@oma3/omatrust 0.1.0-alpha.11 → 0.1.0-alpha.13

package/dist/identity/index.js

@@ -1,6 +1,11 @@
 import { keccak256, toUtf8Bytes, isAddress, getAddress, sha256 } from 'ethers';
 import { base64url, calculateJwkThumbprint } from 'jose';
 import canonicalize from 'canonicalize';
+import { CID } from 'multiformats/cid';
+import { sha256 as sha256$1 } from 'multiformats/hashes/sha2';
+import * as raw from 'multiformats/codecs/raw';
+import { base32 } from 'multiformats/bases/base32';
+import { base58btc } from 'multiformats/bases/base58';
 
 // src/identity/did.ts
 
@@ -8,23 +13,23 @@ import canonicalize from 'canonicalize';
 var OmaTrustError = class extends Error {
   code;
   details;
-  constructor(code, message, details) {
+  constructor(code2, message, details) {
     super(message);
     this.name = "OmaTrustError";
-    this.code = code;
+    this.code = code2;
     this.details = details;
   }
 };
 
 // src/shared/assert.ts
-function assertString(value, name, code = "INVALID_INPUT") {
+function assertString(value, name, code2 = "INVALID_INPUT") {
   if (typeof value !== "string" || value.trim().length === 0) {
-    throw new OmaTrustError(code, `${name} must be a non-empty string`, { value });
+    throw new OmaTrustError(code2, `${name} must be a non-empty string`, { value });
   }
 }
-function assertObject(value, name, code = "INVALID_INPUT") {
+function assertObject(value, name, code2 = "INVALID_INPUT") {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new OmaTrustError(code, `${name} must be an object`, { value });
+    throw new OmaTrustError(code2, `${name} must be an object`, { value });
   }
 }
 
@@ -81,6 +86,158 @@ function parseCaip2(caip2) {
   }
   return { namespace, reference };
 }
+var VALID_KTY = /* @__PURE__ */ new Set(["EC", "OKP", "RSA"]);
+var PRIVATE_KEY_FIELDS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth"]);
+var REQUIRED_PUBLIC_FIELDS = {
+  EC: ["crv", "x", "y"],
+  OKP: ["crv", "x"],
+  RSA: ["n", "e"]
+};
+function validatePublicJwk(jwk) {
+  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
+    return { valid: false, error: "JWK must be a non-null object" };
+  }
+  const obj = jwk;
+  const kty = obj.kty;
+  if (typeof kty !== "string" || !VALID_KTY.has(kty)) {
+    return {
+      valid: false,
+      error: `Invalid or missing kty (must be one of: ${[...VALID_KTY].join(", ")})`
+    };
+  }
+  for (const field of PRIVATE_KEY_FIELDS) {
+    if (field in obj) {
+      return {
+        valid: false,
+        error: `JWK contains private key field "${field}" \u2014 only public keys are allowed`
+      };
+    }
+  }
+  const required = REQUIRED_PUBLIC_FIELDS[kty];
+  if (required) {
+    for (const field of required) {
+      if (!(field in obj) || obj[field] === void 0 || obj[field] === null || obj[field] === "") {
+        return {
+          valid: false,
+          error: `Missing required public key field "${field}" for kty="${kty}"`
+        };
+      }
+    }
+  }
+  return { valid: true };
+}
+function canonicalizeJwkJson(jwk) {
+  const sorted = Object.keys(jwk).sort();
+  const obj = {};
+  for (const key of sorted) {
+    obj[key] = jwk[key];
+  }
+  return JSON.stringify(obj);
+}
+function jwkToDidJwk(jwk) {
+  assertObject(jwk, "jwk", "INVALID_JWK");
+  const validation = validatePublicJwk(jwk);
+  if (!validation.valid) {
+    throw new OmaTrustError("INVALID_JWK", validation.error ?? "Invalid public JWK", { jwk });
+  }
+  const canonical = canonicalizeJwkJson(jwk);
+  const encoded = base64url.encode(new TextEncoder().encode(canonical));
+  return `did:jwk:${encoded}`;
+}
+function didJwkToJwk(didJwk) {
+  if (typeof didJwk !== "string" || !didJwk.startsWith("did:jwk:")) {
+    throw new OmaTrustError("INVALID_DID", "Expected a did:jwk DID", { input: didJwk });
+  }
+  const parts = didJwk.split(":");
+  if (parts.length !== 3) {
