@sanctuary-framework/mcp-server 1.2.12 → 1.2.13

package/dist/index.js

@@ -16700,8 +16700,30 @@ function crossHarnessSummary(details, sender) {
   return `${sender} -> operator approval`;
 }
 var COORDINATION_VIEW_AUDIT_OPS = {
+  /** v1.3 Omega-1: operator opened the chronological handoff list. */
   VIEW_OPENED: "operator_coordination_view_opened",
-  ENTRY_DRILLED: "operator_handoff_entry_drilled"
+  /** v1.3 Omega-1: operator drilled into a single handoff for detail. */
+  ENTRY_DRILLED: "operator_handoff_entry_drilled",
+  /**
+   * v1.3 Omega-3: operator opened the Workflows sibling-view (list of
+   * multi-handoff workflows grouped by `workflow-grouper`). Mirrors
+   * VIEW_OPENED's shape so the dashboard activity feed can group both
+   * as "operator coordination surfaces."
+   */
+  WORKFLOW_VIEW_OPENED: "operator_workflow_view_opened",
+  /**
+   * v1.3 Omega-3: operator drilled into a single workflow for its
+   * timeline + member-handoffs detail. Mirrors ENTRY_DRILLED's shape.
+   */
+  WORKFLOW_DRILLED: "operator_workflow_drilled",
+  /**
+   * v1.3 Omega-3: server-side state transition observed on a
+   * workflow (e.g., in_progress -> stalled). Emitted by the route
+   * layer after the state tracker diffs against its prior snapshot.
+   * Distinct from the operator-action events above: this records what
+   * the workflow itself is doing, not what the operator clicked.
+   */
+  WORKFLOW_STATE_CHANGED: "coordination_workflow_state_changed"
 };
 
 // src/coordination/context-transfer-extractor.ts
@@ -16973,10 +16995,123 @@ function categoryFromPolicyRuleId(ruleId) {
 var CONTEXT_TRANSFER_AUDIT_OPS = {
   DECODED: "operator_handoff_context_transfer_decoded"
 };
+var HEURISTIC_WINDOW_MS = 5 * 60 * 1e3;
+var STALL_THRESHOLD_MS = 2 * 60 * 60 * 1e3;
+var CYCLE_COMPLETION_MIN_HOPS = 2;
+function groupHandoffsIntoWorkflows(handoffs, opts) {
+  if (handoffs.length === 0) return [];
+  const now = opts?.now ?? /* @__PURE__ */ new Date();
+  const linkedGroups = /* @__PURE__ */ new Map();
+  const unlinked = [];
+  for (const h of handoffs) {
+    if (h.workflow_link !== null && h.workflow_link.length > 0) {
+      let bucket = linkedGroups.get(h.workflow_link);
+      if (!bucket) {
+        bucket = [];
+        linkedGroups.set(h.workflow_link, bucket);
+      }
+      bucket.push(h);
+    } else {
+      unlinked.push(h);
+    }
+  }
+  const sortedUnlinked = [...unlinked].sort(
+    (a, b) => a.observed_at < b.observed_at ? -1 : 1
+  );
+  const heuristicChains = [];
+  for (const h of sortedUnlinked) {
+    const joinedIdx = findExtendableChain(heuristicChains, h);
+    if (joinedIdx !== null) {
+      heuristicChains[joinedIdx].push(h);
+    } else {
+      heuristicChains.push([h]);
+    }
+  }
+  const workflows = [];
+  for (const members of linkedGroups.values()) {
+    workflows.push(materialize(members, now));
+  }
+  for (const members of heuristicChains) {
+    workflows.push(materialize(members, now));
+  }
+  workflows.sort(
+    (a, b) => a.last_activity_at < b.last_activity_at ? 1 : -1
+  );
+  return workflows;
+}
+function determineWorkflowState(members, now) {
+  if (members.length === 0) return "unknown";
+  const sorted = [...members].sort(
+    (a, b) => a.observed_at < b.observed_at ? -1 : 1
+  );
+  const last = sorted[sorted.length - 1];
+  const root = sorted[0];
+  const lastMs = Date.parse(last.observed_at);
+  if (!Number.isFinite(lastMs)) return "unknown";
+  if (last.target_agent_id === OPERATOR_PSEUDO_AGENT) {
+    return "completed";
+  }
+  if (sorted.length > CYCLE_COMPLETION_MIN_HOPS && last.target_agent_id === root.source_agent_id) {
+    return "completed";
+  }
+  const ageMs = now.getTime() - lastMs;
