@oma3/omatrust 0.1.0-alpha.10 → 0.1.0-alpha.12

package/dist/index.js

@@ -1,5 +1,11 @@
-import { keccak256, toUtf8Bytes, isAddress, getAddress, sha256, ZeroAddress, Signature, formatUnits, verifyTypedData, hexlify, randomBytes, id, Contract, Interface } from 'ethers';
+import { keccak256, toUtf8Bytes, isAddress, getAddress, sha256, ZeroAddress, Signature, formatUnits, verifyTypedData, Interface, Contract, hexlify, randomBytes, id } from 'ethers';
+import { base64url, calculateJwkThumbprint, decodeProtectedHeader, importJWK, compactVerify } from 'jose';
 import canonicalize from 'canonicalize';
+import { CID } from 'multiformats/cid';
+import { sha256 as sha256$1 } from 'multiformats/hashes/sha2';
+import * as raw from 'multiformats/codecs/raw';
+import { base32 } from 'multiformats/bases/base32';
+import { base58btc } from 'multiformats/bases/base58';
 import { SchemaEncoder, EAS } from '@ethereum-attestation-service/eas-sdk';
 import { resolveTxt } from 'dns/promises';
 
@@ -13,31 +19,31 @@ var __export = (target, all) => {
 var OmaTrustError = class extends Error {
   code;
   details;
-  constructor(code, message, details) {
+  constructor(code2, message, details) {
     super(message);
     this.name = "OmaTrustError";
-    this.code = code;
+    this.code = code2;
     this.details = details;
   }
 };
-function toOmaTrustError(code, message, details) {
-  return new OmaTrustError(code, message, details);
+function toOmaTrustError(code2, message, details) {
+  return new OmaTrustError(code2, message, details);
 }
 
 // src/shared/assert.ts
-function assertString(value, name, code = "INVALID_INPUT") {
+function assertString(value, name, code2 = "INVALID_INPUT") {
   if (typeof value !== "string" || value.trim().length === 0) {
-    throw new OmaTrustError(code, `${name} must be a non-empty string`, { value });
+    throw new OmaTrustError(code2, `${name} must be a non-empty string`, { value });
   }
 }
-function assertNumber(value, name, code = "INVALID_INPUT") {
+function assertNumber(value, name, code2 = "INVALID_INPUT") {
   if (typeof value !== "number" || Number.isNaN(value)) {
-    throw new OmaTrustError(code, `${name} must be a valid number`, { value });
+    throw new OmaTrustError(code2, `${name} must be a valid number`, { value });
   }
 }
-function assertObject(value, name, code = "INVALID_INPUT") {
+function assertObject(value, name, code2 = "INVALID_INPUT") {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new OmaTrustError(code, `${name} must be an object`, { value });
+    throw new OmaTrustError(code2, `${name} must be an object`, { value });
   }
 }
 function asError(err) {
@@ -50,37 +56,63 @@ function asError(err) {
 // src/identity/index.ts
 var identity_exports = {};
 __export(identity_exports, {
+  artifactDidFromBytes: () => artifactDidFromBytes,
+  artifactDidFromJson: () => artifactDidFromJson,
+  assertBareDid: () => assertBareDid,
+  assertJsonSafe: () => assertJsonSafe,
   buildCaip10: () => buildCaip10,
   buildCaip2: () => buildCaip2,
   buildDidPkh: () => buildDidPkh,
   buildDidPkhFromCaip10: () => buildDidPkhFromCaip10,
   buildDidWeb: () => buildDidWeb,
   buildEvmDidPkh: () => buildEvmDidPkh,
+  canonicalizeAndKeccak256: () => canonicalizeAndKeccak256,
   canonicalizeForHash: () => canonicalizeForHash,
   canonicalizeJson: () => canonicalizeJson,
   computeDidAddress: () => computeDidAddress,
   computeDidHash: () => computeDidHash,
+  computeJwkThumbprint: () => computeJwkThumbprint,
+  didEthrToDidPkh: () => didEthrToDidPkh,
+  didJwkToJwk: () => didJwkToJwk,
+  didKeyToDidJwk: () => didKeyToDidJwk,
   didToAddress: () => didToAddress,
   extractAddressFromDid: () => extractAddressFromDid,
+  extractAuthorizationMetadata: () => extractAuthorizationMetadata,
+  extractControllerEvmAddress: () => extractControllerEvmAddress,
   extractDidIdentifier: () => extractDidIdentifier,
   extractDidMethod: () => extractDidMethod,
+  formatJktValue: () => formatJktValue,
   getAddressFromDidPkh: () => getAddressFromDidPkh,
   getChainIdFromDidPkh: () => getChainIdFromDidPkh,
   getDomainFromDidWeb: () => getDomainFromDidWeb,
   getNamespaceFromDidPkh: () => getNamespaceFromDidPkh,
   hashCanonicalizedJson: () => hashCanonicalizedJson,
+  isDidUrl: () => isDidUrl,
   isEvmDidPkh: () => isEvmDidPkh,
+  isPrivateKeyDid: () => isPrivateKeyDid,
+  isSameControllerId: () => isSameControllerId,
   isValidDid: () => isValidDid,
+  jwkToDidJwk: () => jwkToDidJwk,
   normalizeCaip10: () => normalizeCaip10,
   normalizeDid: () => normalizeDid,
   normalizeDidHandle: () => normalizeDidHandle,
+  normalizeDidJwk: () => normalizeDidJwk,
   normalizeDidKey: () => normalizeDidKey,
   normalizeDidPkh: () => normalizeDidPkh,
   normalizeDidWeb: () => normalizeDidWeb,
   normalizeDomain: () => normalizeDomain,
+  parseArtifactDid: () => parseArtifactDid,
   parseCaip10: () => parseCaip10,
   parseCaip2: () => parseCaip2,
-  validateDidAddress: () => validateDidAddress
+  parseDidUrl: () => parseDidUrl,
+  parseJsonStrict: () => parseJsonStrict,
+  publicJwkEquals: () => publicJwkEquals,
+  resolveDidUrlToControllerDid: () => resolveDidUrlToControllerDid,
+  resolveDidUrlToPublicKey: () => resolveDidUrlToPublicKey,
+  validateDidAddress: () => validateDidAddress,
+  validatePrivateKeyDid: () => validatePrivateKeyDid,
+  validatePublicJwk: () => validatePublicJwk,
+  verifyDidArtifact: () => verifyDidArtifact
 });
 
 // src/identity/caip.ts
@@ -136,6 +168,158 @@ function parseCaip2(caip2) {
   }
   return { namespace, reference };
 }
+var VALID_KTY = /* @__PURE__ */ new Set(["EC", "OKP", "RSA"]);
+var PRIVATE_KEY_FIELDS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth"]);
+var REQUIRED_PUBLIC_FIELDS = {
+  EC: ["crv", "x", "y"],
+  OKP: ["crv", "x"],
+  RSA: ["n", "e"]
+};
+function validatePublicJwk(jwk) {
+  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
+    return { valid: false, error: "JWK must be a non-null object" };
+  }
+  const obj = jwk;
+  const kty = obj.kty;
+  if (typeof kty !== "string" || !VALID_KTY.has(kty)) {
+    return {
+      valid: false,
+      error: `Invalid or missing kty (must be one of: ${[...VALID_KTY].join(", ")})`
+    };
+  }
+  for (const field of PRIVATE_KEY_FIELDS) {
+    if (field in obj) {
+      return {
+        valid: false,
+        error: `JWK contains private key field "${field}" \u2014 only public keys are allowed`
+      };
+    }
+  }
+  const required = REQUIRED_PUBLIC_FIELDS[kty];
+  if (required) {
+    for (const field of required) {
+      if (!(field in obj) || obj[field] === void 0 || obj[field] === null || obj[field] === "") {
+        return {
+          valid: false,
+          error: `Missing required public key field "${field}" for kty="${kty}"`
+        };
+      }
+    }
+  }
+  return { valid: true };
+}
+function canonicalizeJwkJson(jwk) {
+  const sorted = Object.keys(jwk).sort();
+  const obj = {};
+  for (const key of sorted) {
+    obj[key] = jwk[key];
+  }
+  return JSON.stringify(obj);
+}
+function jwkToDidJwk(jwk) {
+  assertObject(jwk, "jwk", "INVALID_JWK");
+  const validation = validatePublicJwk(jwk);
+  if (!validation.valid) {
+    throw new OmaTrustError("INVALID_JWK", validation.error ?? "Invalid public JWK", { jwk });
+  }
+  const canonical = canonicalizeJwkJson(jwk);
+  const encoded = base64url.encode(new TextEncoder().encode(canonical));
+  return `did:jwk:${encoded}`;
+}
+function didJwkToJwk(didJwk) {
+  if (typeof didJwk !== "string" || !didJwk.startsWith("did:jwk:")) {
+    throw new OmaTrustError("INVALID_DID", "Expected a did:jwk DID", { input: didJwk });
+  }
+  const parts = didJwk.split(":");
+  if (parts.length !== 3) {
+    throw new OmaTrustError("INVALID_DID", "did:jwk must have exactly 3 colon-separated parts", {
+      input: didJwk
+    });
+  }
+  const encoded = parts[2];
+  if (!encoded || encoded.length === 0) {
+    throw new OmaTrustError("INVALID_DID", "Missing base64url-encoded JWK identifier", {
+      input: didJwk
+    });
+  }
+  let decoded;
+  try {
+    const bytes = base64url.decode(encoded);
+    decoded = new TextDecoder().decode(bytes);
+  } catch {
+    throw new OmaTrustError("INVALID_DID", "Failed to base64url-decode did:jwk identifier", {
+      input: didJwk
+    });
+  }
+  let jwk;
+  try {
+    jwk = JSON.parse(decoded);
+  } catch {
+    throw new OmaTrustError("INVALID_DID", "Decoded did:jwk identifier is not valid JSON", {
+      input: didJwk
+    });
+  }
+  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
+    throw new OmaTrustError("INVALID_DID", "Decoded did:jwk must be a JSON object", {
+      input: didJwk
+    });
+  }
+  const validation = validatePublicJwk(jwk);
+  if (!validation.valid) {
+    throw new OmaTrustError("INVALID_DID", validation.error ?? "Invalid public JWK in did:jwk", {
+      input: didJwk
+    });
+  }
+  return jwk;
+}
+function extractPublicKeyFields(jwk) {
+  const result = {};
+  const metadataFields = /* @__PURE__ */ new Set(["kid", "use", "key_ops", "alg", "ext"]);
+  for (const [key, value] of Object.entries(jwk)) {
+    if (PRIVATE_KEY_FIELDS.has(key)) continue;
+    if (metadataFields.has(key)) continue;
+    result[key] = value;
+  }
+  return result;
+}
+function publicJwkEquals(a, b) {
+  assertObject(a, "a", "INVALID_JWK");
+  assertObject(b, "b", "INVALID_JWK");
+  const aObj = a;
+  const bObj = b;
+  for (const field of PRIVATE_KEY_FIELDS) {
+    if (field in aObj) {
+      throw new OmaTrustError(
+        "INVALID_JWK",
+        `First JWK contains private key field "${field}"`,
+        { field }
+      );
+    }
+    if (field in bObj) {
+      throw new OmaTrustError(
+        "INVALID_JWK",
+        `Second JWK contains private key field "${field}"`,
+        { field }
+      );
+    }
+  }
+  const aPublic = extractPublicKeyFields(aObj);
+  const bPublic = extractPublicKeyFields(bObj);
+  return canonicalizeJwkJson(aPublic) === canonicalizeJwkJson(bPublic);
+}
+async function computeJwkThumbprint(jwk, digestAlgorithm = "sha256") {
+  assertObject(jwk, "jwk", "INVALID_JWK");
+  const validation = validatePublicJwk(jwk);
+  if (!validation.valid) {
+    throw new OmaTrustError("INVALID_JWK", validation.error ?? "Invalid public JWK", { jwk });
+  }
+  const alg = digestAlgorithm === "sha256" ? "sha256" : digestAlgorithm === "sha384" ? "sha384" : "sha512";
+  return calculateJwkThumbprint(jwk, alg);
+}
+async function formatJktValue(jwk) {
+  const thumbprint = await computeJwkThumbprint(jwk, "sha256");
+  return `jkt=S256:${thumbprint}`;
+}
 
 // src/identity/did.ts
 var DID_REGEX = /^did:[a-z0-9]+:.+$/i;
@@ -211,7 +395,7 @@ function normalizeDidKey(input) {
 }
 function normalizeDid(input) {
   assertString(input, "input", "INVALID_DID");
-  const trimmed = input.trim();
+  const trimmed = input.trim().split("#")[0];
   if (!trimmed.startsWith("did:")) {
     return normalizeDidWeb(trimmed);
   }
@@ -228,6 +412,8 @@ function normalizeDid(input) {
       return normalizeDidHandle(trimmed);
     case "key":
       return normalizeDidKey(trimmed);
+    case "jwk":
+      return normalizeDidJwk(trimmed);
     default:
       return trimmed;
   }
@@ -331,29 +517,843 @@ function extractAddressFromDid(identifier) {
   }
   throw new OmaTrustError("INVALID_DID", "Unsupported identifier format", { identifier });
 }
+var CAIP2_NAMESPACE_REGEX = /^[a-z0-9-]{3,8}$/;
+var BASE64URL_REGEX = /^[A-Za-z0-9_-]+$/;
+var VALID_JWK_KTY = /* @__PURE__ */ new Set(["EC", "OKP", "RSA"]);
+function isPrivateKeyDid(did) {
+  return validatePrivateKeyDid(did).valid;
+}
+function validatePrivateKeyDid(did) {
+  if (typeof did !== "string" || did.trim().length === 0) {
+    return { valid: false, method: null, error: "DID must be a non-empty string" };
+  }
+  const trimmed = did.trim();
+  const method = extractDidMethod(trimmed);
+  switch (method) {
+    case "pkh":
+      return validateDidPkh(trimmed);
+    case "jwk":
+      return validateDidJwk(trimmed);
+    default:
+      return {
+        valid: false,
+        method: null,
+        error: method ? `DID method "${method}" is not a recognized private-key method` : "Invalid DID format"
+      };
+  }
+}
+function validateDidPkh(did) {
+  const parts = did.split(":");
+  if (parts.length !== 5) {
+    return {
+      valid: false,
+      method: "pkh",
+      error: `did:pkh must have exactly 5 colon-separated parts, got ${parts.length}`
+    };
+  }
+  const [, , namespace, chainId, address] = parts;
+  if (!namespace) {
+    return { valid: false, method: "pkh", error: "Missing namespace" };
+  }
+  if (!CAIP2_NAMESPACE_REGEX.test(namespace)) {
+    return {
+      valid: false,
+      method: "pkh",
+      error: `Invalid CAIP-2 namespace "${namespace}" (must be 3-8 lowercase alphanumeric/hyphen chars)`
