@metalabel/dfos-protocol 0.7.1 → 0.8.0

package/examples/beacon.json

@@ -1,14 +1,14 @@
 {
-  "description": "Beacon: signed merkle root announcement with witness countersignature",
+  "description": "Beacon: signed manifest content ID announcement with witness countersignature",
   "type": "beacon",
-  "controllerJws": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmJlYWNvbiIsImtpZCI6ImRpZDpkZm9zOmUzdnZ0Y2s0MmQ0ZWFjZG56dnRybjYja2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgiLCJjaWQiOiJiYWZ5cmVpaGhvbHV1aTdzN25zNzRpZW02YWhmeHNiNDcyaHdvZ2JxZDMyeXJycDVmenRjM2t4YTVxdSJ9.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiYmVhY29uIiwiZGlkIjoiZGlkOmRmb3M6ZTN2dnRjazQyZDRlYWNkbnp2dHJuNiIsIm1lcmtsZVJvb3QiOiI3ZTgwZDQ3ODBmNDU0ZTBmY2EwYjA5MGQ4YzY0NmY1NzJiNDkzNTRmNTQxNTQ1MzE2MDYxMDVhYWQyZmRhMjhlIiwiY3JlYXRlZEF0IjoiMjAyNi0wMy0wN1QwMDowNTowMC4wMDBaIn0._1RgZpMv63-M3ZUeTNX679xkAeX3TY0PJ0ImH7422cKA7I88Hf8bBVQMVVhP3oNdvX7i7Q4se5EP3kk5aEuxDQ",
-  "witnessJws": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmJlYWNvbiIsImtpZCI6ImRpZDpkZm9zOmUzdnZ0Y2s0MmQ0ZWFjZG56dnRybjYja2V5X2V6OWE4NzR0Y2tyM2R2OTMzZDNja2QiLCJjaWQiOiJiYWZ5cmVpaGhvbHV1aTdzN25zNzRpZW02YWhmeHNiNDcyaHdvZ2JxZDMyeXJycDVmenRjM2t4YTVxdSJ9.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiYmVhY29uIiwiZGlkIjoiZGlkOmRmb3M6ZTN2dnRjazQyZDRlYWNkbnp2dHJuNiIsIm1lcmtsZVJvb3QiOiI3ZTgwZDQ3ODBmNDU0ZTBmY2EwYjA5MGQ4YzY0NmY1NzJiNDkzNTRmNTQxNTQ1MzE2MDYxMDVhYWQyZmRhMjhlIiwiY3JlYXRlZEF0IjoiMjAyNi0wMy0wN1QwMDowNTowMC4wMDBaIn0.awA8ctmLHjJCHZcH0lav7HpadkIoGiG2WR-pCf-0XfPVi9dD8Z2at0E7iAnOUnVEc5VthBo-mMklSIJFK28IDw",
+  "controllerJws": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmJlYWNvbiIsImtpZCI6ImRpZDpkZm9zOmUzdnZ0Y2s0MmQ0ZWFjZG56dnRybjYja2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgiLCJjaWQiOiJiYWZ5cmVpYzJtdXg0cGxpNXFmZDVzYnAyeXh5MmdqbTU0Zmc1Z2NpNm02YnBldm9pdXdmZGc2cG91NCJ9.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiYmVhY29uIiwiZGlkIjoiZGlkOmRmb3M6ZTN2dnRjazQyZDRlYWNkbnp2dHJuNiIsIm1hbmlmZXN0Q29udGVudElkIjoiYTgyejkyYTNobmRrNmM5N3RoY3JuOCIsImNyZWF0ZWRBdCI6IjIwMjYtMDMtMDdUMDA6MDU6MDAuMDAwWiJ9._EKV036utOU-oMHwMyJ1Om1QhJzN-g9DTRbMz0U7L9SzQR-sHIeC6iNreYN-oV-mBvo5RPLg4TJ0UNv-PNBzDQ",
+  "witnessJws": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmJlYWNvbiIsImtpZCI6ImRpZDpkZm9zOmUzdnZ0Y2s0MmQ0ZWFjZG56dnRybjYja2V5X2V6OWE4NzR0Y2tyM2R2OTMzZDNja2QiLCJjaWQiOiJiYWZ5cmVpYzJtdXg0cGxpNXFmZDVzYnAyeXh5MmdqbTU0Zmc1Z2NpNm02YnBldm9pdXdmZGc2cG91NCJ9.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiYmVhY29uIiwiZGlkIjoiZGlkOmRmb3M6ZTN2dnRjazQyZDRlYWNkbnp2dHJuNiIsIm1hbmlmZXN0Q29udGVudElkIjoiYTgyejkyYTNobmRrNmM5N3RoY3JuOCIsImNyZWF0ZWRBdCI6IjIwMjYtMDMtMDdUMDA6MDU6MDAuMDAwWiJ9.a2BN31Mqi296FJ8wIVOwy7zdTR4fEL2TVy2A6xG6SGUBmJdUdnlqro5JbjIOF-h5RSA1SW0i4WvIK-AeiB27BQ",
   "controllerPublicKey": "z6MkrzLMNwoJSV4P3YccWcbtk8vd9LtgMKnLeaDLUqLuASjb",
   "witnessPublicKey": "z6MkfUd65JrAhfdgFuMCccU9ThQvjB2fJAMUHkuuajF992gK",
   "expected": {
-    "beaconCID": "bafyreihholuui7s7ns74iem6ahfxsb472hwogbqd32yrrp5fztc3kxa5qu",
