agent-passport-system 4.1.1 → 4.2.0

package/dist/src/v2/authority-delegation/parse.js

@@ -0,0 +1,96 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { validateAuthorityDelegationShape } from './schema.js';
+const MAX_WIRE_BYTES = 1_048_576;
+/**
+ * JSON.parse silently keeps the last occurrence of a duplicate member. RFC
+ * 8785 operates on I-JSON, so scan the already-syntax-checked source and reject
+ * repeated names at every object depth before accepting a signed record.
+ */
+function rejectDuplicateMembers(source) {
+    let cursor = 0;
+    const skipWhitespace = () => {
+        while (cursor < source.length && /[\u0009\u000a\u000d\u0020]/.test(source[cursor]))
+            cursor++;
+    };
+    const readString = () => {
+        const start = cursor;
+        cursor++; // opening quote; whole-document JSON.parse already proved syntax
+        while (cursor < source.length) {
+            if (source[cursor] === '\\') {
+                cursor += 2;
+            }
+            else if (source[cursor++] === '"') {
+                return JSON.parse(source.slice(start, cursor));
+            }
+        }
+        throw new SyntaxError('unterminated JSON string');
+    };
+    const value = () => {
+        skipWhitespace();
+        const first = source[cursor];
+        if (first === '{') {
+            cursor++;
+            skipWhitespace();
+            const names = new Set();
+            if (source[cursor] === '}') {
+                cursor++;
+                return;
+            }
+            while (cursor < source.length) {
+                const name = readString();
+                if (names.has(name))
+                    throw new SyntaxError('duplicate JSON object member');
+                names.add(name);
+                skipWhitespace();
+                cursor++; // colon
+                value();
+                skipWhitespace();
+                if (source[cursor++] === '}')
+                    return;
+                skipWhitespace(); // comma was consumed
+            }
+        }
+        else if (first === '[') {
+            cursor++;
+            skipWhitespace();
+            if (source[cursor] === ']') {
+                cursor++;
+                return;
+            }
+            while (cursor < source.length) {
+                value();
+                skipWhitespace();
+                if (source[cursor++] === ']')
+                    return;
+            }
+        }
+        else if (first === '"') {
+            readString();
+        }
+        else {
+            const start = cursor;
+            while (cursor < source.length && !/[\u0009\u000a\u000d\u0020,}\]]/.test(source[cursor]))
+                cursor++;
+            const token = source.slice(start, cursor);
+            if (/^[-0-9]/.test(token) && !/^-?(0|[1-9][0-9]*)$/.test(token)) {
+                throw new SyntaxError('non-integer JSON numbers are not permitted');
+            }
+        }
+    };
+    value();
+}
+/** Strict untrusted-wire entry point: valid JSON, I-JSON names, and closed v1 schema. */
+export function parseAuthorityDelegationJson(source) {
+    if (typeof source !== 'string' || Buffer.byteLength(source, 'utf8') > MAX_WIRE_BYTES) {
+        throw new TypeError('authority delegation JSON must be a string no larger than 1 MiB');
+    }
+    const decoded = JSON.parse(source);
+    rejectDuplicateMembers(source);
+    const failures = validateAuthorityDelegationShape(decoded);
+    if (failures.length > 0) {
+        throw new TypeError(`authority delegation wire invalid: ${failures.map(item => item.code).join(', ')}`);
+    }
+    return decoded;
+}
+//# sourceMappingURL=parse.js.map

package/dist/src/v2/authority-delegation/parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.js","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/parse.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAA;AAG9D,MAAM,cAAc,GAAG,SAAS,CAAA;AAEhC;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,MAAc;IAC5C,IAAI,MAAM,GAAG,CAAC,CAAA;IAEd,MAAM,cAAc,GAAG,GAAS,EAAE;QAChC,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAAE,MAAM,EAAE,CAAA;IAC9F,CAAC,CAAA;IACD,MAAM,UAAU,GAAG,GAAW,EAAE;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAA;QACpB,MAAM,EAAE,CAAA,CAAC,iEAAiE;QAC1E,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,CAAA;YACb,CAAC;iBAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC;gBACpC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAW,CAAA;YAC1D,CAAC;QACH,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,0BAA0B,CAAC,CAAA;IACnD,CAAC,CAAA;IACD,MAAM,KAAK,GAAG,GAAS,EAAE;QACvB,cAAc,EAAE,CAAA;QAChB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;QAC5B,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAClB,MAAM,EAAE,CAAA;YACR,cAAc,EAAE,CAAA;YAChB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;YAC/B,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,MAAM,EAAE,CAAC;gBAAC,OAAM;YAAC,CAAC;YAChD,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,UAAU,EAAE,CAAA;gBACzB,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,WAAW,CAAC,8BAA8B,CAAC,CAAA;gBAC1E,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;gBACf,cAAc,EAAE,CAAA;gBAChB,MAAM,EAAE,CAAA,CAAC,QAAQ;gBACjB,KAAK,EAAE,CAAA;gBACP,cAAc,EAAE,CAAA;gBAChB,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,GAAG;oBAAE,OAAM;gBACpC,cAAc,EAAE,CAAA,CAAC,qBAAqB;YACxC,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACzB,MAAM,EAAE,CAAA;YACR,cAAc,EAAE,CAAA;YAChB,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,MAAM,EAAE,CAAC;gBAAC,OAAM;YAAC,CAAC;YAChD,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC9B,KAAK,EAAE,CAAA;gBACP,cAAc,EAAE,CAAA;gBAChB,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,GAAG;oBAAE,OAAM;YACtC,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACzB,UAAU,EAAE,CAAA;QACd,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,MAAM,CAAA;YACpB,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAAE,MAAM,EAAE,CAAA;YACjG,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;YACzC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChE,MAAM,IAAI,WAAW,CAAC,4CAA4C,CAAC,CAAA;YACrE,CAAC;QACH,CAAC;IACH,CAAC,CAAA;IAED,KAAK,EAAE,CAAA;AACT,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,4BAA4B,CAAC,MAAc;IACzD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,cAAc,EAAE,CAAC;QACrF,MAAM,IAAI,SAAS,CAAC,iEAAiE,CAAC,CAAA;IACxF,CAAC;IACD,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC3C,sBAAsB,CAAC,MAAM,CAAC,CAAA;IAC9B,MAAM,QAAQ,GAAG,gCAAgC,CAAC,OAAO,CAAC,CAAA;IAC1D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,SAAS,CAAC,sCAAsC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACzG,CAAC;IACD,OAAO,OAAgC,CAAA;AACzC,CAAC"}

