@metalabel/dfos-protocol 0.8.1 → 0.10.0

package/README.md

@@ -17,8 +17,6 @@ import { verifyContentChain, verifyIdentityChain } from '@metalabel/dfos-protoco
 import { createAuthToken, createDFOSCredential } from '@metalabel/dfos-protocol/credentials';
 // Crypto primitives
 import { createJws, dagCborCanonicalEncode, verifyJws } from '@metalabel/dfos-protocol/crypto';
-// Merkle trees
-import { buildMerkleTree, verifyMerkleProof } from '@metalabel/dfos-protocol/merkle';
 ```
 
 ## Subpath Exports
@@ -28,7 +26,6 @@ import { buildMerkleTree, verifyMerkleProof } from '@metalabel/dfos-protocol/mer
 | `@metalabel/dfos-protocol/chain`       | Identity and content chain signing, verification, beacons, countersigns |
 | `@metalabel/dfos-protocol/credentials` | Auth tokens (DID-signed JWT) and DFOS credentials for authorization     |
 | `@metalabel/dfos-protocol/crypto`      | Ed25519, JWS, JWT, dag-cbor, base64url, ID generation                   |
-| `@metalabel/dfos-protocol/merkle`      | SHA-256 binary merkle tree, inclusion proofs                            |
 
 ## Specifications
 
@@ -50,7 +47,6 @@ The `examples/` directory contains deterministic reference fixtures that can be
 - `content-delegated.json` — creator genesis + delegated update with DFOS write credential
 - `credential-write.json` — DFOS write credential (broad + content-narrowed)
 - `credential-read.json` — DFOS read credential
-- `merkle-tree.json` — 5 content IDs → sorted tree → root, with inclusion proof
 - `beacon.json` — signed manifest pointer announcement with witness countersignature
 
 ## License

package/dist/chain/index.d.ts

@@ -1,5 +1,5 @@
-import { I as IdentityOperation, S as Signer, V as VerifiedIdentity, C as ContentOperation, B as BeaconPayload, a as CountersignPayload, A as ArtifactPayload } from '../schemas-BEl38wrI.js';
-export { M as MAX_ARTIFACT_PAYLOAD_SIZE, b as MultikeyPublicKey, R as RevocationPayload } from '../schemas-BEl38wrI.js';
+import { I as IdentityOperation, S as Signer, V as VerifiedIdentity, C as ContentOperation, B as BeaconPayload, a as CountersignPayload, A as ArtifactPayload } from '../schemas-BhikXSf_.js';
+export { M as MAX_ARTIFACT_PAYLOAD_SIZE, b as MultikeyPublicKey, R as RevocationPayload } from '../schemas-BhikXSf_.js';
 import 'zod';
 
 /** Ed25519 public key multicodec value */
@@ -32,7 +32,7 @@ declare const deriveChainIdentifier: (cidBytes: Uint8Array, prefix: string) => s
 /**
  * Derive a bare content identifier from CID bytes
  *
- * Returns the raw 22-char hash with no prefix. Applications may add
+ * Returns the raw 31-char hash with no prefix. Applications may add
  * their own prefix for routing (e.g., post_xxxx) — that's semantic sugar.
  */
 declare const deriveContentId: (cidBytes: Uint8Array) => string;
@@ -89,7 +89,7 @@ declare const verifyIdentityExtensionFromTrustedState: (input: {
 }>;
 
 interface VerifiedContentChain {
-    /** Content identifier — bare 22-char hash derived from genesis CID */
+    /** Content identifier — bare 31-char hash derived from genesis CID */
     contentId: string;
     /** CID of the genesis operation */
     genesisCID: string;
@@ -144,6 +144,11 @@ declare const verifyContentChain: (input: {
      * is true, as credential verification needs identity resolution.
      */
     resolveIdentity?: (did: string) => Promise<VerifiedIdentity | undefined>;
+    /**
+     * Check whether a credential (leaf or parent) has been revoked. Threaded onto
+     * the WRITE path so revoked credentials no longer authorize writes.
+     */
+    isRevoked?: (issuerDID: string, credentialCID: string) => Promise<boolean>;
 }) => Promise<VerifiedContentChain>;
 /**
  * Verify a single new content operation against already-verified chain state
@@ -165,6 +170,8 @@ declare const verifyContentExtensionFromTrustedState: (input: {
     enforceAuthorization?: boolean;
     /** Resolve a DID to a VerifiedIdentity. Required when enforceAuthorization is true. */
     resolveIdentity?: (did: string) => Promise<VerifiedIdentity | undefined>;
+    /** Check whether a credential (leaf or parent) has been revoked. */
+    isRevoked?: (issuerDID: string, credentialCID: string) => Promise<boolean>;
 }) => Promise<{
     state: VerifiedContentChain;
     operationCID: string;

package/dist/chain/index.js

@@ -24,14 +24,14 @@ import {
   verifyIdentityChain,
   verifyIdentityExtensionFromTrustedState,
   verifyRevocation
-} from "../chunk-LQ56P4SU.js";
+} from "../chunk-GZ7ZAIRD.js";
 import {
   ED25519_PRIV_MULTICODEC,
   ED25519_PUB_MULTICODEC,
   decodeMultikey,
   encodeEd25519Multikey
-} from "../chunk-MEV6QVLC.js";
-import "../chunk-ZXXP5W5N.js";
+} from "../chunk-LQFOBE6X.js";
+import "../chunk-GQOZJKKO.js";
 export {
   ArtifactPayload,
   BeaconPayload,

package/dist/{chunk-ZXXP5W5N.js → chunk-GQOZJKKO.js}

@@ -40,7 +40,7 @@ var isValidEd25519Signature = (payload, signature, publicKey) => {
 // src/crypto/id.ts
 import { sha256 as sha256Hash } from "@noble/hashes/sha2.js";
 var alphabet = "2346789acdefhknrtvz";
-var idLength = 22;
+var idLength = 31;
 var getRandomBytes = (length) => {
   const bytes = new Uint8Array(length);
   globalThis.crypto.getRandomValues(bytes);
@@ -75,6 +75,22 @@ var normalizedId = (prefix, id) => {
   return `${prefixLowered}_${idLowered}`;
 };
 
+// src/crypto/jws-profile.ts
+var assertJwsProfile = (header, makeError) => {
+  if (header.alg !== "EdDSA") {
+    throw makeError(`Unsupported algorithm: ${String(header.alg)}`);
+  }
+  if ("crit" in header) {
+    throw makeError("crit header is not supported");
+  }
+  if ("jwk" in header) {
+    throw makeError("jwk header is not allowed (key is resolved from kid)");
+  }
+  if ("x5c" in header) {
+    throw makeError("x5c header is not allowed (key is resolved from kid)");
+  }
+};
+
 // src/crypto/jws.ts
 var createJws = async (options) => {
   const headerB64 = base64urlEncode(JSON.stringify(options.header));
@@ -99,9 +115,10 @@ var verifyJws = (options) => {
   } catch {
     throw new JwsVerificationError("Failed to decode token");
   }
-  if (header.alg !== "EdDSA") {
-    throw new JwsVerificationError(`Unsupported algorithm: ${header.alg}`);
-  }
+  assertJwsProfile(
+    header,
+    (m) => new JwsVerificationError(m)
+  );
   const signingInput = `${headerB64}.${payloadB64}`;
   const signingInputBytes = new TextEncoder().encode(signingInput);
   const signatureBytes = base64urlDecode(signatureB64);
@@ -172,12 +189,13 @@ var verifyJwt = (options) => {
   } catch {
     throw new JwtVerificationError("Failed to decode token");
   }
+  assertJwsProfile(
+    header,
+    (m) => new JwtVerificationError(m)
+  );
   const signingInput = `${headerB64}.${payloadB64}`;
   const signingInputBytes = new TextEncoder().encode(signingInput);
   const signatureBytes = base64urlDecode(signatureB64);
-  if (header.alg !== "EdDSA") {
-    throw new JwtVerificationError(`Unsupported algorithm: ${header.alg}`);
-  }
   const isValid = isValidEd25519Signature(signingInputBytes, signatureBytes, options.publicKey);
   if (!isValid) throw new JwtVerificationError("Invalid signature");
   const currentTime = options.currentTime ?? Math.floor(Date.now() / 1e3);
@@ -209,14 +227,43 @@ import * as Block from "multiformats/block";
 import { CID } from "multiformats/cid";
 import { sha256 } from "multiformats/hashes/sha2";
 var dagCborCanonicalEncode = async (value) => {
+  assertCanonicalNumbers(value);
+  const serialized = JSON.parse(JSON.stringify(value));
+  assertCanonicalNumbers(serialized);
   return await Block.encode({
-    // removes any undefineds or other non-serializable values, kinda whack but
-    // it works for now
-    value: JSON.parse(JSON.stringify(value)),
+    // removes any undefineds or other non-serializable values (and normalizes
+    // -0 to 0)
+    value: serialized,
     codec: dagCborCodec,
     hasher: sha256
   });
 };
+var MAX_SAFE_CANONICAL_INTEGER = 9007199254740991;
+var assertCanonicalNumbers = (value) => {
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new Error(`non-finite number is not canonicalizable: ${value}`);
+    }
+    if (!Number.isInteger(value)) {
+      throw new Error(
+        `non-integer number is not canonicalizable: ${value} (encode it as a string)`
+      );
+    }
+    if (value > MAX_SAFE_CANONICAL_INTEGER || value < -MAX_SAFE_CANONICAL_INTEGER) {
+      throw new Error(
+        `integer out of safe range is not canonicalizable: ${value} (encode it as a string)`
+      );
+    }
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const entry of value) assertCanonicalNumbers(entry);
+    return;
+  }
+  if (value !== null && typeof value === "object") {
+    for (const entry of Object.values(value)) assertCanonicalNumbers(entry);
+  }
+};
 var parseDagCborCID = (cid) => {
   return CID.parse(cid);
 };
@@ -237,6 +284,7 @@ export {
   generateId,
   isValidId,
   normalizedId,
+  assertJwsProfile,
   createJws,
   verifyJws,
   decodeJwsUnsafe,

package/dist/{chunk-LQ56P4SU.js → chunk-GZ7ZAIRD.js}

@@ -4,14 +4,14 @@ import {
   matchesResource,
   verifyDFOSCredential,
   verifyDelegationChain
-} from "./chunk-MEV6QVLC.js";
+} from "./chunk-LQFOBE6X.js";
 import {
   createJws,
   dagCborCanonicalEncode,
   decodeJwsUnsafe,
   generateIdNoPrefix,
   verifyJws
-} from "./chunk-ZXXP5W5N.js";
+} from "./chunk-GQOZJKKO.js";
 
 // src/chain/schemas.ts
 import { z } from "zod";
@@ -383,10 +383,14 @@ var verifyOperationAuthorization = async (input) => {
     resolveIdentity: input.resolveIdentity,
     now: opCreatedAtUnix
   });
+  if (input.isRevoked && await input.isRevoked(credential.iss, credential.credentialCID)) {
+    throw new Error("credential is revoked");
+  }
   await verifyDelegationChain(credential, {
     resolveIdentity: input.resolveIdentity,
     rootDID: input.creatorDID,
-    now: opCreatedAtUnix
+    now: opCreatedAtUnix,
+    ...input.isRevoked ? { isRevoked: input.isRevoked } : {}
   });
   if (credential.aud !== "*" && credential.aud !== input.operationDID) {
     throw new Error(
@@ -470,7 +474,8 @@ var verifyContentChain = async (input) => {
           creatorDID: state.creatorDID,
           contentId: state.contentId,
           createdAt: op.createdAt,
-          resolveIdentity: input.resolveIdentity
+          resolveIdentity: input.resolveIdentity,
+          ...input.isRevoked ? { isRevoked: input.isRevoked } : {}
         });
       } catch (err) {
         const message = err instanceof Error ? err.message : "unknown error";
@@ -570,7 +575,8 @@ var verifyContentExtensionFromTrustedState = async (input) => {
         creatorDID: currentState.creatorDID,
         contentId: currentState.contentId,
         createdAt: op.createdAt,
-        resolveIdentity: input.resolveIdentity
+        resolveIdentity: input.resolveIdentity,
+        ...input.isRevoked ? { isRevoked: input.isRevoked } : {}
       });
     } catch (err) {
       const message = err instanceof Error ? err.message : "unknown error";

package/dist/{chunk-MEV6QVLC.js → chunk-LQFOBE6X.js}

@@ -5,7 +5,7 @@ import {
   decodeJwsUnsafe,
   verifyJws,
   verifyJwt
