@oma3/omatrust 0.1.0-alpha.11 → 0.1.0-alpha.12

package/dist/index.cjs

@@ -3,12 +3,36 @@
 var ethers = require('ethers');
 var jose = require('jose');
 var canonicalize = require('canonicalize');
+var cid = require('multiformats/cid');
+var sha2 = require('multiformats/hashes/sha2');
+var raw = require('multiformats/codecs/raw');
+var base32 = require('multiformats/bases/base32');
+var base58 = require('multiformats/bases/base58');
 var easSdk = require('@ethereum-attestation-service/eas-sdk');
 var promises = require('dns/promises');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
+function _interopNamespace(e) {
+  if (e && e.__esModule) return e;
+  var n = Object.create(null);
+  if (e) {
+    Object.keys(e).forEach(function (k) {
+      if (k !== 'default') {
+        var d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: function () { return e[k]; }
+        });
+      }
+    });
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+
 var canonicalize__default = /*#__PURE__*/_interopDefault(canonicalize);
+var raw__namespace = /*#__PURE__*/_interopNamespace(raw);
 
 var __defProp = Object.defineProperty;
 var __export = (target, all) => {
@@ -20,31 +44,31 @@ var __export = (target, all) => {
 var OmaTrustError = class extends Error {
   code;
   details;
-  constructor(code, message, details) {
+  constructor(code2, message, details) {
     super(message);
     this.name = "OmaTrustError";
-    this.code = code;
+    this.code = code2;
     this.details = details;
   }
 };
-function toOmaTrustError(code, message, details) {
-  return new OmaTrustError(code, message, details);
+function toOmaTrustError(code2, message, details) {
+  return new OmaTrustError(code2, message, details);
 }
 
 // src/shared/assert.ts
-function assertString(value, name, code = "INVALID_INPUT") {
+function assertString(value, name, code2 = "INVALID_INPUT") {
   if (typeof value !== "string" || value.trim().length === 0) {
-    throw new OmaTrustError(code, `${name} must be a non-empty string`, { value });
+    throw new OmaTrustError(code2, `${name} must be a non-empty string`, { value });
   }
 }
-function assertNumber(value, name, code = "INVALID_INPUT") {
+function assertNumber(value, name, code2 = "INVALID_INPUT") {
   if (typeof value !== "number" || Number.isNaN(value)) {
-    throw new OmaTrustError(code, `${name} must be a valid number`, { value });
+    throw new OmaTrustError(code2, `${name} must be a valid number`, { value });
   }
 }
-function assertObject(value, name, code = "INVALID_INPUT") {
+function assertObject(value, name, code2 = "INVALID_INPUT") {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new OmaTrustError(code, `${name} must be an object`, { value });
+    throw new OmaTrustError(code2, `${name} must be an object`, { value });
   }
 }
 function asError(err) {
@@ -57,19 +81,25 @@ function asError(err) {
 // src/identity/index.ts
 var identity_exports = {};
 __export(identity_exports, {
+  artifactDidFromBytes: () => artifactDidFromBytes,
+  artifactDidFromJson: () => artifactDidFromJson,
   assertBareDid: () => assertBareDid,
+  assertJsonSafe: () => assertJsonSafe,
   buildCaip10: () => buildCaip10,
   buildCaip2: () => buildCaip2,
   buildDidPkh: () => buildDidPkh,
   buildDidPkhFromCaip10: () => buildDidPkhFromCaip10,
   buildDidWeb: () => buildDidWeb,
   buildEvmDidPkh: () => buildEvmDidPkh,
+  canonicalizeAndKeccak256: () => canonicalizeAndKeccak256,
   canonicalizeForHash: () => canonicalizeForHash,
   canonicalizeJson: () => canonicalizeJson,
   computeDidAddress: () => computeDidAddress,
   computeDidHash: () => computeDidHash,
   computeJwkThumbprint: () => computeJwkThumbprint,
+  didEthrToDidPkh: () => didEthrToDidPkh,
   didJwkToJwk: () => didJwkToJwk,
+  didKeyToDidJwk: () => didKeyToDidJwk,
   didToAddress: () => didToAddress,
   extractAddressFromDid: () => extractAddressFromDid,
   extractAuthorizationMetadata: () => extractAuthorizationMetadata,
@@ -96,15 +126,18 @@ __export(identity_exports, {
   normalizeDidPkh: () => normalizeDidPkh,
   normalizeDidWeb: () => normalizeDidWeb,
   normalizeDomain: () => normalizeDomain,
+  parseArtifactDid: () => parseArtifactDid,
   parseCaip10: () => parseCaip10,
   parseCaip2: () => parseCaip2,
   parseDidUrl: () => parseDidUrl,
+  parseJsonStrict: () => parseJsonStrict,
   publicJwkEquals: () => publicJwkEquals,
   resolveDidUrlToControllerDid: () => resolveDidUrlToControllerDid,
   resolveDidUrlToPublicKey: () => resolveDidUrlToPublicKey,
   validateDidAddress: () => validateDidAddress,
   validatePrivateKeyDid: () => validatePrivateKeyDid,
-  validatePublicJwk: () => validatePublicJwk
+  validatePublicJwk: () => validatePublicJwk,
+  verifyDidArtifact: () => verifyDidArtifact
 });
 
 // src/identity/caip.ts
@@ -160,6 +193,158 @@ function parseCaip2(caip2) {
   }
   return { namespace, reference };
 }
+var VALID_KTY = /* @__PURE__ */ new Set(["EC", "OKP", "RSA"]);
+var PRIVATE_KEY_FIELDS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth"]);
+var REQUIRED_PUBLIC_FIELDS = {
+  EC: ["crv", "x", "y"],
+  OKP: ["crv", "x"],
+  RSA: ["n", "e"]
+};
+function validatePublicJwk(jwk) {
+  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
+    return { valid: false, error: "JWK must be a non-null object" };
+  }
+  const obj = jwk;
+  const kty = obj.kty;
+  if (typeof kty !== "string" || !VALID_KTY.has(kty)) {
+    return {
+      valid: false,
+      error: `Invalid or missing kty (must be one of: ${[...VALID_KTY].join(", ")})`
+    };
+  }
+  for (const field of PRIVATE_KEY_FIELDS) {
+    if (field in obj) {
+      return {
+        valid: false,
+        error: `JWK contains private key field "${field}" \u2014 only public keys are allowed`
+      };
+    }
+  }
+  const required = REQUIRED_PUBLIC_FIELDS[kty];
