npm - agent-passport-system - Versions diffs - 7.2.1 → 8.0.0 - Mend

agent-passport-system 7.2.1 → 8.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (59) hide show

package/dist/src/v2/identity-binding/principal-binding.js CHANGED Viewed

@@ -4,8 +4,11 @@ import { createHash } from 'node:crypto';
 import { canonicalizeJCS } from '../../core/canonical-jcs.js';
 import { sign, verify } from '../../crypto/keys.js';
 import { assertExactKeys, assertHex, assertIJson, assertPlainRecord, assertSortedUnique, assertUtcMilliseconds, sortedUnique, } from './validation.js';
+import { classifyResolution } from './resolution-outcome.js';
+import { unrecognisedProfile } from './profile-recognition.js';
 const ID_DOMAIN = 'APS-PRINCIPAL-BINDING-ID-V1\0';
 const SIGNATURE_DOMAIN = 'APS-PRINCIPAL-BINDING-SIG-V1\0';
+const PROFILE = { record_type: 'aps.principal-binding', version: '1.0', code_prefix: 'PRINCIPAL_BINDING' };
 export function issuePrincipalBindingV1(input) {
     const draft = {
         record_type: 'aps.principal-binding',
@@ -29,6 +32,11 @@ export function issuePrincipalBindingV1(input) {
     };
 }
 export async function verifyPrincipalBindingV1(candidate, options) {
+    // A string record_type or version this verifier does not implement is unsupported, and is
+    // neither judged against the 1.0 schema nor sent to the key resolver (profile-recognition.ts).
+    const profile = unrecognisedProfile(candidate, PROFILE);
+    if (profile)
+        return profile;
     let binding;
     try {
         binding = validateBinding(candidate);
@@ -44,22 +52,31 @@ export async function verifyPrincipalBindingV1(candidate, options) {
     if (now < binding.issued_at || now >= binding.expires_at) {
         return invalid('PRINCIPAL_BINDING_NOT_CURRENT');
     }
-    const resolution = await options.resolve_key({
-        controller: binding.principal_id,
-        verification_method: binding.verification_method,
-        at: binding.issued_at,
-    });
-    if (resolution.state !== 'resolved' || !resolution.public_key_hex) {
-        const indeterminate = resolution.state === 'unreachable';
+    // A resolver that throws is treated like an answer outside the resolver contract.
+    let resolution;
+    try {
+        resolution = await options.resolve_key({
+            controller: binding.principal_id,
+            verification_method: binding.verification_method,
+            at: binding.issued_at,
+        });
+    }
+    catch {
+        resolution = undefined;
+    }
+    // Same section 3.5 mapping as verifyPassportV2 (see resolution-outcome.ts). No
+    // signature was checked in these branches, so none of them is a signature failure.
+    const classified = classifyResolution(resolution);
+    if (!classified.ok) {
         return {
-            state: indeterminate ? 'indeterminate' : 'invalid',
-            code: `PRINCIPAL_BINDING_KEY_${resolution.state.toUpperCase()}`,
+            state: classified.failure.state,
+            code: `PRINCIPAL_BINDING_KEY_${classified.failure.outcome}`,
             proof_of_possession: false,
-            key_authority: indeterminate ? 'unresolved' : 'rejected',
+            key_authority: 'unresolved',
         };
     }
     const signatureForm = omit(binding, ['signature']);
-    if (!verify(SIGNATURE_DOMAIN + canonicalizeJCS(signatureForm), binding.signature, resolution.public_key_hex)) {
+    if (!verify(SIGNATURE_DOMAIN + canonicalizeJCS(signatureForm), binding.signature, classified.public_key_hex)) {
         return invalid('PRINCIPAL_BINDING_SIGNATURE_INVALID');
     }
     let claimLevel = 'principal_attested';

package/dist/src/v2/identity-binding/principal-binding.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"principal-binding.js","sourceRoot":"","sources":["../../../../src/v2/identity-binding/principal-binding.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAOnD,OAAO,EACL,eAAe,EACf,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,YAAY,GACb,MAAM,iBAAiB,CAAA;~~AAExB~~,MAAM,SAAS,GAAG,+BAA+B,CAAA;AACjD,MAAM,gBAAgB,GAAG,gCAAgC,CAAA;~~AAezD~~,MAAM,UAAU,uBAAuB,CAAC,KAAmC;IACzE,MAAM,KAAK,GAAyD;QAClE,WAAW,EAAE,uBAAuB;QACpC,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC;QACrD,kBAAkB,EAAE,YAAY,CAAC,KAAK,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;QAChF,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAA;IACD,oBAAoB,CAAC,KAAK,CAAC,CAAA;IAC3B,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAA;IAC5D,MAAM,MAAM,GAA0C,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,CAAA;IACzF,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,IAAI,CAAC,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,yBAAyB,CAAC;KAC7F,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,SAAkB,EAClB,OAIC;IAED,IAAI,OAA2B,CAAA;IAC/B,IAAI,CAAC;QACH,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,CAAA;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,6BAA6B,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAA;IACzD,IAAI,MAAM,CAAC,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;QACvE,OAAO,OAAO,CAAC,+BAA+B,CAAC,CAAA;IACjD,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACnD,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,GAAG,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACzD,OAAO,OAAO,CAAC,+BAA+B,CAAC,CAAA;IACjD,CAAC;IACD,~~MAAM~~,UAAU,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC;~~QAC3C~~,UAAU,EAAE,OAAO,CAAC,YAAY;~~QAChC~~,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;~~QAChD~~,EAAE,EAAE,OAAO,CAAC,SAAS;~~KACtB~~,CAAC,CAAA;~~IACF~~,~~IAAI~~,UAAU,CAAC,~~KAAK~~,~~KAAK~~,UAAU,~~IAAI~~,CAAC,UAAU,CAAC,~~cAAc~~,~~EAAE~~,CAAC~~;QAClE~~,~~MAAM,aAAa,GAAG,~~UAAU,CAAC,~~KAAK~~,~~KAAK~~,~~aAAa,CAAA~~;~~QACxD~~,OAAO;YACL,KAAK,EAAE,~~aAAa~~,CAAC,~~CAAC~~,CAAC,~~eAAe,CAAC,CAAC,CAAC,SAAS~~;~~YAClD~~,IAAI,EAAE,yBAAyB,UAAU,CAAC,~~KAAK~~,CAAC,~~WAAW~~,EAAE~~,EAAE~~;~~YAC/D~~,mBAAmB,EAAE,KAAK;YAC1B,aAAa,EAAE,~~aAAa,CAAC,CAAC,CAAC,~~YAAY~~,CAAC,CAAC,CAAC,UAAU~~;~~SACzD~~,CAAA;IACH,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;IAClD,IAAI,CAAC,MAAM,CACT,gBAAgB,GAAG,eAAe,CAAC,aAAa,CAAC,EACjD,OAAO,CAAC,SAAS,EACjB,UAAU,CAAC,cAAc,CAC1B,EAAE,CAAC;QACF,OAAO,OAAO,CAAC,qCAAqC,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,UAAU,GAAwB,oBAAoB,CAAA;IAC1D,IAAI,OAAO,CAAC,gCAAgC;QACxC,MAAM,OAAO,CAAC,gCAAgC,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5F,UAAU,GAAG,+BAA+B,CAAA;IAC9C,CAAC;IACD,OAAO;QACL,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,IAAI;QACV,mBAAmB,EAAE,IAAI;QACzB,aAAa,EAAE,UAAU;QACzB,qBAAqB,EAAE,UAAU;KAClC,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,iBAAiB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAA;IAC7C,eAAe,CAAC,KAAK,EAAE;QACrB,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc;QAClE,qBAAqB,EAAE,WAAW,EAAE,oBAAoB,EAAE,YAAY;QACtE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW;KAChD,EAAE,EAAE,EAAE,mBAAmB,CAAC,CAAA;IAC3B,oBAAoB,CAAC,KAAwE,CAAC,CAAA;IAC9F,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,CAAA;IACrD,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;IACpD,OAAO,KAAsC,CAAA;AAC/C,CAAC;AAED,SAAS,oBAAoB,CAAC,KAA2D;IACvF,WAAW,CAAC,KAAK,CAAC,CAAA;IAClB,IAAI,KAAK,CAAC,WAAW,KAAK,uBAAuB,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAA;IACxG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAA;IAC3E,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAA;IACjC,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,YAAY,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IAC3G,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAA;IACjG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;IAC5H,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAChD,kBAAkB,CAAC,KAAK,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAA;IAClE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAA;IACxE,qBAAqB,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IACnD,qBAAqB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;IACrD,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IAC/E,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;AACrC,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,IAAuB;IAClD,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAC9F,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,CAAA;AAC1F,CAAC"}
1	+ {"version":3,"file":"principal-binding.js","sourceRoot":"","sources":["../../../../src/v2/identity-binding/principal-binding.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAOnD,OAAO,EACL,eAAe,EACf,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,YAAY,GACb,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAE9D,MAAM,SAAS,GAAG,+BAA+B,CAAA;AACjD,MAAM,gBAAgB,GAAG,gCAAgC,CAAA;AACzD,MAAM,OAAO,GAAG,EAAE,WAAW,EAAE,uBAAuB,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAA;AAe1G,MAAM,UAAU,uBAAuB,CAAC,KAAmC;IACzE,MAAM,KAAK,GAAyD;QAClE,WAAW,EAAE,uBAAuB;QACpC,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC;QACrD,kBAAkB,EAAE,YAAY,CAAC,KAAK,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;QAChF,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAA;IACD,oBAAoB,CAAC,KAAK,CAAC,CAAA;IAC3B,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAA;IAC5D,MAAM,MAAM,GAA0C,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,CAAA;IACzF,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,IAAI,CAAC,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,yBAAyB,CAAC;KAC7F,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,SAAkB,EAClB,OAIC;IAED,0FAA0F;IAC1F,+FAA+F;IAC/F,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IACvD,IAAI,OAAO;QAAE,OAAO,OAAO,CAAA;IAC3B,IAAI,OAA2B,CAAA;IAC/B,IAAI,CAAC;QACH,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,CAAA;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,6BAA6B,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAA;IACzD,IAAI,MAAM,CAAC,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;QACvE,OAAO,OAAO,CAAC,+BAA+B,CAAC,CAAA;IACjD,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACnD,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,GAAG,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACzD,OAAO,OAAO,CAAC,+BAA+B,CAAC,CAAA;IACjD,CAAC;IACD,kFAAkF;IAClF,IAAI,UAAmB,CAAA;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC;YACrC,UAAU,EAAE,OAAO,CAAC,YAAY;YAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,EAAE,EAAE,OAAO,CAAC,SAAS;SACtB,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,SAAS,CAAA;IACxB,CAAC;IACD,+EAA+E;IAC/E,mFAAmF;IACnF,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAA;IACjD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO;YACL,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK;YAC/B,IAAI,EAAE,yBAAyB,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE;YAC3D,mBAAmB,EAAE,KAAK;YAC1B,aAAa,EAAE,YAAY;SAC5B,CAAA;IACH,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;IAClD,IAAI,CAAC,MAAM,CACT,gBAAgB,GAAG,eAAe,CAAC,aAAa,CAAC,EACjD,OAAO,CAAC,SAAS,EACjB,UAAU,CAAC,cAAc,CAC1B,EAAE,CAAC;QACF,OAAO,OAAO,CAAC,qCAAqC,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,UAAU,GAAwB,oBAAoB,CAAA;IAC1D,IAAI,OAAO,CAAC,gCAAgC;QACxC,MAAM,OAAO,CAAC,gCAAgC,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5F,UAAU,GAAG,+BAA+B,CAAA;IAC9C,CAAC;IACD,OAAO;QACL,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,IAAI;QACV,mBAAmB,EAAE,IAAI;QACzB,aAAa,EAAE,UAAU;QACzB,qBAAqB,EAAE,UAAU;KAClC,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,iBAAiB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAA;IAC7C,eAAe,CAAC,KAAK,EAAE;QACrB,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc;QAClE,qBAAqB,EAAE,WAAW,EAAE,oBAAoB,EAAE,YAAY;QACtE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW;KAChD,EAAE,EAAE,EAAE,mBAAmB,CAAC,CAAA;IAC3B,oBAAoB,CAAC,KAAwE,CAAC,CAAA;IAC9F,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,CAAA;IACrD,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;IACpD,OAAO,KAAsC,CAAA;AAC/C,CAAC;AAED,SAAS,oBAAoB,CAAC,KAA2D;IACvF,WAAW,CAAC,KAAK,CAAC,CAAA;IAClB,IAAI,KAAK,CAAC,WAAW,KAAK,uBAAuB,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAA;IACxG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAA;IAC3E,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAA;IACjC,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,YAAY,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IAC3G,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAA;IACjG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;IAC5H,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAChD,kBAAkB,CAAC,KAAK,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAA;IAClE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAA;IACxE,qBAAqB,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IACnD,qBAAqB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;IACrD,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IAC/E,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;AACrC,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,IAAuB;IAClD,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAC9F,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,CAAA;AAC1F,CAAC"}

