agent-passport-system 4.1.1 → 4.2.0

package/dist/src/v2/action-reference/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/v2/action-reference/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAA"}

package/dist/src/v2/action-reference/v2.d.ts

@@ -0,0 +1,23 @@
+export interface ActionReferenceInputV2 {
+    profile: 'aps-action-ref-v2';
+    agent_id: string;
+    action_type: string;
+    target: string;
+    payload_ref: string;
+    scope_required: string[];
+    issued_at: string;
+    nonce: string;
+}
+export declare function createActionReferenceInputV2(input: {
+    agent_id: string;
+    action_type: string;
+    target: string;
+    payload_ref: string;
+    scope_required: readonly string[];
+    issued_at: string;
+    nonce: string;
+}): ActionReferenceInputV2;
+export declare function computeActionRefV2(input: ActionReferenceInputV2): string;
+export declare function computePayloadRefV1(payload: unknown): string;
+export declare function validateActionReferenceInputV2(candidate: unknown): asserts candidate is ActionReferenceInputV2;
+//# sourceMappingURL=v2.d.ts.map

package/dist/src/v2/action-reference/v2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"v2.d.ts","sourceRoot":"","sources":["../../../../src/v2/action-reference/v2.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,mBAAmB,CAAA;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,sBAAsB,CAgBzB;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,sBAAsB,GAAG,MAAM,CAGxE;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAK5D;AAED,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,sBAAsB,CAmB9G"}

package/dist/src/v2/action-reference/v2.js

@@ -0,0 +1,57 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { createHash } from 'node:crypto';
+import { canonicalizeJCS } from '../../core/canonical-jcs.js';
+import { assertExactKeys, assertHex, assertIJson, assertPlainRecord, assertSortedUnique, assertUtcMilliseconds, sortedUnique, } from '../identity-binding/validation.js';
+const DOMAIN = 'APS-ACTION-REF-V2\0';
+export function createActionReferenceInputV2(input) {
+    const value = {
+        profile: 'aps-action-ref-v2',
+        agent_id: input.agent_id,
+        action_type: input.action_type,
+        target: input.target,
+        payload_ref: input.payload_ref,
+        scope_required: sortedUnique(input.scope_required.map((scope) => scope.normalize('NFC')), 'scope_required'),
+        issued_at: input.issued_at,
+        nonce: input.nonce,
+    };
+    validateActionReferenceInputV2(value);
+    return value;
+}
+export function computeActionRefV2(input) {
+    validateActionReferenceInputV2(input);
+    return createHash('sha256').update(DOMAIN + canonicalizeJCS(input), 'utf8').digest('hex');
+}
+export function computePayloadRefV1(payload) {
+    assertIJson(payload);
+    return createHash('sha256')
+        .update('APS-ACTION-PAYLOAD-V1\0' + canonicalizeJCS(payload), 'utf8')
+        .digest('hex');
+}
+export function validateActionReferenceInputV2(candidate) {
+    assertPlainRecord(candidate, 'action reference');
+    assertExactKeys(candidate, [
+        'profile', 'agent_id', 'action_type', 'target', 'payload_ref',
+        'scope_required', 'issued_at', 'nonce',
+    ], [], 'action reference');
+    assertIJson(candidate);
+    if (candidate.profile !== 'aps-action-ref-v2')
+        throw new Error('action reference profile');
+    if (typeof candidate.agent_id !== 'string' || candidate.agent_id.length === 0)
+        throw new Error('agent_id');
+    if (typeof candidate.action_type !== 'string' || candidate.action_type.length === 0)
+        throw new Error('action_type');
+    if (typeof candidate.target !== 'string' || candidate.target.length === 0)
+        throw new Error('target');
+    assertHex(String(candidate.payload_ref), 64, 'payload_ref');
+    if (!Array.isArray(candidate.scope_required))
+        throw new Error('scope_required');
+    assertSortedUnique(candidate.scope_required, 'scope_required');
+    for (const scope of candidate.scope_required) {
+        if (scope !== scope.normalize('NFC'))
+            throw new Error('scope_required: non-NFC value');
+    }
+    assertUtcMilliseconds(String(candidate.issued_at), 'issued_at');
+    assertHex(String(candidate.nonce), 32, 'nonce');
+}
+//# sourceMappingURL=v2.js.map

