@proof-holdings/delegation-verifier 0.1.1 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (17) hide show
  1. package/README.md +31 -26
  2. package/dist/delegate.d.ts +0 -7
  3. package/dist/delegate.d.ts.map +1 -1
  4. package/dist/delegate.js +0 -28
  5. package/dist/delegate.js.map +1 -1
  6. package/dist/index.d.ts +3 -3
  7. package/dist/index.d.ts.map +1 -1
  8. package/dist/index.js +3 -3
  9. package/dist/index.js.map +1 -1
  10. package/dist/types.d.ts +5 -10
  11. package/dist/types.d.ts.map +1 -1
  12. package/dist/types.js +1 -1
  13. package/dist/types.js.map +1 -1
  14. package/dist/verify.d.ts.map +1 -1
  15. package/dist/verify.js +11 -24
  16. package/dist/verify.js.map +1 -1
  17. package/package.json +1 -1
package/README.md CHANGED
@@ -1,8 +1,7 @@
1
1
  # @proof-holdings/delegation-verifier
2
2
 
3
3
  Verify a **Proof of Delegation**: a signed statement that the controller of a domain authorized
4
- a specific agent artifact — an npm package, a container, an endpoint — for a set of capability
5
- scopes.
4
+ a specific agent artifact — an npm package, a container, an endpoint.
6
5
 
7
6
  You do not need an account with anyone to use this. It runs against public surfaces only, and
8
7
  it has **no built-in trust list**: you name the issuers you accept.
@@ -18,8 +17,8 @@ Zero runtime dependencies. Node ≥ 18 (or any runtime with WebCrypto, `fetch` a
18
17
 
19
18
  A verified delegation says exactly one thing:
20
19
 
21
- > The controller of `principal` authorized `delegate` for these scopes, and the issuer checked
22
- > that control when it signed.
20
+ > The controller of `principal` authorized `delegate`, and the issuer checked that control when
21
+ > it signed.
23
22
 
24
23
  It is **not** a statement that the artifact is safe, audited, maintained, or endorsed, and it is
25
24
  not a review of the business behind the domain. Do not render it as a generic "verified" badge.
@@ -41,7 +40,6 @@ const result = await verifyPublishedDelegation(serverCard, {
41
40
  // The artifact YOU resolved — the package you are installing, the endpoint you are calling.
42
41
  delegate: { type: 'purl', value: 'pkg:npm/postmark-mcp' },
43
42
  expectedPrincipal: 'postmarkapp.com',
44
- requiredScopes: ['send-email'],
45
43
  });
46
44
 
47
45
  if (result.valid) {
@@ -93,15 +91,21 @@ presented as *"X says it authorized this"*, never as *verified*.
93
91
  4. **Principal** — pinned to the domain you expect, when you supply one. See above: without it
94
92
  the answer says who *claims* the artifact, not that the right party did.
95
93
  5. **Delegate** — canonicalized and compared byte-for-byte with the identity you resolved.
96
- 6. **Status** — two channels, both authenticated:
94
+ 6. **Status** — two channels, both authenticated, asked in order:
97
95
  - the IETF Token Status List the token points at (`status.status_list`), whose uri is
98
96
  refused unless it belongs to your trusted issuer, and whose signature is checked against
99
- the same key set;
100
- - the issuer's status endpoint, which is the only thing that can report the **cascade**: a
101
- delegation is worth no more than the domain control proof beneath it, and a revoked domain
102
- proof does not flip the delegation's own status-list bit.
103
-
104
- Status checking is **fail-closed**: if either channel cannot answer, the result is
97
+ the same key set. A readable `valid`, `revoked` or `suspended` slot is the answer, and the
98
+ check stops there. An issuer whose validity cascades folds a revoked or suspended domain
99
+ control proof beneath the delegation into this same slot (proof.holdings does);
100
+ - the issuer's status endpoint, asked only when the list gives no answer: the token carries
101
+ no status-list claim, or the list cannot be read, is not the trusted issuer's, or holds no
102
+ valid/revoked/suspended value for the token's slot. One thing
103
+ only the endpoint can report is an **expiry** inherited from the domain control proof, which
104
+ a list slot never encodes. A delegation whose own slot and own `exp` both read fine is
105
+ therefore not re-checked for it — an accepted residual, explained in
106
+ [Why the status endpoint is not always called](#why-the-status-endpoint-is-not-always-called-and-what-that-leaves-uncovered).
107
+
108
+ Status checking is **fail-closed**: if neither channel gives an answer, the result is
105
109
  `status_unavailable`, not "valid". Pass `statusCheck: 'skip'` to check signature and claims
106
110
  only — the result then carries `statusChecked: false`, which means *revocation was not
107
111
  checked*, never *not revoked*.
@@ -184,7 +188,7 @@ because they occur in practice).
184
188
 
185
189
  | `reason` | `outcome` | Meaning |
186
190
  | --- | --- | --- |
187
- | `invalid_options` | `invalid` | The call is wrong — usually a missing or uncanonicalizable `delegate`. |
191
+ | `invalid_options` | `invalid` | The call is wrong — usually a missing or uncanonicalizable `delegate`, or the `requiredScopes` option, removed in 0.2.0 with the `scope` claim (refused rather than ignored, so no caller reads a valid answer as "my scopes were granted"). |
188
192
  | `no_trust_policy` | `invalid` | `trustedIssuers` was empty. There is no default. |
189
193
  | `malformed_token` | `invalid` | Not a decodable JWT. |
190
194
  | `untrusted_issuer` | `invalid` | Signed by someone you did not name. |
@@ -196,11 +200,10 @@ because they occur in practice).
196
200
  | `wrong_key_purpose` | `invalid` | The signing key belongs to another key family than a delegation. |
197
201
  | `outside_key_window` | `invalid` | The token's `iat` lies outside the signing key's window (5 minutes of skew allowed). |
198
202
  | `token_lifetime_exceeded` | `invalid` | `exp` lies beyond `iat` plus the signing key's `max_token_lifetime`. |
199
- | `not_a_delegation` / `unsupported_schema` | `invalid` | Wrong token type or a schema major this version does not understand. |
203
+ | `not_a_delegation` / `unsupported_version` | `invalid` | Wrong token type, or a `delegation_schema_version` major other than 2 (a 1.x token, which still carries `scope`, is refused before any network call). |
200
204
  | `expired` / `not_yet_valid` / `malformed_claims` | `invalid` | Claim-level rejections. |
201
205
  | `principal_mismatch` | `invalid` | Issued by a different domain than you expected. |
202
206
  | `delegate_mismatch` | `invalid` | **Attests a different artifact than the one you resolved.** |
203
- | `scope_not_granted` | `invalid` | Does not grant a scope you required. |
204
207
  | `status_uri_untrusted` | `unconfirmed` | The status-list uri in the token is not the issuer's. Not fetched. |
205
208
  | `status_unavailable` | `unconfirmed` | Revocation could not be checked. Fail closed. |
206
209
  | `revoked` / `suspended` | `invalid` | Withdrawn, or reversibly paused. |
@@ -217,17 +220,19 @@ that token's validity in it. An issuer that keeps a side-channel revocation reas
217
220
  published list is not honoring the channel it chose to publish — a fact about that issuer, not
218
221
  something a generic verifier can special-case.