+    throw new OmaTrustError("INVALID_DID", "did:jwk must have exactly 3 colon-separated parts", {
+      input: didJwk
+    });
+  }
+  const encoded = parts[2];
+  if (!encoded || encoded.length === 0) {
+    throw new OmaTrustError("INVALID_DID", "Missing base64url-encoded JWK identifier", {
+      input: didJwk
+    });
+  }
+  let decoded;
+  try {
+    const bytes = base64url.decode(encoded);
+    decoded = new TextDecoder().decode(bytes);
+  } catch {
+    throw new OmaTrustError("INVALID_DID", "Failed to base64url-decode did:jwk identifier", {
+      input: didJwk
+    });
+  }
+  let jwk;
+  try {
+    jwk = JSON.parse(decoded);
+  } catch {
+    throw new OmaTrustError("INVALID_DID", "Decoded did:jwk identifier is not valid JSON", {
+      input: didJwk
+    });
+  }
+  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
+    throw new OmaTrustError("INVALID_DID", "Decoded did:jwk must be a JSON object", {
+      input: didJwk
+    });
+  }
+  const validation = validatePublicJwk(jwk);
+  if (!validation.valid) {
+    throw new OmaTrustError("INVALID_DID", validation.error ?? "Invalid public JWK in did:jwk", {
+      input: didJwk
+    });
+  }
+  return jwk;
+}
+function extractPublicKeyFields(jwk) {
+  const result = {};
+  const metadataFields = /* @__PURE__ */ new Set(["kid", "use", "key_ops", "alg", "ext"]);
+  for (const [key, value] of Object.entries(jwk)) {
+    if (PRIVATE_KEY_FIELDS.has(key)) continue;
+    if (metadataFields.has(key)) continue;
+    result[key] = value;
+  }
+  return result;
+}
+function publicJwkEquals(a, b) {
+  assertObject(a, "a", "INVALID_JWK");
+  assertObject(b, "b", "INVALID_JWK");
+  const aObj = a;
+  const bObj = b;
+  for (const field of PRIVATE_KEY_FIELDS) {
+    if (field in aObj) {
+      throw new OmaTrustError(
+        "INVALID_JWK",
+        `First JWK contains private key field "${field}"`,
+        { field }
+      );
+    }
+    if (field in bObj) {
+      throw new OmaTrustError(
+        "INVALID_JWK",
+        `Second JWK contains private key field "${field}"`,
+        { field }
+      );
+    }
+  }
+  const aPublic = extractPublicKeyFields(aObj);
+  const bPublic = extractPublicKeyFields(bObj);
+  return canonicalizeJwkJson(aPublic) === canonicalizeJwkJson(bPublic);
+}
+async function computeJwkThumbprint(jwk, digestAlgorithm = "sha256") {
+  assertObject(jwk, "jwk", "INVALID_JWK");
+  const validation = validatePublicJwk(jwk);
+  if (!validation.valid) {
+    throw new OmaTrustError("INVALID_JWK", validation.error ?? "Invalid public JWK", { jwk });
+  }
+  const alg = digestAlgorithm === "sha256" ? "sha256" : digestAlgorithm === "sha384" ? "sha384" : "sha512";
+  return calculateJwkThumbprint(jwk, alg);
+}
+async function formatJktValue(jwk) {
+  const thumbprint = await computeJwkThumbprint(jwk, "sha256");
+  return `jkt=S256:${thumbprint}`;
+}
 
 // src/identity/did.ts
 var DID_REGEX = /^did:[a-z0-9]+:.+$/i;
@@ -156,7 +313,7 @@ function normalizeDidKey(input) {
 }
 function normalizeDid(input) {
   assertString(input, "input", "INVALID_DID");
-  const trimmed = input.trim();
+  const trimmed = input.trim().split("#")[0];
   if (!trimmed.startsWith("did:")) {
     return normalizeDidWeb(trimmed);
   }
@@ -345,6 +502,15 @@ function validateDidPkh(did) {
       };
     }
   }
+  if (namespace === "solana") {
+    if (!/^[1-9A-HJ-NP-Za-km-z]{32,44}$/.test(address)) {
+      return {
+        valid: false,
+        method: "pkh",
+        error: `Invalid Solana address "${address}" (must be 32-44 base58 characters)`
+      };
+    }
+  }
   return { valid: true, method: "pkh" };
 }
 function validateDidJwk(did) {
@@ -398,6 +564,10 @@ function validateDidJwk(did) {
       error: "DID must reference a public key \u2014 private key component (d) is not allowed"
     };
   }
+  const jwkValidation = validatePublicJwk(jwk);
+  if (!jwkValidation.valid) {
