@oma3/omatrust 0.1.0-alpha.11 → 0.1.0-alpha.13

package/dist/reputation/index.js

@@ -3,6 +3,10 @@ import { ZeroAddress, Signature, toUtf8Bytes, sha256, keccak256, formatUnits, ge
 import { decodeProtectedHeader, importJWK, compactVerify, base64url } from 'jose';
 import canonicalize from 'canonicalize';
 import { resolveTxt } from 'dns/promises';
+import { CID } from 'multiformats/cid';
+import 'multiformats/hashes/sha2';
+import * as raw from 'multiformats/codecs/raw';
+import { base32 } from 'multiformats/bases/base32';
 
 // src/reputation/submit.ts
 
@@ -10,10 +14,10 @@ import { resolveTxt } from 'dns/promises';
 var OmaTrustError = class extends Error {
   code;
   details;
-  constructor(code, message, details) {
+  constructor(code2, message, details) {
     super(message);
     this.name = "OmaTrustError";
-    this.code = code;
+    this.code = code2;
     this.details = details;
   }
 };
@@ -194,14 +198,14 @@ function extractExpirationTime(data) {
 }
 
 // src/shared/assert.ts
-function assertString(value, name, code = "INVALID_INPUT") {
+function assertString(value, name, code2 = "INVALID_INPUT") {
   if (typeof value !== "string" || value.trim().length === 0) {
-    throw new OmaTrustError(code, `${name} must be a non-empty string`, { value });
+    throw new OmaTrustError(code2, `${name} must be a non-empty string`, { value });
   }
 }
-function assertObject(value, name, code = "INVALID_INPUT") {
+function assertObject(value, name, code2 = "INVALID_INPUT") {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new OmaTrustError(code, `${name} must be an object`, { value });
+    throw new OmaTrustError(code2, `${name} must be an object`, { value });
   }
 }
 
@@ -222,6 +226,145 @@ function parseCaip10(input) {
   }
   return { namespace, reference, address };
 }
+var VALID_KTY = /* @__PURE__ */ new Set(["EC", "OKP", "RSA"]);
+var PRIVATE_KEY_FIELDS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth"]);
+var REQUIRED_PUBLIC_FIELDS = {
+  EC: ["crv", "x", "y"],
+  OKP: ["crv", "x"],
+  RSA: ["n", "e"]
+};
+function validatePublicJwk(jwk) {
+  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
+    return { valid: false, error: "JWK must be a non-null object" };
+  }
+  const obj = jwk;
+  const kty = obj.kty;
+  if (typeof kty !== "string" || !VALID_KTY.has(kty)) {
+    return {
+      valid: false,
+      error: `Invalid or missing kty (must be one of: ${[...VALID_KTY].join(", ")})`
+    };
+  }
+  for (const field of PRIVATE_KEY_FIELDS) {
+    if (field in obj) {
+      return {
+        valid: false,
+        error: `JWK contains private key field "${field}" \u2014 only public keys are allowed`
+      };
+    }
+  }
+  const required = REQUIRED_PUBLIC_FIELDS[kty];
+  if (required) {
+    for (const field of required) {
+      if (!(field in obj) || obj[field] === void 0 || obj[field] === null || obj[field] === "") {
+        return {
+          valid: false,
+          error: `Missing required public key field "${field}" for kty="${kty}"`
+        };
+      }
+    }
+  }
+  return { valid: true };
+}
+function canonicalizeJwkJson(jwk) {
+  const sorted = Object.keys(jwk).sort();
+  const obj = {};
+  for (const key of sorted) {
+    obj[key] = jwk[key];
+  }
+  return JSON.stringify(obj);
+}
+function jwkToDidJwk(jwk) {
+  assertObject(jwk, "jwk", "INVALID_JWK");
+  const validation = validatePublicJwk(jwk);
+  if (!validation.valid) {
+    throw new OmaTrustError("INVALID_JWK", validation.error ?? "Invalid public JWK", { jwk });
+  }
+  const canonical = canonicalizeJwkJson(jwk);
+  const encoded = base64url.encode(new TextEncoder().encode(canonical));
+  return `did:jwk:${encoded}`;
+}
+function didJwkToJwk(didJwk) {
+  if (typeof didJwk !== "string" || !didJwk.startsWith("did:jwk:")) {
+    throw new OmaTrustError("INVALID_DID", "Expected a did:jwk DID", { input: didJwk });
+  }
+  const parts = didJwk.split(":");
+  if (parts.length !== 3) {
+    throw new OmaTrustError("INVALID_DID", "did:jwk must have exactly 3 colon-separated parts", {
+      input: didJwk
+    });
+  }
+  const encoded = parts[2];
+  if (!encoded || encoded.length === 0) {
+    throw new OmaTrustError("INVALID_DID", "Missing base64url-encoded JWK identifier", {
+      input: didJwk
+    });
+  }
+  let decoded;
+  try {
+    const bytes = base64url.decode(encoded);
+    decoded = new TextDecoder().decode(bytes);
+  } catch {
+    throw new OmaTrustError("INVALID_DID", "Failed to base64url-decode did:jwk identifier", {
+      input: didJwk
+    });
+  }
+  let jwk;
+  try {
+    jwk = JSON.parse(decoded);
+  } catch {
+    throw new OmaTrustError("INVALID_DID", "Decoded did:jwk identifier is not valid JSON", {
+      input: didJwk
+    });
+  }
+  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
+    throw new OmaTrustError("INVALID_DID", "Decoded did:jwk must be a JSON object", {
+      input: didJwk
+    });
+  }
+  const validation = validatePublicJwk(jwk);
+  if (!validation.valid) {