package/dist/src/v2/identity-binding/profile-recognition.d.ts ADDED Viewed

@@ -0,0 +1,25 @@
+import type { IdentityVerificationResult } from './types.js';
+/**
+ * Profile recognition before the schema, the rule draft-04 states for the delegation and
+ * revocation record families, shared by verifyPassportV2 and verifyPrincipalBindingV1.
+ *
+ * A string record_type other than the family's is unsupported whatever else the object
+ * carries. With the recognised record_type, a string version other than the implemented one
+ * is unsupported. An unsupported record is not judged against the schema and never reaches
+ * the key resolver.
+ *
+ * Everything else returns null and goes to the family's schema check, which reports it
+ * malformed: a value that is not a plain JSON object, a missing or non-string record_type,
+ * the recognised record_type with a missing or non-string version, and a broken shape. Both
+ * discriminators are read here once each, as own data properties, and an accessor on either
+ * is reported before the schema check reads them again, so an accessor never answers
+ * differently here and in the schema check. An accessor record_type is malformed. version
+ * is read only when record_type is the recognised one, so an accessor version is malformed
+ * only then, and an unknown record_type is unsupported whatever version holds.
+ */
+export declare function unrecognisedProfile(value: unknown, profile: {
+    record_type: string;
+    version: string;
+    code_prefix: string;
+}): IdentityVerificationResult | null;
+//# sourceMappingURL=profile-recognition.d.ts.map

package/dist/src/v2/identity-binding/profile-recognition.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"profile-recognition.d.ts","sourceRoot":"","sources":["../../../../src/v2/identity-binding/profile-recognition.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA;AAE5D;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACrE,0BAA0B,GAAG,IAAI,CAYnC"}

package/dist/src/v2/identity-binding/profile-recognition.js ADDED Viewed

@@ -0,0 +1,67 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Profile recognition before the schema, the rule draft-04 states for the delegation and
+ * revocation record families, shared by verifyPassportV2 and verifyPrincipalBindingV1.
+ *
+ * A string record_type other than the family's is unsupported whatever else the object
+ * carries. With the recognised record_type, a string version other than the implemented one
+ * is unsupported. An unsupported record is not judged against the schema and never reaches
+ * the key resolver.
+ *
+ * Everything else returns null and goes to the family's schema check, which reports it
+ * malformed: a value that is not a plain JSON object, a missing or non-string record_type,
+ * the recognised record_type with a missing or non-string version, and a broken shape. Both
+ * discriminators are read here once each, as own data properties, and an accessor on either
+ * is reported before the schema check reads them again, so an accessor never answers
+ * differently here and in the schema check. An accessor record_type is malformed. version
+ * is read only when record_type is the recognised one, so an accessor version is malformed
+ * only then, and an unknown record_type is unsupported whatever version holds.
+ */
+export function unrecognisedProfile(value, profile) {
+    const malformed = {
+        state: 'invalid', code: `${profile.code_prefix}_MALFORMED`, proof_of_possession: false, key_authority: 'rejected',
+    };
+    // A proxy can throw from its prototype or descriptor trap. That object is not a plain
+    // JSON object, so it is malformed, as the schema check would report it, and never an
+    // exception out of the verifier.
+    try {
+        return recognise(value, profile, malformed);
+    }
+    catch {
+        return malformed;
+    }
+}
+function recognise(value, profile, malformed) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null)
+        return null;
+    const recordType = ownData(value, 'record_type');
+    if (recordType === ACCESSOR)
+        return malformed;
+    if (typeof recordType !== 'string')
+        return null;
+    if (recordType !== profile.record_type) {
+        return { state: 'unsupported', code: `${profile.code_prefix}_UNSUPPORTED_RECORD_TYPE`, proof_of_possession: false, key_authority: 'unresolved' };
+    }
+    const version = ownData(value, 'version');
+    if (version === ACCESSOR)
+        return malformed;
+    if (typeof version !== 'string')
+        return null;
+    if (version !== profile.version) {
+        return { state: 'unsupported', code: `${profile.code_prefix}_UNSUPPORTED_VERSION`, proof_of_possession: false, key_authority: 'unresolved' };
+    }
+    return null;
+}
+const ACCESSOR = Symbol('accessor');
+/** The value of an own data property, undefined when absent, ACCESSOR for a getter or setter. */
+function ownData(value, key) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!descriptor)
+        return undefined;
+    return 'value' in descriptor ? descriptor.value : ACCESSOR;
+}
+//# sourceMappingURL=profile-recognition.js.map

