@metalabel/dfos-protocol 0.52.1 → 0.54.0

package/README.md

@@ -36,6 +36,12 @@ import { signKeyProof, verifyKeyProof } from '@metalabel/dfos-protocol/key-proof
 | `@metalabel/dfos-protocol/key-proof`   | KEY-PROOF envelopes — compose/sign and verify a challenge-bound proof that a candidate key is held      |
 | `@metalabel/dfos-protocol/fold`        | Canonical linearization and LWW-map folds for index documents                                           |
 
+## `api:` resources and the `jti` member
+
+An `api:` resource takes one of two forms: `api:<host>`, the whole API surface, and `api:<host>/spaces/<id>`, one space on it. A bare host is the ancestor of every space at that host, so a grant naming the host covers a space-addressed request while a space-scoped grant covers only its own space. `parseApiResource` and `apiResourceCovers` are that rule on its own; `isAttenuated` and `matchesResource` apply it. Every other resource type is exact byte equality, and a malformed `api:` id covers nothing — itself included.
+
+`jti` is the envelope's one registered additive member: a per-request unique string of at most `MAX_JTI_BYTES` UTF-8 bytes, emitted after the canonical members. Pass it typed to `signApiRequest` or `signApiIdentityRequest` (`generateJti()` mints one), set `requireJti` on a verifier to refuse a proof without it, and read the verified value back off the envelope to key a replay cache. A proof carrying none has the bytes it always had.
+
 ## Specifications
 
 | Document                                         | Description                                                                     |
@@ -62,6 +68,7 @@ The `examples/` directory contains deterministic reference fixtures that can be
 - `credential-write.json` — DFOS write credential (broad + content-narrowed)
 - `credential-read.json` — DFOS read credential
 - `identity-services.json` — genesis publishing a services set (relay locator + content/artifact anchors)
+- `api-resource-coverage.json` — the `api:` hierarchy's parse, coverage, attenuation, and matching rows, read by the TypeScript and Go suites alike
 
 ## License
 

package/dist/chain/index.d.ts

@@ -1,5 +1,5 @@
-import { I as IdentityOperation, v as Signer, x as VerifiedIdentity, S as ServiceEntry, c as ContentOperation, R as ResolvedIdentity, r as RevocationChecker, d as CountersignPayload, a as ArtifactPayload } from '../dfos-credential-j-kHtFvG.js';
-export { A as ARTIFACT_CID_ANCHOR_RE, C as CONTENT_ID_ANCHOR_RE, f as CreditClaimPayload, g as DeclaredKeyState, h as Iso8601, M as MAX_ARTIFACT_PAYLOAD_SIZE, j as MAX_CREDIT_CLAIM_SIZE, k as MAX_KEY_PROOFS, l as MAX_OPERATION_SIZE, m as MAX_SERVICES_ENTRIES, n as MAX_SERVICES_PAYLOAD_SIZE, o as MAX_SIGN_REQUEST_PAYLOAD_SIZE, p as MAX_SIGN_REQUEST_SIZE, q as MultikeyPublicKey, s as RevocationPayload, t as ServicesArray, u as SignRequestPayload, y as VoidKeyMembership, G as parseProtocolTimestampUnix } from '../dfos-credential-j-kHtFvG.js';
+import { I as IdentityOperation, v as Signer, x as VerifiedIdentity, S as ServiceEntry, c as ContentOperation, R as ResolvedIdentity, r as RevocationChecker, d as CountersignPayload, a as ArtifactPayload } from '../dfos-credential-DgT8XVTm.js';
+export { A as ARTIFACT_CID_ANCHOR_RE, C as CONTENT_ID_ANCHOR_RE, f as CreditClaimPayload, g as DeclaredKeyState, h as Iso8601, M as MAX_ARTIFACT_PAYLOAD_SIZE, j as MAX_CREDIT_CLAIM_SIZE, k as MAX_KEY_PROOFS, l as MAX_OPERATION_SIZE, m as MAX_SERVICES_ENTRIES, n as MAX_SERVICES_PAYLOAD_SIZE, o as MAX_SIGN_REQUEST_PAYLOAD_SIZE, p as MAX_SIGN_REQUEST_SIZE, q as MultikeyPublicKey, s as RevocationPayload, t as ServicesArray, u as SignRequestPayload, y as VoidKeyMembership, J as parseProtocolTimestampUnix } from '../dfos-credential-DgT8XVTm.js';
 import 'zod';
 