+    "beaconCID": "bafyreic2mux4pli5qfd5sbp2yxy2gjm54fg5gci6m6bpevoiuwfdg6pou4",
     "did": "did:dfos:e3vvtck42d4eacdnzvtrn6",
-    "merkleRoot": "7e80d4780f454e0fca0b090d8c646f572b49354f54154531606105aad2fda28e",
+    "manifestContentId": "a82z92a3hndk6c97thcrn8",
     "createdAt": "2026-03-07T00:05:00.000Z"
   }
 }

package/examples/content-delegated.json

@@ -1,9 +1,9 @@
 {
-  "description": "Content chain: creator signs genesis, delegate signs update with write VC",
+  "description": "Content chain: creator signs genesis, delegate signs update with write credential",
   "type": "content-delegated",
   "chain": [
     "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmNvbnRlbnQtb3AiLCJraWQiOiJkaWQ6ZGZvczplM3Z2dGNrNDJkNGVhY2RuenZ0cm42I2tleV9yOWV2MzRmdmMyM3o5OTl2ZWFhZnQ4IiwiY2lkIjoiYmFmeXJlaWFmeG9ka290ZzJpZGE1eHBjZWR2MzdrMmtqZDdqbmJ5Z2hhamhub3VvYm9qaWF4eGo1eGkifQ.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiY3JlYXRlIiwiZGlkIjoiZGlkOmRmb3M6ZTN2dnRjazQyZDRlYWNkbnp2dHJuNiIsImRvY3VtZW50Q0lEIjoiYmFmeXJlaWduN2dmdXU1NHdvMmdlZzN0ZjV0ZXBlcGxibGt0YWhqZnpxanB1aml6YzdhMmJvZXljY2EiLCJiYXNlRG9jdW1lbnRDSUQiOm51bGwsImNyZWF0ZWRBdCI6IjIwMjYtMDMtMDdUMDA6MTA6MDAuMDAwWiIsIm5vdGUiOm51bGx9.oanyS9rbkqrxd1j8T172jVG4ILKFwW2t1JhkQLxsFqHMMURqA5Hl-0GzGFrfSkQT02Nq5RMYXzhcToqbjoV8AQ",
-    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmNvbnRlbnQtb3AiLCJraWQiOiJkaWQ6ZGZvczpuemtmODM4ZWZyNDI0NDMzcm4ycnprI2tleV9hOHIyNzQzNGFhcjc2YWU3MmM4NzdmIiwiY2lkIjoiYmFmeXJlaWJtMjRmNjY3cGlsNHhiZ2M3emZhM3lvdXRkandya3B4YTJjbWQ3Zm50aWxhYWljMmRlNzQifQ.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoidXBkYXRlIiwiZGlkIjoiZGlkOmRmb3M6bnprZjgzOGVmcjQyNDQzM3JuMnJ6ayIsInByZXZpb3VzT3BlcmF0aW9uQ0lEIjoiYmFmeXJlaWFmeG9ka290ZzJpZGE1eHBjZWR2MzdrMmtqZDdqbmJ5Z2hhamhub3VvYm9qaWF4eGo1eGkiLCJkb2N1bWVudENJRCI6ImJhZnlyZWlmbml5bmQ2aGV2NjQ2dW9hamFjM2VnYWs3cDJxZmhyaGhvNG1mbXBwYTNydGNqcGV0Z2RlIiwiYmFzZURvY3VtZW50Q0lEIjoiYmFmeXJlaWduN2dmdXU1NHdvMmdlZzN0ZjV0ZXBlcGxibGt0YWhqZnpxanB1aml6YzdhMmJvZXljY2EiLCJjcmVhdGVkQXQiOiIyMDI2LTAzLTA3VDAwOjExOjAwLjAwMFoiLCJub3RlIjoiZGVsZWdhdGVkIGVkaXQgYnkga2V5MyIsImF1dGhvcml6YXRpb24iOiJleUpoYkdjaU9pSkZaRVJUUVNJc0luUjVjQ0k2SW5aaksycDNkQ0lzSW10cFpDSTZJbVJwWkRwa1ptOXpPbVV6ZG5aMFkyczBNbVEwWldGalpHNTZkblJ5YmpZamEyVjVYM0k1WlhZek5HWjJZekl6ZWprNU9YWmxZV0ZtZERnaWZRLmV5SnBjM01pT2lKa2FXUTZaR1p2Y3pwbE0zWjJkR05yTkRKa05HVmhZMlJ1ZW5aMGNtNDJJaXdpYzNWaUlqb2laR2xrT21SbWIzTTZibnByWmpnek9HVm1jalF5TkRRek0zSnVNbko2YXlJc0ltVjRjQ0k2TVRjNU9EYzJNVFl3TUN3aWFXRjBJam94TnpjeU9EUXhOakF3TENKMll5STZleUpBWTI5dWRHVjRkQ0k2V3lKb2RIUndjem92TDNkM2R5NTNNeTV2Y21jdmJuTXZZM0psWkdWdWRHbGhiSE12ZGpJaVhTd2lkSGx3WlNJNld5SldaWEpwWm1saFlteGxRM0psWkdWdWRHbGhiQ0lzSWtSR1QxTkRiMjUwWlc1MFYzSnBkR1VpWFN3aVkzSmxaR1Z1ZEdsaGJGTjFZbXBsWTNRaU9uc2lZMjl1ZEdWdWRFbGtJam9pWVdNeU5ubzRlbXRyWlRZM2VqUTRZV1l6Y21ob09TSjlmWDAuZG5vN2lkcnVTMUZDVzl2ZEp5TjAyT1g0a05vcEh0RGlvRE5feHo3MzdBb2tmT1FZa0c3VHFzcXlmM3VPQ0p1MTRtZmhLbGNsb2RMT01LcVBGcGJNQkEifQ.8CiWJSk5Aw0OntAj_vxMawd4rDx42SwhlaPFpevthXVYqXLIOjEeyUO59YnbfQ4dSoz2PfEoRTrBnm4oXIPYAg"