+    throw new OmaTrustError("INVALID_DID", validation.error ?? "Invalid public JWK in did:jwk", {
+      input: didJwk
+    });
+  }
+  return jwk;
+}
+function extractPublicKeyFields(jwk) {
+  const result = {};
+  const metadataFields = /* @__PURE__ */ new Set(["kid", "use", "key_ops", "alg", "ext"]);
+  for (const [key, value] of Object.entries(jwk)) {
+    if (PRIVATE_KEY_FIELDS.has(key)) continue;
+    if (metadataFields.has(key)) continue;
+    result[key] = value;
+  }
+  return result;
+}
+function publicJwkEquals(a, b) {
+  assertObject(a, "a", "INVALID_JWK");
+  assertObject(b, "b", "INVALID_JWK");
+  const aObj = a;
+  const bObj = b;
+  for (const field of PRIVATE_KEY_FIELDS) {
+    if (field in aObj) {
+      throw new OmaTrustError(
+        "INVALID_JWK",
+        `First JWK contains private key field "${field}"`,
+        { field }
+      );
+    }
+    if (field in bObj) {
+      throw new OmaTrustError(
+        "INVALID_JWK",
+        `Second JWK contains private key field "${field}"`,
+        { field }
+      );
+    }
+  }
+  const aPublic = extractPublicKeyFields(aObj);
+  const bPublic = extractPublicKeyFields(bObj);
+  return canonicalizeJwkJson(aPublic) === canonicalizeJwkJson(bPublic);
+}
 
 // src/identity/did.ts
 var DID_REGEX = /^did:[a-z0-9]+:.+$/i;
@@ -293,7 +436,7 @@ function normalizeDidKey(input) {
 }
 function normalizeDid(input) {
   assertString(input, "input", "INVALID_DID");
-  const trimmed = input.trim();
+  const trimmed = input.trim().split("#")[0];
   if (!trimmed.startsWith("did:")) {
     return normalizeDidWeb(trimmed);
   }
@@ -454,6 +597,10 @@ function validateDidJwk(did) {
       error: "DID must reference a public key \u2014 private key component (d) is not allowed"
     };
   }
+  const jwkValidation = validatePublicJwk(jwk);
+  if (!jwkValidation.valid) {
+    return { valid: false, method: "jwk", error: jwkValidation.error };
+  }
   return { valid: true, method: "jwk" };
 }
 function normalizeDidJwk(input) {
@@ -1112,154 +1259,15 @@ function createTxEncodedValueProof(chainId, txHash, purpose) {
   };
 }
 function formatTransferAmount(amount, chainId) {
-  const config = getConfig(chainId);
-  const normalized = typeof amount === "number" ? BigInt(Math.floor(amount)) : amount;
-  return `${formatUnits(normalized, config.decimals)} ${config.nativeSymbol}`;
-}
-function getExplorerTxUrl(chainId, txHash) {
-  return `${getConfig(chainId).explorer}/tx/${txHash}`;
-}
-function getExplorerAddressUrl(chainId, address) {
-  return `${getConfig(chainId).explorer}/address/${address}`;
-}
-var VALID_KTY = /* @__PURE__ */ new Set(["EC", "OKP", "RSA"]);
-var PRIVATE_KEY_FIELDS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth"]);
-var REQUIRED_PUBLIC_FIELDS = {
-  EC: ["crv", "x", "y"],
-  OKP: ["crv", "x"],
-  RSA: ["n", "e"]
-};
-function validatePublicJwk(jwk) {
-  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
-    return { valid: false, error: "JWK must be a non-null object" };
-  }
-  const obj = jwk;
-  const kty = obj.kty;
-  if (typeof kty !== "string" || !VALID_KTY.has(kty)) {
-    return {
-      valid: false,
-      error: `Invalid or missing kty (must be one of: ${[...VALID_KTY].join(", ")})`
-    };
-  }
-  for (const field of PRIVATE_KEY_FIELDS) {
-    if (field in obj) {
-      return {
-        valid: false,
-        error: `JWK contains private key field "${field}" \u2014 only public keys are allowed`
-      };
-    }
-  }
-  const required = REQUIRED_PUBLIC_FIELDS[kty];
-  if (required) {
-    for (const field of required) {
-      if (!(field in obj) || obj[field] === void 0 || obj[field] === null || obj[field] === "") {
-        return {
-          valid: false,
-          error: `Missing required public key field "${field}" for kty="${kty}"`
-        };
-      }
-    }
-  }
-  return { valid: true };
-}
-function canonicalizeJwkJson(jwk) {
-  const sorted = Object.keys(jwk).sort();
-  const obj = {};
-  for (const key of sorted) {
-    obj[key] = jwk[key];
-  }
-  return JSON.stringify(obj);
-}
-function jwkToDidJwk(jwk) {
-  assertObject(jwk, "jwk", "INVALID_JWK");
-  const validation = validatePublicJwk(jwk);
-  if (!validation.valid) {
-    throw new OmaTrustError("INVALID_JWK", validation.error ?? "Invalid public JWK", { jwk });
-  }
-  const canonical = canonicalizeJwkJson(jwk);
-  const encoded = base64url.encode(new TextEncoder().encode(canonical));
-  return `did:jwk:${encoded}`;
-}
-function didJwkToJwk(didJwk) {
-  if (typeof didJwk !== "string" || !didJwk.startsWith("did:jwk:")) {
-    throw new OmaTrustError("INVALID_DID", "Expected a did:jwk DID", { input: didJwk });
-  }
-  const parts = didJwk.split(":");
-  if (parts.length !== 3) {
-    throw new OmaTrustError("INVALID_DID", "did:jwk must have exactly 3 colon-separated parts", {
-      input: didJwk
-    });
-  }
-  const encoded = parts[2];
-  if (!encoded || encoded.length === 0) {
-    throw new OmaTrustError("INVALID_DID", "Missing base64url-encoded JWK identifier", {
-      input: didJwk
-    });
-  }
