agent-passport-system 4.1.0 → 4.2.0

package/dist/src/profiles/mcp/authorization-v1.js

@@ -0,0 +1,215 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { createHash } from 'node:crypto';
+import { canonicalizeJCS } from '../../core/canonical-jcs.js';
+import { sign, verify } from '../../crypto/keys.js';
+import { computeActionRefV2, createActionReferenceInputV2, } from '../../v2/action-reference/v2.js';
+import { assertExactKeys, assertHex, assertIJson, assertPlainRecord, assertSortedUnique, assertUtcMilliseconds, sortedUnique, } from '../../v2/identity-binding/validation.js';
+export const APS_MCP_AUTHORIZATION_META = 'org.agent-passport/authorization';
+export const APS_MCP_RECEIPT_META = 'org.agent-passport/receipt';
+const INTENT_DOMAIN = 'APS-MCP-INTENT-V1\0';
+const ARGUMENTS_DOMAIN = 'APS-MCP-ARGUMENTS-V1\0';
+export class ApsMcpAuthorizationError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = 'ApsMcpAuthorizationError';
+    }
+}
+export function computeMcpArgumentsHashV1(argumentsValue) {
+    assertIJson(argumentsValue);
+    return createHash('sha256')
+        .update(ARGUMENTS_DOMAIN + canonicalizeJCS(argumentsValue), 'utf8')
+        .digest('hex');
+}
+export function issueApsMcpAuthorizationV1(input) {
+    const server = canonicalMcpServerUri(input.mcp_server);
+    const argumentsHash = computeMcpArgumentsHashV1(input.arguments);
+    const scopes = sortedUnique(input.scope_required.map((scope) => scope.normalize('NFC')), 'scope_required');
+    const actionRef = computeActionRefV2(createActionReferenceInputV2({
+        agent_id: input.agent_id,
+        action_type: 'mcp:tools/call',
+        target: `${server}#tool=${encodeURIComponent(input.tool_name)}`,
+        payload_ref: argumentsHash,
+        scope_required: scopes,
+        issued_at: input.issued_at,
+        nonce: input.nonce,
+    }));
+    const unsigned = {
+        profile: 'aps-mcp-1',
+        agent_id: input.agent_id,
+        verification_method: input.verification_method,
+        delegation_ref: input.delegation_ref,
+        mcp_server: server,
+        method: 'tools/call',
+        tool_name: input.tool_name,
+        arguments_hash: argumentsHash,
+        scope_required: scopes,
+        ...(input.spend === undefined ? {} : { spend: input.spend }),
+        nonce: input.nonce,
+        issued_at: input.issued_at,
+        expires_at: input.expires_at,
+        action_ref: actionRef,
+    };
+    validateAuthorizationUnsigned(unsigned);
+    return {
+        ...unsigned,
+        signature: sign(INTENT_DOMAIN + canonicalizeJCS(unsigned), input.private_key_hex),
+    };
+}
+export async function verifyApsMcpAuthorizationV1(candidate, expected) {
+    let authorization;
+    try {
+        authorization = validateAuthorization(candidate);
+    }
+    catch {
+        return { state: 'invalid', code: 'MCP_AUTHORIZATION_MALFORMED' };
+    }
+    const expectedServer = canonicalMcpServerUri(expected.mcp_server);
+    if (authorization.mcp_server !== expectedServer || authorization.tool_name !== expected.tool_name) {
+        return { state: 'invalid', code: 'MCP_TARGET_MISMATCH' };
+    }
+    const argumentsHash = computeMcpArgumentsHashV1(expected.arguments);
+    if (argumentsHash !== authorization.arguments_hash) {
+        return { state: 'invalid', code: 'MCP_ARGUMENTS_MISMATCH' };
+    }
+    const recomputedActionRef = computeActionRefV2(createActionReferenceInputV2({
+        agent_id: authorization.agent_id,
+        action_type: 'mcp:tools/call',
+        target: `${authorization.mcp_server}#tool=${encodeURIComponent(authorization.tool_name)}`,
+        payload_ref: authorization.arguments_hash,
+        scope_required: authorization.scope_required,
+        issued_at: authorization.issued_at,
+        nonce: authorization.nonce,
+    }));
+    if (recomputedActionRef !== authorization.action_ref) {
+        return { state: 'invalid', code: 'MCP_ACTION_REF_MISMATCH' };
+    }
+    const now = expected.now ?? new Date().toISOString();
+    if (now < authorization.issued_at || now >= authorization.expires_at) {
+        return { state: 'invalid', code: 'MCP_AUTHORIZATION_NOT_CURRENT' };
+    }
+    const resolution = await expected.resolve_key({
+        controller: authorization.agent_id,
+        verification_method: authorization.verification_method,
+        at: authorization.issued_at,
+    });
+    if (resolution.state !== 'resolved' || !resolution.public_key_hex) {
+        return {
+            state: resolution.state === 'unreachable' ? 'indeterminate' : 'invalid',
+            code: `MCP_SIGNING_KEY_${resolution.state.toUpperCase()}`,
+        };
+    }
+    const unsigned = omit(authorization, ['signature']);
+    if (!verify(INTENT_DOMAIN + canonicalizeJCS(unsigned), authorization.signature, resolution.public_key_hex)) {
+        return { state: 'invalid', code: 'MCP_SIGNATURE_INVALID' };
+    }
+    return { state: 'valid', code: 'OK', authorization };
+}
+/**
+ * Creates an unavoidable pre-dispatch guard for an MCP tools/call handler.