+    };
+  }
+  if (!chainId) {
+    return { valid: false, method: "pkh", error: "Missing chain ID (reference)" };
+  }
+  if (!address) {
+    return { valid: false, method: "pkh", error: "Missing address" };
+  }
+  if (namespace === "eip155") {
+    if (!/^\d+$/.test(chainId)) {
+      return {
+        valid: false,
+        method: "pkh",
+        error: `Invalid eip155 chain ID "${chainId}" (must be numeric)`
+      };
+    }
+    if (!isAddress(address)) {
+      return {
+        valid: false,
+        method: "pkh",
+        error: `Invalid EVM address "${address}" (must be 0x + 40 hex chars)`
+      };
+    }
+  }
+  if (namespace === "solana") {
+    if (!/^[1-9A-HJ-NP-Za-km-z]{32,44}$/.test(address)) {
+      return {
+        valid: false,
+        method: "pkh",
+        error: `Invalid Solana address "${address}" (must be 32-44 base58 characters)`
+      };
+    }
+  }
+  return { valid: true, method: "pkh" };
+}
+function validateDidJwk(did) {
+  const parts = did.split(":");
+  if (parts.length !== 3) {
+    return {
+      valid: false,
+      method: "jwk",
+      error: `did:jwk must have exactly 3 colon-separated parts, got ${parts.length}`
+    };
+  }
+  const [, , encoded] = parts;
+  if (!encoded || encoded.length === 0) {
+    return { valid: false, method: "jwk", error: "Missing base64url-encoded JWK identifier" };
+  }
+  if (!BASE64URL_REGEX.test(encoded)) {
+    return {
+      valid: false,
+      method: "jwk",
+      error: "Identifier contains invalid base64url characters"
+    };
+  }
+  let decoded;
+  try {
+    const bytes = base64url.decode(encoded);
+    decoded = new TextDecoder().decode(bytes);
+  } catch {
+    return { valid: false, method: "jwk", error: "Failed to base64url-decode identifier" };
+  }
+  let jwk;
+  try {
+    jwk = JSON.parse(decoded);
+  } catch {
+    return { valid: false, method: "jwk", error: "Decoded identifier is not valid JSON" };
+  }
+  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
+    return { valid: false, method: "jwk", error: "Decoded JWK must be a JSON object" };
+  }
+  const kty = jwk.kty;
+  if (typeof kty !== "string" || !VALID_JWK_KTY.has(kty)) {
+    return {
+      valid: false,
+      method: "jwk",
+      error: `Invalid or missing kty field (must be one of: EC, OKP, RSA)`
+    };
+  }
+  if ("d" in jwk) {
+    return {
+      valid: false,
+      method: "jwk",
+      error: "DID must reference a public key \u2014 private key component (d) is not allowed"
+    };
+  }
+  const jwkValidation = validatePublicJwk(jwk);
+  if (!jwkValidation.valid) {
+    return { valid: false, method: "jwk", error: jwkValidation.error };
+  }
+  return { valid: true, method: "jwk" };
+}
+function normalizeDidJwk(input) {
+  assertString(input, "input", "INVALID_DID");
+  const trimmed = input.trim();
+  if (!trimmed.startsWith("did:jwk:")) {
+    throw new OmaTrustError("INVALID_DID", "Expected did:jwk DID", { input });
+  }
+  const result = validateDidJwk(trimmed);
+  if (!result.valid) {
+    throw new OmaTrustError("INVALID_DID", result.error ?? "Invalid did:jwk", { input });
+  }
+  return trimmed;
+}
+
+// src/identity/did-url.ts
+var DID_URL_REGEX = /^did:[a-z0-9]+:.+$/i;
+function parseDidUrl(input) {
+  assertString(input, "input", "INVALID_DID_URL");
+  const trimmed = input.trim();
+  const hashIndex = trimmed.indexOf("#");
+  let did;
+  let fragment;
+  if (hashIndex === -1) {
+    did = trimmed;
+    fragment = null;
+  } else {
+    did = trimmed.slice(0, hashIndex);
+    const rawFragment = trimmed.slice(hashIndex + 1);
+    if (rawFragment.length === 0) {
+      throw new OmaTrustError(
+        "INVALID_DID_URL",
+        "DID URL has empty fragment (trailing '#' with no identifier)",
+        { input }
+      );
+    }
+    fragment = rawFragment;
+  }
+  if (!DID_URL_REGEX.test(did)) {
+    throw new OmaTrustError(
+      "INVALID_DID_URL",
+      "Invalid DID URL: base DID portion is malformed",
+      { input, did }
+    );
+  }
+  return {
+    didUrl: trimmed,
+    did,
+    fragment
+  };
+}
+function isDidUrl(input) {
+  if (typeof input !== "string") return false;
+  const trimmed = input.trim();
+  return trimmed.includes("#") && DID_URL_REGEX.test(trimmed.split("#")[0]);
+}
+function assertBareDid(input, paramName = "did") {
+  assertString(input, paramName, "INVALID_DID");
+  if (isDidUrl(input)) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `Expected a bare DID but received a DID URL with a fragment. Use parseDidUrl() to handle DID URLs.`,
+      { input }
+    );
+  }
+}
+
+// src/shared/did-document.ts
+async function fetchDidDocument(domain) {
+  const normalized = domain.toLowerCase().replace(/\.$/, "");
+  const url = `https://${normalized}/.well-known/did.json`;
+  let response;
+  try {
+    response = await fetch(url, { headers: { Accept: "application/json" } });
+  } catch (err) {
+    throw new OmaTrustError("NETWORK_ERROR", "Failed to fetch DID document", { domain, err });
+  }
+  if (!response.ok) {
+    throw new OmaTrustError("NETWORK_ERROR", `DID document fetch failed: ${response.status}`, {
+      domain,
+      status: response.status
+    });
+  }
+  return await response.json();
+}
+
+// src/identity/resolve-key.ts
+function findVerificationMethod(didDocument, didUrl, fragment) {
+  const methods = didDocument.verificationMethod;
+  if (!Array.isArray(methods)) {
+    return null;
+  }
+  for (const method of methods) {
+    if (!method || typeof method !== "object") continue;
+    const id2 = method.id;
+    if (typeof id2 !== "string") continue;
+    if (id2 === didUrl) return method;
+    if (fragment && (id2 === `#${fragment}` || id2.endsWith(`#${fragment}`))) {
+      return method;
+    }
+  }
+  return null;
+}
+function extractMethodIdsFromDidDocument(didDocument) {
+  const methods = didDocument.verificationMethod;
+  if (!Array.isArray(methods)) return [];
+  return methods.filter((m) => m && typeof m.id === "string").map((m) => m.id);
+}
+async function resolveDidUrlToPublicKey(didUrl, options) {
+  assertString(didUrl, "didUrl", "INVALID_DID_URL");
+  const parsed = parseDidUrl(didUrl);
+  const method = extractDidMethod(parsed.did);
+  if (!method) {
+    throw new OmaTrustError("INVALID_DID_URL", "Cannot extract DID method from DID URL", {
+      didUrl,
+      did: parsed.did
+    });
+  }
+  switch (method) {
+    case "web":
+      return resolveDidUrlKey(parsed.didUrl, parsed.did, parsed.fragment, options);
+    default:
+      throw new OmaTrustError(
+        "UNSUPPORTED_DID_METHOD",
+        `DID URL key resolution is not supported for method "${method}"`,
+        { didUrl, method }
+      );
+  }
+}
+async function resolveDidUrlToControllerDid(didUrl, options) {
+  const resolved = await resolveDidUrlToPublicKey(didUrl, options);
+  const controllerDid = jwkToDidJwk(resolved.publicKeyJwk);
+  return {
+    ...resolved,
+    controllerDid
+  };
+}
+async function resolveDidUrlKey(didUrl, did, fragment, options) {
+  const domain = getDomainFromDidWeb(did);
+  if (!domain) {
+    throw new OmaTrustError("INVALID_DID_URL", "Cannot extract domain from did:web DID", {
+      didUrl,
+      did
+    });
+  }
+  const fetchFn = options?.fetchDidDocument ?? fetchDidDocument;
+  const didDocument = await fetchFn(domain);
+  const method = findVerificationMethod(didDocument, didUrl, fragment);
+  if (!method) {
+    throw new OmaTrustError(
+      "KEY_NOT_FOUND",
+      `No verification method found matching "${fragment ? `#${fragment}` : didUrl}"`,
+      { didUrl, fragment, availableMethods: extractMethodIdsFromDidDocument(didDocument) }
+    );
+  }
+  const publicKeyJwk = method.publicKeyJwk;
+  if (!publicKeyJwk || typeof publicKeyJwk !== "object") {
+    throw new OmaTrustError(
+      "KEY_NOT_FOUND",
+      `Verification method "${method.id}" does not contain publicKeyJwk`,
+      { didUrl, verificationMethodId: method.id }
+    );
+  }
+  const validation = validatePublicJwk(publicKeyJwk);
+  if (!validation.valid) {
+    throw new OmaTrustError(
+      "INVALID_JWK",
+      `publicKeyJwk in verification method "${method.id}" is invalid: ${validation.error}`,
+      { didUrl, verificationMethodId: method.id }
+    );
+  }
+  return {
+    didUrl,
+    did,
+    fragment,
+    publicKeyJwk,
+    verificationMethodId: method.id
+  };
+}
+
+// src/identity/controller-id.ts
+function isSameControllerId(a, b) {
+  let normalizedA = null;
+  let normalizedB = null;
+  try {
+    normalizedA = normalizeDid(a);
+  } catch {
+  }
+  try {
+    normalizedB = normalizeDid(b);
+  } catch {
+  }
+  if (normalizedA && normalizedB && normalizedA === normalizedB) {
+    return true;
+  }
+  const evmA = extractControllerEvmAddress(a);
+  const evmB = extractControllerEvmAddress(b);
+  if (evmA && evmB && evmA.toLowerCase() === evmB.toLowerCase()) {
+    return true;
+  }
+  const methodA = extractDidMethod(a);
+  const methodB = extractDidMethod(b);
+  if (methodA === "jwk" && methodB === "jwk") {
+    try {
+      const jwkA = didJwkToJwk(a);
+      const jwkB = didJwkToJwk(b);
+      return publicJwkEquals(jwkA, jwkB);
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+function extractControllerEvmAddress(controllerDid) {
+  try {
+    const method = extractDidMethod(controllerDid);
+    if (method === "pkh" && controllerDid.includes("eip155")) {
+      return extractAddressFromDid(controllerDid);
+    }
+  } catch {
+  }
+  return null;
+}
+
+// src/identity/types.ts
+function extractAuthorizationMetadata(result) {
+  const payload = result.payload;
+  const resourceUrl = typeof payload.resourceUrl === "string" ? payload.resourceUrl : null;
+  const issuedAt = typeof payload.issuedAt === "string" ? payload.issuedAt : typeof payload.issuedAt === "number" ? payload.issuedAt : null;
+  let subjectDid = null;
+  if (resourceUrl) {
+    try {
+      const url = new URL(resourceUrl);
+      subjectDid = `did:web:${url.hostname}`;
+    } catch {
+    }
+  }
+  if ("publicKeyDid" in result) {
+    const jwsResult = result;
+    return {
+      controllerDid: jwsResult.publicKeyDid,
+      subjectDid,
+      resourceUrl,
+      issuedAt,
+      kid: jwsResult.kid,
+      publicKeyJwk: jwsResult.publicKeyJwk,
+      signer: null
+    };
+  }
+  const eip712Result = result;
+  const signerAddress = eip712Result.signer.toLowerCase();
+  return {
+    controllerDid: `did:pkh:eip155:1:${signerAddress}`,
+    subjectDid,
+    resourceUrl,
+    issuedAt,
+    kid: null,
+    publicKeyJwk: null,
+    signer: eip712Result.signer
+  };
+}
+var VALID_ALGORITHMS = /* @__PURE__ */ new Set(["keccak256", "sha256"]);
+var MAX_JSON_DEPTH = 32;
+function assertDepthLimit(depth, context) {
+  if (depth > MAX_JSON_DEPTH) {
+    const msg = context ? `JSON nesting depth exceeds maximum of ${MAX_JSON_DEPTH} at ${context}` : `JSON nesting depth exceeds maximum of ${MAX_JSON_DEPTH}`;
+    throw new OmaTrustError("INVALID_INPUT", msg);
+  }
+}
+function parseJsonStrict(input) {
+  if (typeof input !== "string") {
+    throw new OmaTrustError("INVALID_INPUT", "Input must be a string");
+  }
+  const duplicateKeys = detectDuplicateKeys(input);
+  if (duplicateKeys.length > 0) {
+    throw new OmaTrustError(
+      "INVALID_INPUT",
+      `Duplicate JSON key${duplicateKeys.length > 1 ? "s" : ""} detected: ${duplicateKeys.map((k) => `"${k}"`).join(", ")}`,
+      { duplicateKeys }
+    );
+  }
+  try {
+    return JSON.parse(input);
+  } catch {
+    throw new OmaTrustError("INVALID_INPUT", "Input is not valid JSON");
+  }
+}
+function detectDuplicateKeys(input) {
+  const duplicates = [];
+  const objectKeyStack = [];
+  let inString = false;
+  let escaped = false;
+  let currentKey = "";
+  let collectingKey = false;
+  let afterColon = false;
+  let i = 0;
+  while (i < input.length) {
+    const ch = input[i];
+    if (escaped) {
+      if (collectingKey) currentKey += ch;
+      escaped = false;
+      i++;
+      continue;
+    }
+    if (ch === "\\") {
+      escaped = true;
+      if (collectingKey) currentKey += ch;
+      i++;
+      continue;
+    }
+    if (ch === '"') {
+      if (!inString) {
+        inString = true;
+        if (objectKeyStack.length > 0 && !afterColon) {
+          collectingKey = true;
+          currentKey = "";
+        }
+      } else {
+        inString = false;
+        if (collectingKey) {
+          collectingKey = false;
+          const keySet = objectKeyStack[objectKeyStack.length - 1];
+          if (keySet.has(currentKey)) {
+            if (!duplicates.includes(currentKey)) {
+              duplicates.push(currentKey);
+            }
+          } else {
+            keySet.add(currentKey);
+          }