-  let decoded;
-  try {
-    const bytes = base64url.decode(encoded);
-    decoded = new TextDecoder().decode(bytes);
-  } catch {
-    throw new OmaTrustError("INVALID_DID", "Failed to base64url-decode did:jwk identifier", {
-      input: didJwk
-    });
-  }
-  let jwk;
-  try {
-    jwk = JSON.parse(decoded);
-  } catch {
-    throw new OmaTrustError("INVALID_DID", "Decoded did:jwk identifier is not valid JSON", {
-      input: didJwk
-    });
-  }
-  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
-    throw new OmaTrustError("INVALID_DID", "Decoded did:jwk must be a JSON object", {
-      input: didJwk
-    });
-  }
-  const validation = validatePublicJwk(jwk);
-  if (!validation.valid) {
-    throw new OmaTrustError("INVALID_DID", validation.error ?? "Invalid public JWK in did:jwk", {
-      input: didJwk
-    });
-  }
-  return jwk;
-}
-function extractPublicKeyFields(jwk) {
-  const result = {};
-  const metadataFields = /* @__PURE__ */ new Set(["kid", "use", "key_ops", "alg", "ext"]);
-  for (const [key, value] of Object.entries(jwk)) {
-    if (PRIVATE_KEY_FIELDS.has(key)) continue;
-    if (metadataFields.has(key)) continue;
-    result[key] = value;
-  }
-  return result;
-}
-function publicJwkEquals(a, b) {
-  assertObject(a, "a", "INVALID_JWK");
-  assertObject(b, "b", "INVALID_JWK");
-  const aObj = a;
-  const bObj = b;
-  for (const field of PRIVATE_KEY_FIELDS) {
-    if (field in aObj) {
-      throw new OmaTrustError(
-        "INVALID_JWK",
-        `First JWK contains private key field "${field}"`,
-        { field }
-      );
-    }
-    if (field in bObj) {
-      throw new OmaTrustError(
-        "INVALID_JWK",
-        `Second JWK contains private key field "${field}"`,
-        { field }
-      );
-    }
-  }
-  const aPublic = extractPublicKeyFields(aObj);
-  const bPublic = extractPublicKeyFields(bObj);
-  return canonicalizeJwkJson(aPublic) === canonicalizeJwkJson(bPublic);
+  const config = getConfig(chainId);
+  const normalized = typeof amount === "number" ? BigInt(Math.floor(amount)) : amount;
+  return `${formatUnits(normalized, config.decimals)} ${config.nativeSymbol}`;
+}
+function getExplorerTxUrl(chainId, txHash) {
+  return `${getConfig(chainId).explorer}/tx/${txHash}`;
+}
+function getExplorerAddressUrl(chainId, address) {
+  return `${getConfig(chainId).explorer}/address/${address}`;
 }
 
 // src/shared/did-document.ts
@@ -1587,10 +1595,10 @@ function validateReceiptPayload(payload) {
   }
   return { valid: true };
 }
-function failure(code, message, partial) {
+function failure(code2, message, partial) {
   return {
     valid: false,
-    error: { code, message },
+    error: { code: code2, message },
     ...partial
   };
 }
@@ -1788,10 +1796,10 @@ function validateReceiptPayload2(payload) {
   }
   return { valid: true };
 }
-function failure2(code, message, partial) {
+function failure2(code2, message, partial) {
   return {
     valid: false,
-    error: { code, message },
+    error: { code: code2, message },
     ...partial
   };
 }
@@ -2309,8 +2317,8 @@ async function readOwnerFromContract(provider, contractAddress, signature, metho
 }
 async function discoverContractOwner(provider, contractAddress) {
   try {
-    const code = await provider.getCode(contractAddress);
-    if (code === "0x" || code === "0x0") {
+    const code2 = await provider.getCode(contractAddress);
+    if (code2 === "0x" || code2 === "0x0") {
       return null;
     }
   } catch {
@@ -2862,6 +2870,42 @@ function createX402OfferProof(offer) {
   };
 }
 
+// src/reputation/proof/x402-verify.ts
+async function verifyX402Artifact(artifact, options) {
+  if (!artifact || typeof artifact !== "object") {
+    return {
+      valid: false,
+      error: { code: "INVALID_ARTIFACT", message: "Artifact must be a non-null object" }
+    };
+  }
+  const format = artifact.format;
+  switch (format) {
+    case "jws": {
+      const jwsArtifact = artifact;
+      const jwsOptions = options.resolveOptions ? { resolveOptions: options.resolveOptions } : void 0;
+      if (options.artifactType === "offer") {
+        return verifyX402JwsOffer(jwsArtifact, jwsOptions);
+      }
+      return verifyX402JwsReceipt(jwsArtifact, jwsOptions);
+    }
+    case "eip712": {
+      const eip712Artifact = artifact;
+      if (options.artifactType === "offer") {
+        return verifyX402Eip712Offer(eip712Artifact);
+      }
+      return verifyX402Eip712Receipt(eip712Artifact);
+    }
+    default:
+      return {
+        valid: false,
+        error: {
+          code: "UNSUPPORTED_FORMAT",
+          message: `Unsupported x402 artifact format: "${format}"`
+        }
+      };
+  }
+}
+
 // src/reputation/proof/evidence-pointer.ts
 function createEvidencePointerProof(url) {
   if (!url || typeof url !== "string") {
@@ -2970,8 +3014,8 @@ async function verifyDidPkhOwnership(params) {
       subjectDid: params.subjectDid
     });
   }
-  const code = await params.provider.getCode(subjectAddress);
