{"_id":"@bolyra/delegation","_rev":"7-eda968e35261486d649c134b1e9205ea","name":"@bolyra/delegation","dist-tags":{"latest":"0.2.3"},"versions":{"0.1.0":{"name":"@bolyra/delegation","version":"0.1.0","keywords":["agent","ai-agent","delegation","authorization","consent","ed25519","jwt","sd-jwt","agentic-commerce","mcp","langchain","openai-agents"],"author":{"name":"ZKProva Inc."},"license":"Apache-2.0","_id":"@bolyra/delegation@0.1.0","maintainers":[{"name":"saneguy","email":"kondojuviswanadha@gmail.com"}],"homepage":"https://bolyra.ai","bugs":{"url":"https://github.com/bolyra/bolyra/issues"},"dist":{"shasum":"12f74c4e5accf22d0342fe3840202e092cbb508d","tarball":"https://registry.npmjs.org/@bolyra/delegation/-/delegation-0.1.0.tgz","fileCount":34,"integrity":"sha512-4ThPb/J5+RnwFWlAPGozQzLZ567ASQ0FVORD1XnQAfHkKa8Mqp0DEPhH3cAlNUOH3eZUL+X+Q/TDa77C3zcA2Q==","signatures":[{"sig":"MEMCHzQB6Jan7DD0CVh7XAljWmBNcmiEvPMTESKTiJ1dSNkCIDxGTkQZ6LAew9qGdoBLFCN/h+XB7P+mSuPlSmTKskW3","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":70000},"main":"dist/index.js","types":"dist/index.d.ts","gitHead":"f39cc271b813a0686ae9ebea90d53a8ea5eeb050","scripts":{"test":"jest --passWithNoTests","build":"tsc","typecheck":"tsc --noEmit","prepublishOnly":"npm run typecheck && npm test && npm run build"},"_npmUser":{"name":"saneguy","email":"kondojuviswanadha@gmail.com"},"repository":{"url":"git+https://github.com/bolyra/bolyra.git","type":"git","directory":"delegation"},"_npmVersion":"11.6.2","description":"Verifiable delegated authority for agent actions. Human signs a scoped receipt; middleware verifies it before the agent calls a tool. SD-JWT/EdDSA today, ZKP upgrade path tomorrow.","directories":{},"_nodeVersion":"24.13.0","dependencies":{"jose":"^5.9.6"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"jest":"^29.7.0","ts-jest":"^29.2.0","typescript":"^5.5.0","@types/jest":"^29.5.0","@types/node":"^22.0.0"},"_npmOperationalInternal":{"tmp":"tmp/delegation_0.1.0_1777951116636_0.8481680348869272","host":"s3://npm-registry-packages-npm-production"}},"0.1.1":{"name":"@bolyra/delegation","version":"0.1.1","keywords":["agent","ai-agent","delegation","authorization","consent","ed25519","jwt","sd-jwt","agentic-commerce","mcp","langchain","openai-agents"],"author":{"name":"ZKProva Inc."},"license":"Apache-2.0","_id":"@bolyra/delegation@0.1.1","maintainers":[{"name":"saneguy","email":"kondojuviswanadha@gmail.com"}],"homepage":"https://bolyra.ai","bugs":{"url":"https://github.com/bolyra/bolyra/issues"},"dist":{"shasum":"33f997e9b54f9e4d6ac59fc6c8925030523843de","tarball":"https://registry.npmjs.org/@bolyra/delegation/-/delegation-0.1.1.tgz","fileCount":34,"integrity":"sha512-CkG0OuGHQhu+SllKMt3ugxVRYfX85r8/s4p2H0lLnitquCQxBFl+1i1gMe5sHdlq5AU6BwHdpOFMINuI4BI5DQ==","signatures":[{"sig":"MEYCIQD25ItOBvw0+rwZTaOYZ1KBi9NTQDM9W7AtzbKacg9QnAIhAJUogwT29g3CRxYJ8PqDHEJfXIPeaRxPdHyYNUNLGtvC","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":70088},"main":"dist/index.js","types":"dist/index.d.ts","gitHead":"43f40e55bba95466054f50976a370aaf344e5261","scripts":{"test":"jest --passWithNoTests","build":"tsc","typecheck":"tsc --noEmit","prepublishOnly":"npm run typecheck && npm test && npm run build"},"_npmUser":{"name":"saneguy","email":"kondojuviswanadha@gmail.com"},"repository":{"url":"git+https://github.com/bolyra/bolyra.git","type":"git","directory":"delegation"},"_npmVersion":"11.6.2","description":"Verifiable