+        }
+      }
+      i++;
+      continue;
+    }
+    if (inString) {
+      if (collectingKey) currentKey += ch;
+      i++;
+      continue;
+    }
+    if (ch === "{") {
+      objectKeyStack.push(/* @__PURE__ */ new Set());
+      assertDepthLimit(objectKeyStack.length);
+      afterColon = false;
+    } else if (ch === "}") {
+      objectKeyStack.pop();
+      afterColon = objectKeyStack.length > 0;
+    } else if (ch === "[") {
+      objectKeyStack.push(/* @__PURE__ */ new Set(["__array__"]));
+      assertDepthLimit(objectKeyStack.length);
+      afterColon = false;
+    } else if (ch === "]") {
+      objectKeyStack.pop();
+      afterColon = objectKeyStack.length > 0;
+    } else if (ch === ":") {
+      afterColon = true;
+    } else if (ch === ",") {
+      afterColon = false;
+    }
+    i++;
+  }
+  return duplicates;
+}
+function assertJsonSafe(value, path = "$", depth = 0) {
+  assertDepthLimit(depth, path);
+  if (value === void 0) {
+    throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: undefined`);
+  }
+  if (value === null) return;
+  switch (typeof value) {
+    case "string":
+    case "boolean":
+      return;
+    case "number":
+      if (!Number.isFinite(value)) {
+        throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: ${value} (must be finite number)`);
+      }
+      return;
+    case "bigint":
+      throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: BigInt (use number or string)`);
+    case "function":
+      throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: function`);
+    case "symbol":
+      throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: Symbol`);
+    case "object":
+      if (value instanceof Date) {
+        throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: Date (use ISO string or timestamp)`);
+      }
+      if (value instanceof RegExp) {
+        throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: RegExp`);
+      }
+      if (Array.isArray(value)) {
+        for (let i = 0; i < value.length; i++) {
+          assertJsonSafe(value[i], `${path}[${i}]`, depth + 1);
+        }
+        return;
+      }
+      for (const [key, val] of Object.entries(value)) {
+        assertJsonSafe(val, `${path}.${key}`, depth + 1);
+      }
+      return;
+    default:
+      throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: unknown type "${typeof value}"`);
+  }
+}
 function canonicalizeJson(obj) {
+  assertJsonSafe(obj);
   const jcs = canonicalize(obj);
   if (!jcs) {
     throw new OmaTrustError("INVALID_INPUT", "Object cannot be canonicalized", { obj });
   }
   return jcs;
 }
-function canonicalizeForHash(obj) {
+function canonicalizeAndKeccak256(obj) {
   const jcsJson = canonicalizeJson(obj);
   return {
     jcsJson,
     hash: keccak256(toUtf8Bytes(jcsJson))
   };
 }
+function canonicalizeForHash(obj) {
+  return canonicalizeAndKeccak256(obj);
+}
 function hashCanonicalizedJson(obj, algorithm) {
+  if (!VALID_ALGORITHMS.has(algorithm)) {
+    throw new OmaTrustError("INVALID_INPUT", `Unsupported hash algorithm: "${algorithm}". Must be "keccak256" or "sha256".`, { algorithm });
+  }
   const jcs = canonicalizeJson(obj);
   const bytes = toUtf8Bytes(jcs);
   return algorithm === "keccak256" ? keccak256(bytes) : sha256(bytes);
 }
+var DID_ARTIFACT_PREFIX = "did:artifact:";
+var CID_VERSION = 1;
+var RAW_CODEC = raw.code;
+var SHA2_256_CODE = 18;
+var SHA2_256_DIGEST_LENGTH = 32;
+async function artifactDidFromBytes(bytes) {
+  if (!(bytes instanceof Uint8Array) || bytes.length === 0) {
+    throw new OmaTrustError(
+      "INVALID_INPUT",
+      "bytes must be a non-empty Uint8Array"
+    );
+  }
+  const digest = await sha256$1.digest(bytes);
+  const cid = CID.createV1(RAW_CODEC, digest);
+  return `${DID_ARTIFACT_PREFIX}${cid.toString(base32)}`;
+}
+async function artifactDidFromJson(input) {
+  const value = typeof input === "string" ? parseJsonStrict(input) : input;
+  const jcs = canonicalizeJson(value);
+  const bytes = new TextEncoder().encode(jcs);
+  const digest = await sha256$1.digest(bytes);
+  const cid = CID.createV1(RAW_CODEC, digest);
+  return `${DID_ARTIFACT_PREFIX}${cid.toString(base32)}`;
+}
+function parseArtifactDid(did) {
+  if (typeof did !== "string" || !did.startsWith(DID_ARTIFACT_PREFIX)) {
+    throw new OmaTrustError("INVALID_DID", "Expected a did:artifact DID", { did });
+  }
+  const identifier = did.slice(DID_ARTIFACT_PREFIX.length);
+  if (!identifier || identifier.length === 0) {
+    throw new OmaTrustError("INVALID_DID", "Missing method-specific identifier", { did });
+  }
+  if (identifier[0] !== "b") {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `Invalid multibase prefix "${identifier[0]}", expected "b" (base32lower)`,
+      { did }
+    );
+  }
+  let cid;
+  try {
+    cid = CID.parse(identifier, base32);
+  } catch (err) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      "Failed to decode base32 CID from did:artifact identifier",
+      { did, cause: err }
+    );
+  }
+  if (cid.version !== CID_VERSION) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `CID version must be 1, got ${cid.version}`,
+      { did }
+    );
+  }
+  if (cid.code !== RAW_CODEC) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `Multicodec must be raw (0x55), got 0x${cid.code.toString(16)}`,
+      { did }
+    );
+  }
+  if (cid.multihash.code !== SHA2_256_CODE) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `Multihash function must be sha2-256 (0x12), got 0x${cid.multihash.code.toString(16)}`,
+      { did }
+    );
+  }
+  if (cid.multihash.digest.length !== SHA2_256_DIGEST_LENGTH) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `SHA-256 digest must be 32 bytes, got ${cid.multihash.digest.length}`,
+      { did }
+    );
+  }
+  const digest = cid.multihash.digest;
+  const digestHex = Array.from(digest).map((b) => b.toString(16).padStart(2, "0")).join("");
+  return { did, identifier, digest, digestHex };
+}
+async function verifyDidArtifact(did, content) {
+  let parsed;
+  try {
+    parsed = parseArtifactDid(did);
+  } catch (err) {
+    return {
+      valid: false,
+      reason: err instanceof OmaTrustError ? err.message : "Invalid did:artifact DID"
+    };
+  }
+  const expectedHex = parsed.digestHex;
+  if (typeof content === "string" || typeof content === "object" && content !== null && !(content instanceof Uint8Array)) {
+    try {
+      const value = typeof content === "string" ? parseJsonStrict(content) : content;
+      const jcs = canonicalizeJson(value);
+      const jcsBytes = new TextEncoder().encode(jcs);
+      const digest2 = await sha256$1.digest(jcsBytes);
+      const digestHex2 = Array.from(digest2.digest).map((b) => b.toString(16).padStart(2, "0")).join("");
+      if (digestHex2 === expectedHex) {
+        return { valid: true, matchedAs: "json" };
+      }
+    } catch {
+    }
+  }
+  let rawBytes;
+  if (content instanceof Uint8Array) {
+    rawBytes = content;
+  } else if (typeof content === "string") {
+    rawBytes = new TextEncoder().encode(content);
+  } else {
+    return {
+      valid: false,
+      reason: "Content did not match as canonical JSON and is not raw bytes"
+    };
+  }
+  const digest = await sha256$1.digest(rawBytes);
+  const digestHex = Array.from(digest.digest).map((b) => b.toString(16).padStart(2, "0")).join("");
+  if (digestHex === expectedHex) {
+    return { valid: true, matchedAs: "binary" };
+  }
+  return {
+    valid: false,
+    reason: "Content does not match the did:artifact identifier (neither as canonical JSON nor as raw bytes)"
+  };
+}
+function didEthrToDidPkh(did) {
+  if (typeof did !== "string" || !did.startsWith("did:ethr:")) {
+    throw new OmaTrustError("INVALID_DID", "Expected a did:ethr DID", { did });
+  }
+  const remainder = did.slice("did:ethr:".length);
+  if (!remainder) {
+    throw new OmaTrustError("INVALID_DID", "Missing identifier in did:ethr DID", { did });
+  }
+  let chainId;
+  let address;
+  const parts = remainder.split(":");
+  if (parts.length === 1) {
+    chainId = "1";
+    address = parts[0];
+  } else if (parts.length === 2) {
+    const rawChainId = parts[0];
+    address = parts[1];
+    if (rawChainId.startsWith("0x")) {
+      chainId = String(parseInt(rawChainId, 16));
+    } else if (/^\d+$/.test(rawChainId)) {
+      chainId = rawChainId;
+    } else {
+      const networkMap = {
+        mainnet: "1",
+        goerli: "5",
+        sepolia: "11155111",
+        polygon: "137",
+        arbitrum: "42161",
+        optimism: "10",
+        base: "8453"
+      };
+      const mapped = networkMap[rawChainId.toLowerCase()];
+      if (!mapped) {
+        throw new OmaTrustError(
+          "INVALID_DID",
+          `Unknown did:ethr network "${rawChainId}"`,
+          { did, network: rawChainId }
+        );
+      }
+      chainId = mapped;
+    }
+  } else {
+    throw new OmaTrustError("INVALID_DID", "Invalid did:ethr format", { did });
+  }
+  if (!isAddress(address)) {
+    throw new OmaTrustError("INVALID_DID", "Invalid Ethereum address in did:ethr DID", {
+      did,
+      address
+    });
+  }
+  const checksummed = getAddress(address);
+  return `did:pkh:eip155:${chainId}:${checksummed.toLowerCase()}`;
+}
+var MULTICODEC_KEY_TYPES = {
+  // Ed25519 public key: 0xed (varint encoded as [0xed, 0x01])
+  237: { kty: "OKP", crv: "Ed25519" },
+  // X25519 public key: 0xec (varint encoded as [0xec, 0x01])
+  236: { kty: "OKP", crv: "X25519" },
+  // secp256k1 public key (compressed): 0xe7 (varint encoded as [0xe7, 0x01])
+  231: { kty: "EC", crv: "secp256k1", coordSize: 33 },
+  // P-256 public key (compressed): 0x80 0x24 (varint 0x1200)
+  4608: { kty: "EC", crv: "P-256", coordSize: 33 },
+  // P-384 public key (compressed): 0x81 0x24 (varint 0x1201)
+  4609: { kty: "EC", crv: "P-384", coordSize: 49 }
+};
+function readVarint(bytes, offset) {
+  let value = 0;
+  let shift = 0;
+  let bytesRead = 0;
+  while (offset + bytesRead < bytes.length) {
+    const byte = bytes[offset + bytesRead];
+    value |= (byte & 127) << shift;
+    bytesRead++;
+    if ((byte & 128) === 0) {
+      return { value, bytesRead };
+    }
+    shift += 7;
+    if (shift > 28) {
+      throw new OmaTrustError("INVALID_DID", "Varint too long in did:key multicodec prefix");
+    }
+  }
+  throw new OmaTrustError("INVALID_DID", "Truncated varint in did:key multicodec prefix");
+}
+function decompressEcKey(compressedKey, crv) {
+  throw new OmaTrustError(
+    "UNSUPPORTED_KEY_TYPE",
+    `Cannot convert compressed EC key (${crv}) from did:key to did:jwk. Decompressing EC points requires elliptic curve arithmetic. For EVM keys, use didEthrToDidPkh() instead.`,
+    { crv, keyLength: compressedKey.length }
+  );
+}
+function didKeyToDidJwk(did) {
+  if (typeof did !== "string" || !did.startsWith("did:key:")) {
+    throw new OmaTrustError("INVALID_DID", "Expected a did:key DID", { did });
+  }
+  const identifier = did.slice("did:key:".length);
+  if (!identifier || !identifier.startsWith("z")) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      "did:key identifier must start with 'z' (base58btc multibase prefix)",
+      { did }
+    );
+  }
+  let decoded;
+  try {
+    decoded = base58btc.decode(identifier);
+  } catch (err) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      "Failed to decode base58btc from did:key identifier",
+      { did, cause: err }
+    );
+  }
+  if (decoded.length < 3) {
+    throw new OmaTrustError("INVALID_DID", "did:key decoded bytes too short", { did });
+  }
+  const { value: codecValue, bytesRead } = readVarint(decoded, 0);
+  const keyType = MULTICODEC_KEY_TYPES[codecValue];
+  if (!keyType) {
+    throw new OmaTrustError(
+      "UNSUPPORTED_KEY_TYPE",
+      `Unsupported multicodec key type 0x${codecValue.toString(16)} in did:key`,
+      { did, codec: `0x${codecValue.toString(16)}` }
+    );
+  }
+  const keyBytes = decoded.slice(bytesRead);
+  if (keyType.kty === "OKP") {
+    if (keyBytes.length !== 32) {
+      throw new OmaTrustError(
+        "INVALID_DID",
+        `Expected 32-byte ${keyType.crv} key, got ${keyBytes.length} bytes`,
+        { did, crv: keyType.crv }
+      );
+    }
+    const jwk = {
+      kty: keyType.kty,
+      crv: keyType.crv,
+      x: base64url.encode(keyBytes)
+    };
+    return jwkToDidJwk(jwk);
+  }
+  return decompressEcKey(keyBytes, keyType.crv).x.toString();
+}
 
 // src/reputation/index.ts
 var reputation_exports = {};
 __export(reputation_exports, {
+  EIP1967_ADMIN_SLOT: () => EIP1967_ADMIN_SLOT,
+  OWNERSHIP_PATTERNS: () => OWNERSHIP_PATTERNS,
   buildDelegatedAttestationTypedData: () => buildDelegatedAttestationTypedData,
   buildDelegatedTypedDataFromEncoded: () => buildDelegatedTypedDataFromEncoded,
