agent-passport-system 4.1.1 → 4.2.0

package/dist/src/v2/authority-delegation/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/verify.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,kCAAkC,GACnC,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,EAAE,oBAAoB,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAA;AASpF,SAAS,MAAM,CAAC,KAA+B,EAAE,QAA4B;IAC3E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,EAAE,QAAQ,EAAE,CAAA;AACtD,CAAC;AAED,SAAS,OAAO,CAAC,OAAyB,EAAE,KAAa;IACvD,OAAO,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAA;AAC9B,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,8BAA8B,CAC5C,QAA4B,EAC5B,OAA0C;IAE1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC/E,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC,CAAC,CAAA;IAC7G,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,uDAAuD,EAAE,CAAC,CAAC,CAAA;IAC9H,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAEnC,MAAM,KAAK,GAA4B,EAAE,CAAA;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,gCAAgC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC5F,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,qBAAqB,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAA;YACtH,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QAClE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAA0B,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACvC,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAC,CAAA;QACjH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAAA;QAClC,MAAM,UAAU,GAAG,4BAA4B,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC,CAAA;QACpF,IAAI,UAAU,KAAK,UAAU,CAAC,aAAa,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC,CAAC,CAAA;QAC1H,CAAC;QACD,IAAI,SAAS,GAAkB,IAAI,CAAA;QACnC,IAAI,CAAC;YACH,SAAS,GAAG,OAAO,CAAC,sBAAsB,CACxC,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,mBAAmB,EAC9B,UAAU,CAAC,SAAS,CACrB,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,IAAI,CAAA;QAClB,CAAC;QACD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAAC,CAAA;QACzI,CAAC;QACD,IAAI,CAAC,kCAAkC,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC;YAC/D,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC,CAAA;QAC9G,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACrB,IAAI,IAAI,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC,CAAC,CAAA;IACpI,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAC,CAAA;IACrH,CAAC;IACD,IAAI,aAAsB,CAAA;IAC1B,IAAI,CAAC;QAAC,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QACrD,OAAO,MAAM,CAAC,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC,CAAA;IACvH,CAAC;IACD,IAAI,OAAO,aAAa,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC,CAAC,CAAA;IACnI,CAAC;IACD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAAC,CAAA;IAC5H,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACtB,IAAI,KAAK,CAAC,oBAAoB,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;YACxD,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC,CAAC,CAAA;QACpI,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC,CAAA;QACnH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAC1C,IAAI,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;YACrD,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1D,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC,CAAC,CAAA;QACxI,CAAC;QACD,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAA;QAC/E,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,eAAe,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YACzE,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAA;YACtF,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;QACzE,CAAC;IACH,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAC3B,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3D,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAA;QACzG,CAAC;QACD,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAA;QAC9F,CAAC;QACD,IAAI,UAAU,GAAqC,SAAS,CAAA;QAC5D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;YACtD,UAAU,GAAG,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;QACrF,CAAC;QAAC,MAAM,CAAC;YAAC,UAAU,GAAG,SAAS,CAAA;QAAC,CAAC;QAClC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAA;QAC7F,CAAC;QACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC,CAAA;QACrH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;AAC5B,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,UAAmB,EACnB,OAA0C;IAE1C,OAAO,8BAA8B,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAA;AAC9D,CAAC"}

package/dist/src/v2/identity-binding/did-aps.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Legacy APS self-certifying identifier support. New PassportV2 issuance uses
+ * did:key by default; this parser exists so previously emitted did:aps values
+ * remain verifiable without implying that their identifier survives rotation.
+ */
+export declare function legacyDidApsFromPublicKey(publicKeyHex: string): string;
+export declare function publicKeyFromLegacyDidAps(did: string): string;
+export declare function publicKeyFromDidKey(did: string): string;
+export declare function didKeyFromPublicKey(publicKeyHex: string): string;
+export declare function selfCertifyingPublicKey(did: string): string | null;
+export declare function defaultVerificationMethod(agentId: string): string;
+//# sourceMappingURL=did-aps.d.ts.map

package/dist/src/v2/identity-binding/did-aps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"did-aps.d.ts","sourceRoot":"","sources":["../../../../src/v2/identity-binding/did-aps.ts"],"names":[],"mappings":"AAKA;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAGtE;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAU7D;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMvD;AAED,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAGhE;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIlE;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGjE"}

