@oma3/omatrust 0.1.0-alpha.10 → 0.1.0-alpha.11

package/dist/reputation/index.browser.cjs

@@ -1,6 +1,7 @@
 'use strict';
 
 var ethers = require('ethers');
+var jose = require('jose');
 var easSdk = require('@ethereum-attestation-service/eas-sdk');
 var canonicalize = require('canonicalize');
 
@@ -41,6 +42,11 @@ function assertString(value, name, code = "INVALID_INPUT") {
     throw new OmaTrustError(code, `${name} must be a non-empty string`, { value });
   }
 }
+function assertObject(value, name, code = "INVALID_INPUT") {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new OmaTrustError(code, `${name} must be an object`, { value });
+  }
+}
 var init_assert = __esm({
   "src/shared/assert.ts"() {
     init_errors();
@@ -156,6 +162,8 @@ function normalizeDid(input) {
       return normalizeDidHandle(trimmed);
     case "key":
       return normalizeDidKey(trimmed);
+    case "jwk":
+      return normalizeDidJwk(trimmed);
     default:
       return trimmed;
   }
@@ -245,13 +253,226 @@ function extractAddressFromDid(identifier) {
   }
   throw new OmaTrustError("INVALID_DID", "Unsupported identifier format", { identifier });
 }
-var DID_REGEX;
+function validateDidJwk(did) {
+  const parts = did.split(":");
+  if (parts.length !== 3) {
+    return {
+      valid: false,
+      method: "jwk",
+      error: `did:jwk must have exactly 3 colon-separated parts, got ${parts.length}`
+    };
+  }
+  const [, , encoded] = parts;
+  if (!encoded || encoded.length === 0) {
+    return { valid: false, method: "jwk", error: "Missing base64url-encoded JWK identifier" };
+  }
+  if (!BASE64URL_REGEX.test(encoded)) {
+    return {
+      valid: false,
+      method: "jwk",
+      error: "Identifier contains invalid base64url characters"
+    };
+  }
+  let decoded;
+  try {
+    const bytes = jose.base64url.decode(encoded);
+    decoded = new TextDecoder().decode(bytes);
+  } catch {
+    return { valid: false, method: "jwk", error: "Failed to base64url-decode identifier" };
+  }
+  let jwk;
+  try {
+    jwk = JSON.parse(decoded);
+  } catch {
+    return { valid: false, method: "jwk", error: "Decoded identifier is not valid JSON" };
+  }
+  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
+    return { valid: false, method: "jwk", error: "Decoded JWK must be a JSON object" };
+  }
+  const kty = jwk.kty;
+  if (typeof kty !== "string" || !VALID_JWK_KTY.has(kty)) {
+    return {
+      valid: false,
+      method: "jwk",
+      error: `Invalid or missing kty field (must be one of: EC, OKP, RSA)`
+    };
+  }
+  if ("d" in jwk) {
+    return {
+      valid: false,
+      method: "jwk",
+      error: "DID must reference a public key \u2014 private key component (d) is not allowed"
+    };
+  }
+  return { valid: true, method: "jwk" };
+}
+function normalizeDidJwk(input) {
+  assertString(input, "input", "INVALID_DID");
+  const trimmed = input.trim();
+  if (!trimmed.startsWith("did:jwk:")) {
+    throw new OmaTrustError("INVALID_DID", "Expected did:jwk DID", { input });
+  }
+  const result = validateDidJwk(trimmed);
+  if (!result.valid) {
+    throw new OmaTrustError("INVALID_DID", result.error ?? "Invalid did:jwk", { input });
+  }
+  return trimmed;
+}
+var DID_REGEX, BASE64URL_REGEX, VALID_JWK_KTY;
 var init_did = __esm({
   "src/identity/did.ts"() {
     init_errors();
     init_assert();
     init_caip();
     DID_REGEX = /^did:[a-z0-9]+:.+$/i;
+    BASE64URL_REGEX = /^[A-Za-z0-9_-]+$/;
+    VALID_JWK_KTY = /* @__PURE__ */ new Set(["EC", "OKP", "RSA"]);
+  }
+});
+function validatePublicJwk(jwk) {
+  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
+    return { valid: false, error: "JWK must be a non-null object" };
+  }
+  const obj = jwk;
+  const kty = obj.kty;
+  if (typeof kty !== "string" || !VALID_KTY.has(kty)) {
+    return {
+      valid: false,
+      error: `Invalid or missing kty (must be one of: ${[...VALID_KTY].join(", ")})`
+    };
+  }
+  for (const field of PRIVATE_KEY_FIELDS) {
+    if (field in obj) {
+      return {
+        valid: false,
+        error: `JWK contains private key field "${field}" \u2014 only public keys are allowed`
+      };
+    }
+  }
+  const required = REQUIRED_PUBLIC_FIELDS[kty];
+  if (required) {
+    for (const field of required) {
+      if (!(field in obj) || obj[field] === void 0 || obj[field] === null || obj[field] === "") {
+        return {
+          valid: false,
+          error: `Missing required public key field "${field}" for kty="${kty}"`
+        };
+      }
+    }
+  }
+  return { valid: true };
+}
+function canonicalizeJwkJson(jwk) {
+  const sorted = Object.keys(jwk).sort();
+  const obj = {};
+  for (const key of sorted) {
+    obj[key] = jwk[key];
+  }
+  return JSON.stringify(obj);
+}
+function jwkToDidJwk(jwk) {
+  assertObject(jwk, "jwk", "INVALID_JWK");
+  const validation = validatePublicJwk(jwk);
+  if (!validation.valid) {
+    throw new OmaTrustError("INVALID_JWK", validation.error ?? "Invalid public JWK", { jwk });
+  }
+  const canonical = canonicalizeJwkJson(jwk);
+  const encoded = jose.base64url.encode(new TextEncoder().encode(canonical));
+  return `did:jwk:${encoded}`;
+}
+function didJwkToJwk(didJwk) {
+  if (typeof didJwk !== "string" || !didJwk.startsWith("did:jwk:")) {
+    throw new OmaTrustError("INVALID_DID", "Expected a did:jwk DID", { input: didJwk });
+  }
