@oma3/omatrust 0.1.0-alpha.10 → 0.1.0-alpha.12

package/dist/identity/index.js

@@ -1,5 +1,11 @@
 import { keccak256, toUtf8Bytes, isAddress, getAddress, sha256 } from 'ethers';
+import { base64url, calculateJwkThumbprint } from 'jose';
 import canonicalize from 'canonicalize';
+import { CID } from 'multiformats/cid';
+import { sha256 as sha256$1 } from 'multiformats/hashes/sha2';
+import * as raw from 'multiformats/codecs/raw';
+import { base32 } from 'multiformats/bases/base32';
+import { base58btc } from 'multiformats/bases/base58';
 
 // src/identity/did.ts
 
@@ -7,18 +13,23 @@ import canonicalize from 'canonicalize';
 var OmaTrustError = class extends Error {
   code;
   details;
-  constructor(code, message, details) {
+  constructor(code2, message, details) {
     super(message);
     this.name = "OmaTrustError";
-    this.code = code;
+    this.code = code2;
     this.details = details;
   }
 };
 
 // src/shared/assert.ts
-function assertString(value, name, code = "INVALID_INPUT") {
+function assertString(value, name, code2 = "INVALID_INPUT") {
   if (typeof value !== "string" || value.trim().length === 0) {
-    throw new OmaTrustError(code, `${name} must be a non-empty string`, { value });
+    throw new OmaTrustError(code2, `${name} must be a non-empty string`, { value });
+  }
+}
+function assertObject(value, name, code2 = "INVALID_INPUT") {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new OmaTrustError(code2, `${name} must be an object`, { value });
   }
 }
 
@@ -75,6 +86,158 @@ function parseCaip2(caip2) {
   }
   return { namespace, reference };
 }
+var VALID_KTY = /* @__PURE__ */ new Set(["EC", "OKP", "RSA"]);
+var PRIVATE_KEY_FIELDS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth"]);
+var REQUIRED_PUBLIC_FIELDS = {
+  EC: ["crv", "x", "y"],
+  OKP: ["crv", "x"],
+  RSA: ["n", "e"]
+};
+function validatePublicJwk(jwk) {
+  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
+    return { valid: false, error: "JWK must be a non-null object" };
+  }
+  const obj = jwk;
+  const kty = obj.kty;
+  if (typeof kty !== "string" || !VALID_KTY.has(kty)) {
+    return {
+      valid: false,
+      error: `Invalid or missing kty (must be one of: ${[...VALID_KTY].join(", ")})`
+    };
+  }
+  for (const field of PRIVATE_KEY_FIELDS) {
+    if (field in obj) {
+      return {
+        valid: false,
+        error: `JWK contains private key field "${field}" \u2014 only public keys are allowed`
+      };
+    }
+  }
+  const required = REQUIRED_PUBLIC_FIELDS[kty];
+  if (required) {
+    for (const field of required) {
+      if (!(field in obj) || obj[field] === void 0 || obj[field] === null || obj[field] === "") {
+        return {
+          valid: false,
+          error: `Missing required public key field "${field}" for kty="${kty}"`
+        };
+      }
+    }
+  }
+  return { valid: true };
+}
+function canonicalizeJwkJson(jwk) {
+  const sorted = Object.keys(jwk).sort();
+  const obj = {};
+  for (const key of sorted) {
+    obj[key] = jwk[key];
+  }
+  return JSON.stringify(obj);
+}
+function jwkToDidJwk(jwk) {
+  assertObject(jwk, "jwk", "INVALID_JWK");
+  const validation = validatePublicJwk(jwk);
+  if (!validation.valid) {
+    throw new OmaTrustError("INVALID_JWK", validation.error ?? "Invalid public JWK", { jwk });
+  }
+  const canonical = canonicalizeJwkJson(jwk);
+  const encoded = base64url.encode(new TextEncoder().encode(canonical));
+  return `did:jwk:${encoded}`;
+}
+function didJwkToJwk(didJwk) {
+  if (typeof didJwk !== "string" || !didJwk.startsWith("did:jwk:")) {
+    throw new OmaTrustError("INVALID_DID", "Expected a did:jwk DID", { input: didJwk });
+  }
+  const parts = didJwk.split(":");
+  if (parts.length !== 3) {
+    throw new OmaTrustError("INVALID_DID", "did:jwk must have exactly 3 colon-separated parts", {
+      input: didJwk
+    });
+  }
+  const encoded = parts[2];
+  if (!encoded || encoded.length === 0) {
+    throw new OmaTrustError("INVALID_DID", "Missing base64url-encoded JWK identifier", {
+      input: didJwk
+    });
+  }
+  let decoded;
+  try {
+    const bytes = base64url.decode(encoded);
+    decoded = new TextDecoder().decode(bytes);
+  } catch {
+    throw new OmaTrustError("INVALID_DID", "Failed to base64url-decode did:jwk identifier", {
+      input: didJwk
+    });
+  }
+  let jwk;
+  try {
+    jwk = JSON.parse(decoded);
+  } catch {
+    throw new OmaTrustError("INVALID_DID", "Decoded did:jwk identifier is not valid JSON", {