+  if (ageMs > STALL_THRESHOLD_MS) {
+    return "stalled";
+  }
+  return "in_progress";
+}
+function workflowIdFromRoot(rootEntryId) {
+  return createHash("sha256").update(`workflow:${rootEntryId}`).digest("hex").slice(0, 32);
+}
+function findExtendableChain(chains, h) {
+  const hMs = Date.parse(h.observed_at);
+  if (!Number.isFinite(hMs)) return null;
+  let bestIdx = null;
+  let bestGapMs = Number.POSITIVE_INFINITY;
+  for (let i = 0; i < chains.length; i += 1) {
+    const chain = chains[i];
+    const last = chain[chain.length - 1];
+    const lastMs = Date.parse(last.observed_at);
+    if (!Number.isFinite(lastMs)) continue;
+    const gapMs = Math.abs(hMs - lastMs);
+    if (gapMs > HEURISTIC_WINDOW_MS) continue;
+    if (!sharesAgent(last, h)) continue;
+    if (gapMs < bestGapMs) {
+      bestGapMs = gapMs;
+      bestIdx = i;
+    }
+  }
+  return bestIdx;
+}
+function sharesAgent(a, b) {
+  return a.source_agent_id === b.source_agent_id || a.source_agent_id === b.target_agent_id || a.target_agent_id === b.source_agent_id || a.target_agent_id === b.target_agent_id;
+}
+function materialize(members, now) {
+  const sorted = [...members].sort(
+    (a, b) => a.observed_at < b.observed_at ? -1 : 1
+  );
+  const root = sorted[0];
+  const last = sorted[sorted.length - 1];
+  const involved = /* @__PURE__ */ new Set();
+  for (const h of sorted) {
+    if (h.source_agent_id) involved.add(h.source_agent_id);
+    if (h.target_agent_id) involved.add(h.target_agent_id);
+  }
+  return {
+    workflow_id: workflowIdFromRoot(root.entry_id),
+    root_handoff: root,
+    member_handoffs: sorted,
+    state: determineWorkflowState(sorted, now),
+    started_at: root.observed_at,
+    last_activity_at: last.observed_at,
+    involved_agents: [...involved].sort()
+  };
+}
 
 // src/coordination/handoff-routes.ts
 var COORDINATION_API_PREFIX = "/api/coordination";
 var COORDINATION_HANDOFFS_PREFIX = "/api/coordination/handoffs";
+var COORDINATION_WORKFLOWS_PREFIX = "/api/coordination/workflows";
 var COORDINATION_LIST_DEFAULT_LIMIT = 50;
 var COORDINATION_LIST_MAX_LIMIT = 500;
 var HandoffEventBridge = class {
@@ -17015,6 +17150,101 @@ function matchEntryRoute2(path) {
   if (rest.includes("/")) return null;
   return { entryId: decodeURIComponent(rest) };
 }
+function matchWorkflowRoute(path) {
+  const prefix = `${COORDINATION_WORKFLOWS_PREFIX}/`;
+  if (!path.startsWith(prefix)) return null;
+  const rest = path.slice(prefix.length);
+  if (rest.length === 0 || rest === "stream") return null;
+  if (rest.includes("/")) return null;
+  return { workflowId: decodeURIComponent(rest) };
+}
+async function computeWorkflowsAndTrackTransitions(deps) {
+  const handoffs = await deps.handoffLog.query({ limit: 500 });
+  const workflows = groupHandoffsIntoWorkflows(handoffs, {
+    ...deps.now !== void 0 ? { now: deps.now() } : {}
+  });
+  const transitions = deps.workflowStateTracker ? deps.workflowStateTracker.observe(workflows) : [];
+  for (const change of transitions) {
+    deps.auditLog.append(
+      "l2",
+      COORDINATION_VIEW_AUDIT_OPS.WORKFLOW_STATE_CHANGED,
+      deps.operatorId,
+      {
+        fortress_id: deps.handoffLog.getFortressId(),
+        workflow_id: change.workflow_id,
+        previous_state: change.previous_state,
+        new_state: change.new_state
+      }
+    );
+  }
+  return { workflows, transitions };
+}
+function filterWorkflowList(workflows, opts) {
+  let filtered = workflows;
+  if (opts.state) {
+    filtered = filtered.filter((w) => w.state === opts.state);
+  }
+  if (opts.agentId) {
+    filtered = filtered.filter((w) => w.involved_agents.includes(opts.agentId));
+  }
+  if (opts.since) {