-} from "./chunk-ZXXP5W5N.js";
+} from "./chunk-GQOZJKKO.js";
 
 // src/credentials/schemas.ts
 import { z } from "zod";
@@ -14,7 +14,7 @@ var MAX_AUD = 512;
 var MAX_RESOURCE = 512;
 var MAX_ACTION = 64;
 var MAX_ATT = 32;
-var MAX_PRF = 8;
+var MAX_PRF = 1;
 var Attenuation = z.strictObject({
   resource: z.string().min(1).max(MAX_RESOURCE),
   action: z.string().min(1).max(MAX_ACTION)
@@ -96,6 +96,7 @@ var verifyAuthToken = (options) => {
     iss: result.data.iss,
     aud: result.data.aud,
     exp: result.data.exp,
+    iat: result.data.iat,
     kid
   };
 };
@@ -256,41 +257,38 @@ var verifyDelegationChain = async (credential, options) => {
       }
       return { credential, chain, rootDID: options.rootDID };
     }
-    const parents = [];
-    for (const parentJws of current.prf) {
-      const parent = await verifyDFOSCredential(parentJws, {
-        resolveIdentity: options.resolveIdentity,
-        ...options.now !== void 0 ? { now: options.now } : {}
-      });
-      if (options.isRevoked) {
-        const revoked = await options.isRevoked(parent.iss, parent.credentialCID);
-        if (revoked) {
-          throw new CredentialVerificationError("parent credential in delegation chain is revoked");
-        }
+    if (current.prf.length > 1) {
+      throw new CredentialVerificationError(
+        "delegation chain: multi-parent credentials are not supported (prf must have at most one entry)"
+      );
+    }
+    const parent = await verifyDFOSCredential(current.prf[0], {
+      resolveIdentity: options.resolveIdentity,
+      ...options.now !== void 0 ? { now: options.now } : {}
+    });
+    if (options.isRevoked) {
+      const revoked = await options.isRevoked(parent.iss, parent.credentialCID);
+      if (revoked) {
+        throw new CredentialVerificationError("parent credential in delegation chain is revoked");
       }
-      parents.push(parent);
     }
-    const matchingParent = parents.find((p) => p.aud === "*" || p.aud === current.iss);
-    if (!matchingParent) {
+    if (parent.aud !== "*" && parent.aud !== current.iss) {
       throw new CredentialVerificationError(
-        `delegation gap: no parent credential has audience matching child issuer ${current.iss}`
+        `delegation gap: parent credential audience ${parent.aud} does not match child issuer ${current.iss}`
       );
     }
-    for (const parent of parents) {
-      if (current.exp > parent.exp) {
-        throw new CredentialVerificationError(
-          "delegation chain: child credential expiry exceeds parent expiry"
-        );
-      }
+    if (current.exp > parent.exp) {
+      throw new CredentialVerificationError(
+        "delegation chain: child credential expiry exceeds parent expiry"
+      );
     }
-    const parentAttUnion = parents.flatMap((p) => p.att);
-    if (!isAttenuated(parentAttUnion, current.att)) {
+    if (!isAttenuated(parent.att, current.att)) {
       throw new CredentialVerificationError(
         "delegation chain: child credential scope exceeds parent scope"
       );
     }
-    chain.push(...parents);
-    current = parents[0];
+    chain.push(parent);
+    current = parent;
   }
   throw new CredentialVerificationError("delegation chain too deep (max 16 hops)");
 };
@@ -315,7 +313,7 @@ var isAttenuated = (parentAtt, childAtt) => {
         if (!parentActions.has(a)) return false;
       }
       if (parentRes.type === "chain" && parentRes.id === "*") {
-        return true;
+        return childRes.type === "chain";
       }
       if (childRes.type === "chain" && childRes.id === "*") {
         return false;
@@ -323,17 +321,11 @@ var isAttenuated = (parentAtt, childAtt) => {
       if (childRes.type === "chain" && parentRes.type === "chain") {
         return childRes.id === parentRes.id;
       }
-      if (childRes.type === "chain" && parentRes.type === "manifest") {
-        return true;
-      }
-      if (childRes.type === "manifest" && parentRes.type === "manifest") {
-        return childRes.id === parentRes.id;
-      }
       return false;
     });
   });
 };
-var matchesResource = async (att, resource, action, options) => {
+var matchesResource = async (att, resource, action) => {
   const requestedRes = parseResource(resource);
   if (!requestedRes) return false;
   const requestedActions = parseActions(action);
@@ -355,12 +347,6 @@ var matchesResource = async (att, resource, action, options) => {
     if (entryRes.type === requestedRes.type && entryRes.id === requestedRes.id) {
       return true;
     }
-    if (entryRes.type === "manifest" && requestedRes.type === "chain") {
-      if (options?.manifestLookup) {
-        const indexed = await options.manifestLookup(entryRes.id);
-        if (indexed.includes(requestedRes.id)) return true;
-      }
-    }
   }
   return false;
 };

package/dist/credentials/index.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { V as VerifiedIdentity } from '../schemas-BEl38wrI.js';
+import { V as VerifiedIdentity } from '../schemas-BhikXSf_.js';
 
 /** Single attenuation entry — resource + action pair */
 declare const Attenuation: z.ZodObject<{
@@ -11,34 +11,23 @@ type Attenuation = z.infer<typeof Attenuation>;
 declare const DFOSCredentialPayload: z.ZodObject<{
     version: z.ZodLiteral<1>;
     type: z.ZodLiteral<"DFOSCredential">;
-    /** Issuer DID */
     iss: z.ZodString;
-    /** Audience DID or "*" for public credentials */
     aud: z.ZodString;
-    /** Attenuations — resource + action pairs */
     att: z.ZodArray<z.ZodObject<{
         resource: z.ZodString;
         action: z.ZodString;
     }, z.core.$strict>>;
-    /** Parent credential JWS tokens (for delegation chains) */
     prf: z.ZodDefault<z.ZodArray<z.ZodString>>;
-    /** Expiration — unix seconds */
     exp: z.ZodNumber;
-    /** Issued at — unix seconds */
     iat: z.ZodNumber;
 }, z.core.$strict>;
 type DFOSCredentialPayload = z.infer<typeof DFOSCredentialPayload>;
 /** Claims for a DID-signed auth token (relay AuthN) */
 declare const AuthTokenClaims: z.ZodObject<{
-    /** Issuer — the DID proving identity */
     iss: z.ZodString;
-    /** Subject — same as iss for auth tokens */
     sub: z.ZodString;
-    /** Audience — target relay hostname (prevents cross-relay replay) */
     aud: z.ZodString;
-    /** Expiration — unix seconds, short-lived (minutes) */
     exp: z.ZodNumber;
-    /** Issued at — unix seconds */
     iat: z.ZodNumber;
 }, z.core.$strict>;
 type AuthTokenClaims = z.infer<typeof AuthTokenClaims>;
@@ -74,6 +63,8 @@ interface VerifiedAuthToken {
     aud: string;
     /** Token expiration (unix seconds) */
     exp: number;
+    /** Token issued-at (unix seconds) */
+    iat: number;
     /** kid from the JWT header */
     kid: string;
 }
@@ -179,12 +170,8 @@ declare const verifyDelegationChain: (credential: VerifiedDFOSCredential, option
  *
  * - `chain:X` covered by `chain:X` (exact match)
  * - `chain:X` covered by `chain:*` (narrowing from wildcard — valid)
- * - `chain:X` covered by `manifest:M` (narrowing from manifest — valid structurally)
- * - `manifest:M` covered by `chain:*` (narrowing from wildcard — valid)
- * - `manifest:M` covered by `manifest:M` (exact match)
- * - `manifest:M` NOT covered by `chain:X` (widening — invalid)
  * - `chain:*` covered by `chain:*` (exact match)
- * - `chain:*` NOT covered by `chain:X` or `manifest:M` (widening — invalid)
+ * - `chain:*` NOT covered by `chain:X` (widening — invalid)
  * - Actions: child action set must be a subset of parent action set
  */
 declare const isAttenuated: (parentAtt: Attenuation[], childAtt: Attenuation[]) => boolean;
@@ -193,14 +180,8 @@ declare const isAttenuated: (parentAtt: Attenuation[], childAtt: Attenuation[])
  *
  * Used at the relay to determine if a credential authorizes access to a
  * specific content chain.
- *
- * For `manifest:` resources, requires a `manifestLookup` callback to resolve
- * which contentIds the manifest indexes. Without the callback, `manifest:`
- * resources can only match exact `manifest:` requests, not `chain:` requests.
  */
-declare const matchesResource: (att: Attenuation[], resource: string, action: string, options?: {
-    manifestLookup?: (manifestContentId: string) => Promise<string[]>;
-}) => Promise<boolean>;
+declare const matchesResource: (att: Attenuation[], resource: string, action: string) => Promise<boolean>;
 /**
  * Decode a DFOS credential JWS without verifying the signature
  *

package/dist/credentials/index.js

@@ -12,8 +12,8 @@ import {
   verifyAuthToken,
   verifyDFOSCredential,
   verifyDelegationChain
-} from "../chunk-MEV6QVLC.js";
-import "../chunk-ZXXP5W5N.js";
+} from "../chunk-LQFOBE6X.js";
+import "../chunk-GQOZJKKO.js";
 export {
   Attenuation,
   AuthTokenClaims,

package/dist/crypto/index.d.ts

@@ -14,22 +14,22 @@ declare const base64urlDecode: (str: string) => Uint8Array;
  * Generate a new random Ed25519 keypair
  */
 declare const createNewEd25519Keypair: () => {
-    privateKey: Uint8Array<ArrayBufferLike>;
-    publicKey: Uint8Array<ArrayBufferLike>;
+    privateKey: Uint8Array<ArrayBufferLike> & Uint8Array<ArrayBuffer>;
+    publicKey: Uint8Array<ArrayBufferLike> & Uint8Array<ArrayBuffer>;
 };
 /**
  * Generate an Ed25519 keypair from a private key
  */
 declare const importEd25519Keypair: (privateKey: Uint8Array) => {
     privateKey: Uint8Array<ArrayBufferLike>;
-    publicKey: Uint8Array<ArrayBufferLike>;
+    publicKey: Uint8Array<ArrayBufferLike> & Uint8Array<ArrayBuffer>;
 };
 /**
  * Sign a payload with an Ed25519 private key
  *
  * Ed25519 handles hashing internally (SHA-512) — no external prehash needed
  */
-declare const signPayloadEd25519: (payload: Uint8Array, privateKey: Uint8Array) => Uint8Array<ArrayBufferLike>;
+declare const signPayloadEd25519: (payload: Uint8Array, privateKey: Uint8Array) => Uint8Array<ArrayBufferLike> & Uint8Array<ArrayBuffer>;
 /**
  * Check that a signature is valid for a given payload and Ed25519 public key
  */
@@ -51,7 +51,7 @@ declare const generateIdNoPrefix: (options?: {
 /**
  * Generate a prefixed ID
  *
- * Without options: generates random 22-char ID
+ * Without options: generates random 31-char ID
  * With { seed }: generates deterministic ID from seed (for external ID mapping)
  *
  * @example
@@ -66,7 +66,7 @@ declare const generateId: <T extends string>(prefix: T, options?: {
  *
  * @param prefix - Expected prefix (e.g., 'msg', 'post')
  * @param id - ID to validate
- * @returns true if ID has correct prefix and length (prefix + _ + 22 chars)
+ * @returns true if ID has correct prefix and length (prefix + _ + 31 chars)
  *
  * @example
  * isValidId('msg', 'msg_abc123...') // true
@@ -125,6 +125,15 @@ declare class JwsVerificationError extends Error {
     constructor(message: string);
 }
 
+/**
+ * Apply the DFOS signature verification profile to a decoded protected header.
+ *
+ * Throws the provided error type with a precise message on any violation. The
+ * caller invokes this BEFORE verifying the signature so that an out-of-profile
+ * token is rejected regardless of whether its signature would have verified.