+  const parts = didJwk.split(":");
+  if (parts.length !== 3) {
+    throw new OmaTrustError("INVALID_DID", "did:jwk must have exactly 3 colon-separated parts", {
+      input: didJwk
+    });
+  }
+  const encoded = parts[2];
+  if (!encoded || encoded.length === 0) {
+    throw new OmaTrustError("INVALID_DID", "Missing base64url-encoded JWK identifier", {
+      input: didJwk
+    });
+  }
+  let decoded;
+  try {
+    const bytes = jose.base64url.decode(encoded);
+    decoded = new TextDecoder().decode(bytes);
+  } catch {
+    throw new OmaTrustError("INVALID_DID", "Failed to base64url-decode did:jwk identifier", {
+      input: didJwk
+    });
+  }
+  let jwk;
+  try {
+    jwk = JSON.parse(decoded);
+  } catch {
+    throw new OmaTrustError("INVALID_DID", "Decoded did:jwk identifier is not valid JSON", {
+      input: didJwk
+    });
+  }
+  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
+    throw new OmaTrustError("INVALID_DID", "Decoded did:jwk must be a JSON object", {
+      input: didJwk
+    });
+  }
+  const validation = validatePublicJwk(jwk);
+  if (!validation.valid) {
+    throw new OmaTrustError("INVALID_DID", validation.error ?? "Invalid public JWK in did:jwk", {
+      input: didJwk
+    });
+  }
+  return jwk;
+}
+function extractPublicKeyFields(jwk) {
+  const result = {};
+  const metadataFields = /* @__PURE__ */ new Set(["kid", "use", "key_ops", "alg", "ext"]);
+  for (const [key, value] of Object.entries(jwk)) {
+    if (PRIVATE_KEY_FIELDS.has(key)) continue;
+    if (metadataFields.has(key)) continue;
+    result[key] = value;
+  }
+  return result;
+}
+function publicJwkEquals(a, b) {
+  assertObject(a, "a", "INVALID_JWK");
+  assertObject(b, "b", "INVALID_JWK");
+  const aObj = a;
+  const bObj = b;
+  for (const field of PRIVATE_KEY_FIELDS) {
+    if (field in aObj) {
+      throw new OmaTrustError(
+        "INVALID_JWK",
+        `First JWK contains private key field "${field}"`,
+        { field }
+      );
+    }
+    if (field in bObj) {
+      throw new OmaTrustError(
+        "INVALID_JWK",
+        `Second JWK contains private key field "${field}"`,
+        { field }
+      );
+    }
+  }
+  const aPublic = extractPublicKeyFields(aObj);
+  const bPublic = extractPublicKeyFields(bObj);
+  return canonicalizeJwkJson(aPublic) === canonicalizeJwkJson(bPublic);
+}
+var VALID_KTY, PRIVATE_KEY_FIELDS, REQUIRED_PUBLIC_FIELDS;
+var init_jwk = __esm({
+  "src/identity/jwk.ts"() {
+    init_errors();
+    init_assert();
+    VALID_KTY = /* @__PURE__ */ new Set(["EC", "OKP", "RSA"]);
+    PRIVATE_KEY_FIELDS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth"]);
+    REQUIRED_PUBLIC_FIELDS = {
+      EC: ["crv", "x", "y"],
+      OKP: ["crv", "x"],
+      RSA: ["n", "e"]
+    };
   }
 });
 
@@ -262,21 +483,23 @@ function parseDnsTxtRecord(record) {
   }
   const entries = record.split(/[;\s]+/).map((entry) => entry.trim()).filter(Boolean);
   const parsed = {};
+  const controllers = [];
   for (const entry of entries) {
-    const [key, ...valueParts] = entry.split("=");
-    if (!key) {
-      continue;
-    }
-    const value = valueParts.join("=");
-    if (!value) {
-      continue;
+    const eqIndex = entry.indexOf("=");
+    if (eqIndex === -1) continue;
+    const key = entry.slice(0, eqIndex).trim();
+    const value = entry.slice(eqIndex + 1).trim();
+    if (!key || !value) continue;
+    if (key === "controller") {
+      controllers.push(value);
+    } else {
+      parsed[key] = value;
     }
-    parsed[key.trim()] = value.trim();
   }
   return {
     version: parsed.v,
-    controller: parsed.controller,
-    ...parsed
+    controller: controllers[0],
+    controllers
   };
 }
 function buildDnsTxtRecord(controllerDid) {
@@ -290,6 +513,56 @@ var init_dns_txt_record = __esm({
   }
 });
 
+// src/identity/controller-id.ts
+function isSameControllerId(a, b) {
+  let normalizedA = null;
+  let normalizedB = null;
+  try {
+    normalizedA = normalizeDid(a);
+  } catch {
+  }
+  try {
+    normalizedB = normalizeDid(b);
+  } catch {
+  }
+  if (normalizedA && normalizedB && normalizedA === normalizedB) {
+    return true;
+  }
+  const evmA = extractControllerEvmAddress(a);
+  const evmB = extractControllerEvmAddress(b);
+  if (evmA && evmB && evmA.toLowerCase() === evmB.toLowerCase()) {
+    return true;
+  }
+  const methodA = extractDidMethod(a);
+  const methodB = extractDidMethod(b);
+  if (methodA === "jwk" && methodB === "jwk") {
+    try {
+      const jwkA = didJwkToJwk(a);
+      const jwkB = didJwkToJwk(b);
+      return publicJwkEquals(jwkA, jwkB);
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+function extractControllerEvmAddress(controllerDid) {
+  try {
+    const method = extractDidMethod(controllerDid);
+    if (method === "pkh" && controllerDid.includes("eip155")) {
+      return extractAddressFromDid(controllerDid);
+    }
+  } catch {
+  }
+  return null;
+}
+var init_controller_id = __esm({
+  "src/identity/controller-id.ts"() {
+    init_did();
+    init_jwk();
+  }
+});
+
 // src/reputation/proof/dns-txt-shared.ts
 var dns_txt_shared_exports = {};
 __export(dns_txt_shared_exports, {
@@ -302,7 +575,6 @@ async function verifyDnsTxtControllerDid(domain, expectedControllerDid, options
   if (!options.resolveTxt) {
     throw new OmaTrustError("NETWORK_ERROR", "No DNS TXT resolver was provided", { domain });