package/dist/src/v2/identity-binding/profile-recognition.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"profile-recognition.js","sourceRoot":"","sources":["../../../../src/v2/identity-binding/profile-recognition.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAItC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAc,EACd,OAAsE;IAEtE,MAAM,SAAS,GAA+B;QAC5C,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,WAAW,YAAY,EAAE,mBAAmB,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU;KAClH,CAAA;IACD,sFAAsF;IACtF,qFAAqF;IACrF,iCAAiC;IACjC,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAChB,KAAc,EACd,OAAsE,EACtE,SAAqC;IAErC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACpF,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;IAC9C,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACrE,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC,CAAA;IAChD,IAAI,UAAU,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC/C,IAAI,UAAU,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;QACvC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,WAAW,0BAA0B,EAAE,mBAAmB,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,CAAA;IAClJ,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACzC,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC1C,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC5C,IAAI,OAAO,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;QAChC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,WAAW,sBAAsB,EAAE,mBAAmB,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,CAAA;IAC9I,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,CAAA;AAEnC,iGAAiG;AACjG,SAAS,OAAO,CAAC,KAAa,EAAE,GAAW;IACzC,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC9D,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAA;IACjC,OAAO,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAA;AAC5D,CAAC"}

package/dist/src/v2/identity-binding/resolution-outcome.d.ts ADDED Viewed

@@ -0,0 +1,23 @@
+import type { IdentityVerificationState } from './types.js';
+export interface ResolutionFailure {
+    state: Extract<IdentityVerificationState, 'indeterminate' | 'unsupported'>;
+    /** Suffix for the caller's code prefix, for example `NOT_FOUND` in `PASSPORT_KEY_NOT_FOUND`. */
+    outcome: 'NOT_FOUND' | 'AMBIGUOUS' | 'MALFORMED' | 'UNREACHABLE' | 'UNSUPPORTED' | 'RESOLUTION_FAILED';
+}
+/** Either the usable key, lowercased, or the failure to report. Computed once per answer. */
+export type ClassifiedResolution = {
+    ok: true;
+    public_key_hex: string;
+} | {
+    ok: false;
+    failure: ResolutionFailure;
+};
+/**
+ * Read a resolver answer once and classify it. Only own data properties are read, so a
+ * getter is never invoked and cannot throw or answer differently on a second read. An
+ * answer that is not a plain object, carries an accessor or a state outside the contract,
+ * or cannot be inspected at all, is RESOLUTION_FAILED. Callers use the returned key and
+ * never read the original answer again.
+ */
+export declare function classifyResolution(resolution: unknown): ClassifiedResolution;
+//# sourceMappingURL=resolution-outcome.d.ts.map

package/dist/src/v2/identity-binding/resolution-outcome.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"resolution-outcome.d.ts","sourceRoot":"","sources":["../../../../src/v2/identity-binding/resolution-outcome.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAA;AAK3D,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,CAAC,yBAAyB,EAAE,eAAe,GAAG,aAAa,CAAC,CAAA;IAC1E,gGAAgG;IAChG,OAAO,EAAE,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,aAAa,GAAG,aAAa,GAAG,mBAAmB,CAAA;CACvG;AAED,6FAA6F;AAC7F,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,CAAA;AAE7C;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,OAAO,GAAG,oBAAoB,CAoC5E"}

package/dist/src/v2/identity-binding/resolution-outcome.js ADDED Viewed

@@ -0,0 +1,69 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+//
+// How the identity-binding verifiers classify a historical key resolution that did not
+// produce usable key material. Draft-04 section 3.5 maps an unsupported identifier scheme
+// to unsupported, and a key or subject that is not found, an ambiguous answer,
+// structurally malformed key material and transport unreachability each to
+// indeterminate, under distinct outcome names. Section 3.4 routes the agent's own
+// retired-key case through the ambiguous outcome. The same mapping is applied here to
+// the agent's own key and to the principal's key: in none of these branches was a
+// signature checked against an established key, so nothing was learned about key
+// authority. The delegation and revocation verifiers in src/v2 already map the issuer's
+// key the same way.
+const KEY_HEX = /^[0-9a-fA-F]{64}$/;
+const STATES = new Set(['resolved', 'not_found', 'ambiguous', 'malformed', 'unreachable', 'unsupported']);
+/**
+ * Read a resolver answer once and classify it. Only own data properties are read, so a
+ * getter is never invoked and cannot throw or answer differently on a second read. An
+ * answer that is not a plain object, carries an accessor or a state outside the contract,
+ * or cannot be inspected at all, is RESOLUTION_FAILED. Callers use the returned key and
+ * never read the original answer again.
+ */
+export function classifyResolution(resolution) {
+    let state;
+    let key;
+    try {
+        if (resolution === null || typeof resolution !== 'object' || Array.isArray(resolution))
+            return failed();
+        // A plain object only, as documented (#228). Inside the try, so a throwing
+        // getPrototypeOf trap is RESOLUTION_FAILED like any other unreadable answer.
+        const prototype = Object.getPrototypeOf(resolution);
+        if (prototype !== Object.prototype && prototype !== null)
+            return failed();
+        const stateDescriptor = Object.getOwnPropertyDescriptor(resolution, 'state');
+        const keyDescriptor = Object.getOwnPropertyDescriptor(resolution, 'public_key_hex');
+        if (!stateDescriptor || !('value' in stateDescriptor))
+            return failed();
+        if (keyDescriptor && !('value' in keyDescriptor))
+            return failed();
+        state = stateDescriptor.value;
+        key = keyDescriptor?.value;
+    }
+    catch {
+        // A proxy trap can throw from getOwnPropertyDescriptor.
+        return failed();
+    }
+    if (typeof state !== 'string' || !STATES.has(state))
+        return failed();
+    switch (state) {
+        case 'resolved':
+            return typeof key === 'string' && KEY_HEX.test(key)
+                ? { ok: true, public_key_hex: key.toLowerCase() }
+                : { ok: false, failure: { state: 'indeterminate', outcome: 'MALFORMED' } };
+        case 'unsupported':
+            return { ok: false, failure: { state: 'unsupported', outcome: 'UNSUPPORTED' } };
+        case 'not_found':
+            return { ok: false, failure: { state: 'indeterminate', outcome: 'NOT_FOUND' } };
+        case 'ambiguous':
+            return { ok: false, failure: { state: 'indeterminate', outcome: 'AMBIGUOUS' } };
+        case 'malformed':
+            return { ok: false, failure: { state: 'indeterminate', outcome: 'MALFORMED' } };
+        default:
+            return { ok: false, failure: { state: 'indeterminate', outcome: 'UNREACHABLE' } };
+    }
+}
+function failed() {
+    return { ok: false, failure: { state: 'indeterminate', outcome: 'RESOLUTION_FAILED' } };
+}
+//# sourceMappingURL=resolution-outcome.js.map

package/dist/src/v2/identity-binding/resolution-outcome.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"resolution-outcome.js","sourceRoot":"","sources":["../../../../src/v2/identity-binding/resolution-outcome.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,EAAE;AACF,uFAAuF;AACvF,0FAA0F;AAC1F,+EAA+E;AAC/E,2EAA2E;AAC3E,kFAAkF;AAClF,sFAAsF;AACtF,kFAAkF;AAClF,iFAAiF;AACjF,wFAAwF;AACxF,oBAAoB;AAIpB,MAAM,OAAO,GAAG,mBAAmB,CAAA;AACnC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,CAAA;AAazG;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAmB;IACpD,IAAI,KAAc,CAAA;IAClB,IAAI,GAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;YAAE,OAAO,MAAM,EAAE,CAAA;QACvG,2EAA2E;QAC3E,6EAA6E;QAC7E,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;QACnD,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,MAAM,EAAE,CAAA;QACzE,MAAM,eAAe,GAAG,MAAM,CAAC,wBAAwB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QAC5E,MAAM,aAAa,GAAG,MAAM,CAAC,wBAAwB,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAA;QACnF,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,OAAO,IAAI,eAAe,CAAC;YAAE,OAAO,MAAM,EAAE,CAAA;QACtE,IAAI,aAAa,IAAI,CAAC,CAAC,OAAO,IAAI,aAAa,CAAC;YAAE,OAAO,MAAM,EAAE,CAAA;QACjE,KAAK,GAAG,eAAe,CAAC,KAAK,CAAA;QAC7B,GAAG,GAAG,aAAa,EAAE,KAAK,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;QACxD,OAAO,MAAM,EAAE,CAAA;IACjB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,EAAE,CAAA;IACpE,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,UAAU;YACb,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;gBACjD,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE;gBACjD,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAA;QAC9E,KAAK,aAAa;YAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAA;QACjF,KAAK,WAAW;YACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAA;QACjF,KAAK,WAAW;YACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAA;QACjF,KAAK,WAAW;YACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAA;QACjF;YACE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAA;IACrF,CAAC;AACH,CAAC;AAED,SAAS,MAAM;IACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,CAAA;AACzF,CAAC"}