+ * Transport OAuth is checked first. The APS intent, replay claim, authority
+ * decision, and budget reservation all complete before dispatch is invoked.
+ */
+export function createApsMcpToolCallMiddleware(options) {
+    return async function apsMcpToolCall(request, context, dispatch) {
+        if (!context.transport_authenticated)
+            throw new ApsMcpAuthorizationError('MCP_TRANSPORT_UNAUTHENTICATED');
+        if (request.method !== 'tools/call')
+            throw new ApsMcpAuthorizationError('MCP_METHOD_UNSUPPORTED');
+        const metadata = request.params._meta;
+        const candidate = metadata?.[APS_MCP_AUTHORIZATION_META];
+        const verification = await verifyApsMcpAuthorizationV1(candidate, {
+            mcp_server: options.mcp_server,
+            tool_name: request.params.name,
+            arguments: request.params.arguments ?? {},
+            resolve_key: options.resolve_key,
+        });
+        if (verification.state !== 'valid' || !verification.authorization) {
+            throw new ApsMcpAuthorizationError(verification.code);
+        }
+        if (!await options.consume_action_ref(verification.authorization.action_ref, verification.authorization.expires_at))
+            throw new ApsMcpAuthorizationError('MCP_ACTION_REPLAY');
+        const authority = await options.evaluate_authority(verification.authorization, request);
+        if (authority.state !== 'permit')
+            throw new ApsMcpAuthorizationError(authority.code);
+        const dispatched = await dispatch(request);
+        const receipt = await options.emit_receipt(verification.authorization, authority, dispatched);
+        return {
+            ...dispatched,
+            _meta: {
+                ...(dispatched._meta ?? {}),
+                [APS_MCP_RECEIPT_META]: receipt,
+            },
+        };
+    };
+}
+export function canonicalMcpServerUri(value) {
+    const parsed = new URL(value);
+    if (!['https:', 'http:'].includes(parsed.protocol) || parsed.username || parsed.password || parsed.hash) {
+        throw new Error('Invalid MCP server resource URI');
+    }
+    if (parsed.protocol === 'http:' && !['localhost', '127.0.0.1', '[::1]'].includes(parsed.hostname)) {
+        throw new Error('MCP server resource URI requires HTTPS outside localhost');
+    }
+    if (parsed.pathname === '/' && !parsed.search)
+        parsed.pathname = '';
+    return parsed.toString().replace(/\/$/, '');
+}
+function validateAuthorization(candidate) {
+    assertPlainRecord(candidate, 'MCP authorization');
+    assertExactKeys(candidate, [
+        'profile', 'agent_id', 'verification_method', 'delegation_ref', 'mcp_server',
+        'method', 'tool_name', 'arguments_hash', 'scope_required', 'nonce',
+        'issued_at', 'expires_at', 'action_ref', 'signature',
+    ], ['spend'], 'MCP authorization');
+    const unsigned = omit(candidate, ['signature']);
+    validateAuthorizationUnsigned(unsigned);
+    assertHex(String(candidate.signature), 128, 'signature');
+    return candidate;
+}
+function validateAuthorizationUnsigned(value) {
+    assertIJson(value);
+    if (value.profile !== 'aps-mcp-1' || value.method !== 'tools/call')
+        throw new Error('MCP profile');
+    if (!/^did:[a-z0-9]+:.+$/.test(value.agent_id))
+        throw new Error('agent_id');
+    if (!value.verification_method.startsWith(`${value.agent_id}#`))
+        throw new Error('verification_method');
+    if (typeof value.delegation_ref !== 'string' || value.delegation_ref.length === 0)
+        throw new Error('delegation_ref');
+    if (canonicalMcpServerUri(value.mcp_server) !== value.mcp_server)
+        throw new Error('non-canonical mcp_server');
+    if (!/^[A-Za-z0-9_.-]{1,128}$/.test(value.tool_name))
+        throw new Error('tool_name');
+    assertHex(value.arguments_hash, 64, 'arguments_hash');
+    if (!Array.isArray(value.scope_required))
+        throw new Error('scope_required');
+    assertSortedUnique(value.scope_required, 'scope_required');
+    for (const scope of value.scope_required)
+        if (scope !== scope.normalize('NFC'))
+            throw new Error('scope_required NFC');
+    if (value.spend !== undefined) {
+        assertPlainRecord(value.spend, 'spend');
+        assertExactKeys(value.spend, ['unit', 'amount'], [], 'spend');
+        if (!/^[A-Za-z0-9:._-]{1,64}$/.test(value.spend.unit))
+            throw new Error('spend unit');
+        if (!/^(0|[1-9]\d{0,18})$/.test(value.spend.amount))
+            throw new Error('spend amount');
+    }
+    assertHex(value.nonce, 32, 'nonce');
+    assertUtcMilliseconds(value.issued_at, 'issued_at');
+    assertUtcMilliseconds(value.expires_at, 'expires_at');
+    if (value.issued_at >= value.expires_at)
+        throw new Error('authorization time window');
+    assertHex(value.action_ref, 64, 'action_ref');
+}
+function omit(value, keys) {
+    const result = {};
+    for (const [key, entry] of Object.entries(value))
+        if (!keys.includes(key))
+            result[key] = entry;
+    return result;
+}
+//# sourceMappingURL=authorization-v1.js.map