 /** Ed25519 public key multicodec value */
@@ -86,6 +86,25 @@ declare const verifyIdentityChain: (input: {
      */
     asOf?: string;
 }) => Promise<VerifiedIdentity>;
+/**
+ * The trusted state cannot be extended incrementally: it does not carry the
+ * chain-wide id-to-material binding. The caller replays the log.
+ *
+ * THERE IS NO RECONSTRUCTION, and that is the whole point. `seenKeys` is a
+ * monotonic index that never forgets a key id once the chain declared it — even
+ * after the id is dropped from the declared arrays — and nothing else in the
+ * state remembers it: an id introduced without a proof and then removed is in
+ * neither `declared` (removed) nor `provedKeys` (never proved). Reading the
+ * binding off those two arrays therefore treats a re-declaration of that id,
+ * bound to DIFFERENT material, as a fresh introduction and accepts it — while a
+ * full replay of the same operations rejects it. A fast path that accepts what
+ * its own re-verification refuses is worse than one that says it cannot answer.
+ *
+ * The Go twin is `ErrIdentityStateNoSeenKeys`, with this exact message.
+ */
+declare class IdentityStateNoSeenKeysError extends Error {
+    constructor();
+}
 /**
  * Verify a single new operation against already-verified identity state
  *
@@ -100,7 +119,8 @@ declare const verifyIdentityChain: (input: {
  * is REJECTED on this path exactly as a replay of the same two operations would
  * reject it. Without that the fast path would accept a chain its own
  * re-verification refuses, and a relay's linear path is the path almost every
- * operation takes.
+ * operation takes. A state that does not carry `seenKeys` is therefore not
+ * extensible at all — see `IdentityStateNoSeenKeysError`.
  *
  * THE POSSESSION FOLD RUNS HERE TOO, and it needs both halves of the trusted
  * state: the EFFECTIVE arrays (to know what an introduction is a transition out
@@ -130,8 +150,16 @@ type AnchorKind = 'chain' | 'artifact' | 'invalid';
  * Enforce the services byte cap on the CBOR-encoded array — same encoding the
  * wire uses, so the bound is identical across implementations. Mirrors the
  * artifact payload size check.
+ *
+ * MEASURE THE RAW DECODED PAYLOAD'S ARRAY, never zod's output. The parameter is
+ * `unknown` to make that hard to get wrong: the schema is a validator, not a
+ * canonicalizer, and its output object is freshly built — a `__proto__` data
+ * member (constructible only by `JSON.parse`) does not survive the copy. Handing
+ * this the parsed `op.services` measured 19 bytes for a 33,032-byte signed
+ * array, which Go's `parseServices` — reading the wire map directly — rejects.
+ * Same rule as the operation CID, and for the same reason.
  */
-declare const assertServicesWithinCap: (services: ServiceEntry[]) => Promise<void>;
+declare const assertServicesWithinCap: (services: unknown) => Promise<void>;
 /**
  * Classify a ContentAnchor target by structural form. Resolvers dispatch on the
  * result: 'chain' → resolve a content chain by contentId; 'artifact' → fetch by
@@ -560,4 +588,4 @@ declare const assertCanonicalSignRequestPayload: (payloadTyp: string, payloadByt
     subject: string;
 }) => void;
 