package/dist/src/v2/authority-delegation/schema.d.ts

@@ -0,0 +1,7 @@
+import type { AuthorityDelegationV1, AuthorityFailure } from './types.js';
+export declare function isCanonicalTimestamp(value: unknown): value is string;
+export declare function isCanonicalQuantity(value: unknown): value is string;
+/** Closed-schema and canonical-value validation for an in-memory decoded record. */
+export declare function validateAuthorityDelegationShape(value: unknown): AuthorityFailure[];
+export declare function isAuthorityDelegationV1(value: unknown): value is AuthorityDelegationV1;
+//# sourceMappingURL=schema.d.ts.map

package/dist/src/v2/authority-delegation/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/schema.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAmCzE,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAIpE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAGnE;AAMD,oFAAoF;AACpF,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,EAAE,CA4GnF;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAEtF"}

package/dist/src/v2/authority-delegation/schema.js

@@ -0,0 +1,177 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { grantsAreCanonical } from './scope.js';
+import { AUTHORITY_DELEGATION_RECORD_TYPE, AUTHORITY_DELEGATION_VERSION, REPUTATION_PROFILE_V1, REVERSIBILITY_PROFILE_V1, SCOPE_PROFILE_V1, VALUES_PROFILE_V1, } from './types.js';
+const ID = /^sha256:[0-9a-f]{64}$/;
+const HEX_32 = /^[0-9a-f]{32}$/;
+const HEX_128 = /^[0-9a-f]{128}$/;
+const DECIMAL = /^(0|[1-9][0-9]*)$/;
+const IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+const MAX_QUANTITY = 9223372036854775807n;
+const MILLIS_UTC = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function exactKeys(value, expected) {
+    const actual = Object.keys(value).sort();
+    const wanted = [...expected].sort();
+    return actual.length === wanted.length && actual.every((key, i) => key === wanted[i]);
+}
+function wellFormedUnicode(value) {
+    for (let i = 0; i < value.length; i++) {
+        const unit = value.charCodeAt(i);
+        if (unit >= 0xd800 && unit <= 0xdbff) {
+            const next = value.charCodeAt(++i);
+            if (!(next >= 0xdc00 && next <= 0xdfff))
+                return false;
+        }
+        else if (unit >= 0xdc00 && unit <= 0xdfff) {
+            return false;
+        }
+    }
+    return true;
+}
+export function isCanonicalTimestamp(value) {
+    if (typeof value !== 'string' || !MILLIS_UTC.test(value) || value.startsWith('0000-'))
+        return false;
+    const parsed = new Date(value);
+    return Number.isFinite(parsed.getTime()) && parsed.toISOString() === value;
+}
+export function isCanonicalQuantity(value) {
+    if (typeof value !== 'string' || !DECIMAL.test(value))
+        return false;
+    try {
+        return BigInt(value) <= MAX_QUANTITY;
+    }
+    catch {
+        return false;
+    }
+}
+function failure(code, message) {
+    return { code, message };
+}
+/** Closed-schema and canonical-value validation for an in-memory decoded record. */
+export function validateAuthorityDelegationShape(value) {
+    const failures = [];
+    const top = record(value);
+    if (!top || !exactKeys(top, [
+        'record_type', 'version', 'delegation_id', 'parent_delegation_id', 'issuer',
+        'subject', 'verification_method', 'issued_at', 'nonce', 'authority', 'signature',
+    ]))
+        return [failure('SCHEMA_INVALID', 'delegation must be an exact closed v1 object')];
+    if (top.record_type !== AUTHORITY_DELEGATION_RECORD_TYPE || top.version !== AUTHORITY_DELEGATION_VERSION) {
+        failures.push(failure('UNSUPPORTED_VERSION', 'unsupported authority-delegation record_type or version'));
+    }
+    if (typeof top.delegation_id !== 'string' || !ID.test(top.delegation_id)) {
+        failures.push(failure('SCHEMA_INVALID', 'delegation_id must be sha256:<64 lowercase hex>'));
+    }
+    if (top.parent_delegation_id !== null &&
+        (typeof top.parent_delegation_id !== 'string' || !ID.test(top.parent_delegation_id))) {
+        failures.push(failure('SCHEMA_INVALID', 'parent_delegation_id must be null or a delegation digest'));
+    }
+    for (const key of ['issuer', 'subject', 'verification_method']) {
+        const item = top[key];
+        if (typeof item !== 'string' || item.length === 0 || Buffer.byteLength(item, 'utf8') > 1024 || !wellFormedUnicode(item)) {
+            failures.push(failure('SCHEMA_INVALID', `${key} must be a non-empty well-formed Unicode string`));
+        }
+    }
+    if (!isCanonicalTimestamp(top.issued_at))
+        failures.push(failure('NONCANONICAL_VALUE', 'issued_at must be canonical UTC milliseconds'));
+    if (typeof top.nonce !== 'string' || !HEX_32.test(top.nonce))
+        failures.push(failure('NONCANONICAL_VALUE', 'nonce must be 32 lowercase hex characters'));
+    if (typeof top.signature !== 'string' || !HEX_128.test(top.signature))
+        failures.push(failure('SCHEMA_INVALID', 'signature must be 128 lowercase hex characters'));
+    const authority = record(top.authority);
+    if (!authority || !exactKeys(authority, ['scope', 'spend', 'depth', 'time', 'reputation', 'values', 'reversibility'])) {