+    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmNvbnRlbnQtb3AiLCJraWQiOiJkaWQ6ZGZvczpuemtmODM4ZWZyNDI0NDMzcm4ycnprI2tleV9hOHIyNzQzNGFhcjc2YWU3MmM4NzdmIiwiY2lkIjoiYmFmeXJlaWE1M3JheWl5djNuY2Z6ZnNmdzJ2cXczeG5sZ2ZibGFiNjNnN2xrbG9laXFhb2Jxc25yenEifQ.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoidXBkYXRlIiwiZGlkIjoiZGlkOmRmb3M6bnprZjgzOGVmcjQyNDQzM3JuMnJ6ayIsInByZXZpb3VzT3BlcmF0aW9uQ0lEIjoiYmFmeXJlaWFmeG9ka290ZzJpZGE1eHBjZWR2MzdrMmtqZDdqbmJ5Z2hhamhub3VvYm9qaWF4eGo1eGkiLCJkb2N1bWVudENJRCI6ImJhZnlyZWlmbml5bmQ2aGV2NjQ2dW9hamFjM2VnYWs3cDJxZmhyaGhvNG1mbXBwYTNydGNqcGV0Z2RlIiwiYmFzZURvY3VtZW50Q0lEIjoiYmFmeXJlaWduN2dmdXU1NHdvMmdlZzN0ZjV0ZXBlcGxibGt0YWhqZnpxanB1aml6YzdhMmJvZXljY2EiLCJjcmVhdGVkQXQiOiIyMDI2LTAzLTA3VDAwOjExOjAwLjAwMFoiLCJub3RlIjoiZGVsZWdhdGVkIGVkaXQgYnkga2V5MyIsImF1dGhvcml6YXRpb24iOiJleUpoYkdjaU9pSkZaRVJUUVNJc0luUjVjQ0k2SW1ScFpEcGtabTl6T21OeVpXUmxiblJwWVd3aUxDSnJhV1FpT2lKa2FXUTZaR1p2Y3pwbE0zWjJkR05yTkRKa05HVmhZMlJ1ZW5aMGNtNDJJMnRsZVY5eU9XVjJNelJtZG1NeU0zbzVPVGwyWldGaFpuUTRJaXdpWTJsa0lqb2lZbUZtZVhKbGFXVnNjemRvYmpkd2NXWjRlV1JvZFhWbmJXWnFiV2t5WTJWb2QyTjNiV3R1WVRJM2IyUjFhWGxvTm5VMmJYcHZaR051YnpRaWZRLmV5SjJaWEp6YVc5dUlqb3hMQ0owZVhCbElqb2lSRVpQVTBOeVpXUmxiblJwWVd3aUxDSnBjM01pT2lKa2FXUTZaR1p2Y3pwbE0zWjJkR05yTkRKa05HVmhZMlJ1ZW5aMGNtNDJJaXdpWVhWa0lqb2laR2xrT21SbWIzTTZibnByWmpnek9HVm1jalF5TkRRek0zSnVNbko2YXlJc0ltRjBkQ0k2VzNzaWNtVnpiM1Z5WTJVaU9pSmphR0ZwYmpwaFl6STJlamg2YTJ0bE5qZDZORGhoWmpOeWFHZzVJaXdpWVdOMGFXOXVJam9pZDNKcGRHVWlmVjBzSW5CeVppSTZXMTBzSW1WNGNDSTZNVGM1T0RjMk1UWXdNQ3dpYVdGMElqb3hOemN5T0RReE5qQXdmUS41ak5SeWdvSUNvX05iMWhoR3JTRkU0c2JEaWgzQU92dWhVVUFVNzBZOThDejdkaEkzakVNclJqZGZpbHh5OTgtOEJBU2VzbEpsMGtEd0ZJc1VUM0lEdyJ9.pmlU0CwctVJJL4eUlrrkUQ52266UtGnV1liETpZ6N-Ui8K-Aob58LdPbAJsk_NpiiFmyeyRiJfUnp-ADCkWqAQ"
   ],
   "creatorPublicKey": "z6MkrzLMNwoJSV4P3YccWcbtk8vd9LtgMKnLeaDLUqLuASjb",
   "delegatePublicKey": "z6MkvsvmSh2dGnu2qw1Tnw7M5fz98ycfuYGxqnpfgmPkLv7o",
@@ -33,7 +33,7 @@
       "createdAt": "2026-03-07T00:11:00.000Z"
     }
   ],
-  "authorization": "eyJhbGciOiJFZERTQSIsInR5cCI6InZjK2p3dCIsImtpZCI6ImRpZDpkZm9zOmUzdnZ0Y2s0MmQ0ZWFjZG56dnRybjYja2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgifQ.eyJpc3MiOiJkaWQ6ZGZvczplM3Z2dGNrNDJkNGVhY2RuenZ0cm42Iiwic3ViIjoiZGlkOmRmb3M6bnprZjgzOGVmcjQyNDQzM3JuMnJ6ayIsImV4cCI6MTc5ODc2MTYwMCwiaWF0IjoxNzcyODQxNjAwLCJ2YyI6eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwidHlwZSI6WyJWZXJpZmlhYmxlQ3JlZGVudGlhbCIsIkRGT1NDb250ZW50V3JpdGUiXSwiY3JlZGVudGlhbFN1YmplY3QiOnsiY29udGVudElkIjoiYWMyNno4emtrZTY3ejQ4YWYzcmhoOSJ9fX0.dno7idruS1FCW9vdJyN02OX4kNopHtDioDN_xz737AokfOQYkG7Tqsqyf3uOCJu14mfhKlclodLOMKqPFpbMBA",
+  "authorization": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmNyZWRlbnRpYWwiLCJraWQiOiJkaWQ6ZGZvczplM3Z2dGNrNDJkNGVhY2RuenZ0cm42I2tleV9yOWV2MzRmdmMyM3o5OTl2ZWFhZnQ4IiwiY2lkIjoiYmFmeXJlaWVsczdobjdwcWZ4eWRodXVnbWZqbWkyY2Vod2N3bWtuYTI3b2R1aXloNnU2bXpvZGNubzQifQ.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiREZPU0NyZWRlbnRpYWwiLCJpc3MiOiJkaWQ6ZGZvczplM3Z2dGNrNDJkNGVhY2RuenZ0cm42IiwiYXVkIjoiZGlkOmRmb3M6bnprZjgzOGVmcjQyNDQzM3JuMnJ6ayIsImF0dCI6W3sicmVzb3VyY2UiOiJjaGFpbjphYzI2ejh6a2tlNjd6NDhhZjNyaGg5IiwiYWN0aW9uIjoid3JpdGUifV0sInByZiI6W10sImV4cCI6MTc5ODc2MTYwMCwiaWF0IjoxNzcyODQxNjAwfQ.5jNRygoICo_Nb1hhGrSFE4sbDih3AOvuhUUAU70Y98Cz7dhI3jEMrRjdfilxy98-8BASeslJl0kDwFIsUT3IDw",