-export { type AnchorKind, ArtifactPayload, ContentOperation, CountersignPayload, type CreditClaimFailureReason, CreditClaimVerifyError, type CreditEntry, type CreditEntryState, ED25519_PRIV_MULTICODEC, ED25519_PUB_MULTICODEC, IdentityOperation, RECOGNIZED_SERVICE_TYPES, ServiceEntry, type SignRequestFailureReason, SignRequestVerifyError, Signer, type VerifiedArtifact, type VerifiedContentChain, type VerifiedCountersignature, type VerifiedCreditClaim, type VerifiedCreditEntry, VerifiedIdentity, type VerifiedRevocation, type VerifiedSignRequest, anchorsByLabel, assertCanonicalSignRequestPayload, assertServicesWithinCap, buildSignRequest, classifyAnchor, decodeEd25519PublicMultikey, decodeMultikey, deriveChainIdentifier, deriveContentId, encodeEd25519Multikey, isRecognizedServiceType, relayEndpoints, signArtifact, signContentOperation, signCountersignature, signCreditClaim, signIdentityOperation, signRevocation, verifyArtifact, verifyContentChain, verifyContentExtensionFromTrustedState, verifyCountersignature, verifyCreditClaim, verifyCreditEntry, verifyIdentityChain, verifyIdentityExtensionFromTrustedState, verifyRevocation, verifySignRequest };
+export { type AnchorKind, ArtifactPayload, ContentOperation, CountersignPayload, type CreditClaimFailureReason, CreditClaimVerifyError, type CreditEntry, type CreditEntryState, ED25519_PRIV_MULTICODEC, ED25519_PUB_MULTICODEC, IdentityOperation, IdentityStateNoSeenKeysError, RECOGNIZED_SERVICE_TYPES, ServiceEntry, type SignRequestFailureReason, SignRequestVerifyError, Signer, type VerifiedArtifact, type VerifiedContentChain, type VerifiedCountersignature, type VerifiedCreditClaim, type VerifiedCreditEntry, VerifiedIdentity, type VerifiedRevocation, type VerifiedSignRequest, anchorsByLabel, assertCanonicalSignRequestPayload, assertServicesWithinCap, buildSignRequest, classifyAnchor, decodeEd25519PublicMultikey, decodeMultikey, deriveChainIdentifier, deriveContentId, encodeEd25519Multikey, isRecognizedServiceType, relayEndpoints, signArtifact, signContentOperation, signCountersignature, signCreditClaim, signIdentityOperation, signRevocation, verifyArtifact, verifyContentChain, verifyContentExtensionFromTrustedState, verifyCountersignature, verifyCreditClaim, verifyCreditEntry, verifyIdentityChain, verifyIdentityExtensionFromTrustedState, verifyRevocation, verifySignRequest };

package/dist/chain/index.js

@@ -8,6 +8,7 @@ import {
   CreditClaimVerifyError,
   DeclaredKeyState,
   IdentityOperation,
+  IdentityStateNoSeenKeysError,
   Iso8601,
   MAX_ARTIFACT_PAYLOAD_SIZE,
   MAX_CREDIT_CLAIM_SIZE,
@@ -52,9 +53,9 @@ import {
   verifyIdentityExtensionFromTrustedState,
   verifyRevocation,
   verifySignRequest
-} from "../chunk-Q7FREWMY.js";
-import "../chunk-FZHHSC5N.js";
-import "../chunk-BMIOY5W5.js";
+} from "../chunk-QIM3KZXZ.js";
+import "../chunk-RPA44ND4.js";
+import "../chunk-ISHAX5WN.js";
 import {
   ED25519_PRIV_MULTICODEC,
   ED25519_PUB_MULTICODEC,
@@ -62,7 +63,7 @@ import {
   decodeMultikey,
   encodeEd25519Multikey
 } from "../chunk-F7RHI2CK.js";
-import "../chunk-KAW4MT4P.js";
+import "../chunk-NUIIVAZ3.js";
 export {
   ARTIFACT_CID_ANCHOR_RE,
   ArtifactPayload,
@@ -75,6 +76,7 @@ export {
   ED25519_PRIV_MULTICODEC,
   ED25519_PUB_MULTICODEC,
   IdentityOperation,
+  IdentityStateNoSeenKeysError,
   Iso8601,
   MAX_ARTIFACT_PAYLOAD_SIZE,
   MAX_CREDIT_CLAIM_SIZE,