+ */
+declare const assertJwsProfile: (header: Record<string, unknown>, makeError: (message: string) => Error) => void;
+
 interface JwtHeader {
     alg: 'EdDSA';
     typ: 'JWT';
@@ -202,4 +211,4 @@ declare const parseDagCborCID: (cid: string) => CID<unknown, number, number, mul
  */
 declare const isCanonicallyEqual: (data1: unknown, data2: unknown) => Promise<boolean>;
 
-export { type JwsHeader, JwsVerificationError, type JwtClaims, type JwtCreateOptions, type JwtHeader, JwtVerificationError, type JwtVerifyOptions, type PrefixedID, base64urlDecode, base64urlEncode, createJws, createJwt, createNewEd25519Keypair, dagCborCanonicalEncode, decodeJwsUnsafe, decodeJwtUnsafe, generateId, generateIdNoPrefix, importEd25519Keypair, isCanonicallyEqual, isValidEd25519Signature, isValidId, normalizedId, parseDagCborCID, signPayloadEd25519, verifyJws, verifyJwt };
+export { type JwsHeader, JwsVerificationError, type JwtClaims, type JwtCreateOptions, type JwtHeader, JwtVerificationError, type JwtVerifyOptions, type PrefixedID, assertJwsProfile, base64urlDecode, base64urlEncode, createJws, createJwt, createNewEd25519Keypair, dagCborCanonicalEncode, decodeJwsUnsafe, decodeJwtUnsafe, generateId, generateIdNoPrefix, importEd25519Keypair, isCanonicallyEqual, isValidEd25519Signature, isValidId, normalizedId, parseDagCborCID, signPayloadEd25519, verifyJws, verifyJwt };

package/dist/crypto/index.js

@@ -1,6 +1,7 @@
 import {
   JwsVerificationError,
   JwtVerificationError,
+  assertJwsProfile,
   base64urlDecode,
   base64urlEncode,
   createJws,
@@ -20,10 +21,11 @@ import {
   signPayloadEd25519,
   verifyJws,
   verifyJwt
-} from "../chunk-ZXXP5W5N.js";
+} from "../chunk-GQOZJKKO.js";
 export {
   JwsVerificationError,
   JwtVerificationError,
+  assertJwsProfile,
   base64urlDecode,
   base64urlEncode,
   createJws,

package/dist/index.d.ts

@@ -1,7 +1,6 @@
-export { JwsHeader, JwsVerificationError, JwtClaims, JwtCreateOptions, JwtHeader, JwtVerificationError, JwtVerifyOptions, PrefixedID, base64urlDecode, base64urlEncode, createJws, createJwt, createNewEd25519Keypair, dagCborCanonicalEncode, decodeJwsUnsafe, decodeJwtUnsafe, generateId, generateIdNoPrefix, importEd25519Keypair, isCanonicallyEqual, isValidEd25519Signature, isValidId, normalizedId, parseDagCborCID, signPayloadEd25519, verifyJws, verifyJwt } from './crypto/index.js';
-export { A as ArtifactPayload, B as BeaconPayload, C as ContentOperation, a as CountersignPayload, I as IdentityOperation, M as MAX_ARTIFACT_PAYLOAD_SIZE, b as MultikeyPublicKey, R as RevocationPayload, S as Signer, V as VerifiedIdentity } from './schemas-BEl38wrI.js';
+export { JwsHeader, JwsVerificationError, JwtClaims, JwtCreateOptions, JwtHeader, JwtVerificationError, JwtVerifyOptions, PrefixedID, assertJwsProfile, base64urlDecode, base64urlEncode, createJws, createJwt, createNewEd25519Keypair, dagCborCanonicalEncode, decodeJwsUnsafe, decodeJwtUnsafe, generateId, generateIdNoPrefix, importEd25519Keypair, isCanonicallyEqual, isValidEd25519Signature, isValidId, normalizedId, parseDagCborCID, signPayloadEd25519, verifyJws, verifyJwt } from './crypto/index.js';
+export { A as ArtifactPayload, B as BeaconPayload, C as ContentOperation, a as CountersignPayload, I as IdentityOperation, M as MAX_ARTIFACT_PAYLOAD_SIZE, b as MultikeyPublicKey, R as RevocationPayload, S as Signer, V as VerifiedIdentity } from './schemas-BhikXSf_.js';
 export { ED25519_PRIV_MULTICODEC, ED25519_PUB_MULTICODEC, VerifiedArtifact, VerifiedBeacon, VerifiedContentChain, VerifiedCountersignature, VerifiedRevocation, decodeMultikey, deriveChainIdentifier, deriveContentId, encodeEd25519Multikey, signArtifact, signBeacon, signContentOperation, signCountersignature, signIdentityOperation, signRevocation, verifyArtifact, verifyBeacon, verifyContentChain, verifyContentExtensionFromTrustedState, verifyCountersignature, verifyIdentityChain, verifyIdentityExtensionFromTrustedState, verifyRevocation } from './chain/index.js';
-export { MerkleProof, buildMerkleTree, generateMerkleProof, hashLeaf, hexToBytes, verifyMerkleProof } from './merkle/index.js';
 export { Attenuation, AuthTokenClaims, AuthTokenCreateOptions, AuthTokenVerificationError, AuthTokenVerifyOptions, CredentialVerificationError, DFOSCredentialPayload, VerifiedAuthToken, VerifiedDFOSCredential, VerifiedDelegationChain, createAuthToken, createDFOSCredential, decodeDFOSCredentialUnsafe, isAttenuated, matchesResource, verifyAuthToken, verifyDFOSCredential, verifyDelegationChain } from './credentials/index.js';
 import 'multiformats';
 import 'multiformats/cid';

package/dist/index.js

@@ -24,14 +24,7 @@ import {
   verifyIdentityChain,
   verifyIdentityExtensionFromTrustedState,
   verifyRevocation
-} from "./chunk-LQ56P4SU.js";
-import {
-  buildMerkleTree,
-  generateMerkleProof,
-  hashLeaf,
-  hexToBytes,
-  verifyMerkleProof
-} from "./chunk-E5CFQG2B.js";
+} from "./chunk-GZ7ZAIRD.js";
 import {
   Attenuation,
   AuthTokenClaims,
@@ -50,10 +43,11 @@ import {
   verifyAuthToken,
   verifyDFOSCredential,
   verifyDelegationChain
-} from "./chunk-MEV6QVLC.js";
+} from "./chunk-LQFOBE6X.js";
 import {
   JwsVerificationError,
   JwtVerificationError,
+  assertJwsProfile,
   base64urlDecode,
   base64urlEncode,
   createJws,
@@ -73,7 +67,7 @@ import {
   signPayloadEd25519,
   verifyJws,
   verifyJwt
-} from "./chunk-ZXXP5W5N.js";
+} from "./chunk-GQOZJKKO.js";
 export {
   ArtifactPayload,
   Attenuation,
@@ -93,9 +87,9 @@ export {
   MultikeyPublicKey,
   RevocationPayload,
   VerifiedIdentity,
+  assertJwsProfile,
   base64urlDecode,
   base64urlEncode,
-  buildMerkleTree,
   createAuthToken,
   createDFOSCredential,
   createJws,
@@ -111,9 +105,6 @@ export {
   encodeEd25519Multikey,
   generateId,
   generateIdNoPrefix,
-  generateMerkleProof,
-  hashLeaf,
-  hexToBytes,
   importEd25519Keypair,
   isAttenuated,
   isCanonicallyEqual,
@@ -141,6 +132,5 @@ export {
   verifyIdentityExtensionFromTrustedState,
   verifyJws,
   verifyJwt,
-  verifyMerkleProof,
   verifyRevocation
 };

package/dist/{schemas-BEl38wrI.d.ts → schemas-BhikXSf_.d.ts}

@@ -91,7 +91,6 @@ declare const ContentOperation: z.ZodDiscriminatedUnion<[z.ZodObject<{
     baseDocumentCID: z.ZodNullable<z.ZodString>;
     createdAt: z.ZodISODateTime;
     note: z.ZodNullable<z.ZodString>;
-    /** DFOS credential authorizing this operation when signer is not the chain creator */
     authorization: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>, z.ZodObject<{
     version: z.ZodLiteral<1>;
@@ -100,7 +99,6 @@ declare const ContentOperation: z.ZodDiscriminatedUnion<[z.ZodObject<{
     previousOperationCID: z.ZodString;
     createdAt: z.ZodISODateTime;
     note: z.ZodNullable<z.ZodString>;
-    /** DFOS credential authorizing this operation when signer is not the chain creator */
     authorization: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>], "type">;
 type ContentOperation = z.infer<typeof ContentOperation>;

package/examples/beacon.json

@@ -1,14 +1,14 @@
 {
   "description": "Beacon: signed manifest content ID announcement with witness countersignature",
   "type": "beacon",
-  "controllerJws": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmJlYWNvbiIsImtpZCI6ImRpZDpkZm9zOmUzdnZ0Y2s0MmQ0ZWFjZG56dnRybjYja2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgiLCJjaWQiOiJiYWZ5cmVpYzJtdXg0cGxpNXFmZDVzYnAyeXh5MmdqbTU0Zmc1Z2NpNm02YnBldm9pdXdmZGc2cG91NCJ9.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiYmVhY29uIiwiZGlkIjoiZGlkOmRmb3M6ZTN2dnRjazQyZDRlYWNkbnp2dHJuNiIsIm1hbmlmZXN0Q29udGVudElkIjoiYTgyejkyYTNobmRrNmM5N3RoY3JuOCIsImNyZWF0ZWRBdCI6IjIwMjYtMDMtMDdUMDA6MDU6MDAuMDAwWiJ9._EKV036utOU-oMHwMyJ1Om1QhJzN-g9DTRbMz0U7L9SzQR-sHIeC6iNreYN-oV-mBvo5RPLg4TJ0UNv-PNBzDQ",
-  "witnessJws": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmJlYWNvbiIsImtpZCI6ImRpZDpkZm9zOmUzdnZ0Y2s0MmQ0ZWFjZG56dnRybjYja2V5X2V6OWE4NzR0Y2tyM2R2OTMzZDNja2QiLCJjaWQiOiJiYWZ5cmVpYzJtdXg0cGxpNXFmZDVzYnAyeXh5MmdqbTU0Zmc1Z2NpNm02YnBldm9pdXdmZGc2cG91NCJ9.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiYmVhY29uIiwiZGlkIjoiZGlkOmRmb3M6ZTN2dnRjazQyZDRlYWNkbnp2dHJuNiIsIm1hbmlmZXN0Q29udGVudElkIjoiYTgyejkyYTNobmRrNmM5N3RoY3JuOCIsImNyZWF0ZWRBdCI6IjIwMjYtMDMtMDdUMDA6MDU6MDAuMDAwWiJ9.a2BN31Mqi296FJ8wIVOwy7zdTR4fEL2TVy2A6xG6SGUBmJdUdnlqro5JbjIOF-h5RSA1SW0i4WvIK-AeiB27BQ",
+  "controllerJws": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmJlYWNvbiIsImtpZCI6ImRpZDpkZm9zOmNubm5mdDlmOGEycm45MzhkNm5rejM4cjg0N3Yya3Ija2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgzbm4yOXp2aGUiLCJjaWQiOiJiYWZ5cmVpYjR3MnAydTZ0bHc3N3NidGtwdnc3ZnF2d3ZrNnJ3MzdweWFtM29zb2JvNXhwM29vZWt1cSJ9.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiYmVhY29uIiwiZGlkIjoiZGlkOmRmb3M6Y25ubmZ0OWY4YTJybjkzOGQ2bmt6MzhyODQ3djJrciIsIm1hbmlmZXN0Q29udGVudElkIjoiY3Y3bjh2a3ZyNjRjY3RmMzI5NGg5azRlYW5oZmY4eiIsImNyZWF0ZWRBdCI6IjIwMjYtMDMtMDdUMDA6MDU6MDAuMDAwWiJ9.exr0Dfb_asVXeMpnUOaql9ppeO2pifzEdId8ocXHQ6-v_XUwccQdJaL4MhKzJGUbRAa0hfRVSFRndhjJ4NN1DA",