   "expected": {
     "contentId": "ac26z8zkke67z48af3rhh9",
     "creatorDID": "did:dfos:e3vvtck42d4eacdnzvtrn6",

package/examples/credential-read.json

@@ -1,12 +1,11 @@
 {
-  "description": "VC-JWT: DFOSContentRead credential",
+  "description": "DFOS credential: read access",
   "type": "credential",
-  "credential": "eyJhbGciOiJFZERTQSIsInR5cCI6InZjK2p3dCIsImtpZCI6ImRpZDpkZm9zOmUzdnZ0Y2s0MmQ0ZWFjZG56dnRybjYja2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgifQ.eyJpc3MiOiJkaWQ6ZGZvczplM3Z2dGNrNDJkNGVhY2RuenZ0cm42Iiwic3ViIjoiZGlkOmRmb3M6bnprZjgzOGVmcjQyNDQzM3JuMnJ6ayIsImV4cCI6MTc5ODc2MTYwMCwiaWF0IjoxNzcyODQxNjAwLCJ2YyI6eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwidHlwZSI6WyJWZXJpZmlhYmxlQ3JlZGVudGlhbCIsIkRGT1NDb250ZW50UmVhZCJdLCJjcmVkZW50aWFsU3ViamVjdCI6e319fQ.zGC2aUOgqXlVwTxSFSa_6g_gGEDEtS5YMLfIJNyPC9hn5IcbHtHxET8MqOKmFfKm9xJgA8uyDv12sr_D3hF9DQ",
+  "credential": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmNyZWRlbnRpYWwiLCJraWQiOiJkaWQ6ZGZvczplM3Z2dGNrNDJkNGVhY2RuenZ0cm42I2tleV9yOWV2MzRmdmMyM3o5OTl2ZWFhZnQ4IiwiY2lkIjoiYmFmeXJlaWMzbmJxemFicmxtbnl2a3o3cXI3Znk2cGd4NGFwdm52eWJvNWtzaGN6bXViaXFzemdod2EifQ.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiREZPU0NyZWRlbnRpYWwiLCJpc3MiOiJkaWQ6ZGZvczplM3Z2dGNrNDJkNGVhY2RuenZ0cm42IiwiYXVkIjoiZGlkOmRmb3M6bnprZjgzOGVmcjQyNDQzM3JuMnJ6ayIsImF0dCI6W3sicmVzb3VyY2UiOiJjaGFpbjoqIiwiYWN0aW9uIjoicmVhZCJ9XSwicHJmIjpbXSwiZXhwIjoxNzk4NzYxNjAwLCJpYXQiOjE3NzI4NDE2MDB9.QB-qK89S-sYXaDUkJJSF5ZbsV2djFFvRQlHCj6UDyl-47LZI-ISwwyqRV-zi6MEGdHb0seSkPxpE4if6HHvvCw",
   "issuerPublicKey": "z6MkrzLMNwoJSV4P3YccWcbtk8vd9LtgMKnLeaDLUqLuASjb",
-  "subjectPublicKey": "z6MkvsvmSh2dGnu2qw1Tnw7M5fz98ycfuYGxqnpfgmPkLv7o",
+  "audiencePublicKey": "z6MkvsvmSh2dGnu2qw1Tnw7M5fz98ycfuYGxqnpfgmPkLv7o",
   "expected": {
     "iss": "did:dfos:e3vvtck42d4eacdnzvtrn6",
-    "sub": "did:dfos:nzkf838efr424433rn2rzk",
-    "vcType": "DFOSContentRead"
+    "aud": "did:dfos:nzkf838efr424433rn2rzk"
   }
 }

package/examples/credential-write.json

@@ -1,14 +1,13 @@
 {
-  "description": "VC-JWT: DFOSContentWrite credential (broad + narrowed)",
+  "description": "DFOS credential: write access (broad + narrowed)",
   "type": "credential",
-  "broadCredential": "eyJhbGciOiJFZERTQSIsInR5cCI6InZjK2p3dCIsImtpZCI6ImRpZDpkZm9zOmUzdnZ0Y2s0MmQ0ZWFjZG56dnRybjYja2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgifQ.eyJpc3MiOiJkaWQ6ZGZvczplM3Z2dGNrNDJkNGVhY2RuenZ0cm42Iiwic3ViIjoiZGlkOmRmb3M6bnprZjgzOGVmcjQyNDQzM3JuMnJ6ayIsImV4cCI6MTc5ODc2MTYwMCwiaWF0IjoxNzcyODQxNjAwLCJ2YyI6eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwidHlwZSI6WyJWZXJpZmlhYmxlQ3JlZGVudGlhbCIsIkRGT1NDb250ZW50V3JpdGUiXSwiY3JlZGVudGlhbFN1YmplY3QiOnt9fX0.Oj0wl8jjzJtT7nluaTa3e9UgdDBnAYagTRs5ZnlW3Dvfxw8BUkEuZ2o_gu80QBl1cHUUxLwmc3-lToPPT7iMCQ",