+    filtered = filtered.filter((w) => w.last_activity_at >= opts.since);
+  }
+  return filtered.slice(0, opts.limit);
+}
+function isWorkflowState(value) {
+  return value === "in_progress" || value === "completed" || value === "stalled" || value === "unknown";
+}
+async function handleWorkflowStream(deps, res) {
+  res.writeHead(200, {
+    "Content-Type": "text/event-stream",
+    "Cache-Control": "no-cache, no-transform",
+    Connection: "keep-alive",
+    "X-Accel-Buffering": "no"
+  });
+  const initial = await computeWorkflowsAndTrackTransitions(deps);
+  res.write(
+    `event: workflow_snapshot
+data: ${JSON.stringify({ workflows: initial.workflows })}
+
+`
+  );
+  if (initial.transitions.length > 0) {
+    res.write(
+      `event: workflow_state_changed
+data: ${JSON.stringify({ transitions: initial.transitions })}
+
+`
+    );
+  }
+  const unsubscribe = deps.events.subscribe(() => {
+    void (async () => {
+      try {
+        const tick = await computeWorkflowsAndTrackTransitions(deps);
+        res.write(
+          `event: workflow_snapshot
+data: ${JSON.stringify({ workflows: tick.workflows })}
+
+`
+        );
+        if (tick.transitions.length > 0) {
+          res.write(
+            `event: workflow_state_changed
+data: ${JSON.stringify({ transitions: tick.transitions })}
+
+`
+          );
+        }
+      } catch {
+      }
+    })();
+  });
+  const cleanup = () => {
+    unsubscribe();
+  };
+  res.on("close", cleanup);
+  res.on("error", cleanup);
+}
 async function handleStream3(deps, res) {
   res.writeHead(200, {
     "Content-Type": "text/event-stream",
@@ -17098,6 +17328,67 @@ async function handleCoordinationRoute(deps, req, res) {
       writeJSON6(res, 200, { ok: true, data: { entries } });
       return true;
     }
+    if (method === "GET" && path === `${COORDINATION_WORKFLOWS_PREFIX}/stream`) {
+      await handleWorkflowStream(deps, res);
+      return true;
+    }
+    if (method === "GET" && path === COORDINATION_WORKFLOWS_PREFIX) {
+      const limit = parseLimit4(
+        url.searchParams.get("limit"),
+        COORDINATION_LIST_DEFAULT_LIMIT,
+        COORDINATION_LIST_MAX_LIMIT
+      );
+      const rawState = url.searchParams.get("state");
+      const state = rawState && isWorkflowState(rawState) ? rawState : void 0;
+      const since = url.searchParams.get("since") ?? void 0;
+      const agentId = url.searchParams.get("agent_id") ?? void 0;
+      const computed = await computeWorkflowsAndTrackTransitions(deps);
+      const filtered = filterWorkflowList(computed.workflows, {
+        ...state !== void 0 ? { state } : {},
+        ...agentId !== void 0 ? { agentId } : {},
+        ...since !== void 0 ? { since } : {},
+        limit
+      });
+      deps.auditLog.append(
+        "l2",
+        COORDINATION_VIEW_AUDIT_OPS.WORKFLOW_VIEW_OPENED,
+        deps.operatorId,
+        {
+          fortress_id: deps.handoffLog.getFortressId(),
+          result_count: filtered.length,
+          ...state !== void 0 ? { state } : {},
+          ...agentId !== void 0 ? { agent_id: agentId } : {},
+          ...since !== void 0 ? { since } : {}
+        }
+      );
+      writeJSON6(res, 200, { ok: true, data: { workflows: filtered } });
+      return true;
+    }
+    const workflowMatch = matchWorkflowRoute(path);
+    if (method === "GET" && workflowMatch) {
+      const computed = await computeWorkflowsAndTrackTransitions(deps);
+      const wf = computed.workflows.find(
+        (w) => w.workflow_id === workflowMatch.workflowId
+      );
+      if (!wf) {
+        writeJSON6(res, 404, { ok: false, error: "not_found" });
+        return true;
+      }
+      deps.auditLog.append(
+        "l2",