+      input: didJwk
+    });
+  }
+  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
+    throw new OmaTrustError("INVALID_DID", "Decoded did:jwk must be a JSON object", {
+      input: didJwk
+    });
+  }
+  const validation = validatePublicJwk(jwk);
+  if (!validation.valid) {
+    throw new OmaTrustError("INVALID_DID", validation.error ?? "Invalid public JWK in did:jwk", {
+      input: didJwk
+    });
+  }
+  return jwk;
+}
+function extractPublicKeyFields(jwk) {
+  const result = {};
+  const metadataFields = /* @__PURE__ */ new Set(["kid", "use", "key_ops", "alg", "ext"]);
+  for (const [key, value] of Object.entries(jwk)) {
+    if (PRIVATE_KEY_FIELDS.has(key)) continue;
+    if (metadataFields.has(key)) continue;
+    result[key] = value;
+  }
+  return result;
+}
+function publicJwkEquals(a, b) {
+  assertObject(a, "a", "INVALID_JWK");
+  assertObject(b, "b", "INVALID_JWK");
+  const aObj = a;
+  const bObj = b;
+  for (const field of PRIVATE_KEY_FIELDS) {
+    if (field in aObj) {
+      throw new OmaTrustError(
+        "INVALID_JWK",
+        `First JWK contains private key field "${field}"`,
+        { field }
+      );
+    }
+    if (field in bObj) {
+      throw new OmaTrustError(
+        "INVALID_JWK",
+        `Second JWK contains private key field "${field}"`,
+        { field }
+      );
+    }
+  }
+  const aPublic = extractPublicKeyFields(aObj);
+  const bPublic = extractPublicKeyFields(bObj);
+  return canonicalizeJwkJson(aPublic) === canonicalizeJwkJson(bPublic);
+}
+async function computeJwkThumbprint(jwk, digestAlgorithm = "sha256") {
+  assertObject(jwk, "jwk", "INVALID_JWK");
+  const validation = validatePublicJwk(jwk);
+  if (!validation.valid) {
+    throw new OmaTrustError("INVALID_JWK", validation.error ?? "Invalid public JWK", { jwk });
+  }
+  const alg = digestAlgorithm === "sha256" ? "sha256" : digestAlgorithm === "sha384" ? "sha384" : "sha512";
+  return calculateJwkThumbprint(jwk, alg);
+}
+async function formatJktValue(jwk) {
+  const thumbprint = await computeJwkThumbprint(jwk, "sha256");
+  return `jkt=S256:${thumbprint}`;
+}
 
 // src/identity/did.ts
 var DID_REGEX = /^did:[a-z0-9]+:.+$/i;
@@ -150,7 +313,7 @@ function normalizeDidKey(input) {
 }
 function normalizeDid(input) {
   assertString(input, "input", "INVALID_DID");
-  const trimmed = input.trim();
+  const trimmed = input.trim().split("#")[0];
   if (!trimmed.startsWith("did:")) {
     return normalizeDidWeb(trimmed);
   }
@@ -167,6 +330,8 @@ function normalizeDid(input) {
       return normalizeDidHandle(trimmed);
     case "key":
       return normalizeDidKey(trimmed);
+    case "jwk":
+      return normalizeDidJwk(trimmed);
     default:
       return trimmed;
   }
@@ -270,26 +435,838 @@ function extractAddressFromDid(identifier) {
   }
   throw new OmaTrustError("INVALID_DID", "Unsupported identifier format", { identifier });
 }
+var CAIP2_NAMESPACE_REGEX = /^[a-z0-9-]{3,8}$/;
+var BASE64URL_REGEX = /^[A-Za-z0-9_-]+$/;
+var VALID_JWK_KTY = /* @__PURE__ */ new Set(["EC", "OKP", "RSA"]);
+function isPrivateKeyDid(did) {
+  return validatePrivateKeyDid(did).valid;
+}
+function validatePrivateKeyDid(did) {
+  if (typeof did !== "string" || did.trim().length === 0) {
+    return { valid: false, method: null, error: "DID must be a non-empty string" };
+  }
+  const trimmed = did.trim();
+  const method = extractDidMethod(trimmed);
+  switch (method) {
+    case "pkh":
+      return validateDidPkh(trimmed);
+    case "jwk":
+      return validateDidJwk(trimmed);
+    default:
+      return {
+        valid: false,
+        method: null,
+        error: method ? `DID method "${method}" is not a recognized private-key method` : "Invalid DID format"
+      };
+  }
+}
+function validateDidPkh(did) {
+  const parts = did.split(":");
+  if (parts.length !== 5) {
+    return {
+      valid: false,
+      method: "pkh",
+      error: `did:pkh must have exactly 5 colon-separated parts, got ${parts.length}`
+    };
+  }
+  const [, , namespace, chainId, address] = parts;
+  if (!namespace) {
+    return { valid: false, method: "pkh", error: "Missing namespace" };
+  }
+  if (!CAIP2_NAMESPACE_REGEX.test(namespace)) {
+    return {
+      valid: false,
+      method: "pkh",
+      error: `Invalid CAIP-2 namespace "${namespace}" (must be 3-8 lowercase alphanumeric/hyphen chars)`
+    };
+  }
+  if (!chainId) {