-  "narrowCredential": "eyJhbGciOiJFZERTQSIsInR5cCI6InZjK2p3dCIsImtpZCI6ImRpZDpkZm9zOmUzdnZ0Y2s0MmQ0ZWFjZG56dnRybjYja2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgifQ.eyJpc3MiOiJkaWQ6ZGZvczplM3Z2dGNrNDJkNGVhY2RuenZ0cm42Iiwic3ViIjoiZGlkOmRmb3M6bnprZjgzOGVmcjQyNDQzM3JuMnJ6ayIsImV4cCI6MTc5ODc2MTYwMCwiaWF0IjoxNzcyODQxNjAwLCJ2YyI6eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwidHlwZSI6WyJWZXJpZmlhYmxlQ3JlZGVudGlhbCIsIkRGT1NDb250ZW50V3JpdGUiXSwiY3JlZGVudGlhbFN1YmplY3QiOnsiY29udGVudElkIjoiYTgyejkyYTNobmRrNmM5N3RoY3JuOCJ9fX0.XecRGtsjHJbE5S2AxNLkfvnHof_t7gZRe_qrbBCLogvzPule51CWVWFsgJctgWu2jEPGiFxAedPOuuhXitSLBA",
+  "broadCredential": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmNyZWRlbnRpYWwiLCJraWQiOiJkaWQ6ZGZvczplM3Z2dGNrNDJkNGVhY2RuenZ0cm42I2tleV9yOWV2MzRmdmMyM3o5OTl2ZWFhZnQ4IiwiY2lkIjoiYmFmeXJlaWh6dDV3Nmt4YnlsZWZ1N2R3ZDRmbnZxdnlueHphNnhud3N6bXpoYml6anVjNnhjeHFkNmEifQ.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiREZPU0NyZWRlbnRpYWwiLCJpc3MiOiJkaWQ6ZGZvczplM3Z2dGNrNDJkNGVhY2RuenZ0cm42IiwiYXVkIjoiZGlkOmRmb3M6bnprZjgzOGVmcjQyNDQzM3JuMnJ6ayIsImF0dCI6W3sicmVzb3VyY2UiOiJjaGFpbjoqIiwiYWN0aW9uIjoid3JpdGUifV0sInByZiI6W10sImV4cCI6MTc5ODc2MTYwMCwiaWF0IjoxNzcyODQxNjAwfQ.brsN3WSdTLhN5-c0mhDriiKa2FuDD3eW5Mlj3KJYcj0cKQH0RDSACMp3qLeN2DGop-kfOtqtxlS7SAMIuCZGAw",
+  "narrowCredential": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmNyZWRlbnRpYWwiLCJraWQiOiJkaWQ6ZGZvczplM3Z2dGNrNDJkNGVhY2RuenZ0cm42I2tleV9yOWV2MzRmdmMyM3o5OTl2ZWFhZnQ4IiwiY2lkIjoiYmFmeXJlaWFreDQ1ZTJnZm5udmF2a25la3YzMnJleTU3a2lybXA3cTV2YW5teHZ0ajc0NjRqbWJpcXUifQ.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiREZPU0NyZWRlbnRpYWwiLCJpc3MiOiJkaWQ6ZGZvczplM3Z2dGNrNDJkNGVhY2RuenZ0cm42IiwiYXVkIjoiZGlkOmRmb3M6bnprZjgzOGVmcjQyNDQzM3JuMnJ6ayIsImF0dCI6W3sicmVzb3VyY2UiOiJjaGFpbjphODJ6OTJhM2huZGs2Yzk3dGhjcm44IiwiYWN0aW9uIjoid3JpdGUifV0sInByZiI6W10sImV4cCI6MTc5ODc2MTYwMCwiaWF0IjoxNzcyODQxNjAwfQ.ep3NgoKLuKQBohx0Gn6FmroBxEJiV1A3PzKWoBqIJAt6UZqw6f2sLOFNSTb8t9PnONHh5aXuG99OmF7Fyv4mBA",
   "issuerPublicKey": "z6MkrzLMNwoJSV4P3YccWcbtk8vd9LtgMKnLeaDLUqLuASjb",
-  "subjectPublicKey": "z6MkvsvmSh2dGnu2qw1Tnw7M5fz98ycfuYGxqnpfgmPkLv7o",
+  "audiencePublicKey": "z6MkvsvmSh2dGnu2qw1Tnw7M5fz98ycfuYGxqnpfgmPkLv7o",
   "expected": {
     "iss": "did:dfos:e3vvtck42d4eacdnzvtrn6",
-    "sub": "did:dfos:nzkf838efr424433rn2rzk",
-    "vcType": "DFOSContentWrite",
+    "aud": "did:dfos:nzkf838efr424433rn2rzk",
     "narrowContentId": "a82z92a3hndk6c97thcrn8"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metalabel/dfos-protocol",
-  "version": "0.7.1",
+  "version": "0.8.0",
   "type": "module",
   "description": "DFOS Protocol — Ed25519 signed chain primitives, beacons, merkle trees, and verification",
   "license": "MIT",
@@ -66,7 +66,7 @@
     "ajv-formats": "^3.0.1",
     "tsup": "^8.5.1",
     "tsx": "^4.21.0",
-    "vitest": "^4.1.0"
+    "vitest": "^4.1.2"
   },
   "scripts": {
     "build": "tsup",

package/dist/chunk-CZSEEZLL.js

@@ -1,258 +0,0 @@
-import {
-  base64urlDecode,
