VerifiedCountersignature, type VerifiedCreditClaim, type VerifiedCreditEntry, VerifiedIdentity, type VerifiedRevocation, type VerifiedSignRequest, anchorsByLabel, assertCanonicalSignRequestPayload, assertServicesWithinCap, buildSignRequest, classifyAnchor, decodeEd25519PublicMultikey, decodeMultikey, deriveChainIdentifier, deriveContentId, encodeEd25519Multikey, isRecognizedServiceType, relayEndpoints, signArtifact, signContentOperation, signCountersignature, signCreditClaim, signIdentityOperation, signRevocation, verifyArtifact, verifyContentChain, verifyContentExtensionFromTrustedState, verifyCountersignature, verifyCreditClaim, verifyCreditEntry, verifyIdentityChain, verifyIdentityExtensionFromTrustedState, verifyRevocation, verifySignRequest };

package/dist/chain/index.js

@@ -52,16 +52,17 @@ import {
   verifyIdentityExtensionFromTrustedState,
   verifyRevocation,
   verifySignRequest
-} from "../chunk-LMAPBTDW.js";
-import "../chunk-T2YR5KWQ.js";
-import "../chunk-JVSC67DC.js";
+} from "../chunk-Q7FREWMY.js";
+import "../chunk-FZHHSC5N.js";
+import "../chunk-BMIOY5W5.js";
 import {
   ED25519_PRIV_MULTICODEC,
   ED25519_PUB_MULTICODEC,
+  decodeEd25519PublicMultikey,
   decodeMultikey,
   encodeEd25519Multikey
-} from "../chunk-IDVYITX7.js";
-import "../chunk-4LG2GEB2.js";
+} from "../chunk-F7RHI2CK.js";
+import "../chunk-KAW4MT4P.js";
 export {
   ARTIFACT_CID_ANCHOR_RE,
   ArtifactPayload,
@@ -97,6 +98,7 @@ export {
   assertServicesWithinCap,
   buildSignRequest,
   classifyAnchor,
+  decodeEd25519PublicMultikey,
   decodeMultikey,
   deriveChainIdentifier,
   deriveContentId,

package/dist/{chunk-JVSC67DC.js → chunk-BMIOY5W5.js}

@@ -1,8 +1,7 @@
 import {
-  ED25519_PUB_MULTICODEC,
-  decodeMultikey,
+  decodeEd25519PublicMultikey,
   encodeEd25519Multikey
-} from "./chunk-IDVYITX7.js";
+} from "./chunk-F7RHI2CK.js";
 import {
   base64urlDecode,
   base64urlEncode,
@@ -10,7 +9,7 @@ import {
   isValidEd25519Signature,
   sha256,
   signPayloadEd25519
-} from "./chunk-4LG2GEB2.js";
+} from "./chunk-KAW4MT4P.js";
 
 // src/key-proof/role-set.ts
 var KEY_ROLES = ["auth", "assert", "controller"];
@@ -205,11 +204,7 @@ var decodeKeyProof = (jws, expectedTyp) => {
 var verifyKeyProofSignature = (decoded) => {
   let keyBytes;
   try {
-    const key = decodeMultikey(decoded.payload.publicKeyMultibase);
-    if (key.codec !== ED25519_PUB_MULTICODEC) {
-      throw new Error("publicKeyMultibase is not an Ed25519 public key");
-    }
-    keyBytes = key.keyBytes;
+    keyBytes = decodeEd25519PublicMultikey(decoded.payload.publicKeyMultibase);
   } catch (err) {
     throw invalid(
       "signature",

package/dist/{chunk-IDVYITX7.js → chunk-F7RHI2CK.js}

@@ -36,10 +36,18 @@ var decodeMultikey = (multibase) => {
     `unsupported multikey codec: [0x${bytes[0]?.toString(16)}, 0x${bytes[1]?.toString(16)}]`
   );
 };
+var decodeEd25519PublicMultikey = (multibase) => {
+  const { keyBytes, codec } = decodeMultikey(multibase);
+  if (codec !== ED25519_PUB_MULTICODEC) {
+    throw new Error("publicKeyMultibase is not an Ed25519 public key");
+  }
+  return keyBytes;
+};
 
 export {
   ED25519_PUB_MULTICODEC,
   ED25519_PRIV_MULTICODEC,
   encodeEd25519Multikey,
-  decodeMultikey
+  decodeMultikey,
+  decodeEd25519PublicMultikey
 };

package/dist/{chunk-T2YR5KWQ.js → chunk-FZHHSC5N.js}

@@ -1,6 +1,6 @@
 import {
-  decodeMultikey
-} from "./chunk-IDVYITX7.js";
+  decodeEd25519PublicMultikey
+} from "./chunk-F7RHI2CK.js";
 import {
   assertJwsProfile,
   base64urlDecode,
@@ -10,7 +10,7 @@ import {
   decodeJwsUnsafe,
   sha256,
   verifyJws
-} from "./chunk-4LG2GEB2.js";
+} from "./chunk-KAW4MT4P.js";
 
 // src/credentials/schemas.ts
 import { z } from "zod";
@@ -355,7 +355,10 @@ var verifyProofEnvelope = async (input, shape, resolvePresenter) => {
   const key = state.keys.find((candidate) => candidate.id === presenterKeyId);
   if (!key) throw invalidProof(`${shape.label} signing key is not a current key of the presenter`);
   try {
-    verifyJws({ token: input.proof, publicKey: decodeMultikey(key.publicKeyMultibase).keyBytes });
+    verifyJws({
+      token: input.proof,
+      publicKey: decodeEd25519PublicMultikey(key.publicKeyMultibase)
+    });
   } catch (err) {
     throw invalidProof(err instanceof Error ? err.message : `invalid ${shape.label} signature`);
   }
@@ -382,7 +385,7 @@ var resolveKeyFromIdentity = (identity, kid, determinate) => {
     );
     throw determinate ? miss : markDependencyMissing(miss);
   }
-  const { keyBytes } = decodeMultikey(key.publicKeyMultibase);
+  const keyBytes = decodeEd25519PublicMultikey(key.publicKeyMultibase);
   return keyBytes;
 };
 var basisUnixSeconds = (basis) => {
@@ -435,6 +438,7 @@ var verifyDFOSCredential = async (jwsToken, options) => {
   }
   const payload = result.data;
   const kid = decoded.header.kid;
+  if (kid === void 0) throw new CredentialVerificationError("credential kid must be present");
   const hashIdx = kid.indexOf("#");
   if (hashIdx < 0) throw new CredentialVerificationError("credential kid must be a DID URL");
   const kidDid = kid.substring(0, hashIdx);
@@ -456,7 +460,7 @@ var verifyDFOSCredential = async (jwsToken, options) => {
   } catch {
     throw new CredentialVerificationError("invalid credential signature");
   }
-  const encoded = await dagCborCanonicalEncode(payload);
+  const encoded = await dagCborCanonicalEncode(decoded.payload);
   const credentialCID = encoded.cid.toString();
   if (!decoded.header.cid) {
     throw new CredentialVerificationError("missing cid in credential header");
@@ -534,8 +538,9 @@ var parseResource = (resource) => {
   if (colonIdx < 0) return null;
   return { type: resource.substring(0, colonIdx), id: resource.substring(colonIdx + 1) };
 };
+var ASCII_TRIM_RE = /^[\t\n\v\f\r ]+|[\t\n\v\f\r ]+$/g;
 var parseActions = (action) => new Set(
-  action.split(",").map((a) => a.trim()).filter((a) => a !== "")
+  action.split(",").map((a) => a.replace(ASCII_TRIM_RE, "")).filter((a) => a !== "")
 );
 var isAttenuated = (parentAtt, childAtt) => {
   return childAtt.every((childEntry) => {
@@ -592,7 +597,7 @@ var matchesResource = async (att, resource, action) => {
 };
 var decodeDFOSCredentialUnsafe = (jwsToken) => {
   const decoded = decodeJwsUnsafe(jwsToken);
-  if (!decoded) return null;
+  if (!decoded || decoded.header.kid === void 0) return null;
   const result = DFOSCredentialPayload.safeParse(decoded.payload);
   if (!result.success) return null;
   return {

package/dist/{chunk-4LG2GEB2.js → chunk-KAW4MT4P.js}

@@ -79,6 +79,68 @@ var normalizedId = (prefix, id) => {
   return `${prefixLowered}_${idLowered}`;
 };
 