   }
-  const expected = normalizeDid(expectedControllerDid);
   const prefix = options.recordPrefix ?? "_controllers";
   const host = `${prefix}.${domain.toLowerCase().replace(/\.$/, "")}`;
   let records;
@@ -314,15 +586,18 @@ async function verifyDnsTxtControllerDid(domain, expectedControllerDid, options
   for (const recordParts of records) {
     const record = recordParts.join("");
     const parsed = parseDnsTxtRecord(record);
-    if (parsed.version === "1" && parsed.controller && normalizeDid(parsed.controller) === expected) {
-      return { valid: true, record };
+    if (parsed.version !== "1") continue;
+    for (const recordController of parsed.controllers) {
+      if (isSameControllerId(recordController, expectedControllerDid)) {
+        return { valid: true, record };
+      }
     }
   }
-  return { valid: false, reason: "No TXT record matched expected controller DID" };
+  return { valid: false, reason: "Controller DID not found in DNS TXT records" };
 }
 var init_dns_txt_shared = __esm({
   "src/reputation/proof/dns-txt-shared.ts"() {
-    init_did();
+    init_controller_id();
     init_errors();
     init_dns_txt_record();
   }
@@ -793,19 +1068,32 @@ async function submitDelegatedAttestation(params) {
     payload = {};
   }
   if (!response.ok) {
-    throw new OmaTrustError("NETWORK_ERROR", "Relay submission failed", {
-      status: response.status,
+    const relayError = {
+      httpStatus: response.status,
+      code: payload.code,
+      error: payload.error ?? payload.message,
       payload
-    });
+    };
+    throw new OmaTrustError("RELAY_ERROR", `Relay submission failed (HTTP ${response.status})`, relayError);
   }
   const uid = payload.uid ?? ZERO_UID;
   const txHash = payload.txHash;
-  const status = payload.status ?? "submitted";
-  return {
-    uid,
-    txHash,
-    status
-  };
+  const hasConfirmationSignals = payload.status === "confirmed" || payload.success === true || typeof payload.blockNumber === "number";
+  const status = hasConfirmationSignals ? "confirmed" : "submitted";
+  const relay = {};
+  if (typeof payload.blockNumber === "number") relay.blockNumber = payload.blockNumber;
+  if (typeof payload.chain === "string") relay.chain = payload.chain;
+  if (typeof payload.success === "boolean") relay.success = payload.success;
+  for (const key of Object.keys(payload)) {
+    if (!["uid", "txHash", "status", "blockNumber", "chain", "success"].includes(key)) {
+      relay[key] = payload[key];
+    }
+  }
+  const result = { uid, txHash, status };
+  if (Object.keys(relay).length > 0) {
+    result.relay = relay;
+  }
+  return result;
 }
 
 // src/reputation/query.ts
@@ -911,7 +1199,7 @@ async function getAttestationsForDid(params) {
     provider,
     fromBlock,
     toBlock,
-    { recipient: didToAddress(params.did), schemas: params.schemas }
+    { recipient: didToAddress(params.subjectDid), schemas: params.schemas }
   );
 }
 async function getAttestationsByAttester(params) {
@@ -1163,6 +1451,10 @@ function getExplorerAddressUrl(chainId, address) {
 
 // src/reputation/proof/did-json.ts
 init_did();
+init_jwk();
+init_errors();
+
+// src/shared/did-document.ts
 init_errors();
 async function fetchDidDocument(domain) {
   const normalized = domain.toLowerCase().replace(/\.$/, "");
@@ -1174,15 +1466,16 @@ async function fetchDidDocument(domain) {
     throw new OmaTrustError("NETWORK_ERROR", "Failed to fetch DID document", { domain, err });
   }
   if (!response.ok) {
-    throw new OmaTrustError("NETWORK_ERROR", "DID document fetch failed", {
+    throw new OmaTrustError("NETWORK_ERROR", `DID document fetch failed: ${response.status}`, {
       domain,
       status: response.status
     });
   }
-  const body = await response.json();
-  return body;
+  return await response.json();
 }
-function extractAddressesFromDidDocument(didDocument) {
+
+// src/reputation/proof/did-json.ts
+function extractEvmAddressesFromDidDocument(didDocument) {
   const methods = didDocument.verificationMethod;
   if (!Array.isArray(methods)) {
     return [];
@@ -1206,14 +1499,52 @@ function extractAddressesFromDidDocument(didDocument) {
   }
   return [...addresses];
 }
+function extractJwksFromDidDocument(didDocument) {
+  const methods = didDocument.verificationMethod;
+  if (!Array.isArray(methods)) {
+    return [];
+  }
+  const jwks = [];
+  for (const method of methods) {
+    const publicKeyJwk = method.publicKeyJwk;
+    if (publicKeyJwk && typeof publicKeyJwk === "object" && !Array.isArray(publicKeyJwk)) {
+      jwks.push(publicKeyJwk);
+    }
+  }
+  return jwks;
+}
 function verifyDidDocumentControllerDid(didDocument, expectedControllerDid) {
+  const method = extractDidMethod(expectedControllerDid);
+  if (method === "jwk") {
+    try {
+      const expectedJwk = didJwkToJwk(expectedControllerDid);
+      const documentJwks = extractJwksFromDidDocument(didDocument);
+      for (const docJwk of documentJwks) {
+        try {
+          if (publicJwkEquals(docJwk, expectedJwk)) {
+            return { valid: true };
+          }
+        } catch {
+        }
+      }
+      return {
+        valid: false,
+        reason: "No matching publicKeyJwk found in DID document verification methods"
+      };
+    } catch {
+      return {
+        valid: false,