package/dist/src/v2/identity-binding/revocation.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../../../../src/v2/identity-binding/revocation.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,qBAAqB,EACrB,0BAA0B,EAC1B,4BAA4B,EAC7B,MAAM,YAAY,CAAA;~~AAYnB~~,wBAAgB,iCAAiC,CAAC,KAAK,EAAE;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,yBAAyB,EAAE,MAAM,CAAA;CAClC,GAAG,4BAA4B,CAqB/B;AAED,wBAAsB,kCAAkC,CACtD,SAAS,EAAE,OAAO,EAClB,UAAU,EAAE,qBAAqB,GAChC,OAAO,CAAC,0BAA0B,CAAC,~~CAgCrC~~"}
1	+ {"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../../../../src/v2/identity-binding/revocation.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,qBAAqB,EACrB,0BAA0B,EAC1B,4BAA4B,EAC7B,MAAM,YAAY,CAAA;AAanB,wBAAgB,iCAAiC,CAAC,KAAK,EAAE;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,yBAAyB,EAAE,MAAM,CAAA;CAClC,GAAG,4BAA4B,CAqB/B;AAED,wBAAsB,kCAAkC,CACtD,SAAS,EAAE,OAAO,EAClB,UAAU,EAAE,qBAAqB,GAChC,OAAO,CAAC,0BAA0B,CAAC,CA8CrC"}

package/dist/src/v2/identity-binding/revocation.js CHANGED Viewed

@@ -4,6 +4,7 @@ import { createHash } from 'node:crypto';
 import { canonicalizeJCS } from '../../core/canonical-jcs.js';
 import { sign, verify } from '../../crypto/keys.js';
 import { assertExactKeys, assertHex, assertIJson, assertPlainRecord, assertUtcMilliseconds, } from './validation.js';
+import { classifyResolution } from './resolution-outcome.js';
 const ID_DOMAIN = 'APS-PRINCIPAL-BINDING-REVOCATION-ID-V1\0';
 const SIGNATURE_DOMAIN = 'APS-PRINCIPAL-BINDING-REVOCATION-SIG-V1\0';
 export function issuePrincipalBindingRevocationV1(input) {
@@ -40,21 +41,36 @@ export async function verifyPrincipalBindingRevocationV1(candidate, resolveKey)
     if (digest(ID_DOMAIN + canonicalizeJCS(idForm)) !== revocation.revocation_id) {
         return invalid('PRINCIPAL_BINDING_REVOCATION_ID_MISMATCH');
     }
-    const resolution = await resolveKey({
-        controller: revocation.principal_id,
-        verification_method: revocation.verification_method,
-        at: revocation.revoked_at,
-    });
-    if (resolution.state !== 'resolved' || !resolution.public_key_hex) {
+    // Only the resolver call is guarded. A resolver that throws or rejects is treated like an
+    // answer outside the resolver contract. Anything else that throws is a defect, not a
+    // resolution failure, and is not caught here.
+    let resolution;
+    try {
+        resolution = await resolveKey({
+            controller: revocation.principal_id,
+            verification_method: revocation.verification_method,
+            at: revocation.revoked_at,
+        });
+    }
+    catch {
+        resolution = undefined;
+    }
+    // The section 3.5 mapping verifyPassportV2 and verifyPrincipalBindingV1 apply (see
+    // resolution-outcome.ts). No key was resolved in these branches, so nothing about the
+    // revoker's authority is established either way: the revocation is not verified, and
+    // that is not evidence that the binding stays in force.
+    const classified = classifyResolution(resolution);
+    if (!classified.ok) {
         return {
-            state: resolution.state === 'unreachable' ? 'indeterminate' : 'invalid',
-            code: `PRINCIPAL_BINDING_REVOCATION_KEY_${resolution.state.toUpperCase()}`,
+            state: classified.failure.state,
+            code: `PRINCIPAL_BINDING_REVOCATION_KEY_${classified.failure.outcome}`,
             proof_of_possession: false,
-            key_authority: resolution.state === 'unreachable' ? 'unresolved' : 'rejected',
+            key_authority: 'unresolved',
         };
     }
+    // A resolved key that does not verify the signature is an established failure.
     const signatureForm = omit(revocation, ['signature']);
-    if (!verify(SIGNATURE_DOMAIN + canonicalizeJCS(signatureForm), revocation.signature, resolution.public_key_hex))
+    if (!verify(SIGNATURE_DOMAIN + canonicalizeJCS(signatureForm), revocation.signature, classified.public_key_hex))
         return invalid('PRINCIPAL_BINDING_REVOCATION_SIGNATURE_INVALID');
     return { state: 'valid', code: 'OK', proof_of_possession: true, key_authority: 'verified' };
 }

package/dist/src/v2/identity-binding/revocation.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"revocation.js","sourceRoot":"","sources":["../../../../src/v2/identity-binding/revocation.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAMnD,OAAO,EACL,eAAe,EACf,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,iBAAiB,CAAA;~~AAExB~~,MAAM,SAAS,GAAG,0CAA0C,CAAA;AAC5D,MAAM,gBAAgB,GAAG,2CAA2C,CAAA;AAEpE,MAAM,UAAU,iCAAiC,CAAC,KAQjD;IACC,MAAM,KAAK,GAAsE;QAC/E,WAAW,EAAE,kCAAkC;QAC/C,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAA;IACD,uBAAuB,CAAC,KAAK,CAAC,CAAA;IAC9B,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAA;IAC/D,MAAM,MAAM,GAAoD;QAC9D,GAAG,KAAK;QACR,aAAa,EAAE,YAAY;KAC5B,CAAA;IACD,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,IAAI,CAAC,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,yBAAyB,CAAC;KAC7F,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,SAAkB,EAClB,UAAiC;IAEjC,IAAI,UAAwC,CAAA;IAC5C,IAAI,CAAC;QACH,UAAU,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,wCAAwC,CAAC,CAAA;IAC1D,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAA;IAC/D,IAAI,MAAM,CAAC,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,UAAU,CAAC,aAAa,EAAE,CAAC;QAC7E,OAAO,OAAO,CAAC,0CAA0C,CAAC,CAAA;IAC5D,CAAC;IACD,~~MAAM~~,UAAU,GAAG,MAAM,UAAU,CAAC;~~QAClC~~,UAAU,EAAE,UAAU,CAAC,YAAY;~~QACnC~~,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;~~QACnD~~,EAAE,EAAE,UAAU,CAAC,UAAU;~~KAC1B~~,CAAC,CAAA;~~IACF~~,~~IAAI~~,UAAU,CAAC,~~KAAK~~,~~KAAK~~,UAAU,IAAI,CAAC,UAAU,CAAC,~~cAAc~~,EAAE,CAAC;~~QAClE~~,OAAO;YACL,KAAK,EAAE,UAAU,CAAC,~~KAAK~~,~~KAAK,aAAa,~~CAAC,~~CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS~~;~~YACvE~~,IAAI,EAAE,oCAAoC,UAAU,CAAC,~~KAAK~~,CAAC,~~WAAW~~,EAAE~~,EAAE~~;~~YAC1E~~,mBAAmB,EAAE,KAAK;YAC1B,aAAa,EAAE,~~UAAU,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,~~YAAY~~,CAAC,CAAC,CAAC,UAAU~~;~~SAC9E~~,CAAA;IACH,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;IACrD,IAAI,CAAC,MAAM,CACT,gBAAgB,GAAG,eAAe,CAAC,aAAa,CAAC,EACjD,UAAU,CAAC,SAAS,EACpB,UAAU,CAAC,cAAc,CAC1B;QAAE,OAAO,OAAO,CAAC,gDAAgD,CAAC,CAAA;IAEnE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,CAAA;AAC7F,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,iBAAiB,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAA;IAC9C,eAAe,CAAC,KAAK,EAAE;QACrB,aAAa,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc;QACvE,qBAAqB,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW;KACzE,EAAE,EAAE,EAAE,oBAAoB,CAAC,CAAA;IAC5B,uBAAuB,CAAC,KAAqF,CAAC,CAAA;IAC9G,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,CAAA;IAC3D,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;IACpD,OAAO,KAAgD,CAAA;AACzD,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAwE;IACvG,WAAW,CAAC,KAAK,CAAC,CAAA;IAClB,IAAI,KAAK,CAAC,WAAW,KAAK,kCAAkC,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAA;IACnH,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,YAAY,CAAC,CAAA;IAC7C,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,YAAY,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IAC3G,qBAAqB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;IACrD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAA;IACvF,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;AACrC,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,IAAuB;IAClD,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAC9F,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,CAAA;AAC1F,CAAC"}
1	+ {"version":3,"file":"revocation.js","sourceRoot":"","sources":["../../../../src/v2/identity-binding/revocation.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAMnD,OAAO,EACL,eAAe,EACf,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE5D,MAAM,SAAS,GAAG,0CAA0C,CAAA;AAC5D,MAAM,gBAAgB,GAAG,2CAA2C,CAAA;AAEpE,MAAM,UAAU,iCAAiC,CAAC,KAQjD;IACC,MAAM,KAAK,GAAsE;QAC/E,WAAW,EAAE,kCAAkC;QAC/C,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAA;IACD,uBAAuB,CAAC,KAAK,CAAC,CAAA;IAC9B,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAA;IAC/D,MAAM,MAAM,GAAoD;QAC9D,GAAG,KAAK;QACR,aAAa,EAAE,YAAY;KAC5B,CAAA;IACD,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,IAAI,CAAC,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,yBAAyB,CAAC;KAC7F,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,SAAkB,EAClB,UAAiC;IAEjC,IAAI,UAAwC,CAAA;IAC5C,IAAI,CAAC;QACH,UAAU,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,wCAAwC,CAAC,CAAA;IAC1D,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAA;IAC/D,IAAI,MAAM,CAAC,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,UAAU,CAAC,aAAa,EAAE,CAAC;QAC7E,OAAO,OAAO,CAAC,0CAA0C,CAAC,CAAA;IAC5D,CAAC;IACD,0FAA0F;IAC1F,qFAAqF;IACrF,8CAA8C;IAC9C,IAAI,UAAmB,CAAA;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,UAAU,CAAC;YAC5B,UAAU,EAAE,UAAU,CAAC,YAAY;YACnC,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;YACnD,EAAE,EAAE,UAAU,CAAC,UAAU;SAC1B,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,SAAS,CAAA;IACxB,CAAC;IACD,mFAAmF;IACnF,sFAAsF;IACtF,qFAAqF;IACrF,wDAAwD;IACxD,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAA;IACjD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO;YACL,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK;YAC/B,IAAI,EAAE,oCAAoC,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE;YACtE,mBAAmB,EAAE,KAAK;YAC1B,aAAa,EAAE,YAAY;SAC5B,CAAA;IACH,CAAC;IACD,+EAA+E;IAC/E,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;IACrD,IAAI,CAAC,MAAM,CACT,gBAAgB,GAAG,eAAe,CAAC,aAAa,CAAC,EACjD,UAAU,CAAC,SAAS,EACpB,UAAU,CAAC,cAAc,CAC1B;QAAE,OAAO,OAAO,CAAC,gDAAgD,CAAC,CAAA;IAEnE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,CAAA;AAC7F,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,iBAAiB,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAA;IAC9C,eAAe,CAAC,KAAK,EAAE;QACrB,aAAa,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc;QACvE,qBAAqB,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW;KACzE,EAAE,EAAE,EAAE,oBAAoB,CAAC,CAAA;IAC5B,uBAAuB,CAAC,KAAqF,CAAC,CAAA;IAC9G,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,CAAA;IAC3D,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;IACpD,OAAO,KAAgD,CAAA;AACzD,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAwE;IACvG,WAAW,CAAC,KAAK,CAAC,CAAA;IAClB,IAAI,KAAK,CAAC,WAAW,KAAK,kCAAkC,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAA;IACnH,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,YAAY,CAAC,CAAA;IAC7C,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,YAAY,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IAC3G,qBAAqB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;IACrD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAA;IACvF,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;AACrC,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,IAAuB;IAClD,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAC9F,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,CAAA;AAC1F,CAAC"}