+// src/crypto/json-scan.ts
+var assertCanonicalJsonText = (text) => {
+  const frames = [];
+  let i = 0;
+  while (i < text.length) {
+    const ch = text[i];
+    if (ch === '"') {
+      const end = scanStringToken(text, i);
+      if (end < 0) return;
+      const value = decodeStringToken(text.slice(i, end));
+      if (value === null) return;
+      if (LONE_SURROGATE_RE.test(value)) {
+        throw new Error("string with an unpaired surrogate is not canonicalizable");
+      }
+      const frame = frames[frames.length - 1];
+      if (frame && frame.isObject && frame.awaitingKey) {
+        if (frame.keys.has(value)) {
+          throw new Error(`duplicate JSON key is malformed: ${JSON.stringify(value)}`);
+        }
+        frame.keys.add(value);
+        frame.awaitingKey = false;
+      }
+      i = end;
+      continue;
+    }
+    if (ch === "{") {
+      frames.push({ isObject: true, keys: /* @__PURE__ */ new Set(), awaitingKey: true });
+    } else if (ch === "[") {
+      frames.push({ isObject: false, keys: /* @__PURE__ */ new Set(), awaitingKey: false });
+    } else if (ch === "}" || ch === "]") {
+      frames.pop();
+    } else if (ch === ",") {
+      const frame = frames[frames.length - 1];
+      if (frame && frame.isObject) frame.awaitingKey = true;
+    }
+    i++;
+  }
+};
+var scanStringToken = (text, start) => {
+  let i = start + 1;
+  while (i < text.length) {
+    const ch = text[i];
+    if (ch === "\\") {
+      i += 2;
+      continue;
+    }
+    if (ch === '"') return i + 1;
+    i++;
+  }
+  return -1;
+};
+var decodeStringToken = (raw) => {
+  if (!raw.includes("\\")) return raw.slice(1, -1);
+  try {
+    const value = JSON.parse(raw);
+    return typeof value === "string" ? value : null;
+  } catch {
+    return null;
+  }
+};
+var LONE_SURROGATE_RE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+
 // src/crypto/jws-profile.ts
 var assertJwsProfile = (header, makeError) => {
   if (header.alg !== "EdDSA") {
@@ -96,6 +158,30 @@ var assertJwsProfile = (header, makeError) => {
 };
 
 // src/crypto/jws.ts
+var decodeJwsSegment = (segmentB64) => {
+  let text;
+  try {
+    text = new TextDecoder("utf-8", { fatal: true }).decode(base64urlDecode(segmentB64));
+  } catch {
+    return null;
+  }
+  assertCanonicalJsonText(text);
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+  return value;
+};
+var asJwsHeader = (raw) => {
+  if (typeof raw["alg"] !== "string") return null;
+  if (typeof raw["typ"] !== "string") return null;
+  if ("kid" in raw && typeof raw["kid"] !== "string") return null;
+  if ("cid" in raw && typeof raw["cid"] !== "string") return null;
+  return raw;
+};
 var createJws = async (options) => {
   const headerB64 = base64urlEncode(JSON.stringify(options.header));
   const payloadB64 = base64urlEncode(JSON.stringify(options.payload));
@@ -111,18 +197,22 @@ var verifyJws = (options) => {
     throw new JwsVerificationError("Invalid token format");
   }
   const [headerB64, payloadB64, signatureB64] = parts;
-  let header;
+  let rawHeader;
   let payload;
   try {
-    header = JSON.parse(new TextDecoder().decode(base64urlDecode(headerB64)));
-    payload = JSON.parse(new TextDecoder().decode(base64urlDecode(payloadB64)));
-  } catch {
+    rawHeader = decodeJwsSegment(headerB64);
+    payload = decodeJwsSegment(payloadB64);
+  } catch (e) {
+    throw new JwsVerificationError(e.message);
+  }
+  if (!rawHeader || !payload) {
     throw new JwsVerificationError("Failed to decode token");
   }
-  assertJwsProfile(
-    header,
-    (m) => new JwsVerificationError(m)
-  );
+  assertJwsProfile(rawHeader, (m) => new JwsVerificationError(m));
+  const header = asJwsHeader(rawHeader);
+  if (!header) {
+    throw new JwsVerificationError("Invalid protected header");
+  }
   const signingInput = `${headerB64}.${payloadB64}`;
   const signingInputBytes = new TextEncoder().encode(signingInput);
   const signatureBytes = base64urlDecode(signatureB64);
@@ -135,14 +225,19 @@ var verifyJws = (options) => {
 var decodeJwsUnsafe = (token) => {
   const parts = token.split(".");
   if (parts.length !== 3) return null;
+  const [headerB64, payloadB64] = parts;
+  let rawHeader;
+  let payload;
   try {
-    const [headerB64, payloadB64] = parts;
-    const header = JSON.parse(new TextDecoder().decode(base64urlDecode(headerB64)));
-    const payload = JSON.parse(new TextDecoder().decode(base64urlDecode(payloadB64)));
-    return { header, payload };
+    rawHeader = decodeJwsSegment(headerB64);
+    payload = decodeJwsSegment(payloadB64);
   } catch {
     return null;
   }
+  if (!rawHeader || !payload) return null;
+  const header = asJwsHeader(rawHeader);
+  if (!header) return null;
+  return { header, payload };
 };
 var JwsVerificationError = class extends Error {
   constructor(message) {
@@ -203,7 +298,7 @@ var verifyJwt = (options) => {
   const isValid = isValidEd25519Signature(signingInputBytes, signatureBytes, options.publicKey);
   if (!isValid) throw new JwtVerificationError("Invalid signature");
   const currentTime = options.currentTime ?? Math.floor(Date.now() / 1e3);
-  if (payload.exp <= currentTime) {
+  if (!Number.isSafeInteger(payload.exp) || payload.exp <= currentTime) {
     throw new JwtVerificationError("Token expired");
   }
   if (options.issuer !== void 0 && payload.iss !== options.issuer) {
@@ -231,20 +326,25 @@ import * as Block from "multiformats/block";
 import { CID } from "multiformats/cid";
 import { sha256 as sha2562 } from "multiformats/hashes/sha2";
 var dagCborCanonicalEncode = async (value) => {
-  assertCanonicalNumbers(value);
+  assertCanonicalValue(value);
   const serialized = JSON.parse(JSON.stringify(value));
-  assertCanonicalNumbers(serialized);
-  return await Block.encode({
-    // removes any undefineds or other non-serializable values (and normalizes
-    // -0 to 0)
-    value: serialized,
-    codec: dagCborCodec,
-    hasher: sha2562
-  });
+  assertCanonicalValue(serialized);
+  try {
+    return await Block.encode({
+      // removes any undefineds or other non-serializable values (and normalizes
+      // -0 to 0)
+      value: serialized,
+      codec: dagCborCodec,
+      hasher: sha2562
+    });
+  } catch (e) {
+    throw new Error(`value is not canonically encodable: ${e.message}`);
+  }
 };
 var MAX_SAFE_CANONICAL_INTEGER = 9007199254740991;
 var MAX_CANONICAL_DEPTH = 1024;
-var assertCanonicalNumbers = (value, depth = 0) => {
+var LONE_SURROGATE_RE2 = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+var assertCanonicalValue = (value, depth = 0) => {
   if (depth > MAX_CANONICAL_DEPTH) {
     throw new Error(`value nesting exceeds max depth ${MAX_CANONICAL_DEPTH}`);
   }
@@ -264,12 +364,26 @@ var assertCanonicalNumbers = (value, depth = 0) => {
     }
     return;
   }
+  if (typeof value === "string") {
+    if (LONE_SURROGATE_RE2.test(value)) {
+      throw new Error("string with an unpaired surrogate is not canonicalizable");
+    }
+    return;
+  }
   if (Array.isArray(value)) {
-    for (const entry of value) assertCanonicalNumbers(entry, depth + 1);
+    for (const entry of value) assertCanonicalValue(entry, depth + 1);
     return;
   }
   if (value !== null && typeof value === "object") {
-    for (const entry of Object.values(value)) assertCanonicalNumbers(entry, depth + 1);
+    if ("/" in value && "bytes" in value) {
+      throw new Error('object carrying both "/" and "bytes" members is not canonicalizable');
+    }
+    for (const [key, entry] of Object.entries(value)) {
+      if (LONE_SURROGATE_RE2.test(key)) {
+        throw new Error("string with an unpaired surrogate is not canonicalizable");
+      }
+      assertCanonicalValue(entry, depth + 1);
+    }
   }
 };
 var parseDagCborCID = (cid) => {
@@ -293,6 +407,7 @@ export {
   generateId,
   isValidId,
   normalizedId,
+  assertCanonicalJsonText,
   assertJwsProfile,
   createJws,
   verifyJws,