+        COORDINATION_VIEW_AUDIT_OPS.WORKFLOW_DRILLED,
+        deps.operatorId,
+        {
+          fortress_id: deps.handoffLog.getFortressId(),
+          workflow_id: wf.workflow_id,
+          state: wf.state,
+          member_count: wf.member_handoffs.length,
+          involved_agent_count: wf.involved_agents.length
+        }
+      );
+      writeJSON6(res, 200, { ok: true, data: { workflow: wf } });
+      return true;
+    }
     const entryMatch = matchEntryRoute2(path);
     if (method === "GET" && entryMatch) {
       const detail = await deps.handoffLog.getEntry(entryMatch.entryId);
@@ -17239,6 +17530,8 @@ var DashboardApprovalChannel = class {
    */
   handoffLog = null;
   handoffEventBridge = null;
+  handoffContextTransfer = null;
+  workflowStateTracker = null;
   handoffAuditLog = null;
   handoffOperatorId = null;
   constructor(config) {
@@ -17319,6 +17612,8 @@ var DashboardApprovalChannel = class {
     this.handoffEventBridge = opts.eventBridge ?? null;
     this.handoffAuditLog = opts.auditLog ?? null;
     this.handoffOperatorId = opts.operatorId ?? null;
+    this.handoffContextTransfer = opts.contextTransfer ?? null;
+    this.workflowStateTracker = opts.workflowStateTracker ?? null;
   }
   /**
    * v1.3 WP-V1.3-10 dispatch entry point. Called from `handleRequest`
@@ -17376,7 +17671,9 @@ var DashboardApprovalChannel = class {
         handoffLog: this.handoffLog,
         auditLog: this.handoffAuditLog,
         operatorId: this.handoffOperatorId ?? this.identityManager?.getPrimaryIdentityId() ?? "operator_dashboard",
-        events: this.handoffEventBridge
+        events: this.handoffEventBridge,
+        ...this.handoffContextTransfer !== null ? { contextTransfer: this.handoffContextTransfer } : {},
+        ...this.workflowStateTracker !== null ? { workflowStateTracker: this.workflowStateTracker } : {}
       },
       req,
       res
@@ -21909,6 +22206,70 @@ function classifierSpecificAuditOp(classifierId) {
   return null;
 }
 
+// src/coordination/workflow-state-tracker.ts
+var WorkflowStateTracker = class {
+  states = /* @__PURE__ */ new Map();
+  now;
+  constructor(opts) {
+    this.now = opts?.now ?? (() => /* @__PURE__ */ new Date());
+  }
+  /**
+   * Diff the supplied workflow list against the last-observed states.
+   * Returns the set of transitions detected this call; the tracker
+   * mutates its internal map to reflect the new states.
+   *
+   * Transitions emitted:
+   *   - First observation of a workflow (`previous_state` is the
+   *     sentinel `unobserved`). Lets the route handler audit-emit
+   *     the initial state so the operator sees workflows as they
+   *     surface, not only when they change.
+   *   - Subsequent observation where `previous_state !== new_state`.
+   */
+  observe(workflows) {
+    const out = [];
+    const observedAt = this.now().toISOString();
+    for (const wf of workflows) {
+      const prior = this.states.get(wf.workflow_id);
+      if (prior === void 0) {
+        out.push({
+          workflow_id: wf.workflow_id,
+          previous_state: "unobserved",
+          new_state: wf.state,
+          observed_at: observedAt
+        });
+        this.states.set(wf.workflow_id, wf.state);
+        continue;
+      }
+      if (prior !== wf.state) {
+        out.push({
+          workflow_id: wf.workflow_id,
+          previous_state: prior,
+          new_state: wf.state,
+          observed_at: observedAt
+        });
+        this.states.set(wf.workflow_id, wf.state);
+      }
+    }
+    return out;
+  }
+  /**
+   * Drop a workflow's recorded state. Surfaced for tests + future
+   * "operator dismissed this workflow" affordance; not currently
+   * called by the production wiring.