package/dist/src/v2/action-reference/v2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v2.js","sourceRoot":"","sources":["../../../../src/v2/action-reference/v2.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EACL,eAAe,EACf,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,YAAY,GACb,MAAM,mCAAmC,CAAA;AAE1C,MAAM,MAAM,GAAG,qBAAqB,CAAA;AAapC,MAAM,UAAU,4BAA4B,CAAC,KAQ5C;IACC,MAAM,KAAK,GAA2B;QACpC,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,cAAc,EAAE,YAAY,CAC1B,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAC3D,gBAAgB,CACjB;QACD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAA;IACD,8BAA8B,CAAC,KAAK,CAAC,CAAA;IACrC,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAA6B;IAC9D,8BAA8B,CAAC,KAAK,CAAC,CAAA;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC3F,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,WAAW,CAAC,OAAO,CAAC,CAAA;IACpB,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,yBAAyB,GAAG,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;SACpE,MAAM,CAAC,KAAK,CAAC,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,SAAkB;IAC/D,iBAAiB,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAA;IAChD,eAAe,CAAC,SAAS,EAAE;QACzB,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa;QAC7D,gBAAgB,EAAE,WAAW,EAAE,OAAO;KACvC,EAAE,EAAE,EAAE,kBAAkB,CAAC,CAAA;IAC1B,WAAW,CAAC,SAAS,CAAC,CAAA;IACtB,IAAI,SAAS,CAAC,OAAO,KAAK,mBAAmB;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;IAC1F,IAAI,OAAO,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAA;IAC1G,IAAI,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ,IAAI,SAAS,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAA;IACnH,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAA;IACpG,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,aAAa,CAAC,CAAA;IAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,cAAc,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAA;IAC/E,kBAAkB,CAAC,SAAS,CAAC,cAA0B,EAAE,gBAAgB,CAAC,CAAA;IAC1E,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,cAA0B,EAAE,CAAC;QACzD,IAAI,KAAK,KAAK,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IACxF,CAAC;IACD,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,CAAA;IAC/D,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;AACjD,CAAC"}

package/dist/src/v2/authority-delegation/budget.d.ts

@@ -0,0 +1,20 @@
+import type { AuthorityDelegationV1, BudgetOperationResult } from './types.js';
+/**
+ * Reference linearizable ledger for one JavaScript process. Each mutation is a
+ * single synchronous critical section. Distributed deployments must replace it
+ * with a store providing the same all-ancestors atomicity and idempotency.
+ */
+export declare class InMemoryAuthorityBudgetLedger {
+    private readonly counters;
+    private readonly reservations;
+    reserve(verifiedChain: readonly AuthorityDelegationV1[], actionRef: string, unit: string, amountString: string): BudgetOperationResult;
+    markDispatched(actionRef: string): BudgetOperationResult;
+    commit(actionRef: string): BudgetOperationResult;
+    /** Cancellation is allowed only before dispatch. */
+    cancel(actionRef: string): BudgetOperationResult;
+    counter(delegationId: string): {
+        reserved: string;
+        committed: string;
+    };
+}
+//# sourceMappingURL=budget.d.ts.map

package/dist/src/v2/authority-delegation/budget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"budget.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/budget.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,qBAAqB,EACrB,qBAAqB,EAEtB,MAAM,YAAY,CAAA;AAiBnB;;;;GAIG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IACtD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiC;IAE9D,OAAO,CACL,aAAa,EAAE,SAAS,qBAAqB,EAAE,EAC/C,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACnB,qBAAqB,CA+DvB;IAED,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,qBAAqB,CAOvD;IAED,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,qBAAqB,CAoB/C;IAED,oDAAoD;IACpD,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,qBAAqB,CAgB/C;IAED,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAGrE;CACF"}