package/dist/src/v2/identity-binding/did-aps.js

@@ -0,0 +1,53 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { hexToMultibase, multibaseToHex } from '../../core/did.js';
+/**
+ * Legacy APS self-certifying identifier support. New PassportV2 issuance uses
+ * did:key by default; this parser exists so previously emitted did:aps values
+ * remain verifiable without implying that their identifier survives rotation.
+ */
+export function legacyDidApsFromPublicKey(publicKeyHex) {
+    assertEd25519PublicKey(publicKeyHex);
+    return `did:aps:${hexToMultibase(publicKeyHex)}`;
+}
+export function publicKeyFromLegacyDidAps(did) {
+    if (!/^did:aps:z[1-9A-HJ-NP-Za-km-z]+$/.test(did)) {
+        throw new Error('Invalid did:aps identifier');
+    }
+    const publicKey = multibaseToHex(did.slice('did:aps:'.length));
+    assertEd25519PublicKey(publicKey);
+    if (legacyDidApsFromPublicKey(publicKey) !== did) {
+        throw new Error('Non-canonical did:aps identifier');
+    }
+    return publicKey;
+}
+export function publicKeyFromDidKey(did) {
+    if (!/^did:key:z[1-9A-HJ-NP-Za-km-z]+$/.test(did))
+        throw new Error('Invalid did:key identifier');
+    const publicKey = multibaseToHex(did.slice('did:key:'.length));
+    assertEd25519PublicKey(publicKey);
+    if (didKeyFromPublicKey(publicKey) !== did)
+        throw new Error('Non-canonical did:key identifier');
+    return publicKey;
+}
+export function didKeyFromPublicKey(publicKeyHex) {
+    assertEd25519PublicKey(publicKeyHex);
+    return `did:key:${hexToMultibase(publicKeyHex)}`;
+}
+export function selfCertifyingPublicKey(did) {
+    if (did.startsWith('did:key:'))
+        return publicKeyFromDidKey(did);
+    if (did.startsWith('did:aps:'))
+        return publicKeyFromLegacyDidAps(did);
+    return null;
+}
+export function defaultVerificationMethod(agentId) {
+    if (agentId.startsWith('did:key:'))
+        return `${agentId}#${agentId.slice('did:key:'.length)}`;
+    return `${agentId}#key-1`;
+}
+function assertEd25519PublicKey(value) {
+    if (!/^[0-9a-f]{64}$/.test(value))
+        throw new Error('Invalid Ed25519 public key');
+}
+//# sourceMappingURL=did-aps.js.map

package/dist/src/v2/identity-binding/did-aps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"did-aps.js","sourceRoot":"","sources":["../../../../src/v2/identity-binding/did-aps.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAElE;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,YAAoB;IAC5D,sBAAsB,CAAC,YAAY,CAAC,CAAA;IACpC,OAAO,WAAW,cAAc,CAAC,YAAY,CAAC,EAAE,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;IAC9D,sBAAsB,CAAC,SAAS,CAAC,CAAA;IACjC,IAAI,yBAAyB,CAAC,SAAS,CAAC,KAAK,GAAG,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IACrD,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAChG,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;IAC9D,sBAAsB,CAAC,SAAS,CAAC,CAAA;IACjC,IAAI,mBAAmB,CAAC,SAAS,CAAC,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IAC/F,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,YAAoB;IACtD,sBAAsB,CAAC,YAAY,CAAC,CAAA;IACpC,OAAO,WAAW,cAAc,CAAC,YAAY,CAAC,EAAE,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAA;IAC/D,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,yBAAyB,CAAC,GAAG,CAAC,CAAA;IACrE,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,GAAG,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAA;IAC3F,OAAO,GAAG,OAAO,QAAQ,CAAA;AAC3B,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;AAClF,CAAC"}

package/dist/src/v2/identity-binding/index.d.ts

@@ -0,0 +1,6 @@
+export * from './types.js';
+export * from './did-aps.js';
+export * from './passport.js';
+export * from './principal-binding.js';
+export * from './revocation.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/v2/identity-binding/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/v2/identity-binding/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,iBAAiB,CAAA"}

package/dist/src/v2/identity-binding/index.js

@@ -0,0 +1,6 @@
+export * from './types.js';
+export * from './did-aps.js';
+export * from './passport.js';
+export * from './principal-binding.js';
+export * from './revocation.js';
+//# sourceMappingURL=index.js.map

package/dist/src/v2/identity-binding/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/v2/identity-binding/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,iBAAiB,CAAA"}

package/dist/src/v2/identity-binding/passport.d.ts

@@ -0,0 +1,18 @@
+import type { HistoricalKeyResolver, IdentityVerificationResult, PassportV2 } from './types.js';
+export interface IssuePassportV2Input {
+    public_key_hex: string;
+    private_key_hex: string;
+    agent_id?: string;
+    verification_method?: string;
+    issued_at: string;
+    expires_at: string;
+    nonce: string;
+    display_name?: string;
+    capabilities?: readonly string[];
+}
+export declare function issuePassportV2(input: IssuePassportV2Input): PassportV2;
+export declare function verifyPassportV2(candidate: unknown, options?: {
+    now?: string;
+    resolve_key?: HistoricalKeyResolver;
+}): Promise<IdentityVerificationResult>;
+//# sourceMappingURL=passport.d.ts.map

package/dist/src/v2/identity-binding/passport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passport.d.ts","sourceRoot":"","sources":["../../../../src/v2/identity-binding/passport.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACV,qBAAqB,EACrB,0BAA0B,EAC1B,UAAU,EACX,MAAM,YAAY,CAAA;AAcnB,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACjC;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,UAAU,CAsBvE;AAED,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,OAAO,EAClB,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,qBAAqB,CAAA;CAAO,GAClE,OAAO,CAAC,0BAA0B,CAAC,CAgErC"}