+    return { valid: false, method: "jwk", error: jwkValidation.error };
+  }
   return { valid: true, method: "jwk" };
 }
 function normalizeDidJwk(input) {
@@ -464,158 +634,6 @@ function assertBareDid(input, paramName = "did") {
     );
   }
 }
-var VALID_KTY = /* @__PURE__ */ new Set(["EC", "OKP", "RSA"]);
-var PRIVATE_KEY_FIELDS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth"]);
-var REQUIRED_PUBLIC_FIELDS = {
-  EC: ["crv", "x", "y"],
-  OKP: ["crv", "x"],
-  RSA: ["n", "e"]
-};
-function validatePublicJwk(jwk) {
-  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
-    return { valid: false, error: "JWK must be a non-null object" };
-  }
-  const obj = jwk;
-  const kty = obj.kty;
-  if (typeof kty !== "string" || !VALID_KTY.has(kty)) {
-    return {
-      valid: false,
-      error: `Invalid or missing kty (must be one of: ${[...VALID_KTY].join(", ")})`
-    };
-  }
-  for (const field of PRIVATE_KEY_FIELDS) {
-    if (field in obj) {
-      return {
-        valid: false,
-        error: `JWK contains private key field "${field}" \u2014 only public keys are allowed`
-      };
-    }
-  }
-  const required = REQUIRED_PUBLIC_FIELDS[kty];
-  if (required) {
-    for (const field of required) {
-      if (!(field in obj) || obj[field] === void 0 || obj[field] === null || obj[field] === "") {
-        return {
-          valid: false,
-          error: `Missing required public key field "${field}" for kty="${kty}"`
-        };
-      }
-    }
-  }
-  return { valid: true };
-}
-function canonicalizeJwkJson(jwk) {
-  const sorted = Object.keys(jwk).sort();
-  const obj = {};
-  for (const key of sorted) {
-    obj[key] = jwk[key];
-  }
-  return JSON.stringify(obj);
-}
-function jwkToDidJwk(jwk) {
-  assertObject(jwk, "jwk", "INVALID_JWK");
-  const validation = validatePublicJwk(jwk);
-  if (!validation.valid) {
-    throw new OmaTrustError("INVALID_JWK", validation.error ?? "Invalid public JWK", { jwk });
-  }
-  const canonical = canonicalizeJwkJson(jwk);
-  const encoded = base64url.encode(new TextEncoder().encode(canonical));
-  return `did:jwk:${encoded}`;
-}
-function didJwkToJwk(didJwk) {
-  if (typeof didJwk !== "string" || !didJwk.startsWith("did:jwk:")) {
-    throw new OmaTrustError("INVALID_DID", "Expected a did:jwk DID", { input: didJwk });
-  }
-  const parts = didJwk.split(":");
-  if (parts.length !== 3) {
-    throw new OmaTrustError("INVALID_DID", "did:jwk must have exactly 3 colon-separated parts", {
-      input: didJwk
-    });
-  }
-  const encoded = parts[2];
-  if (!encoded || encoded.length === 0) {
-    throw new OmaTrustError("INVALID_DID", "Missing base64url-encoded JWK identifier", {
-      input: didJwk
-    });
-  }
-  let decoded;
-  try {
-    const bytes = base64url.decode(encoded);
-    decoded = new TextDecoder().decode(bytes);
-  } catch {
-    throw new OmaTrustError("INVALID_DID", "Failed to base64url-decode did:jwk identifier", {
-      input: didJwk
-    });
-  }
-  let jwk;
-  try {
-    jwk = JSON.parse(decoded);
-  } catch {
-    throw new OmaTrustError("INVALID_DID", "Decoded did:jwk identifier is not valid JSON", {
-      input: didJwk
-    });
-  }
-  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
-    throw new OmaTrustError("INVALID_DID", "Decoded did:jwk must be a JSON object", {
-      input: didJwk
-    });
-  }
-  const validation = validatePublicJwk(jwk);
-  if (!validation.valid) {
-    throw new OmaTrustError("INVALID_DID", validation.error ?? "Invalid public JWK in did:jwk", {
-      input: didJwk
-    });
-  }
-  return jwk;
-}
-function extractPublicKeyFields(jwk) {
-  const result = {};
-  const metadataFields = /* @__PURE__ */ new Set(["kid", "use", "key_ops", "alg", "ext"]);
-  for (const [key, value] of Object.entries(jwk)) {
-    if (PRIVATE_KEY_FIELDS.has(key)) continue;
-    if (metadataFields.has(key)) continue;