+    return { valid: false, method: "pkh", error: "Missing chain ID (reference)" };
+  }
+  if (!address) {
+    return { valid: false, method: "pkh", error: "Missing address" };
+  }
+  if (namespace === "eip155") {
+    if (!/^\d+$/.test(chainId)) {
+      return {
+        valid: false,
+        method: "pkh",
+        error: `Invalid eip155 chain ID "${chainId}" (must be numeric)`
+      };
+    }
+    if (!isAddress(address)) {
+      return {
+        valid: false,
+        method: "pkh",
+        error: `Invalid EVM address "${address}" (must be 0x + 40 hex chars)`
+      };
+    }
+  }
+  if (namespace === "solana") {
+    if (!/^[1-9A-HJ-NP-Za-km-z]{32,44}$/.test(address)) {
+      return {
+        valid: false,
+        method: "pkh",
+        error: `Invalid Solana address "${address}" (must be 32-44 base58 characters)`
+      };
+    }
+  }
+  return { valid: true, method: "pkh" };
+}
+function validateDidJwk(did) {
+  const parts = did.split(":");
+  if (parts.length !== 3) {
+    return {
+      valid: false,
+      method: "jwk",
+      error: `did:jwk must have exactly 3 colon-separated parts, got ${parts.length}`
+    };
+  }
+  const [, , encoded] = parts;
+  if (!encoded || encoded.length === 0) {
+    return { valid: false, method: "jwk", error: "Missing base64url-encoded JWK identifier" };
+  }
+  if (!BASE64URL_REGEX.test(encoded)) {
+    return {
+      valid: false,
+      method: "jwk",
+      error: "Identifier contains invalid base64url characters"
+    };
+  }
+  let decoded;
+  try {
+    const bytes = base64url.decode(encoded);
+    decoded = new TextDecoder().decode(bytes);
+  } catch {
+    return { valid: false, method: "jwk", error: "Failed to base64url-decode identifier" };
+  }
+  let jwk;
+  try {
+    jwk = JSON.parse(decoded);
+  } catch {
+    return { valid: false, method: "jwk", error: "Decoded identifier is not valid JSON" };
+  }
+  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
+    return { valid: false, method: "jwk", error: "Decoded JWK must be a JSON object" };
+  }
+  const kty = jwk.kty;
+  if (typeof kty !== "string" || !VALID_JWK_KTY.has(kty)) {
+    return {
+      valid: false,
+      method: "jwk",
+      error: `Invalid or missing kty field (must be one of: EC, OKP, RSA)`
+    };
+  }
+  if ("d" in jwk) {
+    return {
+      valid: false,
+      method: "jwk",
+      error: "DID must reference a public key \u2014 private key component (d) is not allowed"
+    };
+  }
+  const jwkValidation = validatePublicJwk(jwk);
+  if (!jwkValidation.valid) {
+    return { valid: false, method: "jwk", error: jwkValidation.error };
+  }
+  return { valid: true, method: "jwk" };
+}
+function normalizeDidJwk(input) {
+  assertString(input, "input", "INVALID_DID");
+  const trimmed = input.trim();
+  if (!trimmed.startsWith("did:jwk:")) {
+    throw new OmaTrustError("INVALID_DID", "Expected did:jwk DID", { input });
+  }
+  const result = validateDidJwk(trimmed);
+  if (!result.valid) {
+    throw new OmaTrustError("INVALID_DID", result.error ?? "Invalid did:jwk", { input });
+  }
+  return trimmed;
+}
+
+// src/identity/did-url.ts
+var DID_URL_REGEX = /^did:[a-z0-9]+:.+$/i;
+function parseDidUrl(input) {
+  assertString(input, "input", "INVALID_DID_URL");
+  const trimmed = input.trim();
+  const hashIndex = trimmed.indexOf("#");
+  let did;
+  let fragment;
+  if (hashIndex === -1) {
+    did = trimmed;
+    fragment = null;
+  } else {
+    did = trimmed.slice(0, hashIndex);
+    const rawFragment = trimmed.slice(hashIndex + 1);
+    if (rawFragment.length === 0) {
+      throw new OmaTrustError(
+        "INVALID_DID_URL",
+        "DID URL has empty fragment (trailing '#' with no identifier)",
+        { input }
+      );
+    }
+    fragment = rawFragment;
+  }
+  if (!DID_URL_REGEX.test(did)) {
+    throw new OmaTrustError(
+      "INVALID_DID_URL",
+      "Invalid DID URL: base DID portion is malformed",
+      { input, did }
+    );
+  }
+  return {
+    didUrl: trimmed,
+    did,
+    fragment
+  };
+}
+function isDidUrl(input) {
+  if (typeof input !== "string") return false;
+  const trimmed = input.trim();
+  return trimmed.includes("#") && DID_URL_REGEX.test(trimmed.split("#")[0]);
+}
+function assertBareDid(input, paramName = "did") {
+  assertString(input, paramName, "INVALID_DID");
+  if (isDidUrl(input)) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `Expected a bare DID but received a DID URL with a fragment. Use parseDidUrl() to handle DID URLs.`,