-  const isContract = code !== "0x" && code !== "0x0";
+  const code2 = await params.provider.getCode(subjectAddress);
+  const isContract = code2 !== "0x" && code2 !== "0x0";
   if (!isContract) {
     if (getAddress(subjectAddress) === getAddress(connectedWalletAddress)) {
       return {
@@ -3147,7 +3191,659 @@ async function verifySubjectOwnership(params) {
     subjectDid
   });
 }
+function extractEip712Signer(proof) {
+  const { domain, message, signature } = proof.proofObject;
+  const typedData = {
+    domain,
+    types: {
+      OmaTrustProof: [
+        { name: "signer", type: "address" },
+        { name: "authorizedEntity", type: "string" },
+        { name: "signingPurpose", type: "string" },
+        { name: "creationTimestamp", type: "uint256" },
+        { name: "expirationTimestamp", type: "uint256" },
+        { name: "randomValue", type: "bytes32" },
+        { name: "statement", type: "string" }
+      ]
+    },
+    message
+  };
+  try {
+    const result = verifyEip712Signature(typedData, signature);
+    return result.valid && result.signer ? result.signer : null;
+  } catch (err) {
+    console.warn("[omatrust] EIP-712 signer extraction failed:", err);
+    return null;
+  }
+}
+function extractJwsHeaderJwk(proof) {
+  const jws = proof.proofObject;
+  if (typeof jws !== "string") return null;
+  const parts = jws.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const headerB64 = parts[0].replace(/-/g, "+").replace(/_/g, "/");
+    const padded = headerB64.padEnd(
+      headerB64.length + (4 - headerB64.length % 4) % 4,
+      "="
+    );
+    let headerJson;
+    if (typeof atob === "function") {
+      headerJson = decodeURIComponent(
+        Array.from(atob(padded)).map((char) => `%${char.charCodeAt(0).toString(16).padStart(2, "0")}`).join("")
+      );
+    } else {
+      headerJson = Buffer.from(padded, "base64").toString("utf8");
+    }
+    const header = JSON.parse(headerJson);
+    return header.jwk ?? null;
+  } catch {
+    return null;
+  }
+}
+function extractJwsPayload(proof) {
+  const jws = proof.proofObject;
+  if (typeof jws !== "string") return null;
+  const parts = jws.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const payloadB64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const padded = payloadB64.padEnd(
+      payloadB64.length + (4 - payloadB64.length % 4) % 4,
+      "="
+    );
+    let payloadJson;
+    if (typeof atob === "function") {
+      payloadJson = decodeURIComponent(
+        Array.from(atob(padded)).map((char) => `%${char.charCodeAt(0).toString(16).padStart(2, "0")}`).join("")
+      );
+    } else {
+      payloadJson = Buffer.from(padded, "base64").toString("utf8");
+    }
+    return JSON.parse(payloadJson);
+  } catch {
+    return null;
+  }
+}
+function signerMatchesDid(signerAddress, did) {
+  try {
+    const didAddress = extractAddressFromDid(did);
+    return getAddress(signerAddress).toLowerCase() === getAddress(didAddress).toLowerCase();
+  } catch {
+    return false;
+  }
+}
+function jwkMatchesDid(jwk, did) {
+  const method = extractDidMethod(did);
+  if (method === "jwk") {
+    try {
+      const didJwk = didJwkToJwk(did);
+      return publicJwkEquals(jwk, didJwk);
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+function proofSignerMatchesDid(proof, did) {
+  switch (proof.proofType) {
+    case "pop-eip712": {
+      const signer = extractEip712Signer(proof);
+      if (!signer) return false;
+      return signerMatchesDid(signer, did);
+    }
+    case "pop-jws": {
+      const jwsProof = proof;
+      const jwk = extractJwsHeaderJwk(jwsProof);
+      if (jwk && jwkMatchesDid(jwk, did)) return true;
+      const payload = extractJwsPayload(jwsProof);
+      if (payload && typeof payload.iss === "string") {
+        if (payload.iss === did) return true;
+      }
+      return false;
+    }
+    case "tx-encoded-value":
+    case "tx-interaction":
+      return false;
+    case "evidence-pointer":
+      return false;
+    default:
+      return false;
+  }
+}
+function proofAuthorizedEntityMatchesDid(proof, did) {
+  switch (proof.proofType) {
+    case "pop-eip712": {
+      const eip712 = proof;
+      const authorizedEntity = eip712.proofObject.message.authorizedEntity;
+      return typeof authorizedEntity === "string" && authorizedEntity === did;
+    }
+    case "pop-jws": {
+      const payload = extractJwsPayload(proof);
+      if (!payload) return false;
+      return typeof payload.aud === "string" && payload.aud === did;
+    }
+    default:
+      return false;
+  }
+}
+function verifyLinkedIdentifierProofs(data) {
+  if (!data.subject || !data.linkedId) {
+    return {
+      valid: false,
+      checks: [],
+      reasons: ["subject and linkedId are required"]
+    };
+  }
+  if (!Array.isArray(data.proofs) || data.proofs.length === 0) {
+    return {
+      valid: false,
+      checks: [],
+      reasons: ["At least one proof is required"]
+    };
+  }
+  const checks = [];
+  let subjectProved = false;