+  if (required) {
+    for (const field of required) {
+      if (!(field in obj) || obj[field] === void 0 || obj[field] === null || obj[field] === "") {
+        return {
+          valid: false,
+          error: `Missing required public key field "${field}" for kty="${kty}"`
+        };
+      }
+    }
+  }
+  return { valid: true };
+}
+function canonicalizeJwkJson(jwk) {
+  const sorted = Object.keys(jwk).sort();
+  const obj = {};
+  for (const key of sorted) {
+    obj[key] = jwk[key];
+  }
+  return JSON.stringify(obj);
+}
+function jwkToDidJwk(jwk) {
+  assertObject(jwk, "jwk", "INVALID_JWK");
+  const validation = validatePublicJwk(jwk);
+  if (!validation.valid) {
+    throw new OmaTrustError("INVALID_JWK", validation.error ?? "Invalid public JWK", { jwk });
+  }
+  const canonical = canonicalizeJwkJson(jwk);
+  const encoded = jose.base64url.encode(new TextEncoder().encode(canonical));
+  return `did:jwk:${encoded}`;
+}
+function didJwkToJwk(didJwk) {
+  if (typeof didJwk !== "string" || !didJwk.startsWith("did:jwk:")) {
+    throw new OmaTrustError("INVALID_DID", "Expected a did:jwk DID", { input: didJwk });
+  }
+  const parts = didJwk.split(":");
+  if (parts.length !== 3) {
+    throw new OmaTrustError("INVALID_DID", "did:jwk must have exactly 3 colon-separated parts", {
+      input: didJwk
+    });
+  }
+  const encoded = parts[2];
+  if (!encoded || encoded.length === 0) {
+    throw new OmaTrustError("INVALID_DID", "Missing base64url-encoded JWK identifier", {
+      input: didJwk
+    });
+  }
+  let decoded;
+  try {
+    const bytes = jose.base64url.decode(encoded);
+    decoded = new TextDecoder().decode(bytes);
+  } catch {
+    throw new OmaTrustError("INVALID_DID", "Failed to base64url-decode did:jwk identifier", {
+      input: didJwk
+    });
+  }
+  let jwk;
+  try {
+    jwk = JSON.parse(decoded);
+  } catch {
+    throw new OmaTrustError("INVALID_DID", "Decoded did:jwk identifier is not valid JSON", {
+      input: didJwk
+    });
+  }
+  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
+    throw new OmaTrustError("INVALID_DID", "Decoded did:jwk must be a JSON object", {
+      input: didJwk
+    });
+  }
+  const validation = validatePublicJwk(jwk);
+  if (!validation.valid) {
+    throw new OmaTrustError("INVALID_DID", validation.error ?? "Invalid public JWK in did:jwk", {
+      input: didJwk
+    });
+  }
+  return jwk;
+}
+function extractPublicKeyFields(jwk) {
+  const result = {};
+  const metadataFields = /* @__PURE__ */ new Set(["kid", "use", "key_ops", "alg", "ext"]);
+  for (const [key, value] of Object.entries(jwk)) {
+    if (PRIVATE_KEY_FIELDS.has(key)) continue;
+    if (metadataFields.has(key)) continue;
+    result[key] = value;
+  }
+  return result;
+}
+function publicJwkEquals(a, b) {
+  assertObject(a, "a", "INVALID_JWK");
+  assertObject(b, "b", "INVALID_JWK");
+  const aObj = a;
+  const bObj = b;
+  for (const field of PRIVATE_KEY_FIELDS) {
+    if (field in aObj) {
+      throw new OmaTrustError(
+        "INVALID_JWK",
+        `First JWK contains private key field "${field}"`,
+        { field }
+      );
+    }
+    if (field in bObj) {
+      throw new OmaTrustError(
+        "INVALID_JWK",
+        `Second JWK contains private key field "${field}"`,
+        { field }
+      );
+    }
+  }
+  const aPublic = extractPublicKeyFields(aObj);
+  const bPublic = extractPublicKeyFields(bObj);
+  return canonicalizeJwkJson(aPublic) === canonicalizeJwkJson(bPublic);
+}
+async function computeJwkThumbprint(jwk, digestAlgorithm = "sha256") {
+  assertObject(jwk, "jwk", "INVALID_JWK");
+  const validation = validatePublicJwk(jwk);
+  if (!validation.valid) {
+    throw new OmaTrustError("INVALID_JWK", validation.error ?? "Invalid public JWK", { jwk });
+  }
+  const alg = digestAlgorithm === "sha256" ? "sha256" : digestAlgorithm === "sha384" ? "sha384" : "sha512";
+  return jose.calculateJwkThumbprint(jwk, alg);
+}
+async function formatJktValue(jwk) {
+  const thumbprint = await computeJwkThumbprint(jwk, "sha256");
+  return `jkt=S256:${thumbprint}`;
+}
 
 // src/identity/did.ts
 var DID_REGEX = /^did:[a-z0-9]+:.+$/i;
@@ -235,7 +420,7 @@ function normalizeDidKey(input) {
 }
 function normalizeDid(input) {
   assertString(input, "input", "INVALID_DID");
-  const trimmed = input.trim();
+  const trimmed = input.trim().split("#")[0];
   if (!trimmed.startsWith("did:")) {
     return normalizeDidWeb(trimmed);
   }
@@ -424,6 +609,15 @@ function validateDidPkh(did) {
       };
     }
   }
+  if (namespace === "solana") {
+    if (!/^[1-9A-HJ-NP-Za-km-z]{32,44}$/.test(address)) {
+      return {
+        valid: false,
+        method: "pkh",
+        error: `Invalid Solana address "${address}" (must be 32-44 base58 characters)`
+      };
+    }
+  }
   return { valid: true, method: "pkh" };
 }
 function validateDidJwk(did) {
@@ -477,6 +671,10 @@ function validateDidJwk(did) {
       error: "DID must reference a public key \u2014 private key component (d) is not allowed"
     };
   }
+  const jwkValidation = validatePublicJwk(jwk);
+  if (!jwkValidation.valid) {
+    return { valid: false, method: "jwk", error: jwkValidation.error };
+  }
   return { valid: true, method: "jwk" };
 }
 function normalizeDidJwk(input) {
@@ -543,158 +741,6 @@ function assertBareDid(input, paramName = "did") {
     );
   }
 }
-var VALID_KTY = /* @__PURE__ */ new Set(["EC", "OKP", "RSA"]);
-var PRIVATE_KEY_FIELDS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth"]);
-var REQUIRED_PUBLIC_FIELDS = {
-  EC: ["crv", "x", "y"],
-  OKP: ["crv", "x"],
-  RSA: ["n", "e"]
-};
-function validatePublicJwk(jwk) {
-  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
-    return { valid: false, error: "JWK must be a non-null object" };
-  }