+      { input }
+    );
+  }
+}
+
+// src/shared/did-document.ts
+async function fetchDidDocument(domain) {
+  const normalized = domain.toLowerCase().replace(/\.$/, "");
+  const url = `https://${normalized}/.well-known/did.json`;
+  let response;
+  try {
+    response = await fetch(url, { headers: { Accept: "application/json" } });
+  } catch (err) {
+    throw new OmaTrustError("NETWORK_ERROR", "Failed to fetch DID document", { domain, err });
+  }
+  if (!response.ok) {
+    throw new OmaTrustError("NETWORK_ERROR", `DID document fetch failed: ${response.status}`, {
+      domain,
+      status: response.status
+    });
+  }
+  return await response.json();
+}
+
+// src/identity/resolve-key.ts
+function findVerificationMethod(didDocument, didUrl, fragment) {
+  const methods = didDocument.verificationMethod;
+  if (!Array.isArray(methods)) {
+    return null;
+  }
+  for (const method of methods) {
+    if (!method || typeof method !== "object") continue;
+    const id = method.id;
+    if (typeof id !== "string") continue;
+    if (id === didUrl) return method;
+    if (fragment && (id === `#${fragment}` || id.endsWith(`#${fragment}`))) {
+      return method;
+    }
+  }
+  return null;
+}
+function extractMethodIdsFromDidDocument(didDocument) {
+  const methods = didDocument.verificationMethod;
+  if (!Array.isArray(methods)) return [];
+  return methods.filter((m) => m && typeof m.id === "string").map((m) => m.id);
+}
+async function resolveDidUrlToPublicKey(didUrl, options) {
+  assertString(didUrl, "didUrl", "INVALID_DID_URL");
+  const parsed = parseDidUrl(didUrl);
+  const method = extractDidMethod(parsed.did);
+  if (!method) {
+    throw new OmaTrustError("INVALID_DID_URL", "Cannot extract DID method from DID URL", {
+      didUrl,
+      did: parsed.did
+    });
+  }
+  switch (method) {
+    case "web":
+      return resolveDidUrlKey(parsed.didUrl, parsed.did, parsed.fragment, options);
+    default:
+      throw new OmaTrustError(
+        "UNSUPPORTED_DID_METHOD",
+        `DID URL key resolution is not supported for method "${method}"`,
+        { didUrl, method }
+      );
+  }
+}
+async function resolveDidUrlToControllerDid(didUrl, options) {
+  const resolved = await resolveDidUrlToPublicKey(didUrl, options);
+  const controllerDid = jwkToDidJwk(resolved.publicKeyJwk);
+  return {
+    ...resolved,
+    controllerDid
+  };
+}
+async function resolveDidUrlKey(didUrl, did, fragment, options) {
+  const domain = getDomainFromDidWeb(did);
+  if (!domain) {
+    throw new OmaTrustError("INVALID_DID_URL", "Cannot extract domain from did:web DID", {
+      didUrl,
+      did
+    });
+  }
+  const fetchFn = options?.fetchDidDocument ?? fetchDidDocument;
+  const didDocument = await fetchFn(domain);
+  const method = findVerificationMethod(didDocument, didUrl, fragment);
+  if (!method) {
+    throw new OmaTrustError(
+      "KEY_NOT_FOUND",
+      `No verification method found matching "${fragment ? `#${fragment}` : didUrl}"`,
+      { didUrl, fragment, availableMethods: extractMethodIdsFromDidDocument(didDocument) }
+    );
+  }
+  const publicKeyJwk = method.publicKeyJwk;
+  if (!publicKeyJwk || typeof publicKeyJwk !== "object") {
+    throw new OmaTrustError(
+      "KEY_NOT_FOUND",
+      `Verification method "${method.id}" does not contain publicKeyJwk`,
+      { didUrl, verificationMethodId: method.id }
+    );
+  }
+  const validation = validatePublicJwk(publicKeyJwk);
+  if (!validation.valid) {
+    throw new OmaTrustError(
+      "INVALID_JWK",
+      `publicKeyJwk in verification method "${method.id}" is invalid: ${validation.error}`,
+      { didUrl, verificationMethodId: method.id }
+    );
+  }
+  return {
+    didUrl,
+    did,
+    fragment,
+    publicKeyJwk,
+    verificationMethodId: method.id
+  };
+}
+
+// src/identity/controller-id.ts
+function isSameControllerId(a, b) {
+  let normalizedA = null;
+  let normalizedB = null;
+  try {
+    normalizedA = normalizeDid(a);
+  } catch {
+  }
+  try {
+    normalizedB = normalizeDid(b);
+  } catch {
+  }
+  if (normalizedA && normalizedB && normalizedA === normalizedB) {
+    return true;
+  }
+  const evmA = extractControllerEvmAddress(a);
+  const evmB = extractControllerEvmAddress(b);
+  if (evmA && evmB && evmA.toLowerCase() === evmB.toLowerCase()) {
+    return true;
+  }
+  const methodA = extractDidMethod(a);
+  const methodB = extractDidMethod(b);
+  if (methodA === "jwk" && methodB === "jwk") {