package/dist/src/v2/identity-binding/types.d.ts CHANGED Viewed

@@ -64,6 +64,15 @@ export interface HistoricalKeyResolutionRequest {
     verification_method: string;
     at: string;
 }
+/**
+ * A resolver's answer for the key authorized for `verification_method` at `at`.
+ *
+ * `resolved` means the returned key is the one authorized at `at`. A resolver that cannot
+ * select by time (for example a method with no history, such as did:web read live) and
+ * cannot establish that the current key was also the key at `at` answers `ambiguous`, not
+ * `resolved` with today's key. Verifiers report a resolved key that differs from the
+ * signing key as an established key-authority failure, which is only true when this holds.
+ */
 export interface HistoricalKeyResolutionResult {
     state: 'resolved' | 'not_found' | 'ambiguous' | 'malformed' | 'unreachable' | 'unsupported';
     public_key_hex?: string;

package/dist/src/v2/identity-binding/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/v2/identity-binding/types.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,KAAK,GAAG,MAAM,CAAA;AAC1B,MAAM,MAAM,KAAK,GAAG,MAAM,CAAA;AAC1B,MAAM,MAAM,MAAM,GAAG,MAAM,CAAA;AAE3B,MAAM,WAAW,wBAAwB;IACvC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,EAAE,CAAA;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,oBAAoB,CAAA;IACjC,OAAO,EAAE,KAAK,CAAA;IACd,WAAW,EAAE,KAAK,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,oBAAoB,EAAE,MAAM,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,KAAK,CAAA;IACZ,aAAa,EAAE,wBAAwB,CAAA;IACvC,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,uBAAuB,CAAA;IACpC,OAAO,EAAE,KAAK,CAAA;IACd,UAAU,EAAE,KAAK,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,kBAAkB,EAAE,MAAM,EAAE,CAAA;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,KAAK,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,4BAA4B;IAC3C,WAAW,EAAE,kCAAkC,CAAA;IAC/C,OAAO,EAAE,KAAK,CAAA;IACd,aAAa,EAAE,KAAK,CAAA;IACpB,UAAU,EAAE,KAAK,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,KAAK,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,mBAAmB,GAC3B,eAAe,GACf,oBAAoB,GACpB,+BAA+B,CAAA;AAEnC,MAAM,MAAM,yBAAyB,GACjC,OAAO,GACP,SAAS,GACT,eAAe,GACf,aAAa,CAAA;AAEjB,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,yBAAyB,CAAA;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,mBAAmB,EAAE,OAAO,CAAA;IAC5B,aAAa,EAAE,UAAU,GAAG,YAAY,GAAG,UAAU,CAAA;IACrD,qBAAqB,CAAC,EAAE,mBAAmB,CAAA;CAC5C;AAED,MAAM,WAAW,8BAA8B;IAC7C,UAAU,EAAE,MAAM,CAAA;IAClB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,EAAE,EAAE,MAAM,CAAA;CACX;AAED,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,UAAU,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,aAAa,GAAG,aAAa,CAAA;IAC3F,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,8BAA8B,KACpC,6BAA6B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAA"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/v2/identity-binding/types.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,KAAK,GAAG,MAAM,CAAA;AAC1B,MAAM,MAAM,KAAK,GAAG,MAAM,CAAA;AAC1B,MAAM,MAAM,MAAM,GAAG,MAAM,CAAA;AAE3B,MAAM,WAAW,wBAAwB;IACvC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,EAAE,CAAA;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,oBAAoB,CAAA;IACjC,OAAO,EAAE,KAAK,CAAA;IACd,WAAW,EAAE,KAAK,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,oBAAoB,EAAE,MAAM,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,KAAK,CAAA;IACZ,aAAa,EAAE,wBAAwB,CAAA;IACvC,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,uBAAuB,CAAA;IACpC,OAAO,EAAE,KAAK,CAAA;IACd,UAAU,EAAE,KAAK,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,kBAAkB,EAAE,MAAM,EAAE,CAAA;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,KAAK,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,4BAA4B;IAC3C,WAAW,EAAE,kCAAkC,CAAA;IAC/C,OAAO,EAAE,KAAK,CAAA;IACd,aAAa,EAAE,KAAK,CAAA;IACpB,UAAU,EAAE,KAAK,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,KAAK,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,mBAAmB,GAC3B,eAAe,GACf,oBAAoB,GACpB,+BAA+B,CAAA;AAEnC,MAAM,MAAM,yBAAyB,GACjC,OAAO,GACP,SAAS,GACT,eAAe,GACf,aAAa,CAAA;AAEjB,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,yBAAyB,CAAA;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,mBAAmB,EAAE,OAAO,CAAA;IAC5B,aAAa,EAAE,UAAU,GAAG,YAAY,GAAG,UAAU,CAAA;IACrD,qBAAqB,CAAC,EAAE,mBAAmB,CAAA;CAC5C;AAED,MAAM,WAAW,8BAA8B;IAC7C,UAAU,EAAE,MAAM,CAAA;IAClB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,EAAE,EAAE,MAAM,CAAA;CACX;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,UAAU,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,aAAa,GAAG,aAAa,CAAA;IAC3F,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,8BAA8B,KACpC,6BAA6B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAA"}

package/dist/src/v2/payment-rails/cycles/evidence-resolution.d.ts CHANGED Viewed

@@ -128,6 +128,11 @@ export declare function recomputeEvidenceContentHash(envelope: FetchedCyclesEvid
  * @param resolver  caller-supplied envelope resolver, or undefined
  * @param config    failure policy (default fail-closed)
  */
+/** A resolver's answer, read once from its own properties into a
+ *  prototype-free record. Success needs an own `ok === true` and an own
+ *  envelope, so nothing on Object.prototype can turn a resolver answer into a
+ *  fetched envelope. A non-object answer is malformed. */
+export declare function readEvidenceFetchResult(value: unknown): EvidenceFetchResult;
 export declare function resolveEvidenceRef(ref: CyclesEvidenceRef, resolver: EvidenceResolver | undefined, config?: ResolveEvidenceConfig): Promise<EvidenceResolutionResult>;
 /**
  * The external-evidence observation basis, a mechanical fact for the