+   */
+  forget(workflowId) {
+    this.states.delete(workflowId);
+  }
+  /** Reset the tracker. Tests use this between runs. */
+  reset() {
+    this.states.clear();
+  }
+  /** Read-only view of the current snapshot. Useful for diagnostics. */
+  snapshot() {
+    return new Map(this.states);
+  }
+};
+
 // src/sentinel/sentinel.ts
 var Sentinel = class {
   /**
@@ -25142,7 +25503,7 @@ function createBridgeCommitment(outcome, identity, identityEncryptionKey, includ
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const canonicalBytes = canonicalize2(outcome);
   const canonicalString = new TextDecoder().decode(canonicalBytes);
-  const sha25611 = createCommitment(canonicalString);
+  const sha25612 = createCommitment(canonicalString);
   let pedersenData;
   if (includePedersen && Number.isInteger(outcome.rounds) && outcome.rounds >= 0) {
     const pedersen = createPedersenCommitment(outcome.rounds);
@@ -25154,7 +25515,7 @@ function createBridgeCommitment(outcome, identity, identityEncryptionKey, includ
   const commitmentPayload = {
     bridge_commitment_id: commitmentId,
     session_id: outcome.session_id,
-    sha256_commitment: sha25611.commitment,
+    sha256_commitment: sha25612.commitment,
     terms_hash: outcome.terms_hash,
     committer_did: identity.did,
     committed_at: now,
@@ -25165,8 +25526,8 @@ function createBridgeCommitment(outcome, identity, identityEncryptionKey, includ
   return {
     bridge_commitment_id: commitmentId,
     session_id: outcome.session_id,
-    sha256_commitment: sha25611.commitment,
-    blinding_factor: sha25611.blinding_factor,
+    sha256_commitment: sha25612.commitment,
+    blinding_factor: sha25612.blinding_factor,
     committer_did: identity.did,
     signature: toBase64url(signature),
     pedersen_commitment: pedersenData,
@@ -39717,6 +40078,150 @@ var EXIT_BUNDLE_ARTIFACT_KINDS = [
   "placeholder_vault_metadata"
 ];
 
+// src/recognition/did-web.ts
+init_encoding();
+init_hashing();
+var DEFAULT_TIMEOUT_MS4 = 5e3;
+var HOST_RE = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/i;
+async function resolveDidWeb(did, opts) {
+  const parsed = parseDidWeb(did);
+  const url = didToUrl(parsed);
+  if (!opts.allowed_hosts.includes(parsed.authority_host)) {
+    return {
+      ok: false,
+      failure: "host_not_allowed",
+      message: `did-web: authority_host '${parsed.authority_host}' is not in the operator's allowed_hosts allowlist; resolution refused (no-outbound-by-default)`,
+      url
+    };
+  }
+  const timeoutMs = opts.timeout_ms ?? DEFAULT_TIMEOUT_MS4;
+  const fetcher = opts.fetcher ?? defaultFetcher;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  let response;
+  try {
+    response = await fetcher(url, { signal: controller.signal });
+  } catch (err) {
+    clearTimeout(timer);
+    const message = err instanceof Error ? err.message : String(err);
+    if (controller.signal.aborted) {
+      return {
+        ok: false,
+        failure: "timeout",
+        message: `did-web: resolution exceeded ${timeoutMs}ms`,
+        url
+      };
+    }
+    return {
+      ok: false,
+      failure: "fetch_failed",
+      message: `did-web: fetch error: ${message}`,
+      url
+    };
+  }
+  clearTimeout(timer);
+  if (response.status === 404) {
+    return {
+      ok: false,
+      failure: "not_found",
+      message: `did-web: 404 from authority host`,
+      url
+    };
+  }
+  if (!response.ok) {
+    return {
+      ok: false,
+      failure: "fetch_failed",
+      message: `did-web: authority host returned ${response.status}`,
+      url
+    };
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return {
+      ok: false,
+      failure: "invalid_json",
+      message: `did-web: invalid JSON: ${message}`,
+      url
+    };
+  }
+  if (!isDidDocument(body, did)) {
+    return {
+      ok: false,
+      failure: "invalid_json",
+      message: `did-web: response body is not a valid DID Document for ${did}`,
+      url
+    };
+  }
+  if (opts.expected_public_key !== void 0) {
+    const expectedX = toBase64url(opts.expected_public_key);
+    const actualX = body.verificationMethod[0]?.publicKeyJwk.x;
+    if (actualX !== expectedX) {
+      return {
+        ok: false,