+  "witnessJws": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmJlYWNvbiIsImtpZCI6ImRpZDpkZm9zOmNubm5mdDlmOGEycm45MzhkNm5rejM4cjg0N3Yya3Ija2V5X2V6OWE4NzR0Y2tyM2R2OTMzZDNja2RuN3o2enJjdDgiLCJjaWQiOiJiYWZ5cmVpYjR3MnAydTZ0bHc3N3NidGtwdnc3ZnF2d3ZrNnJ3MzdweWFtM29zb2JvNXhwM29vZWt1cSJ9.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiYmVhY29uIiwiZGlkIjoiZGlkOmRmb3M6Y25ubmZ0OWY4YTJybjkzOGQ2bmt6MzhyODQ3djJrciIsIm1hbmlmZXN0Q29udGVudElkIjoiY3Y3bjh2a3ZyNjRjY3RmMzI5NGg5azRlYW5oZmY4eiIsImNyZWF0ZWRBdCI6IjIwMjYtMDMtMDdUMDA6MDU6MDAuMDAwWiJ9.-49R4npkmKMJtnK4sVS_x7MFOgB1RhjkZAzwycLp80g_o6y0gV0JjnUAj12as8NglccBXEk_5DdZTFs17ygKCA",
   "controllerPublicKey": "z6MkrzLMNwoJSV4P3YccWcbtk8vd9LtgMKnLeaDLUqLuASjb",
   "witnessPublicKey": "z6MkfUd65JrAhfdgFuMCccU9ThQvjB2fJAMUHkuuajF992gK",
   "expected": {
-    "beaconCID": "bafyreic2mux4pli5qfd5sbp2yxy2gjm54fg5gci6m6bpevoiuwfdg6pou4",
-    "did": "did:dfos:e3vvtck42d4eacdnzvtrn6",
-    "manifestContentId": "a82z92a3hndk6c97thcrn8",
+    "beaconCID": "bafyreib4w2p2u6tlw77sbtkpvw7fqvwvk6rw37pyam3osobo5xp3ooekuq",
+    "did": "did:dfos:cnnnft9f8a2rn938d6nkz38r847v2kr",
+    "manifestContentId": "cv7n8vkvr64cctf3294h9k4eanhff8z",
     "createdAt": "2026-03-07T00:05:00.000Z"
   }
 }

package/examples/content-delegated.json

@@ -2,8 +2,8 @@
   "description": "Content chain: creator signs genesis, delegate signs update with write credential",
   "type": "content-delegated",
   "chain": [
-    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmNvbnRlbnQtb3AiLCJraWQiOiJkaWQ6ZGZvczplM3Z2dGNrNDJkNGVhY2RuenZ0cm42I2tleV9yOWV2MzRmdmMyM3o5OTl2ZWFhZnQ4IiwiY2lkIjoiYmFmeXJlaWFmeG9ka290ZzJpZGE1eHBjZWR2MzdrMmtqZDdqbmJ5Z2hhamhub3VvYm9qaWF4eGo1eGkifQ.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiY3JlYXRlIiwiZGlkIjoiZGlkOmRmb3M6ZTN2dnRjazQyZDRlYWNkbnp2dHJuNiIsImRvY3VtZW50Q0lEIjoiYmFmeXJlaWduN2dmdXU1NHdvMmdlZzN0ZjV0ZXBlcGxibGt0YWhqZnpxanB1aml6YzdhMmJvZXljY2EiLCJiYXNlRG9jdW1lbnRDSUQiOm51bGwsImNyZWF0ZWRBdCI6IjIwMjYtMDMtMDdUMDA6MTA6MDAuMDAwWiIsIm5vdGUiOm51bGx9.oanyS9rbkqrxd1j8T172jVG4ILKFwW2t1JhkQLxsFqHMMURqA5Hl-0GzGFrfSkQT02Nq5RMYXzhcToqbjoV8AQ",
-    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmNvbnRlbnQtb3AiLCJraWQiOiJkaWQ6ZGZvczpuemtmODM4ZWZyNDI0NDMzcm4ycnprI2tleV9hOHIyNzQzNGFhcjc2YWU3MmM4NzdmIiwiY2lkIjoiYmFmeXJlaWE1M3JheWl5djNuY2Z6ZnNmdzJ2cXczeG5sZ2ZibGFiNjNnN2xrbG9laXFhb2Jxc25yenEifQ.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoidXBkYXRlIiwiZGlkIjoiZGlkOmRmb3M6bnprZjgzOGVmcjQyNDQzM3JuMnJ6ayIsInByZXZpb3VzT3BlcmF0aW9uQ0lEIjoiYmFmeXJlaWFmeG9ka290ZzJpZGE1eHBjZWR2MzdrMmtqZDdqbmJ5Z2hhamhub3VvYm9qaWF4eGo1eGkiLCJkb2N1bWVudENJRCI6ImJhZnlyZWlmbml5bmQ2aGV2NjQ2dW9hamFjM2VnYWs3cDJxZmhyaGhvNG1mbXBwYTNydGNqcGV0Z2RlIiwiYmFzZURvY3VtZW50Q0lEIjoiYmFmeXJlaWduN2dmdXU1NHdvMmdlZzN0ZjV0ZXBlcGxibGt0YWhqZnpxanB1aml6YzdhMmJvZXljY2EiLCJjcmVhdGVkQXQiOiIyMDI2LTAzLTA3VDAwOjExOjAwLjAwMFoiLCJub3RlIjoiZGVsZWdhdGVkIGVkaXQgYnkga2V5MyIsImF1dGhvcml6YXRpb24iOiJleUpoYkdjaU9pSkZaRVJUUVNJc0luUjVjQ0k2SW1ScFpEcGtabTl6T21OeVpXUmxiblJwWVd3aUxDSnJhV1FpT2lKa2FXUTZaR1p2Y3pwbE0zWjJkR05yTkRKa05HVmhZMlJ1ZW5aMGNtNDJJMnRsZVY5eU9XVjJNelJtZG1NeU0zbzVPVGwyWldGaFpuUTRJaXdpWTJsa0lqb2lZbUZtZVhKbGFXVnNjemRvYmpkd2NXWjRlV1JvZFhWbmJXWnFiV2t5WTJWb2QyTjNiV3R1WVRJM2IyUjFhWGxvTm5VMmJYcHZaR051YnpRaWZRLmV5SjJaWEp6YVc5dUlqb3hMQ0owZVhCbElqb2lSRVpQVTBOeVpXUmxiblJwWVd3aUxDSnBjM01pT2lKa2FXUTZaR1p2Y3pwbE0zWjJkR05yTkRKa05HVmhZMlJ1ZW5aMGNtNDJJaXdpWVhWa0lqb2laR2xrT21SbWIzTTZibnByWmpnek9HVm1jalF5TkRRek0zSnVNbko2YXlJc0ltRjBkQ0k2VzNzaWNtVnpiM1Z5WTJVaU9pSmphR0ZwYmpwaFl6STJlamg2YTJ0bE5qZDZORGhoWmpOeWFHZzVJaXdpWVdOMGFXOXVJam9pZDNKcGRHVWlmVjBzSW5CeVppSTZXMTBzSW1WNGNDSTZNVGM1T0RjMk1UWXdNQ3dpYVdGMElqb3hOemN5T0RReE5qQXdmUS41ak5SeWdvSUNvX05iMWhoR3JTRkU0c2JEaWgzQU92dWhVVUFVNzBZOThDejdkaEkzakVNclJqZGZpbHh5OTgtOEJBU2VzbEpsMGtEd0ZJc1VUM0lEdyJ9.pmlU0CwctVJJL4eUlrrkUQ52266UtGnV1liETpZ6N-Ui8K-Aob58LdPbAJsk_NpiiFmyeyRiJfUnp-ADCkWqAQ"
+    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmNvbnRlbnQtb3AiLCJraWQiOiJkaWQ6ZGZvczpjbm5uZnQ5ZjhhMnJuOTM4ZDZua3ozOHI4NDd2MmtyI2tleV9yOWV2MzRmdmMyM3o5OTl2ZWFhZnQ4M25uMjl6dmhlIiwiY2lkIjoiYmFmeXJlaWRkc2pnZGk3dmZib2tlejVyZWl4enRmcm9kNnhjbmh0Ymc0NmI3dnZmZGRwb2Z4czVtaXkifQ.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiY3JlYXRlIiwiZGlkIjoiZGlkOmRmb3M6Y25ubmZ0OWY4YTJybjkzOGQ2bmt6MzhyODQ3djJrciIsImRvY3VtZW50Q0lEIjoiYmFmeXJlaWRyd2V4NWRjYjJ1c3NqNmJ0eGJjMzQyM3U1d2VzNnJyd29tbXhhemt1bHRzcG9oN2EzdGkiLCJiYXNlRG9jdW1lbnRDSUQiOm51bGwsImNyZWF0ZWRBdCI6IjIwMjYtMDMtMDdUMDA6MTA6MDAuMDAwWiIsIm5vdGUiOm51bGx9.cxfEOGZ08zCQVuqiiljZNCxZudQi3CGqANtFnWLVyh0m9Sdq2yFk_fl4jCcw_4lTDvkYOkMgEOm_VvkpnqdMDA",
+    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmNvbnRlbnQtb3AiLCJraWQiOiJkaWQ6ZGZvczo5NGFoNzk2M24yMjNrOGM5ODg0aGgyN2VraDQybmVhI2tleV9hOHIyNzQzNGFhcjc2YWU3MmM4NzdmYTQ3a2FyOHJuIiwiY2lkIjoiYmFmeXJlaWd3ZjI0aGhkN2N3dGlhMndocWl3bDVndHZwbGRxNnZtZmozY2ZvdGV5cmJpdjNxMmJhbGkifQ.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoidXBkYXRlIiwiZGlkIjoiZGlkOmRmb3M6OTRhaDc5NjNuMjIzazhjOTg4NGhoMjdla2g0Mm5lYSIsInByZXZpb3VzT3BlcmF0aW9uQ0lEIjoiYmFmeXJlaWRkc2pnZGk3dmZib2tlejVyZWl4enRmcm9kNnhjbmh0Ymc0NmI3dnZmZGRwb2Z4czVtaXkiLCJkb2N1bWVudENJRCI6ImJhZnlyZWllanNzaWhrZGZsamphYmRhbWhrdXlpYm1jNzQzaG4zaTM2YTdmbnV6c2plb2FydHBlNXdhIiwiYmFzZURvY3VtZW50Q0lEIjoiYmFmeXJlaWRyd2V4NWRjYjJ1c3NqNmJ0eGJjMzQyM3U1d2VzNnJyd29tbXhhemt1bHRzcG9oN2EzdGkiLCJjcmVhdGVkQXQiOiIyMDI2LTAzLTA3VDAwOjExOjAwLjAwMFoiLCJub3RlIjoiZGVsZWdhdGVkIGVkaXQgYnkga2V5MyIsImF1dGhvcml6YXRpb24iOiJleUpoYkdjaU9pSkZaRVJUUVNJc0luUjVjQ0k2SW1ScFpEcGtabTl6T21OeVpXUmxiblJwWVd3aUxDSnJhV1FpT2lKa2FXUTZaR1p2Y3pwamJtNXVablE1WmpoaE1uSnVPVE00WkRadWEzb3pPSEk0TkRkMk1tdHlJMnRsZVY5eU9XVjJNelJtZG1NeU0zbzVPVGwyWldGaFpuUTRNMjV1TWpsNmRtaGxJaXdpWTJsa0lqb2lZbUZtZVhKbGFXUmtaVzkyZFRJeVpYTjVhSE5pTlRaa2FHRTJaVFJ4TkhZeU5tbHVObmQ1YjNsMGRYbDJjVFV5TlhjMWFqTnlZMlp0Tm1raWZRLmV5SjJaWEp6YVc5dUlqb3hMQ0owZVhCbElqb2lSRVpQVTBOeVpXUmxiblJwWVd3aUxDSnBjM01pT2lKa2FXUTZaR1p2Y3pwamJtNXVablE1WmpoaE1uSnVPVE00WkRadWEzb3pPSEk0TkRkMk1tdHlJaXdpWVhWa0lqb2laR2xrT21SbWIzTTZPVFJoYURjNU5qTnVNakl6YXpoak9UZzROR2hvTWpkbGEyZzBNbTVsWVNJc0ltRjBkQ0k2VzNzaWNtVnpiM1Z5WTJVaU9pSmphR0ZwYmpvemNqSTBNMmczTnpsbGEzSnVjbUZoWTJVMk16ZzRNbVoyT0dRNE16ZzVJaXdpWVdOMGFXOXVJam9pZDNKcGRHVWlmVjBzSW5CeVppSTZXMTBzSW1WNGNDSTZNVGM1T0RjMk1UWXdNQ3dpYVdGMElqb3hOemN5T0RReE5qQXdmUS5oWko1LXpLTXNKR0tQaEtVdjVCaEt4QnJYLWlaUjNJazNJNTB2b1NEUTVrbWFLOXlvNkI3MTZBY05ibnhlc01tclpXX0FfNzJuZDVYQ29iSTZUbFJBZyJ9.0eNH6RC6O-OkFDBLEWk3YugPUzc9WGtZnG8wRzEEjz0SEwTx5z4FkNoP8Fygu7nd9DZbel9flZL-f0Lg_yD6BA"
   ],
   "creatorPublicKey": "z6MkrzLMNwoJSV4P3YccWcbtk8vd9LtgMKnLeaDLUqLuASjb",
   "delegatePublicKey": "z6MkvsvmSh2dGnu2qw1Tnw7M5fz98ycfuYGxqnpfgmPkLv7o",
@@ -14,10 +14,10 @@
         "format": "short-post",
         "title": "Original Post",
         "body": "Content created by the chain owner.",
-        "createdByDID": "did:dfos:e3vvtck42d4eacdnzvtrn6"
+        "createdByDID": "did:dfos:cnnnft9f8a2rn938d6nkz38r847v2kr"
       },
       "baseDocumentCID": null,
-      "createdByDID": "did:dfos:e3vvtck42d4eacdnzvtrn6",
+      "createdByDID": "did:dfos:cnnnft9f8a2rn938d6nkz38r847v2kr",
       "createdAt": "2026-03-07T00:10:00.000Z"
     },
     {
@@ -26,19 +26,19 @@
         "format": "short-post",
         "title": "Delegated Edit",
         "body": "Content updated by an authorized delegate.",
-        "createdByDID": "did:dfos:nzkf838efr424433rn2rzk"
+        "createdByDID": "did:dfos:94ah7963n223k8c9884hh27ekh42nea"
       },
-      "baseDocumentCID": "bafyreign7gfuu54wo2geg3tf5tepeplblktahjfzqjpujizc7a2boeycca",
-      "createdByDID": "did:dfos:nzkf838efr424433rn2rzk",
+      "baseDocumentCID": "bafyreidrwex5dcb2ussj6btxbc3423u5wes6rrwommxazkultspoh7a3ti",
+      "createdByDID": "did:dfos:94ah7963n223k8c9884hh27ekh42nea",
       "createdAt": "2026-03-07T00:11:00.000Z"
     }
   ],
-  "authorization": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmNyZWRlbnRpYWwiLCJraWQiOiJkaWQ6ZGZvczplM3Z2dGNrNDJkNGVhY2RuenZ0cm42I2tleV9yOWV2MzRmdmMyM3o5OTl2ZWFhZnQ4IiwiY2lkIjoiYmFmeXJlaWVsczdobjdwcWZ4eWRodXVnbWZqbWkyY2Vod2N3bWtuYTI3b2R1aXloNnU2bXpvZGNubzQifQ.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiREZPU0NyZWRlbnRpYWwiLCJpc3MiOiJkaWQ6ZGZvczplM3Z2dGNrNDJkNGVhY2RuenZ0cm42IiwiYXVkIjoiZGlkOmRmb3M6bnprZjgzOGVmcjQyNDQzM3JuMnJ6ayIsImF0dCI6W3sicmVzb3VyY2UiOiJjaGFpbjphYzI2ejh6a2tlNjd6NDhhZjNyaGg5IiwiYWN0aW9uIjoid3JpdGUifV0sInByZiI6W10sImV4cCI6MTc5ODc2MTYwMCwiaWF0IjoxNzcyODQxNjAwfQ.5jNRygoICo_Nb1hhGrSFE4sbDih3AOvuhUUAU70Y98Cz7dhI3jEMrRjdfilxy98-8BASeslJl0kDwFIsUT3IDw",