package/dist/src/v2/authority-delegation/budget.js

@@ -0,0 +1,141 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { isCanonicalQuantity, validateAuthorityDelegationShape } from './schema.js';
+import { authorityDelegationBody, computeAuthorityDelegationId } from './canonical.js';
+const ACTION_REF = /^[0-9a-f]{64}$/;
+/**
+ * Reference linearizable ledger for one JavaScript process. Each mutation is a
+ * single synchronous critical section. Distributed deployments must replace it
+ * with a store providing the same all-ancestors atomicity and idempotency.
+ */
+export class InMemoryAuthorityBudgetLedger {
+    counters = new Map();
+    reservations = new Map();
+    reserve(verifiedChain, actionRef, unit, amountString) {
+        if (!ACTION_REF.test(actionRef) || !isCanonicalQuantity(amountString)) {
+            return { ok: false, code: 'CONFLICT' };
+        }
+        if (verifiedChain.length === 0 || verifiedChain.length > 256) {
+            return { ok: false, code: 'CONFLICT' };
+        }
+        const seen = new Set();
+        for (let i = 0; i < verifiedChain.length; i++) {
+            const current = verifiedChain[i];
+            if (validateAuthorityDelegationShape(current).length > 0 ||
+                computeAuthorityDelegationId(authorityDelegationBody(current)) !== current.delegation_id ||
+                seen.has(current.delegation_id)) {
+                return { ok: false, code: 'CONFLICT' };
+            }
+            seen.add(current.delegation_id);
+            if (i === 0) {
+                if (current.parent_delegation_id !== null)
+                    return { ok: false, code: 'CONFLICT' };
+            }
+            else {
+                const parent = verifiedChain[i - 1];
+                if (current.parent_delegation_id !== parent.delegation_id || current.issuer !== parent.subject) {
+                    return { ok: false, code: 'CONFLICT' };
+                }
+            }
+        }
+        const amount = BigInt(amountString);
+        const bounded = verifiedChain.filter(item => item.authority.spend.mode === 'bounded');
+        const ids = bounded.map(item => item.delegation_id);
+        const prior = this.reservations.get(actionRef);
+        if (prior) {
+            const identical = prior.unit === unit && prior.amount === amount &&
+                prior.delegationIds.length === ids.length &&
+                prior.delegationIds.every((id, index) => id === ids[index]);
+            return identical
+                ? { ok: true, code: 'IDEMPOTENT', state: prior.state }
+                : { ok: false, code: 'CONFLICT', state: prior.state };
+        }
+        for (const delegation of bounded) {
+            const spend = delegation.authority.spend;
+            if (spend.mode !== 'bounded')
+                continue;
+            if (spend.unit !== unit)
+                return { ok: false, code: 'UNIT_MISMATCH' };
+            if (amount > BigInt(spend.per_action))
+                return { ok: false, code: 'PER_ACTION_EXCEEDED' };
+            const counter = this.counters.get(delegation.delegation_id) ?? { reserved: 0n, committed: 0n };
+            if (counter.reserved + counter.committed + amount > BigInt(spend.cumulative)) {
+                return { ok: false, code: 'CUMULATIVE_EXCEEDED' };
+            }
+        }
+        // All checks completed before any counter is changed.
+        for (const delegation of bounded) {
+            const counter = this.counters.get(delegation.delegation_id) ?? { reserved: 0n, committed: 0n };
+            counter.reserved += amount;
+            this.counters.set(delegation.delegation_id, counter);
+        }
+        this.reservations.set(actionRef, {
+            actionRef,
+            unit,
+            amount,
+            delegationIds: ids,
+            state: 'reserved',
+        });
+        return { ok: true, code: 'RESERVED', state: 'reserved' };
+    }
+    markDispatched(actionRef) {
+        const reservation = this.reservations.get(actionRef);
+        if (!reservation)
+            return { ok: false, code: 'NOT_FOUND' };
+        if (reservation.state === 'dispatched')
+            return { ok: true, code: 'IDEMPOTENT', state: 'dispatched' };
+        if (reservation.state !== 'reserved')
+            return { ok: false, code: 'INVALID_STATE', state: reservation.state };
+        reservation.state = 'dispatched';
+        return { ok: true, code: 'DISPATCHED', state: 'dispatched' };
+    }
+    commit(actionRef) {
+        const reservation = this.reservations.get(actionRef);
+        if (!reservation)
+            return { ok: false, code: 'NOT_FOUND' };
+        if (reservation.state === 'committed')
+            return { ok: true, code: 'IDEMPOTENT', state: 'committed' };
+        if (reservation.state !== 'reserved' && reservation.state !== 'dispatched') {
+            return { ok: false, code: 'INVALID_STATE', state: reservation.state };
+        }
+        for (const id of reservation.delegationIds) {
+            const counter = this.counters.get(id);
+            if (!counter || counter.reserved < reservation.amount) {
+                return { ok: false, code: 'INVALID_STATE', state: reservation.state };
+            }
+        }
+        for (const id of reservation.delegationIds) {
+            const counter = this.counters.get(id);
+            counter.reserved -= reservation.amount;
+            counter.committed += reservation.amount;
+        }
+        reservation.state = 'committed';
+        return { ok: true, code: 'COMMITTED', state: 'committed' };
+    }
+    /** Cancellation is allowed only before dispatch. */
+    cancel(actionRef) {
+        const reservation = this.reservations.get(actionRef);
+        if (!reservation)
+            return { ok: false, code: 'NOT_FOUND' };
+        if (reservation.state === 'cancelled')
+            return { ok: true, code: 'IDEMPOTENT', state: 'cancelled' };
+        if (reservation.state !== 'reserved')
+            return { ok: false, code: 'INVALID_STATE', state: reservation.state };
+        for (const id of reservation.delegationIds) {
+            const counter = this.counters.get(id);
+            if (!counter || counter.reserved < reservation.amount) {
+                return { ok: false, code: 'INVALID_STATE', state: reservation.state };
+            }
+        }
+        for (const id of reservation.delegationIds) {
+            this.counters.get(id).reserved -= reservation.amount;
+        }
+        reservation.state = 'cancelled';
+        return { ok: true, code: 'CANCELLED', state: 'cancelled' };
+    }
+    counter(delegationId) {
+        const counter = this.counters.get(delegationId) ?? { reserved: 0n, committed: 0n };
+        return { reserved: counter.reserved.toString(), committed: counter.committed.toString() };
+    }
+}
+//# sourceMappingURL=budget.js.map