+        reason: "Failed to decode did:jwk controller DID"
+      };
+    }
+  }
   let expectedAddress;
   try {
     expectedAddress = ethers.getAddress(extractAddressFromDid(expectedControllerDid));
   } catch {
-    return { valid: false, reason: "Expected controller DID does not resolve to an EVM address" };
+    return { valid: false, reason: "Controller DID does not resolve to an EVM address and is not did:jwk" };
   }
-  const addresses = extractAddressesFromDidDocument(didDocument);
+  const addresses = extractEvmAddressesFromDidDocument(didDocument);
   if (addresses.some((address) => address.toLowerCase() === expectedAddress.toLowerCase())) {
     return { valid: true };
   }
@@ -1267,6 +1598,469 @@ function verifyEip712Signature(typedData, signature) {
 
 // src/reputation/verify.ts
 init_dns_txt_record();
+
+// src/reputation/proof/x402-jws.ts
+init_errors();
+init_jwk();
+
+// src/identity/resolve-key.ts
+init_errors();
+init_assert();
+
+// src/identity/did-url.ts
+init_errors();
+init_assert();
+var DID_URL_REGEX = /^did:[a-z0-9]+:.+$/i;
+function parseDidUrl(input) {
+  assertString(input, "input", "INVALID_DID_URL");
+  const trimmed = input.trim();
+  const hashIndex = trimmed.indexOf("#");
+  let did;
+  let fragment;
+  if (hashIndex === -1) {
+    did = trimmed;
+    fragment = null;
+  } else {
+    did = trimmed.slice(0, hashIndex);
+    const rawFragment = trimmed.slice(hashIndex + 1);
+    if (rawFragment.length === 0) {
+      throw new OmaTrustError(
+        "INVALID_DID_URL",
+        "DID URL has empty fragment (trailing '#' with no identifier)",
+        { input }
+      );
+    }
+    fragment = rawFragment;
+  }
+  if (!DID_URL_REGEX.test(did)) {
+    throw new OmaTrustError(
+      "INVALID_DID_URL",
+      "Invalid DID URL: base DID portion is malformed",
+      { input, did }
+    );
+  }
+  return {
+    didUrl: trimmed,
+    did,
+    fragment
+  };
+}
+
+// src/identity/resolve-key.ts
+init_did();
+init_jwk();
+function findVerificationMethod(didDocument, didUrl, fragment) {
+  const methods = didDocument.verificationMethod;
+  if (!Array.isArray(methods)) {
+    return null;
+  }
+  for (const method of methods) {
+    if (!method || typeof method !== "object") continue;
+    const id = method.id;
+    if (typeof id !== "string") continue;
+    if (id === didUrl) return method;
+    if (fragment && (id === `#${fragment}` || id.endsWith(`#${fragment}`))) {
+      return method;
+    }
+  }
+  return null;
+}
+function extractMethodIdsFromDidDocument(didDocument) {
+  const methods = didDocument.verificationMethod;
+  if (!Array.isArray(methods)) return [];
+  return methods.filter((m) => m && typeof m.id === "string").map((m) => m.id);
+}
+async function resolveDidUrlToPublicKey(didUrl, options) {
+  assertString(didUrl, "didUrl", "INVALID_DID_URL");
+  const parsed = parseDidUrl(didUrl);
+  const method = extractDidMethod(parsed.did);
+  if (!method) {
+    throw new OmaTrustError("INVALID_DID_URL", "Cannot extract DID method from DID URL", {
+      didUrl,
+      did: parsed.did
+    });
+  }
+  switch (method) {
+    case "web":
+      return resolveDidUrlKey(parsed.didUrl, parsed.did, parsed.fragment);
+    default:
+      throw new OmaTrustError(
+        "UNSUPPORTED_DID_METHOD",
+        `DID URL key resolution is not supported for method "${method}"`,
+        { didUrl, method }
+      );
+  }
+}
+async function resolveDidUrlKey(didUrl, did, fragment, options) {
+  const domain = getDomainFromDidWeb(did);
+  if (!domain) {
+    throw new OmaTrustError("INVALID_DID_URL", "Cannot extract domain from did:web DID", {
+      didUrl,
+      did
+    });
+  }
+  const fetchFn = fetchDidDocument;
+  const didDocument = await fetchFn(domain);
+  const method = findVerificationMethod(didDocument, didUrl, fragment);
+  if (!method) {
+    throw new OmaTrustError(
+      "KEY_NOT_FOUND",
+      `No verification method found matching "${fragment ? `#${fragment}` : didUrl}"`,
+      { didUrl, fragment, availableMethods: extractMethodIdsFromDidDocument(didDocument) }
+    );
+  }
+  const publicKeyJwk = method.publicKeyJwk;
+  if (!publicKeyJwk || typeof publicKeyJwk !== "object") {
+    throw new OmaTrustError(
+      "KEY_NOT_FOUND",
+      `Verification method "${method.id}" does not contain publicKeyJwk`,
+      { didUrl, verificationMethodId: method.id }
+    );
+  }
+  const validation = validatePublicJwk(publicKeyJwk);
+  if (!validation.valid) {
+    throw new OmaTrustError(
+      "INVALID_JWK",
+      `publicKeyJwk in verification method "${method.id}" is invalid: ${validation.error}`,
+      { didUrl, verificationMethodId: method.id }
+    );
+  }
+  return {
+    didUrl,
+    did,
+    fragment,
+    publicKeyJwk,
+    verificationMethodId: method.id
+  };
+}
+
+// src/reputation/proof/x402-jws.ts
+var REQUIRED_OFFER_FIELDS = [
+  "version",
+  "resourceUrl",
+  "scheme",
+  "network",
+  "asset",
+  "payTo",
+  "amount"
+];
+var REQUIRED_RECEIPT_FIELDS = [
+  "version",
+  "network",
+  "resourceUrl",
+  "payer",
+  "issuedAt"
+];
+function validateOfferPayload(payload) {
+  for (const field of REQUIRED_OFFER_FIELDS) {
+    if (!(field in payload) || payload[field] === void 0 || payload[field] === null) {
+      return { valid: false, field };
+    }
+  }
+  return { valid: true };
+}
+function validateReceiptPayload(payload) {