219
222
 
220
- The endpoint still fires for the cases the bit structurally cannot answer: a token with no
221
- status-list claim at all, `unknown_delegation` ("no record of this handle" is distinguishable
222
- from "a record that is dead" only by a live call), and — for issuers whose validity cascades
223
- through something else, like a domain control proof underneath a delegation — an EXPIRY driven by
224
- that something else, which a status-list bit never encodes (only revoked/suspended are, by the
225
- same draft's own vocabulary). For proof.holdings specifically, that cascade-expiry gap is bounded,
226
- not eliminated: a delegation can no longer be minted longer than its underlying control proof, and
227
- a control cannot be re-issued shorter than an outstanding delegation without capping the
228
- reissue to cover it — but a control shortened before that guarantee existed, or a reissue that hit
229
- its own rare fail-open path, can still leave a delegation whose list bit and own `exp` claim both
230
- read fine while its issuer would answer `expired`. This is a known, accepted trade-off — not
223
+ The endpoint is asked only when the list gives no answer: the token carries no status-list claim,
224
+ or the list cannot be read, is not the trusted issuer's, or holds no valid/revoked/suspended value
225
+ for the token's slot. It is the only channel that can report two things the bit structurally
226
+ cannot — `unknown_delegation` ("no record of this handle" is distinguishable from "a record that
227
+ is dead" only by a live call) and, for issuers whose validity cascades through something else, like
228
+ a domain control proof underneath a delegation, an EXPIRY driven by that something else, which a
229
+ status-list bit never encodes (only revoked/suspended are, by the same draft's own vocabulary) —
230
+ so when the list does answer, neither is checked. For proof.holdings specifically, that
231
+ cascade-expiry gap is bounded, not eliminated: a delegation can no longer be minted longer than its
232
+ underlying control proof, and a control cannot be re-issued shorter than an outstanding delegation
233
+ without capping the reissue to cover it — but a control shortened before that guarantee existed, or a
234
+ reissue that hit its own rare fail-open path, can still leave a delegation whose list bit and own
235
+ `exp` claim both read fine while its issuer would answer `expired`. This is a known, accepted trade-off — not
231
236
  silently assumed away.
232
237
 
233
238
  ### One thing a failure reason is not
package/dist/delegate.d.ts CHANGED
@@ -15,8 +15,6 @@ import type { DelegateInput, DelegateType } from './types.js';
15
15
  export declare const DELEGATE_TYPES: readonly DelegateType[];
16
16
  /** Cap on the CANONICAL delegate string. */
17
17
  export declare const DELEGATE_MAX_LENGTH = 512;
18
- export declare const DELEGATION_SCOPE_MAX_ENTRIES = 32;
19
- export declare const DELEGATION_SCOPE_TOKEN_MAX_LENGTH = 64;
20
18
  export declare class DelegateIdentifierError extends Error {
21
19
  constructor(message: string);
22
20
  }
@@ -26,9 +24,4 @@ export declare class DelegateIdentifierError extends Error {
26
24
  * cannot be canonicalized is a bug in the CALL, not evidence about the token.
27
25
  */
28
26
  export declare function canonicalizeDelegate(input: DelegateInput): string;
29
- /**
30
- * Validate and canonicalize a scope list: every entry a lowercase kebab-case token,
31
- * deduplicated, sorted. Throws `DelegateIdentifierError` on any rejection.
32
- */
33
- export declare function canonicalizeScopes(scopes: string[]): string[];
34
27
  //# sourceMappingURL=delegate.d.ts.map
package/dist/delegate.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"delegate.d.ts","sourceRoot":"","sources":["../src/delegate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE9D,eAAO,MAAM,cAAc,EAAE,SAAS,YAAY,EAA6B,CAAC;AAEhF,4CAA4C;AAC5C,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAEvC,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAC/C,eAAO,MAAM,iCAAiC,KAAK,CAAC;AAQpD,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAIjE;AAsGD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAyB7D"}
1
+ {"version":3,"file":"delegate.d.ts","sourceRoot":"","sources":["../src/delegate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE9D,eAAO,MAAM,cAAc,EAAE,SAAS,YAAY,EAA6B,CAAC;AAEhF,4CAA4C;AAC5C,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAKvC,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAIjE"}
package/dist/delegate.js CHANGED
@@ -14,10 +14,6 @@
14
14
  export const DELEGATE_TYPES = ['url', 'purl'];
15
15
  /** Cap on the CANONICAL delegate string. */
16
16
  export const DELEGATE_MAX_LENGTH = 512;
17
- export const DELEGATION_SCOPE_MAX_ENTRIES = 32;
18
- export const DELEGATION_SCOPE_TOKEN_MAX_LENGTH = 64;
19
- /** Lowercase kebab-case: `send-email`, `read-profile-v2`. */
20
- const SCOPE_TOKEN_RE = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
21
17
  /** `pkg:type/[namespace/]name` — structure only; per-type case rules applied after. */
22
18
  const PURL_RE = /^pkg:([a-z0-9.+-]+)\/(.+)$/i;
23
19
  export class DelegateIdentifierError extends Error {
@@ -130,28 +126,4 @@ function enforceLength(canonical) {
130
126
  }
131
127
  return canonical;
132
128
  }
133
- /**
134
- * Validate and canonicalize a scope list: every entry a lowercase kebab-case token,
135
- * deduplicated, sorted. Throws `DelegateIdentifierError` on any rejection.