-  base64urlEncode,
-  createJwt,
-  isValidEd25519Signature,
-  verifyJwt
-} from "./chunk-ZXXP5W5N.js";
-
-// src/credentials/schemas.ts
-import { z } from "zod";
-var MAX_DID = 256;
-var MAX_AUD = 512;
-var MAX_CONTENT_ID = 256;
-var VC_TYPE_CONTENT_WRITE = "DFOSContentWrite";
-var VC_TYPE_CONTENT_READ = "DFOSContentRead";
-var DFOSCredentialType = z.enum([VC_TYPE_CONTENT_WRITE, VC_TYPE_CONTENT_READ]);
-var AuthTokenClaims = z.strictObject({
-  /** Issuer — the DID proving identity */
-  iss: z.string().max(MAX_DID),
-  /** Subject — same as iss for auth tokens */
-  sub: z.string().max(MAX_DID),
-  /** Audience — target relay hostname (prevents cross-relay replay) */
-  aud: z.string().max(MAX_AUD),
-  /** Expiration — unix seconds, short-lived (minutes) */
-  exp: z.number().int().positive(),
-  /** Issued at — unix seconds */
-  iat: z.number().int().positive()
-});
-var ContentWriteSubject = z.strictObject({
-  /** Optional content chain narrowing — if absent, grants broad write access */
-  contentId: z.string().max(MAX_CONTENT_ID).optional()
-});
-var ContentReadSubject = z.strictObject({
-  /** Optional content chain narrowing — if absent, grants broad read access */
-  contentId: z.string().max(MAX_CONTENT_ID).optional()
-});
-var VCClaim = z.strictObject({
-  "@context": z.tuple([z.literal("https://www.w3.org/ns/credentials/v2")]),
-  type: z.tuple([z.literal("VerifiableCredential"), DFOSCredentialType]).transform((t) => t),
-  credentialSubject: z.union([ContentWriteSubject, ContentReadSubject])
-});
-var CredentialClaims = z.strictObject({
-  /** Issuer — the DID granting the credential */
-  iss: z.string().max(MAX_DID),
-  /** Subject — the DID receiving the credential */
-  sub: z.string().max(MAX_DID),
-  /** Expiration — unix seconds */
-  exp: z.number().int().positive(),
-  /** Issued at — unix seconds */
-  iat: z.number().int().positive(),
-  /** Verifiable credential claim */
-  vc: VCClaim
-});
-
-// src/credentials/auth-token.ts
-var createAuthToken = async (options) => {
-  if (!options.kid.includes("#")) {
-    throw new Error("kid must be a DID URL (did:dfos:xxx#key_yyy)");
-  }
-  const kidDid = options.kid.substring(0, options.kid.indexOf("#"));
-  if (kidDid !== options.iss) {
-    throw new Error("kid DID does not match iss");
-  }
-  const now = options.iat ?? Math.floor(Date.now() / 1e3);
-  const header = { alg: "EdDSA", typ: "JWT", kid: options.kid };
-  const payload = {
-    iss: options.iss,
-    sub: options.iss,
-    aud: options.aud,
-    exp: options.exp,
-    iat: now
-  };
-  return createJwt({ header, payload, sign: options.sign });
-};
-var verifyAuthToken = (options) => {
-  const { header, payload } = verifyJwt({
-    token: options.token,
-    publicKey: options.publicKey,
-    audience: options.audience,
-    ...options.currentTime !== void 0 ? { currentTime: options.currentTime } : {}
-  });
-  const result = AuthTokenClaims.safeParse(payload);
-  if (!result.success) {
-    const messages = result.error.issues.map((e) => e.message).join(", ");