+  for (const field of REQUIRED_RECEIPT_FIELDS) {
+    if (!(field in payload) || payload[field] === void 0 || payload[field] === null) {
+      return { valid: false, field };
+    }
+  }
+  return { valid: true };
+}
+function failure(code, message, partial) {
+  return {
+    valid: false,
+    error: { code, message },
+    ...partial
+  };
+}
+async function verifyX402JwsArtifact(artifact, options) {
+  if (!artifact || typeof artifact !== "object") {
+    return failure("INVALID_ARTIFACT", "Artifact must be a non-null object");
+  }
+  if (artifact.format !== "jws") {
+    return failure("INVALID_ARTIFACT", `Expected format "jws", got "${artifact.format}"`);
+  }
+  if (typeof artifact.signature !== "string" || artifact.signature.length === 0) {
+    return failure("INVALID_ARTIFACT", "Artifact signature must be a non-empty string");
+  }
+  const compactJws = artifact.signature;
+  const parts = compactJws.split(".");
+  if (parts.length !== 3) {
+    return failure("MALFORMED_JWS", "Invalid compact JWS format: expected 3 dot-separated parts");
+  }
+  let header;
+  try {
+    header = jose.decodeProtectedHeader(compactJws);
+  } catch {
+    return failure("MALFORMED_JWS", "Failed to decode JWS protected header");
+  }
+  if (!header.alg || typeof header.alg !== "string") {
+    return failure("MISSING_ALG", "JWS header must include alg", { header });
+  }
+  const kid = typeof header.kid === "string" ? header.kid : null;
+  const embeddedJwk = header.jwk;
+  if (!kid && !embeddedJwk) {
+    return failure(
+      "MISSING_KEY_MATERIAL",
+      "JWS header must include at least one of kid or jwk",
+      { header }
+    );
+  }
+  let publicKeyJwk;
+  let publicKeySource;
+  if (embeddedJwk) {
+    const validation = validatePublicJwk(embeddedJwk);
+    if (!validation.valid) {
+      return failure(
+        "INVALID_EMBEDDED_JWK",
+        `Embedded JWK is invalid: ${validation.error}`,
+        { header }
+      );
+    }
+    publicKeyJwk = embeddedJwk;
+    publicKeySource = "embedded-jwk";
+    if (kid) {
+      try {
+        const resolved = await resolveDidUrlToPublicKey(kid, options?.resolveOptions);
+        if (!publicJwkEquals(publicKeyJwk, resolved.publicKeyJwk)) {
+          return failure(
+            "KEY_CONFLICT",
+            "Embedded jwk conflicts with public key resolved from kid",
+            { header, kid }
+          );
+        }
+      } catch (err) {
+      }
+    }
+  } else {
+    publicKeySource = "kid-resolution";
+    try {
+      const resolved = await resolveDidUrlToPublicKey(kid, options?.resolveOptions);
+      publicKeyJwk = resolved.publicKeyJwk;
+    } catch (err) {
+      const message = err instanceof OmaTrustError ? `Failed to resolve kid "${kid}": ${err.message}` : `Failed to resolve kid "${kid}"`;
+      return failure("KID_RESOLUTION_FAILED", message, { header, kid });
+    }
+  }
+  let payload;
+  try {
+    const key = await jose.importJWK(publicKeyJwk, header.alg);
+    const result = await jose.compactVerify(compactJws, key);
+    const payloadText = new TextDecoder().decode(result.payload);
+    payload = JSON.parse(payloadText);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "Signature verification failed";
+    return failure("SIGNATURE_INVALID", message, { header, kid });
+  }
+  const publicKeyDid = jwkToDidJwk(publicKeyJwk);
+  return {
+    valid: true,
+    header,
+    payload,
+    kid,
+    publicKeyJwk,
+    publicKeySource,
+    publicKeyDid
+  };
+}
+async function verifyX402JwsOffer(artifact, options) {
+  const result = await verifyX402JwsArtifact(artifact, options);
+  if (!result.valid) return result;
+  const payloadCheck = validateOfferPayload(result.payload);
+  if (!payloadCheck.valid) {
+    return failure(
+      "INVALID_OFFER_PAYLOAD",
+      `Missing required offer field: ${payloadCheck.field}`,
+      {
+        header: result.header,
+        payload: result.payload,
+        kid: result.kid,
+        publicKeyJwk: result.publicKeyJwk,
+        publicKeySource: result.publicKeySource,
+        publicKeyDid: result.publicKeyDid
+      }
+    );
+  }
+  return result;
+}
+async function verifyX402JwsReceipt(artifact, options) {
+  const result = await verifyX402JwsArtifact(artifact, options);
+  if (!result.valid) return result;
+  const payloadCheck = validateReceiptPayload(result.payload);
+  if (!payloadCheck.valid) {
+    return failure(
+      "INVALID_RECEIPT_PAYLOAD",
+      `Missing required receipt field: ${payloadCheck.field}`,
+      {
+        header: result.header,
+        payload: result.payload,
+        kid: result.kid,
+        publicKeyJwk: result.publicKeyJwk,
+        publicKeySource: result.publicKeySource,
+        publicKeyDid: result.publicKeyDid
+      }
+    );
+  }
+  return result;
+}
+var OFFER_DOMAIN = {
+  name: "x402 offer",
+  version: "1",
+  chainId: 1
+};
+var RECEIPT_DOMAIN = {
+  name: "x402 receipt",
+  version: "1",
+  chainId: 1
+};
+var OFFER_TYPES = {
+  Offer: [
+    { name: "version", type: "uint256" },
+    { name: "resourceUrl", type: "string" },
+    { name: "scheme", type: "string" },
+    { name: "network", type: "string" },
+    { name: "asset", type: "string" },
+    { name: "payTo", type: "string" },
+    { name: "amount", type: "string" },
+    { name: "validUntil", type: "uint256" }
+  ]
+};