package/dist/src/profiles/mcp/authorization-v1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-v1.js","sourceRoot":"","sources":["../../../../src/profiles/mcp/authorization-v1.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EACL,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,iCAAiC,CAAA;AAExC,OAAO,EACL,eAAe,EACf,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,YAAY,GACb,MAAM,yCAAyC,CAAA;AAEhD,MAAM,CAAC,MAAM,0BAA0B,GAAG,kCAAkC,CAAA;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,4BAA4B,CAAA;AAChE,MAAM,aAAa,GAAG,qBAAqB,CAAA;AAC3C,MAAM,gBAAgB,GAAG,wBAAwB,CAAA;AAiDjD,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAC5B,IAAI;IAAzB,YAAqB,IAAY;QAC/B,KAAK,CAAC,IAAI,CAAC,CAAA;oBADQ,IAAI;QAEvB,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAED,MAAM,UAAU,yBAAyB,CAAC,cAAuC;IAC/E,WAAW,CAAC,cAAc,CAAC,CAAA;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,gBAAgB,GAAG,eAAe,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;SAClE,MAAM,CAAC,KAAK,CAAC,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAa1C;IACC,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IACtD,MAAM,aAAa,GAAG,yBAAyB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAChE,MAAM,MAAM,GAAG,YAAY,CACzB,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAC3D,gBAAgB,CACjB,CAAA;IACD,MAAM,SAAS,GAAG,kBAAkB,CAAC,4BAA4B,CAAC;QAChE,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,gBAAgB;QAC7B,MAAM,EAAE,GAAG,MAAM,SAAS,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE;QAC/D,WAAW,EAAE,aAAa;QAC1B,cAAc,EAAE,MAAM;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC,CAAA;IACH,MAAM,QAAQ,GAA6C;QACzD,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,UAAU,EAAE,MAAM;QAClB,MAAM,EAAE,YAAY;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,aAAa;QAC7B,cAAc,EAAE,MAAM;QACtB,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5D,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,SAAS;KACtB,CAAA;IACD,6BAA6B,CAAC,QAAQ,CAAC,CAAA;IACvC,OAAO;QACL,GAAG,QAAQ;QACX,SAAS,EAAE,IAAI,CAAC,aAAa,GAAG,eAAe,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC;KAClF,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,SAAkB,EAClB,QAMC;IAED,IAAI,aAAoC,CAAA;IACxC,IAAI,CAAC;QACH,aAAa,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAA;IAClE,CAAC;IACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;IACjE,IAAI,aAAa,CAAC,UAAU,KAAK,cAAc,IAAI,aAAa,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;QAClG,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAA;IAC1D,CAAC;IACD,MAAM,aAAa,GAAG,yBAAyB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IACnE,IAAI,aAAa,KAAK,aAAa,CAAC,cAAc,EAAE,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAA;IAC7D,CAAC;IACD,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,4BAA4B,CAAC;QAC1E,QAAQ,EAAE,aAAa,CAAC,QAAQ;QAChC,WAAW,EAAE,gBAAgB;QAC7B,MAAM,EAAE,GAAG,aAAa,CAAC,UAAU,SAAS,kBAAkB,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE;QACzF,WAAW,EAAE,aAAa,CAAC,cAAc;QACzC,cAAc,EAAE,aAAa,CAAC,cAAc;QAC5C,SAAS,EAAE,aAAa,CAAC,SAAS;QAClC,KAAK,EAAE,aAAa,CAAC,KAAK;KAC3B,CAAC,CAAC,CAAA;IACH,IAAI,mBAAmB,KAAK,aAAa,CAAC,UAAU,EAAE,CAAC;QACrD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAA;IAC9D,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACpD,IAAI,GAAG,GAAG,aAAa,CAAC,SAAS,IAAI,GAAG,IAAI,aAAa,CAAC,UAAU,EAAE,CAAC;QACrE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAA;IACpE,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC;QAC5C,UAAU,EAAE,aAAa,CAAC,QAAQ;QAClC,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;QACtD,EAAE,EAAE,aAAa,CAAC,SAAS;KAC5B,CAAC,CAAA;IACF,IAAI,UAAU,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;QAClE,OAAO;YACL,KAAK,EAAE,UAAU,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;YACvE,IAAI,EAAE,mBAAmB,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE;SAC1D,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;IACnD,IAAI,CAAC,MAAM,CAAC,aAAa,GAAG,eAAe,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC3G,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAA;IAC5D,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAAC,OAa9C;IACC,OAAO,KAAK,UAAU,cAAc,CAClC,OAA2B,EAC3B,OAAgC,EAChC,QAAyF;QAEzF,IAAI,CAAC,OAAO,CAAC,uBAAuB;YAAE,MAAM,IAAI,wBAAwB,CAAC,+BAA+B,CAAC,CAAA;QACzG,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY;YAAE,MAAM,IAAI,wBAAwB,CAAC,wBAAwB,CAAC,CAAA;QACjG,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAA;QACrC,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC,0BAA0B,CAAC,CAAA;QACxD,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC,SAAS,EAAE;YAChE,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI;YAC9B,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE;YACzC,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAA;QACF,IAAI,YAAY,CAAC,KAAK,KAAK,OAAO,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC;YAClE,MAAM,IAAI,wBAAwB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;QACvD,CAAC;QACD,IAAI,CAAC,MAAM,OAAO,CAAC,kBAAkB,CACnC,YAAY,CAAC,aAAa,CAAC,UAAU,EACrC,YAAY,CAAC,aAAa,CAAC,UAAU,CACtC;YAAE,MAAM,IAAI,wBAAwB,CAAC,mBAAmB,CAAC,CAAA;QAE1D,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;QACvF,IAAI,SAAS,CAAC,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,wBAAwB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAEpF,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;QAC1C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,aAAa,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;QAC7F,OAAO;YACL,GAAG,UAAU;YACb,KAAK,EAAE;gBACL,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3B,CAAC,oBAAoB,CAAC,EAAE,OAAO;aAChC;SACF,CAAA;IACH,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IAC7B,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACpD,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClG,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC7E,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAA;IACnE,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAC7C,CAAC;AAED,SAAS,qBAAqB,CAAC,SAAkB;IAC/C,iBAAiB,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAA;IACjD,eAAe,CAAC,SAAS,EAAE;QACzB,SAAS,EAAE,UAAU,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,YAAY;QAC5E,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,OAAO;QAClE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW;KACrD,EAAE,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC,CAAA;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,CAAwD,CAAA;IACtG,6BAA6B,CAAC,QAAQ,CAAC,CAAA;IACvC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;IACxD,OAAO,SAA6C,CAAA;AACtD,CAAC;AAED,SAAS,6BAA6B,CAAC,KAA+C;IACpF,WAAW,CAAC,KAAK,CAAC,CAAA;IAClB,IAAI,KAAK,CAAC,OAAO,KAAK,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAA;IAClG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAA;IAC3E,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,QAAQ,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IACvG,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAA;IACpH,IAAI,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,KAAK,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;IAC7G,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAA;IAClF,SAAS,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,EAAE,gBAAgB,CAAC,CAAA;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAA;IAC3E,kBAAkB,CAAC,KAAK,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAA;IAC1D,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,cAAc;QAAE,IAAI,KAAK,KAAK,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;IACrH,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QACvC,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;QAC7D,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAA;QACpF,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAA;IACtF,CAAC;IACD,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;IACnC,qBAAqB,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IACnD,qBAAqB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;IACrD,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;IACrF,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,YAAY,CAAC,CAAA;AAC/C,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,IAAuB;IAClD,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAC9F,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/src/profiles/mcp/index.d.ts