package/dist/src/v2/identity-binding/passport.js

@@ -0,0 +1,144 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { createHash } from 'node:crypto';
+import { canonicalizeJCS } from '../../core/canonical-jcs.js';
+import { sign, verify } from '../../crypto/keys.js';
+import { hexToMultibase, multibaseToHex } from '../../core/did.js';
+import { defaultVerificationMethod, didKeyFromPublicKey, selfCertifyingPublicKey, } from './did-aps.js';
+import { assertExactKeys, assertHex, assertIJson, assertPlainRecord, assertSortedUnique, assertUtcMilliseconds, sortedUnique, } from './validation.js';
+const ID_DOMAIN = 'APS-PASSPORT-ID-V2\0';
+const SIGNATURE_DOMAIN = 'APS-PASSPORT-SIG-V2\0';
+export function issuePassportV2(input) {
+    assertHex(input.public_key_hex, 64, 'public_key_hex');
+    const agentId = input.agent_id ?? didKeyFromPublicKey(input.public_key_hex);
+    const draft = {
+        record_type: 'aps.agent-passport',
+        version: '2.0',
+        agent_id: agentId,
+        verification_method: input.verification_method ?? defaultVerificationMethod(agentId),
+        public_key_multibase: hexToMultibase(input.public_key_hex),
+        issued_at: input.issued_at,
+        expires_at: input.expires_at,
+        nonce: input.nonce,
+        self_asserted: {
+            ...(input.display_name === undefined ? {} : { display_name: input.display_name }),
+            capabilities: sortedUnique(input.capabilities ?? [], 'self_asserted.capabilities'),
+        },
+    };
+    validatePassportDraft(draft);
+    const passportId = digest(ID_DOMAIN + canonicalizeJCS(draft));
+    const withId = { ...draft, passport_id: passportId };
+    const signature = sign(SIGNATURE_DOMAIN + canonicalizeJCS(withId), input.private_key_hex);
+    return { ...withId, signature };
+}
+export async function verifyPassportV2(candidate, options = {}) {
+    let passport;
+    try {
+        passport = validatePassport(candidate);
+    }
+    catch {
+        return invalid('PASSPORT_MALFORMED');
+    }
+    const idForm = omit(passport, ['passport_id', 'signature']);
+    if (digest(ID_DOMAIN + canonicalizeJCS(idForm)) !== passport.passport_id) {
+        return invalid('PASSPORT_ID_MISMATCH');
+    }
+    const publicKey = multibaseToHex(passport.public_key_multibase);
+    const signatureForm = omit(passport, ['signature']);
+    if (!verify(SIGNATURE_DOMAIN + canonicalizeJCS(signatureForm), passport.signature, publicKey)) {
+        return invalid('PASSPORT_SIGNATURE_INVALID');
+    }
+    const now = options.now ?? new Date().toISOString();
+    if (now < passport.issued_at || now >= passport.expires_at) {
+        return { ...invalid('PASSPORT_NOT_CURRENT'), proof_of_possession: true };
+    }
+    const derived = selfCertifyingPublicKey(passport.agent_id);
+    if (derived !== null) {
+        if (derived !== publicKey) {
+            return {
+                ...invalid('PASSPORT_KEY_AUTHORITY_REJECTED'),
+                proof_of_possession: true,
+                key_authority: 'rejected',
+            };
+        }
+        return { state: 'valid', code: 'OK', proof_of_possession: true, key_authority: 'verified' };
+    }
+    if (!options.resolve_key) {
+        return {
+            state: 'indeterminate',
+            code: 'PASSPORT_KEY_AUTHORITY_UNRESOLVED',
+            proof_of_possession: true,
+            key_authority: 'unresolved',
+        };
+    }
+    const resolution = await options.resolve_key({
+        controller: passport.agent_id,
+        verification_method: passport.verification_method,
+        at: passport.issued_at,
+    });
+    if (resolution.state !== 'resolved' || !resolution.public_key_hex) {
+        return {
+            state: resolution.state === 'unreachable' ? 'indeterminate' : 'invalid',
+            code: `PASSPORT_KEY_${resolution.state.toUpperCase()}`,
+            proof_of_possession: true,
+            key_authority: resolution.state === 'unreachable' ? 'unresolved' : 'rejected',
+        };
+    }
+    if (resolution.public_key_hex !== publicKey) {
+        return {
+            ...invalid('PASSPORT_KEY_AUTHORITY_REJECTED'),
+            proof_of_possession: true,
+            key_authority: 'rejected',
+        };
+    }
+    return { state: 'valid', code: 'OK', proof_of_possession: true, key_authority: 'verified' };
+}
+function validatePassport(value) {
+    assertPlainRecord(value, 'passport');
+    assertExactKeys(value, [
+        'record_type', 'version', 'passport_id', 'agent_id', 'verification_method',
+        'public_key_multibase', 'issued_at', 'expires_at', 'nonce', 'self_asserted', 'signature',
+    ], [], 'passport');
+    validatePassportDraft(value);
+    assertHex(String(value.passport_id), 64, 'passport_id');
+    assertHex(String(value.signature), 128, 'signature');
+    return value;
+}
+function validatePassportDraft(value) {
+    assertIJson(value);
+    if (value.record_type !== 'aps.agent-passport' || value.version !== '2.0')
+        throw new Error('passport profile');
+    if (!/^did:[a-z0-9]+:.+$/.test(value.agent_id))
+        throw new Error('agent_id');
+    if (!value.verification_method.startsWith(`${value.agent_id}#`))
+        throw new Error('verification_method');
+    const key = multibaseToHex(value.public_key_multibase);
+    assertHex(key, 64, 'public_key_multibase');
+    assertUtcMilliseconds(value.issued_at, 'issued_at');
+    assertUtcMilliseconds(value.expires_at, 'expires_at');
+    if (value.issued_at >= value.expires_at)
+        throw new Error('passport time window');
+    assertHex(value.nonce, 32, 'nonce');
+    assertPlainRecord(value.self_asserted, 'self_asserted');
+    assertExactKeys(value.self_asserted, ['capabilities'], ['display_name'], 'self_asserted');
+    if (!Array.isArray(value.self_asserted.capabilities))
+        throw new Error('capabilities');
+    assertSortedUnique(value.self_asserted.capabilities, 'capabilities');
+    if (value.self_asserted.display_name !== undefined && typeof value.self_asserted.display_name !== 'string') {
+        throw new Error('display_name');
+    }
+}
+function digest(value) {
+    return createHash('sha256').update(value, 'utf8').digest('hex');
+}
+function omit(value, keys) {
+    const result = {};
+    for (const [key, entry] of Object.entries(value))
+        if (!keys.includes(key))
+            result[key] = entry;
+    return result;
+}
+function invalid(code) {
+    return { state: 'invalid', code, proof_of_possession: false, key_authority: 'rejected' };
+}
+//# sourceMappingURL=passport.js.map