package/dist/{chunk-BMIOY5W5.js → chunk-ISHAX5WN.js}

@@ -9,7 +9,7 @@ import {
   isValidEd25519Signature,
   sha256,
   signPayloadEd25519
-} from "./chunk-KAW4MT4P.js";
+} from "./chunk-NUIIVAZ3.js";
 
 // src/key-proof/role-set.ts
 var KEY_ROLES = ["auth", "assert", "controller"];

package/dist/{chunk-KAW4MT4P.js → chunk-NUIIVAZ3.js}

@@ -161,10 +161,15 @@ var assertJwsProfile = (header, makeError) => {
 var decodeJwsSegment = (segmentB64) => {
   let text;
   try {
-    text = new TextDecoder("utf-8", { fatal: true }).decode(base64urlDecode(segmentB64));
+    text = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(
+      base64urlDecode(segmentB64)
+    );
   } catch {
     return null;
   }
+  if (text.charCodeAt(0) === 65279) {
+    throw new Error("leading byte order mark is not canonicalizable");
+  }
   assertCanonicalJsonText(text);
   let value;
   try {

package/dist/{chunk-Q7FREWMY.js → chunk-QIM3KZXZ.js}

@@ -6,13 +6,13 @@ import {
   matchesResource,
   verifyDFOSCredential,
   verifyDelegationChain
-} from "./chunk-FZHHSC5N.js";
+} from "./chunk-RPA44ND4.js";
 import {
   KEY_ADD_JWS_TYP,
   KEY_ROLES,
   unsafeKeyProofSubject,
   verifyChainKeyProof
-} from "./chunk-BMIOY5W5.js";
+} from "./chunk-ISHAX5WN.js";
 import {
   decodeEd25519PublicMultikey
 } from "./chunk-F7RHI2CK.js";
@@ -25,7 +25,7 @@ import {
   decodeJwsUnsafe,
   generateIdNoPrefix,
   verifyJws
-} from "./chunk-KAW4MT4P.js";
+} from "./chunk-NUIIVAZ3.js";
 
 // src/chain/schemas.ts
 import { z } from "zod";
@@ -540,7 +540,7 @@ var verifyIdentityChain = async (input) => {
       });
       if (op.services) {
         try {
-          await assertServicesWithinCap(op.services);
+          await assertServicesWithinCap(decoded.payload["services"]);
         } catch (e) {
           throw new Error(`log[${idx}]: ${e.message}`);
         }
@@ -661,14 +661,19 @@ var verifyIdentityChain = async (input) => {
     seenKeys: [...state.seenKeys.values()]
   };
 };
+var IdentityStateNoSeenKeysError = class extends Error {
+  constructor() {
+    super("identity state has no seenKeys; replay the chain");
+    this.name = "IdentityStateNoSeenKeysError";
+  }
+};
 var verifyIdentityExtensionFromTrustedState = async (input) => {
   const { currentState, headCID, lastCreatedAt, newOp } = input;
   const priorEffective = keyStateOf(currentState);
   const priorDeclared = currentState.declared ?? priorEffective;
   const priorProved = currentState.provedKeys ?? priorEffective;
-  const seenKeys = keyMaterialIndex(
-    currentState.seenKeys ?? [...flatKeys(priorDeclared), ...flatKeys(priorProved)]
-  );
+  if (!currentState.seenKeys?.length) throw new IdentityStateNoSeenKeysError();
+  const seenKeys = keyMaterialIndex(currentState.seenKeys);
   const priorSeenKeys = [...seenKeys.values()];
   const decoded = decodeJwsUnsafe(newOp);
   if (!decoded) throw new Error("failed to decode JWS");
@@ -733,7 +738,7 @@ var verifyIdentityExtensionFromTrustedState = async (input) => {
         throw new Error("cannot repeat key ids in same usage");
       }
     });
-    if (op.services) await assertServicesWithinCap(op.services);
+    if (op.services) await assertServicesWithinCap(decoded.payload["services"]);
   }
   const newState = (() => {
     switch (op.type) {
@@ -1679,6 +1684,7 @@ export {
   anchorsByLabel,
   signIdentityOperation,
   verifyIdentityChain,
+  IdentityStateNoSeenKeysError,
   verifyIdentityExtensionFromTrustedState,
   signContentOperation,
   verifyContentChain,