package/dist/{chunk-LMAPBTDW.js → chunk-Q7FREWMY.js}

@@ -6,16 +6,16 @@ import {
   matchesResource,
   verifyDFOSCredential,
   verifyDelegationChain
-} from "./chunk-T2YR5KWQ.js";
+} from "./chunk-FZHHSC5N.js";
 import {
   KEY_ADD_JWS_TYP,
   KEY_ROLES,
   unsafeKeyProofSubject,
   verifyChainKeyProof
-} from "./chunk-JVSC67DC.js";
+} from "./chunk-BMIOY5W5.js";
 import {
-  decodeMultikey
-} from "./chunk-IDVYITX7.js";
+  decodeEd25519PublicMultikey
+} from "./chunk-F7RHI2CK.js";
 import {
   assertJwsProfile,
   base64urlDecode,
@@ -25,13 +25,13 @@ import {
   decodeJwsUnsafe,
   generateIdNoPrefix,
   verifyJws
-} from "./chunk-4LG2GEB2.js";
+} from "./chunk-KAW4MT4P.js";
 
 // src/chain/schemas.ts
 import { z } from "zod";
 var MAX_KEYS_PER_ROLE = 256;
 var MAX_KEY_PROOFS = 256;
-var MAX_RELATION = 64;
+var MAX_RELATION_BYTES = 64;
 var MAX_SERVICES_ENTRIES = 256;
 var MAX_SERVICES_PAYLOAD_SIZE = 32768;
 var MAX_OPERATION_SIZE = 65536;
@@ -78,7 +78,7 @@ var parseProtocolTimestampUnix = (value) => {
   const ms = Date.parse(value);
   return Number.isFinite(ms) ? Math.floor(ms / 1e3) : null;
 };
-var CIDString = z.string();
+var CIDString = z.string().min(1, "CID must not be empty");
 var IdentityCreate = z.looseObject({
   version: z.literal(1),
   type: z.literal("create"),
@@ -261,7 +261,9 @@ var CountersignPayload = z.looseObject({
   type: z.literal("countersign"),
   did: z.string(),
   targetCID: CIDString,
-  relation: z.string().min(1).max(MAX_RELATION).optional(),
+  relation: z.string().min(1).refine((value) => new TextEncoder().encode(value).length <= MAX_RELATION_BYTES, {
+    message: `relation exceeds ${MAX_RELATION_BYTES} bytes`
+  }).optional(),
   createdAt: Iso8601
 });
 var RevocationPayload = z.looseObject({
@@ -544,7 +546,7 @@ var verifyIdentityChain = async (input) => {
         }
       }
     }
-    const encoded = await dagCborCanonicalEncode(op);
+    const encoded = await dagCborCanonicalEncode(decoded.payload);
     if (encoded.bytes.length > MAX_OPERATION_SIZE) {
       throw new Error(
         `log[${idx}]: operation exceeds max size: ${encoded.bytes.length} > ${MAX_OPERATION_SIZE}`
@@ -558,6 +560,7 @@ var verifyIdentityChain = async (input) => {
       throw new Error(`log[${idx}]: cid mismatch in protected header`);
     }
     const kid = decoded.header.kid;
+    if (kid === void 0) throw new Error(`log[${idx}]: kid must be present`);
     let signingKeyId;
     if (kid.includes("#")) {
       const hashIdx = kid.indexOf("#");
@@ -575,7 +578,7 @@ var verifyIdentityChain = async (input) => {
     if (!signingKey) {
       throw new Error(`log[${idx}]: kid references unknown key: ${signingKeyId}`);
     }
-    const { keyBytes } = decodeMultikey(signingKey.publicKeyMultibase);
+    const keyBytes = decodeEd25519PublicMultikey(signingKey.publicKeyMultibase);
     try {
       verifyJws({ token: jwsToken, publicKey: keyBytes });
     } catch {
@@ -694,7 +697,7 @@ var verifyIdentityExtensionFromTrustedState = async (input) => {
   if (op.createdAt <= lastCreatedAt) {
     throw new Error("createdAt must be after last op");
   }
-  const encoded = await dagCborCanonicalEncode(op);
+  const encoded = await dagCborCanonicalEncode(decoded.payload);
   if (encoded.bytes.length > MAX_OPERATION_SIZE) {
     throw new Error(`operation exceeds max size: ${encoded.bytes.length} > ${MAX_OPERATION_SIZE}`);
   }
@@ -702,6 +705,7 @@ var verifyIdentityExtensionFromTrustedState = async (input) => {
   if (!decoded.header.cid) throw new Error("missing cid in protected header");
   if (decoded.header.cid !== operationCID) throw new Error("cid mismatch in protected header");
   const kid = decoded.header.kid;
+  if (kid === void 0) throw new Error("kid must be present");
   if (!kid.includes("#")) {
     throw new Error("non-genesis op kid must be DID URL, got bare key ID");
   }
@@ -715,7 +719,7 @@ var verifyIdentityExtensionFromTrustedState = async (input) => {
   if (!signingKey) {
     throw new Error(`kid references unknown key: ${signingKeyId}`);
   }
-  const { keyBytes } = decodeMultikey(signingKey.publicKeyMultibase);
+  const keyBytes = decodeEd25519PublicMultikey(signingKey.publicKeyMultibase);
   try {
     verifyJws({ token: newOp, publicKey: keyBytes });
   } catch {
@@ -791,11 +795,13 @@ var verifyIdentityExtensionFromTrustedState = async (input) => {
 