package/dist/src/v2/identity-binding/passport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passport.js","sourceRoot":"","sources":["../../../../src/v2/identity-binding/passport.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,cAAc,CAAA;AAMrB,OAAO,EACL,eAAe,EACf,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,YAAY,GACb,MAAM,iBAAiB,CAAA;AAExB,MAAM,SAAS,GAAG,sBAAsB,CAAA;AACxC,MAAM,gBAAgB,GAAG,uBAAuB,CAAA;AAchD,MAAM,UAAU,eAAe,CAAC,KAA2B;IACzD,SAAS,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,EAAE,gBAAgB,CAAC,CAAA;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,IAAI,mBAAmB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;IAC3E,MAAM,KAAK,GAAkD;QAC3D,WAAW,EAAE,oBAAoB;QACjC,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,OAAO;QACjB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,IAAI,yBAAyB,CAAC,OAAO,CAAC;QACpF,oBAAoB,EAAE,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC;QAC1D,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,aAAa,EAAE;YACb,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;YACjF,YAAY,EAAE,YAAY,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,EAAE,4BAA4B,CAAC;SACnF;KACF,CAAA;IACD,qBAAqB,CAAC,KAAK,CAAC,CAAA;IAC5B,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAA;IAC7D,MAAM,MAAM,GAAkC,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,CAAA;IACnF,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,CAAA;IACzF,OAAO,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,CAAA;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAkB,EAClB,OAAO,GAA0D,EAAE;IAEnE,IAAI,QAAoB,CAAA;IACxB,IAAI,CAAC;QACH,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAA;IACtC,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;IAC3D,IAAI,MAAM,CAAC,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzE,OAAO,OAAO,CAAC,sBAAsB,CAAC,CAAA;IACxC,CAAC;IACD,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAA;IAC/D,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;IACnD,IAAI,CAAC,MAAM,CAAC,gBAAgB,GAAG,eAAe,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QAC9F,OAAO,OAAO,CAAC,4BAA4B,CAAC,CAAA;IAC9C,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACnD,IAAI,GAAG,GAAG,QAAQ,CAAC,SAAS,IAAI,GAAG,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC3D,OAAO,EAAE,GAAG,OAAO,CAAC,sBAAsB,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAA;IAC1E,CAAC;IAED,MAAM,OAAO,GAAG,uBAAuB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC1D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO;gBACL,GAAG,OAAO,CAAC,iCAAiC,CAAC;gBAC7C,mBAAmB,EAAE,IAAI;gBACzB,aAAa,EAAE,UAAU;aAC1B,CAAA;QACH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,CAAA;IAC7F,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,OAAO;YACL,KAAK,EAAE,eAAe;YACtB,IAAI,EAAE,mCAAmC;YACzC,mBAAmB,EAAE,IAAI;YACzB,aAAa,EAAE,YAAY;SAC5B,CAAA;IACH,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC;QAC3C,UAAU,EAAE,QAAQ,CAAC,QAAQ;QAC7B,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;QACjD,EAAE,EAAE,QAAQ,CAAC,SAAS;KACvB,CAAC,CAAA;IACF,IAAI,UAAU,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;QAClE,OAAO;YACL,KAAK,EAAE,UAAU,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;YACvE,IAAI,EAAE,gBAAgB,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE;YACtD,mBAAmB,EAAE,IAAI;YACzB,aAAa,EAAE,UAAU,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU;SAC9E,CAAA;IACH,CAAC;IACD,IAAI,UAAU,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC5C,OAAO;YACL,GAAG,OAAO,CAAC,iCAAiC,CAAC;YAC7C,mBAAmB,EAAE,IAAI;YACzB,aAAa,EAAE,UAAU;SAC1B,CAAA;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,CAAA;AAC7F,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,iBAAiB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IACpC,eAAe,CAAC,KAAK,EAAE;QACrB,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,qBAAqB;QAC1E,sBAAsB,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW;KACzF,EAAE,EAAE,EAAE,UAAU,CAAC,CAAA;IAClB,qBAAqB,CAAC,KAAiE,CAAC,CAAA;IACxF,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,aAAa,CAAC,CAAA;IACvD,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;IACpD,OAAO,KAA8B,CAAA;AACvC,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAoD;IACjF,WAAW,CAAC,KAAK,CAAC,CAAA;IAClB,IAAI,KAAK,CAAC,WAAW,KAAK,oBAAoB,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;IAC9G,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAA;IAC3E,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,QAAQ,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IACvG,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAA;IACtD,SAAS,CAAC,GAAG,EAAE,EAAE,EAAE,sBAAsB,CAAC,CAAA;IAC1C,qBAAqB,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IACnD,qBAAqB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;IACrD,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;IAChF,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;IACnC,iBAAiB,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC,CAAA;IACvD,eAAe,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,eAAe,CAAC,CAAA;IACzF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAA;IACrF,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAAA;IACpE,IAAI,KAAK,CAAC,aAAa,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,aAAa,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC3G,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAA;IACjC,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,IAAuB;IAClD,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAC9F,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,CAAA;AAC1F,CAAC"}