+  "authorization": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmNyZWRlbnRpYWwiLCJraWQiOiJkaWQ6ZGZvczpjbm5uZnQ5ZjhhMnJuOTM4ZDZua3ozOHI4NDd2MmtyI2tleV9yOWV2MzRmdmMyM3o5OTl2ZWFhZnQ4M25uMjl6dmhlIiwiY2lkIjoiYmFmeXJlaWRkZW92dTIyZXN5aHNiNTZkaGE2ZTRxNHYyNmluNnd5b3l0dXl2cTUyNXc1ajNyY2ZtNmkifQ.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiREZPU0NyZWRlbnRpYWwiLCJpc3MiOiJkaWQ6ZGZvczpjbm5uZnQ5ZjhhMnJuOTM4ZDZua3ozOHI4NDd2MmtyIiwiYXVkIjoiZGlkOmRmb3M6OTRhaDc5NjNuMjIzazhjOTg4NGhoMjdla2g0Mm5lYSIsImF0dCI6W3sicmVzb3VyY2UiOiJjaGFpbjozcjI0M2g3Nzlla3JucmFhY2U2Mzg4MmZ2OGQ4Mzg5IiwiYWN0aW9uIjoid3JpdGUifV0sInByZiI6W10sImV4cCI6MTc5ODc2MTYwMCwiaWF0IjoxNzcyODQxNjAwfQ.hZJ5-zKMsJGKPhKUv5BhKxBrX-iZR3Ik3I50voSDQ5kmaK9yo6B716AcNbnxesMmrZW_A_72nd5XCobI6TlRAg",
   "expected": {
-    "contentId": "ac26z8zkke67z48af3rhh9",
-    "creatorDID": "did:dfos:e3vvtck42d4eacdnzvtrn6",
+    "contentId": "3r243h779ekrnraace63882fv8d8389",
+    "creatorDID": "did:dfos:cnnnft9f8a2rn938d6nkz38r847v2kr",
     "isDeleted": false,
-    "currentDocumentCID": "bafyreifniynd6hev646uoajac3egak7p2qfhrhho4mfmppa3rtcjpetgde",
+    "currentDocumentCID": "bafyreiejssihkdfljjabdamhkuyibmc743hn3i36a7fnuzsjeoartpe5wa",
     "length": 2
   }
 }

package/examples/content-delete.json

@@ -2,8 +2,8 @@
   "description": "Content chain: create + delete",
   "type": "content",
   "chain": [
-    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmNvbnRlbnQtb3AiLCJraWQiOiJkaWQ6ZGZvczplM3Z2dGNrNDJkNGVhY2RuenZ0cm42I2tleV9lejlhODc0dGNrcjNkdjkzM2QzY2tkIiwiY2lkIjoiYmFmeXJlaWFlZGhqcTY0YWFqcHdvY2lhaGw1dzM3ajZ1b3hyNW1vam9xNWRuYWg2ZnB2eHI1ZDRseHUifQ.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiY3JlYXRlIiwiZGlkIjoiZGlkOmRmb3M6ZTN2dnRjazQyZDRlYWNkbnp2dHJuNiIsImRvY3VtZW50Q0lEIjoiYmFmeXJlaWh6d3VvdXBmZzNkeGlwNnhtZ3pteHN5d3lpaTJqZW94eHpiZ3gzenhtMmluN2tub2kzZzQiLCJiYXNlRG9jdW1lbnRDSUQiOm51bGwsImNyZWF0ZWRBdCI6IjIwMjYtMDMtMDdUMDA6MDI6MDAuMDAwWiIsIm5vdGUiOm51bGx9.Rv6vlz5MfrwqDUrSVIGs4ZfeBbkQUSBcXhxwZ6hfudSr5MxhYl08hTqLDOA0W1NMjN0Hs0IW9jXTwLwP1dMDBg",
-    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmNvbnRlbnQtb3AiLCJraWQiOiJkaWQ6ZGZvczplM3Z2dGNrNDJkNGVhY2RuenZ0cm42I2tleV9lejlhODc0dGNrcjNkdjkzM2QzY2tkIiwiY2lkIjoiYmFmeXJlaWQydjUyN2lxMzZ2dnUyNWc3b3BjczJudjRjbmRhcWdrd29naHEzdHB3Z215cnBxZWVuZ2EifQ.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiZGVsZXRlIiwiZGlkIjoiZGlkOmRmb3M6ZTN2dnRjazQyZDRlYWNkbnp2dHJuNiIsInByZXZpb3VzT3BlcmF0aW9uQ0lEIjoiYmFmeXJlaWFlZGhqcTY0YWFqcHdvY2lhaGw1dzM3ajZ1b3hyNW1vam9xNWRuYWg2ZnB2eHI1ZDRseHUiLCJjcmVhdGVkQXQiOiIyMDI2LTAzLTA3VDAwOjAzOjAwLjAwMFoiLCJub3RlIjoicmVtb3ZpbmcgY29udGVudCJ9.9DTnVeYjVV6Kc971etvWeNn9iMme7RnrRZRmYBO0iaYeePJDblL_p2uuEIuxtAQQp1bATpsQ475zpK6N2A0eAg"
+    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmNvbnRlbnQtb3AiLCJraWQiOiJkaWQ6ZGZvczpjbm5uZnQ5ZjhhMnJuOTM4ZDZua3ozOHI4NDd2MmtyI2tleV9lejlhODc0dGNrcjNkdjkzM2QzY2tkbjd6NnpyY3Q4IiwiY2lkIjoiYmFmeXJlaWFxYXRnZGd3Z2d1Zmd5NHRzejZldXJ3dWR0ZHh5Z3V6dHQ3bnE1d2dkN3FpNDQ1bnY1NnkifQ.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiY3JlYXRlIiwiZGlkIjoiZGlkOmRmb3M6Y25ubmZ0OWY4YTJybjkzOGQ2bmt6MzhyODQ3djJrciIsImRvY3VtZW50Q0lEIjoiYmFmeXJlaWV2Y3FybXZ0ejJwaXM1dGRpenQ3c2pvdG9xcW9nbDZ2cnJxZ2E2NHcydG53a3Eycm51ZHkiLCJiYXNlRG9jdW1lbnRDSUQiOm51bGwsImNyZWF0ZWRBdCI6IjIwMjYtMDMtMDdUMDA6MDI6MDAuMDAwWiIsIm5vdGUiOm51bGx9.POTcvRbYb5r_P6ZpJRNAufCkEHmfebUyc1jb_USg7xdG8bwq520HMsg6wWjfrhU8Y-7_86IcLwpldD03_L0-Ag",
+    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmNvbnRlbnQtb3AiLCJraWQiOiJkaWQ6ZGZvczpjbm5uZnQ5ZjhhMnJuOTM4ZDZua3ozOHI4NDd2MmtyI2tleV9lejlhODc0dGNrcjNkdjkzM2QzY2tkbjd6NnpyY3Q4IiwiY2lkIjoiYmFmeXJlaWFsaXlvenNqaW4yaTd4NHl4ejJwcmJnaGIybGU1YzYycGxsbWxhc3YyaGlhZ3l5ZnZjc2kifQ.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiZGVsZXRlIiwiZGlkIjoiZGlkOmRmb3M6Y25ubmZ0OWY4YTJybjkzOGQ2bmt6MzhyODQ3djJrciIsInByZXZpb3VzT3BlcmF0aW9uQ0lEIjoiYmFmeXJlaWFxYXRnZGd3Z2d1Zmd5NHRzejZldXJ3dWR0ZHh5Z3V6dHQ3bnE1d2dkN3FpNDQ1bnY1NnkiLCJjcmVhdGVkQXQiOiIyMDI2LTAzLTA3VDAwOjAzOjAwLjAwMFoiLCJub3RlIjoicmVtb3ZpbmcgY29udGVudCJ9.k_zTEiRy1aPc1d39SQJOCf8yCVaRoYhenun4RJTxBsmDu6TZ5EvBAvXnbFS0DYLE3X1wV1G6YQG6rpxYElG_Ag"
   ],
   "signerPublicKey": "z6MkfUd65JrAhfdgFuMCccU9ThQvjB2fJAMUHkuuajF992gK",
   "documents": [
@@ -13,15 +13,15 @@
         "format": "short-post",
         "title": "Hello World",
         "body": "First post on the protocol.",
-        "createdByDID": "did:dfos:e3vvtck42d4eacdnzvtrn6"
+        "createdByDID": "did:dfos:cnnnft9f8a2rn938d6nkz38r847v2kr"
       },
       "baseDocumentCID": null,
-      "createdByDID": "did:dfos:e3vvtck42d4eacdnzvtrn6",
+      "createdByDID": "did:dfos:cnnnft9f8a2rn938d6nkz38r847v2kr",
       "createdAt": "2026-03-07T00:02:00.000Z"
     }
   ],
   "expected": {
-    "contentId": "a82z92a3hndk6c97thcrn8",
+    "contentId": "cv7n8vkvr64cctf3294h9k4eanhff8z",
     "isDeleted": true,
     "currentDocumentCID": null,
     "length": 2

package/examples/content-lifecycle.json

@@ -2,8 +2,8 @@
   "description": "Content chain: create + update (with both documents)",
   "type": "content",
   "chain": [
-    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmNvbnRlbnQtb3AiLCJraWQiOiJkaWQ6ZGZvczplM3Z2dGNrNDJkNGVhY2RuenZ0cm42I2tleV9lejlhODc0dGNrcjNkdjkzM2QzY2tkIiwiY2lkIjoiYmFmeXJlaWFlZGhqcTY0YWFqcHdvY2lhaGw1dzM3ajZ1b3hyNW1vam9xNWRuYWg2ZnB2eHI1ZDRseHUifQ.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiY3JlYXRlIiwiZGlkIjoiZGlkOmRmb3M6ZTN2dnRjazQyZDRlYWNkbnp2dHJuNiIsImRvY3VtZW50Q0lEIjoiYmFmeXJlaWh6d3VvdXBmZzNkeGlwNnhtZ3pteHN5d3lpaTJqZW94eHpiZ3gzenhtMmluN2tub2kzZzQiLCJiYXNlRG9jdW1lbnRDSUQiOm51bGwsImNyZWF0ZWRBdCI6IjIwMjYtMDMtMDdUMDA6MDI6MDAuMDAwWiIsIm5vdGUiOm51bGx9.Rv6vlz5MfrwqDUrSVIGs4ZfeBbkQUSBcXhxwZ6hfudSr5MxhYl08hTqLDOA0W1NMjN0Hs0IW9jXTwLwP1dMDBg",
-    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmNvbnRlbnQtb3AiLCJraWQiOiJkaWQ6ZGZvczplM3Z2dGNrNDJkNGVhY2RuenZ0cm42I2tleV9lejlhODc0dGNrcjNkdjkzM2QzY2tkIiwiY2lkIjoiYmFmeXJlaWg2ZTVjYmppdHBvemh6aGdtZmt0bWlvaG14eW4zdWN3aHFkM21qaXhpenZ3bWxodjdobTQifQ.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoidXBkYXRlIiwiZGlkIjoiZGlkOmRmb3M6ZTN2dnRjazQyZDRlYWNkbnp2dHJuNiIsInByZXZpb3VzT3BlcmF0aW9uQ0lEIjoiYmFmeXJlaWFlZGhqcTY0YWFqcHdvY2lhaGw1dzM3ajZ1b3hyNW1vam9xNWRuYWg2ZnB2eHI1ZDRseHUiLCJkb2N1bWVudENJRCI6ImJhZnlyZWlkaDdlMzZjdnd5M3V3NXlwaXRjcWs3dW9rdGJra2tqN2U2aHhoa3k0bzc1cnhuN2t4aWx1IiwiYmFzZURvY3VtZW50Q0lEIjoiYmFmeXJlaWh6d3VvdXBmZzNkeGlwNnhtZ3pteHN5d3lpaTJqZW94eHpiZ3gzenhtMmluN2tub2kzZzQiLCJjcmVhdGVkQXQiOiIyMDI2LTAzLTA3VDAwOjAzOjAwLjAwMFoiLCJub3RlIjoiZWRpdGVkIHRpdGxlIGFuZCBib2R5In0.46H3WBKigCzUrIOvS2ekYJFdK1OeLhqvcZTj8FBqFNKO1ivs3oC0ui_hzTKkKO-8uevMjf9-k0GOjyw2u16PDA"
+    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmNvbnRlbnQtb3AiLCJraWQiOiJkaWQ6ZGZvczpjbm5uZnQ5ZjhhMnJuOTM4ZDZua3ozOHI4NDd2MmtyI2tleV9lejlhODc0dGNrcjNkdjkzM2QzY2tkbjd6NnpyY3Q4IiwiY2lkIjoiYmFmeXJlaWFxYXRnZGd3Z2d1Zmd5NHRzejZldXJ3dWR0ZHh5Z3V6dHQ3bnE1d2dkN3FpNDQ1bnY1NnkifQ.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiY3JlYXRlIiwiZGlkIjoiZGlkOmRmb3M6Y25ubmZ0OWY4YTJybjkzOGQ2bmt6MzhyODQ3djJrciIsImRvY3VtZW50Q0lEIjoiYmFmeXJlaWV2Y3FybXZ0ejJwaXM1dGRpenQ3c2pvdG9xcW9nbDZ2cnJxZ2E2NHcydG53a3Eycm51ZHkiLCJiYXNlRG9jdW1lbnRDSUQiOm51bGwsImNyZWF0ZWRBdCI6IjIwMjYtMDMtMDdUMDA6MDI6MDAuMDAwWiIsIm5vdGUiOm51bGx9.POTcvRbYb5r_P6ZpJRNAufCkEHmfebUyc1jb_USg7xdG8bwq520HMsg6wWjfrhU8Y-7_86IcLwpldD03_L0-Ag",
+    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmNvbnRlbnQtb3AiLCJraWQiOiJkaWQ6ZGZvczpjbm5uZnQ5ZjhhMnJuOTM4ZDZua3ozOHI4NDd2MmtyI2tleV9lejlhODc0dGNrcjNkdjkzM2QzY2tkbjd6NnpyY3Q4IiwiY2lkIjoiYmFmeXJlaWJweDRjZ2I0ajZuM216NzY0cHlscmRnNnE3YTQ2bmpuaHg2cDRjcTJybGdldWUzczNldnEifQ.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoidXBkYXRlIiwiZGlkIjoiZGlkOmRmb3M6Y25ubmZ0OWY4YTJybjkzOGQ2bmt6MzhyODQ3djJrciIsInByZXZpb3VzT3BlcmF0aW9uQ0lEIjoiYmFmeXJlaWFxYXRnZGd3Z2d1Zmd5NHRzejZldXJ3dWR0ZHh5Z3V6dHQ3bnE1d2dkN3FpNDQ1bnY1NnkiLCJkb2N1bWVudENJRCI6ImJhZnlyZWlmZXRwdXRreTRmbnp2N3NyZzdsN3luaWg2ajR5dHplcWlicmNwNXVpZXB2b2x4cWhjYmN5IiwiYmFzZURvY3VtZW50Q0lEIjoiYmFmeXJlaWV2Y3FybXZ0ejJwaXM1dGRpenQ3c2pvdG9xcW9nbDZ2cnJxZ2E2NHcydG53a3Eycm51ZHkiLCJjcmVhdGVkQXQiOiIyMDI2LTAzLTA3VDAwOjAzOjAwLjAwMFoiLCJub3RlIjoiZWRpdGVkIHRpdGxlIGFuZCBib2R5In0.yTkJOiiCsjIBHmR7773W1pdjC5in_Fl3WUXHl8Y_Hyb47RgfiWVufPirIolnuI-IOOl6zHNNmDfmy6kFROwOAg"
   ],
   "signerPublicKey": "z6MkfUd65JrAhfdgFuMCccU9ThQvjB2fJAMUHkuuajF992gK",
   "documents": [
@@ -13,10 +13,10 @@
         "format": "short-post",
         "title": "Hello World",
         "body": "First post on the protocol.",
-        "createdByDID": "did:dfos:e3vvtck42d4eacdnzvtrn6"
+        "createdByDID": "did:dfos:cnnnft9f8a2rn938d6nkz38r847v2kr"
       },
       "baseDocumentCID": null,
-      "createdByDID": "did:dfos:e3vvtck42d4eacdnzvtrn6",
+      "createdByDID": "did:dfos:cnnnft9f8a2rn938d6nkz38r847v2kr",
       "createdAt": "2026-03-07T00:02:00.000Z"
     },
     {
@@ -25,17 +25,17 @@
         "format": "short-post",
         "title": "Hello World (edited)",