 // src/chain/content-chain.ts
 var operationSizeForCap = async (op, fullByteLength) => {
+  if (op.type === "create") return fullByteLength;
   const auth = op.authorization;
   if (typeof auth !== "string") return fullByteLength;
-  if (auth.length > MAX_CREDENTIAL_SIZE) {
+  const authByteLength = new TextEncoder().encode(auth).length;
+  if (authByteLength > MAX_CREDENTIAL_SIZE) {
     throw new Error(
-      `authorization credential exceeds max size: ${auth.length} > ${MAX_CREDENTIAL_SIZE}`
+      `authorization credential exceeds max size: ${authByteLength} > ${MAX_CREDENTIAL_SIZE}`
     );
   }
   const { authorization: _omit, ...rest } = op;
@@ -888,6 +894,7 @@ var verifyContentChain = async (input) => {
       }
     }
     const kid = decoded.header.kid;
+    if (kid === void 0) throw new Error(`log[${idx}]: kid must be present`);
     const hashIdx = kid.indexOf("#");
     if (hashIdx < 0) throw new Error(`log[${idx}]: kid must be a DID URL`);
     const kidDid = kid.substring(0, hashIdx);
@@ -927,8 +934,8 @@ var verifyContentChain = async (input) => {
         );
       }
     }
-    const encoded = await dagCborCanonicalEncode(op);
-    const opSize = await operationSizeForCap(op, encoded.bytes.length);
+    const encoded = await dagCborCanonicalEncode(decoded.payload);
+    const opSize = await operationSizeForCap(decoded.payload, encoded.bytes.length);
     if (opSize > MAX_OPERATION_SIZE) {
       throw new Error(`operation exceeds max size: ${opSize} > ${MAX_OPERATION_SIZE}`);
     }
@@ -998,6 +1005,7 @@ var verifyContentExtensionFromTrustedState = async (input) => {
     throw new Error("createdAt must be after last op");
   }
   const kid = decoded.header.kid;
+  if (kid === void 0) throw new Error("kid must be present");
   const hashIdx = kid.indexOf("#");
   if (hashIdx < 0) throw new Error("kid must be a DID URL");
   const kidDid = kid.substring(0, hashIdx);
@@ -1032,8 +1040,8 @@ var verifyContentExtensionFromTrustedState = async (input) => {
       throw carryDependencyMissing(err, new Error(`authorization verification failed: ${message}`));
     }
   }
-  const encoded = await dagCborCanonicalEncode(op);
-  const opSize = await operationSizeForCap(op, encoded.bytes.length);
+  const encoded = await dagCborCanonicalEncode(decoded.payload);
+  const opSize = await operationSizeForCap(decoded.payload, encoded.bytes.length);
   if (opSize > MAX_OPERATION_SIZE) {
     throw new Error(`operation exceeds max size: ${opSize} > ${MAX_OPERATION_SIZE}`);
   }
@@ -1076,6 +1084,7 @@ var verifyCountersignature = async (input) => {
   }
   const payload = result.data;
   const kid = decoded.header.kid;
+  if (kid === void 0) throw new Error("kid must be present");
   const hashIdx = kid.indexOf("#");
   if (hashIdx < 0) throw new Error("countersignature kid must be a DID URL");
   const kidDid = kid.substring(0, hashIdx);
@@ -1129,6 +1138,7 @@ var verifyArtifact = async (input) => {
     throw new Error(`invalid artifact typ: ${decoded.header.typ}`);
   }
   const kid = decoded.header.kid;
+  if (kid === void 0) throw new Error("kid must be present");
   const hashIdx = kid.indexOf("#");
   if (hashIdx < 0) throw new Error("artifact kid must be a DID URL");
   const kidDid = kid.substring(0, hashIdx);
@@ -1186,6 +1196,7 @@ var verifyRevocation = async (input) => {
     throw new Error(`invalid revocation typ: ${decoded.header.typ}`);
   }
   const kid = decoded.header.kid;
+  if (kid === void 0) throw new Error("kid must be present");
   const hashIdx = kid.indexOf("#");
   if (hashIdx < 0) throw new Error("revocation kid must be a DID URL");
   const kidDid = kid.substring(0, hashIdx);
@@ -1198,7 +1209,7 @@ var verifyRevocation = async (input) => {
   } catch {
     throw new Error("invalid revocation signature");
   }
-  const encoded = await dagCborCanonicalEncode(payload);
+  const encoded = await dagCborCanonicalEncode(decoded.payload);
   const revocationCID = encoded.cid.toString();
   if (!decoded.header.cid) throw new Error("missing cid in revocation header");
   if (decoded.header.cid !== revocationCID) throw new Error("revocation cid mismatch");
@@ -1231,7 +1242,7 @@ var resolveKeyFromIdentity = (identity, kid) => {
   if (!key) {
     throw markDependencyMissing(invalid(`key ${keyId} not found on identity ${identity.did}`));
   }
-  const { keyBytes } = decodeMultikey(key.publicKeyMultibase);
+  const keyBytes = decodeEd25519PublicMultikey(key.publicKeyMultibase);
   return keyBytes;
 };
 var normalizeClaimCreatedAt = (createdAt) => {
@@ -1291,8 +1302,7 @@ var verifyCreditClaim = async (jwsToken, options) => {
   }
   const decoded = decodeJwsUnsafe(jwsToken);
   if (!decoded) throw invalid("failed to decode credit claim JWS");
-  const rawHeader = decoded.header;
-  if (typeof rawHeader["typ"] !== "string" || typeof rawHeader["kid"] !== "string") {
+  if (typeof decoded.header.kid !== "string") {
     throw invalid("credit claim header must carry a string typ and kid");
   }
   if (decoded.header.typ !== "did:dfos:credit-claim") {
@@ -1327,7 +1337,7 @@ var verifyCreditClaim = async (jwsToken, options) => {
   } catch {
     throw invalid("invalid credit claim signature");
   }
-  const encoded = await dagCborCanonicalEncode(payload);
+  const encoded = await dagCborCanonicalEncode(decoded.payload);
   const claimCID = encoded.cid.toString();
   if (!decoded.header.cid) throw invalid("missing cid in credit claim header");
   if (decoded.header.cid !== claimCID) throw invalid("credit claim cid mismatch");
@@ -1454,7 +1464,7 @@ var resolveCurrentKey = (identity, kid) => {
   );
   if (!key) throw invalid2(`key ${keyId} not found on current identity ${identity.did}`);
   try {
-    return decodeMultikey(key.publicKeyMultibase).keyBytes;
+    return decodeEd25519PublicMultikey(key.publicKeyMultibase);
   } catch {
     throw invalid2(`key ${keyId} on identity ${identity.did} is not a valid Ed25519 multikey`);
   }
@@ -1518,7 +1528,7 @@ var verifySignRequest = async (jwsToken, options) => {
       throw invalid2("sign request protected header must be an object");
     }
     assertJwsProfile(rawHeader, invalid2);
-    if (typeof rawHeader["typ"] !== "string" || typeof rawHeader["kid"] !== "string") {
+    if (typeof rawHeader["typ"] !== "string" || typeof decoded.header.kid !== "string") {
       throw invalid2("sign request header must carry a string typ and kid");
     }
     if (decoded.header.typ !== "did:dfos:sign-request") {
@@ -1554,7 +1564,7 @@ var verifySignRequest = async (jwsToken, options) => {
     }
     let encoded;
     try {
-      encoded = await dagCborCanonicalEncode(payload);
+      encoded = await dagCborCanonicalEncode(decoded.payload);
     } catch (error) {
       const detail = error instanceof Error ? error.message : String(error);
       throw invalid2(`failed to derive sign request CID: ${detail}`);