+var RECEIPT_TYPES = {
+  Receipt: [
+    { name: "version", type: "uint256" },
+    { name: "network", type: "string" },
+    { name: "resourceUrl", type: "string" },
+    { name: "payer", type: "string" },
+    { name: "issuedAt", type: "uint256" },
+    { name: "transaction", type: "string" }
+  ]
+};
+var REQUIRED_OFFER_FIELDS2 = [
+  "version",
+  "resourceUrl",
+  "scheme",
+  "network",
+  "asset",
+  "payTo",
+  "amount"
+];
+var REQUIRED_RECEIPT_FIELDS2 = [
+  "version",
+  "network",
+  "resourceUrl",
+  "payer",
+  "issuedAt"
+];
+function validateOfferPayload2(payload) {
+  for (const field of REQUIRED_OFFER_FIELDS2) {
+    if (!(field in payload) || payload[field] === void 0 || payload[field] === null) {
+      return { valid: false, field };
+    }
+  }
+  return { valid: true };
+}
+function validateReceiptPayload2(payload) {
+  for (const field of REQUIRED_RECEIPT_FIELDS2) {
+    if (!(field in payload) || payload[field] === void 0 || payload[field] === null) {
+      return { valid: false, field };
+    }
+  }
+  return { valid: true };
+}
+function failure2(code, message, partial) {
+  return {
+    valid: false,
+    error: { code, message },
+    ...partial
+  };
+}
+function prepareOfferMessage(payload) {
+  return {
+    version: payload.version,
+    resourceUrl: payload.resourceUrl,
+    scheme: payload.scheme,
+    network: payload.network,
+    asset: payload.asset,
+    payTo: payload.payTo,
+    amount: payload.amount,
+    validUntil: payload.validUntil ?? 0
+  };
+}
+function prepareReceiptMessage(payload) {
+  return {
+    version: payload.version,
+    network: payload.network,
+    resourceUrl: payload.resourceUrl,
+    payer: payload.payer,
+    issuedAt: payload.issuedAt,
+    transaction: payload.transaction ?? ""
+  };
+}
+function verifyX402Eip712Artifact(artifact, artifactType) {
+  if (!artifact || typeof artifact !== "object") {
+    return failure2("INVALID_ARTIFACT", "Artifact must be a non-null object");
+  }
+  if (artifact.format !== "eip712") {
+    return failure2("INVALID_ARTIFACT", `Expected format "eip712", got "${artifact.format}"`);
+  }
+  if (!artifact.payload || typeof artifact.payload !== "object" || Array.isArray(artifact.payload)) {
+    return failure2("MISSING_PAYLOAD", "EIP-712 artifact must include a payload object");
+  }
+  if (typeof artifact.signature !== "string" || artifact.signature.length === 0) {
+    return failure2("MISSING_SIGNATURE", "EIP-712 artifact must include a non-empty signature");
+  }
+  const payload = artifact.payload;
+  if (artifactType === "offer") {
+    const check = validateOfferPayload2(payload);
+    if (!check.valid) {
+      return failure2(
+        "INVALID_OFFER_PAYLOAD",
+        `Missing required offer field: ${check.field}`,
+        { payload }
+      );
+    }
+  } else {
+    const check = validateReceiptPayload2(payload);
+    if (!check.valid) {
+      return failure2(
+        "INVALID_RECEIPT_PAYLOAD",
+        `Missing required receipt field: ${check.field}`,
+        { payload }
+      );
+    }
+  }
+  const domain = artifactType === "offer" ? OFFER_DOMAIN : RECEIPT_DOMAIN;
+  const types = artifactType === "offer" ? OFFER_TYPES : RECEIPT_TYPES;
+  const message = artifactType === "offer" ? prepareOfferMessage(payload) : prepareReceiptMessage(payload);
+  let signer;
+  try {
+    signer = ethers.verifyTypedData(
+      domain,
+      types,
+      message,
+      artifact.signature
+    );
+    signer = ethers.getAddress(signer);
+  } catch (err) {
+    const message2 = err instanceof Error ? err.message : "EIP-712 signature verification failed";
+    return failure2("SIGNATURE_INVALID", message2, { payload });
+  }
+  return {
+    valid: true,
+    payload,
+    signer,
+    artifactType
+  };
+}
+function verifyX402Eip712Offer(artifact) {
+  return verifyX402Eip712Artifact(artifact, "offer");
+}
+function verifyX402Eip712Receipt(artifact) {
+  return verifyX402Eip712Artifact(artifact, "receipt");
+}
+
+// src/reputation/verify.ts
 function parseChainId(input) {
   if (typeof input === "number") {
     return input;
@@ -1323,18 +2117,18 @@ function decodeJwtPayload(compactJws) {
   return JSON.parse(json);
 }
 async function verifyProof(params) {
-  const { proof, provider, expectedSubject, expectedController } = params;
+  const { proof, provider, expectedSubjectDid, expectedControllerDid } = params;
   try {
     switch (proof.proofType) {
       case "tx-encoded-value": {
         if (!provider) {
           return { valid: false, proofType: proof.proofType, reason: "Provider is required" };
         }
-        if (!expectedSubject || !expectedController) {
+        if (!expectedSubjectDid || !expectedControllerDid) {
           return {
             valid: false,
             proofType: proof.proofType,
-            reason: "expectedSubject and expectedController are required"
+            reason: "expectedSubjectDid and expectedControllerDid are required"
           };
         }
         const proofObject = proof.proofObject;
@@ -1346,13 +2140,13 @@ async function verifyProof(params) {
           return { valid: false, proofType: proof.proofType, reason: "Transaction not found" };
         }
         const expectedAmount = calculateTransferAmount(
-          expectedSubject,
-          expectedController,
+          expectedSubjectDid,