+        failures.push(failure('SCHEMA_INVALID', 'authority must carry exactly all seven facets'));
+        return failures;
+    }
+    const scope = record(authority.scope);
+    if (!scope || !exactKeys(scope, ['profile', 'grants']) || typeof scope.profile !== 'string' ||
+        !IDENTIFIER.test(scope.profile) || !Array.isArray(scope.grants) ||
+        !scope.grants.every(item => typeof item === 'string')) {
+        failures.push(failure('SCHEMA_INVALID', 'scope must contain profile and grants'));
+    }
+    else {
+        if (scope.profile !== SCOPE_PROFILE_V1)
+            failures.push(failure('UNSUPPORTED_PROFILE', 'unsupported scope profile'));
+        if (!grantsAreCanonical(scope.grants))
+            failures.push(failure('NONCANONICAL_VALUE', 'scope grants must be valid, sorted, unique, and irredundant'));
+    }
+    const spend = record(authority.spend);
+    if (!spend || typeof spend.mode !== 'string') {
+        failures.push(failure('SCHEMA_INVALID', 'spend must be a tagged object'));
+    }
+    else if (spend.mode === 'unbounded') {
+        if (!exactKeys(spend, ['mode']))
+            failures.push(failure('SCHEMA_INVALID', 'unbounded spend has no other fields'));
+    }
+    else if (spend.mode === 'bounded') {
+        if (!exactKeys(spend, ['mode', 'unit', 'per_action', 'cumulative']) ||
+            typeof spend.unit !== 'string' || !IDENTIFIER.test(spend.unit) ||
+            !isCanonicalQuantity(spend.per_action) || !isCanonicalQuantity(spend.cumulative)) {
+            failures.push(failure('NONCANONICAL_VALUE', 'bounded spend fields are malformed'));
+        }
+        else if (BigInt(spend.per_action) > BigInt(spend.cumulative)) {
+            failures.push(failure('SCHEMA_INVALID', 'spend per_action cannot exceed cumulative'));
+        }
+    }
+    else
+        failures.push(failure('SCHEMA_INVALID', 'unknown spend mode'));
+    const depth = record(authority.depth);
+    if (!depth || !exactKeys(depth, ['remaining']) || !Number.isInteger(depth.remaining) ||
+        depth.remaining < 0 || depth.remaining > 255) {
+        failures.push(failure('SCHEMA_INVALID', 'depth.remaining must be an integer from 0 through 255'));
+    }
+    const time = record(authority.time);
+    if (!time || !exactKeys(time, ['not_before', 'not_after']) ||
+        !isCanonicalTimestamp(time.not_before) || !isCanonicalTimestamp(time.not_after)) {
+        failures.push(failure('NONCANONICAL_VALUE', 'time bounds must be canonical UTC milliseconds'));
+    }
+    else if (Date.parse(time.not_before) >= Date.parse(time.not_after)) {
+        failures.push(failure('SCHEMA_INVALID', 'time window must be non-empty'));
+    }
+    else if (isCanonicalTimestamp(top.issued_at) && Date.parse(time.not_before) < Date.parse(top.issued_at)) {
+        failures.push(failure('SCHEMA_INVALID', 'time.not_before cannot predate issued_at'));
+    }
+    const reputation = record(authority.reputation);
+    if (!reputation || !exactKeys(reputation, ['profile', 'ceiling']) ||
+        typeof reputation.profile !== 'string' || !IDENTIFIER.test(reputation.profile) ||
+        !Number.isInteger(reputation.ceiling) || reputation.ceiling < 0 ||
+        reputation.ceiling > 100) {
+        failures.push(failure('SCHEMA_INVALID', 'reputation ceiling must be an integer from 0 through 100'));
+    }
+    else if (reputation.profile !== REPUTATION_PROFILE_V1) {
+        failures.push(failure('UNSUPPORTED_PROFILE', 'unsupported reputation profile'));
+    }
+    const values = record(authority.values);
+    if (!values || !exactKeys(values, ['profile', 'required']) || typeof values.profile !== 'string' ||
+        !IDENTIFIER.test(values.profile) || !Array.isArray(values.required) ||
+        !values.required.every(item => typeof item === 'string' && IDENTIFIER.test(item))) {
+        failures.push(failure('SCHEMA_INVALID', 'values.required must contain valid identifiers'));
+    }
+    else {
+        if (values.profile !== VALUES_PROFILE_V1)
+            failures.push(failure('UNSUPPORTED_PROFILE', 'unsupported values profile'));
+        const required = values.required;
+        if (required.some((item, i) => i > 0 && required[i - 1] >= item)) {
+            failures.push(failure('NONCANONICAL_VALUE', 'values.required must be sorted and unique'));
+        }
+    }
+    const reversibility = record(authority.reversibility);
+    if (!reversibility || !exactKeys(reversibility, ['profile', 'ceiling']) ||
+        typeof reversibility.profile !== 'string' || !IDENTIFIER.test(reversibility.profile) ||
+        !['tentative', 'compensable', 'irreversible'].includes(String(reversibility.ceiling))) {
+        failures.push(failure('SCHEMA_INVALID', 'reversibility facet is malformed'));
+    }
+    else if (reversibility.profile !== REVERSIBILITY_PROFILE_V1) {
+        failures.push(failure('UNSUPPORTED_PROFILE', 'unsupported reversibility profile'));
+    }
+    return failures;
+}
+export function isAuthorityDelegationV1(value) {
+    return validateAuthorityDelegationShape(value).length === 0;
+}
+//# sourceMappingURL=schema.js.map