package/dist/src/v2/authority-delegation/budget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"budget.js","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/budget.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,mBAAmB,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAA;AACnF,OAAO,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAA;AAoBtF,MAAM,UAAU,GAAG,gBAAgB,CAAA;AAEnC;;;;GAIG;AACH,MAAM,OAAO,6BAA6B;IACvB,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAA;IACrC,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAA;IAE9D,OAAO,CACL,aAA+C,EAC/C,SAAiB,EACjB,IAAY,EACZ,YAAoB;QAEpB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,CAAC;YACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;QACxC,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;QACxC,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;YAChC,IAAI,gCAAgC,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;gBACpD,4BAA4B,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,KAAK,OAAO,CAAC,aAAa;gBACxF,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;gBACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;YACxC,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;YAC/B,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACZ,IAAI,OAAO,CAAC,oBAAoB,KAAK,IAAI;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;YACnF,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;gBACnC,IAAI,OAAO,CAAC,oBAAoB,KAAK,MAAM,CAAC,aAAa,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC/F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;gBACxC,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAA;QACnC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;QACrF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC9C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;gBAC9D,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;gBACzC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;YAC7D,OAAO,SAAS;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;gBACtD,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAA;QACzD,CAAC;QAED,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,KAAK,CAAA;YACxC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBAAE,SAAQ;YACtC,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAA;YACpE,IAAI,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAA;YACxF,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;YAC9F,IAAI,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAA;YACnD,CAAC;QACH,CAAC;QAED,sDAAsD;QACtD,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;YAC9F,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAA;YAC1B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;QACtD,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE;YAC/B,SAAS;YACT,IAAI;YACJ,MAAM;YACN,aAAa,EAAE,GAAG;YAClB,KAAK,EAAE,UAAU;SAClB,CAAC,CAAA;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,CAAA;IAC1D,CAAC;IAED,cAAc,CAAC,SAAiB;QAC9B,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACpD,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QACzD,IAAI,WAAW,CAAC,KAAK,KAAK,YAAY;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,CAAA;QACpG,IAAI,WAAW,CAAC,KAAK,KAAK,UAAU;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAA;QAC3G,WAAW,CAAC,KAAK,GAAG,YAAY,CAAA;QAChC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,CAAA;IAC9D,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACpD,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QACzD,IAAI,WAAW,CAAC,KAAK,KAAK,WAAW;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;QAClG,IAAI,WAAW,CAAC,KAAK,KAAK,UAAU,IAAI,WAAW,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAA;QACvE,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,aAAa,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACrC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC;gBACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAA;YACvE,CAAC;QACH,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,aAAa,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAE,CAAA;YACtC,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAC,MAAM,CAAA;YACtC,OAAO,CAAC,SAAS,IAAI,WAAW,CAAC,MAAM,CAAA;QACzC,CAAC;QACD,WAAW,CAAC,KAAK,GAAG,WAAW,CAAA;QAC/B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;IAC5D,CAAC;IAED,oDAAoD;IACpD,MAAM,CAAC,SAAiB;QACtB,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACpD,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QACzD,IAAI,WAAW,CAAC,KAAK,KAAK,WAAW;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;QAClG,IAAI,WAAW,CAAC,KAAK,KAAK,UAAU;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAA;QAC3G,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,aAAa,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACrC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC;gBACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAA;YACvE,CAAC;QACH,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,aAAa,EAAE,CAAC;YAC3C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,QAAQ,IAAI,WAAW,CAAC,MAAM,CAAA;QACvD,CAAC;QACD,WAAW,CAAC,KAAK,GAAG,WAAW,CAAA;QAC/B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;IAC5D,CAAC;IAED,OAAO,CAAC,YAAoB;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;QAClF,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAA;IAC3F,CAAC;CACF"}