+        failure: "signature_mismatch",
+        message: `did-web: verificationMethod public key does not match expected key`,
+        url
+      };
+    }
+  }
+  return { ok: true, did_document: body, url };
+}
+function parseDidWeb(did) {
+  if (!did.startsWith("did:web:")) {
+    throw new Error(`did-web: '${did}' is not a did:web identifier`);
+  }
+  const rest = did.slice("did:web:".length);
+  const segments = rest.split(":");
+  const authorityHost = segments[0];
+  if (!HOST_RE.test(authorityHost)) {
+    throw new Error(`did-web: '${authorityHost}' is not a valid DNS host`);
+  }
+  const parsed = { authority_host: authorityHost };
+  if (segments.length === 1) return parsed;
+  if (segments.length === 5 && segments[1] === "fortress" && segments[3] === "agent") {
+    parsed.fortress_id = segments[2];
+    parsed.agent_label = segments[4];
+    return parsed;
+  }
+  throw new Error(
+    `did-web: '${did}' does not match the supported shapes (bare did:web:<host> or did:web:<host>:fortress:<fid>:agent:<alabel>)`
+  );
+}
+function didToUrl(parsed) {
+  if (parsed.fortress_id === void 0 || parsed.agent_label === void 0) {
+    return `https://${parsed.authority_host}/.well-known/did.json`;
+  }
+  return `https://${parsed.authority_host}/fortress/${parsed.fortress_id}/agent/${parsed.agent_label}/did.json`;
+}
+function isDidDocument(value, expectedDid) {
+  if (!value || typeof value !== "object") return false;
+  const v = value;
+  if (v["id"] !== expectedDid) return false;
+  if (!Array.isArray(v["@context"])) return false;
+  const vm = v["verificationMethod"];
+  if (!Array.isArray(vm) || vm.length === 0) return false;
+  const first = vm[0];
+  if (!first || typeof first["id"] !== "string") return false;
+  const jwk = first["publicKeyJwk"];
+  if (!jwk || jwk["kty"] !== "OKP" || jwk["crv"] !== "Ed25519") return false;
+  if (typeof jwk["x"] !== "string") return false;
+  if (!Array.isArray(v["authentication"])) return false;
+  if (!Array.isArray(v["assertionMethod"])) return false;
+  return true;
+}
+async function defaultFetcher(url, init) {
+  const response = await fetch(url, init);
+  return {
+    ok: response.ok,
+    status: response.status,
+    json: () => response.json()
+  };
+}
+
 // src/exit/bundle.ts
 init_hashing();
 init_encoding();
@@ -40141,6 +40646,11 @@ async function verifyExitBundle(bundleDir, options = {}) {
 
 // src/exit/bundle.ts
 var ARTIFACT_DIR = "artifacts";
+var EXIT_BUNDLE_DID_WEB_AUDIT_OPS = {
+  EXPORT_INCLUDED: "exit_bundle_did_web_export_included",
+  IMPORT_VERIFIED: "exit_bundle_did_web_import_verified",
+  AUTHORITY_HOST: "exit_bundle_did_web_authority_host"
+};
 var EXIT_IMPORT_NAMESPACE = "_exit_imports";
 var EXIT_PUBLIC_IDENTITIES_NAMESPACE = "_exit_public_identities";
 var EXIT_AUDIT_RECEIPTS_NAMESPACE = "_exit_audit_receipts";
@@ -40432,6 +40942,7 @@ async function exportExitBundle(opts) {
       "placeholder_vault_metadata"
     )
   );
+  const didWebBinding = validateExportDidWeb(opts.didWeb);
   const body = {
     manifest_version: EXIT_BUNDLE_MANIFEST_VERSION,
     exported_at: (/* @__PURE__ */ new Date()).toISOString(),
@@ -40439,7 +40950,8 @@ async function exportExitBundle(opts) {
       identity_id: identity.identity_id,
       fortress_id: identity.did,
       fortress_master_pubkey: identity.public_key,
-      did: identity.did
+      did: identity.did,
+      ...didWebBinding !== void 0 ? { did_web: didWebBinding } : {}
     },
     source_sanctuary_version: opts.config?.version ?? SANCTUARY_VERSION,
     artifacts,
@@ -40461,6 +40973,18 @@ async function exportExitBundle(opts) {
   };
   const manifestBytes = jsonBytes(manifest);
   await writeFile(join(bundleDir, "manifest.json"), manifestBytes, { mode: 384 });
+  if (didWebBinding !== void 0) {
+    opts.auditLog.append(
+      "l1",
+      EXIT_BUNDLE_DID_WEB_AUDIT_OPS.EXPORT_INCLUDED,
+      identity.identity_id,
+      {
+        approval_id: exportApprovalAuditId,
+        identifier: didWebBinding.identifier,
+        authority_host: didWebBinding.authority_host
+      }
+    );
+  }
   await opts.auditLog.flush();
   return {
     bundle_dir: bundleDir,
@@ -40472,6 +40996,30 @@ async function exportExitBundle(opts) {
     ]