package/dist/src/v2/payment-rails/cycles/evidence-resolution.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"evidence-resolution.d.ts","sourceRoot":"","sources":["../../../../../src/v2/payment-rails/cycles/evidence-resolution.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AACtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAWnD;;6DAE6D;AAC7D,MAAM,WAAW,6BAA6B;IAC5C,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,+DAA+D;IAC/D,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAOD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,wBAAwB,GAChC,SAAS,GACT,eAAe,GACf,WAAW,GACX,WAAW,GACX,aAAa,GACb,aAAa,CAAA;AAEjB,mEAAmE;AACnE,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,MAAM,CAAA;AAErD;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAA;IACX;;qDAEiD;IACjD,MAAM,CAAC,EAAE,WAAW,GAAG,aAAa,GAAG,WAAW,CAAA;IAClD,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,6BAA6B,CAAA;IACxC,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;IAChC;2DACuD;IACvD,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;CACnD;AAID;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,wBAAwB;IACvC,8DAA8D;IAC9D,cAAc,EAAE,MAAM,CAAA;IACtB,wEAAwE;IACxE,QAAQ,EAAE,OAAO,CAAA;IACjB,MAAM,EAAE,wBAAwB,CAAA;IAChC;6DACyD;IACzD,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;0EACsE;IACtE,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,oEAAoE;IACpE,cAAc,CAAC,EAAE,YAAY,CAAA;IAC7B;;;sCAGkC;IAClC,QAAQ,CAAC,EAAE,6BAA6B,CAAA;CACzC;AAID,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACpC,aAAa,CAAC,EAAE,qBAAqB,CAAA;CACtC;AAID;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,6BAA6B,GACtC,MAAM,CAOR;AAoCD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,iBAAiB,EACtB,QAAQ,EAAE,gBAAgB,GAAG,SAAS,EACtC,MAAM,GAAE,qBAA0B,GACjC,OAAO,CAAC,wBAAwB,CAAC,~~CA6EnC~~;AA2CD;;;;;;;;GAQG;AACH,MAAM,MAAM,wBAAwB,GAChC,gBAAgB,GAChB,uBAAuB,CAAA;AAE3B;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAA;IACtB,sEAAsE;IACtE,iBAAiB,EAAE,wBAAwB,CAAA;IAC3C,8DAA8D;IAC9D,gBAAgB,EAAE,OAAO,CAAA;IACzB,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,sEAAsE;IACtE,iBAAiB,EAAE,wBAAwB,CAAA;IAC3C,iEAAiE;IACjE,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,wBAAwB,GAC/B,uBAAuB,~~CAczB~~"}
1	+ {"version":3,"file":"evidence-resolution.d.ts","sourceRoot":"","sources":["../../../../../src/v2/payment-rails/cycles/evidence-resolution.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AACtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAWnD;;6DAE6D;AAC7D,MAAM,WAAW,6BAA6B;IAC5C,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,+DAA+D;IAC/D,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAOD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,wBAAwB,GAChC,SAAS,GACT,eAAe,GACf,WAAW,GACX,WAAW,GACX,aAAa,GACb,aAAa,CAAA;AAEjB,mEAAmE;AACnE,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,MAAM,CAAA;AAErD;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAA;IACX;;qDAEiD;IACjD,MAAM,CAAC,EAAE,WAAW,GAAG,aAAa,GAAG,WAAW,CAAA;IAClD,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,6BAA6B,CAAA;IACxC,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;IAChC;2DACuD;IACvD,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;CACnD;AAID;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,wBAAwB;IACvC,8DAA8D;IAC9D,cAAc,EAAE,MAAM,CAAA;IACtB,wEAAwE;IACxE,QAAQ,EAAE,OAAO,CAAA;IACjB,MAAM,EAAE,wBAAwB,CAAA;IAChC;6DACyD;IACzD,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;0EACsE;IACtE,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,oEAAoE;IACpE,cAAc,CAAC,EAAE,YAAY,CAAA;IAC7B;;;sCAGkC;IAClC,QAAQ,CAAC,EAAE,6BAA6B,CAAA;CACzC;AAID,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACpC,aAAa,CAAC,EAAE,qBAAqB,CAAA;CACtC;AAID;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,6BAA6B,GACtC,MAAM,CAOR;AAoCD;;;;;;;;;;;;;GAaG;AACH;;;0DAG0D;AAC1D,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,CAoB3E;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,iBAAiB,EACtB,QAAQ,EAAE,gBAAgB,GAAG,SAAS,EACtC,MAAM,GAAE,qBAA0B,GACjC,OAAO,CAAC,wBAAwB,CAAC,CAmFnC;AA2CD;;;;;;;;GAQG;AACH,MAAM,MAAM,wBAAwB,GAChC,gBAAgB,GAChB,uBAAuB,CAAA;AAE3B;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAA;IACtB,sEAAsE;IACtE,iBAAiB,EAAE,wBAAwB,CAAA;IAC3C,8DAA8D;IAC9D,gBAAgB,EAAE,OAAO,CAAA;IACzB,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,sEAAsE;IACtE,iBAAiB,EAAE,wBAAwB,CAAA;IAC3C,iEAAiE;IACjE,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,wBAAwB,GAC/B,uBAAuB,CAiBzB"}

package/dist/src/v2/payment-rails/cycles/evidence-resolution.js CHANGED Viewed

@@ -90,6 +90,34 @@ function claimedOnlyScope() {
  * @param resolver  caller-supplied envelope resolver, or undefined
  * @param config    failure policy (default fail-closed)
  */
+/** A resolver's answer, read once from its own properties into a
+ *  prototype-free record. Success needs an own `ok === true` and an own
+ *  envelope, so nothing on Object.prototype can turn a resolver answer into a
+ *  fetched envelope. A non-object answer is malformed. */
+export function readEvidenceFetchResult(value) {
+    const out = Object.create(null);
+    if (value === null || typeof value !== 'object') {
+        out.ok = false;
+        out.status = 'malformed';
+        out.reason = 'resolver answer is not an object';
+        return out;
+    }
+    const own = (k) => Object.prototype.hasOwnProperty.call(value, k) ? value[k] : undefined;
+    const ok = own('ok');
+    const envelope = own('envelope');
+    const status = own('status');
+    const reason = own('reason');
+    out.ok = ok === true && envelope !== null && typeof envelope === 'object';
+    if (out.ok)
+        out.envelope = envelope;
+    if (status === 'not_found' || status === 'unreachable' || status === 'malformed')
+        out.status = status;
+    else if (status !== undefined)
+        out.status = 'malformed';
+    if (typeof reason === 'string')
+        out.reason = reason;
+    return out;
+}
 export async function resolveEvidenceRef(ref, resolver, config = {}) {
     const claimed = ref.cycles_evidence_id_sha256;
     const failurePolicy = config.failurePolicy ?? 'closed';
@@ -108,7 +136,7 @@ export async function resolveEvidenceRef(ref, resolver, config = {}) {
     }
     let fetched;
     try {
-        fetched = await resolver.resolve(ref.cycles_evidence_url);
+        fetched = readEvidenceFetchResult(await resolver.resolve(ref.cycles_evidence_url));
     }
     catch (err) {
         // A resolver SHOULD NOT reject, but if it does we record it as
@@ -116,7 +144,12 @@ export async function resolveEvidenceRef(ref, resolver, config = {}) {
         return unreachableResult(claimed, failurePolicy, `resolver threw: ${safeMsg(err)}`);
     }
     if (!fetched.ok || !fetched.envelope) {
-        const status = fetched.status ?? 'unreachable';
+        // Only a failure status may describe a failed fetch. Any other value
+        // (including 'matched') is reported as malformed, never as a match.
+        const reported = fetched.status ?? 'unreachable';
+        const status = reported === 'unreachable' || reported === 'not_found' || reported === 'malformed'
+            ? reported
+            : 'malformed';
         if (status === 'unreachable') {
             return unreachableResult(claimed, failurePolicy, fetched.reason ?? 'envelope unreachable');
         }
@@ -191,16 +224,19 @@ function safeMsg(err) {
  * corroborated by a fetched envelope).
  */
 export function toEvidenceDescriptorInput(result) {
-    const input = {
-        claimed_sha256: result.claimed_sha256,
-        observation_basis: result.resolved ? 'counterparty_resolved' : 'signature_only',
-        envelope_matched: result.resolved,
-        resolution_status: result.status,
-    };
-    if (result.resolved_sha256 !== undefined) {
+    // Prototype-free, so assignments below cannot hit a setter on
+    // Object.prototype and an absent optional field reads as undefined.
+    const input = Object.create(null);
+    input.claimed_sha256 = result.claimed_sha256;
+    input.observation_basis = result.resolved ? 'counterparty_resolved' : 'signature_only';
+    input.envelope_matched = result.resolved;
+    input.resolution_status = result.status;
+    // Own properties only, so a value on Object.prototype never appears as a
+    // resolved hash or a degraded flag.
+    if (Object.prototype.hasOwnProperty.call(result, 'resolved_sha256') && result.resolved_sha256 !== undefined) {
         input.resolved_sha256 = result.resolved_sha256;
     }
-    if (result.degraded !== undefined) {
+    if (Object.prototype.hasOwnProperty.call(result, 'degraded') && result.degraded !== undefined) {
         input.degraded = result.degraded;
     }
     return input;