   buildDnsTxtRecord: () => buildDnsTxtRecord,
@@ -372,9 +1372,12 @@ __export(reputation_exports, {
   createX402ReceiptProof: () => createX402ReceiptProof,
   decodeAttestationData: () => decodeAttestationData,
   deduplicateReviews: () => deduplicateReviews,
+  discoverContractOwner: () => discoverContractOwner,
+  discoverControllingWalletDid: () => discoverControllingWalletDid,
   encodeAttestationData: () => encodeAttestationData,
-  extractAddressesFromDidDocument: () => extractAddressesFromDidDocument,
+  extractEvmAddressesFromDidDocument: () => extractEvmAddressesFromDidDocument,
   extractExpirationTime: () => extractExpirationTime,
+  extractJwksFromDidDocument: () => extractJwksFromDidDocument,
   fetchDidDocument: () => fetchDidDocument,
   formatSchemaUid: () => formatSchemaUid,
   formatTransferAmount: () => formatTransferAmount,
@@ -382,6 +1385,7 @@ __export(reputation_exports, {
   getAttestationsByAttester: () => getAttestationsByAttester,
   getAttestationsForDid: () => getAttestationsForDid,
   getChainConstants: () => getChainConstants,
+  getControllerAuthorization: () => getControllerAuthorization,
   getExplorerAddressUrl: () => getExplorerAddressUrl,
   getExplorerTxUrl: () => getExplorerTxUrl,
   getLatestAttestations: () => getLatestAttestations,
@@ -395,6 +1399,8 @@ __export(reputation_exports, {
   normalizeSchema: () => normalizeSchema,
   parseDnsTxtRecord: () => parseDnsTxtRecord,
   prepareDelegatedAttestation: () => prepareDelegatedAttestation,
+  readOwnerFromContract: () => readOwnerFromContract,
+  requestControllerWitness: () => requestControllerWitness,
   revokeAttestation: () => revokeAttestation,
   schemaToString: () => schemaToString,
   splitSignature: () => splitSignature,
@@ -406,11 +1412,21 @@ __export(reputation_exports, {
   verifyDidJsonControllerDid: () => verifyDidJsonControllerDid,
   verifyDidPkhOwnership: () => verifyDidPkhOwnership,
   verifyDidWebOwnership: () => verifyDidWebOwnership,
-  verifyDnsTxtControllerDid: () => verifyDnsTxtControllerDid,
+  verifyDnsTxtControllerDid: () => verifyDnsTxtControllerDid2,
   verifyEip712Signature: () => verifyEip712Signature,
+  verifyKeyBindingProofs: () => verifyKeyBindingProofs,
+  verifyLinkedIdentifierProofs: () => verifyLinkedIdentifierProofs,
   verifyProof: () => verifyProof,
   verifySchemaExists: () => verifySchemaExists,
-  verifySubjectOwnership: () => verifySubjectOwnership
+  verifySubjectOwnership: () => verifySubjectOwnership,
+  verifyTransferProof: () => verifyTransferProof,
+  verifyX402Artifact: () => verifyX402Artifact,
+  verifyX402Eip712Artifact: () => verifyX402Eip712Artifact,
+  verifyX402Eip712Offer: () => verifyX402Eip712Offer,
+  verifyX402Eip712Receipt: () => verifyX402Eip712Receipt,
+  verifyX402JwsArtifact: () => verifyX402JwsArtifact,
+  verifyX402JwsOffer: () => verifyX402JwsOffer,
+  verifyX402JwsReceipt: () => verifyX402JwsReceipt
 });
 function normalizeSchema(schema) {
   if (Array.isArray(schema)) {
@@ -869,19 +1885,32 @@ async function submitDelegatedAttestation(params) {
     payload = {};
   }
   if (!response.ok) {
-    throw new OmaTrustError("NETWORK_ERROR", "Relay submission failed", {
-      status: response.status,
+    const relayError = {
+      httpStatus: response.status,
+      code: payload.code,
+      error: payload.error ?? payload.message,
       payload
-    });
+    };
+    throw new OmaTrustError("RELAY_ERROR", `Relay submission failed (HTTP ${response.status})`, relayError);
   }
   const uid = payload.uid ?? ZERO_UID;
   const txHash = payload.txHash;
-  const status = payload.status ?? "submitted";
-  return {
-    uid,
-    txHash,
-    status
-  };
+  const hasConfirmationSignals = payload.status === "confirmed" || payload.success === true || typeof payload.blockNumber === "number";
+  const status = hasConfirmationSignals ? "confirmed" : "submitted";
+  const relay = {};
+  if (typeof payload.blockNumber === "number") relay.blockNumber = payload.blockNumber;
+  if (typeof payload.chain === "string") relay.chain = payload.chain;
+  if (typeof payload.success === "boolean") relay.success = payload.success;
+  for (const key of Object.keys(payload)) {
+    if (!["uid", "txHash", "status", "blockNumber", "chain", "success"].includes(key)) {
+      relay[key] = payload[key];
+    }
+  }
+  const result = { uid, txHash, status };
+  if (Object.keys(relay).length > 0) {
+    result.relay = relay;
+  }
+  return result;
 }
 var EAS_EVENT_ABI = [
   "event Attested(address indexed recipient, address indexed attester, bytes32 uid, bytes32 indexed schemaUID)"
@@ -983,7 +2012,7 @@ async function getAttestationsForDid(params) {
     provider,
     fromBlock,
     toBlock,
-    { recipient: didToAddress(params.did), schemas: params.schemas }
+    { recipient: didToAddress(params.subjectDid), schemas: params.schemas }
   );
 }
 async function getAttestationsByAttester(params) {
@@ -1224,25 +2253,7 @@ function getExplorerTxUrl(chainId, txHash) {
 function getExplorerAddressUrl(chainId, address) {
   return `${getConfig(chainId).explorer}/address/${address}`;
 }
-async function fetchDidDocument(domain) {
-  const normalized = domain.toLowerCase().replace(/\.$/, "");
-  const url = `https://${normalized}/.well-known/did.json`;
-  let response;
-  try {
-    response = await fetch(url, { headers: { Accept: "application/json" } });
-  } catch (err) {
-    throw new OmaTrustError("NETWORK_ERROR", "Failed to fetch DID document", { domain, err });
-  }
-  if (!response.ok) {
-    throw new OmaTrustError("NETWORK_ERROR", "DID document fetch failed", {
-      domain,
-      status: response.status
-    });
-  }
-  const body = await response.json();
-  return body;
-}
-function extractAddressesFromDidDocument(didDocument) {
+function extractEvmAddressesFromDidDocument(didDocument) {
   const methods = didDocument.verificationMethod;
   if (!Array.isArray(methods)) {
     return [];
@@ -1266,89 +2277,453 @@ function extractAddressesFromDidDocument(didDocument) {
   }
   return [...addresses];
 }
+function extractJwksFromDidDocument(didDocument) {
+  const methods = didDocument.verificationMethod;
+  if (!Array.isArray(methods)) {
+    return [];
+  }
+  const jwks = [];
+  for (const method of methods) {
+    const publicKeyJwk = method.publicKeyJwk;
+    if (publicKeyJwk && typeof publicKeyJwk === "object" && !Array.isArray(publicKeyJwk)) {
+      jwks.push(publicKeyJwk);
+    }
+  }
+  return jwks;
+}
 function verifyDidDocumentControllerDid(didDocument, expectedControllerDid) {
+  const method = extractDidMethod(expectedControllerDid);
+  if (method === "jwk") {
+    try {
+      const expectedJwk = didJwkToJwk(expectedControllerDid);
+      const documentJwks = extractJwksFromDidDocument(didDocument);
+      for (const docJwk of documentJwks) {
+        try {
+          if (publicJwkEquals(docJwk, expectedJwk)) {
+            return { valid: true };
+          }
+        } catch {
+        }
+      }
+      return {
+        valid: false,
+        reason: "No matching publicKeyJwk found in DID document verification methods"
+      };
+    } catch {
+      return {
+        valid: false,
+        reason: "Failed to decode did:jwk controller DID"
+      };
+    }
+  }
   let expectedAddress;
   try {
     expectedAddress = getAddress(extractAddressFromDid(expectedControllerDid));
   } catch {
-    return { valid: false, reason: "Expected controller DID does not resolve to an EVM address" };
+    return { valid: false, reason: "Controller DID does not resolve to an EVM address and is not did:jwk" };
+  }
+  const addresses = extractEvmAddressesFromDidDocument(didDocument);
+  if (addresses.some((address) => address.toLowerCase() === expectedAddress.toLowerCase())) {
+    return { valid: true };
+  }
+  return {
+    valid: false,
+    reason: `No matching address found in DID document (expected ${expectedAddress})`
+  };
+}
+async function verifyDidJsonControllerDid(domain, expectedControllerDid, options = {}) {
+  if (!domain || typeof domain !== "string") {
+    throw new OmaTrustError("INVALID_INPUT", "domain must be a non-empty string", { domain });
+  }
+  const didDocument = options.fetchDidDocument ? await options.fetchDidDocument(domain) : await fetchDidDocument(domain);
+  return verifyDidDocumentControllerDid(didDocument, expectedControllerDid);
+}
+function buildEip712Domain(name, version, chainId, verifyingContract) {
+  return { name, version, chainId, verifyingContract };
+}
+function getOmaTrustProofEip712Types() {
+  return {
+    primaryType: "OmaTrustProof",
+    types: {
+      OmaTrustProof: [
+        { name: "signer", type: "address" },
+        { name: "authorizedEntity", type: "string" },
+        { name: "signingPurpose", type: "string" },
+        { name: "creationTimestamp", type: "uint256" },
+        { name: "expirationTimestamp", type: "uint256" },
+        { name: "randomValue", type: "bytes32" },
+        { name: "statement", type: "string" }
+      ]
+    }
+  };
+}
+function verifyEip712Signature(typedData, signature) {
+  try {
+    const signer = verifyTypedData(
+      typedData.domain,
+      typedData.types,
+      typedData.message,
+      signature
+    );
+    return { valid: true, signer };
+  } catch (err) {
+    throw new OmaTrustError("INVALID_INPUT", "Failed to verify EIP-712 signature", { err });
+  }
+}
+
+// src/reputation/proof/dns-txt-record.ts
+function parseDnsTxtRecord(record) {
+  if (!record || typeof record !== "string") {
+    throw new OmaTrustError("INVALID_INPUT", "record must be a non-empty string", { record });
+  }
+  const entries = record.split(/[;\s]+/).map((entry) => entry.trim()).filter(Boolean);
+  const parsed = {};
+  const controllers = [];
+  for (const entry of entries) {
+    const eqIndex = entry.indexOf("=");
+    if (eqIndex === -1) continue;
+    const key = entry.slice(0, eqIndex).trim();
+    const value = entry.slice(eqIndex + 1).trim();
+    if (!key || !value) continue;
+    if (key === "controller") {
+      controllers.push(value);
+    } else {
+      parsed[key] = value;
+    }
+  }
+  return {
+    version: parsed.v,
+    controller: controllers[0],
+    controllers
+  };
+}
+function buildDnsTxtRecord(controllerDid) {
+  const normalized = normalizeDid(controllerDid);
+  return `v=1;controller=${normalized}`;
+}
+var REQUIRED_OFFER_FIELDS = [
+  "version",
+  "resourceUrl",
+  "scheme",
+  "network",
+  "asset",
+  "payTo",
+  "amount"
+];
+var REQUIRED_RECEIPT_FIELDS = [
+  "version",
+  "network",
+  "resourceUrl",
+  "payer",
+  "issuedAt"
+];
+function validateOfferPayload(payload) {
+  for (const field of REQUIRED_OFFER_FIELDS) {
+    if (!(field in payload) || payload[field] === void 0 || payload[field] === null) {
+      return { valid: false, field };
+    }
+  }
+  return { valid: true };
+}
+function validateReceiptPayload(payload) {
+  for (const field of REQUIRED_RECEIPT_FIELDS) {
+    if (!(field in payload) || payload[field] === void 0 || payload[field] === null) {
+      return { valid: false, field };
+    }
+  }
+  return { valid: true };
+}
+function failure(code2, message, partial) {
+  return {
+    valid: false,
+    error: { code: code2, message },
+    ...partial
+  };
+}
+async function verifyX402JwsArtifact(artifact, options) {
+  if (!artifact || typeof artifact !== "object") {
+    return failure("INVALID_ARTIFACT", "Artifact must be a non-null object");
+  }
+  if (artifact.format !== "jws") {
+    return failure("INVALID_ARTIFACT", `Expected format "jws", got "${artifact.format}"`);
+  }
+  if (typeof artifact.signature !== "string" || artifact.signature.length === 0) {
+    return failure("INVALID_ARTIFACT", "Artifact signature must be a non-empty string");
+  }
+  const compactJws = artifact.signature;
+  const parts = compactJws.split(".");
+  if (parts.length !== 3) {
+    return failure("MALFORMED_JWS", "Invalid compact JWS format: expected 3 dot-separated parts");
+  }
+  let header;
+  try {
+    header = decodeProtectedHeader(compactJws);
+  } catch {
+    return failure("MALFORMED_JWS", "Failed to decode JWS protected header");
+  }
+  if (!header.alg || typeof header.alg !== "string") {
+    return failure("MISSING_ALG", "JWS header must include alg", { header });
+  }
+  const kid = typeof header.kid === "string" ? header.kid : null;
+  const embeddedJwk = header.jwk;
+  if (!kid && !embeddedJwk) {
+    return failure(
+      "MISSING_KEY_MATERIAL",
+      "JWS header must include at least one of kid or jwk",
+      { header }
+    );
+  }
+  let publicKeyJwk;
+  let publicKeySource;
+  if (embeddedJwk) {
+    const validation = validatePublicJwk(embeddedJwk);
+    if (!validation.valid) {
+      return failure(