package/dist/src/v2/authority-delegation/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/schema.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EACL,gCAAgC,EAChC,4BAA4B,EAC5B,qBAAqB,EACrB,wBAAwB,EACxB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,YAAY,CAAA;AAGnB,MAAM,EAAE,GAAG,uBAAuB,CAAA;AAClC,MAAM,MAAM,GAAG,gBAAgB,CAAA;AAC/B,MAAM,OAAO,GAAG,iBAAiB,CAAA;AACjC,MAAM,OAAO,GAAG,mBAAmB,CAAA;AACnC,MAAM,UAAU,GAAG,qCAAqC,CAAA;AACxD,MAAM,YAAY,GAAG,oBAAoB,CAAA;AACzC,MAAM,UAAU,GAAG,+CAA+C,CAAA;AAElE,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAC,KAAgC;QAClC,CAAC,CAAC,IAAI,CAAA;AACV,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,QAA2B;IAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;IACxC,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAA;IACnC,OAAO,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;AACvF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAChC,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;YAClC,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAA;QACvD,CAAC;aAAM,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IACnG,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK,CAAA;AAC5E,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACnE,IAAI,CAAC;QAAC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,YAAY,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;AACrE,CAAC;AAED,SAAS,OAAO,CAAC,IAA8B,EAAE,OAAe;IAC9D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAC1B,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,gCAAgC,CAAC,KAAc;IAC7D,MAAM,QAAQ,GAAuB,EAAE,CAAA;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IACzB,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;QAC1B,aAAa,EAAE,SAAS,EAAE,eAAe,EAAE,sBAAsB,EAAE,QAAQ;QAC3E,SAAS,EAAE,qBAAqB,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW;KACjF,CAAC;QAAE,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,8CAA8C,CAAC,CAAC,CAAA;IAEtF,IAAI,GAAG,CAAC,WAAW,KAAK,gCAAgC,IAAI,GAAG,CAAC,OAAO,KAAK,4BAA4B,EAAE,CAAC;QACzG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,yDAAyD,CAAC,CAAC,CAAA;IAC1G,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QACzE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,iDAAiD,CAAC,CAAC,CAAA;IAC7F,CAAC;IACD,IAAI,GAAG,CAAC,oBAAoB,KAAK,IAAI;QACjC,CAAC,OAAO,GAAG,CAAC,oBAAoB,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC;QACzF,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,0DAA0D,CAAC,CAAC,CAAA;IACtG,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,qBAAqB,CAAU,EAAE,CAAC;QACxE,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;QACrB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YACxH,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,GAAG,iDAAiD,CAAC,CAAC,CAAA;QACnG,CAAC;IACH,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,8CAA8C,CAAC,CAAC,CAAA;IACtI,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,2CAA2C,CAAC,CAAC,CAAA;IACvJ,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,gDAAgD,CAAC,CAAC,CAAA;IAEjK,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACvC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;QACtH,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,+CAA+C,CAAC,CAAC,CAAA;QACzF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACrC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACvF,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAC/D,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC1D,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,uCAAuC,CAAC,CAAC,CAAA;IACnF,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,CAAC,OAAO,KAAK,gBAAgB;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,2BAA2B,CAAC,CAAC,CAAA;QAClH,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAkB,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,6DAA6D,CAAC,CAAC,CAAA;IAChK,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACrC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7C,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC,CAAA;IAC3E,CAAC;SAAM,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACtC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,qCAAqC,CAAC,CAAC,CAAA;IAClH,CAAC;SAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;YAC/D,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAC9D,CAAC,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACrF,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,oCAAoC,CAAC,CAAC,CAAA;QACpF,CAAC;aAAM,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/D,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,2CAA2C,CAAC,CAAC,CAAA;QACvF,CAAC;IACH,CAAC;;QAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,CAAC,CAAA;IAErE,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACrC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC;QAC/E,KAAK,CAAC,SAAoB,GAAG,CAAC,IAAK,KAAK,CAAC,SAAoB,GAAG,GAAG,EAAE,CAAC;QACzE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,uDAAuD,CAAC,CAAC,CAAA;IACnG,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACnC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACtD,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACpF,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,gDAAgD,CAAC,CAAC,CAAA;IAChG,CAAC;SAAM,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACrE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC,CAAA;IAC3E,CAAC;SAAM,IAAI,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1G,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,0CAA0C,CAAC,CAAC,CAAA;IACtF,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;IAC/C,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC7D,OAAO,UAAU,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAC9E,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,IAAK,UAAU,CAAC,OAAkB,GAAG,CAAC;QAC1E,UAAU,CAAC,OAAkB,GAAG,GAAG,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,0DAA0D,CAAC,CAAC,CAAA;IACtG,CAAC;SAAM,IAAI,UAAU,CAAC,OAAO,KAAK,qBAAqB,EAAE,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,gCAAgC,CAAC,CAAC,CAAA;IACjF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IACvC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;QAC5F,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;QACnE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACtF,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,gDAAgD,CAAC,CAAC,CAAA;IAC5F,CAAC;SAAM,CAAC;QACN,IAAI,MAAM,CAAC,OAAO,KAAK,iBAAiB;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,4BAA4B,CAAC,CAAC,CAAA;QACrH,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAoB,CAAA;QAC5C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;YACjE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,2CAA2C,CAAC,CAAC,CAAA;QAC3F,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;IACrD,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACnE,OAAO,aAAa,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QACpF,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC1F,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,kCAAkC,CAAC,CAAC,CAAA;IAC9E,CAAC;SAAM,IAAI,aAAa,CAAC,OAAO,KAAK,wBAAwB,EAAE,CAAC;QAC9D,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,mCAAmC,CAAC,CAAC,CAAA;IACpF,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,OAAO,gCAAgC,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAA;AAC7D,CAAC"}