+  let linkedIdProved = false;
+  for (let i = 0; i < data.proofs.length; i++) {
+    const proof = data.proofs[i];
+    if (proofSignerMatchesDid(proof, data.subject)) {
+      checks.push({
+        proofIndex: i,
+        proofType: proof.proofType,
+        checkType: "signer-is-subject",
+        valid: true
+      });
+      subjectProved = true;
+      if (!proofAuthorizedEntityMatchesDid(proof, data.linkedId)) {
+        checks.push({
+          proofIndex: i,
+          proofType: proof.proofType,
+          checkType: "signer-is-subject",
+          valid: false,
+          reason: "Proof from subject does not authorize linkedId (aud mismatch)"
+        });
+      }
+    }
+    if (proofSignerMatchesDid(proof, data.linkedId)) {
+      checks.push({
+        proofIndex: i,
+        proofType: proof.proofType,
+        checkType: "signer-is-linkedId",
+        valid: true
+      });
+      linkedIdProved = true;
+      if (!proofAuthorizedEntityMatchesDid(proof, data.subject)) {
+        checks.push({
+          proofIndex: i,
+          proofType: proof.proofType,
+          checkType: "signer-is-linkedId",
+          valid: false,
+          reason: "Proof from linkedId does not authorize subject (aud mismatch)"
+        });
+      }
+    }
+    if (proof.proofType === "evidence-pointer") {
+      checks.push({
+        proofIndex: i,
+        proofType: proof.proofType,
+        checkType: "signer-is-subject",
+        valid: true,
+        reason: "Evidence pointer accepted (requires URL fetch for full verification)"
+      });
+      subjectProved = true;
+    }
+  }
+  const reasons = [];
+  if (!subjectProved) {
+    reasons.push("No proof demonstrates control by subject");
+  }
+  if (!linkedIdProved) {
+    reasons.push("No proof demonstrates control by linkedId");
+  }
+  return {
+    valid: reasons.length === 0,
+    checks,
+    reasons
+  };
+}
+function verifyKeyBindingProofs(data) {
+  if (!data.subject || !data.keyId) {
+    return {
+      valid: false,
+      checks: [],
+      reasons: ["subject and keyId are required"]
+    };
+  }
+  if (!Array.isArray(data.proofs) || data.proofs.length === 0) {
+    return {
+      valid: false,
+      checks: [],
+      reasons: ["At least one proof is required"]
+    };
+  }
+  const checks = [];
+  let subjectAuthorizedKey = false;
+  for (let i = 0; i < data.proofs.length; i++) {
+    const proof = data.proofs[i];
+    if (proofSignerMatchesDid(proof, data.subject)) {
+      const authorizesKey = proofAuthorizedEntityMatchesDid(proof, data.keyId);
+      checks.push({
+        proofIndex: i,
+        proofType: proof.proofType,
+        checkType: "signer-is-subject-for-key",
+        valid: authorizesKey,
+        reason: authorizesKey ? void 0 : "Proof signed by subject but does not authorize the keyId"
+      });
+      if (authorizesKey) {
+        subjectAuthorizedKey = true;
+      }
+    }
+    if (proofSignerMatchesDid(proof, data.keyId)) {
+      checks.push({
+        proofIndex: i,
+        proofType: proof.proofType,
+        checkType: "signer-is-keyId",
+        valid: true,
+        reason: "Key proved possession (supplementary, not sufficient alone)"
+      });
+    }
+    if (proof.proofType === "evidence-pointer") {
+      checks.push({
+        proofIndex: i,
+        proofType: proof.proofType,
+        checkType: "signer-is-subject-for-key",
+        valid: true,
+        reason: "Evidence pointer accepted (requires URL fetch for full verification)"
+      });
+      subjectAuthorizedKey = true;
+    }
+  }
+  if (data.publicKeyJwk && extractDidMethod(data.keyId) === "jwk") {
+    try {
+      const keyIdJwk = didJwkToJwk(data.keyId);
+      const jwkConsistent = publicJwkEquals(data.publicKeyJwk, keyIdJwk);
+      if (!jwkConsistent) {
+        return {
+          valid: false,
+          checks,
+          reasons: ["publicKeyJwk does not match the key material in keyId (did:jwk)"]
+        };
+      }
+    } catch {
+    }
+  }
+  const reasons = [];
+  if (!subjectAuthorizedKey) {
+    reasons.push(
+      "No proof demonstrates that subject authorized the key binding"
+    );
+  }
+  return {
+    valid: reasons.length === 0,
+    checks,
+    reasons
+  };
+}
+var DID_ARTIFACT_PREFIX = "did:artifact:";
+var CID_VERSION = 1;
+var RAW_CODEC = raw.code;
+var SHA2_256_CODE = 18;
+var SHA2_256_DIGEST_LENGTH = 32;
+function parseArtifactDid(did) {
+  if (typeof did !== "string" || !did.startsWith(DID_ARTIFACT_PREFIX)) {
+    throw new OmaTrustError("INVALID_DID", "Expected a did:artifact DID", { did });
+  }
+  const identifier = did.slice(DID_ARTIFACT_PREFIX.length);
+  if (!identifier || identifier.length === 0) {
+    throw new OmaTrustError("INVALID_DID", "Missing method-specific identifier", { did });
+  }
+  if (identifier[0] !== "b") {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `Invalid multibase prefix "${identifier[0]}", expected "b" (base32lower)`,
+      { did }
+    );
+  }
+  let cid;
+  try {