package/dist/credentials/index.d.ts

@@ -1,15 +1,16 @@
-export { b as Attenuation, e as CredentialVerificationError, D as DFOSCredentialPayload, i as MAX_CREDENTIAL_SIZE, R as ResolvedIdentity, r as RevocationChecker, V as VerifiedDFOSCredential, w as VerifiedDelegationChain, z as createDFOSCredential, B as decodeDFOSCredentialUnsafe, E as isAttenuated, F as matchesResource, H as verifyDFOSCredential, J as verifyDelegationChain } from '../dfos-credential-CtG0_n4P.js';
+export { b as Attenuation, e as CredentialVerificationError, D as DFOSCredentialPayload, i as MAX_CREDENTIAL_SIZE, R as ResolvedIdentity, r as RevocationChecker, V as VerifiedDFOSCredential, w as VerifiedDelegationChain, z as createDFOSCredential, B as decodeDFOSCredentialUnsafe, E as isAttenuated, F as matchesResource, H as verifyDFOSCredential, J as verifyDelegationChain } from '../dfos-credential-j-kHtFvG.js';
 import 'zod';
 
 /**
- * The normative JWS header `typ` for a request proof (API-AUTH.md). Signers MUST
- * set it; the request-proof verifier rejects anything else — it is also what lets
- * typ-routing dispatchers tell a proof apart from credentials and chain ops.
+ * The normative JWS header `typ` for a request proof (INTEGRATIONS.md, The
+ * request proof). Signers MUST set it; the request-proof verifier rejects
+ * anything else — it is also what lets typ-routing dispatchers tell a proof
+ * apart from credentials and chain ops.
  */
 declare const REQUEST_PROOF_JWS_TYP = "did:dfos:request-proof";
 /**
- * The normative JWS header `typ` for an identity proof (API-AUTH.md) — the
- * request proof's credential-less sibling.
+ * The normative JWS header `typ` for an identity proof (INTEGRATIONS.md, The
+ * identity proof) — the request proof's credential-less sibling.
  *
  * THE TYP GATE IS ABSOLUTE, IN BOTH DIRECTIONS. "Possession of a grant's
  * audience key" and "possession of a bare identity's key" are different claims,
@@ -84,10 +85,10 @@ interface IdentityProofPayload {
 /**
  * ADDITIVE MEMBERS, appended AFTER the canonical order.
  *
- * API-AUTH.md's growth rule is additive members on this envelope, never a new
- * envelope: "additional members register additively, appended to the canonical
- * order". `jti` — the per-request uniqueness member a write-gating deployment
- * requires — is the named one.
+ * INTEGRATIONS.md, One envelope, optional credential's growth rule is additive
+ * members on this envelope, never a new envelope: "additional members register
+ * additively, appended to the canonical order". `jti` — the per-request
+ * uniqueness member a write-gating deployment requires — is the named one.
  *
  * TWO RULES MAKE THIS A BYTE-TWIN. (1) Extra members are emitted AFTER every
  * canonical member, so a verifier that ignores them still reconstructs the same
@@ -173,7 +174,7 @@ interface SignApiRequestInput {
     /**
      * ADDITIVE members, appended after the canonical order in lexicographic name
      * order. `{ jti }` is the registered one — required by a deployment that gates
-     * WRITES with this envelope (API-AUTH.md, Security Considerations).
+     * WRITES with this envelope (INTEGRATIONS.md, API security notes).
      */
     extraMembers?: ProofExtraMembers;
 }
@@ -211,7 +212,7 @@ interface SignApiIdentityRequestInput {
     /**
      * ADDITIVE members, appended after the canonical order in lexicographic name
      * order. `{ jti }` is the registered one, and a WRITE-SHAPED surface — relay
-     * ingestion, blob upload — REQUIRES it (WEB-RELAY.md, Authentication).
+     * ingestion, blob upload — REQUIRES it (INTEGRATIONS.md, API security notes).
      */
     extraMembers?: ProofExtraMembers;
 }
@@ -247,8 +248,8 @@ declare const buildApiAuthHeaders: (input: {
  * On an `api:<host>` surface an accompanying `X-Credential` is MALFORMED: the
  * two headers would assert two different claims at once. A relay content-plane
  * read is NOT that case — there the identity proof is the AuthN half and a DFOS
- * credential presentation is a separate authorization artifact (WEB-RELAY.md,
- * Authentication) — so that refusal belongs to the middleware of the surface
+ * credential presentation is a separate authorization artifact (RELAY.md,
+ * Access) — so that refusal belongs to the middleware of the surface
  * being served, never to this builder.
  */
 declare const buildApiIdentityHeaders: (input: {
@@ -317,7 +318,7 @@ interface ProofPresenterState {
 type ResolveProofPresenter = (did: string) => Promise<ProofPresenterState | null>;
 /**
  * What the PROOF PHASE reads — the subset of a verifier's inputs that
- * API-AUTH.md steps 1–7 touch.
+ * INTEGRATIONS.md, Verification algorithm steps 1–7 touch.
  */
 interface ProofEnvelopeInput {
     /** The proof JWS — the `Authorization: DFOS <token>` token, scheme stripped. */
@@ -346,8 +347,8 @@ interface ProofEnvelopeInput {
     now?: () => number;
 }
 /**
- * API-AUTH.md step 4's CONFIG half, hoisted so a caller can run it BEFORE any
- * request-dependent gate.
+ * INTEGRATIONS.md, Verification algorithm step 4's freshness configuration,
+ * hoisted so a caller can run it BEFORE any request-dependent gate.
  *
  * ORDER IS LOAD-BEARING. A deployment whose freshness span is out of bounds must
  * never verify anything, and its misconfiguration must never be REPORTED as a
@@ -399,9 +400,9 @@ interface VerifiedProofEnvelope {
  */
 declare const verifyIdentityProofEnvelope: (input: ProofEnvelopeInput, resolvePresenter: ResolveProofPresenter) => Promise<VerifiedProofEnvelope>;
 /**
- * Verify a REQUEST proof's envelope — API-AUTH.md steps 1–7 with the request
- * `typ`. The caller then performs steps 8–11 (the credential walk), for which a
- * verified proof signature is the gate.
+ * Verify a REQUEST proof's envelope — INTEGRATIONS.md, Verification algorithm
+ * steps 1–7 with the request `typ`. The caller then performs steps 8–11 (the
+ * credential walk), for which a verified proof signature is the gate.
  */
 declare const verifyRequestProofEnvelope: (input: ProofEnvelopeInput, resolvePresenter: ResolveProofPresenter) => Promise<VerifiedProofEnvelope>;
 