package/dist/{chunk-FZHHSC5N.js → chunk-RPA44ND4.js}

@@ -10,7 +10,7 @@ import {
   decodeJwsUnsafe,
   sha256,
   verifyJws
-} from "./chunk-KAW4MT4P.js";
+} from "./chunk-NUIIVAZ3.js";
 
 // src/credentials/schemas.ts
 import { z } from "zod";
@@ -43,6 +43,7 @@ var REQUEST_PROOF_JWS_TYP = "did:dfos:request-proof";
 var IDENTITY_PROOF_JWS_TYP = "did:dfos:identity-proof";
 var EMPTY_BODY_SHA256 = "47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU";
 var MAX_REQUEST_PROOF_SIZE = 4096;
+var MAX_JTI_BYTES = 256;
 var DEFAULT_PROOF_WINDOW_SECONDS = 60;
 var DEFAULT_PROOF_SKEW_SECONDS = 60;
 var MAX_PROOF_FRESHNESS_SPAN_SECONDS = 300;
@@ -66,6 +67,27 @@ var CTL_OR_SPACE = /[\u0000-\u0020\u007f]/;
 var BASE64URL_32 = /^[A-Za-z0-9_-]{43}$/;
 var EXTRA_MEMBER_NAME = /^[A-Za-z0-9_.-]+$/;
 var CANONICAL_MEMBERS = /* @__PURE__ */ new Set(["method", "host", "path", "bodyHash", "credentialCID", "iat"]);
+var assertJtiBound = (jti, label) => {
+  if (jti === "" || encoder.encode(jti).length > MAX_JTI_BYTES) {
+    throw new Error(
+      `invalid ${label}: jti must be a non-empty string of at most ${MAX_JTI_BYTES} bytes`
+    );
+  }
+};
+var withJti = (extra, jti, label) => {
+  if (jti === void 0) return extra;
+  if (extra && "jti" in extra) {
+    throw new Error(`invalid ${label}: jti is named twice \u2014 pass it typed or in extraMembers`);
+  }
+  assertJtiBound(jti, label);
+  return { ...extra, jti };
+};
+var emittedExtraMembers = (parsed, extra, label) => canonicalExtraMembers(withJti(extra, parsed.jti, label), label);
+var generateJti = () => {
+  const bytes = new Uint8Array(16);
+  globalThis.crypto.getRandomValues(bytes);
+  return base64urlEncode(bytes);
+};
 var assertNoLoneSurrogate = (value, field, label) => {
   if (LONE_SURROGATE.test(value)) {
     throw new Error(`invalid ${label}: ${field} must be well-formed Unicode`);
@@ -113,7 +135,26 @@ var validateProofPayload = (value, shape) => {
   if (typeof iat !== "number" || !Number.isSafeInteger(iat) || iat <= 0) {
     throw new Error(`invalid ${label}: iat must be a positive integer`);
   }
-  return shape.credentialed ? { method, host, path, bodyHash, credentialCID: raw["credentialCID"], iat } : { method, host, path, bodyHash, iat };
+  const rawJti = raw["jti"];
+  let jti;
+  if (rawJti !== void 0) {
+    if (typeof rawJti !== "string") {
+      throw new Error(
+        `invalid ${label}: jti must be a non-empty string of at most ${MAX_JTI_BYTES} bytes`
+      );
+    }
+    assertJtiBound(rawJti, label);
+    jti = rawJti;
+  }
+  return {
+    method,
+    host,
+    path,
+    bodyHash,
+    ...shape.credentialed ? { credentialCID: raw["credentialCID"] } : {},
+    iat,
+    ...jti !== void 0 ? { jti } : {}
+  };
 };
 var validateRequestProofPayload = (value) => {
   const parsed = validateProofPayload(value, REQUEST_PROOF_SHAPE);
@@ -123,7 +164,8 @@ var validateRequestProofPayload = (value) => {
     path: parsed.path,
     bodyHash: parsed.bodyHash,