-  const obj = jwk;
-  const kty = obj.kty;
-  if (typeof kty !== "string" || !VALID_KTY.has(kty)) {
-    return {
-      valid: false,
-      error: `Invalid or missing kty (must be one of: ${[...VALID_KTY].join(", ")})`
-    };
-  }
-  for (const field of PRIVATE_KEY_FIELDS) {
-    if (field in obj) {
-      return {
-        valid: false,
-        error: `JWK contains private key field "${field}" \u2014 only public keys are allowed`
-      };
-    }
-  }
-  const required = REQUIRED_PUBLIC_FIELDS[kty];
-  if (required) {
-    for (const field of required) {
-      if (!(field in obj) || obj[field] === void 0 || obj[field] === null || obj[field] === "") {
-        return {
-          valid: false,
-          error: `Missing required public key field "${field}" for kty="${kty}"`
-        };
-      }
-    }
-  }
-  return { valid: true };
-}
-function canonicalizeJwkJson(jwk) {
-  const sorted = Object.keys(jwk).sort();
-  const obj = {};
-  for (const key of sorted) {
-    obj[key] = jwk[key];
-  }
-  return JSON.stringify(obj);
-}
-function jwkToDidJwk(jwk) {
-  assertObject(jwk, "jwk", "INVALID_JWK");
-  const validation = validatePublicJwk(jwk);
-  if (!validation.valid) {
-    throw new OmaTrustError("INVALID_JWK", validation.error ?? "Invalid public JWK", { jwk });
-  }
-  const canonical = canonicalizeJwkJson(jwk);
-  const encoded = jose.base64url.encode(new TextEncoder().encode(canonical));
-  return `did:jwk:${encoded}`;
-}
-function didJwkToJwk(didJwk) {
-  if (typeof didJwk !== "string" || !didJwk.startsWith("did:jwk:")) {
-    throw new OmaTrustError("INVALID_DID", "Expected a did:jwk DID", { input: didJwk });
-  }
-  const parts = didJwk.split(":");
-  if (parts.length !== 3) {
-    throw new OmaTrustError("INVALID_DID", "did:jwk must have exactly 3 colon-separated parts", {
-      input: didJwk
-    });
-  }
-  const encoded = parts[2];
-  if (!encoded || encoded.length === 0) {
-    throw new OmaTrustError("INVALID_DID", "Missing base64url-encoded JWK identifier", {
-      input: didJwk
-    });
-  }
-  let decoded;
-  try {
-    const bytes = jose.base64url.decode(encoded);
-    decoded = new TextDecoder().decode(bytes);
-  } catch {
-    throw new OmaTrustError("INVALID_DID", "Failed to base64url-decode did:jwk identifier", {
-      input: didJwk
-    });
-  }
-  let jwk;
-  try {
-    jwk = JSON.parse(decoded);
-  } catch {
-    throw new OmaTrustError("INVALID_DID", "Decoded did:jwk identifier is not valid JSON", {
-      input: didJwk
-    });
-  }
-  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
-    throw new OmaTrustError("INVALID_DID", "Decoded did:jwk must be a JSON object", {
-      input: didJwk
-    });
-  }
-  const validation = validatePublicJwk(jwk);
-  if (!validation.valid) {
-    throw new OmaTrustError("INVALID_DID", validation.error ?? "Invalid public JWK in did:jwk", {
-      input: didJwk
-    });
-  }
-  return jwk;
-}
-function extractPublicKeyFields(jwk) {
-  const result = {};
-  const metadataFields = /* @__PURE__ */ new Set(["kid", "use", "key_ops", "alg", "ext"]);
-  for (const [key, value] of Object.entries(jwk)) {
-    if (PRIVATE_KEY_FIELDS.has(key)) continue;
-    if (metadataFields.has(key)) continue;
-    result[key] = value;
-  }
-  return result;
-}
-function publicJwkEquals(a, b) {
-  assertObject(a, "a", "INVALID_JWK");
-  assertObject(b, "b", "INVALID_JWK");
-  const aObj = a;
-  const bObj = b;
-  for (const field of PRIVATE_KEY_FIELDS) {
-    if (field in aObj) {
-      throw new OmaTrustError(
-        "INVALID_JWK",
-        `First JWK contains private key field "${field}"`,
-        { field }
-      );
-    }
-    if (field in bObj) {
-      throw new OmaTrustError(
-        "INVALID_JWK",
-        `Second JWK contains private key field "${field}"`,
-        { field }
-      );
-    }
-  }
-  const aPublic = extractPublicKeyFields(aObj);
-  const bPublic = extractPublicKeyFields(bObj);
-  return canonicalizeJwkJson(aPublic) === canonicalizeJwkJson(bPublic);
-}
-async function computeJwkThumbprint(jwk, digestAlgorithm = "sha256") {
-  assertObject(jwk, "jwk", "INVALID_JWK");
-  const validation = validatePublicJwk(jwk);
-  if (!validation.valid) {
-    throw new OmaTrustError("INVALID_JWK", validation.error ?? "Invalid public JWK", { jwk });
-  }
-  const alg = digestAlgorithm === "sha256" ? "sha256" : digestAlgorithm === "sha384" ? "sha384" : "sha512";
-  return jose.calculateJwkThumbprint(jwk, alg);
-}
-async function formatJktValue(jwk) {
-  const thumbprint = await computeJwkThumbprint(jwk, "sha256");
-  return `jkt=S256:${thumbprint}`;
-}
 
 // src/shared/did-document.ts
 async function fetchDidDocument(domain) {
@@ -857,7 +903,7 @@ function extractControllerEvmAddress(controllerDid) {
 function extractAuthorizationMetadata(result) {
   const payload = result.payload;
   const resourceUrl = typeof payload.resourceUrl === "string" ? payload.resourceUrl : null;
-  const issuedAt = typeof payload.issuedAt === "string" ? payload.issuedAt : null;
+  const issuedAt = typeof payload.issuedAt === "string" ? payload.issuedAt : typeof payload.issuedAt === "number" ? payload.issuedAt : null;
   let subjectDid = null;
   if (resourceUrl) {
     try {
@@ -866,34 +912,467 @@ function extractAuthorizationMetadata(result) {
     } catch {
     }
   }
-  return {
-    controllerDid: result.publicKeyDid,
-    subjectDid,
-    resourceUrl,
-    issuedAt,
-    kid: result.kid,
-    publicKeyJwk: result.publicKeyJwk
-  };
+  if ("publicKeyDid" in result) {
+    const jwsResult = result;
+    return {
+      controllerDid: jwsResult.publicKeyDid,
+      subjectDid,
+      resourceUrl,
+      issuedAt,
+      kid: jwsResult.kid,
+      publicKeyJwk: jwsResult.publicKeyJwk,
+      signer: null
+    };
+  }
+  const eip712Result = result;