+        "INVALID_EMBEDDED_JWK",
+        `Embedded JWK is invalid: ${validation.error}`,
+        { header }
+      );
+    }
+    publicKeyJwk = embeddedJwk;
+    publicKeySource = "embedded-jwk";
+    if (kid) {
+      try {
+        const resolved = await resolveDidUrlToPublicKey(kid, options?.resolveOptions);
+        if (!publicJwkEquals(publicKeyJwk, resolved.publicKeyJwk)) {
+          return failure(
+            "KEY_CONFLICT",
+            "Embedded jwk conflicts with public key resolved from kid",
+            { header, kid }
+          );
+        }
+      } catch (err) {
+      }
+    }
+  } else {
+    publicKeySource = "kid-resolution";
+    try {
+      const resolved = await resolveDidUrlToPublicKey(kid, options?.resolveOptions);
+      publicKeyJwk = resolved.publicKeyJwk;
+    } catch (err) {
+      const message = err instanceof OmaTrustError ? `Failed to resolve kid "${kid}": ${err.message}` : `Failed to resolve kid "${kid}"`;
+      return failure("KID_RESOLUTION_FAILED", message, { header, kid });
+    }
+  }
+  let payload;
+  try {
+    const key = await importJWK(publicKeyJwk, header.alg);
+    const result = await compactVerify(compactJws, key);
+    const payloadText = new TextDecoder().decode(result.payload);
+    payload = JSON.parse(payloadText);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "Signature verification failed";
+    return failure("SIGNATURE_INVALID", message, { header, kid });
+  }
+  const publicKeyDid = jwkToDidJwk(publicKeyJwk);
+  return {
+    valid: true,
+    header,
+    payload,
+    kid,
+    publicKeyJwk,
+    publicKeySource,
+    publicKeyDid
+  };
+}
+async function verifyX402JwsOffer(artifact, options) {
+  const result = await verifyX402JwsArtifact(artifact, options);
+  if (!result.valid) return result;
+  const payloadCheck = validateOfferPayload(result.payload);
+  if (!payloadCheck.valid) {
+    return failure(
+      "INVALID_OFFER_PAYLOAD",
+      `Missing required offer field: ${payloadCheck.field}`,
+      {
+        header: result.header,
+        payload: result.payload,
+        kid: result.kid,
+        publicKeyJwk: result.publicKeyJwk,
+        publicKeySource: result.publicKeySource,
+        publicKeyDid: result.publicKeyDid
+      }
+    );
+  }
+  return result;
+}
+async function verifyX402JwsReceipt(artifact, options) {
+  const result = await verifyX402JwsArtifact(artifact, options);
+  if (!result.valid) return result;
+  const payloadCheck = validateReceiptPayload(result.payload);
+  if (!payloadCheck.valid) {
+    return failure(
+      "INVALID_RECEIPT_PAYLOAD",
+      `Missing required receipt field: ${payloadCheck.field}`,
+      {
+        header: result.header,
+        payload: result.payload,
+        kid: result.kid,
+        publicKeyJwk: result.publicKeyJwk,
+        publicKeySource: result.publicKeySource,
+        publicKeyDid: result.publicKeyDid
+      }
+    );
+  }
+  return result;
+}
+var OFFER_DOMAIN = {
+  name: "x402 offer",
+  version: "1",
+  chainId: 1
+};
+var RECEIPT_DOMAIN = {
+  name: "x402 receipt",
+  version: "1",
+  chainId: 1
+};
+var OFFER_TYPES = {
+  Offer: [
+    { name: "version", type: "uint256" },
+    { name: "resourceUrl", type: "string" },
+    { name: "scheme", type: "string" },
+    { name: "network", type: "string" },
+    { name: "asset", type: "string" },
+    { name: "payTo", type: "string" },
+    { name: "amount", type: "string" },
+    { name: "validUntil", type: "uint256" }
+  ]
+};
+var RECEIPT_TYPES = {
+  Receipt: [
+    { name: "version", type: "uint256" },
+    { name: "network", type: "string" },
+    { name: "resourceUrl", type: "string" },
+    { name: "payer", type: "string" },
+    { name: "issuedAt", type: "uint256" },
+    { name: "transaction", type: "string" }
+  ]
+};
+var REQUIRED_OFFER_FIELDS2 = [
+  "version",
+  "resourceUrl",
+  "scheme",
+  "network",
+  "asset",
+  "payTo",
+  "amount"
+];
+var REQUIRED_RECEIPT_FIELDS2 = [
+  "version",
+  "network",
+  "resourceUrl",
+  "payer",
+  "issuedAt"
+];
+function validateOfferPayload2(payload) {
+  for (const field of REQUIRED_OFFER_FIELDS2) {
+    if (!(field in payload) || payload[field] === void 0 || payload[field] === null) {
+      return { valid: false, field };
+    }
   }
-  const addresses = extractAddressesFromDidDocument(didDocument);
-  if (addresses.some((address) => address.toLowerCase() === expectedAddress.toLowerCase())) {
-    return { valid: true };
+  return { valid: true };
+}
+function validateReceiptPayload2(payload) {
+  for (const field of REQUIRED_RECEIPT_FIELDS2) {
+    if (!(field in payload) || payload[field] === void 0 || payload[field] === null) {
+      return { valid: false, field };
+    }
   }
+  return { valid: true };
+}
+function failure2(code2, message, partial) {
   return {
     valid: false,
-    reason: `No matching address found in DID document (expected ${expectedAddress})`
+    error: { code: code2, message },
+    ...partial
   };
 }
-async function verifyDidJsonControllerDid(domain, expectedControllerDid, options = {}) {
-  if (!domain || typeof domain !== "string") {
-    throw new OmaTrustError("INVALID_INPUT", "domain must be a non-empty string", { domain });
-  }
-  const didDocument = options.fetchDidDocument ? await options.fetchDidDocument(domain) : await fetchDidDocument(domain);
-  return verifyDidDocumentControllerDid(didDocument, expectedControllerDid);
-}
-function buildEip712Domain(name, version, chainId, verifyingContract) {
-  return { name, version, chainId, verifyingContract };
+function prepareOfferMessage(payload) {
+  return {
+    version: payload.version,
+    resourceUrl: payload.resourceUrl,
+    scheme: payload.scheme,
+    network: payload.network,
+    asset: payload.asset,
+    payTo: payload.payTo,
+    amount: payload.amount,
+    validUntil: payload.validUntil ?? 0
+  };
 }
-function getOmaTrustProofEip712Types() {
+function prepareReceiptMessage(payload) {
   return {
-    primaryType: "OmaTrustProof",
-    types: {
-      OmaTrustProof: [
-        { name: "signer", type: "address" },
-        { name: "authorizedEntity", type: "string" },
-        { name: "signingPurpose", type: "string" },
-        { name: "creationTimestamp", type: "uint256" },
-        { name: "expirationTimestamp", type: "uint256" },
-        { name: "randomValue", type: "bytes32" },
-        { name: "statement", type: "string" }
-      ]
-    }
+    version: payload.version,
+    network: payload.network,
+    resourceUrl: payload.resourceUrl,
+    payer: payload.payer,
+    issuedAt: payload.issuedAt,
+    transaction: payload.transaction ?? ""
   };
 }
-function verifyEip712Signature(typedData, signature) {
-  try {
-    const signer = verifyTypedData(
-      typedData.domain,
-      typedData.types,
-      typedData.message,
-      signature
-    );
-    return { valid: true, signer };
-  } catch (err) {
-    throw new OmaTrustError("INVALID_INPUT", "Failed to verify EIP-712 signature", { err });
+function verifyX402Eip712Artifact(artifact, artifactType) {
+  if (!artifact || typeof artifact !== "object") {
+    return failure2("INVALID_ARTIFACT", "Artifact must be a non-null object");
   }
-}
-
-// src/reputation/proof/dns-txt-record.ts
-function parseDnsTxtRecord(record) {
-  if (!record || typeof record !== "string") {
-    throw new OmaTrustError("INVALID_INPUT", "record must be a non-empty string", { record });
+  if (artifact.format !== "eip712") {
+    return failure2("INVALID_ARTIFACT", `Expected format "eip712", got "${artifact.format}"`);
   }
-  const entries = record.split(/[;\s]+/).map((entry) => entry.trim()).filter(Boolean);
-  const parsed = {};
-  for (const entry of entries) {
-    const [key, ...valueParts] = entry.split("=");
-    if (!key) {
-      continue;
+  if (!artifact.payload || typeof artifact.payload !== "object" || Array.isArray(artifact.payload)) {
+    return failure2("MISSING_PAYLOAD", "EIP-712 artifact must include a payload object");
+  }
+  if (typeof artifact.signature !== "string" || artifact.signature.length === 0) {
+    return failure2("MISSING_SIGNATURE", "EIP-712 artifact must include a non-empty signature");
+  }
+  const payload = artifact.payload;
+  if (artifactType === "offer") {
+    const check = validateOfferPayload2(payload);
+    if (!check.valid) {
+      return failure2(
+        "INVALID_OFFER_PAYLOAD",
+        `Missing required offer field: ${check.field}`,
+        { payload }
+      );
     }
-    const value = valueParts.join("=");
-    if (!value) {
-      continue;
+  } else {
+    const check = validateReceiptPayload2(payload);
+    if (!check.valid) {
+      return failure2(
+        "INVALID_RECEIPT_PAYLOAD",
+        `Missing required receipt field: ${check.field}`,
+        { payload }
+      );
     }
-    parsed[key.trim()] = value.trim();
+  }
+  const domain = artifactType === "offer" ? OFFER_DOMAIN : RECEIPT_DOMAIN;
+  const types = artifactType === "offer" ? OFFER_TYPES : RECEIPT_TYPES;
+  const message = artifactType === "offer" ? prepareOfferMessage(payload) : prepareReceiptMessage(payload);
+  let signer;
+  try {
+    signer = verifyTypedData(
+      domain,
+      types,
+      message,
+      artifact.signature
+    );
+    signer = getAddress(signer);
+  } catch (err) {
+    const message2 = err instanceof Error ? err.message : "EIP-712 signature verification failed";
+    return failure2("SIGNATURE_INVALID", message2, { payload });
   }
   return {
-    version: parsed.v,
-    controller: parsed.controller,
-    ...parsed
+    valid: true,
+    payload,
+    signer,
+    artifactType
   };
 }
-function buildDnsTxtRecord(controllerDid) {
-  const normalized = normalizeDid(controllerDid);
-  return `v=1;controller=${normalized}`;
+function verifyX402Eip712Offer(artifact) {
+  return verifyX402Eip712Artifact(artifact, "offer");
+}
+function verifyX402Eip712Receipt(artifact) {
+  return verifyX402Eip712Artifact(artifact, "receipt");
 }
 
 // src/reputation/verify.ts
@@ -1408,18 +2783,18 @@ function decodeJwtPayload(compactJws) {
   return JSON.parse(json);
 }
 async function verifyProof(params) {
-  const { proof, provider, expectedSubject, expectedController } = params;
+  const { proof, provider, expectedSubjectDid, expectedControllerDid } = params;
   try {
     switch (proof.proofType) {
       case "tx-encoded-value": {
         if (!provider) {
           return { valid: false, proofType: proof.proofType, reason: "Provider is required" };
         }
-        if (!expectedSubject || !expectedController) {
+        if (!expectedSubjectDid || !expectedControllerDid) {
           return {
             valid: false,
             proofType: proof.proofType,
-            reason: "expectedSubject and expectedController are required"
+            reason: "expectedSubjectDid and expectedControllerDid are required"
           };
         }
         const proofObject = proof.proofObject;
@@ -1431,13 +2806,13 @@ async function verifyProof(params) {
           return { valid: false, proofType: proof.proofType, reason: "Transaction not found" };
         }
         const expectedAmount = calculateTransferAmount(
-          expectedSubject,
-          expectedController,
+          expectedSubjectDid,
+          expectedControllerDid,
           chainId,
           getProofPurpose(proof)
         );
-        const subjectAddress = getAddress(extractAddressFromDid(expectedSubject));
-        const controllerAddress = getAddress(extractAddressFromDid(expectedController));
+        const subjectAddress = getAddress(extractAddressFromDid(expectedSubjectDid));
+        const controllerAddress = getAddress(extractAddressFromDid(expectedControllerDid));
         if (tx.from && getAddress(tx.from) !== subjectAddress) {
           return { valid: false, proofType: proof.proofType, reason: "Transaction sender mismatch" };
         }
@@ -1511,6 +2886,38 @@ async function verifyProof(params) {
         if (!proof.proofObject || typeof proof.proofObject !== "object") {
           return { valid: false, proofType: proof.proofType, reason: "Invalid x402 proof object" };
         }
+        const proofObj = proof.proofObject;
+        if (proofObj.format === "jws" && typeof proofObj.signature === "string") {
+          const artifact = {
+            format: "jws",
+            signature: proofObj.signature
+          };
+          const jwsResult = proof.proofType === "x402-offer" ? await verifyX402JwsOffer(artifact) : await verifyX402JwsReceipt(artifact);
+          if (!jwsResult.valid) {
+            return {
+              valid: false,
+              proofType: proof.proofType,
+              reason: jwsResult.error?.message ?? "JWS verification failed"
+            };
+          }