package/dist/src/v2/identity-binding/principal-binding.d.ts

@@ -0,0 +1,20 @@
+import type { HistoricalKeyResolver, IdentityVerificationResult, PrincipalBindingV1 } from './types.js';
+export interface IssuePrincipalBindingV1Input {
+    agent_id: string;
+    principal_id: string;
+    verification_method: string;
+    audiences: readonly string[];
+    authority_profiles: readonly string[];
+    status_uri: string;
+    issued_at: string;
+    expires_at: string;
+    nonce: string;
+    principal_private_key_hex: string;
+}
+export declare function issuePrincipalBindingV1(input: IssuePrincipalBindingV1Input): PrincipalBindingV1;
+export declare function verifyPrincipalBindingV1(candidate: unknown, options: {
+    now?: string;
+    resolve_key: HistoricalKeyResolver;
+    principal_is_externally_verified?: (principalId: string, at: string) => boolean | Promise<boolean>;
+}): Promise<IdentityVerificationResult>;
+//# sourceMappingURL=principal-binding.d.ts.map

package/dist/src/v2/identity-binding/principal-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-binding.d.ts","sourceRoot":"","sources":["../../../../src/v2/identity-binding/principal-binding.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,qBAAqB,EACrB,0BAA0B,EAC1B,kBAAkB,EAEnB,MAAM,YAAY,CAAA;AAcnB,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IAC5B,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,yBAAyB,EAAE,MAAM,CAAA;CAClC;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,4BAA4B,GAAG,kBAAkB,CAqB/F;AAED,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE;IACP,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,qBAAqB,CAAA;IAClC,gCAAgC,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACnG,GACA,OAAO,CAAC,0BAA0B,CAAC,CAiDrC"}

package/dist/src/v2/identity-binding/principal-binding.js

@@ -0,0 +1,128 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { createHash } from 'node:crypto';
+import { canonicalizeJCS } from '../../core/canonical-jcs.js';
+import { sign, verify } from '../../crypto/keys.js';
+import { assertExactKeys, assertHex, assertIJson, assertPlainRecord, assertSortedUnique, assertUtcMilliseconds, sortedUnique, } from './validation.js';
+const ID_DOMAIN = 'APS-PRINCIPAL-BINDING-ID-V1\0';
+const SIGNATURE_DOMAIN = 'APS-PRINCIPAL-BINDING-SIG-V1\0';
+export function issuePrincipalBindingV1(input) {
+    const draft = {
+        record_type: 'aps.principal-binding',
+        version: '1.0',
+        agent_id: input.agent_id,
+        principal_id: input.principal_id,
+        verification_method: input.verification_method,
+        audiences: sortedUnique(input.audiences, 'audiences'),
+        authority_profiles: sortedUnique(input.authority_profiles, 'authority_profiles'),
+        status_uri: input.status_uri,
+        issued_at: input.issued_at,
+        expires_at: input.expires_at,
+        nonce: input.nonce,
+    };
+    validateBindingDraft(draft);
+    const bindingId = digest(ID_DOMAIN + canonicalizeJCS(draft));
+    const withId = { ...draft, binding_id: bindingId };
+    return {
+        ...withId,
+        signature: sign(SIGNATURE_DOMAIN + canonicalizeJCS(withId), input.principal_private_key_hex),
+    };
+}
+export async function verifyPrincipalBindingV1(candidate, options) {
+    let binding;
+    try {
+        binding = validateBinding(candidate);
+    }
+    catch {
+        return invalid('PRINCIPAL_BINDING_MALFORMED');
+    }
+    const idForm = omit(binding, ['binding_id', 'signature']);
+    if (digest(ID_DOMAIN + canonicalizeJCS(idForm)) !== binding.binding_id) {
+        return invalid('PRINCIPAL_BINDING_ID_MISMATCH');
+    }
+    const now = options.now ?? new Date().toISOString();
+    if (now < binding.issued_at || now >= binding.expires_at) {
+        return invalid('PRINCIPAL_BINDING_NOT_CURRENT');
+    }
+    const resolution = await options.resolve_key({
+        controller: binding.principal_id,
+        verification_method: binding.verification_method,
+        at: binding.issued_at,
+    });
+    if (resolution.state !== 'resolved' || !resolution.public_key_hex) {
+        const indeterminate = resolution.state === 'unreachable';
+        return {
+            state: indeterminate ? 'indeterminate' : 'invalid',
+            code: `PRINCIPAL_BINDING_KEY_${resolution.state.toUpperCase()}`,
+            proof_of_possession: false,
+            key_authority: indeterminate ? 'unresolved' : 'rejected',
+        };
+    }
+    const signatureForm = omit(binding, ['signature']);
+    if (!verify(SIGNATURE_DOMAIN + canonicalizeJCS(signatureForm), binding.signature, resolution.public_key_hex)) {
+        return invalid('PRINCIPAL_BINDING_SIGNATURE_INVALID');
+    }
+    let claimLevel = 'principal_attested';
+    if (options.principal_is_externally_verified &&
+        await options.principal_is_externally_verified(binding.principal_id, binding.issued_at)) {
+        claimLevel = 'externally_verified_principal';
+    }
+    return {
+        state: 'valid',
+        code: 'OK',
+        proof_of_possession: true,
+        key_authority: 'verified',
+        principal_claim_level: claimLevel,
+    };
+}
+function validateBinding(value) {
+    assertPlainRecord(value, 'principal binding');
+    assertExactKeys(value, [
+        'record_type', 'version', 'binding_id', 'agent_id', 'principal_id',
+        'verification_method', 'audiences', 'authority_profiles', 'status_uri',
+        'issued_at', 'expires_at', 'nonce', 'signature',
+    ], [], 'principal binding');
+    validateBindingDraft(value);
+    assertHex(String(value.binding_id), 64, 'binding_id');
+    assertHex(String(value.signature), 128, 'signature');
+    return value;
+}
+function validateBindingDraft(value) {
+    assertIJson(value);
+    if (value.record_type !== 'aps.principal-binding' || value.version !== '1.0')
+        throw new Error('profile');
+    if (!/^did:[a-z0-9]+:.+$/.test(value.agent_id))
+        throw new Error('agent_id');
+    if (!/^did:[a-z0-9]+:.+$/.test(value.principal_id) && !/^https:\/\//.test(value.principal_id)) {
+        throw new Error('principal_id');
+    }
+    if (!value.verification_method.startsWith(`${value.principal_id}#`))
+        throw new Error('verification_method');
+    if (!Array.isArray(value.audiences) || value.audiences.length === 0)
+        throw new Error('audiences');
+    if (!Array.isArray(value.authority_profiles) || value.authority_profiles.length === 0)
+        throw new Error('authority_profiles');
+    assertSortedUnique(value.audiences, 'audiences');
+    assertSortedUnique(value.authority_profiles, 'authority_profiles');
+    if (!/^https:\/\//.test(value.status_uri))
+        throw new Error('status_uri');
+    assertUtcMilliseconds(value.issued_at, 'issued_at');
+    assertUtcMilliseconds(value.expires_at, 'expires_at');
+    if (value.issued_at >= value.expires_at)
+        throw new Error('binding time window');
+    assertHex(value.nonce, 32, 'nonce');
+}
+function digest(value) {
+    return createHash('sha256').update(value, 'utf8').digest('hex');
+}
+function omit(value, keys) {
+    const result = {};
+    for (const [key, entry] of Object.entries(value))
+        if (!keys.includes(key))
+            result[key] = entry;
+    return result;
+}
+function invalid(code) {
+    return { state: 'invalid', code, proof_of_possession: false, key_authority: 'rejected' };
+}
+//# sourceMappingURL=principal-binding.js.map