136
- */
137
- export function canonicalizeScopes(scopes) {
138
- if (!Array.isArray(scopes) || scopes.length === 0) {
139
- throw new DelegateIdentifierError('scope must contain at least one entry');
140
- }
141
- if (scopes.length > DELEGATION_SCOPE_MAX_ENTRIES) {
142
- throw new DelegateIdentifierError(`too many scope entries (max ${DELEGATION_SCOPE_MAX_ENTRIES})`);
143
- }
144
- for (const token of scopes) {
145
- if (typeof token !== 'string' || token.length === 0) {
146
- throw new DelegateIdentifierError('scope entries must be non-empty strings');
147
- }
148
- if (token.length > DELEGATION_SCOPE_TOKEN_MAX_LENGTH) {
149
- throw new DelegateIdentifierError(`scope entry is too long (max ${DELEGATION_SCOPE_TOKEN_MAX_LENGTH} characters)`);
150
- }
151
- if (!SCOPE_TOKEN_RE.test(token)) {
152
- throw new DelegateIdentifierError(`invalid scope entry "${token}" — lowercase kebab-case tokens only (e.g. send-email)`);
153
- }
154
- }
155
- return [...new Set(scopes)].sort();
156
- }
157
129
  //# sourceMappingURL=delegate.js.map
package/dist/delegate.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"delegate.js","sourceRoot":"","sources":["../src/delegate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,MAAM,CAAC,MAAM,cAAc,GAA4B,CAAC,KAAK,EAAE,MAAM,CAAU,CAAC;AAEhF,4CAA4C;AAC5C,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,CAAC;AAC/C,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,CAAC;AAEpD,6DAA6D;AAC7D,MAAM,cAAc,GAAG,+BAA+B,CAAC;AAEvD,uFAAuF;AACvF,MAAM,OAAO,GAAG,6BAA6B,CAAC;AAE9C,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAoB;IACvD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,IAAI,uBAAuB,CAAC,0BAA0B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,uBAAuB,CAAC,4BAA4B,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,sCAAsC,CAAC,CAAC;IAC9F,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAAC,+CAA+C,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAAC,2CAA2C,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,uBAAuB,CAAC,mDAAmD,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACpC,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAEpB,0FAA0F;IAC1F,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,uBAAuB,CAC/B,kFAAkF,CACnF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,uBAAuB,CAAC,2CAA2C,CAAC,CAAC;IACjF,CAAC;IAED,2FAA2F;IAC3F,4FAA4F;IAC5F,wDAAwD;IACxD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpE,CAAC;SAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvF,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,aAAa,CAAC,OAAO,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,SAAS;QAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;YAAE,SAAS,CAAC,eAAe;QAC7D,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,uBAAuB,CAAC,4BAA4B,CAAC,CAAC;IAE1E,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAAC,uCAAuC,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,uBAAuB,CAAC,6BAA6B,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,uBAAuB,CAAC,yCAAyC,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,IAAI,uBAAuB,CAAC,4CAA4C,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAAC,wCAAwC,CAAC,CAAC;IAC9E,CAAC;IAED,4FAA4F;IAC5F,4FAA4F;IAC5F,4EAA4E;IAC5E,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC/B,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;IACjD,CAAC;IAED,OAAO,aAAa,CAAC,WAAW,MAAM,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB;IACtC,IAAI,SAAS,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QAC3C,MAAM,IAAI,uBAAuB,CAAC,6BAA6B,mBAAmB,cAAc,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAgB;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,uBAAuB,CAAC,uCAAuC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,4BAA4B,EAAE,CAAC;QACjD,MAAM,IAAI,uBAAuB,CAAC,+BAA+B,4BAA4B,GAAG,CAAC,CAAC;IACpG,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,uBAAuB,CAAC,yCAAyC,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,iCAAiC,EAAE,CAAC;YACrD,MAAM,IAAI,uBAAuB,CAC/B,gCAAgC,iCAAiC,cAAc,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,uBAAuB,CAC/B,wBAAwB,KAAK,wDAAwD,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACrC,CAAC"}
1
+ {"version":3,"file":"delegate.js","sourceRoot":"","sources":["../src/delegate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,MAAM,CAAC,MAAM,cAAc,GAA4B,CAAC,KAAK,EAAE,MAAM,CAAU,CAAC;AAEhF,4CAA4C;AAC5C,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC,uFAAuF;AACvF,MAAM,OAAO,GAAG,6BAA6B,CAAC;AAE9C,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAoB;IACvD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,IAAI,uBAAuB,CAAC,0BAA0B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,uBAAuB,CAAC,4BAA4B,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,sCAAsC,CAAC,CAAC;IAC9F,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAAC,+CAA+C,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAAC,2CAA2C,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,uBAAuB,CAAC,mDAAmD,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACpC,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAEpB,0FAA0F;IAC1F,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,uBAAuB,CAC/B,kFAAkF,CACnF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,uBAAuB,CAAC,2CAA2C,CAAC,CAAC;IACjF,CAAC;IAED,2FAA2F;IAC3F,4FAA4F;IAC5F,wDAAwD;IACxD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpE,CAAC;SAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvF,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,aAAa,CAAC,OAAO,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,SAAS;QAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;YAAE,SAAS,CAAC,eAAe;QAC7D,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,uBAAuB,CAAC,4BAA4B,CAAC,CAAC;IAE1E,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAAC,uCAAuC,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,uBAAuB,CAAC,6BAA6B,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,uBAAuB,CAAC,yCAAyC,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,IAAI,uBAAuB,CAAC,4CAA4C,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAAC,wCAAwC,CAAC,CAAC;IAC9E,CAAC;IAED,4FAA4F;IAC5F,4FAA4F;IAC5F,4EAA4E;IAC5E,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC/B,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;IACjD,CAAC;IAED,OAAO,aAAa,CAAC,WAAW,MAAM,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB;IACtC,IAAI,SAAS,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QAC3C,MAAM,IAAI,uBAAuB,CAAC,6BAA6B,mBAAmB,cAAc,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
package/dist/index.d.ts CHANGED
@@ -1,8 +1,8 @@
1
1
  /**
2
2
  * @proof-holdings/delegation-verifier — issuer-agnostic verification of Proof of Delegation.
3
3
  *
4
- * A delegation says: the domain in `principal` authorized the artifact in `delegate` for these
5
- * capability scopes, and the issuer checked that domain's control at issuance. It says nothing
4
+ * A delegation says: the domain in `principal` authorized the artifact in `delegate`, and the
5
+ * issuer checked that domain's control at issuance. It says nothing
6
6
  * about whether the artifact is safe, audited, or any good.
7
7
  *
8
8
  * ```ts
@@ -28,7 +28,7 @@ export type { FoundPublication } from './publication.js';
28
28
  */
29
29
  export { parseDelegationPointer, pointerRecordName, POINTER_VERSION, POINTER_RECORD_PREFIX, } from './publication.js';
30
30
  export type { PointerParseResult, PointerRejection } from './publication.js';
31
- export { canonicalizeDelegate, canonicalizeScopes, DelegateIdentifierError, DELEGATE_TYPES, DELEGATE_MAX_LENGTH, } from './delegate.js';
31
+ export { canonicalizeDelegate, DelegateIdentifierError, DELEGATE_TYPES, DELEGATE_MAX_LENGTH, } from './delegate.js';
32
32
  export { clearTombstones, DEFAULT_MAX_JWKS_AGE_MS, getJwksDiagnostics, MAX_JWKS_AGE_CAP_MS, refreshJwks, resetJwksCache, SUPPORTED_ALGORITHMS, } from './jwks.js';
33
33
  export type { JwksDiagnostics, SupportedAlgorithm } from './jwks.js';
34
34
  export { readStatusSlot } from './status.js';
package/dist/index.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,mBAAmB,EACnB,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD;;;;;GAKG;AACH,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,EACvB,cAAc,EACd,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,WAAW,EACX,cAAc,EACd,oBAAoB,GACrB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,YAAY,EACV,aAAa,EACb,YAAY,EACZ,cAAc,EACd,aAAa,EACb,SAAS,EACT,SAAS,EACT,aAAa,EACb,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,GACd,MAAM,YAAY,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,mBAAmB,EACnB,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD;;;;;GAKG;AACH,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,cAAc,EACd,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,WAAW,EACX,cAAc,EACd,oBAAoB,GACrB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,YAAY,EACV,aAAa,EACb,YAAY,EACZ,cAAc,EACd,aAAa,EACb,SAAS,EACT,SAAS,EACT,aAAa,EACb,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,GACd,MAAM,YAAY,CAAC"}
package/dist/index.js CHANGED
@@ -1,8 +1,8 @@
1
1
  /**
2
2
  * @proof-holdings/delegation-verifier — issuer-agnostic verification of Proof of Delegation.