package/dist/src/v2/payment-rails/cycles/evidence-resolution.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"evidence-resolution.js","sourceRoot":"","sources":["../../../../../src/v2/payment-rails/cycles/evidence-resolution.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,qEAAqE;AACrE,mEAAmE;AACnE,qEAAqE;AACrE,wEAAwE;AACxE,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AACpE,wEAAwE;AACxE,iBAAiB;AACjB,EAAE;AACF,kEAAkE;AAClE,sEAAsE;AACtE,uEAAuE;AACvE,sEAAsE;AACtE,wEAAwE;AACxE,kEAAkE;AAClE,uEAAuE;AACvE,qEAAqE;AACrE,EAAE;AACF,qEAAqE;AACrE,gEAAgE;AAChE,kEAAkE;AAClE,EAAE;AACF,kEAAkE;AAClE,uEAAuE;AACvE,gEAAgE;AAChE,uEAAuE;AACvE,oEAAoE;AACpE,qEAAqE;AAErE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AA4I9C,qEAAqE;AAErE;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAuC;IAEvC,MAAM,SAAS,GAAG,eAAe,CAAC;QAChC,GAAG,QAAQ;QACX,WAAW,EAAE,EAAE;QACf,SAAS,EAAE,EAAE;KACd,CAAC,CAAA;IACF,OAAO,SAAS,CAAC,SAAS,CAAC,CAAA;AAC7B,CAAC;AAED,qEAAqE;AAErE,SAAS,YAAY;IACnB,OAAO;QACL,OAAO,EACL,+KAA+K;QACjL,eAAe,EAAE;YACf,yEAAyE;YACzE,gEAAgE;YAChE,gCAAgC;SACjC;QACD,YAAY,EAAE,kBAAkB;QAChC,YAAY,EAAE,UAAU;QACxB,aAAa,EAAE,KAAK;KACrB,CAAA;AACH,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO;QACL,OAAO,EACL,wMAAwM;QAC1M,eAAe,EAAE;YACf,+CAA+C;YAC/C,yEAAyE;YACzE,qDAAqD;SACtD;QACD,YAAY,EAAE,SAAS;QACvB,YAAY,EAAE,aAAa;QAC3B,aAAa,EAAE,KAAK;KACrB,CAAA;AACH,CAAC;AAED,qEAAqE;AAErE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAsB,EACtB,QAAsC,EACtC,MAAM,GAA0B,EAAE;IAElC,MAAM,OAAO,GAAG,GAAG,CAAC,yBAAyB,CAAA;IAC7C,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,QAAQ,CAAA;IAEtD,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC/D,OAAO;YACL,cAAc,EAAE,OAAO;YACvB,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,QAAQ;gBACd,CAAC,CAAC,qCAAqC;gBACvC,CAAC,CAAC,wDAAwD;YAC5D,cAAc,EAAE,gBAAgB,EAAE;SACnC,CAAA;IACH,CAAC;IAED,IAAI,OAA4B,CAAA;IAChC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;~~IAC3D~~,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,+DAA+D;QAC/D,gEAAgE;QAChE,OAAO,iBAAiB,CAAC,OAAO,EAAE,aAAa,EAAE,mBAAmB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACrF,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrC,~~MAAM~~,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAA;~~QAC9C~~,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;YAC7B,OAAO,iBAAiB,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,IAAI,sBAAsB,CAAC,CAAA;QAC5F,CAAC;QACD,oEAAoE;QACpE,0BAA0B;QAC1B,OAAO;YACL,cAAc,EAAE,OAAO;YACvB,QAAQ,EAAE,KAAK;YACf,MAAM;YACN,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,YAAY,MAAM,EAAE;YAC9C,cAAc,EAAE,gBAAgB,EAAE;SACnC,CAAA;IACH,CAAC;IAED,2CAA2C;IAC3C,IAAI,UAAkB,CAAA;IACtB,IAAI,CAAC;QACH,UAAU,GAAG,4BAA4B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,cAAc,EAAE,OAAO;YACvB,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,qCAAqC,OAAO,CAAC,GAAG,CAAC,EAAE;YAC3D,cAAc,EAAE,gBAAgB,EAAE;SACnC,CAAA;IACH,CAAC;IAED,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO;YACL,cAAc,EAAE,OAAO;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,SAAS;YACjB,eAAe,EAAE,UAAU;YAC3B,cAAc,EAAE,YAAY,EAAE;YAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAA;IACH,CAAC;IAED,OAAO;QACL,cAAc,EAAE,OAAO;QACvB,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,eAAe;QACvB,eAAe,EAAE,UAAU;QAC3B,MAAM,EAAE,wEAAwE;QAChF,cAAc,EAAE,gBAAgB,EAAE;QAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAA;AACH,CAAC;AAED,qEAAqE;AAErE,SAAS,iBAAiB,CACxB,OAAe,EACf,aAAoC,EACpC,MAAc;IAEd,4DAA4D;IAC5D,sEAAsE;IACtE,sDAAsD;IACtD,OAAO;QACL,cAAc,EAAE,OAAO;QACvB,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,aAAa;QACrB,QAAQ,EAAE,aAAa,KAAK,MAAM;QAClC,MAAM,EACJ,aAAa,KAAK,MAAM;YACtB,CAAC,CAAC,uBAAuB,MAAM,EAAE;YACjC,CAAC,CAAC,gBAAgB,MAAM,EAAE;QAC9B,cAAc,EAAE,gBAAgB,EAAE;KACnC,CAAA;AACH,CAAC;AAED,SAAS,OAAO,CAAC,GAAY;IAC3B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AACzD,CAAC;AAiDD;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAgC;IAEhC,MAAM,KAAK,~~GAA4B~~;~~QACrC~~,cAAc,~~EAAE~~,MAAM,CAAC,cAAc;~~QACrC~~,iBAAiB,~~EAAE~~,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,gBAAgB;~~QAC/E~~,gBAAgB,~~EAAE~~,MAAM,CAAC,QAAQ;~~QACjC~~,iBAAiB,~~EAAE~~,MAAM,CAAC,MAAM~~;KACjC~~,CAAA;~~IACD~~,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;~~QACzC~~,KAAK,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAA;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;~~QAClC~~,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;IAClC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}
1	+ {"version":3,"file":"evidence-resolution.js","sourceRoot":"","sources":["../../../../../src/v2/payment-rails/cycles/evidence-resolution.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,qEAAqE;AACrE,mEAAmE;AACnE,qEAAqE;AACrE,wEAAwE;AACxE,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AACpE,wEAAwE;AACxE,iBAAiB;AACjB,EAAE;AACF,kEAAkE;AAClE,sEAAsE;AACtE,uEAAuE;AACvE,sEAAsE;AACtE,wEAAwE;AACxE,kEAAkE;AAClE,uEAAuE;AACvE,qEAAqE;AACrE,EAAE;AACF,qEAAqE;AACrE,gEAAgE;AAChE,kEAAkE;AAClE,EAAE;AACF,kEAAkE;AAClE,uEAAuE;AACvE,gEAAgE;AAChE,uEAAuE;AACvE,oEAAoE;AACpE,qEAAqE;AAErE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AA4I9C,qEAAqE;AAErE;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAuC;IAEvC,MAAM,SAAS,GAAG,eAAe,CAAC;QAChC,GAAG,QAAQ;QACX,WAAW,EAAE,EAAE;QACf,SAAS,EAAE,EAAE;KACd,CAAC,CAAA;IACF,OAAO,SAAS,CAAC,SAAS,CAAC,CAAA;AAC7B,CAAC;AAED,qEAAqE;AAErE,SAAS,YAAY;IACnB,OAAO;QACL,OAAO,EACL,+KAA+K;QACjL,eAAe,EAAE;YACf,yEAAyE;YACzE,gEAAgE;YAChE,gCAAgC;SACjC;QACD,YAAY,EAAE,kBAAkB;QAChC,YAAY,EAAE,UAAU;QACxB,aAAa,EAAE,KAAK;KACrB,CAAA;AACH,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO;QACL,OAAO,EACL,wMAAwM;QAC1M,eAAe,EAAE;YACf,+CAA+C;YAC/C,yEAAyE;YACzE,qDAAqD;SACtD;QACD,YAAY,EAAE,SAAS;QACvB,YAAY,EAAE,aAAa;QAC3B,aAAa,EAAE,KAAK;KACrB,CAAA;AACH,CAAC;AAED,qEAAqE;AAErE;;;;;;;;;;;;;GAaG;AACH;;;0DAG0D;AAC1D,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAwB,CAAA;IACtD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,GAAG,CAAC,EAAE,GAAG,KAAK,CAAA;QACd,GAAG,CAAC,MAAM,GAAG,WAAW,CAAA;QACxB,GAAG,CAAC,MAAM,GAAG,kCAAkC,CAAA;QAC/C,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAW,EAAE,CACjC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACpG,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAA;IACpB,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAA;IAChC,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5B,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAA;IACzE,IAAI,GAAG,CAAC,EAAE;QAAE,GAAG,CAAC,QAAQ,GAAG,QAAyC,CAAA;IACpE,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,aAAa,IAAI,MAAM,KAAK,WAAW;QAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAA;SAChG,IAAI,MAAM,KAAK,SAAS;QAAE,GAAG,CAAC,MAAM,GAAG,WAAW,CAAA;IACvD,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAA;IACnD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAsB,EACtB,QAAsC,EACtC,MAAM,GAA0B,EAAE;IAElC,MAAM,OAAO,GAAG,GAAG,CAAC,yBAAyB,CAAA;IAC7C,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,QAAQ,CAAA;IAEtD,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC/D,OAAO;YACL,cAAc,EAAE,OAAO;YACvB,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,QAAQ;gBACd,CAAC,CAAC,qCAAqC;gBACvC,CAAC,CAAC,wDAAwD;YAC5D,cAAc,EAAE,gBAAgB,EAAE;SACnC,CAAA;IACH,CAAC;IAED,IAAI,OAA4B,CAAA;IAChC,IAAI,CAAC;QACH,OAAO,GAAG,uBAAuB,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAA;IACpF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,+DAA+D;QAC/D,gEAAgE;QAChE,OAAO,iBAAiB,CAAC,OAAO,EAAE,aAAa,EAAE,mBAAmB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACrF,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrC,qEAAqE;QACrE,oEAAoE;QACpE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAA;QAChD,MAAM,MAAM,GACV,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW;YAChF,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,WAAW,CAAA;QACjB,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;YAC7B,OAAO,iBAAiB,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,IAAI,sBAAsB,CAAC,CAAA;QAC5F,CAAC;QACD,oEAAoE;QACpE,0BAA0B;QAC1B,OAAO;YACL,cAAc,EAAE,OAAO;YACvB,QAAQ,EAAE,KAAK;YACf,MAAM;YACN,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,YAAY,MAAM,EAAE;YAC9C,cAAc,EAAE,gBAAgB,EAAE;SACnC,CAAA;IACH,CAAC;IAED,2CAA2C;IAC3C,IAAI,UAAkB,CAAA;IACtB,IAAI,CAAC;QACH,UAAU,GAAG,4BAA4B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,cAAc,EAAE,OAAO;YACvB,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,qCAAqC,OAAO,CAAC,GAAG,CAAC,EAAE;YAC3D,cAAc,EAAE,gBAAgB,EAAE;SACnC,CAAA;IACH,CAAC;IAED,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO;YACL,cAAc,EAAE,OAAO;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,SAAS;YACjB,eAAe,EAAE,UAAU;YAC3B,cAAc,EAAE,YAAY,EAAE;YAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAA;IACH,CAAC;IAED,OAAO;QACL,cAAc,EAAE,OAAO;QACvB,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,eAAe;QACvB,eAAe,EAAE,UAAU;QAC3B,MAAM,EAAE,wEAAwE;QAChF,cAAc,EAAE,gBAAgB,EAAE;QAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAA;AACH,CAAC;AAED,qEAAqE;AAErE,SAAS,iBAAiB,CACxB,OAAe,EACf,aAAoC,EACpC,MAAc;IAEd,4DAA4D;IAC5D,sEAAsE;IACtE,sDAAsD;IACtD,OAAO;QACL,cAAc,EAAE,OAAO;QACvB,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,aAAa;QACrB,QAAQ,EAAE,aAAa,KAAK,MAAM;QAClC,MAAM,EACJ,aAAa,KAAK,MAAM;YACtB,CAAC,CAAC,uBAAuB,MAAM,EAAE;YACjC,CAAC,CAAC,gBAAgB,MAAM,EAAE;QAC9B,cAAc,EAAE,gBAAgB,EAAE;KACnC,CAAA;AACH,CAAC;AAED,SAAS,OAAO,CAAC,GAAY;IAC3B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AACzD,CAAC;AAiDD;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAgC;IAEhC,8DAA8D;IAC9D,oEAAoE;IACpE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA4B,CAAA;IAC5D,KAAK,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAA;IAC5C,KAAK,CAAC,iBAAiB,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,gBAAgB,CAAA;IACtF,KAAK,CAAC,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAA;IACxC,KAAK,CAAC,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAA;IACvC,yEAAyE;IACzE,oCAAoC;IACpC,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC5G,KAAK,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAA;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC9F,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;IAClC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/src/v2/payment-rails/cycles/index.d.ts CHANGED Viewed