package/dist/src/v2/authority-delegation/canonical.d.ts

@@ -0,0 +1,12 @@
+import type { AuthorityDelegationBodyV1, AuthorityDelegationV1 } from './types.js';
+export declare const AUTHORITY_DELEGATION_ID_DOMAIN = "APS-AUTHORITY-DELEGATION-ID-V1\0";
+export declare const AUTHORITY_DELEGATION_SIGNATURE_DOMAIN = "APS-AUTHORITY-DELEGATION-SIGNATURE-V1\0";
+/** Exact RFC 8785 input used to derive delegation_id. */
+export declare function authorityDelegationIdInput(body: AuthorityDelegationBodyV1): string;
+export declare function computeAuthorityDelegationId(body: AuthorityDelegationBodyV1): string;
+/** Exact Ed25519 input: domain plus JCS(record without signature). */
+export declare function authorityDelegationSignatureInput(delegation: Omit<AuthorityDelegationV1, 'signature'>): string;
+export declare function signAuthorityDelegation(delegation: Omit<AuthorityDelegationV1, 'signature'>, privateKey: string): string;
+export declare function verifyAuthorityDelegationSignature(delegation: AuthorityDelegationV1, publicKey: string): boolean;
+export declare function authorityDelegationBody(delegation: AuthorityDelegationV1): AuthorityDelegationBodyV1;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/src/v2/authority-delegation/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/canonical.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAElF,eAAO,MAAM,8BAA8B,qCAAqC,CAAA;AAChF,eAAO,MAAM,qCAAqC,4CAA4C,CAAA;AAM9F,yDAAyD;AACzD,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,yBAAyB,GAAG,MAAM,CAElF;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,yBAAyB,GAAG,MAAM,CAEpF;AAED,sEAAsE;AACtE,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,IAAI,CAAC,qBAAqB,EAAE,WAAW,CAAC,GACnD,MAAM,CAER;AAED,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,IAAI,CAAC,qBAAqB,EAAE,WAAW,CAAC,EACpD,UAAU,EAAE,MAAM,GACjB,MAAM,CAER;AAED,wBAAgB,kCAAkC,CAChD,UAAU,EAAE,qBAAqB,EACjC,SAAS,EAAE,MAAM,GAChB,OAAO,CAGT;AAED,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,qBAAqB,GAChC,yBAAyB,CAG3B"}

package/dist/src/v2/authority-delegation/canonical.js

@@ -0,0 +1,33 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { createHash } from 'node:crypto';
+import { canonicalizeJCS } from '../../core/canonical-jcs.js';
+import { sign, verify } from '../../crypto/keys.js';
+export const AUTHORITY_DELEGATION_ID_DOMAIN = 'APS-AUTHORITY-DELEGATION-ID-V1\0';
+export const AUTHORITY_DELEGATION_SIGNATURE_DOMAIN = 'APS-AUTHORITY-DELEGATION-SIGNATURE-V1\0';
+function sha256Hex(value) {
+    return createHash('sha256').update(value, 'utf8').digest('hex');
+}
+/** Exact RFC 8785 input used to derive delegation_id. */
+export function authorityDelegationIdInput(body) {
+    return AUTHORITY_DELEGATION_ID_DOMAIN + canonicalizeJCS(body);
+}
+export function computeAuthorityDelegationId(body) {
+    return `sha256:${sha256Hex(authorityDelegationIdInput(body))}`;
+}
+/** Exact Ed25519 input: domain plus JCS(record without signature). */
+export function authorityDelegationSignatureInput(delegation) {
+    return AUTHORITY_DELEGATION_SIGNATURE_DOMAIN + canonicalizeJCS(delegation);
+}
+export function signAuthorityDelegation(delegation, privateKey) {
+    return sign(authorityDelegationSignatureInput(delegation), privateKey);
+}
+export function verifyAuthorityDelegationSignature(delegation, publicKey) {
+    const { signature, ...unsigned } = delegation;
+    return verify(authorityDelegationSignatureInput(unsigned), signature, publicKey);
+}
+export function authorityDelegationBody(delegation) {
+    const { delegation_id: _delegationId, signature: _signature, ...body } = delegation;
+    return body;
+}
+//# sourceMappingURL=canonical.js.map

package/dist/src/v2/authority-delegation/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/canonical.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAGnD,MAAM,CAAC,MAAM,8BAA8B,GAAG,kCAAkC,CAAA;AAChF,MAAM,CAAC,MAAM,qCAAqC,GAAG,yCAAyC,CAAA;AAE9F,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,0BAA0B,CAAC,IAA+B;IACxE,OAAO,8BAA8B,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;AAC/D,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,IAA+B;IAC1E,OAAO,UAAU,SAAS,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,EAAE,CAAA;AAChE,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,iCAAiC,CAC/C,UAAoD;IAEpD,OAAO,qCAAqC,GAAG,eAAe,CAAC,UAAU,CAAC,CAAA;AAC5E,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,UAAoD,EACpD,UAAkB;IAElB,OAAO,IAAI,CAAC,iCAAiC,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAA;AACxE,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,UAAiC,EACjC,SAAiB;IAEjB,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,UAAU,CAAA;IAC7C,OAAO,MAAM,CAAC,iCAAiC,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;AAClF,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,UAAiC;IAEjC,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAA;IACnF,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/src/v2/authority-delegation/compare.d.ts