package/dist/src/v2/identity-binding/principal-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-binding.js","sourceRoot":"","sources":["../../../../src/v2/identity-binding/principal-binding.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAOnD,OAAO,EACL,eAAe,EACf,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,YAAY,GACb,MAAM,iBAAiB,CAAA;AAExB,MAAM,SAAS,GAAG,+BAA+B,CAAA;AACjD,MAAM,gBAAgB,GAAG,gCAAgC,CAAA;AAezD,MAAM,UAAU,uBAAuB,CAAC,KAAmC;IACzE,MAAM,KAAK,GAAyD;QAClE,WAAW,EAAE,uBAAuB;QACpC,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC;QACrD,kBAAkB,EAAE,YAAY,CAAC,KAAK,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;QAChF,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAA;IACD,oBAAoB,CAAC,KAAK,CAAC,CAAA;IAC3B,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAA;IAC5D,MAAM,MAAM,GAA0C,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,CAAA;IACzF,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,IAAI,CAAC,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,yBAAyB,CAAC;KAC7F,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,SAAkB,EAClB,OAIC;IAED,IAAI,OAA2B,CAAA;IAC/B,IAAI,CAAC;QACH,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,CAAA;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,6BAA6B,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAA;IACzD,IAAI,MAAM,CAAC,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;QACvE,OAAO,OAAO,CAAC,+BAA+B,CAAC,CAAA;IACjD,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACnD,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,GAAG,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACzD,OAAO,OAAO,CAAC,+BAA+B,CAAC,CAAA;IACjD,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC;QAC3C,UAAU,EAAE,OAAO,CAAC,YAAY;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,EAAE,EAAE,OAAO,CAAC,SAAS;KACtB,CAAC,CAAA;IACF,IAAI,UAAU,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;QAClE,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,KAAK,aAAa,CAAA;QACxD,OAAO;YACL,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;YAClD,IAAI,EAAE,yBAAyB,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE;YAC/D,mBAAmB,EAAE,KAAK;YAC1B,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU;SACzD,CAAA;IACH,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;IAClD,IAAI,CAAC,MAAM,CACT,gBAAgB,GAAG,eAAe,CAAC,aAAa,CAAC,EACjD,OAAO,CAAC,SAAS,EACjB,UAAU,CAAC,cAAc,CAC1B,EAAE,CAAC;QACF,OAAO,OAAO,CAAC,qCAAqC,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,UAAU,GAAwB,oBAAoB,CAAA;IAC1D,IAAI,OAAO,CAAC,gCAAgC;QACxC,MAAM,OAAO,CAAC,gCAAgC,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5F,UAAU,GAAG,+BAA+B,CAAA;IAC9C,CAAC;IACD,OAAO;QACL,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,IAAI;QACV,mBAAmB,EAAE,IAAI;QACzB,aAAa,EAAE,UAAU;QACzB,qBAAqB,EAAE,UAAU;KAClC,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,iBAAiB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAA;IAC7C,eAAe,CAAC,KAAK,EAAE;QACrB,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc;QAClE,qBAAqB,EAAE,WAAW,EAAE,oBAAoB,EAAE,YAAY;QACtE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW;KAChD,EAAE,EAAE,EAAE,mBAAmB,CAAC,CAAA;IAC3B,oBAAoB,CAAC,KAAwE,CAAC,CAAA;IAC9F,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,CAAA;IACrD,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;IACpD,OAAO,KAAsC,CAAA;AAC/C,CAAC;AAED,SAAS,oBAAoB,CAAC,KAA2D;IACvF,WAAW,CAAC,KAAK,CAAC,CAAA;IAClB,IAAI,KAAK,CAAC,WAAW,KAAK,uBAAuB,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAA;IACxG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAA;IAC3E,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAA;IACjC,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,YAAY,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IAC3G,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAA;IACjG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;IAC5H,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAChD,kBAAkB,CAAC,KAAK,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAA;IAClE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAA;IACxE,qBAAqB,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IACnD,qBAAqB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;IACrD,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IAC/E,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;AACrC,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,IAAuB;IAClD,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAC9F,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,CAAA;AAC1F,CAAC"}