@@ -1,6 +1,6 @@
 import type { DenialReason as FoundationDenialReason } from '../types.js';
 export { CYCLES_PROTOCOL_VERSION, CYCLES_EVIDENCE_SCHEMA_VERSION, RAIL_BUDGET_RESERVATION_PERMIT_CLAIM_TYPE, RAIL_BUDGET_RESERVATION_RELEASE_CLAIM_TYPE, RAIL_BUDGET_RESERVATION_DENIAL_CLAIM_TYPE, } from './types.js';
-import type { CyclesDenial, CyclesDenialDetail, CyclesEvidenceView, CyclesPermitReceipt, CyclesReleaseReceipt, CyclesVerifyResult, SignCyclesDenialInput, SignCyclesPermitReceiptInput, SignCyclesReleaseReceiptInput, VerifyCyclesOptions } from './types.js';
+import type { CyclesDenial, CyclesDenialDetail, CyclesEvidenceCorrespondence, CyclesEvidenceView, CyclesPermitReceipt, CyclesReleaseReceipt, CyclesVerifyResult, SignCyclesDenialInput, SignCyclesPermitReceiptInput, SignCyclesReleaseReceiptInput, VerifyCyclesOptions } from './types.js';
 import type { EvidenceDescriptorInput, EvidenceResolutionResult, FetchedCyclesEvidenceEnvelope } from './evidence-resolution.js';
 /**
  * Maps a Cycles denial signal (extracted from a CyclesEvidence view)
@@ -26,7 +26,9 @@ export declare function mapCyclesDenialToFoundation(evidence: CyclesEvidenceView
 } | null;
 export declare function signCyclesPermitReceipt(input: SignCyclesPermitReceiptInput, signerPrivateKeyHex: string): CyclesPermitReceipt;
 /** Verify a Cycles permit receipt (sync). With `options.evidence`, also
- *  checks the receipt↔envelope hash binding (see `_checkEvidenceJoin`).
+ *  checks the receipt↔envelope hash binding and that the envelope is the
+ *  referenced stage for the same reservation_id (see `_checkEvidenceJoin`).
+ *  Amount, unit, action and server identity are not compared.
  *  NOTE: `valid: true` does NOT assert the envelope's own Ed25519
  *  authenticity or signer authority — that is the v0.2 item (#43). Pin
  *  `expected_signer` for issuer trust until then. */
@@ -37,7 +39,9 @@ export declare function verifyCyclesPermitReceipt(receipt: CyclesPermitReceipt,
 export declare function verifyCyclesPermitReceiptWithDID(receipt: CyclesPermitReceipt, options?: VerifyCyclesOptions): Promise<CyclesVerifyResult>;
 export declare function signCyclesReleaseReceipt(input: SignCyclesReleaseReceiptInput, signerPrivateKeyHex: string): CyclesReleaseReceipt;
 /** Verify a Cycles release receipt (sync). With `options.evidence`, also
- *  checks the receipt↔envelope hash binding (see `_checkEvidenceJoin`).
+ *  checks the receipt↔envelope hash binding and that the envelope is the
+ *  referenced stage for the same reservation_id (see `_checkEvidenceJoin`).
+ *  Amount, unit, action and server identity are not compared.
  *  NOTE: `valid: true` does NOT assert the envelope's own Ed25519
  *  authenticity or signer authority — that is the v0.2 item (#43). Pin
  *  `expected_signer` for issuer trust until then. */
@@ -78,6 +82,13 @@ export interface CyclesVerifyWithEvidenceResult {
      *  resolved from the server's JWK Set under the issuance-time window verifies
      *  the envelope (after its evidence_id re-derives). */
     authority: CyclesEvidenceAuthorityResult;
+    /** Receipt-to-envelope correspondence for the FETCHED envelope (8.0.0).
+     *  Evaluated for permit and release receipts when resolution `matched`,
+     *  else `not_applicable`. Additive and independent of `verify`, `evidence`
+     *  and `authority`: a consumer that needs "this envelope is the event this
+     *  receipt references" must read it. `matched` covers stage and
+     *  reservation_id only. */
+    correspondence: CyclesEvidenceCorrespondence;
 }
 /**
  * Signer-authority verdict for a CyclesEvidence envelope. The five DISTINCT