+    cid = CID.parse(identifier, base32);
+  } catch (err) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      "Failed to decode base32 CID from did:artifact identifier",
+      { did, cause: err }
+    );
+  }
+  if (cid.version !== CID_VERSION) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `CID version must be 1, got ${cid.version}`,
+      { did }
+    );
+  }
+  if (cid.code !== RAW_CODEC) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `Multicodec must be raw (0x55), got 0x${cid.code.toString(16)}`,
+      { did }
+    );
+  }
+  if (cid.multihash.code !== SHA2_256_CODE) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `Multihash function must be sha2-256 (0x12), got 0x${cid.multihash.code.toString(16)}`,
+      { did }
+    );
+  }
+  if (cid.multihash.digest.length !== SHA2_256_DIGEST_LENGTH) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `SHA-256 digest must be 32 bytes, got ${cid.multihash.digest.length}`,
+      { did }
+    );
+  }
+  const digest = cid.multihash.digest;
+  const digestHex = Array.from(digest).map((b) => b.toString(16).padStart(2, "0")).join("");
+  return { did, identifier, digest, digestHex };
+}
+
+// src/reputation/artifact-verification.ts
+async function verifyResponsibilityClaim(params) {
+  const {
+    attestation,
+    artifactDid,
+    provider,
+    easContractAddress,
+    chain,
+    chainId,
+    responsibilityClaimSchemaString
+  } = params;
+  const reasons = [];
+  const checks = {
+    schemaValid: false,
+    subjectMatches: false,
+    notRevoked: false,
+    currentlyEffective: false,
+    controllerAuthorized: false,
+    issuedDuringAuthorizationWindow: false
+  };
+  let decoded;
+  try {
+    if (attestation.raw) {
+      decoded = decodeAttestationData(responsibilityClaimSchemaString, attestation.raw);
+    } else if (attestation.data && typeof attestation.data === "object") {
+      decoded = attestation.data;
+    } else {
+      reasons.push("No attestation data available to decode");
+      return buildFailedResult(checks, reasons);
+    }
+  } catch (err) {
+    reasons.push(
+      `Failed to decode attestation data: ${err instanceof Error ? err.message : "unknown error"}`
+    );
+    return buildFailedResult(checks, reasons);
+  }
+  const responsibleParty = decoded.responsibleParty;
+  const subject = decoded.subject;
+  const responsibilityType = decoded.responsibilityType;
+  const issuedAt = decoded.issuedAt;
+  const effectiveAt = decoded.effectiveAt;
+  const expiresAt = decoded.expiresAt;
+  const subjectLabel = decoded.subjectLabel;
+  if (!responsibleParty || !subject || !responsibilityType || !issuedAt) {
+    if (!responsibleParty) reasons.push("Missing required field: responsibleParty");
+    if (!subject) reasons.push("Missing required field: subject");
+    if (!responsibilityType) reasons.push("Missing required field: responsibilityType");
+    if (!issuedAt) reasons.push("Missing required field: issuedAt");
+    return buildFailedResult(checks, reasons, {
+      responsibleParty,
+      subjectLabel,
+      responsibilityType
+    });
+  }
+  if (!Array.isArray(responsibilityType) || responsibilityType.length === 0) {
+    reasons.push("responsibilityType must be a non-empty array");
+    return buildFailedResult(checks, reasons, {
+      responsibleParty,
+      subjectLabel,
+      responsibilityType
+    });
+  }
+  checks.schemaValid = true;
+  if (artifactDid) {
+    checks.subjectMatches = subject.toLowerCase() === artifactDid.toLowerCase();
+    if (!checks.subjectMatches) {
+      reasons.push(`Subject "${subject}" does not match expected artifact "${artifactDid}"`);
+    }
+  } else {
+    checks.subjectMatches = true;
+  }
+  checks.notRevoked = attestation.revocationTime === BigInt(0);
+  if (!checks.notRevoked) {
+    reasons.push("Attestation has been revoked");
+  }
+  const now = BigInt(Math.floor(Date.now() / 1e3));
+  const effectiveTime = toBigInt(effectiveAt);
+  const expirationTime = toBigInt(expiresAt);
+  const isEffective = effectiveTime === BigInt(0) || effectiveTime <= now;
+  const isNotExpired = expirationTime === BigInt(0) || expirationTime > now;
+  checks.currentlyEffective = isEffective && isNotExpired;
+  if (!isEffective) {
+    reasons.push("Attestation is not yet effective");
+  }
+  if (!isNotExpired) {
+    reasons.push("Attestation has expired");
+  }
+  const controllerDid = `did:pkh:eip155:${chainId}:${attestation.attester.toLowerCase()}`;
+  let authorization = null;
+  try {
+    const resolvedChain = chain ?? `eip155:${chainId}`;
+    authorization = await getControllerAuthorization({
+      subjectDid: responsibleParty,
+      controllerDid,
+      provider,
+      chain: resolvedChain,
+      easContractAddress
+    });
+    checks.controllerAuthorized = authorization.authorized;
+    if (!checks.controllerAuthorized) {
+      reasons.push(`Controller ${controllerDid} is not authorized for ${responsibleParty}`);
+    }
+    if (authorization.authorized && authorization.anchoredFrom !== null) {