@@ -0,0 +1,4 @@
+import type { AuthorityFailure, AuthorityVectorV1 } from './types.js';
+/** Compare a child against its immediate parent in the seven-facet partial order. */
+export declare function compareAuthority(parent: AuthorityVectorV1, child: AuthorityVectorV1): AuthorityFailure[];
+//# sourceMappingURL=compare.d.ts.map

package/dist/src/v2/authority-delegation/compare.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compare.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/compare.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAwB,MAAM,YAAY,CAAA;AAiB3F,qFAAqF;AACrF,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,iBAAiB,GACvB,gBAAgB,EAAE,CAsDpB"}

package/dist/src/v2/authority-delegation/compare.js

@@ -0,0 +1,67 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { scopeNarrows } from './scope.js';
+const REVERSIBILITY_RANK = {
+    tentative: 0,
+    compensable: 1,
+    irreversible: 2,
+};
+function fail(failures, code, facet, message) {
+    failures.push({ code, facet, message });
+}
+/** Compare a child against its immediate parent in the seven-facet partial order. */
+export function compareAuthority(parent, child) {
+    const failures = [];
+    if (child.scope.profile !== parent.scope.profile) {
+        fail(failures, 'UNSUPPORTED_PROFILE', 'scope', 'scope profile changes are incomparable');
+    }
+    else if (!scopeNarrows(parent.scope.grants, child.scope.grants)) {
+        fail(failures, 'SCOPE_WIDENING', 'scope', 'child scope is not covered by parent scope');
+    }
+    if (parent.spend.mode === 'bounded') {
+        if (child.spend.mode === 'unbounded') {
+            fail(failures, 'SPEND_WIDENING', 'spend', 'bounded parent cannot produce unbounded child');
+        }
+        else if (child.spend.unit !== parent.spend.unit) {
+            fail(failures, 'SPEND_UNIT_CHANGE', 'spend', 'bounded spend unit must remain exact');
+        }
+        else if (BigInt(child.spend.per_action) > BigInt(parent.spend.per_action) ||
+            BigInt(child.spend.cumulative) > BigInt(parent.spend.cumulative)) {
+            fail(failures, 'SPEND_WIDENING', 'spend', 'child spend limits exceed parent limits');
+        }
+    }
+    if (parent.depth.remaining === 0) {
+        fail(failures, 'DEPTH_EXHAUSTED', 'depth', 'parent has no remaining delegation hop');
+    }
+    else if (child.depth.remaining > parent.depth.remaining - 1) {
+        fail(failures, 'DEPTH_WIDENING', 'depth', 'child remaining depth must consume at least one hop');
+    }
+    if (Date.parse(child.time.not_before) < Date.parse(parent.time.not_before) ||
+        Date.parse(child.time.not_after) > Date.parse(parent.time.not_after)) {
+        fail(failures, 'TIME_WIDENING', 'time', 'child validity window is not contained in parent window');
+    }
+    if (child.reputation.profile !== parent.reputation.profile) {
+        fail(failures, 'UNSUPPORTED_PROFILE', 'reputation', 'reputation profile changes are incomparable');
+    }
+    else if (child.reputation.ceiling > parent.reputation.ceiling) {
+        fail(failures, 'REPUTATION_WIDENING', 'reputation', 'child reputation ceiling exceeds parent');
+    }
+    if (child.values.profile !== parent.values.profile) {
+        fail(failures, 'UNSUPPORTED_PROFILE', 'values', 'values profile changes are incomparable');
+    }
+    else {
+        const childRequired = new Set(child.values.required);
+        if (parent.values.required.some(identifier => !childRequired.has(identifier))) {
+            fail(failures, 'VALUES_WEAKENING', 'values', 'child removed an ancestor-required value identifier');
+        }
+    }
+    if (child.reversibility.profile !== parent.reversibility.profile) {
+        fail(failures, 'UNSUPPORTED_PROFILE', 'reversibility', 'reversibility profile changes are incomparable');
+    }
+    else if (REVERSIBILITY_RANK[child.reversibility.ceiling] >
+        REVERSIBILITY_RANK[parent.reversibility.ceiling]) {
+        fail(failures, 'REVERSIBILITY_WIDENING', 'reversibility', 'child reversibility ceiling exceeds parent');
+    }
+    return failures;
+}
+//# sourceMappingURL=compare.js.map