package/dist/credentials/index.js

@@ -34,9 +34,9 @@ import {
   verifyDelegationChain,
   verifyIdentityProofEnvelope,
   verifyRequestProofEnvelope
-} from "../chunk-T2YR5KWQ.js";
-import "../chunk-IDVYITX7.js";
-import "../chunk-4LG2GEB2.js";
+} from "../chunk-FZHHSC5N.js";
+import "../chunk-F7RHI2CK.js";
+import "../chunk-KAW4MT4P.js";
 export {
   ApiRequestVerifyError,
   Attenuation,

package/dist/crypto/index.d.ts

@@ -85,7 +85,7 @@ declare const normalizedId: <T extends string>(prefix: T, id: string) => `${T}_$
 interface JwsHeader {
     alg: 'EdDSA';
     typ: string;
-    kid: string;
+    kid?: string;
     /** CIDv1 of the operation payload (dag-cbor + SHA-256), signed in the protected header */
     cid?: string;
 }
@@ -96,7 +96,9 @@ interface JwsHeader {
  * signature (64 bytes)
  */
 declare const createJws: (options: {
-    header: JwsHeader;
+    header: JwsHeader & {
+        kid: string;
+    };
     payload: Record<string, unknown>;
     sign: (message: Uint8Array) => Promise<Uint8Array>;
 }) => Promise<string>;
@@ -128,6 +130,28 @@ declare class JwsVerificationError extends Error {
     constructor(message: string);
 }
 
+/**
+ * Reject a signed JSON document whose raw text carries something its decoded
+ * value can no longer show:
+ *
+ * 1. DUPLICATE KEYS — PROTOCOL: "A payload containing duplicate keys is
+ *    malformed: the signature commits to the raw payload bytes while the CID
+ *    derives from the decoded value." Every JSON parser silently resolves a
+ *    duplicate (last wins), so the only place to see one is the text.
+ * 2. LONE SURROGATE ESCAPES — a `\uD800`-class escape with no pair. TypeScript
+ *    keeps it; Go's decoder replaces it with U+FFFD. Two verifiers would derive
+ *    two different CIDs from the same signed bytes, so refusing the escape is
+ *    the one verdict both can reach.
+ *
+ * This is a tokenizer, not a parser: it does not validate the grammar — the
+ * caller's `JSON.parse` is the grammar judge, and this walk simply stops at the
+ * first thing it cannot read. It tracks only enough structure to know which
+ * strings are member names of which object.
+ *
+ * MUST match the Go reference (AssertCanonicalJSONText in json_scan.go).
+ */
+declare const assertCanonicalJsonText: (text: string) => void;
+
 /**
  * Apply the DFOS signature verification profile to a decoded protected header.
  *
@@ -214,4 +238,4 @@ declare const parseDagCborCID: (cid: string) => CID<unknown, number, number, mul
  */
 declare const isCanonicallyEqual: (data1: unknown, data2: unknown) => Promise<boolean>;
 
-export { type JwsHeader, JwsVerificationError, type JwtClaims, type JwtCreateOptions, type JwtHeader, JwtVerificationError, type JwtVerifyOptions, type PrefixedID, assertJwsProfile, base64urlDecode, base64urlEncode, createJws, createJwt, createNewEd25519Keypair, dagCborCanonicalEncode, decodeJwsUnsafe, decodeJwtUnsafe, generateId, generateIdNoPrefix, importEd25519Keypair, isCanonicallyEqual, isValidEd25519Signature, isValidId, normalizedId, parseDagCborCID, sha256, signPayloadEd25519, verifyJws, verifyJwt };
+export { type JwsHeader, JwsVerificationError, type JwtClaims, type JwtCreateOptions, type JwtHeader, JwtVerificationError, type JwtVerifyOptions, type PrefixedID, assertCanonicalJsonText, assertJwsProfile, base64urlDecode, base64urlEncode, createJws, createJwt, createNewEd25519Keypair, dagCborCanonicalEncode, decodeJwsUnsafe, decodeJwtUnsafe, generateId, generateIdNoPrefix, importEd25519Keypair, isCanonicallyEqual, isValidEd25519Signature, isValidId, normalizedId, parseDagCborCID, sha256, signPayloadEd25519, verifyJws, verifyJwt };

package/dist/crypto/index.js

@@ -1,6 +1,7 @@
 import {
   JwsVerificationError,
   JwtVerificationError,
+  assertCanonicalJsonText,
   assertJwsProfile,
   base64urlDecode,
   base64urlEncode,
@@ -22,10 +23,11 @@ import {
   signPayloadEd25519,
   verifyJws,
   verifyJwt
-} from "../chunk-4LG2GEB2.js";
+} from "../chunk-KAW4MT4P.js";
 export {
   JwsVerificationError,
   JwtVerificationError,
+  assertCanonicalJsonText,
   assertJwsProfile,
   base64urlDecode,
   base64urlEncode,

package/dist/{dfos-credential-CtG0_n4P.d.ts → dfos-credential-j-kHtFvG.d.ts}

@@ -440,7 +440,8 @@ declare const MAX_SIGN_REQUEST_PAYLOAD_SIZE = 4096;
  *
  * Unknown envelope fields are preserved-and-ignored, matching every other wire
  * payload in this file. The signer-side target-payload check is deliberately
- * strict instead: a signer refuses fields it cannot render (see SIGNING.md).
+ * strict instead: a signer refuses fields it cannot render (see RELAY.md,
+ * Signer obligations).
  */
 declare const SignRequestPayload: z.ZodObject<{
     version: z.ZodLiteral<1>;