+  const signerAddress = eip712Result.signer.toLowerCase();
+  return {
+    controllerDid: `did:pkh:eip155:1:${signerAddress}`,
+    subjectDid,
+    resourceUrl,
+    issuedAt,
+    kid: null,
+    publicKeyJwk: null,
+    signer: eip712Result.signer
+  };
+}
+var VALID_ALGORITHMS = /* @__PURE__ */ new Set(["keccak256", "sha256"]);
+var MAX_JSON_DEPTH = 32;
+function assertDepthLimit(depth, context) {
+  if (depth > MAX_JSON_DEPTH) {
+    const msg = context ? `JSON nesting depth exceeds maximum of ${MAX_JSON_DEPTH} at ${context}` : `JSON nesting depth exceeds maximum of ${MAX_JSON_DEPTH}`;
+    throw new OmaTrustError("INVALID_INPUT", msg);
+  }
+}
+function parseJsonStrict(input) {
+  if (typeof input !== "string") {
+    throw new OmaTrustError("INVALID_INPUT", "Input must be a string");
+  }
+  const duplicateKeys = detectDuplicateKeys(input);
+  if (duplicateKeys.length > 0) {
+    throw new OmaTrustError(
+      "INVALID_INPUT",
+      `Duplicate JSON key${duplicateKeys.length > 1 ? "s" : ""} detected: ${duplicateKeys.map((k) => `"${k}"`).join(", ")}`,
+      { duplicateKeys }
+    );
+  }
+  try {
+    return JSON.parse(input);
+  } catch {
+    throw new OmaTrustError("INVALID_INPUT", "Input is not valid JSON");
+  }
+}
+function detectDuplicateKeys(input) {
+  const duplicates = [];
+  const objectKeyStack = [];
+  let inString = false;
+  let escaped = false;
+  let currentKey = "";
+  let collectingKey = false;
+  let afterColon = false;
+  let i = 0;
+  while (i < input.length) {
+    const ch = input[i];
+    if (escaped) {
+      if (collectingKey) currentKey += ch;
+      escaped = false;
+      i++;
+      continue;
+    }
+    if (ch === "\\") {
+      escaped = true;
+      if (collectingKey) currentKey += ch;
+      i++;
+      continue;
+    }
+    if (ch === '"') {
+      if (!inString) {
+        inString = true;
+        if (objectKeyStack.length > 0 && !afterColon) {
+          collectingKey = true;
+          currentKey = "";
+        }
+      } else {
+        inString = false;
+        if (collectingKey) {
+          collectingKey = false;
+          const keySet = objectKeyStack[objectKeyStack.length - 1];
+          if (keySet.has(currentKey)) {
+            if (!duplicates.includes(currentKey)) {
+              duplicates.push(currentKey);
+            }
+          } else {
+            keySet.add(currentKey);
+          }
+        }
+      }
+      i++;
+      continue;
+    }
+    if (inString) {
+      if (collectingKey) currentKey += ch;
+      i++;
+      continue;
+    }
+    if (ch === "{") {
+      objectKeyStack.push(/* @__PURE__ */ new Set());
+      assertDepthLimit(objectKeyStack.length);
+      afterColon = false;
+    } else if (ch === "}") {
+      objectKeyStack.pop();
+      afterColon = objectKeyStack.length > 0;
+    } else if (ch === "[") {
+      objectKeyStack.push(/* @__PURE__ */ new Set(["__array__"]));
+      assertDepthLimit(objectKeyStack.length);
+      afterColon = false;
+    } else if (ch === "]") {
+      objectKeyStack.pop();
+      afterColon = objectKeyStack.length > 0;
+    } else if (ch === ":") {
+      afterColon = true;
+    } else if (ch === ",") {
+      afterColon = false;
+    }
+    i++;
+  }
+  return duplicates;
+}
+function assertJsonSafe(value, path = "$", depth = 0) {
+  assertDepthLimit(depth, path);
+  if (value === void 0) {
+    throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: undefined`);
+  }
+  if (value === null) return;
+  switch (typeof value) {
+    case "string":
+    case "boolean":
+      return;
+    case "number":
+      if (!Number.isFinite(value)) {
+        throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: ${value} (must be finite number)`);
+      }
+      return;
+    case "bigint":
+      throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: BigInt (use number or string)`);
+    case "function":
+      throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: function`);
+    case "symbol":
+      throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: Symbol`);
+    case "object":
+      if (value instanceof Date) {
+        throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: Date (use ISO string or timestamp)`);
+      }
+      if (value instanceof RegExp) {
+        throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: RegExp`);
+      }
+      if (Array.isArray(value)) {
+        for (let i = 0; i < value.length; i++) {
+          assertJsonSafe(value[i], `${path}[${i}]`, depth + 1);
+        }
+        return;
+      }
+      for (const [key, val] of Object.entries(value)) {
+        assertJsonSafe(val, `${path}.${key}`, depth + 1);
+      }
+      return;
+    default:
+      throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: unknown type "${typeof value}"`);
+  }
 }
 function canonicalizeJson(obj) {
+  assertJsonSafe(obj);
   const jcs = canonicalize__default.default(obj);
   if (!jcs) {
     throw new OmaTrustError("INVALID_INPUT", "Object cannot be canonicalized", { obj });
   }
   return jcs;
 }
-function canonicalizeForHash(obj) {
+function canonicalizeAndKeccak256(obj) {
   const jcsJson = canonicalizeJson(obj);
   return {
     jcsJson,
     hash: ethers.keccak256(ethers.toUtf8Bytes(jcsJson))
   };
 }
+function canonicalizeForHash(obj) {
+  return canonicalizeAndKeccak256(obj);
+}
 function hashCanonicalizedJson(obj, algorithm) {
+  if (!VALID_ALGORITHMS.has(algorithm)) {
+    throw new OmaTrustError("INVALID_INPUT", `Unsupported hash algorithm: "${algorithm}". Must be "keccak256" or "sha256".`, { algorithm });
+  }
   const jcs = canonicalizeJson(obj);
   const bytes = ethers.toUtf8Bytes(jcs);
   return algorithm === "keccak256" ? ethers.keccak256(bytes) : ethers.sha256(bytes);
 }
+var DID_ARTIFACT_PREFIX = "did:artifact:";