     credentialCID: parsed.credentialCID,
-    iat: parsed.iat
+    iat: parsed.iat,
+    ...parsed.jti !== void 0 ? { jti: parsed.jti } : {}
   };
 };
 var validateIdentityProofPayload = (value) => {
@@ -133,7 +175,8 @@ var validateIdentityProofPayload = (value) => {
     host: parsed.host,
     path: parsed.path,
     bodyHash: parsed.bodyHash,
-    iat: parsed.iat
+    iat: parsed.iat,
+    ...parsed.jti !== void 0 ? { jti: parsed.jti } : {}
   };
 };
 var canonicalExtraMembers = (extra, label) => {
@@ -171,16 +214,22 @@ var proofPayloadObject = (parsed, shape, extra) => {
   for (const [name, value] of extra) out[name] = value;
   return out;
 };
-var apiRequestSigningInput = (payload, extraMembers) => proofSigningInput(
-  validateProofPayload(payload, REQUEST_PROOF_SHAPE),
-  REQUEST_PROOF_SHAPE,
-  canonicalExtraMembers(extraMembers, REQUEST_PROOF_SHAPE.label)
-);
-var apiIdentitySigningInput = (payload, extraMembers) => proofSigningInput(
-  validateProofPayload(payload, IDENTITY_PROOF_SHAPE),
-  IDENTITY_PROOF_SHAPE,
-  canonicalExtraMembers(extraMembers, IDENTITY_PROOF_SHAPE.label)
-);
+var apiRequestSigningInput = (payload, extraMembers) => {
+  const parsed = validateProofPayload(payload, REQUEST_PROOF_SHAPE);
+  return proofSigningInput(
+    parsed,
+    REQUEST_PROOF_SHAPE,
+    emittedExtraMembers(parsed, extraMembers, REQUEST_PROOF_SHAPE.label)
+  );
+};
+var apiIdentitySigningInput = (payload, extraMembers) => {
+  const parsed = validateProofPayload(payload, IDENTITY_PROOF_SHAPE);
+  return proofSigningInput(
+    parsed,
+    IDENTITY_PROOF_SHAPE,
+    emittedExtraMembers(parsed, extraMembers, IDENTITY_PROOF_SHAPE.label)
+  );
+};
 var sha256BodyHash = (body) => base64urlEncode(sha256(body));
 var parseDfosAuthorization = (header) => {
   if (!header) return null;
@@ -199,12 +248,13 @@ var signApiRequest = async (input) => {
     path: input.path,
     bodyHash: sha256BodyHash(input.body ?? EMPTY_BODY),
     credentialCID: input.credentialCID,
-    iat: input.iat ?? Math.floor(Date.now() / 1e3)
+    iat: input.iat ?? Math.floor(Date.now() / 1e3),
+    ...input.jti !== void 0 ? { jti: input.jti } : {}
   });
   if (!input.kid.includes("#")) {
     throw new Error("invalid request proof: kid must be a DID URL");
   }
-  const extra = canonicalExtraMembers(input.extraMembers, REQUEST_PROOF_SHAPE.label);
+  const extra = emittedExtraMembers(payload, input.extraMembers, REQUEST_PROOF_SHAPE.label);
   const proof = await createJws({
     header: { alg: "EdDSA", typ: REQUEST_PROOF_JWS_TYP, kid: input.kid },
     payload: proofPayloadObject(payload, REQUEST_PROOF_SHAPE, extra),
@@ -221,12 +271,13 @@ var signApiIdentityRequest = async (input) => {
     host: input.host,
     path: input.path,
     bodyHash: sha256BodyHash(input.body ?? EMPTY_BODY),
-    iat: input.iat ?? Math.floor(Date.now() / 1e3)
+    iat: input.iat ?? Math.floor(Date.now() / 1e3),
+    ...input.jti !== void 0 ? { jti: input.jti } : {}
   });