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-export { JwsHeader, JwsVerificationError, JwtClaims, JwtCreateOptions, JwtHeader, JwtVerificationError, JwtVerifyOptions, PrefixedID, assertJwsProfile, base64urlDecode, base64urlEncode, createJws, createJwt, createNewEd25519Keypair, dagCborCanonicalEncode, decodeJwsUnsafe, decodeJwtUnsafe, generateId, generateIdNoPrefix, importEd25519Keypair, isCanonicallyEqual, isValidEd25519Signature, isValidId, normalizedId, parseDagCborCID, sha256, signPayloadEd25519, verifyJws, verifyJwt } from './crypto/index.js';
-export { A as ARTIFACT_CID_ANCHOR_RE, a as ArtifactPayload, b as Attenuation, C as CONTENT_ID_ANCHOR_RE, c as ContentOperation, d as CountersignPayload, e as CredentialVerificationError, f as CreditClaimPayload, D as DFOSCredentialPayload, g as DeclaredKeyState, I as IdentityOperation, h as Iso8601, M as MAX_ARTIFACT_PAYLOAD_SIZE, i as MAX_CREDENTIAL_SIZE, j as MAX_CREDIT_CLAIM_SIZE, k as MAX_KEY_PROOFS, l as MAX_OPERATION_SIZE, m as MAX_SERVICES_ENTRIES, n as MAX_SERVICES_PAYLOAD_SIZE, o as MAX_SIGN_REQUEST_PAYLOAD_SIZE, p as MAX_SIGN_REQUEST_SIZE, q as MultikeyPublicKey, R as ResolvedIdentity, r as RevocationChecker, s as RevocationPayload, S as ServiceEntry, t as ServicesArray, u as SignRequestPayload, v as Signer, V as VerifiedDFOSCredential, w as VerifiedDelegationChain, x as VerifiedIdentity, y as VoidKeyMembership, z as createDFOSCredential, B as decodeDFOSCredentialUnsafe, E as isAttenuated, F as matchesResource, G as parseProtocolTimestampUnix, H as verifyDFOSCredential, J as verifyDelegationChain } from './dfos-credential-CtG0_n4P.js';
-export { AnchorKind, CreditClaimFailureReason, CreditClaimVerifyError, CreditEntry, CreditEntryState, ED25519_PRIV_MULTICODEC, ED25519_PUB_MULTICODEC, RECOGNIZED_SERVICE_TYPES, SignRequestFailureReason, SignRequestVerifyError, VerifiedArtifact, VerifiedContentChain, VerifiedCountersignature, VerifiedCreditClaim, VerifiedCreditEntry, VerifiedRevocation, VerifiedSignRequest, anchorsByLabel, assertCanonicalSignRequestPayload, assertServicesWithinCap, buildSignRequest, classifyAnchor, decodeMultikey, deriveChainIdentifier, deriveContentId, encodeEd25519Multikey, isRecognizedServiceType, relayEndpoints, signArtifact, signContentOperation, signCountersignature, signCreditClaim, signIdentityOperation, signRevocation, verifyArtifact, verifyContentChain, verifyContentExtensionFromTrustedState, verifyCountersignature, verifyCreditClaim, verifyCreditEntry, verifyIdentityChain, verifyIdentityExtensionFromTrustedState, verifyRevocation, verifySignRequest } from './chain/index.js';
+export { JwsHeader, JwsVerificationError, JwtClaims, JwtCreateOptions, JwtHeader, JwtVerificationError, JwtVerifyOptions, PrefixedID, assertCanonicalJsonText, assertJwsProfile, base64urlDecode, base64urlEncode, createJws, createJwt, createNewEd25519Keypair, dagCborCanonicalEncode, decodeJwsUnsafe, decodeJwtUnsafe, generateId, generateIdNoPrefix, importEd25519Keypair, isCanonicallyEqual, isValidEd25519Signature, isValidId, normalizedId, parseDagCborCID, sha256, signPayloadEd25519, verifyJws, verifyJwt } from './crypto/index.js';
+export { A as ARTIFACT_CID_ANCHOR_RE, a as ArtifactPayload, b as Attenuation, C as CONTENT_ID_ANCHOR_RE, c as ContentOperation, d as CountersignPayload, e as CredentialVerificationError, f as CreditClaimPayload, D as DFOSCredentialPayload, g as DeclaredKeyState, I as IdentityOperation, h as Iso8601, M as MAX_ARTIFACT_PAYLOAD_SIZE, i as MAX_CREDENTIAL_SIZE, j as MAX_CREDIT_CLAIM_SIZE, k as MAX_KEY_PROOFS, l as MAX_OPERATION_SIZE, m as MAX_SERVICES_ENTRIES, n as MAX_SERVICES_PAYLOAD_SIZE, o as MAX_SIGN_REQUEST_PAYLOAD_SIZE, p as MAX_SIGN_REQUEST_SIZE, q as MultikeyPublicKey, R as ResolvedIdentity, r as RevocationChecker, s as RevocationPayload, S as ServiceEntry, t as ServicesArray, u as SignRequestPayload, v as Signer, V as VerifiedDFOSCredential, w as VerifiedDelegationChain, x as VerifiedIdentity, y as VoidKeyMembership, z as createDFOSCredential, B as decodeDFOSCredentialUnsafe, E as isAttenuated, F as matchesResource, G as parseProtocolTimestampUnix, H as verifyDFOSCredential, J as verifyDelegationChain } from './dfos-credential-j-kHtFvG.js';
+export { AnchorKind, CreditClaimFailureReason, CreditClaimVerifyError, CreditEntry, CreditEntryState, ED25519_PRIV_MULTICODEC, ED25519_PUB_MULTICODEC, RECOGNIZED_SERVICE_TYPES, SignRequestFailureReason, SignRequestVerifyError, VerifiedArtifact, VerifiedContentChain, VerifiedCountersignature, VerifiedCreditClaim, VerifiedCreditEntry, VerifiedRevocation, VerifiedSignRequest, anchorsByLabel, assertCanonicalSignRequestPayload, assertServicesWithinCap, buildSignRequest, classifyAnchor, decodeEd25519PublicMultikey, decodeMultikey, deriveChainIdentifier, deriveContentId, encodeEd25519Multikey, isRecognizedServiceType, relayEndpoints, signArtifact, signContentOperation, signCountersignature, signCreditClaim, signIdentityOperation, signRevocation, verifyArtifact, verifyContentChain, verifyContentExtensionFromTrustedState, verifyCountersignature, verifyCreditClaim, verifyCreditEntry, verifyIdentityChain, verifyIdentityExtensionFromTrustedState, verifyRevocation, verifySignRequest } from './chain/index.js';
 export { ApiRequestVerifyError, DEFAULT_PROOF_SKEW_SECONDS, DEFAULT_PROOF_WINDOW_SECONDS, DFOS_AUTH_SCHEME, EMPTY_BODY_SHA256, IDENTITY_PROOF_JWS_TYP, IdentityProofPayload, MAX_BODY_BYTES, MAX_PROOF_FRESHNESS_SPAN_SECONDS, MAX_REQUEST_PROOF_SIZE, ParsedProofPayload, ProofEnvelopeInput, ProofExtraMembers, ProofPresenterState, REQUEST_PROOF_JWS_TYP, RequestProofFailurePhase, RequestProofFailureReason, RequestProofPayload, ResolveProofPresenter, SignApiIdentityRequestInput, SignApiRequestInput, VerifiedProofEnvelope, apiIdentitySigningInput, apiRequestSigningInput, assertProofVerifierConfig, buildApiAuthHeaders, buildApiIdentityHeaders, canonicalExtraMembers, invalidProof, misconfiguredProof, parseDfosAuthorization, sha256BodyHash, signApiIdentityRequest, signApiRequest, unverifiableProof, verifyIdentityProofEnvelope, verifyRequestProofEnvelope } from './credentials/index.js';
 export { DEFAULT_KEY_PROOF_SKEW_SECONDS, KEY_ADD_JWS_TYP, KEY_ROLES, KeyProofFailureReason, KeyProofPayload, KeyProofVerifyError, KeyRole, MAX_KEY_PROOF_SIZE, SignKeyProofInput, VerifiedKeyProof, VerifyChainKeyProofOptions, VerifyKeyProofOptions, isCanonicalRoleSet, keyProofSigningInput, keyWordFingerprint, parseRoleSet, roleSetCovers, serializeRoleSet, signKeyProof, unsafeKeyProofSubject, verifyChainKeyProof, verifyKeyProof } from './key-proof/index.js';
 export { FoldOperation, INDEX_V1_SCHEMA, IndexDelta, IndexDocument, IndexEntry, LwwDelta, OrderKey, byteCompare, compareHeadPreference, compareLinear, foldIndexV1, foldLwwMap, linearize } from './fold/index.js';