package/dist/src/v2/identity-binding/revocation.d.ts

@@ -0,0 +1,12 @@
+import type { HistoricalKeyResolver, IdentityVerificationResult, PrincipalBindingRevocationV1 } from './types.js';
+export declare function issuePrincipalBindingRevocationV1(input: {
+    binding_id: string;
+    principal_id: string;
+    verification_method: string;
+    revoked_at: string;
+    reason_code: string;
+    nonce: string;
+    principal_private_key_hex: string;
+}): PrincipalBindingRevocationV1;
+export declare function verifyPrincipalBindingRevocationV1(candidate: unknown, resolveKey: HistoricalKeyResolver): Promise<IdentityVerificationResult>;
+//# sourceMappingURL=revocation.d.ts.map

package/dist/src/v2/identity-binding/revocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../../../../src/v2/identity-binding/revocation.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,qBAAqB,EACrB,0BAA0B,EAC1B,4BAA4B,EAC7B,MAAM,YAAY,CAAA;AAYnB,wBAAgB,iCAAiC,CAAC,KAAK,EAAE;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,yBAAyB,EAAE,MAAM,CAAA;CAClC,GAAG,4BAA4B,CAqB/B;AAED,wBAAsB,kCAAkC,CACtD,SAAS,EAAE,OAAO,EAClB,UAAU,EAAE,qBAAqB,GAChC,OAAO,CAAC,0BAA0B,CAAC,CAgCrC"}

package/dist/src/v2/identity-binding/revocation.js

@@ -0,0 +1,97 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { createHash } from 'node:crypto';
+import { canonicalizeJCS } from '../../core/canonical-jcs.js';
+import { sign, verify } from '../../crypto/keys.js';
+import { assertExactKeys, assertHex, assertIJson, assertPlainRecord, assertUtcMilliseconds, } from './validation.js';
+const ID_DOMAIN = 'APS-PRINCIPAL-BINDING-REVOCATION-ID-V1\0';
+const SIGNATURE_DOMAIN = 'APS-PRINCIPAL-BINDING-REVOCATION-SIG-V1\0';
+export function issuePrincipalBindingRevocationV1(input) {
+    const draft = {
+        record_type: 'aps.principal-binding-revocation',
+        version: '1.0',
+        binding_id: input.binding_id,
+        principal_id: input.principal_id,
+        verification_method: input.verification_method,
+        revoked_at: input.revoked_at,
+        reason_code: input.reason_code,
+        nonce: input.nonce,
+    };
+    validateRevocationDraft(draft);
+    const revocationId = digest(ID_DOMAIN + canonicalizeJCS(draft));
+    const withId = {
+        ...draft,
+        revocation_id: revocationId,
+    };
+    return {
+        ...withId,
+        signature: sign(SIGNATURE_DOMAIN + canonicalizeJCS(withId), input.principal_private_key_hex),
+    };
+}
+export async function verifyPrincipalBindingRevocationV1(candidate, resolveKey) {
+    let revocation;
+    try {
+        revocation = validateRevocation(candidate);
+    }
+    catch {
+        return invalid('PRINCIPAL_BINDING_REVOCATION_MALFORMED');
+    }
+    const idForm = omit(revocation, ['revocation_id', 'signature']);
+    if (digest(ID_DOMAIN + canonicalizeJCS(idForm)) !== revocation.revocation_id) {
+        return invalid('PRINCIPAL_BINDING_REVOCATION_ID_MISMATCH');
+    }
+    const resolution = await resolveKey({
+        controller: revocation.principal_id,
+        verification_method: revocation.verification_method,
+        at: revocation.revoked_at,
+    });
+    if (resolution.state !== 'resolved' || !resolution.public_key_hex) {
+        return {
+            state: resolution.state === 'unreachable' ? 'indeterminate' : 'invalid',
+            code: `PRINCIPAL_BINDING_REVOCATION_KEY_${resolution.state.toUpperCase()}`,
+            proof_of_possession: false,
+            key_authority: resolution.state === 'unreachable' ? 'unresolved' : 'rejected',
+        };
+    }
+    const signatureForm = omit(revocation, ['signature']);
+    if (!verify(SIGNATURE_DOMAIN + canonicalizeJCS(signatureForm), revocation.signature, resolution.public_key_hex))
+        return invalid('PRINCIPAL_BINDING_REVOCATION_SIGNATURE_INVALID');
+    return { state: 'valid', code: 'OK', proof_of_possession: true, key_authority: 'verified' };
+}
+function validateRevocation(value) {
+    assertPlainRecord(value, 'binding revocation');
+    assertExactKeys(value, [
+        'record_type', 'version', 'revocation_id', 'binding_id', 'principal_id',
+        'verification_method', 'revoked_at', 'reason_code', 'nonce', 'signature',
+    ], [], 'binding revocation');
+    validateRevocationDraft(value);
+    assertHex(String(value.revocation_id), 64, 'revocation_id');
+    assertHex(String(value.signature), 128, 'signature');
+    return value;
+}
+function validateRevocationDraft(value) {
+    assertIJson(value);
+    if (value.record_type !== 'aps.principal-binding-revocation' || value.version !== '1.0')
+        throw new Error('profile');
+    assertHex(value.binding_id, 64, 'binding_id');
+    if (!value.verification_method.startsWith(`${value.principal_id}#`))
+        throw new Error('verification_method');
+    assertUtcMilliseconds(value.revoked_at, 'revoked_at');
+    if (!/^[a-z][a-z0-9_.-]{0,63}$/.test(value.reason_code))
+        throw new Error('reason_code');
+    assertHex(value.nonce, 32, 'nonce');
+}
+function digest(value) {
+    return createHash('sha256').update(value, 'utf8').digest('hex');
+}
+function omit(value, keys) {
+    const result = {};
+    for (const [key, entry] of Object.entries(value))
+        if (!keys.includes(key))
+            result[key] = entry;
+    return result;
+}
+function invalid(code) {
+    return { state: 'invalid', code, proof_of_possession: false, key_authority: 'rejected' };
+}
+//# sourceMappingURL=revocation.js.map