   };
 }
+function validateExportDidWeb(binding) {
+  if (binding === void 0) return void 0;
+  if (!binding.identifier || typeof binding.identifier !== "string") {
+    throw new Error(
+      "exit-bundle: did_web.identifier must be a non-empty did:web URI"
+    );
+  }
+  if (!binding.authority_host || typeof binding.authority_host !== "string") {
+    throw new Error(
+      "exit-bundle: did_web.authority_host must be a non-empty DNS host"
+    );
+  }
+  const parsed = parseDidWeb(binding.identifier);
+  if (parsed.authority_host.toLowerCase() !== binding.authority_host.toLowerCase()) {
+    throw new Error(
+      `exit-bundle: did_web.identifier authority host '${parsed.authority_host}' does not match did_web.authority_host '${binding.authority_host}'`
+    );
+  }
+  return {
+    identifier: binding.identifier,
+    authority_host: binding.authority_host,
+    ...binding.published_at !== void 0 ? { published_at: binding.published_at } : {}
+  };
+}
 function publicKeysFromIdentityArtifact(identityArtifact) {
   const pubkey = fromBase64url(identityArtifact.bundle.publicKey);
   return {
@@ -40686,6 +41234,87 @@ async function importExitBundle(opts) {
     };
   }
   const manifest = await readManifest(opts.bundleDir);
+  const importWarnings = [];
+  const manifestDidWeb = manifest.body.identity_binding.did_web;
+  if (manifestDidWeb !== void 0 && !opts.skipDidWebVerify) {
+    const expectedPublicKey = fromBase64url(
+      manifest.body.identity_binding.fortress_master_pubkey
+    );
+    const resolveOpts = {
+      allowed_hosts: opts.didWebAllowedHosts ?? [],
+      expected_public_key: expectedPublicKey,
+      ...opts.didWebFetcher !== void 0 ? { fetcher: opts.didWebFetcher } : {},
+      ...opts.didWebTimeoutMs !== void 0 ? { timeout_ms: opts.didWebTimeoutMs } : {}
+    };
+    const resolution = await resolveDidWeb(
+      manifestDidWeb.identifier,
+      resolveOpts
+    );
+    const authorityHost = manifestDidWeb.authority_host;
+    opts.auditLog.append(
+      "l1",
+      EXIT_BUNDLE_DID_WEB_AUDIT_OPS.AUTHORITY_HOST,
+      manifest.body.identity_binding.identity_id,
+      { authority_host: authorityHost, identifier: manifestDidWeb.identifier }
+    );
+    if (resolution.ok) {
+      opts.auditLog.append(
+        "l1",
+        EXIT_BUNDLE_DID_WEB_AUDIT_OPS.IMPORT_VERIFIED,
+        manifest.body.identity_binding.identity_id,
+        {
+          outcome: "success",
+          identifier: manifestDidWeb.identifier,
+          authority_host: authorityHost,
+          resolved_url: resolution.url
+        }
+      );
+    } else if (resolution.failure === "signature_mismatch") {
+      opts.auditLog.append(
+        "l1",
+        EXIT_BUNDLE_DID_WEB_AUDIT_OPS.IMPORT_VERIFIED,
+        manifest.body.identity_binding.identity_id,
+        {
+          outcome: "mismatch",
+          identifier: manifestDidWeb.identifier,
+          authority_host: authorityHost,
+          resolved_url: resolution.url
+        }
+      );
+      await opts.auditLog.flush();
+      throw new ExitBundleImportError(
+        "did_web_mismatch",
+        `did:web cross-check failed: the DID Document at ${resolution.url} resolved successfully, but the verificationMethod public key did not match the manifest's claimed fortress_master_pubkey. The bundle's claimed origin (${manifestDidWeb.identifier}) is inconsistent with the published DID Document. To proceed anyway with the manifest signature alone, re-run import with --skip-did-web-verify.`
+      );
+    } else {
+      opts.auditLog.append(
+        "l1",
+        EXIT_BUNDLE_DID_WEB_AUDIT_OPS.IMPORT_VERIFIED,
+        manifest.body.identity_binding.identity_id,
+        {
+          outcome: "resolution_failure",
+          failure: resolution.failure,
+          identifier: manifestDidWeb.identifier,
+          authority_host: authorityHost,
+          resolved_url: resolution.url
+        }
+      );
+      importWarnings.push(
+        `did:web resolution failed (${resolution.failure}): ${resolution.message}. Import proceeded with manifest-signature verification alone; recognition-layer cross-check was skipped. Re-run with --did-web-allowed-host=<host> to enable resolution, or --skip-did-web-verify to skip deliberately.`