@@ -0,0 +1,2 @@
+export * from './authorization-v1.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/profiles/mcp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/profiles/mcp/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAA"}

package/dist/src/profiles/mcp/index.js

@@ -0,0 +1,2 @@
+export * from './authorization-v1.js';
+//# sourceMappingURL=index.js.map

package/dist/src/profiles/mcp/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/profiles/mcp/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAA"}

package/dist/src/v2/action-reference/index.d.ts

@@ -0,0 +1,2 @@
+export * from './v2.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/v2/action-reference/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/v2/action-reference/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAA"}

package/dist/src/v2/action-reference/index.js

@@ -0,0 +1,2 @@
+export * from './v2.js';
+//# sourceMappingURL=index.js.map

package/dist/src/v2/action-reference/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/v2/action-reference/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAA"}

package/dist/src/v2/action-reference/v2.d.ts

@@ -0,0 +1,23 @@
+export interface ActionReferenceInputV2 {
+    profile: 'aps-action-ref-v2';
+    agent_id: string;
+    action_type: string;
+    target: string;
+    payload_ref: string;
+    scope_required: string[];
+    issued_at: string;
+    nonce: string;
+}
+export declare function createActionReferenceInputV2(input: {
+    agent_id: string;
+    action_type: string;
+    target: string;
+    payload_ref: string;
+    scope_required: readonly string[];
+    issued_at: string;
+    nonce: string;
+}): ActionReferenceInputV2;
+export declare function computeActionRefV2(input: ActionReferenceInputV2): string;
+export declare function computePayloadRefV1(payload: unknown): string;
+export declare function validateActionReferenceInputV2(candidate: unknown): asserts candidate is ActionReferenceInputV2;
+//# sourceMappingURL=v2.d.ts.map

package/dist/src/v2/action-reference/v2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"v2.d.ts","sourceRoot":"","sources":["../../../../src/v2/action-reference/v2.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,mBAAmB,CAAA;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,sBAAsB,CAgBzB;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,sBAAsB,GAAG,MAAM,CAGxE;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAK5D;AAED,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,sBAAsB,CAmB9G"}