-    result[key] = value;
-  }
-  return result;
-}
-function publicJwkEquals(a, b) {
-  assertObject(a, "a", "INVALID_JWK");
-  assertObject(b, "b", "INVALID_JWK");
-  const aObj = a;
-  const bObj = b;
-  for (const field of PRIVATE_KEY_FIELDS) {
-    if (field in aObj) {
-      throw new OmaTrustError(
-        "INVALID_JWK",
-        `First JWK contains private key field "${field}"`,
-        { field }
-      );
-    }
-    if (field in bObj) {
-      throw new OmaTrustError(
-        "INVALID_JWK",
-        `Second JWK contains private key field "${field}"`,
-        { field }
-      );
-    }
-  }
-  const aPublic = extractPublicKeyFields(aObj);
-  const bPublic = extractPublicKeyFields(bObj);
-  return canonicalizeJwkJson(aPublic) === canonicalizeJwkJson(bPublic);
-}
-async function computeJwkThumbprint(jwk, digestAlgorithm = "sha256") {
-  assertObject(jwk, "jwk", "INVALID_JWK");
-  const validation = validatePublicJwk(jwk);
-  if (!validation.valid) {
-    throw new OmaTrustError("INVALID_JWK", validation.error ?? "Invalid public JWK", { jwk });
-  }
-  const alg = digestAlgorithm === "sha256" ? "sha256" : digestAlgorithm === "sha384" ? "sha384" : "sha512";
-  return calculateJwkThumbprint(jwk, alg);
-}
-async function formatJktValue(jwk) {
-  const thumbprint = await computeJwkThumbprint(jwk, "sha256");
-  return `jkt=S256:${thumbprint}`;
-}
 
 // src/shared/did-document.ts
 async function fetchDidDocument(domain) {
@@ -778,7 +796,7 @@ function extractControllerEvmAddress(controllerDid) {
 function extractAuthorizationMetadata(result) {
   const payload = result.payload;
   const resourceUrl = typeof payload.resourceUrl === "string" ? payload.resourceUrl : null;
-  const issuedAt = typeof payload.issuedAt === "string" ? payload.issuedAt : null;
+  const issuedAt = typeof payload.issuedAt === "string" ? payload.issuedAt : typeof payload.issuedAt === "number" ? payload.issuedAt : null;
   let subjectDid = null;
   if (resourceUrl) {
     try {
@@ -787,35 +805,468 @@ function extractAuthorizationMetadata(result) {
     } catch {
     }
   }
+  if ("publicKeyDid" in result) {
+    const jwsResult = result;
+    return {
+      controllerDid: jwsResult.publicKeyDid,
+      subjectDid,
+      resourceUrl,
+      issuedAt,
+      kid: jwsResult.kid,
+      publicKeyJwk: jwsResult.publicKeyJwk,
+      signer: null
+    };
+  }
+  const eip712Result = result;
+  const signerAddress = eip712Result.signer.toLowerCase();
   return {
-    controllerDid: result.publicKeyDid,
+    controllerDid: `did:pkh:eip155:1:${signerAddress}`,
     subjectDid,
     resourceUrl,
     issuedAt,
-    kid: result.kid,
-    publicKeyJwk: result.publicKeyJwk
+    kid: null,
+    publicKeyJwk: null,
+    signer: eip712Result.signer
   };
 }
+var VALID_ALGORITHMS = /* @__PURE__ */ new Set(["keccak256", "sha256"]);
+var MAX_JSON_DEPTH = 32;
+function assertDepthLimit(depth, context) {
+  if (depth > MAX_JSON_DEPTH) {
+    const msg = context ? `JSON nesting depth exceeds maximum of ${MAX_JSON_DEPTH} at ${context}` : `JSON nesting depth exceeds maximum of ${MAX_JSON_DEPTH}`;
+    throw new OmaTrustError("INVALID_INPUT", msg);
+  }
+}
+function parseJsonStrict(input) {
+  if (typeof input !== "string") {
+    throw new OmaTrustError("INVALID_INPUT", "Input must be a string");
+  }
+  const duplicateKeys = detectDuplicateKeys(input);
+  if (duplicateKeys.length > 0) {
+    throw new OmaTrustError(
+      "INVALID_INPUT",
+      `Duplicate JSON key${duplicateKeys.length > 1 ? "s" : ""} detected: ${duplicateKeys.map((k) => `"${k}"`).join(", ")}`,
+      { duplicateKeys }
+    );
+  }
+  try {
+    return JSON.parse(input);
+  } catch {
+    throw new OmaTrustError("INVALID_INPUT", "Input is not valid JSON");
+  }
+}
+function detectDuplicateKeys(input) {
+  const duplicates = [];
+  const objectKeyStack = [];