         "body": "Updated content.",
-        "createdByDID": "did:dfos:e3vvtck42d4eacdnzvtrn6"
+        "createdByDID": "did:dfos:cnnnft9f8a2rn938d6nkz38r847v2kr"
       },
-      "baseDocumentCID": "bafyreihzwuoupfg3dxip6xmgzmxsywyii2jeoxxzbgx3zxm2in7knoi3g4",
-      "createdByDID": "did:dfos:e3vvtck42d4eacdnzvtrn6",
+      "baseDocumentCID": "bafyreievcqrmvtz2pis5tdizt7sjotoqqogl6vrrqga64w2tnwkq2rnudy",
+      "createdByDID": "did:dfos:cnnnft9f8a2rn938d6nkz38r847v2kr",
       "createdAt": "2026-03-07T00:03:00.000Z"
     }
   ],
   "expected": {
-    "contentId": "a82z92a3hndk6c97thcrn8",
+    "contentId": "cv7n8vkvr64cctf3294h9k4eanhff8z",
     "isDeleted": false,
-    "currentDocumentCID": "bafyreidh7e36cvwy3uw5ypitcqk7uoktbkkkj7e6hxhky4o75rxn7kxilu",
+    "currentDocumentCID": "bafyreifetputky4fnzv7srg7l7ynih6j4ytzeqibrcp5uiepvolxqhcbcy",
     "length": 2
   }
 }

package/examples/credential-read.json

@@ -1,11 +1,11 @@
 {
   "description": "DFOS credential: read access",
   "type": "credential",
-  "credential": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmNyZWRlbnRpYWwiLCJraWQiOiJkaWQ6ZGZvczplM3Z2dGNrNDJkNGVhY2RuenZ0cm42I2tleV9yOWV2MzRmdmMyM3o5OTl2ZWFhZnQ4IiwiY2lkIjoiYmFmeXJlaWMzbmJxemFicmxtbnl2a3o3cXI3Znk2cGd4NGFwdm52eWJvNWtzaGN6bXViaXFzemdod2EifQ.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiREZPU0NyZWRlbnRpYWwiLCJpc3MiOiJkaWQ6ZGZvczplM3Z2dGNrNDJkNGVhY2RuenZ0cm42IiwiYXVkIjoiZGlkOmRmb3M6bnprZjgzOGVmcjQyNDQzM3JuMnJ6ayIsImF0dCI6W3sicmVzb3VyY2UiOiJjaGFpbjoqIiwiYWN0aW9uIjoicmVhZCJ9XSwicHJmIjpbXSwiZXhwIjoxNzk4NzYxNjAwLCJpYXQiOjE3NzI4NDE2MDB9.QB-qK89S-sYXaDUkJJSF5ZbsV2djFFvRQlHCj6UDyl-47LZI-ISwwyqRV-zi6MEGdHb0seSkPxpE4if6HHvvCw",
+  "credential": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmNyZWRlbnRpYWwiLCJraWQiOiJkaWQ6ZGZvczpjbm5uZnQ5ZjhhMnJuOTM4ZDZua3ozOHI4NDd2MmtyI2tleV9yOWV2MzRmdmMyM3o5OTl2ZWFhZnQ4M25uMjl6dmhlIiwiY2lkIjoiYmFmeXJlaWN0aGNiaXp4dmdlbXN4djdrc2NvbzdhcGllYWFsM2Z5ZTM3bzQ1Zmt5a25lN2I0aG9icmEifQ.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiREZPU0NyZWRlbnRpYWwiLCJpc3MiOiJkaWQ6ZGZvczpjbm5uZnQ5ZjhhMnJuOTM4ZDZua3ozOHI4NDd2MmtyIiwiYXVkIjoiZGlkOmRmb3M6OTRhaDc5NjNuMjIzazhjOTg4NGhoMjdla2g0Mm5lYSIsImF0dCI6W3sicmVzb3VyY2UiOiJjaGFpbjoqIiwiYWN0aW9uIjoicmVhZCJ9XSwicHJmIjpbXSwiZXhwIjoxNzk4NzYxNjAwLCJpYXQiOjE3NzI4NDE2MDB9.UvTItuWFriA39FZIdB5TuXa_b07eyNLc-iR0cej2litSkjBYAZaLlDJUmyDQ-3dB7TmNVXDbB3SMbpvLnWW9Dw",
   "issuerPublicKey": "z6MkrzLMNwoJSV4P3YccWcbtk8vd9LtgMKnLeaDLUqLuASjb",
   "audiencePublicKey": "z6MkvsvmSh2dGnu2qw1Tnw7M5fz98ycfuYGxqnpfgmPkLv7o",
   "expected": {
-    "iss": "did:dfos:e3vvtck42d4eacdnzvtrn6",
-    "aud": "did:dfos:nzkf838efr424433rn2rzk"
+    "iss": "did:dfos:cnnnft9f8a2rn938d6nkz38r847v2kr",
+    "aud": "did:dfos:94ah7963n223k8c9884hh27ekh42nea"
   }
 }

package/examples/credential-write.json

@@ -1,13 +1,13 @@
 {
   "description": "DFOS credential: write access (broad + narrowed)",
   "type": "credential",
-  "broadCredential": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmNyZWRlbnRpYWwiLCJraWQiOiJkaWQ6ZGZvczplM3Z2dGNrNDJkNGVhY2RuenZ0cm42I2tleV9yOWV2MzRmdmMyM3o5OTl2ZWFhZnQ4IiwiY2lkIjoiYmFmeXJlaWh6dDV3Nmt4YnlsZWZ1N2R3ZDRmbnZxdnlueHphNnhud3N6bXpoYml6anVjNnhjeHFkNmEifQ.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiREZPU0NyZWRlbnRpYWwiLCJpc3MiOiJkaWQ6ZGZvczplM3Z2dGNrNDJkNGVhY2RuenZ0cm42IiwiYXVkIjoiZGlkOmRmb3M6bnprZjgzOGVmcjQyNDQzM3JuMnJ6ayIsImF0dCI6W3sicmVzb3VyY2UiOiJjaGFpbjoqIiwiYWN0aW9uIjoid3JpdGUifV0sInByZiI6W10sImV4cCI6MTc5ODc2MTYwMCwiaWF0IjoxNzcyODQxNjAwfQ.brsN3WSdTLhN5-c0mhDriiKa2FuDD3eW5Mlj3KJYcj0cKQH0RDSACMp3qLeN2DGop-kfOtqtxlS7SAMIuCZGAw",
-  "narrowCredential": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmNyZWRlbnRpYWwiLCJraWQiOiJkaWQ6ZGZvczplM3Z2dGNrNDJkNGVhY2RuenZ0cm42I2tleV9yOWV2MzRmdmMyM3o5OTl2ZWFhZnQ4IiwiY2lkIjoiYmFmeXJlaWFreDQ1ZTJnZm5udmF2a25la3YzMnJleTU3a2lybXA3cTV2YW5teHZ0ajc0NjRqbWJpcXUifQ.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiREZPU0NyZWRlbnRpYWwiLCJpc3MiOiJkaWQ6ZGZvczplM3Z2dGNrNDJkNGVhY2RuenZ0cm42IiwiYXVkIjoiZGlkOmRmb3M6bnprZjgzOGVmcjQyNDQzM3JuMnJ6ayIsImF0dCI6W3sicmVzb3VyY2UiOiJjaGFpbjphODJ6OTJhM2huZGs2Yzk3dGhjcm44IiwiYWN0aW9uIjoid3JpdGUifV0sInByZiI6W10sImV4cCI6MTc5ODc2MTYwMCwiaWF0IjoxNzcyODQxNjAwfQ.ep3NgoKLuKQBohx0Gn6FmroBxEJiV1A3PzKWoBqIJAt6UZqw6f2sLOFNSTb8t9PnONHh5aXuG99OmF7Fyv4mBA",
+  "broadCredential": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmNyZWRlbnRpYWwiLCJraWQiOiJkaWQ6ZGZvczpjbm5uZnQ5ZjhhMnJuOTM4ZDZua3ozOHI4NDd2MmtyI2tleV9yOWV2MzRmdmMyM3o5OTl2ZWFhZnQ4M25uMjl6dmhlIiwiY2lkIjoiYmFmeXJlaWZ5aW5ieGhicml0NTZtM2FhdjY2bXc0eGQ2YWRxamFzdmNmaG11NjZnNnRudXFncnljbG0ifQ.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiREZPU0NyZWRlbnRpYWwiLCJpc3MiOiJkaWQ6ZGZvczpjbm5uZnQ5ZjhhMnJuOTM4ZDZua3ozOHI4NDd2MmtyIiwiYXVkIjoiZGlkOmRmb3M6OTRhaDc5NjNuMjIzazhjOTg4NGhoMjdla2g0Mm5lYSIsImF0dCI6W3sicmVzb3VyY2UiOiJjaGFpbjoqIiwiYWN0aW9uIjoid3JpdGUifV0sInByZiI6W10sImV4cCI6MTc5ODc2MTYwMCwiaWF0IjoxNzcyODQxNjAwfQ.A-EygURAN2bALVwI2AZKFEuy30ZnWJFBaD4jCTf1d7A90rYELStjTWJ1iI7OulihTCfaVtlvj5HtX6Dwv1VxAg",
+  "narrowCredential": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmNyZWRlbnRpYWwiLCJraWQiOiJkaWQ6ZGZvczpjbm5uZnQ5ZjhhMnJuOTM4ZDZua3ozOHI4NDd2MmtyI2tleV9yOWV2MzRmdmMyM3o5OTl2ZWFhZnQ4M25uMjl6dmhlIiwiY2lkIjoiYmFmeXJlaWNiNGVoZWl6eHNrM3N6Ymgyb2dvbXU0cmV1NGd0a2kycHB4NjR6ZW8zeGFrMnh1bWZ2dWkifQ.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiREZPU0NyZWRlbnRpYWwiLCJpc3MiOiJkaWQ6ZGZvczpjbm5uZnQ5ZjhhMnJuOTM4ZDZua3ozOHI4NDd2MmtyIiwiYXVkIjoiZGlkOmRmb3M6OTRhaDc5NjNuMjIzazhjOTg4NGhoMjdla2g0Mm5lYSIsImF0dCI6W3sicmVzb3VyY2UiOiJjaGFpbjpjdjduOHZrdnI2NGNjdGYzMjk0aDlrNGVhbmhmZjh6IiwiYWN0aW9uIjoid3JpdGUifV0sInByZiI6W10sImV4cCI6MTc5ODc2MTYwMCwiaWF0IjoxNzcyODQxNjAwfQ.xwsGleofAr78xbT4jCrK402PEI8G_OzvxJITvAjL5ltr7_2bdkX4sCjmZbnjl9m9QcEXnWyWbBgYO8KFl2r8CQ",
   "issuerPublicKey": "z6MkrzLMNwoJSV4P3YccWcbtk8vd9LtgMKnLeaDLUqLuASjb",
   "audiencePublicKey": "z6MkvsvmSh2dGnu2qw1Tnw7M5fz98ycfuYGxqnpfgmPkLv7o",
   "expected": {
-    "iss": "did:dfos:e3vvtck42d4eacdnzvtrn6",
-    "aud": "did:dfos:nzkf838efr424433rn2rzk",
-    "narrowContentId": "a82z92a3hndk6c97thcrn8"
+    "iss": "did:dfos:cnnnft9f8a2rn938d6nkz38r847v2kr",
+    "aud": "did:dfos:94ah7963n223k8c9884hh27ekh42nea",
+    "narrowContentId": "cv7n8vkvr64cctf3294h9k4eanhff8z"
   }
 }

package/examples/identity-delete.json

@@ -2,15 +2,15 @@
   "description": "Identity chain: genesis + delete (terminal)",
   "type": "identity",
   "chain": [
-    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmlkZW50aXR5LW9wIiwia2lkIjoia2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgiLCJjaWQiOiJiYWZ5cmVpYmFuanBnY3FmZmNmaHI0c3B0empmdGhoNXN6b2hoYm81dGpmdWxlbWt3N3VoZGVuNXVxeSJ9.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiY3JlYXRlIiwiYXV0aEtleXMiOlt7ImlkIjoia2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgiLCJ0eXBlIjoiTXVsdGlrZXkiLCJwdWJsaWNLZXlNdWx0aWJhc2UiOiJ6Nk1rcnpMTU53b0pTVjRQM1ljY1djYnRrOHZkOUx0Z01LbkxlYURMVXFMdUFTamIifV0sImFzc2VydEtleXMiOlt7ImlkIjoia2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgiLCJ0eXBlIjoiTXVsdGlrZXkiLCJwdWJsaWNLZXlNdWx0aWJhc2UiOiJ6Nk1rcnpMTU53b0pTVjRQM1ljY1djYnRrOHZkOUx0Z01LbkxlYURMVXFMdUFTamIifV0sImNvbnRyb2xsZXJLZXlzIjpbeyJpZCI6ImtleV9yOWV2MzRmdmMyM3o5OTl2ZWFhZnQ4IiwidHlwZSI6Ik11bHRpa2V5IiwicHVibGljS2V5TXVsdGliYXNlIjoiejZNa3J6TE1Od29KU1Y0UDNZY2NXY2J0azh2ZDlMdGdNS25MZWFETFVxTHVBU2piIn1dLCJjcmVhdGVkQXQiOiIyMDI2LTAzLTA3VDAwOjAwOjAwLjAwMFoifQ.EDryDK1uvtix-17cHun9t6MacFIx2rMmMF1QLzfD5TFlSsOvMcue97pCgGn3CXeLVFtVxgpCoh0kGSXioKKzAw",
-    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmlkZW50aXR5LW9wIiwia2lkIjoiZGlkOmRmb3M6ZTN2dnRjazQyZDRlYWNkbnp2dHJuNiNrZXlfcjlldjM0ZnZjMjN6OTk5dmVhYWZ0OCIsImNpZCI6ImJhZnlyZWloZ214ZmlnY2JvZjQ2czRrcGtteXhicXJ3dGxybmE0b2NibmxybzNzN29wanljYW15b3g0In0.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiZGVsZXRlIiwicHJldmlvdXNPcGVyYXRpb25DSUQiOiJiYWZ5cmVpYmFuanBnY3FmZmNmaHI0c3B0empmdGhoNXN6b2hoYm81dGpmdWxlbWt3N3VoZGVuNXVxeSIsImNyZWF0ZWRBdCI6IjIwMjYtMDMtMDdUMDA6MDE6MDAuMDAwWiJ9.l3X4ojfmfSd2N2tcLL4LlQbP2iaNrsxrgJ-1Wh2T3xNeZ77jgoWYIN6NHI-oYfi9GnwHBPKsOPKoBOoEFUPlAw"
+    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmlkZW50aXR5LW9wIiwia2lkIjoia2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgzbm4yOXp2aGUiLCJjaWQiOiJiYWZ5cmVpY29naHZqem52bGl1bG94eG1iZjU0dHB6cXdhaG5xcGlsazduY3hlcGppbmVkcGtnYTNuZSJ9.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiY3JlYXRlIiwiYXV0aEtleXMiOlt7ImlkIjoia2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgzbm4yOXp2aGUiLCJ0eXBlIjoiTXVsdGlrZXkiLCJwdWJsaWNLZXlNdWx0aWJhc2UiOiJ6Nk1rcnpMTU53b0pTVjRQM1ljY1djYnRrOHZkOUx0Z01LbkxlYURMVXFMdUFTamIifV0sImFzc2VydEtleXMiOlt7ImlkIjoia2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgzbm4yOXp2aGUiLCJ0eXBlIjoiTXVsdGlrZXkiLCJwdWJsaWNLZXlNdWx0aWJhc2UiOiJ6Nk1rcnpMTU53b0pTVjRQM1ljY1djYnRrOHZkOUx0Z01LbkxlYURMVXFMdUFTamIifV0sImNvbnRyb2xsZXJLZXlzIjpbeyJpZCI6ImtleV9yOWV2MzRmdmMyM3o5OTl2ZWFhZnQ4M25uMjl6dmhlIiwidHlwZSI6Ik11bHRpa2V5IiwicHVibGljS2V5TXVsdGliYXNlIjoiejZNa3J6TE1Od29KU1Y0UDNZY2NXY2J0azh2ZDlMdGdNS25MZWFETFVxTHVBU2piIn1dLCJjcmVhdGVkQXQiOiIyMDI2LTAzLTA3VDAwOjAwOjAwLjAwMFoifQ.TeznHnzrtKOGTr0FzkDL2z-luMWnAbKXrmDbi-Exgw_xMPCnYwGHORMjw-BM28f0RoTirIAeD7d20W5RSuGuBg",