package/dist/src/v2/identity-binding/revocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../../../../src/v2/identity-binding/revocation.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAMnD,OAAO,EACL,eAAe,EACf,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,iBAAiB,CAAA;AAExB,MAAM,SAAS,GAAG,0CAA0C,CAAA;AAC5D,MAAM,gBAAgB,GAAG,2CAA2C,CAAA;AAEpE,MAAM,UAAU,iCAAiC,CAAC,KAQjD;IACC,MAAM,KAAK,GAAsE;QAC/E,WAAW,EAAE,kCAAkC;QAC/C,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAA;IACD,uBAAuB,CAAC,KAAK,CAAC,CAAA;IAC9B,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAA;IAC/D,MAAM,MAAM,GAAoD;QAC9D,GAAG,KAAK;QACR,aAAa,EAAE,YAAY;KAC5B,CAAA;IACD,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,IAAI,CAAC,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,yBAAyB,CAAC;KAC7F,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,SAAkB,EAClB,UAAiC;IAEjC,IAAI,UAAwC,CAAA;IAC5C,IAAI,CAAC;QACH,UAAU,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,wCAAwC,CAAC,CAAA;IAC1D,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAA;IAC/D,IAAI,MAAM,CAAC,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,UAAU,CAAC,aAAa,EAAE,CAAC;QAC7E,OAAO,OAAO,CAAC,0CAA0C,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC;QAClC,UAAU,EAAE,UAAU,CAAC,YAAY;QACnC,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;QACnD,EAAE,EAAE,UAAU,CAAC,UAAU;KAC1B,CAAC,CAAA;IACF,IAAI,UAAU,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;QAClE,OAAO;YACL,KAAK,EAAE,UAAU,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;YACvE,IAAI,EAAE,oCAAoC,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE;YAC1E,mBAAmB,EAAE,KAAK;YAC1B,aAAa,EAAE,UAAU,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU;SAC9E,CAAA;IACH,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;IACrD,IAAI,CAAC,MAAM,CACT,gBAAgB,GAAG,eAAe,CAAC,aAAa,CAAC,EACjD,UAAU,CAAC,SAAS,EACpB,UAAU,CAAC,cAAc,CAC1B;QAAE,OAAO,OAAO,CAAC,gDAAgD,CAAC,CAAA;IAEnE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,CAAA;AAC7F,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,iBAAiB,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAA;IAC9C,eAAe,CAAC,KAAK,EAAE;QACrB,aAAa,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc;QACvE,qBAAqB,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW;KACzE,EAAE,EAAE,EAAE,oBAAoB,CAAC,CAAA;IAC5B,uBAAuB,CAAC,KAAqF,CAAC,CAAA;IAC9G,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,CAAA;IAC3D,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;IACpD,OAAO,KAAgD,CAAA;AACzD,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAwE;IACvG,WAAW,CAAC,KAAK,CAAC,CAAA;IAClB,IAAI,KAAK,CAAC,WAAW,KAAK,kCAAkC,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAA;IACnH,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,YAAY,CAAC,CAAA;IAC7C,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,YAAY,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IAC3G,qBAAqB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;IACrD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAA;IACvF,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;AACrC,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,IAAuB;IAClD,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAC9F,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,CAAA;AAC1F,CAAC"}