+  let inString = false;
+  let escaped = false;
+  let currentKey = "";
+  let collectingKey = false;
+  let afterColon = false;
+  let i = 0;
+  while (i < input.length) {
+    const ch = input[i];
+    if (escaped) {
+      if (collectingKey) currentKey += ch;
+      escaped = false;
+      i++;
+      continue;
+    }
+    if (ch === "\\") {
+      escaped = true;
+      if (collectingKey) currentKey += ch;
+      i++;
+      continue;
+    }
+    if (ch === '"') {
+      if (!inString) {
+        inString = true;
+        if (objectKeyStack.length > 0 && !afterColon) {
+          collectingKey = true;
+          currentKey = "";
+        }
+      } else {
+        inString = false;
+        if (collectingKey) {
+          collectingKey = false;
+          const keySet = objectKeyStack[objectKeyStack.length - 1];
+          if (keySet.has(currentKey)) {
+            if (!duplicates.includes(currentKey)) {
+              duplicates.push(currentKey);
+            }
+          } else {
+            keySet.add(currentKey);
+          }
+        }
+      }
+      i++;
+      continue;
+    }
+    if (inString) {
+      if (collectingKey) currentKey += ch;
+      i++;
+      continue;
+    }
+    if (ch === "{") {
+      objectKeyStack.push(/* @__PURE__ */ new Set());
+      assertDepthLimit(objectKeyStack.length);
+      afterColon = false;
+    } else if (ch === "}") {
+      objectKeyStack.pop();
+      afterColon = objectKeyStack.length > 0;
+    } else if (ch === "[") {
+      objectKeyStack.push(/* @__PURE__ */ new Set(["__array__"]));
+      assertDepthLimit(objectKeyStack.length);
+      afterColon = false;
+    } else if (ch === "]") {
+      objectKeyStack.pop();
+      afterColon = objectKeyStack.length > 0;
+    } else if (ch === ":") {
+      afterColon = true;
+    } else if (ch === ",") {
+      afterColon = false;
+    }
+    i++;
+  }
+  return duplicates;
+}
+function assertJsonSafe(value, path = "$", depth = 0) {
+  assertDepthLimit(depth, path);
+  if (value === void 0) {
+    throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: undefined`);
+  }
+  if (value === null) return;
+  switch (typeof value) {
+    case "string":
+    case "boolean":
+      return;
+    case "number":
+      if (!Number.isFinite(value)) {
+        throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: ${value} (must be finite number)`);
+      }
+      return;
+    case "bigint":
+      throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: BigInt (use number or string)`);
+    case "function":
+      throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: function`);
+    case "symbol":
+      throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: Symbol`);
+    case "object":
+      if (value instanceof Date) {
+        throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: Date (use ISO string or timestamp)`);
+      }
+      if (value instanceof RegExp) {
+        throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: RegExp`);
+      }
+      if (Array.isArray(value)) {
+        for (let i = 0; i < value.length; i++) {
+          assertJsonSafe(value[i], `${path}[${i}]`, depth + 1);
+        }
+        return;
+      }
+      for (const [key, val] of Object.entries(value)) {
+        assertJsonSafe(val, `${path}.${key}`, depth + 1);
+      }
+      return;
+    default:
+      throw new OmaTrustError("INVALID_INPUT", `Non-JSON-safe value at ${path}: unknown type "${typeof value}"`);
+  }
+}
 function canonicalizeJson(obj) {
+  assertJsonSafe(obj);
   const jcs = canonicalize(obj);
   if (!jcs) {
     throw new OmaTrustError("INVALID_INPUT", "Object cannot be canonicalized", { obj });
   }
   return jcs;
 }
-function canonicalizeForHash(obj) {
+function canonicalizeAndKeccak256(obj) {
   const jcsJson = canonicalizeJson(obj);
   return {
     jcsJson,
     hash: keccak256(toUtf8Bytes(jcsJson))