+var CID_VERSION = 1;
+var RAW_CODEC = raw__namespace.code;
+var SHA2_256_CODE = 18;
+var SHA2_256_DIGEST_LENGTH = 32;
+async function artifactDidFromBytes(bytes) {
+  if (!(bytes instanceof Uint8Array) || bytes.length === 0) {
+    throw new OmaTrustError(
+      "INVALID_INPUT",
+      "bytes must be a non-empty Uint8Array"
+    );
+  }
+  const digest = await sha2.sha256.digest(bytes);
+  const cid$1 = cid.CID.createV1(RAW_CODEC, digest);
+  return `${DID_ARTIFACT_PREFIX}${cid$1.toString(base32.base32)}`;
+}
+async function artifactDidFromJson(input) {
+  const value = typeof input === "string" ? parseJsonStrict(input) : input;
+  const jcs = canonicalizeJson(value);
+  const bytes = new TextEncoder().encode(jcs);
+  const digest = await sha2.sha256.digest(bytes);
+  const cid$1 = cid.CID.createV1(RAW_CODEC, digest);
+  return `${DID_ARTIFACT_PREFIX}${cid$1.toString(base32.base32)}`;
+}
+function parseArtifactDid(did) {
+  if (typeof did !== "string" || !did.startsWith(DID_ARTIFACT_PREFIX)) {
+    throw new OmaTrustError("INVALID_DID", "Expected a did:artifact DID", { did });
+  }
+  const identifier = did.slice(DID_ARTIFACT_PREFIX.length);
+  if (!identifier || identifier.length === 0) {
+    throw new OmaTrustError("INVALID_DID", "Missing method-specific identifier", { did });
+  }
+  if (identifier[0] !== "b") {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `Invalid multibase prefix "${identifier[0]}", expected "b" (base32lower)`,
+      { did }
+    );
+  }
+  let cid$1;
+  try {
+    cid$1 = cid.CID.parse(identifier, base32.base32);
+  } catch (err) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      "Failed to decode base32 CID from did:artifact identifier",
+      { did, cause: err }
+    );
+  }
+  if (cid$1.version !== CID_VERSION) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `CID version must be 1, got ${cid$1.version}`,
+      { did }
+    );
+  }
+  if (cid$1.code !== RAW_CODEC) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `Multicodec must be raw (0x55), got 0x${cid$1.code.toString(16)}`,
+      { did }
+    );
+  }
+  if (cid$1.multihash.code !== SHA2_256_CODE) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `Multihash function must be sha2-256 (0x12), got 0x${cid$1.multihash.code.toString(16)}`,
+      { did }
+    );
+  }
+  if (cid$1.multihash.digest.length !== SHA2_256_DIGEST_LENGTH) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `SHA-256 digest must be 32 bytes, got ${cid$1.multihash.digest.length}`,
+      { did }
+    );
+  }
+  const digest = cid$1.multihash.digest;
+  const digestHex = Array.from(digest).map((b) => b.toString(16).padStart(2, "0")).join("");
+  return { did, identifier, digest, digestHex };
+}
+async function verifyDidArtifact(did, content) {
+  let parsed;
+  try {
+    parsed = parseArtifactDid(did);
+  } catch (err) {
+    return {
+      valid: false,
+      reason: err instanceof OmaTrustError ? err.message : "Invalid did:artifact DID"
+    };
+  }
+  const expectedHex = parsed.digestHex;
+  if (typeof content === "string" || typeof content === "object" && content !== null && !(content instanceof Uint8Array)) {
+    try {
+      const value = typeof content === "string" ? parseJsonStrict(content) : content;
+      const jcs = canonicalizeJson(value);
+      const jcsBytes = new TextEncoder().encode(jcs);
+      const digest2 = await sha2.sha256.digest(jcsBytes);
+      const digestHex2 = Array.from(digest2.digest).map((b) => b.toString(16).padStart(2, "0")).join("");
+      if (digestHex2 === expectedHex) {
+        return { valid: true, matchedAs: "json" };
+      }
+    } catch {
+    }
+  }
+  let rawBytes;
+  if (content instanceof Uint8Array) {
+    rawBytes = content;
+  } else if (typeof content === "string") {
+    rawBytes = new TextEncoder().encode(content);
+  } else {
+    return {
+      valid: false,
+      reason: "Content did not match as canonical JSON and is not raw bytes"
+    };
+  }
+  const digest = await sha2.sha256.digest(rawBytes);
+  const digestHex = Array.from(digest.digest).map((b) => b.toString(16).padStart(2, "0")).join("");
+  if (digestHex === expectedHex) {
+    return { valid: true, matchedAs: "binary" };
+  }
+  return {
+    valid: false,
+    reason: "Content does not match the did:artifact identifier (neither as canonical JSON nor as raw bytes)"
+  };
+}
+function didEthrToDidPkh(did) {
+  if (typeof did !== "string" || !did.startsWith("did:ethr:")) {
+    throw new OmaTrustError("INVALID_DID", "Expected a did:ethr DID", { did });
+  }
+  const remainder = did.slice("did:ethr:".length);
+  if (!remainder) {
+    throw new OmaTrustError("INVALID_DID", "Missing identifier in did:ethr DID", { did });
+  }
+  let chainId;
+  let address;
+  const parts = remainder.split(":");
+  if (parts.length === 1) {
+    chainId = "1";
+    address = parts[0];
+  } else if (parts.length === 2) {
+    const rawChainId = parts[0];
+    address = parts[1];
+    if (rawChainId.startsWith("0x")) {
+      chainId = String(parseInt(rawChainId, 16));
+    } else if (/^\d+$/.test(rawChainId)) {
+      chainId = rawChainId;
+    } else {
+      const networkMap = {
+        mainnet: "1",
+        goerli: "5",
+        sepolia: "11155111",
+        polygon: "137",
+        arbitrum: "42161",
+        optimism: "10",
+        base: "8453"
+      };
+      const mapped = networkMap[rawChainId.toLowerCase()];
+      if (!mapped) {
+        throw new OmaTrustError(
+          "INVALID_DID",
+          `Unknown did:ethr network "${rawChainId}"`,
+          { did, network: rawChainId }
+        );
+      }
+      chainId = mapped;
+    }
+  } else {
+    throw new OmaTrustError("INVALID_DID", "Invalid did:ethr format", { did });
+  }
+  if (!ethers.isAddress(address)) {