package/dist/src/v2/action-reference/v2.js

@@ -0,0 +1,57 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { createHash } from 'node:crypto';
+import { canonicalizeJCS } from '../../core/canonical-jcs.js';
+import { assertExactKeys, assertHex, assertIJson, assertPlainRecord, assertSortedUnique, assertUtcMilliseconds, sortedUnique, } from '../identity-binding/validation.js';
+const DOMAIN = 'APS-ACTION-REF-V2\0';
+export function createActionReferenceInputV2(input) {
+    const value = {
+        profile: 'aps-action-ref-v2',
+        agent_id: input.agent_id,
+        action_type: input.action_type,
+        target: input.target,
+        payload_ref: input.payload_ref,
+        scope_required: sortedUnique(input.scope_required.map((scope) => scope.normalize('NFC')), 'scope_required'),
+        issued_at: input.issued_at,
+        nonce: input.nonce,
+    };
+    validateActionReferenceInputV2(value);
+    return value;
+}
+export function computeActionRefV2(input) {
+    validateActionReferenceInputV2(input);
+    return createHash('sha256').update(DOMAIN + canonicalizeJCS(input), 'utf8').digest('hex');
+}
+export function computePayloadRefV1(payload) {
+    assertIJson(payload);
+    return createHash('sha256')
+        .update('APS-ACTION-PAYLOAD-V1\0' + canonicalizeJCS(payload), 'utf8')
+        .digest('hex');
+}
+export function validateActionReferenceInputV2(candidate) {
+    assertPlainRecord(candidate, 'action reference');
+    assertExactKeys(candidate, [
+        'profile', 'agent_id', 'action_type', 'target', 'payload_ref',
+        'scope_required', 'issued_at', 'nonce',
+    ], [], 'action reference');
+    assertIJson(candidate);
+    if (candidate.profile !== 'aps-action-ref-v2')
+        throw new Error('action reference profile');
+    if (typeof candidate.agent_id !== 'string' || candidate.agent_id.length === 0)
+        throw new Error('agent_id');
+    if (typeof candidate.action_type !== 'string' || candidate.action_type.length === 0)
+        throw new Error('action_type');
+    if (typeof candidate.target !== 'string' || candidate.target.length === 0)
+        throw new Error('target');
+    assertHex(String(candidate.payload_ref), 64, 'payload_ref');
+    if (!Array.isArray(candidate.scope_required))
+        throw new Error('scope_required');
+    assertSortedUnique(candidate.scope_required, 'scope_required');
+    for (const scope of candidate.scope_required) {
+        if (scope !== scope.normalize('NFC'))
+            throw new Error('scope_required: non-NFC value');
+    }
+    assertUtcMilliseconds(String(candidate.issued_at), 'issued_at');
+    assertHex(String(candidate.nonce), 32, 'nonce');
+}
+//# sourceMappingURL=v2.js.map

package/dist/src/v2/action-reference/v2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v2.js","sourceRoot":"","sources":["../../../../src/v2/action-reference/v2.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EACL,eAAe,EACf,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,YAAY,GACb,MAAM,mCAAmC,CAAA;AAE1C,MAAM,MAAM,GAAG,qBAAqB,CAAA;AAapC,MAAM,UAAU,4BAA4B,CAAC,KAQ5C;IACC,MAAM,KAAK,GAA2B;QACpC,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,cAAc,EAAE,YAAY,CAC1B,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAC3D,gBAAgB,CACjB;QACD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAA;IACD,8BAA8B,CAAC,KAAK,CAAC,CAAA;IACrC,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAA6B;IAC9D,8BAA8B,CAAC,KAAK,CAAC,CAAA;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC3F,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,WAAW,CAAC,OAAO,CAAC,CAAA;IACpB,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,yBAAyB,GAAG,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;SACpE,MAAM,CAAC,KAAK,CAAC,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,SAAkB;IAC/D,iBAAiB,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAA;IAChD,eAAe,CAAC,SAAS,EAAE;QACzB,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa;QAC7D,gBAAgB,EAAE,WAAW,EAAE,OAAO;KACvC,EAAE,EAAE,EAAE,kBAAkB,CAAC,CAAA;IAC1B,WAAW,CAAC,SAAS,CAAC,CAAA;IACtB,IAAI,SAAS,CAAC,OAAO,KAAK,mBAAmB;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;IAC1F,IAAI,OAAO,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAA;IAC1G,IAAI,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ,IAAI,SAAS,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAA;IACnH,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAA;IACpG,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,aAAa,CAAC,CAAA;IAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,cAAc,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAA;IAC/E,kBAAkB,CAAC,SAAS,CAAC,cAA0B,EAAE,gBAAgB,CAAC,CAAA;IAC1E,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,cAA0B,EAAE,CAAC;QACzD,IAAI,KAAK,KAAK,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IACxF,CAAC;IACD,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,CAAA;IAC/D,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;AACjD,CAAC"}

package/dist/src/v2/authority-delegation/budget.d.ts

@@ -0,0 +1,20 @@
+import type { AuthorityDelegationV1, BudgetOperationResult } from './types.js';
+/**
+ * Reference linearizable ledger for one JavaScript process. Each mutation is a
+ * single synchronous critical section. Distributed deployments must replace it
+ * with a store providing the same all-ancestors atomicity and idempotency.
+ */
+export declare class InMemoryAuthorityBudgetLedger {
+    private readonly counters;
+    private readonly reservations;
+    reserve(verifiedChain: readonly AuthorityDelegationV1[], actionRef: string, unit: string, amountString: string): BudgetOperationResult;
+    markDispatched(actionRef: string): BudgetOperationResult;
+    commit(actionRef: string): BudgetOperationResult;
+    /** Cancellation is allowed only before dispatch. */
+    cancel(actionRef: string): BudgetOperationResult;
+    counter(delegationId: string): {
+        reserved: string;
+        committed: string;
+    };
+}
+//# sourceMappingURL=budget.d.ts.map

package/dist/src/v2/authority-delegation/budget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"budget.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/budget.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,qBAAqB,EACrB,qBAAqB,EAEtB,MAAM,YAAY,CAAA;AAiBnB;;;;GAIG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IACtD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiC;IAE9D,OAAO,CACL,aAAa,EAAE,SAAS,qBAAqB,EAAE,EAC/C,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACnB,qBAAqB,CA+DvB;IAED,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,qBAAqB,CAOvD;IAED,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,qBAAqB,CAoB/C;IAED,oDAAoD;IACpD,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,qBAAqB,CAgB/C;IAED,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAGrE;CACF"}