   };
 }
+function canonicalizeForHash(obj) {
+  return canonicalizeAndKeccak256(obj);
+}
 function hashCanonicalizedJson(obj, algorithm) {
+  if (!VALID_ALGORITHMS.has(algorithm)) {
+    throw new OmaTrustError("INVALID_INPUT", `Unsupported hash algorithm: "${algorithm}". Must be "keccak256" or "sha256".`, { algorithm });
+  }
   const jcs = canonicalizeJson(obj);
   const bytes = toUtf8Bytes(jcs);
   return algorithm === "keccak256" ? keccak256(bytes) : sha256(bytes);
 }
+var DID_ARTIFACT_PREFIX = "did:artifact:";
+var CID_VERSION = 1;
+var RAW_CODEC = raw.code;
+var SHA2_256_CODE = 18;
+var SHA2_256_DIGEST_LENGTH = 32;
+async function artifactDidFromBytes(bytes) {
+  if (!(bytes instanceof Uint8Array) || bytes.length === 0) {
+    throw new OmaTrustError(
+      "INVALID_INPUT",
+      "bytes must be a non-empty Uint8Array"
+    );
+  }
+  const digest = await sha256$1.digest(bytes);
+  const cid = CID.createV1(RAW_CODEC, digest);
+  return `${DID_ARTIFACT_PREFIX}${cid.toString(base32)}`;
+}
+async function artifactDidFromJson(input) {
+  const value = typeof input === "string" ? parseJsonStrict(input) : input;
+  const jcs = canonicalizeJson(value);
+  const bytes = new TextEncoder().encode(jcs);
+  const digest = await sha256$1.digest(bytes);
+  const cid = CID.createV1(RAW_CODEC, digest);
+  return `${DID_ARTIFACT_PREFIX}${cid.toString(base32)}`;
+}
+function parseArtifactDid(did) {
+  if (typeof did !== "string" || !did.startsWith(DID_ARTIFACT_PREFIX)) {
+    throw new OmaTrustError("INVALID_DID", "Expected a did:artifact DID", { did });
+  }
+  const identifier = did.slice(DID_ARTIFACT_PREFIX.length);
+  if (!identifier || identifier.length === 0) {
+    throw new OmaTrustError("INVALID_DID", "Missing method-specific identifier", { did });
+  }
+  if (identifier[0] !== "b") {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `Invalid multibase prefix "${identifier[0]}", expected "b" (base32lower)`,
+      { did }
+    );
+  }
+  let cid;
+  try {
+    cid = CID.parse(identifier, base32);
+  } catch (err) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      "Failed to decode base32 CID from did:artifact identifier",
+      { did, cause: err }
+    );
+  }
+  if (cid.version !== CID_VERSION) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `CID version must be 1, got ${cid.version}`,
+      { did }
+    );
+  }
+  if (cid.code !== RAW_CODEC) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `Multicodec must be raw (0x55), got 0x${cid.code.toString(16)}`,
+      { did }
+    );
+  }
+  if (cid.multihash.code !== SHA2_256_CODE) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `Multihash function must be sha2-256 (0x12), got 0x${cid.multihash.code.toString(16)}`,
+      { did }
+    );
+  }
+  if (cid.multihash.digest.length !== SHA2_256_DIGEST_LENGTH) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `SHA-256 digest must be 32 bytes, got ${cid.multihash.digest.length}`,
+      { did }
+    );
+  }
+  const digest = cid.multihash.digest;
+  const digestHex = Array.from(digest).map((b) => b.toString(16).padStart(2, "0")).join("");
+  return { did, identifier, digest, digestHex };
+}
+async function verifyDidArtifact(did, content) {
+  let parsed;
+  try {
+    parsed = parseArtifactDid(did);
+  } catch (err) {
+    return {
+      valid: false,
+      reason: err instanceof OmaTrustError ? err.message : "Invalid did:artifact DID"
+    };
+  }
+  const expectedHex = parsed.digestHex;
+  if (typeof content === "string" || typeof content === "object" && content !== null && !(content instanceof Uint8Array)) {
+    try {
+      const value = typeof content === "string" ? parseJsonStrict(content) : content;
+      const jcs = canonicalizeJson(value);
+      const jcsBytes = new TextEncoder().encode(jcs);
+      const digest2 = await sha256$1.digest(jcsBytes);