+    throw new OmaTrustError("INVALID_DID", "Invalid Ethereum address in did:ethr DID", {
+      did,
+      address
+    });
+  }
+  const checksummed = ethers.getAddress(address);
+  return `did:pkh:eip155:${chainId}:${checksummed.toLowerCase()}`;
+}
+var MULTICODEC_KEY_TYPES = {
+  // Ed25519 public key: 0xed (varint encoded as [0xed, 0x01])
+  237: { kty: "OKP", crv: "Ed25519" },
+  // X25519 public key: 0xec (varint encoded as [0xec, 0x01])
+  236: { kty: "OKP", crv: "X25519" },
+  // secp256k1 public key (compressed): 0xe7 (varint encoded as [0xe7, 0x01])
+  231: { kty: "EC", crv: "secp256k1", coordSize: 33 },
+  // P-256 public key (compressed): 0x80 0x24 (varint 0x1200)
+  4608: { kty: "EC", crv: "P-256", coordSize: 33 },
+  // P-384 public key (compressed): 0x81 0x24 (varint 0x1201)
+  4609: { kty: "EC", crv: "P-384", coordSize: 49 }
+};
+function readVarint(bytes, offset) {
+  let value = 0;
+  let shift = 0;
+  let bytesRead = 0;
+  while (offset + bytesRead < bytes.length) {
+    const byte = bytes[offset + bytesRead];
+    value |= (byte & 127) << shift;
+    bytesRead++;
+    if ((byte & 128) === 0) {
+      return { value, bytesRead };
+    }
+    shift += 7;
+    if (shift > 28) {
+      throw new OmaTrustError("INVALID_DID", "Varint too long in did:key multicodec prefix");
+    }
+  }
+  throw new OmaTrustError("INVALID_DID", "Truncated varint in did:key multicodec prefix");
+}
+function decompressEcKey(compressedKey, crv) {
+  throw new OmaTrustError(
+    "UNSUPPORTED_KEY_TYPE",
+    `Cannot convert compressed EC key (${crv}) from did:key to did:jwk. Decompressing EC points requires elliptic curve arithmetic. For EVM keys, use didEthrToDidPkh() instead.`,
+    { crv, keyLength: compressedKey.length }
+  );
+}
+function didKeyToDidJwk(did) {
+  if (typeof did !== "string" || !did.startsWith("did:key:")) {
+    throw new OmaTrustError("INVALID_DID", "Expected a did:key DID", { did });
+  }
+  const identifier = did.slice("did:key:".length);
+  if (!identifier || !identifier.startsWith("z")) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      "did:key identifier must start with 'z' (base58btc multibase prefix)",
+      { did }
+    );
+  }
+  let decoded;
+  try {
+    decoded = base58.base58btc.decode(identifier);
+  } catch (err) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      "Failed to decode base58btc from did:key identifier",
+      { did, cause: err }
+    );
+  }
+  if (decoded.length < 3) {
+    throw new OmaTrustError("INVALID_DID", "did:key decoded bytes too short", { did });
+  }
+  const { value: codecValue, bytesRead } = readVarint(decoded, 0);
+  const keyType = MULTICODEC_KEY_TYPES[codecValue];
+  if (!keyType) {
+    throw new OmaTrustError(
+      "UNSUPPORTED_KEY_TYPE",
+      `Unsupported multicodec key type 0x${codecValue.toString(16)} in did:key`,
+      { did, codec: `0x${codecValue.toString(16)}` }
+    );
+  }
+  const keyBytes = decoded.slice(bytesRead);
+  if (keyType.kty === "OKP") {
+    if (keyBytes.length !== 32) {
+      throw new OmaTrustError(
+        "INVALID_DID",
+        `Expected 32-byte ${keyType.crv} key, got ${keyBytes.length} bytes`,
+        { did, crv: keyType.crv }
+      );
+    }
+    const jwk = {
+      kty: keyType.kty,
+      crv: keyType.crv,
+      x: jose.base64url.encode(keyBytes)
+    };
+    return jwkToDidJwk(jwk);
+  }
+  return decompressEcKey(keyBytes, keyType.crv).x.toString();
+}
 
 // src/reputation/index.ts
 var reputation_exports = {};
@@ -960,10 +1439,13 @@ __export(reputation_exports, {
   verifyDidWebOwnership: () => verifyDidWebOwnership,
   verifyDnsTxtControllerDid: () => verifyDnsTxtControllerDid2,
   verifyEip712Signature: () => verifyEip712Signature,
+  verifyKeyBindingProofs: () => verifyKeyBindingProofs,
+  verifyLinkedIdentifierProofs: () => verifyLinkedIdentifierProofs,
   verifyProof: () => verifyProof,
   verifySchemaExists: () => verifySchemaExists,
   verifySubjectOwnership: () => verifySubjectOwnership,
   verifyTransferProof: () => verifyTransferProof,
+  verifyX402Artifact: () => verifyX402Artifact,
   verifyX402Eip712Artifact: () => verifyX402Eip712Artifact,
   verifyX402Eip712Offer: () => verifyX402Eip712Offer,
   verifyX402Eip712Receipt: () => verifyX402Eip712Receipt,
@@ -1976,10 +2458,10 @@ function validateReceiptPayload(payload) {
   }
   return { valid: true };
 }
-function failure(code, message, partial) {
+function failure(code2, message, partial) {
   return {
     valid: false,
-    error: { code, message },
+    error: { code: code2, message },
     ...partial
   };
 }
@@ -2177,10 +2659,10 @@ function validateReceiptPayload2(payload) {
   }
   return { valid: true };
 }
-function failure2(code, message, partial) {
+function failure2(code2, message, partial) {
   return {
     valid: false,
-    error: { code, message },
+    error: { code: code2, message },
     ...partial
   };
 }
@@ -2698,8 +3180,8 @@ async function readOwnerFromContract(provider, contractAddress, signature, metho
 }
 async function discoverContractOwner(provider, contractAddress) {
   try {
-    const code = await provider.getCode(contractAddress);
-    if (code === "0x" || code === "0x0") {
+    const code2 = await provider.getCode(contractAddress);
+    if (code2 === "0x" || code2 === "0x0") {
       return null;
     }
   } catch {
@@ -3207,6 +3689,42 @@ function createX402OfferProof(offer) {
   };
 }
 
+// src/reputation/proof/x402-verify.ts
+async function verifyX402Artifact(artifact, options) {
+  if (!artifact || typeof artifact !== "object") {
+    return {
+      valid: false,
+      error: { code: "INVALID_ARTIFACT", message: "Artifact must be a non-null object" }
+    };
+  }
+  const format = artifact.format;
+  switch (format) {
+    case "jws": {
+      const jwsArtifact = artifact;