package/dist/src/v2/authority-delegation/compare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compare.js","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/compare.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAGzC,MAAM,kBAAkB,GAAyC;IAC/D,SAAS,EAAE,CAAC;IACZ,WAAW,EAAE,CAAC;IACd,YAAY,EAAE,CAAC;CAChB,CAAA;AAED,SAAS,IAAI,CACX,QAA4B,EAC5B,IAA8B,EAC9B,KAA8B,EAC9B,OAAe;IAEf,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;AACzC,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,gBAAgB,CAC9B,MAAyB,EACzB,KAAwB;IAExB,MAAM,QAAQ,GAAuB,EAAE,CAAA;IAEvC,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACjD,IAAI,CAAC,QAAQ,EAAE,qBAAqB,EAAE,OAAO,EAAE,wCAAwC,CAAC,CAAA;IAC1F,CAAC;SAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,4CAA4C,CAAC,CAAA;IACzF,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACrC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,+CAA+C,CAAC,CAAA;QAC5F,CAAC;aAAM,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAClD,IAAI,CAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,sCAAsC,CAAC,CAAA;QACtF,CAAC;aAAM,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;YAChE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5E,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,yCAAyC,CAAC,CAAA;QACtF,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,wCAAwC,CAAC,CAAA;IACtF,CAAC;SAAM,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,qDAAqD,CAAC,CAAA;IAClG,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACtE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,yDAAyD,CAAC,CAAA;IACpG,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAC3D,IAAI,CAAC,QAAQ,EAAE,qBAAqB,EAAE,YAAY,EAAE,6CAA6C,CAAC,CAAA;IACpG,CAAC;SAAM,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAChE,IAAI,CAAC,QAAQ,EAAE,qBAAqB,EAAE,YAAY,EAAE,yCAAyC,CAAC,CAAA;IAChG,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,qBAAqB,EAAE,QAAQ,EAAE,yCAAyC,CAAC,CAAA;IAC5F,CAAC;SAAM,CAAC;QACN,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QACpD,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAC9E,IAAI,CAAC,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,EAAE,qDAAqD,CAAC,CAAA;QACrG,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,aAAa,CAAC,OAAO,KAAK,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QACjE,IAAI,CAAC,QAAQ,EAAE,qBAAqB,EAAE,eAAe,EAAE,gDAAgD,CAAC,CAAA;IAC1G,CAAC;SAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC;QAC/C,kBAAkB,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,QAAQ,EAAE,wBAAwB,EAAE,eAAe,EAAE,4CAA4C,CAAC,CAAA;IACzG,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/src/v2/authority-delegation/index.d.ts

@@ -0,0 +1,10 @@
+export * from './types.js';
+export * from './schema.js';
+export * from './scope.js';
+export * from './canonical.js';
+export * from './compare.js';
+export * from './issue.js';
+export * from './parse.js';
+export * from './verify.js';
+export * from './budget.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/v2/authority-delegation/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/index.ts"],"names":[],"mappings":"AAGA,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA"}

package/dist/src/v2/authority-delegation/index.js

@@ -0,0 +1,12 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+export * from './types.js';
+export * from './schema.js';
+export * from './scope.js';
+export * from './canonical.js';
+export * from './compare.js';
+export * from './issue.js';
+export * from './parse.js';
+export * from './verify.js';
+export * from './budget.js';
+//# sourceMappingURL=index.js.map

package/dist/src/v2/authority-delegation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/index.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA"}

package/dist/src/v2/authority-delegation/issue.d.ts

@@ -0,0 +1,10 @@
+import type { AuthorityDelegationBodyV1, AuthorityDelegationV1 } from './types.js';
+/** Create a deterministic v1 record from explicit body fields and an Ed25519 key. */
+export declare function issueAuthorityDelegation(body: AuthorityDelegationBodyV1, privateKey: string): AuthorityDelegationV1;
+/**
+ * Issue a child after immediate-parent attenuation checks. The caller must first
+ * validate the complete parent chain and revocation state; this pure primitive
+ * cannot establish live ancestor status by itself.
+ */
+export declare function issueSubAuthorityDelegation(parent: AuthorityDelegationV1, body: AuthorityDelegationBodyV1, privateKey: string): AuthorityDelegationV1;
+//# sourceMappingURL=issue.d.ts.map