package/dist/src/v2/authority-delegation/budget.js

@@ -0,0 +1,141 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { isCanonicalQuantity, validateAuthorityDelegationShape } from './schema.js';
+import { authorityDelegationBody, computeAuthorityDelegationId } from './canonical.js';
+const ACTION_REF = /^[0-9a-f]{64}$/;
+/**
+ * Reference linearizable ledger for one JavaScript process. Each mutation is a
+ * single synchronous critical section. Distributed deployments must replace it
+ * with a store providing the same all-ancestors atomicity and idempotency.
+ */
+export class InMemoryAuthorityBudgetLedger {
+    counters = new Map();
+    reservations = new Map();
+    reserve(verifiedChain, actionRef, unit, amountString) {
+        if (!ACTION_REF.test(actionRef) || !isCanonicalQuantity(amountString)) {
+            return { ok: false, code: 'CONFLICT' };
+        }
+        if (verifiedChain.length === 0 || verifiedChain.length > 256) {
+            return { ok: false, code: 'CONFLICT' };
+        }
+        const seen = new Set();
+        for (let i = 0; i < verifiedChain.length; i++) {
+            const current = verifiedChain[i];
+            if (validateAuthorityDelegationShape(current).length > 0 ||
+                computeAuthorityDelegationId(authorityDelegationBody(current)) !== current.delegation_id ||
+                seen.has(current.delegation_id)) {
+                return { ok: false, code: 'CONFLICT' };
+            }
+            seen.add(current.delegation_id);
+            if (i === 0) {
+                if (current.parent_delegation_id !== null)
+                    return { ok: false, code: 'CONFLICT' };
+            }
+            else {
+                const parent = verifiedChain[i - 1];
+                if (current.parent_delegation_id !== parent.delegation_id || current.issuer !== parent.subject) {
+                    return { ok: false, code: 'CONFLICT' };
+                }
+            }
+        }
+        const amount = BigInt(amountString);
+        const bounded = verifiedChain.filter(item => item.authority.spend.mode === 'bounded');
+        const ids = bounded.map(item => item.delegation_id);
+        const prior = this.reservations.get(actionRef);
+        if (prior) {
+            const identical = prior.unit === unit && prior.amount === amount &&
+                prior.delegationIds.length === ids.length &&
+                prior.delegationIds.every((id, index) => id === ids[index]);
+            return identical
+                ? { ok: true, code: 'IDEMPOTENT', state: prior.state }
+                : { ok: false, code: 'CONFLICT', state: prior.state };
+        }
+        for (const delegation of bounded) {
+            const spend = delegation.authority.spend;
+            if (spend.mode !== 'bounded')
+                continue;
+            if (spend.unit !== unit)
+                return { ok: false, code: 'UNIT_MISMATCH' };
+            if (amount > BigInt(spend.per_action))
+                return { ok: false, code: 'PER_ACTION_EXCEEDED' };
+            const counter = this.counters.get(delegation.delegation_id) ?? { reserved: 0n, committed: 0n };
+            if (counter.reserved + counter.committed + amount > BigInt(spend.cumulative)) {
+                return { ok: false, code: 'CUMULATIVE_EXCEEDED' };
+            }
+        }
+        // All checks completed before any counter is changed.
+        for (const delegation of bounded) {
+            const counter = this.counters.get(delegation.delegation_id) ?? { reserved: 0n, committed: 0n };
+            counter.reserved += amount;
+            this.counters.set(delegation.delegation_id, counter);
+        }
+        this.reservations.set(actionRef, {
+            actionRef,
+            unit,
+            amount,
+            delegationIds: ids,
+            state: 'reserved',
+        });
+        return { ok: true, code: 'RESERVED', state: 'reserved' };
+    }
+    markDispatched(actionRef) {
+        const reservation = this.reservations.get(actionRef);
+        if (!reservation)
+            return { ok: false, code: 'NOT_FOUND' };
+        if (reservation.state === 'dispatched')
+            return { ok: true, code: 'IDEMPOTENT', state: 'dispatched' };
+        if (reservation.state !== 'reserved')
+            return { ok: false, code: 'INVALID_STATE', state: reservation.state };
+        reservation.state = 'dispatched';
+        return { ok: true, code: 'DISPATCHED', state: 'dispatched' };
+    }
+    commit(actionRef) {
+        const reservation = this.reservations.get(actionRef);
+        if (!reservation)
+            return { ok: false, code: 'NOT_FOUND' };
+        if (reservation.state === 'committed')
+            return { ok: true, code: 'IDEMPOTENT', state: 'committed' };
+        if (reservation.state !== 'reserved' && reservation.state !== 'dispatched') {
+            return { ok: false, code: 'INVALID_STATE', state: reservation.state };
+        }
+        for (const id of reservation.delegationIds) {
+            const counter = this.counters.get(id);
+            if (!counter || counter.reserved < reservation.amount) {
+                return { ok: false, code: 'INVALID_STATE', state: reservation.state };
+            }
+        }
+        for (const id of reservation.delegationIds) {
+            const counter = this.counters.get(id);
+            counter.reserved -= reservation.amount;
+            counter.committed += reservation.amount;
+        }
+        reservation.state = 'committed';
+        return { ok: true, code: 'COMMITTED', state: 'committed' };
+    }
+    /** Cancellation is allowed only before dispatch. */
+    cancel(actionRef) {
+        const reservation = this.reservations.get(actionRef);
+        if (!reservation)
+            return { ok: false, code: 'NOT_FOUND' };
+        if (reservation.state === 'cancelled')
+            return { ok: true, code: 'IDEMPOTENT', state: 'cancelled' };
+        if (reservation.state !== 'reserved')
+            return { ok: false, code: 'INVALID_STATE', state: reservation.state };
+        for (const id of reservation.delegationIds) {
+            const counter = this.counters.get(id);
+            if (!counter || counter.reserved < reservation.amount) {
+                return { ok: false, code: 'INVALID_STATE', state: reservation.state };
+            }
+        }
+        for (const id of reservation.delegationIds) {
+            this.counters.get(id).reserved -= reservation.amount;
+        }
+        reservation.state = 'cancelled';
+        return { ok: true, code: 'CANCELLED', state: 'cancelled' };
+    }
+    counter(delegationId) {
+        const counter = this.counters.get(delegationId) ?? { reserved: 0n, committed: 0n };
+        return { reserved: counter.reserved.toString(), committed: counter.committed.toString() };
+    }
+}
+//# sourceMappingURL=budget.js.map