+      const digestHex2 = Array.from(digest2.digest).map((b) => b.toString(16).padStart(2, "0")).join("");
+      if (digestHex2 === expectedHex) {
+        return { valid: true, matchedAs: "json" };
+      }
+    } catch {
+    }
+  }
+  let rawBytes;
+  if (content instanceof Uint8Array) {
+    rawBytes = content;
+  } else if (typeof content === "string") {
+    rawBytes = new TextEncoder().encode(content);
+  } else {
+    return {
+      valid: false,
+      reason: "Content did not match as canonical JSON and is not raw bytes"
+    };
+  }
+  const digest = await sha256$1.digest(rawBytes);
+  const digestHex = Array.from(digest.digest).map((b) => b.toString(16).padStart(2, "0")).join("");
+  if (digestHex === expectedHex) {
+    return { valid: true, matchedAs: "binary" };
+  }
+  return {
+    valid: false,
+    reason: "Content does not match the did:artifact identifier (neither as canonical JSON nor as raw bytes)"
+  };
+}
+function didEthrToDidPkh(did) {
+  if (typeof did !== "string" || !did.startsWith("did:ethr:")) {
+    throw new OmaTrustError("INVALID_DID", "Expected a did:ethr DID", { did });
+  }
+  const remainder = did.slice("did:ethr:".length);
+  if (!remainder) {
+    throw new OmaTrustError("INVALID_DID", "Missing identifier in did:ethr DID", { did });
+  }
+  let chainId;
+  let address;
+  const parts = remainder.split(":");
+  if (parts.length === 1) {
+    chainId = "1";
+    address = parts[0];
+  } else if (parts.length === 2) {
+    const rawChainId = parts[0];
+    address = parts[1];
+    if (rawChainId.startsWith("0x")) {
+      chainId = String(parseInt(rawChainId, 16));
+    } else if (/^\d+$/.test(rawChainId)) {
+      chainId = rawChainId;
+    } else {
+      const networkMap = {
+        mainnet: "1",
+        goerli: "5",
+        sepolia: "11155111",
+        polygon: "137",
+        arbitrum: "42161",
+        optimism: "10",
+        base: "8453"
+      };
+      const mapped = networkMap[rawChainId.toLowerCase()];
+      if (!mapped) {
+        throw new OmaTrustError(
+          "INVALID_DID",
+          `Unknown did:ethr network "${rawChainId}"`,
+          { did, network: rawChainId }
+        );
+      }
+      chainId = mapped;
+    }
+  } else {
+    throw new OmaTrustError("INVALID_DID", "Invalid did:ethr format", { did });
+  }
+  if (!isAddress(address)) {
+    throw new OmaTrustError("INVALID_DID", "Invalid Ethereum address in did:ethr DID", {
+      did,
+      address
+    });
+  }
+  const checksummed = getAddress(address);
+  return `did:pkh:eip155:${chainId}:${checksummed.toLowerCase()}`;
+}
+var MULTICODEC_KEY_TYPES = {
+  // Ed25519 public key: 0xed (varint encoded as [0xed, 0x01])
+  237: { kty: "OKP", crv: "Ed25519" },
+  // X25519 public key: 0xec (varint encoded as [0xec, 0x01])
+  236: { kty: "OKP", crv: "X25519" },
+  // secp256k1 public key (compressed): 0xe7 (varint encoded as [0xe7, 0x01])
+  231: { kty: "EC", crv: "secp256k1", coordSize: 33 },
+  // P-256 public key (compressed): 0x80 0x24 (varint 0x1200)
+  4608: { kty: "EC", crv: "P-256", coordSize: 33 },
+  // P-384 public key (compressed): 0x81 0x24 (varint 0x1201)
+  4609: { kty: "EC", crv: "P-384", coordSize: 49 }
+};
+function readVarint(bytes, offset) {
+  let value = 0;
+  let shift = 0;
+  let bytesRead = 0;
+  while (offset + bytesRead < bytes.length) {
+    const byte = bytes[offset + bytesRead];
+    value |= (byte & 127) << shift;
+    bytesRead++;
+    if ((byte & 128) === 0) {
+      return { value, bytesRead };
+    }
+    shift += 7;
+    if (shift > 28) {
+      throw new OmaTrustError("INVALID_DID", "Varint too long in did:key multicodec prefix");
+    }
+  }
+  throw new OmaTrustError("INVALID_DID", "Truncated varint in did:key multicodec prefix");
+}
+function decompressEcKey(compressedKey, crv) {
+  throw new OmaTrustError(
+    "UNSUPPORTED_KEY_TYPE",