+          return { valid: true, proofType: proof.proofType };
+        }
+        if (proofObj.format === "eip712" && typeof proofObj.signature === "string" && proofObj.payload && typeof proofObj.payload === "object") {
+          const artifact = {
+            format: "eip712",
+            payload: proofObj.payload,
+            signature: proofObj.signature
+          };
+          const eip712Result = proof.proofType === "x402-offer" ? verifyX402Eip712Offer(artifact) : verifyX402Eip712Receipt(artifact);
+          if (!eip712Result.valid) {
+            return {
+              valid: false,
+              proofType: proof.proofType,
+              reason: eip712Result.error?.message ?? "EIP-712 verification failed"
+            };
+          }
+          return { valid: true, proofType: proof.proofType };
+        }
         return { valid: true, proofType: proof.proofType };
       }
       case "evidence-pointer": {
@@ -1522,9 +2929,9 @@ async function verifyProof(params) {
         if (!response.ok) {
           return { valid: false, proofType: proof.proofType, reason: `Evidence fetch failed (${response.status})` };
         }
-        if (object.url.endsWith("/.well-known/did.json") && expectedController) {
+        if (object.url.endsWith("/.well-known/did.json") && expectedControllerDid) {
           const didDoc = await response.json();
-          const didCheck = verifyDidDocumentControllerDid(didDoc, expectedController);
+          const didCheck = verifyDidDocumentControllerDid(didDoc, expectedControllerDid);
           return {
             valid: didCheck.valid,
             proofType: proof.proofType,
@@ -1532,10 +2939,10 @@ async function verifyProof(params) {
           };
         }
         const body = await response.text();
-        if (expectedController && !body.includes(expectedController)) {
+        if (expectedControllerDid && !body.includes(expectedControllerDid)) {
           try {
             const parsed = parseDnsTxtRecord(body);
-            if (parsed.controller !== expectedController) {
+            if (!parsed.controllers.includes(expectedControllerDid)) {
               return {
                 valid: false,
                 proofType: proof.proofType,
@@ -1591,8 +2998,8 @@ async function verifyAttestation(params) {
     const result = await verifyProof({
       proof,
       provider: params.provider,
-      expectedSubject: params.context?.subject,
-      expectedController: params.context?.controller
+      expectedSubjectDid: params.context?.subjectDid,
+      expectedControllerDid: params.context?.controllerDid
     });
     checks[proof.proofType] = result.valid;
     if (!result.valid) {
@@ -1675,25 +3082,479 @@ async function callMethod(params, method) {
   if (!response.ok) {
     return null;
   }
-  return {
-    ok: true,
-    method,
-    details
-  };
+  return {
+    ok: true,
+    method,
+    details
+  };
+}
+async function callControllerWitness(params) {
+  const dnsResult = await callMethod(params, "dns-txt").catch(() => null);
+  if (dnsResult) {
+    return dnsResult;
+  }
+  const didJsonResult = await callMethod(params, "did-json").catch(() => null);
+  if (didJsonResult) {
+    return didJsonResult;
+  }
+  return {
+    ok: false,
+    method: "did-json"
+  };
+}
+var DEFAULT_CONTROLLER_WITNESS_URL = "https://api.omatrust.org/v1/controller-witness";
+async function requestControllerWitness(params) {
+  const url = params.gatewayUrl ?? DEFAULT_CONTROLLER_WITNESS_URL;
+  const body = {
+    subjectDid: params.subjectDid,
+    controllerDid: params.controllerDid
+  };
+  if (params.chainId !== void 0) {
+    body.chainId = params.chainId;
+  }
+  let response;
+  try {
+    response = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      credentials: "include",
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(params.timeoutMs ?? 15e3)
+    });
+  } catch (err) {
+    throw new OmaTrustError("NETWORK_ERROR", "Controller witness request failed", { err });
+  }
+  if (!response.ok) {
+    const errorBody = await response.json().catch(() => ({ error: response.statusText }));
+    throw new OmaTrustError(
+      "API_ERROR",
+      errorBody.error ?? `Controller witness failed: ${response.status}`,
+      { status: response.status, ...errorBody }
+    );
+  }
+  return await response.json();
+}
+var EIP1967_ADMIN_SLOT = "0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103";
+var OWNERSHIP_PATTERNS = [
+  { method: "owner", signature: "function owner() view returns (address)" },
+  { method: "admin", signature: "function admin() view returns (address)" },
+  { method: "getOwner", signature: "function getOwner() view returns (address)" }
+];
+async function readOwnerFromContract(provider, contractAddress, signature, method) {
+  try {
+    const iface = new Interface([signature]);
+    const data = iface.encodeFunctionData(method, []);
+    const result = await provider.call({ to: contractAddress, data });
+    const [value] = iface.decodeFunctionResult(method, result);
+    if (typeof value === "string" && isAddress(value) && value !== ZeroAddress) {
+      return getAddress(value);
+    }
+  } catch {
+  }
+  return null;
+}
+async function discoverContractOwner(provider, contractAddress) {
+  try {
+    const code2 = await provider.getCode(contractAddress);
+    if (code2 === "0x" || code2 === "0x0") {
+      return null;
+    }
+  } catch {
+    return null;
+  }
+  for (const pattern of OWNERSHIP_PATTERNS) {
+    const address = await readOwnerFromContract(
+      provider,
+      contractAddress,
+      pattern.signature,
+      pattern.method
+    );
+    if (address) {
+      return address;
+    }
+  }
+  try {
+    const adminValue = await provider.getStorage(contractAddress, EIP1967_ADMIN_SLOT);
+    if (adminValue && adminValue !== "0x" && adminValue !== "0x0000000000000000000000000000000000000000000000000000000000000000") {
+      const adminAddress = getAddress(`0x${adminValue.slice(-40)}`);
+      if (adminAddress !== ZeroAddress) {
+        return adminAddress;
+      }
+    }
+  } catch {
+  }
+  return null;
+}
+async function discoverControllingWalletDid(provider, contractAddress, chainId) {
+  const owner = await discoverContractOwner(provider, contractAddress);
+  return owner ? buildEvmDidPkh(chainId, owner) : null;
+}
+async function verifyTransferProof(provider, txHash, subjectDid, attesterAddress, chainId) {
+  try {
+    const tx = await provider.getTransaction(txHash);
+    if (!tx || !tx.from || !tx.to) {
+      return false;
+    }
+    if (getAddress(tx.to) !== getAddress(attesterAddress)) {
+      return false;
+    }
+    const attesterDid = buildEvmDidPkh(chainId, attesterAddress);
+    const expectedAmount = calculateTransferAmount(
+      subjectDid,
+      attesterDid,
+      chainId,
+      "shared-control"
+    );
+    const actualValue = BigInt(tx.value ?? 0n);
+    return actualValue === expectedAmount;
+  } catch {
+    return false;
+  }
+}
+
+// src/shared/trust-anchors.ts
+var DEFAULT_TRUST_ANCHORS_URL = "https://api.omatrust.org/v1/trust-anchors";
+var TRUST_ANCHORS_URL = DEFAULT_TRUST_ANCHORS_URL;
+var cachedAnchors = null;
+var cacheTimestamp = 0;
+var CACHE_TTL_MS = 5 * 60 * 1e3;
+async function fetchTrustAnchors(url) {
+  const now = Date.now();
+  if (cachedAnchors && now - cacheTimestamp < CACHE_TTL_MS) {
+    return cachedAnchors;
+  }
+  let res;
+  try {
+    res = await fetch(url ?? TRUST_ANCHORS_URL);
+  } catch (err) {
+    throw new OmaTrustError("NETWORK_ERROR", "Failed to fetch trust anchors", { err });
+  }
+  if (!res.ok) {
+    throw new OmaTrustError("NETWORK_ERROR", `Failed to fetch trust anchors: ${res.status} ${res.statusText}`);
+  }
+  const anchors = await res.json();
+  if (!anchors.version || !anchors.chains || typeof anchors.chains !== "object") {
+    throw new OmaTrustError("INVALID_INPUT", "Invalid trust anchors format");
+  }
+  cachedAnchors = anchors;
+  cacheTimestamp = now;
+  return anchors;
+}
+function getChainAnchors(anchors, caip2) {
+  const chain = anchors.chains[caip2];
+  if (!chain) {
+    throw new OmaTrustError("UNSUPPORTED_CHAIN", `Chain ${caip2} is not in the trust anchors`, {
+      caip2,
+      supportedChains: Object.keys(anchors.chains)
+    });
+  }
+  return chain;
+}
+
+// src/reputation/proof/dns-txt-shared.ts
+async function verifyDnsTxtControllerDid(domain, expectedControllerDid, options = {}) {
+  if (!domain || typeof domain !== "string") {
+    throw new OmaTrustError("INVALID_INPUT", "domain must be a non-empty string", { domain });
+  }
+  if (!options.resolveTxt) {
+    throw new OmaTrustError("NETWORK_ERROR", "No DNS TXT resolver was provided", { domain });
+  }
+  const prefix = options.recordPrefix ?? "_controllers";
+  const host = `${prefix}.${domain.toLowerCase().replace(/\.$/, "")}`;
+  let records;
+  try {
+    records = await options.resolveTxt(host);
+  } catch (err) {
+    throw new OmaTrustError("NETWORK_ERROR", "Failed to resolve DNS TXT records", { domain, err });
+  }
+  for (const recordParts of records) {
+    const record = recordParts.join("");
+    const parsed = parseDnsTxtRecord(record);
+    if (parsed.version !== "1") continue;
+    for (const recordController of parsed.controllers) {
+      if (isSameControllerId(recordController, expectedControllerDid)) {
+        return { valid: true, record };
+      }
+    }
+  }
+  return { valid: false, reason: "Controller DID not found in DNS TXT records" };
+}
+
+// src/reputation/attester-authorization.ts
+var DEFAULT_CHAIN = "eip155:6623";
+var DEFAULT_PURPOSES = ["authentication", "assertionMethod"];
+async function getControllerAuthorization(params) {
+  const chain = params.chain ?? DEFAULT_CHAIN;
+  const purposes = params.purpose && params.purpose.length > 0 ? params.purpose : DEFAULT_PURPOSES;
+  const controllerDid = normalizeDid(params.controllerDid);
+  const controllerMethod = extractDidMethod(controllerDid);
+  const controllerEvmAddress = extractControllerEvmAddress(controllerDid);
+  const anchors = await fetchTrustAnchors();
+  const chainAnchors = getChainAnchors(anchors, chain);
+  const easContractAddress = params.easContractAddress ?? chainAnchors.easContract;
+  const provider = params.provider;
+  const controllerWitnessSchemaUid = chainAnchors.schemas["controller-witness"];
+  const keyBindingSchemaUid = chainAnchors.schemas["key-binding"];
+  const subjectAddress = didToAddress(params.subjectDid);
+  let relevantWitnesses = [];
+  if (controllerWitnessSchemaUid) {
+    const rawWitnesses = await queryByRecipientAndSchema(
+      easContractAddress,
+      provider,
+      subjectAddress,
+      [controllerWitnessSchemaUid],
+      params.fromBlock ?? 0
+    );
+    relevantWitnesses = rawWitnesses.filter((att) => {
+      const witnessController = att.data?.controller;
+      if (typeof witnessController !== "string") return false;
+      return isSameControllerId(witnessController, controllerDid);
+    });
+    relevantWitnesses.sort((a, b) => Number(a.time - b.time));
+  }
+  const controllerWitnesses = relevantWitnesses.map((att) => ({
+    uid: att.uid,
+    issuedAt: att.time,
+    attester: att.attester,
+    method: resolveWitnessMethod(att.data?.method)
+  }));
+  let keyBindingUid = null;
+  let until = null;
+  let keyPurposeStatus = "not-required";
+  if (keyBindingSchemaUid) {
+    const keyBindings = await queryByRecipientAndSchema(
+      easContractAddress,
+      provider,
+      subjectAddress,
+      [keyBindingSchemaUid],
+      params.fromBlock ?? 0
+    );
+    const relevantKeyBindings = keyBindings.filter((att) => controllerMatchesKeyBinding(att, controllerDid, controllerMethod)).sort((a, b) => Number(b.time - a.time));
+    const relevantKeyBinding = relevantKeyBindings[0] ?? null;
+    if (relevantKeyBinding) {
+      keyBindingUid = relevantKeyBinding.uid;
+      if (relevantKeyBinding.revocationTime > 0n) {
+        until = relevantKeyBinding.revocationTime;
+      }
+      const keyPurposes = relevantKeyBinding.data?.keyPurpose;
+      if (!Array.isArray(keyPurposes) || keyPurposes.length === 0) {
+        keyPurposeStatus = "unknown";
+      } else {
+        const allMatched = purposes.every((p) => keyPurposes.includes(p));
+        keyPurposeStatus = allMatched ? "matched" : "mismatch";
+      }
+    }
+  }
+  let currentlyVerified = false;
+  let liveMethod = null;
+  let transferProofVerified = false;
+  let transferProofAnchor = null;
+  const subjectMethod = extractDidMethod(params.subjectDid);
+  if (subjectMethod === "web") {
+    const domain = getDomainFromDidWeb(params.subjectDid);
+    if (domain) {
+      try {
+        const dnsResult = await verifyDnsTxtControllerDid(domain, controllerDid, {