+      );
+    }
+  } else if (manifestDidWeb !== void 0 && opts.skipDidWebVerify) {
+    opts.auditLog.append(
+      "l1",
+      EXIT_BUNDLE_DID_WEB_AUDIT_OPS.IMPORT_VERIFIED,
+      manifest.body.identity_binding.identity_id,
+      {
+        outcome: "skipped",
+        identifier: manifestDidWeb.identifier,
+        authority_host: manifestDidWeb.authority_host
+      }
+    );
+  }
   const identityArtifact = await loadExitArtifact(
     opts.bundleDir,
     manifest,
@@ -40750,7 +41379,7 @@ async function importExitBundle(opts) {
         unverifiable_attestations: verification.reputation?.unverifiable_attestations ?? 0
       },
       staged_artifacts: [],
-      warnings: verification.warnings,
+      warnings: [...verification.warnings, ...importWarnings],
       unsupported_artifacts: verification.unsupported_artifacts
     };
   }
@@ -40917,7 +41546,7 @@ async function importExitBundle(opts) {
     state: stateResult,
     reputation: reputationResult,
     staged_artifacts: stagedArtifacts,
-    warnings: verification.warnings,
+    warnings: [...verification.warnings, ...importWarnings],
     unsupported_artifacts: verification.unsupported_artifacts
   };
 }
@@ -41140,6 +41769,26 @@ ${policyErr.message}
         }
         throw policyErr;
       }
+      const includeDidWebFlag = flagValue(argv, "--include-did-web");
+      const includeDidWebDisabled = includeDidWebFlag === "false";
+      const didWebIdentifier = flagValue(argv, "--did-web");
+      const didWebAuthorityHost = flagValue(argv, "--did-web-authority-host");
+      const didWebPublishedAt = flagValue(argv, "--did-web-published-at");
+      let exportDidWeb;
+      if (!includeDidWebDisabled && didWebIdentifier !== void 0) {
+        if (didWebAuthorityHost === void 0) {
+          write(
+            err,
+            "Error: --did-web requires --did-web-authority-host=<host>\n"
+          );
+          return 2;
+        }
+        exportDidWeb = {
+          identifier: didWebIdentifier,
+          authority_host: didWebAuthorityHost,
+          ...didWebPublishedAt !== void 0 ? { published_at: didWebPublishedAt } : {}
+        };
+      }
       const result = await exportExitBundle({
         bundleDir: outDir,
         storage: ctx.storage,
@@ -41151,7 +41800,8 @@ ${policyErr.message}
         config,
         stateStoragePath: ctx.stateStoragePath,
         stateNamespaces: repeatedFlagValues(argv, "--state-namespace"),
-        keySource: ctx.keySource
+        keySource: ctx.keySource,
+        ...exportDidWeb !== void 0 ? { didWeb: exportDidWeb } : {}
       });
       if (json) write(out, JSON.stringify(result, null, 2) + "\n");
       else {
@@ -41229,6 +41879,11 @@ ${policyErr.message}
         write(err, "--conflict must be skip, overwrite, or version\n");
         return 2;
       }
+      const didWebAllowedHosts = repeatedFlagValues(
+        argv,
+        "--did-web-allowed-host"
+      );
+      const skipDidWebVerify = hasFlag(argv, "--skip-did-web-verify");
       let result;
       try {
         result = await importExitBundle({
@@ -41244,7 +41899,9 @@ ${policyErr.message}
           conflictResolution: conflict,
           sourcePassphrase: flagValue(argv, "--source-passphrase"),
           sourceRecoveryKey: flagValue(argv, "--source-recovery-key"),
-          destinationSignerIdentityId: flagValue(argv, "--destination-identity-id")
+          destinationSignerIdentityId: flagValue(argv, "--destination-identity-id"),
+          ...didWebAllowedHosts.length > 0 ? { didWebAllowedHosts } : {},
+          skipDidWebVerify
         });
       } catch (e) {
         if (e instanceof InvalidExitBundleError) {
@@ -41981,12 +42638,14 @@ ${err.message}
     fortressId: fortressIdForAggregator
   });
   const handoffEventBridge = new HandoffEventBridge();
+  const workflowStateTracker = new WorkflowStateTracker();
   if (dashboard) {
     dashboard.setHandoffLog({
       handoffLog,
       eventBridge: handoffEventBridge,
       auditLog,
-      operatorId: aggregatorIdentityId
+      operatorId: aggregatorIdentityId,
+      workflowStateTracker
     });
   }
   const policyTools = createPrincipalPolicyTools(policy, baseline, auditLog);