+    try {
+      const jwkA = didJwkToJwk(a);
+      const jwkB = didJwkToJwk(b);
+      return publicJwkEquals(jwkA, jwkB);
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+function extractControllerEvmAddress(controllerDid) {
+  try {
+    const method = extractDidMethod(controllerDid);
+    if (method === "pkh" && controllerDid.includes("eip155")) {
+      return extractAddressFromDid(controllerDid);
+    }
+  } catch {
+  }
+  return null;
+}
+
+// src/identity/types.ts
+function extractAuthorizationMetadata(result) {
+  const payload = result.payload;
+  const resourceUrl = typeof payload.resourceUrl === "string" ? payload.resourceUrl : null;
+  const issuedAt = typeof payload.issuedAt === "string" ? payload.issuedAt : typeof payload.issuedAt === "number" ? payload.issuedAt : null;
+  let subjectDid = null;
+  if (resourceUrl) {
+    try {
+      const url = new URL(resourceUrl);
+      subjectDid = `did:web:${url.hostname}`;
+    } catch {
+    }
+  }
+  if ("publicKeyDid" in result) {
+    const jwsResult = result;
+    return {
+      controllerDid: jwsResult.publicKeyDid,
+      subjectDid,
+      resourceUrl,
+      issuedAt,
+      kid: jwsResult.kid,
+      publicKeyJwk: jwsResult.publicKeyJwk,
+      signer: null
+    };
+  }
+  const eip712Result = result;
+  const signerAddress = eip712Result.signer.toLowerCase();
+  return {
+    controllerDid: `did:pkh:eip155:1:${signerAddress}`,
+    subjectDid,
+    resourceUrl,
+    issuedAt,
+    kid: null,
+    publicKeyJwk: null,
+    signer: eip712Result.signer
+  };
+}
+var VALID_ALGORITHMS = /* @__PURE__ */ new Set(["keccak256", "sha256"]);
+var MAX_JSON_DEPTH = 32;
+function assertDepthLimit(depth, context) {
+  if (depth > MAX_JSON_DEPTH) {
+    const msg = context ? `JSON nesting depth exceeds maximum of ${MAX_JSON_DEPTH} at ${context}` : `JSON nesting depth exceeds maximum of ${MAX_JSON_DEPTH}`;
+    throw new OmaTrustError("INVALID_INPUT", msg);
+  }
+}
+function parseJsonStrict(input) {
+  if (typeof input !== "string") {
+    throw new OmaTrustError("INVALID_INPUT", "Input must be a string");
+  }
+  const duplicateKeys = detectDuplicateKeys(input);
+  if (duplicateKeys.length > 0) {
+    throw new OmaTrustError(
+      "INVALID_INPUT",
+      `Duplicate JSON key${duplicateKeys.length > 1 ? "s" : ""} detected: ${duplicateKeys.map((k) => `"${k}"`).join(", ")}`,
+      { duplicateKeys }
+    );
+  }
+  try {
+    return JSON.parse(input);
+  } catch {
+    throw new OmaTrustError("INVALID_INPUT", "Input is not valid JSON");
+  }
+}
+function detectDuplicateKeys(input) {
+  const duplicates = [];
+  const objectKeyStack = [];
+  let inString = false;
+  let escaped = false;
+  let currentKey = "";
+  let collectingKey = false;
+  let afterColon = false;
+  let i = 0;
+  while (i < input.length) {
+    const ch = input[i];
+    if (escaped) {
+      if (collectingKey) currentKey += ch;
+      escaped = false;
+      i++;
+      continue;
+    }
+    if (ch === "\\") {
+      escaped = true;
+      if (collectingKey) currentKey += ch;
+      i++;
+      continue;
+    }
+    if (ch === '"') {
+      if (!inString) {
+        inString = true;
+        if (objectKeyStack.length > 0 && !afterColon) {
+          collectingKey = true;
+          currentKey = "";
+        }
+      } else {
+        inString = false;
+        if (collectingKey) {
+          collectingKey = false;
+          const keySet = objectKeyStack[objectKeyStack.length - 1];
+          if (keySet.has(currentKey)) {
+            if (!duplicates.includes(currentKey)) {
+              duplicates.push(currentKey);
+            }
+          } else {
+            keySet.add(currentKey);
+          }
+        }
+      }
+      i++;
+      continue;
+    }
+    if (inString) {
+      if (collectingKey) currentKey += ch;
+      i++;
+      continue;
+    }
+    if (ch === "{") {
+      objectKeyStack.push(/* @__PURE__ */ new Set());
+      assertDepthLimit(objectKeyStack.length);
+      afterColon = false;
+    } else if (ch === "}") {
+      objectKeyStack.pop();
+      afterColon = objectKeyStack.length > 0;
+    } else if (ch === "[") {
+      objectKeyStack.push(/* @__PURE__ */ new Set(["__array__"]));
+      assertDepthLimit(objectKeyStack.length);
+      afterColon = false;
+    } else if (ch === "]") {
+      objectKeyStack.pop();
+      afterColon = objectKeyStack.length > 0;
+    } else if (ch === ":") {
+      afterColon = true;