+    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmlkZW50aXR5LW9wIiwia2lkIjoiZGlkOmRmb3M6Y25ubmZ0OWY4YTJybjkzOGQ2bmt6MzhyODQ3djJrciNrZXlfcjlldjM0ZnZjMjN6OTk5dmVhYWZ0ODNubjI5enZoZSIsImNpZCI6ImJhZnlyZWlnaWJ5anN2bGt0ZTQ2Zzd6NHIydXd5eHA2eDU1b3RlbzRmcjVuZGE3emFvbHFvbDIyM3hhIn0.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiZGVsZXRlIiwicHJldmlvdXNPcGVyYXRpb25DSUQiOiJiYWZ5cmVpY29naHZqem52bGl1bG94eG1iZjU0dHB6cXdhaG5xcGlsazduY3hlcGppbmVkcGtnYTNuZSIsImNyZWF0ZWRBdCI6IjIwMjYtMDMtMDdUMDA6MDE6MDAuMDAwWiJ9.7SNEk43hmCoN4vpUELfHNMsHO_H1QBPurEFPH3n2xf3cVR3EvJ1A7-xwf8_f3AmawFNI712jMQTpj9r4jQvQCg"
   ],
   "expected": {
-    "did": "did:dfos:e3vvtck42d4eacdnzvtrn6",
+    "did": "did:dfos:cnnnft9f8a2rn938d6nkz38r847v2kr",
     "isDeleted": true,
     "controllerKeys": [
       {
-        "id": "key_r9ev34fvc23z999veaaft8",
+        "id": "key_r9ev34fvc23z999veaaft83nn29zvhe",
         "type": "Multikey",
         "publicKeyMultibase": "z6MkrzLMNwoJSV4P3YccWcbtk8vd9LtgMKnLeaDLUqLuASjb"
       }

package/examples/identity-genesis.json

@@ -2,14 +2,14 @@
   "description": "Identity chain: genesis (single create operation)",
   "type": "identity",
   "chain": [
-    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmlkZW50aXR5LW9wIiwia2lkIjoia2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgiLCJjaWQiOiJiYWZ5cmVpYmFuanBnY3FmZmNmaHI0c3B0empmdGhoNXN6b2hoYm81dGpmdWxlbWt3N3VoZGVuNXVxeSJ9.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiY3JlYXRlIiwiYXV0aEtleXMiOlt7ImlkIjoia2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgiLCJ0eXBlIjoiTXVsdGlrZXkiLCJwdWJsaWNLZXlNdWx0aWJhc2UiOiJ6Nk1rcnpMTU53b0pTVjRQM1ljY1djYnRrOHZkOUx0Z01LbkxlYURMVXFMdUFTamIifV0sImFzc2VydEtleXMiOlt7ImlkIjoia2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgiLCJ0eXBlIjoiTXVsdGlrZXkiLCJwdWJsaWNLZXlNdWx0aWJhc2UiOiJ6Nk1rcnpMTU53b0pTVjRQM1ljY1djYnRrOHZkOUx0Z01LbkxlYURMVXFMdUFTamIifV0sImNvbnRyb2xsZXJLZXlzIjpbeyJpZCI6ImtleV9yOWV2MzRmdmMyM3o5OTl2ZWFhZnQ4IiwidHlwZSI6Ik11bHRpa2V5IiwicHVibGljS2V5TXVsdGliYXNlIjoiejZNa3J6TE1Od29KU1Y0UDNZY2NXY2J0azh2ZDlMdGdNS25MZWFETFVxTHVBU2piIn1dLCJjcmVhdGVkQXQiOiIyMDI2LTAzLTA3VDAwOjAwOjAwLjAwMFoifQ.EDryDK1uvtix-17cHun9t6MacFIx2rMmMF1QLzfD5TFlSsOvMcue97pCgGn3CXeLVFtVxgpCoh0kGSXioKKzAw"
+    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmlkZW50aXR5LW9wIiwia2lkIjoia2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgzbm4yOXp2aGUiLCJjaWQiOiJiYWZ5cmVpY29naHZqem52bGl1bG94eG1iZjU0dHB6cXdhaG5xcGlsazduY3hlcGppbmVkcGtnYTNuZSJ9.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiY3JlYXRlIiwiYXV0aEtleXMiOlt7ImlkIjoia2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgzbm4yOXp2aGUiLCJ0eXBlIjoiTXVsdGlrZXkiLCJwdWJsaWNLZXlNdWx0aWJhc2UiOiJ6Nk1rcnpMTU53b0pTVjRQM1ljY1djYnRrOHZkOUx0Z01LbkxlYURMVXFMdUFTamIifV0sImFzc2VydEtleXMiOlt7ImlkIjoia2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgzbm4yOXp2aGUiLCJ0eXBlIjoiTXVsdGlrZXkiLCJwdWJsaWNLZXlNdWx0aWJhc2UiOiJ6Nk1rcnpMTU53b0pTVjRQM1ljY1djYnRrOHZkOUx0Z01LbkxlYURMVXFMdUFTamIifV0sImNvbnRyb2xsZXJLZXlzIjpbeyJpZCI6ImtleV9yOWV2MzRmdmMyM3o5OTl2ZWFhZnQ4M25uMjl6dmhlIiwidHlwZSI6Ik11bHRpa2V5IiwicHVibGljS2V5TXVsdGliYXNlIjoiejZNa3J6TE1Od29KU1Y0UDNZY2NXY2J0azh2ZDlMdGdNS25MZWFETFVxTHVBU2piIn1dLCJjcmVhdGVkQXQiOiIyMDI2LTAzLTA3VDAwOjAwOjAwLjAwMFoifQ.TeznHnzrtKOGTr0FzkDL2z-luMWnAbKXrmDbi-Exgw_xMPCnYwGHORMjw-BM28f0RoTirIAeD7d20W5RSuGuBg"
   ],
   "expected": {
-    "did": "did:dfos:e3vvtck42d4eacdnzvtrn6",
+    "did": "did:dfos:cnnnft9f8a2rn938d6nkz38r847v2kr",
     "isDeleted": false,
     "controllerKeys": [
       {
-        "id": "key_r9ev34fvc23z999veaaft8",
+        "id": "key_r9ev34fvc23z999veaaft83nn29zvhe",
         "type": "Multikey",
         "publicKeyMultibase": "z6MkrzLMNwoJSV4P3YccWcbtk8vd9LtgMKnLeaDLUqLuASjb"
       }

package/examples/identity-rotation.json

@@ -2,15 +2,15 @@
   "description": "Identity chain: genesis + key rotation",
   "type": "identity",
   "chain": [
-    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmlkZW50aXR5LW9wIiwia2lkIjoia2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgiLCJjaWQiOiJiYWZ5cmVpYmFuanBnY3FmZmNmaHI0c3B0empmdGhoNXN6b2hoYm81dGpmdWxlbWt3N3VoZGVuNXVxeSJ9.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiY3JlYXRlIiwiYXV0aEtleXMiOlt7ImlkIjoia2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgiLCJ0eXBlIjoiTXVsdGlrZXkiLCJwdWJsaWNLZXlNdWx0aWJhc2UiOiJ6Nk1rcnpMTU53b0pTVjRQM1ljY1djYnRrOHZkOUx0Z01LbkxlYURMVXFMdUFTamIifV0sImFzc2VydEtleXMiOlt7ImlkIjoia2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgiLCJ0eXBlIjoiTXVsdGlrZXkiLCJwdWJsaWNLZXlNdWx0aWJhc2UiOiJ6Nk1rcnpMTU53b0pTVjRQM1ljY1djYnRrOHZkOUx0Z01LbkxlYURMVXFMdUFTamIifV0sImNvbnRyb2xsZXJLZXlzIjpbeyJpZCI6ImtleV9yOWV2MzRmdmMyM3o5OTl2ZWFhZnQ4IiwidHlwZSI6Ik11bHRpa2V5IiwicHVibGljS2V5TXVsdGliYXNlIjoiejZNa3J6TE1Od29KU1Y0UDNZY2NXY2J0azh2ZDlMdGdNS25MZWFETFVxTHVBU2piIn1dLCJjcmVhdGVkQXQiOiIyMDI2LTAzLTA3VDAwOjAwOjAwLjAwMFoifQ.EDryDK1uvtix-17cHun9t6MacFIx2rMmMF1QLzfD5TFlSsOvMcue97pCgGn3CXeLVFtVxgpCoh0kGSXioKKzAw",
-    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmlkZW50aXR5LW9wIiwia2lkIjoiZGlkOmRmb3M6ZTN2dnRjazQyZDRlYWNkbnp2dHJuNiNrZXlfcjlldjM0ZnZjMjN6OTk5dmVhYWZ0OCIsImNpZCI6ImJhZnlyZWljeW00Y3lpZWRubGQ3M3NtYngzMnN6YWVpN3hkdWxxbjRnM3N0ZTVlMncydWxhanIzb3FtIn0.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoidXBkYXRlIiwicHJldmlvdXNPcGVyYXRpb25DSUQiOiJiYWZ5cmVpYmFuanBnY3FmZmNmaHI0c3B0empmdGhoNXN6b2hoYm81dGpmdWxlbWt3N3VoZGVuNXVxeSIsImF1dGhLZXlzIjpbeyJpZCI6ImtleV9lejlhODc0dGNrcjNkdjkzM2QzY2tkIiwidHlwZSI6Ik11bHRpa2V5IiwicHVibGljS2V5TXVsdGliYXNlIjoiejZNa2ZVZDY1SnJBaGZkZ0Z1TUNjY1U5VGhRdmpCMmZKQU1VSGt1dWFqRjk5MmdLIn1dLCJhc3NlcnRLZXlzIjpbeyJpZCI6ImtleV9lejlhODc0dGNrcjNkdjkzM2QzY2tkIiwidHlwZSI6Ik11bHRpa2V5IiwicHVibGljS2V5TXVsdGliYXNlIjoiejZNa2ZVZDY1SnJBaGZkZ0Z1TUNjY1U5VGhRdmpCMmZKQU1VSGt1dWFqRjk5MmdLIn1dLCJjb250cm9sbGVyS2V5cyI6W3siaWQiOiJrZXlfZXo5YTg3NHRja3IzZHY5MzNkM2NrZCIsInR5cGUiOiJNdWx0aWtleSIsInB1YmxpY0tleU11bHRpYmFzZSI6Ino2TWtmVWQ2NUpyQWhmZGdGdU1DY2NVOVRoUXZqQjJmSkFNVUhrdXVhakY5OTJnSyJ9XSwiY3JlYXRlZEF0IjoiMjAyNi0wMy0wN1QwMDowMTowMC4wMDBaIn0.MScuoBlgOK3j5QX9tFcw1ou0o4LgJziGJEsZ5pvqiBr1SagAyAv5h-wajQhtg8IP7dLlM0U4leW2iRra945cDg"
+    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmlkZW50aXR5LW9wIiwia2lkIjoia2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgzbm4yOXp2aGUiLCJjaWQiOiJiYWZ5cmVpY29naHZqem52bGl1bG94eG1iZjU0dHB6cXdhaG5xcGlsazduY3hlcGppbmVkcGtnYTNuZSJ9.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiY3JlYXRlIiwiYXV0aEtleXMiOlt7ImlkIjoia2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgzbm4yOXp2aGUiLCJ0eXBlIjoiTXVsdGlrZXkiLCJwdWJsaWNLZXlNdWx0aWJhc2UiOiJ6Nk1rcnpMTU53b0pTVjRQM1ljY1djYnRrOHZkOUx0Z01LbkxlYURMVXFMdUFTamIifV0sImFzc2VydEtleXMiOlt7ImlkIjoia2V5X3I5ZXYzNGZ2YzIzejk5OXZlYWFmdDgzbm4yOXp2aGUiLCJ0eXBlIjoiTXVsdGlrZXkiLCJwdWJsaWNLZXlNdWx0aWJhc2UiOiJ6Nk1rcnpMTU53b0pTVjRQM1ljY1djYnRrOHZkOUx0Z01LbkxlYURMVXFMdUFTamIifV0sImNvbnRyb2xsZXJLZXlzIjpbeyJpZCI6ImtleV9yOWV2MzRmdmMyM3o5OTl2ZWFhZnQ4M25uMjl6dmhlIiwidHlwZSI6Ik11bHRpa2V5IiwicHVibGljS2V5TXVsdGliYXNlIjoiejZNa3J6TE1Od29KU1Y0UDNZY2NXY2J0azh2ZDlMdGdNS25MZWFETFVxTHVBU2piIn1dLCJjcmVhdGVkQXQiOiIyMDI2LTAzLTA3VDAwOjAwOjAwLjAwMFoifQ.TeznHnzrtKOGTr0FzkDL2z-luMWnAbKXrmDbi-Exgw_xMPCnYwGHORMjw-BM28f0RoTirIAeD7d20W5RSuGuBg",
+    "eyJhbGciOiJFZERTQSIsInR5cCI6ImRpZDpkZm9zOmlkZW50aXR5LW9wIiwia2lkIjoiZGlkOmRmb3M6Y25ubmZ0OWY4YTJybjkzOGQ2bmt6MzhyODQ3djJrciNrZXlfcjlldjM0ZnZjMjN6OTk5dmVhYWZ0ODNubjI5enZoZSIsImNpZCI6ImJhZnlyZWliZnVoNjN1djMzaTJpNWVvb2UzYm9pdDJydXlqZWh1YnNyeWVtdXV6Nm1ydGxlajI2cmVpIn0.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoidXBkYXRlIiwicHJldmlvdXNPcGVyYXRpb25DSUQiOiJiYWZ5cmVpY29naHZqem52bGl1bG94eG1iZjU0dHB6cXdhaG5xcGlsazduY3hlcGppbmVkcGtnYTNuZSIsImF1dGhLZXlzIjpbeyJpZCI6ImtleV9lejlhODc0dGNrcjNkdjkzM2QzY2tkbjd6NnpyY3Q4IiwidHlwZSI6Ik11bHRpa2V5IiwicHVibGljS2V5TXVsdGliYXNlIjoiejZNa2ZVZDY1SnJBaGZkZ0Z1TUNjY1U5VGhRdmpCMmZKQU1VSGt1dWFqRjk5MmdLIn1dLCJhc3NlcnRLZXlzIjpbeyJpZCI6ImtleV9lejlhODc0dGNrcjNkdjkzM2QzY2tkbjd6NnpyY3Q4IiwidHlwZSI6Ik11bHRpa2V5IiwicHVibGljS2V5TXVsdGliYXNlIjoiejZNa2ZVZDY1SnJBaGZkZ0Z1TUNjY1U5VGhRdmpCMmZKQU1VSGt1dWFqRjk5MmdLIn1dLCJjb250cm9sbGVyS2V5cyI6W3siaWQiOiJrZXlfZXo5YTg3NHRja3IzZHY5MzNkM2NrZG43ejZ6cmN0OCIsInR5cGUiOiJNdWx0aWtleSIsInB1YmxpY0tleU11bHRpYmFzZSI6Ino2TWtmVWQ2NUpyQWhmZGdGdU1DY2NVOVRoUXZqQjJmSkFNVUhrdXVhakY5OTJnSyJ9XSwiY3JlYXRlZEF0IjoiMjAyNi0wMy0wN1QwMDowMTowMC4wMDBaIn0.7fqvWGEVYW9atA1uqpp7lIUOWp4dATLpLjOmFWzJN-8gTL-QnXDCeyGcBu5AXhHzO52fauwUavh1KrB6wBYuCw"
   ],
   "expected": {