   if (!input.kid.includes("#")) {
     throw new Error("invalid identity proof: kid must be a DID URL");
   }
-  const extra = canonicalExtraMembers(input.extraMembers, IDENTITY_PROOF_SHAPE.label);
+  const extra = emittedExtraMembers(payload, input.extraMembers, IDENTITY_PROOF_SHAPE.label);
   const proof = await createJws({
     header: { alg: "EdDSA", typ: IDENTITY_PROOF_JWS_TYP, kid: input.kid },
     payload: proofPayloadObject(payload, IDENTITY_PROOF_SHAPE, extra),
@@ -247,7 +298,7 @@ var buildApiIdentityHeaders = (input) => ({
 var ApiRequestVerifyError = class extends Error {
   reason;
   phase;
-  /** Recommended HTTP status: 401 proof-invalid, 403 credential-invalid, 503 unverifiable, 500 config. */
+  /** Recommended HTTP status: 401 proof-invalid, 403 credential-invalid or uncovered, 409 replayed, 503 unverifiable, 500 config. */
   status;
   constructor(reason, phase, status, message) {
     super(message);
@@ -258,6 +309,8 @@ var ApiRequestVerifyError = class extends Error {
   }
 };
 var invalidProof = (message) => new ApiRequestVerifyError("invalid", "proof", 401, message);
+var replayedProof = (message) => new ApiRequestVerifyError("replayed", "proof", 409, message);
+var uncoveredProof = (message) => new ApiRequestVerifyError("uncovered", "credential", 403, message);
 var unverifiableProof = (message) => new ApiRequestVerifyError("unverifiable", "proof", 503, message);
 var misconfiguredProof = (message) => new ApiRequestVerifyError("config", "config", 500, message);
 var assertProofVerifierConfig = (input) => {
@@ -319,6 +372,9 @@ var verifyProofEnvelope = async (input, shape, resolvePresenter) => {
   } catch (err) {
     throw invalidProof(err instanceof Error ? err.message : `invalid ${shape.label} payload`);
   }
+  if (input.requireJti === true && payload.jti === void 0) {
+    throw invalidProof(`invalid ${shape.label}: jti is required on this route`);
+  }
   const now = Math.floor((input.now ? input.now() : Date.now()) / 1e3);
   if (now - payload.iat > window) throw invalidProof(`${shape.label} is stale`);
   if (payload.iat - now > skew) {
@@ -362,7 +418,15 @@ var verifyProofEnvelope = async (input, shape, resolvePresenter) => {
   } catch (err) {
     throw invalidProof(err instanceof Error ? err.message : `invalid ${shape.label} signature`);
   }
-  return { payload, rawPayload, presenterDID, kid, now };
+  return {
+    payload,
+    rawPayload,
+    presenterDID,
+    kid,
+    now,
+    ...payload.jti !== void 0 ? { jti: payload.jti } : {},
+    ...key.roles !== void 0 ? { keyRoles: key.roles } : {}
+  };
 };
 var verifyIdentityProofEnvelope = (input, resolvePresenter) => verifyProofEnvelope(input, IDENTITY_PROOF_SHAPE, resolvePresenter);
 var verifyRequestProofEnvelope = (input, resolvePresenter) => verifyProofEnvelope(input, REQUEST_PROOF_SHAPE, resolvePresenter);
@@ -538,6 +602,26 @@ var parseResource = (resource) => {
   if (colonIdx < 0) return null;