-    throw new AuthTokenVerificationError(`invalid auth token claims: ${messages}`);
-  }
-  const currentTime = options.currentTime ?? Math.floor(Date.now() / 1e3);
-  if (result.data.iat > currentTime) {
-    throw new AuthTokenVerificationError("auth token not yet valid (iat is in the future)");
-  }
-  const kid = header.kid;
-  if (!kid || !kid.includes("#")) {
-    throw new AuthTokenVerificationError("auth token kid must be a DID URL");
-  }
-  const kidDid = kid.substring(0, kid.indexOf("#"));
-  if (kidDid !== result.data.iss) {
-    throw new AuthTokenVerificationError("auth token kid DID does not match iss");
-  }
-  return {
-    iss: result.data.iss,
-    aud: result.data.aud,
-    exp: result.data.exp,
-    kid
-  };
-};
-var AuthTokenVerificationError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "AuthTokenVerificationError";
-  }
-};
-
-// src/credentials/credential.ts
-var createCredential = async (options) => {
-  if (!options.kid.includes("#")) {
-    throw new Error("kid must be a DID URL (did:dfos:xxx#key_yyy)");
-  }
-  const kidDid = options.kid.substring(0, options.kid.indexOf("#"));
-  if (kidDid !== options.iss) {
-    throw new Error("kid DID does not match iss");
-  }
-  const now = options.iat ?? Math.floor(Date.now() / 1e3);
-  const header = { alg: "EdDSA", typ: "vc+jwt", kid: options.kid };
-  const credentialSubject = {};
-  if (options.contentId) {
-    credentialSubject.contentId = options.contentId;
-  }
-  const payload = {
-    iss: options.iss,
-    sub: options.sub,
-    exp: options.exp,
-    iat: now,
-    vc: {
-      "@context": ["https://www.w3.org/ns/credentials/v2"],
-      type: ["VerifiableCredential", options.type],
-      credentialSubject
-    }
-  };
-  const headerB64 = base64urlEncode(JSON.stringify(header));
-  const payloadB64 = base64urlEncode(JSON.stringify(payload));
-  const signingInput = `${headerB64}.${payloadB64}`;
-  const signingInputBytes = new TextEncoder().encode(signingInput);
-  const signatureBytes = await options.sign(signingInputBytes);
-  const signatureB64 = base64urlEncode(signatureBytes);
-  return `${signingInput}.${signatureB64}`;
-};
-var verifyCredential = (options) => {
-  const parts = options.token.split(".");
-  if (parts.length !== 3) {
-    throw new CredentialVerificationError("invalid token format");
-  }
-  const [headerB64, payloadB64, signatureB64] = parts;
-  let header;
-  let payload;
-  try {
-    header = JSON.parse(new TextDecoder().decode(base64urlDecode(headerB64)));
-    payload = JSON.parse(new TextDecoder().decode(base64urlDecode(payloadB64)));
-  } catch {
-    throw new CredentialVerificationError("failed to decode token");
-  }
-  if (header.alg !== "EdDSA") {
-    throw new CredentialVerificationError(`unsupported algorithm: ${header.alg}`);
-  }
-  if (header.typ !== "vc+jwt") {
-    throw new CredentialVerificationError(`invalid typ: ${header.typ}`);
-  }
-  const signingInput = `${headerB64}.${payloadB64}`;