+          resolveTxt: params.resolveTxt
+        });
+        if (dnsResult.valid) {
+          currentlyVerified = true;
+          liveMethod = "dns";
+        }
+      } catch {
+      }
+      if (!currentlyVerified) {
+        try {
+          const fetchDoc = params.fetchDidDocument ?? fetchDidDocument;
+          const didDoc = await fetchDoc(domain);
+          const didJsonResult = verifyDidDocumentControllerDid(didDoc, controllerDid);
+          if (didJsonResult.valid) {
+            currentlyVerified = true;
+            liveMethod = "did-document";
+          }
+        } catch {
+        }
+      }
+    }
+  } else if (subjectMethod === "pkh") {
+    if (isEvmDidPkh(params.subjectDid) && controllerEvmAddress) {
+      const subjectContractAddress = getAddressFromDidPkh(params.subjectDid);
+      const subjectChainId = getChainIdFromDidPkh(params.subjectDid);
+      const chainIdNum = subjectChainId ? Number(subjectChainId) : null;
+      if (subjectContractAddress && chainIdNum) {
+        const ownerAddress = await discoverContractOwner(
+          provider,
+          subjectContractAddress
+        );
+        if (ownerAddress && getAddress(ownerAddress) === getAddress(controllerEvmAddress)) {
+          currentlyVerified = true;
+          liveMethod = "contract-ownership";
+        }
+        if (!currentlyVerified && keyBindingUid) {
+          const relevantKeyBinding = await findKeyBindingWithTransferProof(
+            keyBindingSchemaUid,
+            easContractAddress,
+            provider,
+            subjectAddress,
+            controllerDid,
+            controllerMethod,
+            params.fromBlock ?? 0
+          );
+          if (relevantKeyBinding) {
+            const proofTxHash = relevantKeyBinding.data?.proofTxHash;
+            if (proofTxHash && /^0x[0-9a-fA-F]{64}$/.test(proofTxHash)) {
+              const verified = await verifyTransferProof(
+                provider,
+                proofTxHash,
+                params.subjectDid,
+                controllerEvmAddress,
+                chainIdNum
+              );
+              if (verified) {
+                transferProofVerified = true;
+                transferProofAnchor = relevantKeyBinding.time;
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+  const witnessAnchor = relevantWitnesses.length > 0 ? relevantWitnesses[0].time : null;
+  const anchoredFrom = witnessAnchor ?? transferProofAnchor;
+  const purposeBlocks = keyPurposeStatus === "mismatch";
+  const hasOpenWindow = relevantWitnesses.length > 0 && until === null;
+  const hasKeyBindingWithProof = keyBindingUid !== null && transferProofVerified && until === null;
+  const authorized = !purposeBlocks && (hasOpenWindow || currentlyVerified && until === null || hasKeyBindingWithProof);
+  return {
+    authorized,
+    anchoredFrom,
+    until,
+    currentlyVerified,
+    liveMethod,
+    controllerWitnesses,
+    keyBindingUid,
+    keyPurposeStatus,
+    transferProofVerified: transferProofVerified || void 0
+  };
+}
+function controllerMatchesKeyBinding(att, controllerDid, controllerMethod) {
+  const keyId = att.data?.keyId;
+  if (typeof keyId === "string") {
+    if (isSameControllerId(keyId, controllerDid)) {
+      return true;
+    }
+  }
+  if (controllerMethod === "jwk") {
+    const publicKeyJwkRaw = att.data?.publicKeyJwk;
+    if (publicKeyJwkRaw) {
+      try {
+        const onChainJwk = typeof publicKeyJwkRaw === "string" ? JSON.parse(publicKeyJwkRaw) : publicKeyJwkRaw;
+        const controllerJwk = didJwkToJwk(controllerDid);
+        return publicJwkEquals(onChainJwk, controllerJwk);
+      } catch {
+      }
+    }
+  }
+  return false;
+}
+var EAS_EVENT_ABI2 = [
+  "event Attested(address indexed recipient, address indexed attester, bytes32 uid, bytes32 indexed schemaUID)"
+];
+function resolveWitnessMethod(value) {
+  if (typeof value !== "string") return void 0;
+  switch (value) {
+    case "dns":
+    case "dns-txt":
+      return "dns";
+    case "did-document":
+    case "did-json":
+      return "did-document";
+    case "manual":
+      return "manual";
+    default:
+      return "other";
+  }
 }
-async function callControllerWitness(params) {
-  const dnsResult = await callMethod(params, "dns-txt").catch(() => null);
-  if (dnsResult) {
-    return dnsResult;
+async function queryByRecipientAndSchema(easContractAddress, provider, recipient, schemas, fromBlock) {
+  const contract = new Contract(easContractAddress, EAS_EVENT_ABI2, provider);
+  const filter = contract.filters.Attested(recipient, null);
+  const toBlock = await provider.getBlockNumber();
+  let events;
+  try {
+    events = await contract.queryFilter(filter, fromBlock, toBlock);
+  } catch (err) {
+    throw new OmaTrustError("NETWORK_ERROR", "Failed to query attestation events", { err });
   }
-  const didJsonResult = await callMethod(params, "did-json").catch(() => null);
-  if (didJsonResult) {
-    return didJsonResult;
+  const eas = new EAS(easContractAddress);
+  eas.connect(provider);
+  const schemaFilter = schemas.map((s) => s.toLowerCase());
+  const results = [];
+  for (const event of events) {
+    if (!("args" in event) || !Array.isArray(event.args)) continue;
+    const args = event.args;
+    const uid = args?.[2];
+    const schemaUid = args?.[3];
+    if (!uid || !schemaUid) continue;
+    if (!schemaFilter.includes(schemaUid.toLowerCase())) continue;
+    const attestation = await eas.getAttestation(uid);
+    if (!attestation || !attestation.uid) continue;
+    let data = {};
+    const rawData = attestation.data;
+    if (rawData && rawData !== "0x") {
+      try {
+        data = decodeAttestationData(
+          "string subject, string controller, string method",
+          rawData
+        );
+      } catch {
+        try {
+          data = decodeAttestationData(
+            "string subject, string keyId, string publicKeyJwk, string[] keyPurpose, string[] proofs, uint256 issuedAt, uint256 effectiveAt, uint256 expiresAt",
+            rawData
+          );
+        } catch {
+        }
+      }
+    }
+    const toBigIntSafe = (value) => {
+      if (typeof value === "bigint") return value;
+      if (typeof value === "number") return BigInt(value);
+      if (typeof value === "string" && value.length > 0) return BigInt(value);
+      return 0n;
+    };
+    results.push({
+      uid: attestation.uid,
+      schema: attestation.schema,
+      attester: attestation.attester,
+      recipient: attestation.recipient,
+      revocable: Boolean(attestation.revocable),
+      revocationTime: toBigIntSafe(attestation.revocationTime),
+      expirationTime: toBigIntSafe(attestation.expirationTime),
+      time: toBigIntSafe(attestation.time),
+      refUID: attestation.refUID,
+      data
+    });
   }
-  return {
-    ok: false,
-    method: "did-json"
-  };
+  return results;
+}
+async function findKeyBindingWithTransferProof(keyBindingSchemaUid, easContractAddress, provider, subjectAddress, controllerDid, controllerMethod, fromBlock) {
+  const keyBindings = await queryByRecipientAndSchema(
+    easContractAddress,
+    provider,
+    subjectAddress,
+    [keyBindingSchemaUid],
+    fromBlock
+  );
+  const withProof = keyBindings.filter((att) => {
+    if (!controllerMatchesKeyBinding(att, controllerDid, controllerMethod)) return false;
+    const proofs = att.data?.proofs;
+    if (Array.isArray(proofs)) {
+      return proofs.some((p) => typeof p === "string" && /^0x[0-9a-fA-F]{64}$/.test(p));
+    }
+    return typeof att.data?.proofTxHash === "string";
+  }).sort((a, b) => Number(b.time - a.time));
+  return withProof[0] ?? null;
 }
 
 // src/reputation/proof/tx-interaction.ts
@@ -1803,6 +3664,42 @@ function createX402OfferProof(offer) {
   };
 }
 
+// src/reputation/proof/x402-verify.ts
+async function verifyX402Artifact(artifact, options) {
+  if (!artifact || typeof artifact !== "object") {
+    return {
+      valid: false,
+      error: { code: "INVALID_ARTIFACT", message: "Artifact must be a non-null object" }
+    };
+  }
+  const format = artifact.format;
+  switch (format) {
+    case "jws": {
+      const jwsArtifact = artifact;
+      const jwsOptions = options.resolveOptions ? { resolveOptions: options.resolveOptions } : void 0;
+      if (options.artifactType === "offer") {
+        return verifyX402JwsOffer(jwsArtifact, jwsOptions);
+      }
+      return verifyX402JwsReceipt(jwsArtifact, jwsOptions);
+    }
+    case "eip712": {
+      const eip712Artifact = artifact;
+      if (options.artifactType === "offer") {
+        return verifyX402Eip712Offer(eip712Artifact);
+      }
+      return verifyX402Eip712Receipt(eip712Artifact);
+    }
+    default:
+      return {
+        valid: false,
+        error: {
+          code: "UNSUPPORTED_FORMAT",
+          message: `Unsupported x402 artifact format: "${format}"`
+        }
+      };
+  }
+}
+
 // src/reputation/proof/evidence-pointer.ts
 function createEvidencePointerProof(url) {
   if (!url || typeof url !== "string") {
@@ -1816,63 +3713,12 @@ function createEvidencePointerProof(url) {
     issuedAt: Math.floor(Date.now() / 1e3)
   };
 }
-async function verifyDnsTxtControllerDid(domain, expectedControllerDid, options = {}) {
-  if (!domain || typeof domain !== "string") {
-    throw new OmaTrustError("INVALID_INPUT", "domain must be a non-empty string", { domain });
-  }
-  const expected = normalizeDid(expectedControllerDid);
-  const prefix = options.recordPrefix ?? "_controllers";
-  const host = `${prefix}.${domain.toLowerCase().replace(/\.$/, "")}`;
-  let records;
-  try {
-    records = await (options.resolveTxt ?? resolveTxt)(host);
-  } catch (err) {
-    throw new OmaTrustError("NETWORK_ERROR", "Failed to resolve DNS TXT records", { domain, err });
-  }
-  for (const recordParts of records) {
-    const record = recordParts.join("");
-    const parsed = parseDnsTxtRecord(record);
-    if (parsed.version === "1" && parsed.controller && normalizeDid(parsed.controller) === expected) {
-      return { valid: true, record };
-    }
-  }
-  return { valid: false, reason: "No TXT record matched expected controller DID" };
-}
-
-// src/reputation/proof/dns-txt-shared.ts
-async function verifyDnsTxtControllerDid2(domain, expectedControllerDid, options = {}) {
-  if (!domain || typeof domain !== "string") {
-    throw new OmaTrustError("INVALID_INPUT", "domain must be a non-empty string", { domain });
-  }
-  if (!options.resolveTxt) {
-    throw new OmaTrustError("NETWORK_ERROR", "No DNS TXT resolver was provided", { domain });
-  }
-  const expected = normalizeDid(expectedControllerDid);
-  const prefix = options.recordPrefix ?? "_controllers";
-  const host = `${prefix}.${domain.toLowerCase().replace(/\.$/, "")}`;
-  let records;
-  try {
-    records = await options.resolveTxt(host);
-  } catch (err) {
-    throw new OmaTrustError("NETWORK_ERROR", "Failed to resolve DNS TXT records", { domain, err });
-  }
-  for (const recordParts of records) {
-    const record = recordParts.join("");
-    const parsed = parseDnsTxtRecord(record);
-    if (parsed.version === "1" && parsed.controller && normalizeDid(parsed.controller) === expected) {
-      return { valid: true, record };
-    }
-  }
-  return { valid: false, reason: "No TXT record matched expected controller DID" };
+function verifyDnsTxtControllerDid2(domain, expectedControllerDid, options = {}) {
+  return verifyDnsTxtControllerDid(domain, expectedControllerDid, {
+    ...options,
+    resolveTxt: options.resolveTxt ?? resolveTxt
+  });
 }
-
-// src/reputation/proof/subject-ownership.ts
-var EIP1967_ADMIN_SLOT = "0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103";
-var OWNERSHIP_PATTERNS = [
-  { method: "owner", signature: "function owner() view returns (address)" },
-  { method: "admin", signature: "function admin() view returns (address)" },
-  { method: "getOwner", signature: "function getOwner() view returns (address)" }
-];
 function assertConnectedWalletDid(input) {
   const normalized = normalizeDid(input);
   if (extractDidMethod(normalized) !== "pkh") {
@@ -1885,43 +3731,6 @@ function assertConnectedWalletDid(input) {
 function normalizeSubjectDid(input) {
   return normalizeDid(input);
 }
-async function readAddressFromContract(provider, contractAddress, signature, method) {
-  try {
-    const iface = new Interface([signature]);
-    const data = iface.encodeFunctionData(method, []);
-    const result = await provider.call({ to: contractAddress, data });
-    const [value] = iface.decodeFunctionResult(method, result);
-    if (typeof value === "string" && isAddress(value) && value !== ZeroAddress) {
-      return getAddress(value);
-    }
-  } catch {
-  }