+      const jwsOptions = options.resolveOptions ? { resolveOptions: options.resolveOptions } : void 0;
+      if (options.artifactType === "offer") {
+        return verifyX402JwsOffer(jwsArtifact, jwsOptions);
+      }
+      return verifyX402JwsReceipt(jwsArtifact, jwsOptions);
+    }
+    case "eip712": {
+      const eip712Artifact = artifact;
+      if (options.artifactType === "offer") {
+        return verifyX402Eip712Offer(eip712Artifact);
+      }
+      return verifyX402Eip712Receipt(eip712Artifact);
+    }
+    default:
+      return {
+        valid: false,
+        error: {
+          code: "UNSUPPORTED_FORMAT",
+          message: `Unsupported x402 artifact format: "${format}"`
+        }
+      };
+  }
+}
+
 // src/reputation/proof/evidence-pointer.ts
 function createEvidencePointerProof(url) {
   if (!url || typeof url !== "string") {
@@ -3315,8 +3833,8 @@ async function verifyDidPkhOwnership(params) {
       subjectDid: params.subjectDid
     });
   }
-  const code = await params.provider.getCode(subjectAddress);
-  const isContract = code !== "0x" && code !== "0x0";
+  const code2 = await params.provider.getCode(subjectAddress);
+  const isContract = code2 !== "0x" && code2 !== "0x0";
   if (!isContract) {
     if (ethers.getAddress(subjectAddress) === ethers.getAddress(connectedWalletAddress)) {
       return {
@@ -3492,6 +4010,300 @@ async function verifySubjectOwnership(params) {
     subjectDid
   });
 }
+function extractEip712Signer(proof) {
+  const { domain, message, signature } = proof.proofObject;
+  const typedData = {
+    domain,
+    types: {
+      OmaTrustProof: [
+        { name: "signer", type: "address" },
+        { name: "authorizedEntity", type: "string" },
+        { name: "signingPurpose", type: "string" },
+        { name: "creationTimestamp", type: "uint256" },
+        { name: "expirationTimestamp", type: "uint256" },
+        { name: "randomValue", type: "bytes32" },
+        { name: "statement", type: "string" }
+      ]
+    },
+    message
+  };
+  try {
+    const result = verifyEip712Signature(typedData, signature);
+    return result.valid && result.signer ? result.signer : null;
+  } catch (err) {
+    console.warn("[omatrust] EIP-712 signer extraction failed:", err);
+    return null;
+  }
+}
+function extractJwsHeaderJwk(proof) {
+  const jws = proof.proofObject;
+  if (typeof jws !== "string") return null;
+  const parts = jws.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const headerB64 = parts[0].replace(/-/g, "+").replace(/_/g, "/");
+    const padded = headerB64.padEnd(
+      headerB64.length + (4 - headerB64.length % 4) % 4,
+      "="
+    );
+    let headerJson;
+    if (typeof atob === "function") {
+      headerJson = decodeURIComponent(
+        Array.from(atob(padded)).map((char) => `%${char.charCodeAt(0).toString(16).padStart(2, "0")}`).join("")
+      );
+    } else {
+      headerJson = Buffer.from(padded, "base64").toString("utf8");
+    }
+    const header = JSON.parse(headerJson);
+    return header.jwk ?? null;
+  } catch {
+    return null;
+  }
+}
+function extractJwsPayload(proof) {
+  const jws = proof.proofObject;
+  if (typeof jws !== "string") return null;
+  const parts = jws.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const payloadB64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const padded = payloadB64.padEnd(
+      payloadB64.length + (4 - payloadB64.length % 4) % 4,
+      "="
+    );
+    let payloadJson;
+    if (typeof atob === "function") {
+      payloadJson = decodeURIComponent(
+        Array.from(atob(padded)).map((char) => `%${char.charCodeAt(0).toString(16).padStart(2, "0")}`).join("")
+      );
+    } else {
+      payloadJson = Buffer.from(padded, "base64").toString("utf8");
+    }
+    return JSON.parse(payloadJson);
+  } catch {
+    return null;
+  }
+}
+function signerMatchesDid(signerAddress, did) {
+  try {
+    const didAddress = extractAddressFromDid(did);
+    return ethers.getAddress(signerAddress).toLowerCase() === ethers.getAddress(didAddress).toLowerCase();
+  } catch {
+    return false;
+  }
+}
+function jwkMatchesDid(jwk, did) {
+  const method = extractDidMethod(did);
+  if (method === "jwk") {
+    try {
+      const didJwk = didJwkToJwk(did);
+      return publicJwkEquals(jwk, didJwk);
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+function proofSignerMatchesDid(proof, did) {
+  switch (proof.proofType) {
+    case "pop-eip712": {
+      const signer = extractEip712Signer(proof);
+      if (!signer) return false;
+      return signerMatchesDid(signer, did);
+    }
+    case "pop-jws": {
+      const jwsProof = proof;
+      const jwk = extractJwsHeaderJwk(jwsProof);
+      if (jwk && jwkMatchesDid(jwk, did)) return true;
+      const payload = extractJwsPayload(jwsProof);
+      if (payload && typeof payload.iss === "string") {
+        if (payload.iss === did) return true;
+      }
+      return false;
+    }
+    case "tx-encoded-value":
+    case "tx-interaction":
+      return false;
+    case "evidence-pointer":
+      return false;
+    default:
+      return false;
+  }
+}
+function proofAuthorizedEntityMatchesDid(proof, did) {
+  switch (proof.proofType) {
+    case "pop-eip712": {
+      const eip712 = proof;
+      const authorizedEntity = eip712.proofObject.message.authorizedEntity;
+      return typeof authorizedEntity === "string" && authorizedEntity === did;
+    }
+    case "pop-jws": {
+      const payload = extractJwsPayload(proof);
+      if (!payload) return false;
+      return typeof payload.aud === "string" && payload.aud === did;
+    }
+    default:
+      return false;
+  }
+}
+function verifyLinkedIdentifierProofs(data) {
+  if (!data.subject || !data.linkedId) {
+    return {