package/dist/src/v2/authority-delegation/budget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"budget.js","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/budget.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,mBAAmB,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAA;AACnF,OAAO,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAA;AAoBtF,MAAM,UAAU,GAAG,gBAAgB,CAAA;AAEnC;;;;GAIG;AACH,MAAM,OAAO,6BAA6B;IACvB,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAA;IACrC,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAA;IAE9D,OAAO,CACL,aAA+C,EAC/C,SAAiB,EACjB,IAAY,EACZ,YAAoB;QAEpB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,CAAC;YACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;QACxC,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;QACxC,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;YAChC,IAAI,gCAAgC,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;gBACpD,4BAA4B,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,KAAK,OAAO,CAAC,aAAa;gBACxF,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;gBACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;YACxC,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;YAC/B,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACZ,IAAI,OAAO,CAAC,oBAAoB,KAAK,IAAI;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;YACnF,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;gBACnC,IAAI,OAAO,CAAC,oBAAoB,KAAK,MAAM,CAAC,aAAa,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC/F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;gBACxC,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAA;QACnC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;QACrF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC9C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;gBAC9D,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;gBACzC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;YAC7D,OAAO,SAAS;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;gBACtD,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAA;QACzD,CAAC;QAED,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,KAAK,CAAA;YACxC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBAAE,SAAQ;YACtC,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAA;YACpE,IAAI,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAA;YACxF,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;YAC9F,IAAI,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAA;YACnD,CAAC;QACH,CAAC;QAED,sDAAsD;QACtD,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;YAC9F,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAA;YAC1B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;QACtD,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE;YAC/B,SAAS;YACT,IAAI;YACJ,MAAM;YACN,aAAa,EAAE,GAAG;YAClB,KAAK,EAAE,UAAU;SAClB,CAAC,CAAA;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,CAAA;IAC1D,CAAC;IAED,cAAc,CAAC,SAAiB;QAC9B,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACpD,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QACzD,IAAI,WAAW,CAAC,KAAK,KAAK,YAAY;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,CAAA;QACpG,IAAI,WAAW,CAAC,KAAK,KAAK,UAAU;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAA;QAC3G,WAAW,CAAC,KAAK,GAAG,YAAY,CAAA;QAChC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,CAAA;IAC9D,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACpD,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QACzD,IAAI,WAAW,CAAC,KAAK,KAAK,WAAW;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;QAClG,IAAI,WAAW,CAAC,KAAK,KAAK,UAAU,IAAI,WAAW,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAA;QACvE,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,aAAa,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACrC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC;gBACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAA;YACvE,CAAC;QACH,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,aAAa,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAE,CAAA;YACtC,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAC,MAAM,CAAA;YACtC,OAAO,CAAC,SAAS,IAAI,WAAW,CAAC,MAAM,CAAA;QACzC,CAAC;QACD,WAAW,CAAC,KAAK,GAAG,WAAW,CAAA;QAC/B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;IAC5D,CAAC;IAED,oDAAoD;IACpD,MAAM,CAAC,SAAiB;QACtB,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACpD,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QACzD,IAAI,WAAW,CAAC,KAAK,KAAK,WAAW;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;QAClG,IAAI,WAAW,CAAC,KAAK,KAAK,UAAU;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAA;QAC3G,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,aAAa,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACrC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC;gBACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAA;YACvE,CAAC;QACH,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,aAAa,EAAE,CAAC;YAC3C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,QAAQ,IAAI,WAAW,CAAC,MAAM,CAAA;QACvD,CAAC;QACD,WAAW,CAAC,KAAK,GAAG,WAAW,CAAA;QAC/B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;IAC5D,CAAC;IAED,OAAO,CAAC,YAAoB;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;QAClF,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAA;IAC3F,CAAC;CACF"}