+      const issuedAtBigInt = toBigInt(issuedAt);
+      const afterStart = issuedAtBigInt >= authorization.anchoredFrom;
+      const beforeEnd = authorization.until === null || issuedAtBigInt <= authorization.until;
+      checks.issuedDuringAuthorizationWindow = afterStart && beforeEnd;
+      if (!afterStart) {
+        reasons.push("Attestation was issued before the authorization window started");
+      }
+      if (!beforeEnd) {
+        reasons.push("Attestation was issued after the authorization window ended");
+      }
+    } else if (authorization.authorized && authorization.anchoredFrom === null) {
+      checks.issuedDuringAuthorizationWindow = true;
+    } else {
+      checks.issuedDuringAuthorizationWindow = false;
+    }
+  } catch (err) {
+    reasons.push(
+      `Controller authorization check failed: ${err instanceof Error ? err.message : "unknown error"}`
+    );
+    checks.controllerAuthorized = false;
+    checks.issuedDuringAuthorizationWindow = false;
+  }
+  const valid = Object.values(checks).every(Boolean);
+  return {
+    valid,
+    responsibleParty,
+    controllerDid,
+    responsibilityTypes: responsibilityType,
+    subjectLabel: subjectLabel || void 0,
+    authorization,
+    checks,
+    reasons
+  };
+}
+async function getVerifiedArtifactAttestations(params) {
+  const {
+    artifactDid,
+    provider,
+    easContractAddress,
+    chain,
+    chainId,
+    schemaUids,
+    responsibilityClaimSchemaUid,
+    responsibilityClaimSchemaString,
+    securityAssessmentSchemaUid,
+    certificationSchemaUid,
+    fromBlock,
+    limit
+  } = params;
+  parseArtifactDid(artifactDid);
+  if (schemaUids.length === 0) {
+    return {
+      artifactDid,
+      responsibilityClaims: [],
+      securityAssessments: [],
+      certifications: [],
+      otherAttestations: []
+    };
+  }
+  const results = await listAttestations({
+    subjectDid: artifactDid,
+    provider,
+    easContractAddress,
+    schemas: schemaUids,
+    limit: limit ?? 100,
+    fromBlock
+  });
+  const responsibilityClaims = [];
+  const securityAssessments = [];
+  const certifications = [];
+  const otherAttestations = [];
+  for (const att of results) {
+    const schemaUidLower = att.schema.toLowerCase();
+    if (schemaUidLower === responsibilityClaimSchemaUid.toLowerCase()) {
+      const verification = await verifyResponsibilityClaim({
+        attestation: att,
+        artifactDid,
+        provider,
+        easContractAddress,
+        chain,
+        chainId,
+        responsibilityClaimSchemaString
+      });
+      responsibilityClaims.push({ attestation: att, verification });
+    } else if (securityAssessmentSchemaUid && schemaUidLower === securityAssessmentSchemaUid.toLowerCase()) {
+      const verification = await runStandardVerification(att, provider);
+      securityAssessments.push({ attestation: att, verification });
+    } else if (certificationSchemaUid && schemaUidLower === certificationSchemaUid.toLowerCase()) {
+      const verification = await runStandardVerification(att, provider);
+      certifications.push({ attestation: att, verification });
+    } else {
+      const verification = await runStandardVerification(att, provider);
+      otherAttestations.push({ attestation: att, verification });
+    }
+  }
+  return {
+    artifactDid,
+    responsibilityClaims,
+    securityAssessments,
+    certifications,
+    otherAttestations
+  };
+}
+async function isArtifactClaimedBy(params) {
+  const { artifactDid, responsibleParty, responsibilityTypes } = params;
+  const result = await getVerifiedArtifactAttestations({
+    artifactDid,
+    provider: params.provider,
+    easContractAddress: params.easContractAddress,
+    chain: params.chain,
+    chainId: params.chainId,
+    schemaUids: params.schemaUids,
+    responsibilityClaimSchemaUid: params.responsibilityClaimSchemaUid,
+    responsibilityClaimSchemaString: params.responsibilityClaimSchemaString,
+    securityAssessmentSchemaUid: params.securityAssessmentSchemaUid,
+    certificationSchemaUid: params.certificationSchemaUid
+  });
+  const matchingClaims = result.responsibilityClaims.filter(
+    (claim) => claim.verification.responsibleParty.toLowerCase() === responsibleParty.toLowerCase()
+  );
+  const validClaims = matchingClaims.filter((claim) => claim.verification.valid);
+  let finalClaims = validClaims;
+  let matchedTypes = [];
+  if (responsibilityTypes && responsibilityTypes.length > 0) {
+    finalClaims = validClaims.filter(
+      (claim) => claim.verification.responsibilityTypes.some(
+        (t) => responsibilityTypes.includes(t)
+      )
+    );
+    matchedTypes = [
+      ...new Set(
+        finalClaims.flatMap(
+          (claim) => claim.verification.responsibilityTypes.filter(
+            (t) => responsibilityTypes.includes(t)
+          )
+        )
+      )
+    ];
+  } else {
+    matchedTypes = [
+      ...new Set(
+        validClaims.flatMap((claim) => claim.verification.responsibilityTypes)