-    "did": "did:dfos:e3vvtck42d4eacdnzvtrn6",
+    "did": "did:dfos:cnnnft9f8a2rn938d6nkz38r847v2kr",
     "isDeleted": false,
     "controllerKeys": [
       {
-        "id": "key_ez9a874tckr3dv933d3ckd",
+        "id": "key_ez9a874tckr3dv933d3ckdn7z6zrct8",
         "type": "Multikey",
         "publicKeyMultibase": "z6MkfUd65JrAhfdgFuMCccU9ThQvjB2fJAMUHkuuajF992gK"
       }

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@metalabel/dfos-protocol",
-  "version": "0.8.1",
+  "version": "0.10.0",
   "type": "module",
-  "description": "DFOS Protocol — Ed25519 signed chain primitives, beacons, merkle trees, and verification",
+  "description": "DFOS Protocol — Ed25519 signed chain primitives, beacons, credentials, and verification",
   "license": "MIT",
   "author": "Metalabel <hello@metalabel.com> (https://metalabel.com)",
   "repository": {
@@ -37,10 +37,6 @@
       "import": "./dist/chain/index.js",
       "types": "./dist/chain/index.d.ts"
     },
-    "./merkle": {
-      "import": "./dist/merkle/index.js",
-      "types": "./dist/merkle/index.d.ts"
-    },
     "./credentials": {
       "import": "./dist/credentials/index.js",
       "types": "./dist/credentials/index.d.ts"
@@ -54,19 +50,19 @@
     "README.md"
   ],
   "dependencies": {
-    "@ipld/dag-cbor": "^9.2.5",
-    "@noble/curves": "^2.0.1",
-    "@noble/hashes": "^2.0.1",
-    "multiformats": "^13.4.2",
-    "zod": "^4.3.6"
+    "@ipld/dag-cbor": "^10.0.1",
+    "@noble/curves": "^2.2.0",
+    "@noble/hashes": "^2.2.0",
+    "multiformats": "^14.0.0",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@types/node": "^24.10.4",
-    "ajv": "^8.18.0",
+    "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
     "tsup": "^8.5.1",
-    "tsx": "^4.21.0",
-    "vitest": "^4.1.2"
+    "tsx": "^4.22.4",
+    "vitest": "^4.1.8"
   },
   "scripts": {
     "build": "tsup",

package/schemas/manifest.v1.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://schemas.dfos.com/manifest/v1",
   "title": "Manifest",
-  "description": "A manifest — a named map of protocol object references for semantic navigation. Keys are path-like labels. Values are protocol references: content chain identifiers (22-char bare hash), DIDs (did:dfos:...), or CIDs (bafyrei...). The document layer of the dark forest. Discovery is social or out-of-band.",
+  "description": "A manifest — a named map of protocol object references for semantic navigation. Keys are path-like labels. Values are protocol references: content chain identifiers (31-char bare hash), DIDs (did:dfos:...), or CIDs (bafyrei...). The document layer of the dark forest. Discovery is social or out-of-band.",
   "type": "object",
   "required": ["$schema", "entries"],
   "properties": {

package/dist/chunk-E5CFQG2B.js

@@ -1,99 +0,0 @@
-// src/merkle/tree.ts
-var sha256 = async (data) => {
-  const buf = await crypto.subtle.digest("SHA-256", data);
-  return new Uint8Array(buf);
-};
-var toHex = (bytes) => {
-  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
-};
-var hexToBytes = (hex) => {
-  const bytes = new Uint8Array(hex.length / 2);
-  for (let i = 0; i < hex.length; i += 2) {
-    bytes[i / 2] = parseInt(hex.substring(i, i + 2), 16);
-  }
-  return bytes;
-};
-var concat = (a, b) => {
-  const result = new Uint8Array(a.length + b.length);
-  result.set(a, 0);
-  result.set(b, a.length);
-  return result;
-};
-var hashLeaf = async (contentId) => {
-  return sha256(new TextEncoder().encode(contentId));
-};
-var hashInterior = async (left, right) => {
-  return sha256(concat(left, right));
-};
-var buildMerkleTree = async (contentIds) => {
-  const sorted = [...new Set(contentIds)].sort();
-  if (sorted.length === 0) return { root: null, leafCount: 0 };
-  let level = await Promise.all(sorted.map(hashLeaf));
-  while (level.length > 1) {
-    const nextLevel = [];
-    for (let i = 0; i < level.length; i += 2) {
-      if (i + 1 < level.length) {
-        nextLevel.push(await hashInterior(level[i], level[i + 1]));
-      } else {
-        nextLevel.push(level[i]);
-      }
-    }
-    level = nextLevel;
-  }
-  return { root: toHex(level[0]), leafCount: sorted.length };
-};
-
-// src/merkle/proof.ts
-var generateMerkleProof = async (contentIds, targetId) => {
-  const sorted = [...new Set(contentIds)].sort();
-  const targetIdx = sorted.indexOf(targetId);
-  if (targetIdx < 0) return null;
-  const { root } = await buildMerkleTree(sorted);
-  if (!root) return null;
-  const leaves = await Promise.all(sorted.map(hashLeaf));
-  const path = [];
-  let level = leaves;
-  let idx = targetIdx;
-  while (level.length > 1) {
-    const nextLevel = [];
-    const nextIdx = Math.floor(idx / 2);
-    for (let i = 0; i < level.length; i += 2) {
-      if (i + 1 < level.length) {
-        if (i === idx || i + 1 === idx) {
-          const siblingIdx = i === idx ? i + 1 : i;
-          path.push({
-            hash: toHex(level[siblingIdx]),
-            position: siblingIdx < idx ? "left" : "right"
-          });
-        }
-        const interior = await sha256(concat(level[i], level[i + 1]));
-        nextLevel.push(interior);
-      } else {
-        nextLevel.push(level[i]);
-      }
-    }
-    level = nextLevel;
-    idx = nextIdx;
-  }
-  return { contentId: targetId, root, path };
-};
-var verifyMerkleProof = async (proof) => {
-  let current = await hashLeaf(proof.contentId);
-  for (const step of proof.path) {
-    const sibling = hexToBytes(step.hash);
-    if (step.position === "left") {
-      current = await sha256(concat(sibling, current));
-    } else {
-      current = await sha256(concat(current, sibling));
-    }
-  }
-  return toHex(current) === proof.root;
-};
-
-export {
-  hexToBytes,
-  hashLeaf,
-  buildMerkleTree,
-  generateMerkleProof,
-  verifyMerkleProof
-};

package/dist/merkle/index.d.ts

@@ -1,45 +0,0 @@
-declare const hexToBytes: (hex: string) => Uint8Array;
-/**
- * Hash a leaf node — SHA-256 of UTF-8 encoded contentId
- */
-declare const hashLeaf: (contentId: string) => Promise<Uint8Array>;
-/**
- * Build a sorted binary Merkle tree over content identifiers
- *
- * ContentIds are sorted lexicographically, hashed to leaves, then paired
- * and hashed up to the root. Odd nodes are promoted to the next level.
- *
- * Returns null root for empty input. Deduplicates contentIds.
- */
-declare const buildMerkleTree: (contentIds: string[]) => Promise<{
-    root: string | null;
-    leafCount: number;
-}>;
-
-interface MerkleProof {
-    /** The contentId being proven */
-    contentId: string;
-    /** Hex SHA-256 root of the tree */
-    root: string;
-    /** Sibling hashes along the path from leaf to root */
-    path: Array<{
-        /** Hex SHA-256 of sibling node */
-        hash: string;
-        /** Position of the sibling relative to the current node */
-        position: 'left' | 'right';
-    }>;
-}
-/**
- * Generate an inclusion proof for a contentId in the set
- *
- * Returns null if the contentId is not in the set.
- */
-declare const generateMerkleProof: (contentIds: string[], targetId: string) => Promise<MerkleProof | null>;
-/**
- * Verify a Merkle inclusion proof
- *
- * Recomputes the root from the leaf and proof path, compares to the claimed root.
- */
-declare const verifyMerkleProof: (proof: MerkleProof) => Promise<boolean>;
-
-export { type MerkleProof, buildMerkleTree, generateMerkleProof, hashLeaf, hexToBytes, verifyMerkleProof };

package/dist/merkle/index.js

@@ -1,14 +0,0 @@
-import {
-  buildMerkleTree,
-  generateMerkleProof,
-  hashLeaf,
-  hexToBytes,
-  verifyMerkleProof
-} from "../chunk-E5CFQG2B.js";
-export {
-  buildMerkleTree,
-  generateMerkleProof,
-  hashLeaf,
-  hexToBytes,
-  verifyMerkleProof
-};

package/examples/merkle-tree.json

@@ -1,28 +0,0 @@
-{
-  "description": "Merkle tree: 5 content IDs → sorted → leaf hashes → root, with inclusion proof for \"charlie\"",
-  "type": "merkle",
-  "contentIds": ["alpha", "bravo", "charlie", "delta", "echo"],
-  "expected": {
-    "sortedIds": ["alpha", "bravo", "charlie", "delta", "echo"],
-    "root": "7e80d4780f454e0fca0b090d8c646f572b49354f54154531606105aad2fda28e",
-    "leafCount": 5,
-    "charlieProof": {
-      "contentId": "charlie",
-      "root": "7e80d4780f454e0fca0b090d8c646f572b49354f54154531606105aad2fda28e",
-      "path": [
-        {
-          "hash": "4f4a9410ffcdf895c4adb880659e9b5c0dd1f23a30790684340b3eaacb045398",
-          "position": "right"
-        },
-        {
-          "hash": "90d39555bb3c223e12f5a375c3011d2462fe2e1e36b8416a0b623d5831a9b4f3",
-          "position": "left"
-        },
-        {
-          "hash": "092c79e8f80e559e404bcf660c48f3522b67aba9ff1484b0367e1a4ddef7431d",
-          "position": "right"
-        }
-      ]
-    }
-  }
-}