+    } else if (ch === ",") {
+      afterColon = false;
+    }
+    i++;
+  }
+  return duplicates;
+}
+function assertJsonSafe(value, path = "$", depth = 0) {
+  assertDepthLimit(depth, path);
+  if (value === void 0) {
+    throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: undefined`);
+  }
+  if (value === null) return;
+  switch (typeof value) {
+    case "string":
+    case "boolean":
+      return;
+    case "number":
+      if (!Number.isFinite(value)) {
+        throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: ${value} (must be finite number)`);
+      }
+      return;
+    case "bigint":
+      throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: BigInt (use number or string)`);
+    case "function":
+      throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: function`);
+    case "symbol":
+      throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: Symbol`);
+    case "object":
+      if (value instanceof Date) {
+        throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: Date (use ISO string or timestamp)`);
+      }
+      if (value instanceof RegExp) {
+        throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: RegExp`);
+      }
+      if (Array.isArray(value)) {
+        for (let i = 0; i < value.length; i++) {
+          assertJsonSafe(value[i], `${path}[${i}]`, depth + 1);
+        }
+        return;
+      }
+      for (const [key, val] of Object.entries(value)) {
+        assertJsonSafe(val, `${path}.${key}`, depth + 1);
+      }
+      return;
+    default:
+      throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: unknown type "${typeof value}"`);
+  }
+}
 function canonicalizeJson(obj) {
+  assertJsonSafe(obj);
   const jcs = canonicalize(obj);
   if (!jcs) {
     throw new OmaTrustError("INVALID_INPUT", "Object cannot be canonicalized", { obj });
   }
   return jcs;
 }
-function canonicalizeForHash(obj) {
+function canonicalizeAndKeccak256(obj) {
   const jcsJson = canonicalizeJson(obj);
   return {
     jcsJson,
     hash: keccak256(toUtf8Bytes(jcsJson))
   };
 }
+function canonicalizeForHash(obj) {
+  return canonicalizeAndKeccak256(obj);
+}
 function hashCanonicalizedJson(obj, algorithm) {
+  if (!VALID_ALGORITHMS.has(algorithm)) {
+    throw new OmaTrustError("INVALID_INPUT", `Unsupported hash algorithm: "${algorithm}". Must be "keccak256" or "sha256".`, { algorithm });
+  }
   const jcs = canonicalizeJson(obj);
   const bytes = toUtf8Bytes(jcs);
   return algorithm === "keccak256" ? keccak256(bytes) : sha256(bytes);
 }
+var DID_ARTIFACT_PREFIX = "did:artifact:";
+var CID_VERSION = 1;
+var RAW_CODEC = raw.code;
+var SHA2_256_CODE = 18;
+var SHA2_256_DIGEST_LENGTH = 32;
+async function artifactDidFromBytes(bytes) {
+  if (!(bytes instanceof Uint8Array) || bytes.length === 0) {
+    throw new OmaTrustError(
+      "INVALID_INPUT",
+      "bytes must be a non-empty Uint8Array"
+    );
+  }
+  const digest = await sha256$1.digest(bytes);
+  const cid = CID.createV1(RAW_CODEC, digest);
+  return `${DID_ARTIFACT_PREFIX}${cid.toString(base32)}`;
+}
+async function artifactDidFromJson(input) {
+  const value = typeof input === "string" ? parseJsonStrict(input) : input;
+  const jcs = canonicalizeJson(value);
+  const bytes = new TextEncoder().encode(jcs);
+  const digest = await sha256$1.digest(bytes);
+  const cid = CID.createV1(RAW_CODEC, digest);
+  return `${DID_ARTIFACT_PREFIX}${cid.toString(base32)}`;
+}
+function parseArtifactDid(did) {
+  if (typeof did !== "string" || !did.startsWith(DID_ARTIFACT_PREFIX)) {
+    throw new OmaTrustError("INVALID_DID", "Expected a did:artifact DID", { did });
+  }
+  const identifier = did.slice(DID_ARTIFACT_PREFIX.length);
+  if (!identifier || identifier.length === 0) {
+    throw new OmaTrustError("INVALID_DID", "Missing method-specific identifier", { did });
+  }
+  if (identifier[0] !== "b") {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `Invalid multibase prefix "${identifier[0]}", expected "b" (base32lower)`,
+      { did }
+    );
+  }
+  let cid;
+  try {
+    cid = CID.parse(identifier, base32);
+  } catch (err) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      "Failed to decode base32 CID from did:artifact identifier",
+      { did, cause: err }
+    );
+  }
+  if (cid.version !== CID_VERSION) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `CID version must be 1, got ${cid.version}`,
+      { did }
+    );
+  }