+      )
+    ];
+  }
+  const reasons = [];
+  if (finalClaims.length === 0) {
+    if (matchingClaims.length === 0) {
+      reasons.push(
+        `No responsibility claims found from ${responsibleParty} for this artifact`
+      );
+    } else if (validClaims.length === 0) {
+      reasons.push(
+        `Claims from ${responsibleParty} exist but none passed verification`
+      );
+    } else if (responsibilityTypes) {
+      reasons.push(
+        `No claims matched the requested responsibility types: ${responsibilityTypes.join(", ")}`
+      );
+    }
+  }
+  return {
+    claimed: finalClaims.length > 0,
+    claims: finalClaims,
+    matchedResponsibilityTypes: matchedTypes,
+    reasons
+  };
+}
+function toBigInt(value) {
+  if (value === void 0 || value === null) return BigInt(0);
+  if (typeof value === "bigint") return value;
+  return BigInt(value);
+}
+function buildFailedResult(checks, reasons, decoded) {
+  return {
+    valid: false,
+    responsibleParty: decoded?.responsibleParty ?? "",
+    controllerDid: "",
+    responsibilityTypes: decoded?.responsibilityType ?? [],
+    subjectLabel: decoded?.subjectLabel || void 0,
+    authorization: null,
+    checks,
+    reasons
+  };
+}
+async function runStandardVerification(attestation, provider) {
+  try {
+    return await verifyAttestation({ attestation, provider });
+  } catch {
+    return void 0;
+  }
+}
 
-export { EIP1967_ADMIN_SLOT, OWNERSHIP_PATTERNS, buildDelegatedAttestationTypedData, buildDelegatedTypedDataFromEncoded, buildDnsTxtRecord, buildEip712Domain, calculateAverageUserReviewRating, calculateTransferAmount, calculateTransferAmountFromAddresses, callControllerWitness, constructSeed, createEvidencePointerProof, createPopEip712Proof, createPopJwsProof, createTxEncodedValueProof, createTxInteractionProof, createX402OfferProof, createX402ReceiptProof, decodeAttestationData, deduplicateReviews, discoverContractOwner, discoverControllingWalletDid, encodeAttestationData, extractEvmAddressesFromDidDocument, extractExpirationTime, extractJwksFromDidDocument, fetchDidDocument, formatSchemaUid, formatTransferAmount, getAttestation, getAttestationsByAttester, getAttestationsForDid, getChainConstants, getControllerAuthorization, getExplorerAddressUrl, getExplorerTxUrl, getLatestAttestations, getMajorVersion, getOmaTrustProofEip712Types, getSchemaDetails, getSupportedChainIds, hashSeed, isChainSupported, listAttestations, normalizeSchema, parseDnsTxtRecord, prepareDelegatedAttestation, readOwnerFromContract, requestControllerWitness, revokeAttestation, schemaToString, splitSignature, submitAttestation, submitDelegatedAttestation, validateAttestationData, verifyAttestation, verifyDidDocumentControllerDid, verifyDidJsonControllerDid, verifyDidPkhOwnership, verifyDidWebOwnership, verifyDnsTxtControllerDid2 as verifyDnsTxtControllerDid, verifyEip712Signature, verifyProof, verifySchemaExists, verifySubjectOwnership, verifyTransferProof, verifyX402Eip712Artifact, verifyX402Eip712Offer, verifyX402Eip712Receipt, verifyX402JwsArtifact, verifyX402JwsOffer, verifyX402JwsReceipt };
+export { EIP1967_ADMIN_SLOT, OWNERSHIP_PATTERNS, buildDelegatedAttestationTypedData, buildDelegatedTypedDataFromEncoded, buildDnsTxtRecord, buildEip712Domain, calculateAverageUserReviewRating, calculateTransferAmount, calculateTransferAmountFromAddresses, callControllerWitness, constructSeed, createEvidencePointerProof, createPopEip712Proof, createPopJwsProof, createTxEncodedValueProof, createTxInteractionProof, createX402OfferProof, createX402ReceiptProof, decodeAttestationData, deduplicateReviews, discoverContractOwner, discoverControllingWalletDid, encodeAttestationData, extractEvmAddressesFromDidDocument, extractExpirationTime, extractJwksFromDidDocument, fetchDidDocument, formatSchemaUid, formatTransferAmount, getAttestation, getAttestationsByAttester, getAttestationsForDid, getChainConstants, getControllerAuthorization, getExplorerAddressUrl, getExplorerTxUrl, getLatestAttestations, getMajorVersion, getOmaTrustProofEip712Types, getSchemaDetails, getSupportedChainIds, getVerifiedArtifactAttestations, hashSeed, isArtifactClaimedBy, isChainSupported, listAttestations, normalizeSchema, parseDnsTxtRecord, prepareDelegatedAttestation, readOwnerFromContract, requestControllerWitness, revokeAttestation, schemaToString, splitSignature, submitAttestation, submitDelegatedAttestation, validateAttestationData, verifyAttestation, verifyDidDocumentControllerDid, verifyDidJsonControllerDid, verifyDidPkhOwnership, verifyDidWebOwnership, verifyDnsTxtControllerDid2 as verifyDnsTxtControllerDid, verifyEip712Signature, verifyKeyBindingProofs, verifyLinkedIdentifierProofs, verifyProof, verifyResponsibilityClaim, verifySchemaExists, verifySubjectOwnership, verifyTransferProof, verifyX402Artifact, verifyX402Eip712Artifact, verifyX402Eip712Offer, verifyX402Eip712Receipt, verifyX402JwsArtifact, verifyX402JwsOffer, verifyX402JwsReceipt };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map