3
3
  *
4
- * A delegation says: the domain in `principal` authorized the artifact in `delegate` for these
5
- * capability scopes, and the issuer checked that domain's control at issuance. It says nothing
4
+ * A delegation says: the domain in `principal` authorized the artifact in `delegate`, and the
5
+ * issuer checked that domain's control at issuance. It says nothing
6
6
  * about whether the artifact is safe, audited, or any good.
7
7
  *
8
8
  * ```ts
@@ -26,7 +26,7 @@ export { verifyPublishedDelegation, extractDelegationPublications, DELEGATION_ME
26
26
  * and hands the TXT values in.
27
27
  */
28
28
  export { parseDelegationPointer, pointerRecordName, POINTER_VERSION, POINTER_RECORD_PREFIX, } from './publication.js';
29
- export { canonicalizeDelegate, canonicalizeScopes, DelegateIdentifierError, DELEGATE_TYPES, DELEGATE_MAX_LENGTH, } from './delegate.js';
29
+ export { canonicalizeDelegate, DelegateIdentifierError, DELEGATE_TYPES, DELEGATE_MAX_LENGTH, } from './delegate.js';
30
30
  export { clearTombstones, DEFAULT_MAX_JWKS_AGE_MS, getJwksDiagnostics, MAX_JWKS_AGE_CAP_MS, refreshJwks, resetJwksCache, SUPPORTED_ALGORITHMS, } from './jwks.js';
31
31
  export { readStatusSlot } from './status.js';
32
32
  export { classifyFailureReason } from './types.js';
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,mBAAmB,EACnB,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,kBAAkB,CAAC;AAE1B;;;;;GAKG;AACH,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,EACvB,cAAc,EACd,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,WAAW,EACX,cAAc,EACd,oBAAoB,GACrB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,mBAAmB,EACnB,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,kBAAkB,CAAC;AAE1B;;;;;GAKG;AACH,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,cAAc,EACd,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,WAAW,EACX,cAAc,EACd,oBAAoB,GACrB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC"}
package/dist/types.d.ts CHANGED
@@ -2,7 +2,7 @@
2
2
  * Public types of the Proof of Delegation reference verifier.
3
3
  *
4
4
  * The library verifies a delegation token — an attestation that the domain in `principal`
5
- * authorized the artifact in `delegate` for a set of capability scopes. It attests NOTHING
5
+ * authorized the artifact in `delegate`. It attests NOTHING
6
6
  * about the artifact's quality, safety or the business behind it, and it is not a statement
7
7
  * that anyone "verified" the server.
8
8
  *
@@ -93,12 +93,6 @@ export interface VerifyOptions {
93
93
  * trimming and lowercasing.
94
94
  */
95
95
  expectedPrincipal?: string;
96
- /**
97
- * Scopes the delegation must grant. Compared as EXACT strings against the token's own
98
- * `scope` (trimmed only): scope grammar belongs to the issuer, and imposing one issuer's
99
- * rules here would make another issuer's grants unaskable.
100
- */
101
- requiredScopes?: string[];
102
96
  /**
103
97
  * `required` (default) — the delegation's status list is checked, and the issuer's status
104
98
  * endpoint is asked too whenever the list cannot answer on its own (see `status.ts` for
@@ -144,9 +138,11 @@ export type FailureReason =
144
138
  /** The token's `iat` lies outside the signing key's window (5 minutes of skew allowed). */
145
139
  | 'outside_key_window'
146
140
  /** `exp` lies beyond `iat` plus the signing key's `max_token_lifetime`. */
147
- | 'token_lifetime_exceeded' | 'not_a_delegation' | 'unsupported_schema' | 'expired' | 'not_yet_valid' | 'malformed_claims' | 'principal_mismatch'
141
+ | 'token_lifetime_exceeded' | 'not_a_delegation'
142
+ /** The token's `delegation_schema_version` major is not 2 (a 1.x token carries `scope`). */
143
+ | 'unsupported_version' | 'expired' | 'not_yet_valid' | 'malformed_claims' | 'principal_mismatch'
148
144
  /** The token attests some OTHER artifact than the one the caller resolved. */
149
- | 'delegate_mismatch' | 'scope_not_granted'
145
+ | 'delegate_mismatch'
150
146
  /** The status-list uri in the token does not belong to the trusted issuer. */
151
147
  | 'status_uri_untrusted' | 'status_unavailable' | 'revoked' | 'suspended'
152
148
  /** The issuer has no record of this delegation — distinct from "it could not answer". */
@@ -171,7 +167,6 @@ export interface VerifiedDelegation {
171
167
  principal: string;
172
168
  /** Canonical artifact identifier, byte-equal to what the caller resolved. */
173
169
  delegate: string;
174
- scope: string[];
175
170
  /** Public handle of the domain control proof underneath this delegation. */
176
171
  controlProof: string;
177
172
  /** Public handle of the delegation itself (`ph_dlg_*` for proof.holdings). */
package/dist/types.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,oEAAoE;AACpE,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,MAAM,CAAC;AAE1C,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,YAAY,CAAC;IACnB,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEjF;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACtF,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC5D;AAED,MAAM,MAAM,aAAa;AACvB,qFAAqF;AACnF,mBAAmB;AACrB,uEAAuE;GACrE,mBAAmB;AACrB,mFAAmF;GACjF,wBAAwB;AAC1B,iGAAiG;GAC/F,0BAA0B;AAC5B,+FAA+F;GAC7F,0BAA0B;AAC5B,yEAAyE;GACvE,0BAA0B;AAC5B,wFAAwF;GACtF,sBAAsB;AACxB,gFAAgF;GAC9E,cAAc;AAChB,yDAAyD;GACvD,aAAa,CAAC;AAElB,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,+EAA+E;IAC/E,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,yEAAyE;IACzE,QAAQ,EAAE,aAAa,CAAC;IACxB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IAClC,mDAAmD;IACnD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,0CAA0C;IAC1C,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,oFAAoF;IACpF,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,2EAA2E;IAC3E,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;CAC1C;AAED,MAAM,MAAM,aAAa;AACvB,4EAA4E;AAC1E,iBAAiB;AACnB,qEAAqE;GACnE,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,uBAAuB,GACvB,aAAa,GACb,eAAe,GACf,kBAAkB;AACpB,0FAA0F;GACxF,aAAa;AACf,4EAA4E;GAC1E,YAAY;AACd,qEAAqE;GACnE,mBAAmB;AACrB,2FAA2F;GACzF,oBAAoB;AACtB,2EAA2E;GACzE,yBAAyB,GACzB,kBAAkB,GAClB,oBAAoB,GACpB,SAAS,GACT,eAAe,GACf,kBAAkB,GAClB,oBAAoB;AACtB,8EAA8E;GAC5E,mBAAmB,GACnB,mBAAmB;AACrB,8EAA8E;GAC5E,sBAAsB,GACtB,oBAAoB,GACpB,SAAS,GACT,WAAW;AACb,yFAAyF;GACvF,oBAAoB;AACtB,8CAA8C;GAC5C,gBAAgB;AAClB,kFAAkF;GAChF,uBAAuB,CAAC;AAE5B,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,aAAa,CAAC;AASvD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,aAAa,GAAG,cAAc,CAE3E;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,4EAA4E;IAC5E,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,IAAI,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,IAAI,CAAC;IACZ,2DAA2D;IAC3D,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;;;;;;;;OAYG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAC1B,UAAU,EAAE,kBAAkB,CAAC;CAChC;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,aAAa,CAAC;IACtB,oGAAoG;IACpG,OAAO,EAAE,cAAc,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,QAAQ,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,qFAAqF;IACrF,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,kFAAkF;IAClF,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,CAAA;KAAE,CAAC;CAC1D;AAED,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,GAAG,mBAAmB,CAAC"}
1
+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,oEAAoE;AACpE,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,MAAM,CAAC;AAE1C,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,YAAY,CAAC;IACnB,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEjF;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACtF,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC5D;AAED,MAAM,MAAM,aAAa;AACvB,qFAAqF;AACnF,mBAAmB;AACrB,uEAAuE;GACrE,mBAAmB;AACrB,mFAAmF;GACjF,wBAAwB;AAC1B,iGAAiG;GAC/F,0BAA0B;AAC5B,+FAA+F;GAC7F,0BAA0B;AAC5B,yEAAyE;GACvE,0BAA0B;AAC5B,wFAAwF;GACtF,sBAAsB;AACxB,gFAAgF;GAC9E,cAAc;AAChB,yDAAyD;GACvD,aAAa,CAAC;AAElB,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,+EAA+E;IAC/E,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,yEAAyE;IACzE,QAAQ,EAAE,aAAa,CAAC;IACxB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IAClC,mDAAmD;IACnD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,0CAA0C;IAC1C,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,oFAAoF;IACpF,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,2EAA2E;IAC3E,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;CAC1C;AAED,MAAM,MAAM,aAAa;AACvB,4EAA4E;AAC1E,iBAAiB;AACnB,qEAAqE;GACnE,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,uBAAuB,GACvB,aAAa,GACb,eAAe,GACf,kBAAkB;AACpB,0FAA0F;GACxF,aAAa;AACf,4EAA4E;GAC1E,YAAY;AACd,qEAAqE;GACnE,mBAAmB;AACrB,2FAA2F;GACzF,oBAAoB;AACtB,2EAA2E;GACzE,yBAAyB,GACzB,kBAAkB;AACpB,4FAA4F;GAC1F,qBAAqB,GACrB,SAAS,GACT,eAAe,GACf,kBAAkB,GAClB,oBAAoB;AACtB,8EAA8E;GAC5E,mBAAmB;AACrB,8EAA8E;GAC5E,sBAAsB,GACtB,oBAAoB,GACpB,SAAS,GACT,WAAW;AACb,yFAAyF;GACvF,oBAAoB;AACtB,8CAA8C;GAC5C,gBAAgB;AAClB,kFAAkF;GAChF,uBAAuB,CAAC;AAE5B,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,aAAa,CAAC;AASvD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,aAAa,GAAG,cAAc,CAE3E;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,IAAI,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,IAAI,CAAC;IACZ,2DAA2D;IAC3D,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;;;;;;;;OAYG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAC1B,UAAU,EAAE,kBAAkB,CAAC;CAChC;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,aAAa,CAAC;IACtB,oGAAoG;IACpG,OAAO,EAAE,cAAc,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,QAAQ,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,qFAAqF;IACrF,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,kFAAkF;IAClF,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,CAAA;KAAE,CAAC;CAC1D;AAED,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,GAAG,mBAAmB,CAAC"}
package/dist/types.js CHANGED
@@ -2,7 +2,7 @@
2
2
  * Public types of the Proof of Delegation reference verifier.
3
3
  *
4
4
  * The library verifies a delegation token — an attestation that the domain in `principal`
5
- * authorized the artifact in `delegate` for a set of capability scopes. It attests NOTHING
5
+ * authorized the artifact in `delegate`. It attests NOTHING
6
6
  * about the artifact's quality, safety or the business behind it, and it is not a statement
7
7
  * that anyone "verified" the server.
8
8
  *
package/dist/types.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAwKH,MAAM,mBAAmB,GAA+B,IAAI,GAAG,CAAC;IAC9D,oBAAoB;IACpB,kBAAkB;IAClB,YAAY;IACZ,sBAAsB;CACvB,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAqB;IACzD,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC"}
1
+ {"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAkKH,MAAM,mBAAmB,GAA+B,IAAI,GAAG,CAAC;IAC9D,oBAAoB;IACpB,kBAAkB;IAClB,YAAY;IACZ,sBAAsB;CACvB,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAqB;IACzD,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC"}
package/dist/verify.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAcH,OAAO,KAAK,EAMV,kBAAkB,EAClB,aAAa,EACd,MAAM,YAAY,CAAC;AAoDpB,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAiQzG"}
1
+ {"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAcH,OAAO,KAAK,EAMV,kBAAkB,EAClB,aAAa,EACd,MAAM,YAAY,CAAC;AAuDpB,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAgPzG"}
package/dist/verify.js CHANGED
@@ -11,8 +11,11 @@ import { DEFAULT_MAX_JWKS_AGE_MS, isSupportedAlgorithm, MAX_JWKS_AGE_CAP_MS, res
11
11
  import { parseJwt } from './jwt.js';
12
12
  import { checkDelegationStatus } from './status.js';
13
13
  import { classifyFailureReason } from './types.js';
14
- /** Delegation token schema versions this verifier understands (major-compatible). */
15
- const SUPPORTED_SCHEMA_MAJOR = '1';
14
+ /**
15
+ * Delegation token schema versions this verifier understands (major-compatible). Schema 2.0
16
+ * removed `scope`; a 1.x token is refused with `unsupported_version`.