package/dist/src/v2/authority-delegation/canonical.d.ts

@@ -0,0 +1,12 @@
+import type { AuthorityDelegationBodyV1, AuthorityDelegationV1 } from './types.js';
+export declare const AUTHORITY_DELEGATION_ID_DOMAIN = "APS-AUTHORITY-DELEGATION-ID-V1\0";
+export declare const AUTHORITY_DELEGATION_SIGNATURE_DOMAIN = "APS-AUTHORITY-DELEGATION-SIGNATURE-V1\0";
+/** Exact RFC 8785 input used to derive delegation_id. */
+export declare function authorityDelegationIdInput(body: AuthorityDelegationBodyV1): string;
+export declare function computeAuthorityDelegationId(body: AuthorityDelegationBodyV1): string;
+/** Exact Ed25519 input: domain plus JCS(record without signature). */
+export declare function authorityDelegationSignatureInput(delegation: Omit<AuthorityDelegationV1, 'signature'>): string;
+export declare function signAuthorityDelegation(delegation: Omit<AuthorityDelegationV1, 'signature'>, privateKey: string): string;
+export declare function verifyAuthorityDelegationSignature(delegation: AuthorityDelegationV1, publicKey: string): boolean;
+export declare function authorityDelegationBody(delegation: AuthorityDelegationV1): AuthorityDelegationBodyV1;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/src/v2/authority-delegation/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/canonical.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAElF,eAAO,MAAM,8BAA8B,qCAAqC,CAAA;AAChF,eAAO,MAAM,qCAAqC,4CAA4C,CAAA;AAM9F,yDAAyD;AACzD,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,yBAAyB,GAAG,MAAM,CAElF;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,yBAAyB,GAAG,MAAM,CAEpF;AAED,sEAAsE;AACtE,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,IAAI,CAAC,qBAAqB,EAAE,WAAW,CAAC,GACnD,MAAM,CAER;AAED,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,IAAI,CAAC,qBAAqB,EAAE,WAAW,CAAC,EACpD,UAAU,EAAE,MAAM,GACjB,MAAM,CAER;AAED,wBAAgB,kCAAkC,CAChD,UAAU,EAAE,qBAAqB,EACjC,SAAS,EAAE,MAAM,GAChB,OAAO,CAGT;AAED,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,qBAAqB,GAChC,yBAAyB,CAG3B"}

package/dist/src/v2/authority-delegation/canonical.js

@@ -0,0 +1,33 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { createHash } from 'node:crypto';
+import { canonicalizeJCS } from '../../core/canonical-jcs.js';
+import { sign, verify } from '../../crypto/keys.js';
+export const AUTHORITY_DELEGATION_ID_DOMAIN = 'APS-AUTHORITY-DELEGATION-ID-V1\0';
+export const AUTHORITY_DELEGATION_SIGNATURE_DOMAIN = 'APS-AUTHORITY-DELEGATION-SIGNATURE-V1\0';
+function sha256Hex(value) {
+    return createHash('sha256').update(value, 'utf8').digest('hex');
+}
+/** Exact RFC 8785 input used to derive delegation_id. */
+export function authorityDelegationIdInput(body) {
+    return AUTHORITY_DELEGATION_ID_DOMAIN + canonicalizeJCS(body);
+}
+export function computeAuthorityDelegationId(body) {
+    return `sha256:${sha256Hex(authorityDelegationIdInput(body))}`;
+}
+/** Exact Ed25519 input: domain plus JCS(record without signature). */
+export function authorityDelegationSignatureInput(delegation) {
+    return AUTHORITY_DELEGATION_SIGNATURE_DOMAIN + canonicalizeJCS(delegation);
+}
+export function signAuthorityDelegation(delegation, privateKey) {
+    return sign(authorityDelegationSignatureInput(delegation), privateKey);
+}
+export function verifyAuthorityDelegationSignature(delegation, publicKey) {
+    const { signature, ...unsigned } = delegation;
+    return verify(authorityDelegationSignatureInput(unsigned), signature, publicKey);
+}
+export function authorityDelegationBody(delegation) {
+    const { delegation_id: _delegationId, signature: _signature, ...body } = delegation;
+    return body;
+}
+//# sourceMappingURL=canonical.js.map

package/dist/src/v2/authority-delegation/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/canonical.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAGnD,MAAM,CAAC,MAAM,8BAA8B,GAAG,kCAAkC,CAAA;AAChF,MAAM,CAAC,MAAM,qCAAqC,GAAG,yCAAyC,CAAA;AAE9F,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,0BAA0B,CAAC,IAA+B;IACxE,OAAO,8BAA8B,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;AAC/D,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,IAA+B;IAC1E,OAAO,UAAU,SAAS,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,EAAE,CAAA;AAChE,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,iCAAiC,CAC/C,UAAoD;IAEpD,OAAO,qCAAqC,GAAG,eAAe,CAAC,UAAU,CAAC,CAAA;AAC5E,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,UAAoD,EACpD,UAAkB;IAElB,OAAO,IAAI,CAAC,iCAAiC,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAA;AACxE,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,UAAiC,EACjC,SAAiB;IAEjB,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,UAAU,CAAA;IAC7C,OAAO,MAAM,CAAC,iCAAiC,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;AAClF,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,UAAiC;IAEjC,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAA;IACnF,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/src/v2/authority-delegation/compare.d.ts

@@ -0,0 +1,4 @@
+import type { AuthorityFailure, AuthorityVectorV1 } from './types.js';
+/** Compare a child against its immediate parent in the seven-facet partial order. */
+export declare function compareAuthority(parent: AuthorityVectorV1, child: AuthorityVectorV1): AuthorityFailure[];
+//# sourceMappingURL=compare.d.ts.map

package/dist/src/v2/authority-delegation/compare.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compare.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/compare.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAwB,MAAM,YAAY,CAAA;AAiB3F,qFAAqF;AACrF,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,iBAAiB,GACvB,gBAAgB,EAAE,CAsDpB"}