package/dist/src/v2/authority-delegation/issue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/issue.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAclF,qFAAqF;AACrF,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,yBAAyB,EAC/B,UAAU,EAAE,MAAM,GACjB,qBAAqB,CAKvB;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,yBAAyB,EAC/B,UAAU,EAAE,MAAM,GACjB,qBAAqB,CAsBvB"}

package/dist/src/v2/authority-delegation/issue.js

@@ -0,0 +1,52 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { computeAuthorityDelegationId, signAuthorityDelegation, } from './canonical.js';
+import { compareAuthority } from './compare.js';
+import { validateAuthorityDelegationShape } from './schema.js';
+function assertBody(body) {
+    const probe = {
+        ...body,
+        delegation_id: `sha256:${'0'.repeat(64)}`,
+        signature: '0'.repeat(128),
+    };
+    const failures = validateAuthorityDelegationShape(probe);
+    if (failures.length > 0) {
+        throw new Error(`authority delegation body invalid: ${failures.map(item => `${item.code}: ${item.message}`).join('; ')}`);
+    }
+}
+/** Create a deterministic v1 record from explicit body fields and an Ed25519 key. */
+export function issueAuthorityDelegation(body, privateKey) {
+    assertBody(body);
+    const delegation_id = computeAuthorityDelegationId(body);
+    const unsigned = { ...body, delegation_id };
+    return { ...unsigned, signature: signAuthorityDelegation(unsigned, privateKey) };
+}
+/**
+ * Issue a child after immediate-parent attenuation checks. The caller must first
+ * validate the complete parent chain and revocation state; this pure primitive
+ * cannot establish live ancestor status by itself.
+ */
+export function issueSubAuthorityDelegation(parent, body, privateKey) {
+    const parentFailures = validateAuthorityDelegationShape(parent);
+    if (parentFailures.length > 0) {
+        throw new Error(`authority delegation parent invalid: ${parentFailures.map(item => item.code).join(', ')}`);
+    }
+    assertBody(body);
+    if (body.parent_delegation_id !== parent.delegation_id) {
+        throw new Error('authority delegation parent mismatch');
+    }
+    if (body.issuer !== parent.subject) {
+        throw new Error('authority delegation chain continuity failure');
+    }
+    const issued = Date.parse(body.issued_at);
+    if (issued < Date.parse(parent.authority.time.not_before) ||
+        issued >= Date.parse(parent.authority.time.not_after)) {
+        throw new Error('authority delegation issued_at is outside parent validity');
+    }
+    const failures = compareAuthority(parent.authority, body.authority);
+    if (failures.length > 0) {
+        throw new Error(`authority delegation does not narrow: ${failures.map(item => item.code).join(', ')}`);
+    }
+    return issueAuthorityDelegation(body, privateKey);
+}
+//# sourceMappingURL=issue.js.map

package/dist/src/v2/authority-delegation/issue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue.js","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/issue.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAA;AAG9D,SAAS,UAAU,CAAC,IAA+B;IACjD,MAAM,KAAK,GAA0B;QACnC,GAAG,IAAI;QACP,aAAa,EAAE,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;QACzC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;KAC3B,CAAA;IACD,MAAM,QAAQ,GAAG,gCAAgC,CAAC,KAAK,CAAC,CAAA;IACxD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC3H,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,wBAAwB,CACtC,IAA+B,EAC/B,UAAkB;IAElB,UAAU,CAAC,IAAI,CAAC,CAAA;IAChB,MAAM,aAAa,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAA;IACxD,MAAM,QAAQ,GAA6C,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,CAAA;IACrF,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,uBAAuB,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAA;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAA6B,EAC7B,IAA+B,EAC/B,UAAkB;IAElB,MAAM,cAAc,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAA;IAC/D,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,wCAAwC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC7G,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,CAAA;IAChB,IAAI,IAAI,CAAC,oBAAoB,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;IACzD,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACzC,IAAI,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;QACrD,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IACnE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACxG,CAAC;IACD,OAAO,wBAAwB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;AACnD,CAAC"}

package/dist/src/v2/authority-delegation/parse.d.ts

@@ -0,0 +1,4 @@
+import type { AuthorityDelegationV1 } from './types.js';
+/** Strict untrusted-wire entry point: valid JSON, I-JSON names, and closed v1 schema. */
+export declare function parseAuthorityDelegationJson(source: string): AuthorityDelegationV1;
+//# sourceMappingURL=parse.d.ts.map

package/dist/src/v2/authority-delegation/parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/parse.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAsEvD,yFAAyF;AACzF,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,GAAG,qBAAqB,CAWlF"}