-  return null;
-}
-async function discoverControllingWallet(provider, contractAddress, chainId) {
-  for (const pattern of OWNERSHIP_PATTERNS) {
-    const address = await readAddressFromContract(
-      provider,
-      contractAddress,
-      pattern.signature,
-      pattern.method
-    );
-    if (address) {
-      return buildEvmDidPkh(chainId, address);
-    }
-  }
-  try {
-    const adminValue = await provider.getStorage(contractAddress, EIP1967_ADMIN_SLOT);
-    if (adminValue && adminValue !== "0x" && adminValue !== "0x0000000000000000000000000000000000000000000000000000000000000000") {
-      const adminAddress = getAddress(`0x${adminValue.slice(-40)}`);
-      if (adminAddress !== ZeroAddress) {
-        return buildEvmDidPkh(chainId, adminAddress);
-      }
-    }
-  } catch {
-  }
-  return null;
-}
 async function verifyDidWebOwnership(params) {
   const subjectDid = normalizeSubjectDid(params.subjectDid);
   const connectedWalletDid = assertConnectedWalletDid(params.connectedWalletDid);
@@ -1933,7 +3742,7 @@ async function verifyDidWebOwnership(params) {
   }
   let dnsReason;
   try {
-    const dnsResult = await verifyDnsTxtControllerDid2(domain, connectedWalletDid, {
+    const dnsResult = await verifyDnsTxtControllerDid(domain, connectedWalletDid, {
       resolveTxt: params.resolveTxt,
       recordPrefix: params.recordPrefix
     });
@@ -1999,8 +3808,8 @@ async function verifyDidPkhOwnership(params) {
       subjectDid: params.subjectDid
     });
   }
-  const code = await params.provider.getCode(subjectAddress);
-  const isContract = code !== "0x" && code !== "0x0";
+  const code2 = await params.provider.getCode(subjectAddress);
+  const isContract = code2 !== "0x" && code2 !== "0x0";
   if (!isContract) {
     if (getAddress(subjectAddress) === getAddress(connectedWalletAddress)) {
       return {
@@ -2019,7 +3828,7 @@ async function verifyDidPkhOwnership(params) {
       connectedWalletDid
     };
   }
-  const controllingWalletDid = await discoverControllingWallet(params.provider, subjectAddress, chainId);
+  const controllingWalletDid = await discoverControllingWalletDid(params.provider, subjectAddress, chainId);
   if (params.txHash) {
     if (!controllingWalletDid) {
       return {
@@ -2102,7 +3911,7 @@ async function verifyDidPkhOwnership(params) {
     };
   }
   for (const pattern of OWNERSHIP_PATTERNS) {
-    const ownerAddress = await readAddressFromContract(
+    const ownerAddress = await readOwnerFromContract(
       params.provider,
       subjectAddress,
       pattern.signature,
@@ -2176,6 +3985,300 @@ async function verifySubjectOwnership(params) {
     subjectDid
   });
 }
+function extractEip712Signer(proof) {
+  const { domain, message, signature } = proof.proofObject;
+  const typedData = {
+    domain,
+    types: {
+      OmaTrustProof: [
+        { name: "signer", type: "address" },
+        { name: "authorizedEntity", type: "string" },
+        { name: "signingPurpose", type: "string" },
+        { name: "creationTimestamp", type: "uint256" },
+        { name: "expirationTimestamp", type: "uint256" },
+        { name: "randomValue", type: "bytes32" },
+        { name: "statement", type: "string" }
+      ]
+    },
+    message
+  };
+  try {
+    const result = verifyEip712Signature(typedData, signature);
+    return result.valid && result.signer ? result.signer : null;
+  } catch (err) {
+    console.warn("[omatrust] EIP-712 signer extraction failed:", err);
+    return null;
+  }
+}
+function extractJwsHeaderJwk(proof) {
+  const jws = proof.proofObject;
+  if (typeof jws !== "string") return null;
+  const parts = jws.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const headerB64 = parts[0].replace(/-/g, "+").replace(/_/g, "/");
+    const padded = headerB64.padEnd(
+      headerB64.length + (4 - headerB64.length % 4) % 4,
+      "="
+    );
+    let headerJson;
+    if (typeof atob === "function") {
+      headerJson = decodeURIComponent(
+        Array.from(atob(padded)).map((char) => `%${char.charCodeAt(0).toString(16).padStart(2, "0")}`).join("")
+      );
+    } else {
+      headerJson = Buffer.from(padded, "base64").toString("utf8");
+    }
+    const header = JSON.parse(headerJson);
+    return header.jwk ?? null;
+  } catch {
+    return null;
+  }
+}
+function extractJwsPayload(proof) {
+  const jws = proof.proofObject;
+  if (typeof jws !== "string") return null;
+  const parts = jws.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const payloadB64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const padded = payloadB64.padEnd(
+      payloadB64.length + (4 - payloadB64.length % 4) % 4,
+      "="
+    );
+    let payloadJson;
+    if (typeof atob === "function") {
+      payloadJson = decodeURIComponent(
+        Array.from(atob(padded)).map((char) => `%${char.charCodeAt(0).toString(16).padStart(2, "0")}`).join("")
+      );
+    } else {
+      payloadJson = Buffer.from(padded, "base64").toString("utf8");
+    }
+    return JSON.parse(payloadJson);
+  } catch {
+    return null;
+  }
+}
+function signerMatchesDid(signerAddress, did) {
+  try {
+    const didAddress = extractAddressFromDid(did);
+    return getAddress(signerAddress).toLowerCase() === getAddress(didAddress).toLowerCase();
+  } catch {
+    return false;
+  }
+}
+function jwkMatchesDid(jwk, did) {
+  const method = extractDidMethod(did);
+  if (method === "jwk") {
+    try {
+      const didJwk = didJwkToJwk(did);
+      return publicJwkEquals(jwk, didJwk);
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+function proofSignerMatchesDid(proof, did) {
+  switch (proof.proofType) {
+    case "pop-eip712": {
+      const signer = extractEip712Signer(proof);
+      if (!signer) return false;
+      return signerMatchesDid(signer, did);
+    }
+    case "pop-jws": {
+      const jwsProof = proof;
+      const jwk = extractJwsHeaderJwk(jwsProof);
+      if (jwk && jwkMatchesDid(jwk, did)) return true;
+      const payload = extractJwsPayload(jwsProof);
+      if (payload && typeof payload.iss === "string") {
+        if (payload.iss === did) return true;
+      }
+      return false;
+    }
+    case "tx-encoded-value":
+    case "tx-interaction":
+      return false;
+    case "evidence-pointer":
+      return false;
+    default:
+      return false;
+  }
+}
+function proofAuthorizedEntityMatchesDid(proof, did) {
+  switch (proof.proofType) {
+    case "pop-eip712": {
+      const eip712 = proof;
+      const authorizedEntity = eip712.proofObject.message.authorizedEntity;
+      return typeof authorizedEntity === "string" && authorizedEntity === did;
+    }
+    case "pop-jws": {
+      const payload = extractJwsPayload(proof);
+      if (!payload) return false;
+      return typeof payload.aud === "string" && payload.aud === did;
+    }
+    default:
+      return false;
+  }
+}
+function verifyLinkedIdentifierProofs(data) {
+  if (!data.subject || !data.linkedId) {
+    return {
+      valid: false,
+      checks: [],
+      reasons: ["subject and linkedId are required"]
+    };
+  }
+  if (!Array.isArray(data.proofs) || data.proofs.length === 0) {
+    return {
+      valid: false,
+      checks: [],
+      reasons: ["At least one proof is required"]
+    };
+  }
+  const checks = [];
+  let subjectProved = false;
+  let linkedIdProved = false;
+  for (let i = 0; i < data.proofs.length; i++) {
+    const proof = data.proofs[i];
+    if (proofSignerMatchesDid(proof, data.subject)) {
+      checks.push({
+        proofIndex: i,
+        proofType: proof.proofType,
+        checkType: "signer-is-subject",
+        valid: true
+      });
+      subjectProved = true;
+      if (!proofAuthorizedEntityMatchesDid(proof, data.linkedId)) {
+        checks.push({
+          proofIndex: i,
+          proofType: proof.proofType,
+          checkType: "signer-is-subject",
+          valid: false,
+          reason: "Proof from subject does not authorize linkedId (aud mismatch)"
+        });
+      }
+    }
+    if (proofSignerMatchesDid(proof, data.linkedId)) {
+      checks.push({
+        proofIndex: i,
+        proofType: proof.proofType,
+        checkType: "signer-is-linkedId",
+        valid: true
+      });
+      linkedIdProved = true;
+      if (!proofAuthorizedEntityMatchesDid(proof, data.subject)) {
+        checks.push({
+          proofIndex: i,
+          proofType: proof.proofType,
+          checkType: "signer-is-linkedId",
+          valid: false,
+          reason: "Proof from linkedId does not authorize subject (aud mismatch)"
+        });
+      }
+    }
+    if (proof.proofType === "evidence-pointer") {
+      checks.push({
+        proofIndex: i,
+        proofType: proof.proofType,
+        checkType: "signer-is-subject",
+        valid: true,
+        reason: "Evidence pointer accepted (requires URL fetch for full verification)"
+      });
+      subjectProved = true;
+    }
+  }
+  const reasons = [];
+  if (!subjectProved) {
+    reasons.push("No proof demonstrates control by subject");
+  }
+  if (!linkedIdProved) {
+    reasons.push("No proof demonstrates control by linkedId");
+  }
+  return {
+    valid: reasons.length === 0,
+    checks,
+    reasons
+  };
+}
+function verifyKeyBindingProofs(data) {
+  if (!data.subject || !data.keyId) {
+    return {
+      valid: false,
+      checks: [],
+      reasons: ["subject and keyId are required"]
+    };
+  }
+  if (!Array.isArray(data.proofs) || data.proofs.length === 0) {
+    return {
+      valid: false,
+      checks: [],
+      reasons: ["At least one proof is required"]
+    };
+  }
+  const checks = [];
+  let subjectAuthorizedKey = false;
+  for (let i = 0; i < data.proofs.length; i++) {
+    const proof = data.proofs[i];
+    if (proofSignerMatchesDid(proof, data.subject)) {
+      const authorizesKey = proofAuthorizedEntityMatchesDid(proof, data.keyId);
+      checks.push({
+        proofIndex: i,
+        proofType: proof.proofType,
+        checkType: "signer-is-subject-for-key",
+        valid: authorizesKey,
+        reason: authorizesKey ? void 0 : "Proof signed by subject but does not authorize the keyId"
+      });
+      if (authorizesKey) {
+        subjectAuthorizedKey = true;
+      }
+    }
+    if (proofSignerMatchesDid(proof, data.keyId)) {
+      checks.push({
+        proofIndex: i,
+        proofType: proof.proofType,
+        checkType: "signer-is-keyId",
+        valid: true,
+        reason: "Key proved possession (supplementary, not sufficient alone)"
+      });
+    }
+    if (proof.proofType === "evidence-pointer") {
+      checks.push({
+        proofIndex: i,
+        proofType: proof.proofType,
+        checkType: "signer-is-subject-for-key",
+        valid: true,
+        reason: "Evidence pointer accepted (requires URL fetch for full verification)"
+      });
+      subjectAuthorizedKey = true;
+    }
+  }
+  if (data.publicKeyJwk && extractDidMethod(data.keyId) === "jwk") {
+    try {
+      const keyIdJwk = didJwkToJwk(data.keyId);
+      const jwkConsistent = publicJwkEquals(data.publicKeyJwk, keyIdJwk);
+      if (!jwkConsistent) {
+        return {
+          valid: false,
+          checks,
+          reasons: ["publicKeyJwk does not match the key material in keyId (did:jwk)"]
+        };
+      }
+    } catch {
+    }
+  }
+  const reasons = [];
+  if (!subjectAuthorizedKey) {
+    reasons.push(
+      "No proof demonstrates that subject authorized the key binding"
+    );
+  }
+  return {
+    valid: reasons.length === 0,
+    checks,
+    reasons
+  };
+}
 
 // src/app-registry/index.ts
 var app_registry_exports = {};
@@ -2263,8 +4366,8 @@ function getInterfaceTypes(bitmap) {
 }
 
 // src/app-registry/status.ts
-function registryCodeToStatus(code) {
-  switch (code) {
+function registryCodeToStatus(code2) {
+  switch (code2) {
     case 0:
       return "Active";
     case 1:
@@ -2272,7 +4375,7 @@ function registryCodeToStatus(code) {
     case 2:
       return "Replaced";
     default:
-      throw new OmaTrustError("INVALID_INPUT", "Invalid registry status code", { code });
+      throw new OmaTrustError("INVALID_INPUT", "Invalid registry status code", { code: code2 });
   }
 }
 function registryStatusToCode(status) {
@@ -2374,6 +4477,9 @@ async function computeDataHashFromUrl(url, algorithm) {
   if (!url || typeof url !== "string") {
     throw new OmaTrustError("INVALID_INPUT", "url must be a non-empty string", { url });
   }
+  if (algorithm !== "keccak256" && algorithm !== "sha256") {
+    throw new OmaTrustError("INVALID_INPUT", `Unsupported hash algorithm: "${algorithm}". Must be "keccak256" or "sha256".`, { algorithm });
+  }
   const json = await fetchJson(url);
   const jcsJson = canonicalizeJson(json);
   return hashJcs(jcsJson, algorithm);