package/dist/src/v2/authority-delegation/scope.d.ts

@@ -0,0 +1,6 @@
+export declare function isValidScopeGrant(grant: string): boolean;
+/** Exact grants cover only themselves. A terminal :* grant covers its prefix and descendants. */
+export declare function scopeGrantCovers(parent: string, child: string): boolean;
+export declare function grantsAreCanonical(grants: readonly string[]): boolean;
+export declare function scopeNarrows(parent: readonly string[], child: readonly string[]): boolean;
+//# sourceMappingURL=scope.d.ts.map

package/dist/src/v2/authority-delegation/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/scope.ts"],"names":[],"mappings":"AAKA,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CASxD;AAED,iGAAiG;AACjG,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAQvE;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAYrE;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAEzF"}

package/dist/src/v2/authority-delegation/scope.js

@@ -0,0 +1,50 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+const SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+export function isValidScopeGrant(grant) {
+    if (grant === '*')
+        return true;
+    if (typeof grant !== 'string' || grant.length === 0 || grant.length > 255)
+        return false;
+    const parts = grant.split(':');
+    if (parts.length > 16)
+        return false;
+    const wildcard = parts.at(-1) === '*';
+    if (wildcard)
+        parts.pop();
+    if (parts.length === 0 || parts.some(part => !SEGMENT.test(part)))
+        return false;
+    return !parts.includes('*');
+}
+/** Exact grants cover only themselves. A terminal :* grant covers its prefix and descendants. */
+export function scopeGrantCovers(parent, child) {
+    if (parent === '*')
+        return true;
+    if (parent.endsWith(':*')) {
+        const prefix = parent.slice(0, -2);
+        const childPrefix = child.endsWith(':*') ? child.slice(0, -2) : child;
+        return childPrefix === prefix || childPrefix.startsWith(prefix + ':');
+    }
+    return parent === child;
+}
+export function grantsAreCanonical(grants) {
+    if (!Array.isArray(grants))
+        return false;
+    for (let i = 0; i < grants.length; i++) {
+        const grant = grants[i];
+        if (!isValidScopeGrant(grant))
+            return false;
+        if (i > 0 && grants[i - 1] >= grant)
+            return false;
+        // A canonical set is an antichain: no entry is redundant under another entry.
+        for (let j = 0; j < grants.length; j++) {
+            if (i !== j && scopeGrantCovers(grants[j], grant))
+                return false;
+        }
+    }
+    return true;
+}
+export function scopeNarrows(parent, child) {
+    return child.every(grant => parent.some(parentGrant => scopeGrantCovers(parentGrant, grant)));
+}
+//# sourceMappingURL=scope.js.map

package/dist/src/v2/authority-delegation/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/scope.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,MAAM,OAAO,GAAG,mCAAmC,CAAA;AAEnD,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,KAAK,CAAA;IACvF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAA;IACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAA;IACrC,IAAI,QAAQ;QAAE,KAAK,CAAC,GAAG,EAAE,CAAA;IACzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAC/E,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AAC7B,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,KAAa;IAC5D,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAC/B,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAClC,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACrE,OAAO,WAAW,KAAK,MAAM,IAAI,WAAW,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAA;IACvE,CAAC;IACD,OAAO,MAAM,KAAK,KAAK,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAyB;IAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;QACvB,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QAC3C,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAA;QACjD,8EAA8E;QAC9E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,IAAI,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAA;QACjE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAyB,EAAE,KAAwB;IAC9E,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAA;AAC/F,CAAC"}