17
+ */
18
+ const SUPPORTED_SCHEMA_MAJOR = '2';
16
19
  const DEFAULT_CLOCK_TOLERANCE_SECONDS = 5;
17
20
  const DEFAULT_TIMEOUT_MS = 5_000;
18
21
  function fail(reason, message, extra = {}) {
@@ -74,16 +77,10 @@ export async function verifyDelegation(token, options) {
74
77
  catch (error) {
75
78
  return fail('invalid_options', error instanceof DelegateIdentifierError ? error.message : 'delegate could not be canonicalized');
76
79
  }
77
- // Compared as exact strings, deliberately NOT through the issuer-side scope canonicalizer:
78
- // scope grammar is the issuer's, and running another issuer's `mcp:tools/call` through
79
- // proof.holdings' kebab-case rules would make the requirement unaskable rather than merely
80
- // over-constrained.
81
- let requiredScopes = [];
80
+ // Removed in 0.2.0 together with the claim. Refused rather than ignored: an untyped caller still
81
+ // passing it would otherwise read a valid answer as "the scopes I required were granted".
82
82
  if (options.requiredScopes !== undefined) {
83
- if (!Array.isArray(options.requiredScopes) || options.requiredScopes.some((entry) => typeof entry !== 'string')) {
84
- return fail('invalid_options', 'requiredScopes must be an array of strings');
85
- }
86
- requiredScopes = options.requiredScopes.map((entry) => entry.trim()).filter((entry) => entry.length > 0);
83
+ return fail('invalid_options', 'requiredScopes is no longer supported: delegation schema 2.0 carries no scope');
87
84
  }
88
85
  // Validated like every other option rather than trusted: this is the pin that closes the
89
86
  // sibling attack, and a non-string reaching `normalizePrincipal` would throw out of a
@@ -139,9 +136,9 @@ export async function verifyDelegation(token, options) {
139
136
  }
140
137
  const schemaVersion = claims.delegation_schema_version;
141
138
  if (typeof schemaVersion !== 'string' || schemaVersion.split('.')[0] !== SUPPORTED_SCHEMA_MAJOR) {
142
- return fail('unsupported_schema', `delegation_schema_version ${JSON.stringify(schemaVersion)} is not supported (this verifier understands ${SUPPORTED_SCHEMA_MAJOR}.x)`);
139
+ return fail('unsupported_version', `delegation_schema_version ${JSON.stringify(schemaVersion)} is not supported (this verifier understands ${SUPPORTED_SCHEMA_MAJOR}.x)`);
143
140
  }
144
- const { sub, principal, delegate, control_proof: controlProof, scope, iat, exp } = claims;
141
+ const { sub, principal, delegate, control_proof: controlProof, iat, exp } = claims;
145
142
  if (typeof sub !== 'string' ||
146
143
  sub.length === 0 ||
147
144
  typeof principal !== 'string' ||
@@ -150,12 +147,9 @@ export async function verifyDelegation(token, options) {
150
147
  delegate.length === 0 ||
151
148
  typeof controlProof !== 'string' ||
152
149
  controlProof.length === 0 ||
153
- !Array.isArray(scope) ||
154
- scope.length === 0 ||
155
- scope.some((entry) => typeof entry !== 'string') ||
156
150
  typeof iat !== 'number' ||
157
151
  typeof exp !== 'number') {
158
- return fail('malformed_claims', 'token is missing one of sub / principal / delegate / control_proof / scope / iat / exp');
152
+ return fail('malformed_claims', 'token is missing one of sub / principal / delegate / control_proof / iat / exp');
159
153
  }
160
154
  if (nowSeconds > exp + clockToleranceSeconds) {
161
155
  return fail('expired', 'delegation expired');
@@ -174,12 +168,6 @@ export async function verifyDelegation(token, options) {
174
168
  if (delegate !== expectedDelegate) {
175
169
  return fail('delegate_mismatch', `delegation attests ${JSON.stringify(delegate)}, but the artifact you resolved is ${JSON.stringify(expectedDelegate)}`);
176
170
  }
177
- const grantedScopes = scope;
178
- const grantedTrimmed = grantedScopes.map((entry) => entry.trim());
179
- const missing = requiredScopes.filter((required) => !grantedTrimmed.includes(required));
180
- if (missing.length > 0) {
181
- return fail('scope_not_granted', `delegation does not grant: ${missing.join(', ')}`);
182
- }
183
171
  // ---------------------------------------------------------------- signature
184
172
  const keySetOptions = {
185
173
  maxJwksAgeMs: options.maxJwksAgeMs ?? DEFAULT_MAX_JWKS_AGE_MS,
@@ -226,7 +214,6 @@ export async function verifyDelegation(token, options) {
226
214
  issuer: issuer.issuer,
227
215
  principal,
228
216
  delegate,
229
- scope: grantedScopes,
230
217
  controlProof,
231
218
  delegationId: sub,
232
219
  issuedAt: new Date(iat * 1000),
package/dist/verify.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAC9E,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAWnD,qFAAqF;AACrF,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAC1C,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC,SAAS,IAAI,CACX,MAAqB,EACrB,OAAe,EACf,QAAmF,EAAE;IAErF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;AAC7F,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAwB,EAAE,GAAY;IAC/D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,SAAS,GAAG,KAA+B,CAAC;IAClD,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxF,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,SAAS,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,CAAC;QAAE,OAAO,KAAK,CAAC;IAClG,IAAI,SAAS,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,iBAAiB,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9D,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa,EAAE,OAAsB;IAC1E,qFAAqF;IACrF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,IAAI,CACT,iBAAiB,EACjB,iJAAiJ,CAClJ,CAAC;IACJ,CAAC;IAED,IAAI,gBAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,gBAAgB,GAAG,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,CACT,iBAAiB,EACjB,KAAK,YAAY,uBAAuB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,qCAAqC,CACjG,CAAC;IACJ,CAAC;IAED,2FAA2F;IAC3F,uFAAuF;IACvF,2FAA2F;IAC3F,oBAAoB;IACpB,IAAI,cAAc,GAAa,EAAE,CAAC;IAClC,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;YAChH,OAAO,IAAI,CAAC,iBAAiB,EAAE,4CAA4C,CAAC,CAAC;QAC/E,CAAC;QACD,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3G,CAAC;IAED,yFAAyF;IACzF,sFAAsF;IACtF,2FAA2F;IAC3F,sCAAsC;IACtC,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC5C,IAAI,OAAO,OAAO,CAAC,iBAAiB,KAAK,QAAQ,IAAI,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnG,OAAO,IAAI,CAAC,iBAAiB,EAAE,4DAA4D,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC;QACjC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,mBAAmB,EAAE,CAAC;YAC/F,OAAO,IAAI,CACT,iBAAiB,EACjB,iEAAiE,mBAAmB,YAAY,CACjG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,WAA0C,CAAC;QACjE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACnF,OAAO,IAAI,CAAC,iBAAiB,EAAE,iEAAiE,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACnF,OAAO,IAAI,CAAC,iBAAiB,EAAE,gCAAgC,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/G,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CACT,iBAAiB,EACjB,gJAAgJ,CACjJ,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAc,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,+BAA+B,CAAC;IAC/F,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAEpD,oFAAoF;IACpF,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,iBAAiB,EAAE,yCAAyC,CAAC,CAAC;IAEvF,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CACT,kBAAkB,EAClB,gBAAgB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,sCAAsC,CACzF,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;IAC9B,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,wFAAwF;QACxF,uCAAuC;QACvC,OAAO,IAAI,CAAC,uBAAuB,EAAE,mBAAmB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACjG,CAAC;IAED,wFAAwF;IACxF,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;IAC9B,IAAI,MAAM,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,kBAAkB,EAAE,wCAAwC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/G,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,yBAAyB,CAAC;IACvD,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,sBAAsB,EAAE,CAAC;QAChG,OAAO,IAAI,CACT,oBAAoB,EACpB,6BAA6B,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,gDAAgD,sBAAsB,KAAK,CACtI,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC1F,IACE,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,CAAC,MAAM,KAAK,CAAC;QAChB,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,CAAC,MAAM,KAAK,CAAC;QACtB,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,CAAC,MAAM,KAAK,CAAC;QACrB,OAAO,YAAY,KAAK,QAAQ;QAChC,YAAY,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QAChD,OAAO,GAAG,KAAK,QAAQ;QACvB,OAAO,GAAG,KAAK,QAAQ,EACvB,CAAC;QACD,OAAO,IAAI,CAAC,kBAAkB,EAAE,wFAAwF,CAAC,CAAC;IAC5H,CAAC;IAED,IAAI,UAAU,GAAG,GAAG,GAAG,qBAAqB,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,UAAU,GAAG,qBAAqB,GAAG,GAAG,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,eAAe,EAAE,oDAAoD,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC5C,IAAI,kBAAkB,CAAC,SAAS,CAAC,KAAK,kBAAkB,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACpF,OAAO,IAAI,CACT,oBAAoB,EACpB,4BAA4B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAC1G,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8FAA8F;IAC9F,4FAA4F;IAC5F,kBAAkB;IAClB,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QAClC,OAAO,IAAI,CACT,mBAAmB,EACnB,sBAAsB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,sCAAsC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,CACvH,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,KAAiB,CAAC;IACxC,MAAM,cAAc,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,mBAAmB,EAAE,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,6EAA6E;IAC7E,MAAM,aAAa,GAAkB;QACnC,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,uBAAuB;QAC7D,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC;QAC/C,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QAC1E,GAAG;QACH,MAAM,EAAE,YAAY;QACpB,KAAK,EAAE,SAAS;QAChB,SAAS;QACT,GAAG,aAAa;KACjB,CAAC,CAAC;IACH,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC;QACxB,KAAK,aAAa;YAChB,0EAA0E;YAC1E,OAAO,IAAI,CAAC,kBAAkB,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;QACtD,KAAK,OAAO;YACV,OAAO,IAAI,CACT,YAAY,EACZ,0FAA0F,aAAa,CAAC,YAAY,MAAM,EAC1H,EAAE,eAAe,EAAE,UAAU,CAAC,eAAe,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,CACjH,CAAC;QACJ,KAAK,SAAS;YACZ,4EAA4E;YAC5E,OAAO,IAAI,CAAC,aAAa,EAAE,mCAAmC,UAAU,CAAC,GAAG,GAAG,EAAE;gBAC/E,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE;aACxE,CAAC,CAAC;QACL,KAAK,eAAe;YAClB,OAAO,IAAI,CAAC,mBAAmB,EAAE,gBAAgB,UAAU,CAAC,GAAG,2BAA2B,CAAC,CAAC;QAC9F,KAAK,SAAS;YACZ,OAAO,IAAI,CAAC,aAAa,EAAE,8CAA8C,CAAC,CAAC;QAC7E,KAAK,MAAM;YACT,MAAM;IACV,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IACjH,IAAI,OAAO,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,4BAA4B,CAAC,CAAC;IAC5F,IAAI,OAAO,KAAK,oBAAoB,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC,oBAAoB,EAAE,iDAAiD,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,OAAO,KAAK,yBAAyB,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,yBAAyB,EAAE,qEAAqE,CAAC,CAAC;IAChH,CAAC;IAED,MAAM,UAAU,GAAG;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS;QACT,QAAQ;QACR,KAAK,EAAE,aAAa;QACpB,YAAY;QACZ,YAAY,EAAE,GAAG;QACjB,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC;QAC9B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC;KAChC,CAAC;IACF,0FAA0F;IAC1F,0FAA0F;IAC1F,8DAA8D;IAC9D,MAAM,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,KAAK,SAAS,CAAC;IAEjE,0EAA0E;IAC1E,IAAI,OAAO,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;QACnC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC;QACzC,KAAK;QACL,MAAM;QACN,MAAM;QACN,KAAK,EAAE,SAAS;QAChB,SAAS;QACT,GAAG;QACH,qBAAqB;QACrB,aAAa;KACd,CAAC,CAAC;IAEH,QAAQ,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,KAAK,OAAO;YACV,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC;QAC5E,KAAK,SAAS;YACZ,OAAO,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACzC,KAAK,WAAW;YACd,OAAO,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3C,KAAK,SAAS;YACZ,OAAO,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACzC,KAAK,SAAS;YACZ,OAAO,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACpD,KAAK,eAAe;YAClB,OAAO,IAAI,CAAC,sBAAsB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACtD,KAAK,aAAa;YAChB,4EAA4E;YAC5E,OAAO,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;AACH,CAAC"}
1
+ {"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAC9E,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAWnD;;;GAGG;AACH,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAC1C,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC,SAAS,IAAI,CACX,MAAqB,EACrB,OAAe,EACf,QAAmF,EAAE;IAErF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;AAC7F,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAwB,EAAE,GAAY;IAC/D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,SAAS,GAAG,KAA+B,CAAC;IAClD,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxF,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,SAAS,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,CAAC;QAAE,OAAO,KAAK,CAAC;IAClG,IAAI,SAAS,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,iBAAiB,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9D,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa,EAAE,OAAsB;IAC1E,qFAAqF;IACrF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,IAAI,CACT,iBAAiB,EACjB,iJAAiJ,CAClJ,CAAC;IACJ,CAAC;IAED,IAAI,gBAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,gBAAgB,GAAG,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,CACT,iBAAiB,EACjB,KAAK,YAAY,uBAAuB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,qCAAqC,CACjG,CAAC;IACJ,CAAC;IAED,iGAAiG;IACjG,0FAA0F;IAC1F,IAAK,OAAwC,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC,iBAAiB,EAAE,+EAA+E,CAAC,CAAC;IAClH,CAAC;IAED,yFAAyF;IACzF,sFAAsF;IACtF,2FAA2F;IAC3F,sCAAsC;IACtC,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC5C,IAAI,OAAO,OAAO,CAAC,iBAAiB,KAAK,QAAQ,IAAI,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnG,OAAO,IAAI,CAAC,iBAAiB,EAAE,4DAA4D,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC;QACjC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,mBAAmB,EAAE,CAAC;YAC/F,OAAO,IAAI,CACT,iBAAiB,EACjB,iEAAiE,mBAAmB,YAAY,CACjG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,WAA0C,CAAC;QACjE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACnF,OAAO,IAAI,CAAC,iBAAiB,EAAE,iEAAiE,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACnF,OAAO,IAAI,CAAC,iBAAiB,EAAE,gCAAgC,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/G,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CACT,iBAAiB,EACjB,gJAAgJ,CACjJ,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAc,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,+BAA+B,CAAC;IAC/F,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAEpD,oFAAoF;IACpF,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,iBAAiB,EAAE,yCAAyC,CAAC,CAAC;IAEvF,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CACT,kBAAkB,EAClB,gBAAgB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,sCAAsC,CACzF,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;IAC9B,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,wFAAwF;QACxF,uCAAuC;QACvC,OAAO,IAAI,CAAC,uBAAuB,EAAE,mBAAmB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACjG,CAAC;IAED,wFAAwF;IACxF,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;IAC9B,IAAI,MAAM,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,kBAAkB,EAAE,wCAAwC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/G,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,yBAAyB,CAAC;IACvD,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,sBAAsB,EAAE,CAAC;QAChG,OAAO,IAAI,CACT,qBAAqB,EACrB,6BAA6B,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,gDAAgD,sBAAsB,KAAK,CACtI,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IACnF,IACE,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,CAAC,MAAM,KAAK,CAAC;QAChB,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,CAAC,MAAM,KAAK,CAAC;QACtB,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,CAAC,MAAM,KAAK,CAAC;QACrB,OAAO,YAAY,KAAK,QAAQ;QAChC,YAAY,CAAC,MAAM,KAAK,CAAC;QACzB,OAAO,GAAG,KAAK,QAAQ;QACvB,OAAO,GAAG,KAAK,QAAQ,EACvB,CAAC;QACD,OAAO,IAAI,CAAC,kBAAkB,EAAE,gFAAgF,CAAC,CAAC;IACpH,CAAC;IAED,IAAI,UAAU,GAAG,GAAG,GAAG,qBAAqB,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,UAAU,GAAG,qBAAqB,GAAG,GAAG,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,eAAe,EAAE,oDAAoD,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC5C,IAAI,kBAAkB,CAAC,SAAS,CAAC,KAAK,kBAAkB,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACpF,OAAO,IAAI,CACT,oBAAoB,EACpB,4BAA4B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAC1G,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8FAA8F;IAC9F,4FAA4F;IAC5F,kBAAkB;IAClB,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QAClC,OAAO,IAAI,CACT,mBAAmB,EACnB,sBAAsB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,sCAAsC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,CACvH,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,MAAM,aAAa,GAAkB;QACnC,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,uBAAuB;QAC7D,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC;QAC/C,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QAC1E,GAAG;QACH,MAAM,EAAE,YAAY;QACpB,KAAK,EAAE,SAAS;QAChB,SAAS;QACT,GAAG,aAAa;KACjB,CAAC,CAAC;IACH,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC;QACxB,KAAK,aAAa;YAChB,0EAA0E;YAC1E,OAAO,IAAI,CAAC,kBAAkB,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;QACtD,KAAK,OAAO;YACV,OAAO,IAAI,CACT,YAAY,EACZ,0FAA0F,aAAa,CAAC,YAAY,MAAM,EAC1H,EAAE,eAAe,EAAE,UAAU,CAAC,eAAe,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,CACjH,CAAC;QACJ,KAAK,SAAS;YACZ,4EAA4E;YAC5E,OAAO,IAAI,CAAC,aAAa,EAAE,mCAAmC,UAAU,CAAC,GAAG,GAAG,EAAE;gBAC/E,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE;aACxE,CAAC,CAAC;QACL,KAAK,eAAe;YAClB,OAAO,IAAI,CAAC,mBAAmB,EAAE,gBAAgB,UAAU,CAAC,GAAG,2BAA2B,CAAC,CAAC;QAC9F,KAAK,SAAS;YACZ,OAAO,IAAI,CAAC,aAAa,EAAE,8CAA8C,CAAC,CAAC;QAC7E,KAAK,MAAM;YACT,MAAM;IACV,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IACjH,IAAI,OAAO,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,4BAA4B,CAAC,CAAC;IAC5F,IAAI,OAAO,KAAK,oBAAoB,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC,oBAAoB,EAAE,iDAAiD,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,OAAO,KAAK,yBAAyB,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,yBAAyB,EAAE,qEAAqE,CAAC,CAAC;IAChH,CAAC;IAED,MAAM,UAAU,GAAG;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS;QACT,QAAQ;QACR,YAAY;QACZ,YAAY,EAAE,GAAG;QACjB,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC;QAC9B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC;KAChC,CAAC;IACF,0FAA0F;IAC1F,0FAA0F;IAC1F,8DAA8D;IAC9D,MAAM,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,KAAK,SAAS,CAAC;IAEjE,0EAA0E;IAC1E,IAAI,OAAO,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;QACnC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC;QACzC,KAAK;QACL,MAAM;QACN,MAAM;QACN,KAAK,EAAE,SAAS;QAChB,SAAS;QACT,GAAG;QACH,qBAAqB;QACrB,aAAa;KACd,CAAC,CAAC;IAEH,QAAQ,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,KAAK,OAAO;YACV,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC;QAC5E,KAAK,SAAS;YACZ,OAAO,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACzC,KAAK,WAAW;YACd,OAAO,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3C,KAAK,SAAS;YACZ,OAAO,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACzC,KAAK,SAAS;YACZ,OAAO,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACpD,KAAK,eAAe;YAClB,OAAO,IAAI,CAAC,sBAAsB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACtD,KAAK,aAAa;YAChB,4EAA4E;YAC5E,OAAO,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;AACH,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@proof-holdings/delegation-verifier",
3
- "version": "0.1.1",
3
+ "version": "0.2.0",
4
4
  "description": "Issuer-agnostic verifier for Proof of Delegation tokens — checks that a domain authorized an agent artifact, against a trust policy you supply",
5
5
  "type": "module",
6
6
  "license": "MIT",