+      valid: false,
+      checks: [],
+      reasons: ["subject and linkedId are required"]
+    };
+  }
+  if (!Array.isArray(data.proofs) || data.proofs.length === 0) {
+    return {
+      valid: false,
+      checks: [],
+      reasons: ["At least one proof is required"]
+    };
+  }
+  const checks = [];
+  let subjectProved = false;
+  let linkedIdProved = false;
+  for (let i = 0; i < data.proofs.length; i++) {
+    const proof = data.proofs[i];
+    if (proofSignerMatchesDid(proof, data.subject)) {
+      checks.push({
+        proofIndex: i,
+        proofType: proof.proofType,
+        checkType: "signer-is-subject",
+        valid: true
+      });
+      subjectProved = true;
+      if (!proofAuthorizedEntityMatchesDid(proof, data.linkedId)) {
+        checks.push({
+          proofIndex: i,
+          proofType: proof.proofType,
+          checkType: "signer-is-subject",
+          valid: false,
+          reason: "Proof from subject does not authorize linkedId (aud mismatch)"
+        });
+      }
+    }
+    if (proofSignerMatchesDid(proof, data.linkedId)) {
+      checks.push({
+        proofIndex: i,
+        proofType: proof.proofType,
+        checkType: "signer-is-linkedId",
+        valid: true
+      });
+      linkedIdProved = true;
+      if (!proofAuthorizedEntityMatchesDid(proof, data.subject)) {
+        checks.push({
+          proofIndex: i,
+          proofType: proof.proofType,
+          checkType: "signer-is-linkedId",
+          valid: false,
+          reason: "Proof from linkedId does not authorize subject (aud mismatch)"
+        });
+      }
+    }
+    if (proof.proofType === "evidence-pointer") {
+      checks.push({
+        proofIndex: i,
+        proofType: proof.proofType,
+        checkType: "signer-is-subject",
+        valid: true,
+        reason: "Evidence pointer accepted (requires URL fetch for full verification)"
+      });
+      subjectProved = true;
+    }
+  }
+  const reasons = [];
+  if (!subjectProved) {
+    reasons.push("No proof demonstrates control by subject");
+  }
+  if (!linkedIdProved) {
+    reasons.push("No proof demonstrates control by linkedId");
+  }
+  return {
+    valid: reasons.length === 0,
+    checks,
+    reasons
+  };
+}
+function verifyKeyBindingProofs(data) {
+  if (!data.subject || !data.keyId) {
+    return {
+      valid: false,
+      checks: [],
+      reasons: ["subject and keyId are required"]
+    };
+  }
+  if (!Array.isArray(data.proofs) || data.proofs.length === 0) {
+    return {
+      valid: false,
+      checks: [],
+      reasons: ["At least one proof is required"]
+    };
+  }
+  const checks = [];
+  let subjectAuthorizedKey = false;
+  for (let i = 0; i < data.proofs.length; i++) {
+    const proof = data.proofs[i];
+    if (proofSignerMatchesDid(proof, data.subject)) {
+      const authorizesKey = proofAuthorizedEntityMatchesDid(proof, data.keyId);
+      checks.push({
+        proofIndex: i,
+        proofType: proof.proofType,
+        checkType: "signer-is-subject-for-key",
+        valid: authorizesKey,
+        reason: authorizesKey ? void 0 : "Proof signed by subject but does not authorize the keyId"
+      });
+      if (authorizesKey) {
+        subjectAuthorizedKey = true;
+      }
+    }
+    if (proofSignerMatchesDid(proof, data.keyId)) {
+      checks.push({
+        proofIndex: i,
+        proofType: proof.proofType,
+        checkType: "signer-is-keyId",
+        valid: true,
+        reason: "Key proved possession (supplementary, not sufficient alone)"
+      });
+    }
+    if (proof.proofType === "evidence-pointer") {
+      checks.push({
+        proofIndex: i,
+        proofType: proof.proofType,
+        checkType: "signer-is-subject-for-key",
+        valid: true,
+        reason: "Evidence pointer accepted (requires URL fetch for full verification)"
+      });
+      subjectAuthorizedKey = true;
+    }
+  }
+  if (data.publicKeyJwk && extractDidMethod(data.keyId) === "jwk") {
+    try {
+      const keyIdJwk = didJwkToJwk(data.keyId);
+      const jwkConsistent = publicJwkEquals(data.publicKeyJwk, keyIdJwk);
+      if (!jwkConsistent) {
+        return {
+          valid: false,
+          checks,
+          reasons: ["publicKeyJwk does not match the key material in keyId (did:jwk)"]
+        };
+      }
+    } catch {
+    }
+  }
+  const reasons = [];
+  if (!subjectAuthorizedKey) {
+    reasons.push(
+      "No proof demonstrates that subject authorized the key binding"
+    );
+  }
+  return {
+    valid: reasons.length === 0,
+    checks,
+    reasons
+  };
+}
 
 // src/app-registry/index.ts
 var app_registry_exports = {};
@@ -3579,8 +4391,8 @@ function getInterfaceTypes(bitmap) {
 }
 
 // src/app-registry/status.ts
-function registryCodeToStatus(code) {
-  switch (code) {
+function registryCodeToStatus(code2) {
+  switch (code2) {
     case 0:
       return "Active";
     case 1:
@@ -3588,7 +4400,7 @@ function registryCodeToStatus(code) {
     case 2:
       return "Replaced";
     default:
-      throw new OmaTrustError("INVALID_INPUT", "Invalid registry status code", { code });
+      throw new OmaTrustError("INVALID_INPUT", "Invalid registry status code", { code: code2 });
   }
 }
 function registryStatusToCode(status) {
@@ -3690,6 +4502,9 @@ async function computeDataHashFromUrl(url, algorithm) {
   if (!url || typeof url !== "string") {
     throw new OmaTrustError("INVALID_INPUT", "url must be a non-empty string", { url });
   }
+  if (algorithm !== "keccak256" && algorithm !== "sha256") {
+    throw new OmaTrustError("INVALID_INPUT", `Unsupported hash algorithm: "${algorithm}". Must be "keccak256" or "sha256".`, { algorithm });
+  }
   const json = await fetchJson(url);
   const jcsJson = canonicalizeJson(json);
   return hashJcs(jcsJson, algorithm);