package/dist/src/v2/authority-delegation/types.d.ts

@@ -0,0 +1,98 @@
+/** First complete APS authority-delegation wire profile. */
+export declare const AUTHORITY_DELEGATION_RECORD_TYPE: 'aps:authority-delegation:v1';
+export declare const AUTHORITY_DELEGATION_VERSION: '1.0';
+export declare const SCOPE_PROFILE_V1: 'aps-hierarchical-v1';
+export declare const REPUTATION_PROFILE_V1: 'aps-score-0-100-v1';
+export declare const VALUES_PROFILE_V1: 'aps-values-identifiers-v1';
+export declare const REVERSIBILITY_PROFILE_V1: 'aps-tci-v1';
+export interface ScopeFacetV1 {
+    profile: typeof SCOPE_PROFILE_V1;
+    grants: string[];
+}
+export type SpendFacetV1 = {
+    mode: 'unbounded';
+} | {
+    mode: 'bounded';
+    /** Opaque, exact-match accounting unit, for example iso4217:USD:minor. */
+    unit: string;
+    /** Canonical unsigned decimal integer. */
+    per_action: string;
+    /** Canonical unsigned decimal integer applying to the whole delegation subtree. */
+    cumulative: string;
+};
+export interface DepthFacetV1 {
+    /** Number of further delegation hops the subject may create. */
+    remaining: number;
+}
+export interface TimeFacetV1 {
+    not_before: string;
+    not_after: string;
+}
+export interface ReputationFacetV1 {
+    profile: typeof REPUTATION_PROFILE_V1;
+    ceiling: number;
+}
+export interface ValuesFacetV1 {
+    profile: typeof VALUES_PROFILE_V1;
+    required: string[];
+}
+export type ReversibilityClassV1 = 'tentative' | 'compensable' | 'irreversible';
+export interface ReversibilityFacetV1 {
+    profile: typeof REVERSIBILITY_PROFILE_V1;
+    ceiling: ReversibilityClassV1;
+}
+export interface AuthorityVectorV1 {
+    scope: ScopeFacetV1;
+    spend: SpendFacetV1;
+    depth: DepthFacetV1;
+    time: TimeFacetV1;
+    reputation: ReputationFacetV1;
+    values: ValuesFacetV1;
+    reversibility: ReversibilityFacetV1;
+}
+export interface AuthorityDelegationBodyV1 {
+    record_type: typeof AUTHORITY_DELEGATION_RECORD_TYPE;
+    version: typeof AUTHORITY_DELEGATION_VERSION;
+    /** Null only for a trust-policy-selected root. */
+    parent_delegation_id: string | null;
+    issuer: string;
+    subject: string;
+    verification_method: string;
+    issued_at: string;
+    /** 16 random bytes encoded as 32 lowercase hexadecimal characters. */
+    nonce: string;
+    authority: AuthorityVectorV1;
+}
+export interface AuthorityDelegationV1 extends AuthorityDelegationBodyV1 {
+    delegation_id: string;
+    /** Raw 64-byte Ed25519 signature encoded as 128 lowercase hexadecimal characters. */
+    signature: string;
+}
+export type AuthorityFailureCode = 'SCHEMA_INVALID' | 'UNSUPPORTED_VERSION' | 'UNSUPPORTED_PROFILE' | 'NONCANONICAL_VALUE' | 'ID_MISMATCH' | 'KEY_RESOLUTION_FAILED' | 'SIGNATURE_INVALID' | 'ROOT_UNTRUSTED' | 'CHAIN_DUPLICATE_ID' | 'PARENT_MISMATCH' | 'CHAIN_CONTINUITY' | 'ISSUED_AT_OUTSIDE_PARENT' | 'SCOPE_WIDENING' | 'SPEND_WIDENING' | 'SPEND_UNIT_CHANGE' | 'DEPTH_EXHAUSTED' | 'DEPTH_WIDENING' | 'TIME_WIDENING' | 'REPUTATION_WIDENING' | 'VALUES_WEAKENING' | 'REVERSIBILITY_WIDENING' | 'NOT_YET_VALID' | 'EXPIRED' | 'REVOKED' | 'REVOCATION_UNKNOWN';
+export interface AuthorityFailure {
+    code: AuthorityFailureCode;
+    message: string;
+    index?: number;
+    facet?: keyof AuthorityVectorV1;
+}
+export type AuthorityValidationState = 'valid' | 'invalid' | 'indeterminate' | 'unsupported';
+export interface AuthorityValidationResult {
+    state: AuthorityValidationState;
+    valid: boolean;
+    failures: AuthorityFailure[];
+}
+export type VerificationKeyResolver = (issuer: string, verificationMethod: string, issuedAt: string) => string | null;
+export type RevocationResolution = 'active' | 'revoked' | 'unknown';
+export interface AuthorityChainVerificationOptions {
+    now: string;
+    resolveVerificationKey: VerificationKeyResolver;
+    trustRoot: (root: AuthorityDelegationV1) => boolean;
+    resolveRevocation: (delegation: AuthorityDelegationV1) => RevocationResolution;
+}
+export type BudgetReservationState = 'reserved' | 'dispatched' | 'committed' | 'cancelled';
+export interface BudgetOperationResult {
+    ok: boolean;
+    code: 'RESERVED' | 'DISPATCHED' | 'COMMITTED' | 'CANCELLED' | 'IDEMPOTENT' | 'CONFLICT' | 'UNIT_MISMATCH' | 'PER_ACTION_EXCEEDED' | 'CUMULATIVE_EXCEEDED' | 'NOT_FOUND' | 'INVALID_STATE';
+    state?: BudgetReservationState;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/v2/authority-delegation/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/types.ts"],"names":[],"mappings":"AAGA,4DAA4D;AAC5D,eAAO,MAAM,gCAAgC,EAAG,6BAAsC,CAAA;AACtF,eAAO,MAAM,4BAA4B,EAAG,KAAc,CAAA;AAE1D,eAAO,MAAM,gBAAgB,EAAG,qBAA8B,CAAA;AAC9D,eAAO,MAAM,qBAAqB,EAAG,oBAA6B,CAAA;AAClE,eAAO,MAAM,iBAAiB,EAAG,2BAAoC,CAAA;AACrE,eAAO,MAAM,wBAAwB,EAAG,YAAqB,CAAA;AAE7D,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,gBAAgB,CAAA;IAChC,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IACE,IAAI,EAAE,SAAS,CAAA;IACf,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAA;IACZ,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,mFAAmF;IACnF,UAAU,EAAE,MAAM,CAAA;CACnB,CAAA;AAEL,MAAM,WAAW,YAAY;IAC3B,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,qBAAqB,CAAA;IACrC,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,iBAAiB,CAAA;IACjC,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG,aAAa,GAAG,cAAc,CAAA;AAE/E,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,wBAAwB,CAAA;IACxC,OAAO,EAAE,oBAAoB,CAAA;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,YAAY,CAAA;IACnB,KAAK,EAAE,YAAY,CAAA;IACnB,KAAK,EAAE,YAAY,CAAA;IACnB,IAAI,EAAE,WAAW,CAAA;IACjB,UAAU,EAAE,iBAAiB,CAAA;IAC7B,MAAM,EAAE,aAAa,CAAA;IACrB,aAAa,EAAE,oBAAoB,CAAA;CACpC;AAED,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,OAAO,gCAAgC,CAAA;IACpD,OAAO,EAAE,OAAO,4BAA4B,CAAA;IAC5C,kDAAkD;IAClD,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,mBAAmB,EAAE,MAAM,CAAA;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,iBAAiB,CAAA;CAC7B;AAED,MAAM,WAAW,qBAAsB,SAAQ,yBAAyB;IACtE,aAAa,EAAE,MAAM,CAAA;IACrB,qFAAqF;IACrF,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,oBAAoB,GAC5B,gBAAgB,GAChB,qBAAqB,GACrB,qBAAqB,GACrB,oBAAoB,GACpB,aAAa,GACb,uBAAuB,GACvB,mBAAmB,GACnB,gBAAgB,GAChB,oBAAoB,GACpB,iBAAiB,GACjB,kBAAkB,GAClB,0BAA0B,GAC1B,gBAAgB,GAChB,gBAAgB,GAChB,mBAAmB,GACnB,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,GACrB,kBAAkB,GAClB,wBAAwB,GACxB,eAAe,GACf,SAAS,GACT,SAAS,GACT,oBAAoB,CAAA;AAExB,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,oBAAoB,CAAA;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,iBAAiB,CAAA;CAChC;AAED,MAAM,MAAM,wBAAwB,GAAG,OAAO,GAAG,SAAS,GAAG,eAAe,GAAG,aAAa,CAAA;AAE5F,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,wBAAwB,CAAA;IAC/B,KAAK,EAAE,OAAO,CAAA;IACd,QAAQ,EAAE,gBAAgB,EAAE,CAAA;CAC7B;AAED,MAAM,MAAM,uBAAuB,GAAG,CACpC,MAAM,EAAE,MAAM,EACd,kBAAkB,EAAE,MAAM,EAC1B,QAAQ,EAAE,MAAM,KACb,MAAM,GAAG,IAAI,CAAA;AAElB,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAA;AAEnE,MAAM,WAAW,iCAAiC;IAChD,GAAG,EAAE,MAAM,CAAA;IACX,sBAAsB,EAAE,uBAAuB,CAAA;IAC/C,SAAS,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,OAAO,CAAA;IACnD,iBAAiB,EAAE,CAAC,UAAU,EAAE,qBAAqB,KAAK,oBAAoB,CAAA;CAC/E;AAED,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,YAAY,GAAG,WAAW,GAAG,WAAW,CAAA;AAE1F,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAA;IACX,IAAI,EAAE,UAAU,GAAG,YAAY,GAAG,WAAW,GAAG,WAAW,GAAG,YAAY,GACxE,UAAU,GAAG,eAAe,GAAG,qBAAqB,GACpD,qBAAqB,GAAG,WAAW,GAAG,eAAe,CAAA;IACvD,KAAK,CAAC,EAAE,sBAAsB,CAAA;CAC/B"}