   return { type: resource.substring(0, colonIdx), id: resource.substring(colonIdx + 1) };
 };
+var SPACE_ID_RE = /^[2346789acdefhknrtvz]{31}$/;
+var parseApiResource = (resource) => {
+  const parsed = parseResource(resource);
+  if (!parsed || parsed.type !== "api") return null;
+  const slash = parsed.id.indexOf("/");
+  if (slash < 0) return parsed.id === "" ? null : { host: parsed.id };
+  const host = parsed.id.substring(0, slash);
+  if (host === "") return null;
+  const child = parsed.id.substring(slash + 1);
+  if (!child.startsWith("spaces/")) return null;
+  const spaceId = child.substring("spaces/".length);
+  if (!SPACE_ID_RE.test(spaceId)) return null;
+  return { host, spaceId };
+};
+var apiResourceCovers = (entryResource, requiredResource) => {
+  const entry = parseApiResource(entryResource);
+  const required = parseApiResource(requiredResource);
+  if (!entry || !required || entry.host !== required.host) return false;
+  return entry.spaceId === void 0 || entry.spaceId === required.spaceId;
+};
 var ASCII_TRIM_RE = /^[\t\n\v\f\r ]+|[\t\n\v\f\r ]+$/g;
 var parseActions = (action) => new Set(
   action.split(",").map((a) => a.replace(ASCII_TRIM_RE, "")).filter((a) => a !== "")
@@ -563,6 +647,9 @@ var isAttenuated = (parentAtt, childAtt) => {
       if (childRes.type === "chain" && parentRes.type === "chain") {
         return childRes.id === parentRes.id;
       }
+      if (childRes.type === "api" && parentRes.type === "api") {
+        return apiResourceCovers(parentEntry.resource, childEntry.resource) || childEntry.resource === parentEntry.resource;
+      }
       if (childRes.type !== "chain" && parentRes.type !== "chain") {
         return childEntry.resource === parentEntry.resource;
       }
@@ -589,6 +676,10 @@ var matchesResource = async (att, resource, action) => {
     if (entryRes.type === "chain" && entryRes.id === "*" && requestedRes.type === "chain") {
       return true;
     }
+    if (entryRes.type === "api" || requestedRes.type === "api") {
+      if (apiResourceCovers(entry.resource, resource)) return true;
+      continue;
+    }
     if (entryRes.type === requestedRes.type && entryRes.id === requestedRes.id) {
       return true;
     }
@@ -623,11 +714,13 @@ export {
   IDENTITY_PROOF_JWS_TYP,
   EMPTY_BODY_SHA256,
   MAX_REQUEST_PROOF_SIZE,
+  MAX_JTI_BYTES,
   DEFAULT_PROOF_WINDOW_SECONDS,
   DEFAULT_PROOF_SKEW_SECONDS,
   MAX_PROOF_FRESHNESS_SPAN_SECONDS,
   MAX_BODY_BYTES,
   DFOS_AUTH_SCHEME,
+  generateJti,
   canonicalExtraMembers,
   apiRequestSigningInput,
   apiIdentitySigningInput,
@@ -639,6 +732,8 @@ export {
   buildApiIdentityHeaders,
   ApiRequestVerifyError,
   invalidProof,
+  replayedProof,
+  uncoveredProof,
   unverifiableProof,
   misconfiguredProof,
   assertProofVerifierConfig,
@@ -647,6 +742,8 @@ export {
   createDFOSCredential,
   verifyDFOSCredential,
   verifyDelegationChain,
+  parseApiResource,
+  apiResourceCovers,
   isAttenuated,
   matchesResource,
   decodeDFOSCredentialUnsafe,