package/dist/index.js

@@ -52,7 +52,7 @@ import {
   verifyIdentityExtensionFromTrustedState,
   verifyRevocation,
   verifySignRequest
-} from "./chunk-LMAPBTDW.js";
+} from "./chunk-Q7FREWMY.js";
 import {
   ApiRequestVerifyError,
   Attenuation,
@@ -92,7 +92,7 @@ import {
   verifyDelegationChain,
   verifyIdentityProofEnvelope,
   verifyRequestProofEnvelope
-} from "./chunk-T2YR5KWQ.js";
+} from "./chunk-FZHHSC5N.js";
 import {
   DEFAULT_KEY_PROOF_SKEW_SECONDS,
   KEY_ADD_JWS_TYP,
@@ -109,16 +109,18 @@ import {
   unsafeKeyProofSubject,
   verifyChainKeyProof,
   verifyKeyProof
-} from "./chunk-JVSC67DC.js";
+} from "./chunk-BMIOY5W5.js";
 import {
   ED25519_PRIV_MULTICODEC,
   ED25519_PUB_MULTICODEC,
+  decodeEd25519PublicMultikey,
   decodeMultikey,
   encodeEd25519Multikey
-} from "./chunk-IDVYITX7.js";
+} from "./chunk-F7RHI2CK.js";
 import {
   JwsVerificationError,
   JwtVerificationError,
+  assertCanonicalJsonText,
   assertJwsProfile,
   base64urlDecode,
   base64urlEncode,
@@ -140,7 +142,7 @@ import {
   signPayloadEd25519,
   verifyJws,
   verifyJwt
-} from "./chunk-4LG2GEB2.js";
+} from "./chunk-KAW4MT4P.js";
 import {
   INDEX_V1_SCHEMA,
   byteCompare,
@@ -205,6 +207,7 @@ export {
   anchorsByLabel,
   apiIdentitySigningInput,
   apiRequestSigningInput,
+  assertCanonicalJsonText,
   assertCanonicalSignRequestPayload,
   assertJwsProfile,
   assertProofVerifierConfig,
@@ -226,6 +229,7 @@ export {
   createNewEd25519Keypair,
   dagCborCanonicalEncode,
   decodeDFOSCredentialUnsafe,
+  decodeEd25519PublicMultikey,
   decodeJwsUnsafe,
   decodeJwtUnsafe,
   decodeMultikey,

package/dist/key-proof/index.d.ts

@@ -43,7 +43,7 @@ declare const isCanonicalRoleSet: (value: string) => boolean;
 declare const roleSetCovers: (value: string, role: KeyRole) => boolean;
 
 /**
- * The first registered purpose in KEY-PROOF.md's purpose registry: the candidate
+ * The registered key-proof purpose in PROTOCOL.md, The envelope: the candidate
  * key presents for addition to a ceremony-named identity's `authKeys`/
  * `assertKeys` sets.
  *
@@ -57,7 +57,7 @@ declare const KEY_ADD_JWS_TYP = "did:dfos:key-add";
 declare const MAX_KEY_PROOF_SIZE = 4096;
 /**
  * RECOMMENDED acceptance window, in seconds, EITHER SIDE of the verifier's clock
- * — matching a ceremony's own lifetime (KEY-PROOF.md, Verification step 5).
+ * — matching a ceremony's own lifetime (INTEGRATIONS.md, Presentation verification).
  */
 declare const DEFAULT_KEY_PROOF_SKEW_SECONDS = 300;
 /**
@@ -143,11 +143,11 @@ interface SignKeyProofInput {
  * The protected header is EXACTLY `{"alg":"EdDSA","typ":"<purpose>"}` — two
  * members, no `kid` (the key is in no chain and rides in the payload) and no
  * `cid` (there is no operation to bind). It is assembled by hand rather than
- * through `createJws`, whose `JwsHeader` requires a `kid` this envelope must not
+ * through `createJws`, whose header input requires a `kid` this envelope must not
  * carry.
  *
- * HOLDER OBLIGATIONS THIS FUNCTION CANNOT DISCHARGE (KEY-PROOF.md, Holder
- * Obligations). A holder MUST show its human — before calling this — the
+ * HOLDER OBLIGATIONS THIS FUNCTION CANNOT DISCHARGE (INTEGRATIONS.md, Holder
+ * obligations). A holder MUST show its human — before calling this — the
  * audience, the purpose, the adopting identity, and the roles. A proof is
  * consent, and consent that was never displayed was never given.
  *
@@ -210,10 +210,10 @@ interface VerifyKeyProofOptions {
 /** What a verified key proof hands back. */
 interface VerifiedKeyProof {
     /**
-     * The validated payload. THE CALLER MUST NOW RUN STEP 6 against `payload.nonce`:
-     * check that it is a nonce this verifier minted, for this ceremony, not yet
-     * consumed, and consume it ATOMICALLY (check-and-delete) so two racing
-     * completions cannot both pass.
+     * The validated payload. THE CALLER MUST NOW RUN THE NONCE CHECK against
+     * `payload.nonce`: check that it is a nonce this verifier minted, for this
+     * ceremony, not yet consumed, and consume it ATOMICALLY (check-and-delete) so
+     * two racing completions cannot both pass.
      */
     payload: KeyProofPayload;
     /** The header `typ` — equal to `expectedTyp`, since anything else rejected. */
@@ -222,17 +222,18 @@ interface VerifiedKeyProof {
     now: number;
 }
 /**
- * Verify a key proof AT PRESENTATION TIME — KEY-PROOF.md's verification algorithm
- * steps 1–5 and 7: size cap, header gates, the closed payload schema over
- * CANONICAL bytes, the four expectation arms (audience, did, roleSet, prevCID),
- * freshness, and the signature against the payload's OWN `publicKeyMultibase`.
+ * Verify a key proof AT PRESENTATION TIME — INTEGRATIONS.md, Presentation
+ * verification except its nonce check: size cap, header gates, the closed
+ * payload schema over CANONICAL bytes, the four expectation arms (audience,
+ * did, roleSet, prevCID), freshness, and the signature against the payload's
+ * OWN `publicKeyMultibase`.
  *
  * EVERY EXPECTATION IS THE DEPLOYMENT'S OWN VALUE. There is no arm here that
  * compares the envelope to itself. `expectedDid`, `expectedRoleSet` and
  * `expectedPrevCID` are the position the completing authority is about to WRITE;
  * if the envelope names a different one, the holder consented to something else.
  *
- * STEP 6 (NONCE) IS THE CALLER'S, and this function cannot stand in for it. The
+ * THE NONCE CHECK IS THE CALLER'S, and this function cannot stand in for it. The
  * nonce MUST be one this verifier minted, for this ceremony, not yet consumed,
  * checked and consumed ATOMICALLY — a check-and-delete against the verifier's
  * own store, which is state this pure function does not hold. It is returned on

package/dist/key-proof/index.js

@@ -14,9 +14,9 @@ import {
   unsafeKeyProofSubject,
   verifyChainKeyProof,
   verifyKeyProof
-} from "../chunk-JVSC67DC.js";
-import "../chunk-IDVYITX7.js";
-import "../chunk-4LG2GEB2.js";
+} from "../chunk-BMIOY5W5.js";
+import "../chunk-F7RHI2CK.js";
+import "../chunk-KAW4MT4P.js";
 export {
   DEFAULT_KEY_PROOF_SKEW_SECONDS,
   KEY_ADD_JWS_TYP,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metalabel/dfos-protocol",
-  "version": "0.51.0",
+  "version": "0.52.1",
   "type": "module",
   "description": "DFOS Protocol — Ed25519 signed chain primitives, services, credentials, and verification",
   "license": "MIT",