package/dist/src/v2/authority-delegation/types.js

@@ -0,0 +1,10 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+/** First complete APS authority-delegation wire profile. */
+export const AUTHORITY_DELEGATION_RECORD_TYPE = 'aps:authority-delegation:v1';
+export const AUTHORITY_DELEGATION_VERSION = '1.0';
+export const SCOPE_PROFILE_V1 = 'aps-hierarchical-v1';
+export const REPUTATION_PROFILE_V1 = 'aps-score-0-100-v1';
+export const VALUES_PROFILE_V1 = 'aps-values-identifiers-v1';
+export const REVERSIBILITY_PROFILE_V1 = 'aps-tci-v1';
+//# sourceMappingURL=types.js.map

package/dist/src/v2/authority-delegation/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/types.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,4DAA4D;AAC5D,MAAM,CAAC,MAAM,gCAAgC,GAAG,6BAAsC,CAAA;AACtF,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAc,CAAA;AAE1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAA8B,CAAA;AAC9D,MAAM,CAAC,MAAM,qBAAqB,GAAG,oBAA6B,CAAA;AAClE,MAAM,CAAC,MAAM,iBAAiB,GAAG,2BAAoC,CAAA;AACrE,MAAM,CAAC,MAAM,wBAAwB,GAAG,YAAqB,CAAA"}

package/dist/src/v2/authority-delegation/verify.d.ts

@@ -0,0 +1,5 @@
+import type { AuthorityChainVerificationOptions, AuthorityValidationResult } from './types.js';
+/** Full root-to-leaf structural, cryptographic, temporal, and revocation validation. */
+export declare function verifyAuthorityDelegationChain(rawChain: readonly unknown[], options: AuthorityChainVerificationOptions): AuthorityValidationResult;
+export declare function verifyAuthorityDelegation(delegation: unknown, options: AuthorityChainVerificationOptions): AuthorityValidationResult;
+//# sourceMappingURL=verify.d.ts.map

package/dist/src/v2/authority-delegation/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/verify.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,iCAAiC,EAGjC,yBAAyB,EAE1B,MAAM,YAAY,CAAA;AAUnB,wFAAwF;AACxF,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,SAAS,OAAO,EAAE,EAC5B,OAAO,EAAE,iCAAiC,GACzC,yBAAyB,CA8G3B;AAED,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,OAAO,EACnB,OAAO,EAAE,iCAAiC,GACzC,yBAAyB,CAE3B"}