-  const signingInputBytes = new TextEncoder().encode(signingInput);
-  let signatureBytes;
-  try {
-    signatureBytes = base64urlDecode(signatureB64);
-  } catch {
-    throw new CredentialVerificationError("failed to decode signature");
-  }
-  const isValid = isValidEd25519Signature(signingInputBytes, signatureBytes, options.publicKey);
-  if (!isValid) {
-    throw new CredentialVerificationError("invalid signature");
-  }
-  const result = CredentialClaims.safeParse(payload);
-  if (!result.success) {
-    const messages = result.error.issues.map((e) => e.message).join(", ");
-    throw new CredentialVerificationError(`invalid credential claims: ${messages}`);
-  }
-  const claims = result.data;
-  const kid = header.kid;
-  if (!kid || !kid.includes("#")) {
-    throw new CredentialVerificationError("credential kid must be a DID URL");
-  }
-  const kidDid = kid.substring(0, kid.indexOf("#"));
-  if (kidDid !== claims.iss) {
-    throw new CredentialVerificationError("credential kid DID does not match iss");
-  }
-  const currentTime = options.currentTime ?? Math.floor(Date.now() / 1e3);
-  if (claims.iat > currentTime) {
-    throw new CredentialVerificationError("credential not yet valid (iat is in the future)");
-  }
-  if (claims.exp <= currentTime) {
-    throw new CredentialVerificationError("credential expired");
-  }
-  if (options.subject !== void 0 && claims.sub !== options.subject) {
-    throw new CredentialVerificationError(
-      `subject mismatch: expected ${options.subject}, got ${claims.sub}`
-    );
-  }
-  const vcType = claims.vc.type[1];
-  if (options.expectedType !== void 0 && vcType !== options.expectedType) {
-    throw new CredentialVerificationError(
-      `type mismatch: expected ${options.expectedType}, got ${vcType}`
-    );
-  }
-  const contentId = claims.vc.credentialSubject.contentId;
-  return {
-    iss: claims.iss,
-    sub: claims.sub,
-    exp: claims.exp,
-    type: vcType,
-    kid,
-    ...contentId !== void 0 ? { contentId } : {}
-  };
-};
-var decodeCredentialUnsafe = (token) => {
-  const parts = token.split(".");
-  if (parts.length !== 3) return null;
-  try {
-    const [headerB64, payloadB64] = parts;
-    const header = JSON.parse(new TextDecoder().decode(base64urlDecode(headerB64)));
-    const payload = JSON.parse(new TextDecoder().decode(base64urlDecode(payloadB64)));
-    const result = CredentialClaims.safeParse(payload);
-    if (!result.success) return null;
-    return { header, claims: result.data };
-  } catch {
-    return null;
-  }
-};
-var CredentialVerificationError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "CredentialVerificationError";
-  }
-};
-
-export {
-  VC_TYPE_CONTENT_WRITE,
-  VC_TYPE_CONTENT_READ,
-  DFOSCredentialType,
-  AuthTokenClaims,
-  ContentWriteSubject,
-  ContentReadSubject,
-  VCClaim,
-  CredentialClaims,
-  createAuthToken,
-  verifyAuthToken,
-  AuthTokenVerificationError,
-  createCredential,
-  verifyCredential,
-  decodeCredentialUnsafe,
-  CredentialVerificationError
-};