+    `Cannot convert compressed EC key (${crv}) from did:key to did:jwk. Decompressing EC points requires elliptic curve arithmetic. For EVM keys, use didEthrToDidPkh() instead.`,
+    { crv, keyLength: compressedKey.length }
+  );
+}
+function didKeyToDidJwk(did) {
+  if (typeof did !== "string" || !did.startsWith("did:key:")) {
+    throw new OmaTrustError("INVALID_DID", "Expected a did:key DID", { did });
+  }
+  const identifier = did.slice("did:key:".length);
+  if (!identifier || !identifier.startsWith("z")) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      "did:key identifier must start with 'z' (base58btc multibase prefix)",
+      { did }
+    );
+  }
+  let decoded;
+  try {
+    decoded = base58btc.decode(identifier);
+  } catch (err) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      "Failed to decode base58btc from did:key identifier",
+      { did, cause: err }
+    );
+  }
+  if (decoded.length < 3) {
+    throw new OmaTrustError("INVALID_DID", "did:key decoded bytes too short", { did });
+  }
+  const { value: codecValue, bytesRead } = readVarint(decoded, 0);
+  const keyType = MULTICODEC_KEY_TYPES[codecValue];
+  if (!keyType) {
+    throw new OmaTrustError(
+      "UNSUPPORTED_KEY_TYPE",
+      `Unsupported multicodec key type 0x${codecValue.toString(16)} in did:key`,
+      { did, codec: `0x${codecValue.toString(16)}` }
+    );
+  }
+  const keyBytes = decoded.slice(bytesRead);
+  if (keyType.kty === "OKP") {
+    if (keyBytes.length !== 32) {
+      throw new OmaTrustError(
+        "INVALID_DID",
+        `Expected 32-byte ${keyType.crv} key, got ${keyBytes.length} bytes`,
+        { did, crv: keyType.crv }
+      );
+    }
+    const jwk = {
+      kty: keyType.kty,
+      crv: keyType.crv,
+      x: base64url.encode(keyBytes)
+    };
+    return jwkToDidJwk(jwk);
+  }
+  return decompressEcKey(keyBytes, keyType.crv).x.toString();
+}
 
-export { assertBareDid, buildCaip10, buildCaip2, buildDidPkh, buildDidPkhFromCaip10, buildDidWeb, buildEvmDidPkh, canonicalizeForHash, canonicalizeJson, computeDidAddress, computeDidHash, computeJwkThumbprint, didJwkToJwk, didToAddress, extractAddressFromDid, extractAuthorizationMetadata, extractControllerEvmAddress, extractDidIdentifier, extractDidMethod, formatJktValue, getAddressFromDidPkh, getChainIdFromDidPkh, getDomainFromDidWeb, getNamespaceFromDidPkh, hashCanonicalizedJson, isDidUrl, isEvmDidPkh, isPrivateKeyDid, isSameControllerId, isValidDid, jwkToDidJwk, normalizeCaip10, normalizeDid, normalizeDidHandle, normalizeDidJwk, normalizeDidKey, normalizeDidPkh, normalizeDidWeb, normalizeDomain, parseCaip10, parseCaip2, parseDidUrl, publicJwkEquals, resolveDidUrlToControllerDid, resolveDidUrlToPublicKey, validateDidAddress, validatePrivateKeyDid, validatePublicJwk };
+export { artifactDidFromBytes, artifactDidFromJson, assertBareDid, assertJsonSafe, buildCaip10, buildCaip2, buildDidPkh, buildDidPkhFromCaip10, buildDidWeb, buildEvmDidPkh, canonicalizeAndKeccak256, canonicalizeForHash, canonicalizeJson, computeDidAddress, computeDidHash, computeJwkThumbprint, didEthrToDidPkh, didJwkToJwk, didKeyToDidJwk, didToAddress, extractAddressFromDid, extractAuthorizationMetadata, extractControllerEvmAddress, extractDidIdentifier, extractDidMethod, formatJktValue, getAddressFromDidPkh, getChainIdFromDidPkh, getDomainFromDidWeb, getNamespaceFromDidPkh, hashCanonicalizedJson, isDidUrl, isEvmDidPkh, isPrivateKeyDid, isSameControllerId, isValidDid, jwkToDidJwk, normalizeCaip10, normalizeDid, normalizeDidHandle, normalizeDidJwk, normalizeDidKey, normalizeDidPkh, normalizeDidWeb, normalizeDomain, parseArtifactDid, parseCaip10, parseCaip2, parseDidUrl, parseJsonStrict, publicJwkEquals, resolveDidUrlToControllerDid, resolveDidUrlToPublicKey, validateDidAddress, validatePrivateKeyDid, validatePublicJwk, verifyDidArtifact };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map