package/dist/src/v2/authority-delegation/verify.js

@@ -0,0 +1,124 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { authorityDelegationBody, computeAuthorityDelegationId, verifyAuthorityDelegationSignature, } from './canonical.js';
+import { compareAuthority } from './compare.js';
+import { isCanonicalTimestamp, validateAuthorityDelegationShape } from './schema.js';
+function result(state, failures) {
+    return { state, valid: state === 'valid', failures };
+}
+function indexed(failure, index) {
+    return { ...failure, index };
+}
+/** Full root-to-leaf structural, cryptographic, temporal, and revocation validation. */
+export function verifyAuthorityDelegationChain(rawChain, options) {
+    if (!Array.isArray(rawChain) || rawChain.length === 0 || rawChain.length > 256) {
+        return result('invalid', [{ code: 'SCHEMA_INVALID', message: 'chain must contain 1 through 256 records' }]);
+    }
+    if (!options || !isCanonicalTimestamp(options.now)) {
+        return result('invalid', [{ code: 'NONCANONICAL_VALUE', message: 'verification clock must be canonical UTC milliseconds' }]);
+    }
+    const now = Date.parse(options.now);
+    const chain = [];
+    for (let i = 0; i < rawChain.length; i++) {
+        const failures = validateAuthorityDelegationShape(rawChain[i]).map(item => indexed(item, i));
+        if (failures.length > 0) {
+            const unsupported = failures.every(item => item.code === 'UNSUPPORTED_VERSION' || item.code === 'UNSUPPORTED_PROFILE');
+            return result(unsupported ? 'unsupported' : 'invalid', failures);
+        }
+        chain.push(rawChain[i]);
+    }
+    const seen = new Set();
+    for (let i = 0; i < chain.length; i++) {
+        const delegation = chain[i];
+        if (seen.has(delegation.delegation_id)) {
+            return result('invalid', [{ code: 'CHAIN_DUPLICATE_ID', index: i, message: 'delegation ID repeats in chain' }]);
+        }
+        seen.add(delegation.delegation_id);
+        const expectedId = computeAuthorityDelegationId(authorityDelegationBody(delegation));
+        if (expectedId !== delegation.delegation_id) {
+            return result('invalid', [{ code: 'ID_MISMATCH', index: i, message: 'delegation content address does not match body' }]);
+        }
+        let publicKey = null;
+        try {
+            publicKey = options.resolveVerificationKey(delegation.issuer, delegation.verification_method, delegation.issued_at);
+        }
+        catch {
+            publicKey = null;
+        }
+        if (publicKey === null) {
+            return result('indeterminate', [{ code: 'KEY_RESOLUTION_FAILED', index: i, message: 'issuer verification key could not be resolved' }]);
+        }
+        if (!verifyAuthorityDelegationSignature(delegation, publicKey)) {
+            return result('invalid', [{ code: 'SIGNATURE_INVALID', index: i, message: 'Ed25519 signature is invalid' }]);
+        }
+    }
+    const root = chain[0];
+    if (root.parent_delegation_id !== null) {
+        return result('invalid', [{ code: 'PARENT_MISMATCH', index: 0, message: 'full chain root must carry null parent_delegation_id' }]);
+    }
+    if (typeof options.trustRoot !== 'function') {
+        return result('indeterminate', [{ code: 'ROOT_UNTRUSTED', index: 0, message: 'root trust policy is unavailable' }]);
+    }
+    let trustDecision;
+    try {
+        trustDecision = options.trustRoot(root);
+    }
+    catch {
+        return result('indeterminate', [{ code: 'ROOT_UNTRUSTED', index: 0, message: 'root trust policy could not decide' }]);
+    }
+    if (typeof trustDecision !== 'boolean') {
+        return result('indeterminate', [{ code: 'ROOT_UNTRUSTED', index: 0, message: 'root trust policy returned no boolean decision' }]);
+    }
+    if (!trustDecision) {
+        return result('invalid', [{ code: 'ROOT_UNTRUSTED', index: 0, message: 'root is not accepted by verifier trust policy' }]);
+    }
+    for (let i = 1; i < chain.length; i++) {
+        const parent = chain[i - 1];
+        const child = chain[i];
+        if (child.parent_delegation_id !== parent.delegation_id) {
+            return result('invalid', [{ code: 'PARENT_MISMATCH', index: i, message: 'child does not name immediate parent content address' }]);
+        }
+        if (child.issuer !== parent.subject) {
+            return result('invalid', [{ code: 'CHAIN_CONTINUITY', index: i, message: 'child issuer is not parent subject' }]);
+        }
+        const issued = Date.parse(child.issued_at);
+        if (issued < Date.parse(parent.authority.time.not_before) ||
+            issued >= Date.parse(parent.authority.time.not_after)) {
+            return result('invalid', [{ code: 'ISSUED_AT_OUTSIDE_PARENT', index: i, message: 'child was issued outside parent validity window' }]);
+        }
+        const attenuationFailures = compareAuthority(parent.authority, child.authority);
+        if (attenuationFailures.length > 0) {
+            const indexedFailures = attenuationFailures.map(item => indexed(item, i));
+            const unsupported = indexedFailures.every(item => item.code === 'UNSUPPORTED_PROFILE');
+            return result(unsupported ? 'unsupported' : 'invalid', indexedFailures);
+        }
+    }
+    for (let i = 0; i < chain.length; i++) {
+        const delegation = chain[i];
+        if (now < Date.parse(delegation.authority.time.not_before)) {
+            return result('invalid', [{ code: 'NOT_YET_VALID', index: i, message: 'delegation is not yet valid' }]);
+        }
+        if (now >= Date.parse(delegation.authority.time.not_after)) {
+            return result('invalid', [{ code: 'EXPIRED', index: i, message: 'delegation has expired' }]);
+        }
+        let revocation = 'unknown';
+        try {
+            const resolved = options.resolveRevocation(delegation);
+            revocation = resolved === 'active' || resolved === 'revoked' ? resolved : 'unknown';
+        }
+        catch {
+            revocation = 'unknown';
+        }
+        if (revocation === 'revoked') {
+            return result('invalid', [{ code: 'REVOKED', index: i, message: 'delegation is revoked' }]);
+        }
+        if (revocation === 'unknown') {
+            return result('indeterminate', [{ code: 'REVOCATION_UNKNOWN', index: i, message: 'revocation status is unknown' }]);
+        }
+    }
+    return result('valid', []);
+}
+export function verifyAuthorityDelegation(delegation, options) {
+    return verifyAuthorityDelegationChain([delegation], options);
+}
+//# sourceMappingURL=verify.js.map