+  if (cid.code !== RAW_CODEC) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `Multicodec must be raw (0x55), got 0x${cid.code.toString(16)}`,
+      { did }
+    );
+  }
+  if (cid.multihash.code !== SHA2_256_CODE) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `Multihash function must be sha2-256 (0x12), got 0x${cid.multihash.code.toString(16)}`,
+      { did }
+    );
+  }
+  if (cid.multihash.digest.length !== SHA2_256_DIGEST_LENGTH) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `SHA-256 digest must be 32 bytes, got ${cid.multihash.digest.length}`,
+      { did }
+    );
+  }
+  const digest = cid.multihash.digest;
+  const digestHex = Array.from(digest).map((b) => b.toString(16).padStart(2, "0")).join("");
+  return { did, identifier, digest, digestHex };
+}
+async function verifyDidArtifact(did, content) {
+  let parsed;
+  try {
+    parsed = parseArtifactDid(did);
+  } catch (err) {
+    return {
+      valid: false,
+      reason: err instanceof OmaTrustError ? err.message : "Invalid did:artifact DID"
+    };
+  }
+  const expectedHex = parsed.digestHex;
+  if (typeof content === "string" || typeof content === "object" && content !== null && !(content instanceof Uint8Array)) {
+    try {
+      const value = typeof content === "string" ? parseJsonStrict(content) : content;
+      const jcs = canonicalizeJson(value);
+      const jcsBytes = new TextEncoder().encode(jcs);
+      const digest2 = await sha256$1.digest(jcsBytes);
+      const digestHex2 = Array.from(digest2.digest).map((b) => b.toString(16).padStart(2, "0")).join("");
+      if (digestHex2 === expectedHex) {
+        return { valid: true, matchedAs: "json" };
+      }
+    } catch {
+    }
+  }
+  let rawBytes;
+  if (content instanceof Uint8Array) {
+    rawBytes = content;
+  } else if (typeof content === "string") {
+    rawBytes = new TextEncoder().encode(content);
+  } else {
+    return {
+      valid: false,
+      reason: "Content did not match as canonical JSON and is not raw bytes"
+    };
+  }
+  const digest = await sha256$1.digest(rawBytes);
+  const digestHex = Array.from(digest.digest).map((b) => b.toString(16).padStart(2, "0")).join("");
+  if (digestHex === expectedHex) {
+    return { valid: true, matchedAs: "binary" };
+  }
+  return {
+    valid: false,
+    reason: "Content does not match the did:artifact identifier (neither as canonical JSON nor as raw bytes)"
+  };
+}
+function didEthrToDidPkh(did) {
+  if (typeof did !== "string" || !did.startsWith("did:ethr:")) {
+    throw new OmaTrustError("INVALID_DID", "Expected a did:ethr DID", { did });
+  }
+  const remainder = did.slice("did:ethr:".length);
+  if (!remainder) {
+    throw new OmaTrustError("INVALID_DID", "Missing identifier in did:ethr DID", { did });
+  }
+  let chainId;
+  let address;
+  const parts = remainder.split(":");
+  if (parts.length === 1) {
+    chainId = "1";
+    address = parts[0];
+  } else if (parts.length === 2) {
+    const rawChainId = parts[0];
+    address = parts[1];
+    if (rawChainId.startsWith("0x")) {
+      chainId = String(parseInt(rawChainId, 16));
+    } else if (/^\d+$/.test(rawChainId)) {
+      chainId = rawChainId;
+    } else {
+      const networkMap = {
+        mainnet: "1",
+        goerli: "5",
+        sepolia: "11155111",
+        polygon: "137",
+        arbitrum: "42161",
+        optimism: "10",
+        base: "8453"
+      };
+      const mapped = networkMap[rawChainId.toLowerCase()];
+      if (!mapped) {
+        throw new OmaTrustError(
+          "INVALID_DID",
+          `Unknown did:ethr network "${rawChainId}"`,
+          { did, network: rawChainId }
+        );
+      }
+      chainId = mapped;
+    }
+  } else {
+    throw new OmaTrustError("INVALID_DID", "Invalid did:ethr format", { did });
+  }
+  if (!isAddress(address)) {
+    throw new OmaTrustError("INVALID_DID", "Invalid Ethereum address in did:ethr DID", {
+      did,
+      address
+    });
+  }
+  const checksummed = getAddress(address);
+  return `did:pkh:eip155:${chainId}:${checksummed.toLowerCase()}`;
+}
+var MULTICODEC_KEY_TYPES = {
+  // Ed25519 public key: 0xed (varint encoded as [0xed, 0x01])
+  237: { kty: "OKP", crv: "Ed25519" },
+  // X25519 public key: 0xec (varint encoded as [0xec, 0x01])
+  236: { kty: "OKP", crv: "X25519" },
+  // secp256k1 public key (compressed): 0xe7 (varint encoded as [0xe7, 0x01])
+  231: { kty: "EC", crv: "secp256k1", coordSize: 33 },