+          expectedControllerDid,
           chainId,
           getProofPurpose(proof)
         );
-        const subjectAddress = ethers.getAddress(extractAddressFromDid(expectedSubject));
-        const controllerAddress = ethers.getAddress(extractAddressFromDid(expectedController));
+        const subjectAddress = ethers.getAddress(extractAddressFromDid(expectedSubjectDid));
+        const controllerAddress = ethers.getAddress(extractAddressFromDid(expectedControllerDid));
         if (tx.from && ethers.getAddress(tx.from) !== subjectAddress) {
           return { valid: false, proofType: proof.proofType, reason: "Transaction sender mismatch" };
         }
@@ -1426,6 +2220,38 @@ async function verifyProof(params) {
         if (!proof.proofObject || typeof proof.proofObject !== "object") {
           return { valid: false, proofType: proof.proofType, reason: "Invalid x402 proof object" };
         }
+        const proofObj = proof.proofObject;
+        if (proofObj.format === "jws" && typeof proofObj.signature === "string") {
+          const artifact = {
+            format: "jws",
+            signature: proofObj.signature
+          };
+          const jwsResult = proof.proofType === "x402-offer" ? await verifyX402JwsOffer(artifact) : await verifyX402JwsReceipt(artifact);
+          if (!jwsResult.valid) {
+            return {
+              valid: false,
+              proofType: proof.proofType,
+              reason: jwsResult.error?.message ?? "JWS verification failed"
+            };
+          }
+          return { valid: true, proofType: proof.proofType };
+        }
+        if (proofObj.format === "eip712" && typeof proofObj.signature === "string" && proofObj.payload && typeof proofObj.payload === "object") {
+          const artifact = {
+            format: "eip712",
+            payload: proofObj.payload,
+            signature: proofObj.signature
+          };
+          const eip712Result = proof.proofType === "x402-offer" ? verifyX402Eip712Offer(artifact) : verifyX402Eip712Receipt(artifact);
+          if (!eip712Result.valid) {
+            return {
+              valid: false,
+              proofType: proof.proofType,
+              reason: eip712Result.error?.message ?? "EIP-712 verification failed"
+            };
+          }
+          return { valid: true, proofType: proof.proofType };
+        }
         return { valid: true, proofType: proof.proofType };
       }
       case "evidence-pointer": {
@@ -1437,9 +2263,9 @@ async function verifyProof(params) {
         if (!response.ok) {
           return { valid: false, proofType: proof.proofType, reason: `Evidence fetch failed (${response.status})` };
         }
-        if (object.url.endsWith("/.well-known/did.json") && expectedController) {
+        if (object.url.endsWith("/.well-known/did.json") && expectedControllerDid) {
           const didDoc = await response.json();
-          const didCheck = verifyDidDocumentControllerDid(didDoc, expectedController);
+          const didCheck = verifyDidDocumentControllerDid(didDoc, expectedControllerDid);
           return {
             valid: didCheck.valid,
             proofType: proof.proofType,
@@ -1447,10 +2273,10 @@ async function verifyProof(params) {
           };
         }
         const body = await response.text();
-        if (expectedController && !body.includes(expectedController)) {
+        if (expectedControllerDid && !body.includes(expectedControllerDid)) {
           try {
             const parsed = parseDnsTxtRecord(body);
-            if (parsed.controller !== expectedController) {
+            if (!parsed.controllers.includes(expectedControllerDid)) {
               return {
                 valid: false,
                 proofType: proof.proofType,
@@ -1506,8 +2332,8 @@ async function verifyAttestation(params) {
     const result = await verifyProof({
       proof,
       provider: params.provider,
-      expectedSubject: params.context?.subject,
-      expectedController: params.context?.controller
+      expectedSubjectDid: params.context?.subjectDid,
+      expectedControllerDid: params.context?.controllerDid
     });
     checks[proof.proofType] = result.valid;
     if (!result.valid) {
@@ -1612,6 +2438,38 @@ async function callControllerWitness(params) {
     method: "did-json"
   };
 }
+var DEFAULT_CONTROLLER_WITNESS_URL = "https://api.omatrust.org/v1/controller-witness";
+async function requestControllerWitness(params) {
+  const url = params.gatewayUrl ?? DEFAULT_CONTROLLER_WITNESS_URL;
+  const body = {
+    subjectDid: params.subjectDid,
+    controllerDid: params.controllerDid
+  };
+  if (params.chainId !== void 0) {
+    body.chainId = params.chainId;
+  }
+  let response;
+  try {
+    response = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      credentials: "include",
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(params.timeoutMs ?? 15e3)
+    });
+  } catch (err) {
+    throw new OmaTrustError("NETWORK_ERROR", "Controller witness request failed", { err });
+  }
+  if (!response.ok) {
+    const errorBody = await response.json().catch(() => ({ error: response.statusText }));
+    throw new OmaTrustError(
+      "API_ERROR",
+      errorBody.error ?? `Controller witness failed: ${response.status}`,
+      { status: response.status, ...errorBody }
+    );
+  }