+  // P-256 public key (compressed): 0x80 0x24 (varint 0x1200)
+  4608: { kty: "EC", crv: "P-256", coordSize: 33 },
+  // P-384 public key (compressed): 0x81 0x24 (varint 0x1201)
+  4609: { kty: "EC", crv: "P-384", coordSize: 49 }
+};
+function readVarint(bytes, offset) {
+  let value = 0;
+  let shift = 0;
+  let bytesRead = 0;
+  while (offset + bytesRead < bytes.length) {
+    const byte = bytes[offset + bytesRead];
+    value |= (byte & 127) << shift;
+    bytesRead++;
+    if ((byte & 128) === 0) {
+      return { value, bytesRead };
+    }
+    shift += 7;
+    if (shift > 28) {
+      throw new OmaTrustError("INVALID_DID", "Varint too long in did:key multicodec prefix");
+    }
+  }
+  throw new OmaTrustError("INVALID_DID", "Truncated varint in did:key multicodec prefix");
+}
+function decompressEcKey(compressedKey, crv) {
+  throw new OmaTrustError(
+    "UNSUPPORTED_KEY_TYPE",
+    `Cannot convert compressed EC key (${crv}) from did:key to did:jwk. Decompressing EC points requires elliptic curve arithmetic. For EVM keys, use didEthrToDidPkh() instead.`,
+    { crv, keyLength: compressedKey.length }
+  );
+}
+function didKeyToDidJwk(did) {
+  if (typeof did !== "string" || !did.startsWith("did:key:")) {
+    throw new OmaTrustError("INVALID_DID", "Expected a did:key DID", { did });
+  }
+  const identifier = did.slice("did:key:".length);
+  if (!identifier || !identifier.startsWith("z")) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      "did:key identifier must start with 'z' (base58btc multibase prefix)",
+      { did }
+    );
+  }
+  let decoded;
+  try {
+    decoded = base58btc.decode(identifier);
+  } catch (err) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      "Failed to decode base58btc from did:key identifier",
+      { did, cause: err }
+    );
+  }
+  if (decoded.length < 3) {
+    throw new OmaTrustError("INVALID_DID", "did:key decoded bytes too short", { did });
+  }
+  const { value: codecValue, bytesRead } = readVarint(decoded, 0);
+  const keyType = MULTICODEC_KEY_TYPES[codecValue];
+  if (!keyType) {
+    throw new OmaTrustError(
+      "UNSUPPORTED_KEY_TYPE",
+      `Unsupported multicodec key type 0x${codecValue.toString(16)} in did:key`,
+      { did, codec: `0x${codecValue.toString(16)}` }
+    );
+  }
+  const keyBytes = decoded.slice(bytesRead);
+  if (keyType.kty === "OKP") {
+    if (keyBytes.length !== 32) {
+      throw new OmaTrustError(
+        "INVALID_DID",
+        `Expected 32-byte ${keyType.crv} key, got ${keyBytes.length} bytes`,
+        { did, crv: keyType.crv }
+      );
+    }
+    const jwk = {
+      kty: keyType.kty,
+      crv: keyType.crv,
+      x: base64url.encode(keyBytes)
+    };
+    return jwkToDidJwk(jwk);
+  }
+  return decompressEcKey(keyBytes, keyType.crv).x.toString();
+}
 
-export { buildCaip10, buildCaip2, buildDidPkh, buildDidPkhFromCaip10, buildDidWeb, buildEvmDidPkh, canonicalizeForHash, canonicalizeJson, computeDidAddress, computeDidHash, didToAddress, extractAddressFromDid, extractDidIdentifier, extractDidMethod, getAddressFromDidPkh, getChainIdFromDidPkh, getDomainFromDidWeb, getNamespaceFromDidPkh, hashCanonicalizedJson, isEvmDidPkh, isValidDid, normalizeCaip10, normalizeDid, normalizeDidHandle, normalizeDidKey, normalizeDidPkh, normalizeDidWeb, normalizeDomain, parseCaip10, parseCaip2, validateDidAddress };
+export { artifactDidFromBytes, artifactDidFromJson, assertBareDid, assertJsonSafe, buildCaip10, buildCaip2, buildDidPkh, buildDidPkhFromCaip10, buildDidWeb, buildEvmDidPkh, canonicalizeAndKeccak256, canonicalizeForHash, canonicalizeJson, computeDidAddress, computeDidHash, computeJwkThumbprint, didEthrToDidPkh, didJwkToJwk, didKeyToDidJwk, didToAddress, extractAddressFromDid, extractAuthorizationMetadata, extractControllerEvmAddress, extractDidIdentifier, extractDidMethod, formatJktValue, getAddressFromDidPkh, getChainIdFromDidPkh, getDomainFromDidWeb, getNamespaceFromDidPkh, hashCanonicalizedJson, isDidUrl, isEvmDidPkh, isPrivateKeyDid, isSameControllerId, isValidDid, jwkToDidJwk, normalizeCaip10, normalizeDid, normalizeDidHandle, normalizeDidJwk, normalizeDidKey, normalizeDidPkh, normalizeDidWeb, normalizeDomain, parseArtifactDid, parseCaip10, parseCaip2, parseDidUrl, parseJsonStrict, publicJwkEquals, resolveDidUrlToControllerDid, resolveDidUrlToPublicKey, validateDidAddress, validatePrivateKeyDid, validatePublicJwk, verifyDidArtifact };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map