+  return await response.json();
+}
 
 // src/reputation/proof/tx-interaction.ts
 init_errors();
@@ -1758,29 +2616,20 @@ async function verifyDnsTxtControllerDid2(domain, expectedControllerDid, options
   );
 }
 
-// src/reputation/proof/subject-ownership.ts
+// src/reputation/subject-ownership.ts
 init_did();
 init_errors();
 init_dns_txt_shared();
+
+// src/reputation/contract-ownership.ts
+init_did();
 var EIP1967_ADMIN_SLOT = "0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103";
 var OWNERSHIP_PATTERNS = [
   { method: "owner", signature: "function owner() view returns (address)" },
   { method: "admin", signature: "function admin() view returns (address)" },
   { method: "getOwner", signature: "function getOwner() view returns (address)" }
 ];
-function assertConnectedWalletDid(input) {
-  const normalized = normalizeDid(input);
-  if (extractDidMethod(normalized) !== "pkh") {
-    throw new OmaTrustError("INVALID_INPUT", "connectedWalletDid must be a did:pkh DID", {
-      connectedWalletDid: input
-    });
-  }
-  return normalized;
-}
-function normalizeSubjectDid(input) {
-  return normalizeDid(input);
-}
-async function readAddressFromContract(provider, contractAddress, signature, method) {
+async function readOwnerFromContract(provider, contractAddress, signature, method) {
   try {
     const iface = new ethers.Interface([signature]);
     const data = iface.encodeFunctionData(method, []);
@@ -1793,16 +2642,24 @@ async function readAddressFromContract(provider, contractAddress, signature, met
   }
   return null;
 }
-async function discoverControllingWallet(provider, contractAddress, chainId) {
+async function discoverContractOwner(provider, contractAddress) {
+  try {
+    const code = await provider.getCode(contractAddress);
+    if (code === "0x" || code === "0x0") {
+      return null;
+    }
+  } catch {
+    return null;
+  }
   for (const pattern of OWNERSHIP_PATTERNS) {
-    const address = await readAddressFromContract(
+    const address = await readOwnerFromContract(
       provider,
       contractAddress,
       pattern.signature,
       pattern.method
     );
     if (address) {
-      return buildEvmDidPkh(chainId, address);
+      return address;
     }
   }
   try {
@@ -1810,13 +2667,31 @@ async function discoverControllingWallet(provider, contractAddress, chainId) {
     if (adminValue && adminValue !== "0x" && adminValue !== "0x0000000000000000000000000000000000000000000000000000000000000000") {
       const adminAddress = ethers.getAddress(`0x${adminValue.slice(-40)}`);
       if (adminAddress !== ethers.ZeroAddress) {
-        return buildEvmDidPkh(chainId, adminAddress);
+        return adminAddress;
       }
     }
   } catch {
   }
   return null;
 }
+async function discoverControllingWalletDid(provider, contractAddress, chainId) {
+  const owner = await discoverContractOwner(provider, contractAddress);
+  return owner ? buildEvmDidPkh(chainId, owner) : null;
+}
+
+// src/reputation/subject-ownership.ts
+function assertConnectedWalletDid(input) {
+  const normalized = normalizeDid(input);
+  if (extractDidMethod(normalized) !== "pkh") {
+    throw new OmaTrustError("INVALID_INPUT", "connectedWalletDid must be a did:pkh DID", {
+      connectedWalletDid: input
+    });
+  }
+  return normalized;
+}
+function normalizeSubjectDid(input) {
+  return normalizeDid(input);
+}
 async function verifyDidWebOwnership(params) {
   const subjectDid = normalizeSubjectDid(params.subjectDid);
   const connectedWalletDid = assertConnectedWalletDid(params.connectedWalletDid);
@@ -1914,7 +2789,7 @@ async function verifyDidPkhOwnership(params) {
       connectedWalletDid
     };
   }
-  const controllingWalletDid = await discoverControllingWallet(params.provider, subjectAddress, chainId);
+  const controllingWalletDid = await discoverControllingWalletDid(params.provider, subjectAddress, chainId);
   if (params.txHash) {
     if (!controllingWalletDid) {
       return {
@@ -1997,7 +2872,7 @@ async function verifyDidPkhOwnership(params) {
     };
   }
   for (const pattern of OWNERSHIP_PATTERNS) {
-    const ownerAddress = await readAddressFromContract(
+    const ownerAddress = await readOwnerFromContract(
       params.provider,
       subjectAddress,
       pattern.signature,
@@ -2091,8 +2966,9 @@ exports.createX402ReceiptProof = createX402ReceiptProof;
 exports.decodeAttestationData = decodeAttestationData;
 exports.deduplicateReviews = deduplicateReviews;
 exports.encodeAttestationData = encodeAttestationData;
-exports.extractAddressesFromDidDocument = extractAddressesFromDidDocument;
+exports.extractEvmAddressesFromDidDocument = extractEvmAddressesFromDidDocument;
 exports.extractExpirationTime = extractExpirationTime;
+exports.extractJwksFromDidDocument = extractJwksFromDidDocument;
 exports.fetchDidDocument = fetchDidDocument;
 exports.formatSchemaUid = formatSchemaUid;
 exports.formatTransferAmount = formatTransferAmount;
@@ -2113,6 +2989,7 @@ exports.listAttestations = listAttestations;
 exports.normalizeSchema = normalizeSchema;
 exports.parseDnsTxtRecord = parseDnsTxtRecord;
 exports.prepareDelegatedAttestation = prepareDelegatedAttestation;
+exports.requestControllerWitness = requestControllerWitness;
 exports.revokeAttestation = revokeAttestation;
 exports.schemaToString = schemaToString;
 exports.splitSignature = splitSignature;