delegated authority for agent actions. Human signs a scoped receipt; middleware verifies it before the agent calls a tool. SD-JWT/EdDSA today, ZKP upgrade path tomorrow.","directories":{},"_nodeVersion":"24.13.0","dependencies":{"jose":"^5.9.6"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"jest":"^29.7.0","ts-jest":"^29.2.0","typescript":"^5.5.0","@types/jest":"^29.5.0","@types/node":"^22.0.0"},"_npmOperationalInternal":{"tmp":"tmp/delegation_0.1.1_1777952604084_0.9266762728933582","host":"s3://npm-registry-packages-npm-production"}},"0.2.0":{"name":"@bolyra/delegation","version":"0.2.0","keywords":["agent","ai-agent","delegation","authorization","consent","ed25519","jwt","sd-jwt","agentic-commerce","mcp","langchain","openai-agents"],"author":{"name":"ZKProva Inc."},"license":"Apache-2.0","_id":"@bolyra/delegation@0.2.0","maintainers":[{"name":"saneguy","email":"kondojuviswanadha@gmail.com"}],"homepage":"https://bolyra.ai","bugs":{"url":"https://github.com/bolyra/bolyra/issues"},"dist":{"shasum":"169ba86dd4b4b0c235c35226df54a5cda202d665","tarball":"https://registry.npmjs.org/@bolyra/delegation/-/delegation-0.2.0.tgz","fileCount":74,"integrity":"sha512-IBc13YjaGUcuxrkFYuqW728+99y4flGPwjntDhiV1QutAr9kAxkDx1RlBRT49/n7CflE6fXQTa4I31KkbnXnLQ==","signatures":[{"sig":"MEUCIAUTfpFeY1xUXZk7Qw70kWDAfnyXNEBPdlKLFXYIw+qJAiEAzq5stMQyj98vggr3m82LMkWzhvj1RAJfg9iv3MAzcg4=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":206374},"main":"dist/index.js","types":"dist/index.d.ts","gitHead":"25bd5430bbac57c8bdb2cf6fdb94012ee88f6571","scripts":{"test":"jest --passWithNoTests","build":"tsc","typecheck":"tsc --noEmit","prepublishOnly":"npm run typecheck && npm test && npm run build"},"_npmUser":{"name":"saneguy","email":"kondojuviswanadha@gmail.com"},"repository":{"url":"git+https://github.com/bolyra/bolyra.git","type":"git","directory":"delegation"},"_npmVersion":"11.6.2","description":"Verifiable delegated authority for agent actions. Human signs a scoped receipt; middleware verifies it before the agent calls a tool. SD-JWT/EdDSA today, ZKP upgrade path tomorrow.","directories":{},"_nodeVersion":"24.13.0","dependencies":{"jose":"^5.9.6"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"jest":"^29.7.0","ts-jest":"^29.2.0","typescript":"^5.5.0","@types/jest":"^29.5.0","@types/node":"^22.0.0"},"_npmOperationalInternal":{"tmp":"tmp/delegation_0.2.0_1778638791725_0.1906249645125797","host":"s3://npm-registry-packages-npm-production"}},"0.2.1":{"name":"@bolyra/delegation","version":"0.2.1","keywords":["agent","ai-agent","delegation","authorization","consent","ed25519","jwt","sd-jwt","agentic-commerce","mcp","langchain","openai-agents"],"author":{"name":"ZKProva Inc."},"license":"Apache-2.0","_id":"@bolyra/delegation@0.2.1","maintainers":[{"name":"saneguy","email":"kondojuviswanadha@gmail.com"}],"homepage":"https://bolyra.ai","bugs":{"url":"https://github.com/bolyra/bolyra/issues"},"dist":{"shasum":"83588df1656862fb2f0a01313b732dcb4bd80f6a","tarball":"https://registry.npmjs.org/@bolyra/delegation/-/delegation-0.2.1.tgz","fileCount":74,"integrity":"sha512-+/xeFB6d75APQkY632OPX/Gnny1oKYWhONN823skjk/sG/ulBFRt25XPhHdP5DR08OZS9U0iQZUjv0ixxhcOAA==","signatures":[{"sig":"MEUCICbioCqLK2eeLot5kezINNbAkySNjmyKI/zfObAL/xadAiEA/mox4I4T3nQ3iEqnYADk9HGbT0L228tAx9H9wei79ag=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":211089},"main":"dist/index.js","types":"dist/index.d.ts","gitHead":"25bd5430bbac57c8bdb2cf6fdb94012ee88f6571","scripts":{"test":"jest --passWithNoTests","build":"tsc","typecheck":"tsc --noEmit","prepublishOnly":"npm run typecheck && npm test && npm run build"},"_npmUser":{"name":"saneguy","email":"kondojuviswanadha@gmail.com"},"deprecated":"Incomplete F2 fix — jose's clockTolerance not yet wired. Use 0.2.2 or later.","repository":{"url":"git+https://github.com/bolyra/bolyra.git","type":"git","directory":"delegation"},"_npmVersion":"11.6.2","description":"Verifiable delegated authority for agent actions. Human signs a scoped receipt; middleware verifies it before the agent calls a tool. SD-JWT/EdDSA today, ZKP upgrade path tomorrow.","directories":{},"_nodeVersion":"24.13.0","dependencies":{"jose":"^5.9.6"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"jest":"^29.7.0","ts-jest":"^29.2.0","typescript":"^5.5.0","@types/jest":"^29.5.0","@types/node":"^22.0.0"},"_npmOperationalInternal":{"tmp":"tmp/delegation_0.2.1_1778640816002_0.4856336040307445","host":"s3://npm-registry-packages-npm-production"}},"0.2.2":{"name":"@bolyra/delegation","version":"0.2.2","keywords":["agent","ai-agent","delegation","authorization","consent","ed25519","jwt","sd-jwt","agentic-commerce","mcp","langchain","openai-agents"],"author":{"name":"ZKProva Inc."},"license":"Apache-2.0","_id":"@bolyra/delegation@0.2.2","maintainers":[{"name":"saneguy","email":"kondojuviswanadha@gmail.com"}],"homepage":"https://bolyra.ai","bugs":{"url":"https://github.com/bolyra/bolyra/issues"},"dist":{"shasum":"a909d74b4d3df6b6023449c0116cbe510ec0f2f9","tarball":"https://registry.npmjs.org/@bolyra/delegation/-/delegation-0.2.2.tgz","fileCount":74,"integrity":"sha512-5Jqb54O5gu0037JKkNxPMQf7A9wjye+dgKLygSsy2OcbnWcC9UD+zIgO3DK+4E1loaqskC3WePQqrZgty9eFpg==","signatures":[{"sig":"MEUCIQCxxdBqrhhfdsTwSkHBDGn+PVwjQD436lA5ROBs4Qj8hwIgZLp0ufLH8+YXsDvRYfelYiSw/JmIQ9CL8RZIDR6F7HU=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":212580},"main":"dist/index.js","types":"dist/index.d.ts","gitHead":"25bd5430bbac57c8bdb2cf6fdb94012ee88f6571","scripts":{"test":"jest --passWithNoTests","build":"tsc","typecheck":"tsc --noEmit","prepublishOnly":"npm run typecheck && npm test && npm run build"},"_npmUser":{"name":"saneguy","email":"kondojuviswanadha@gmail.com"},"repository":{"url":"git+https://github.com/bolyra/bolyra.git","type":"git","directory":"delegation"},"_npmVersion":"11.6.2","description":"Verifiable delegated authority for agent actions. Human signs a scoped receipt; middleware verifies it before the agent calls a tool. SD-JWT/EdDSA today, ZKP upgrade path tomorrow.","directories":{},"_nodeVersion":"24.13.0","dependencies":{"jose":"^5.9.6"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"jest":"^29.7.0","ts-jest":"^29.2.0","typescript":"^5.5.0","@types/jest":"^29.5.0","@types/node":"^22.0.0"},"_npmOperationalInternal":{"tmp":"tmp/delegation_0.2.2_1778640901596_0.7789601734877212","host":"s3://npm-registry-packages-npm-production"}},"0.2.3":{"name":"@bolyra/delegation","version":"0.2.3","description":"Verifiable delegated authority for agent actions. Human signs a scoped receipt; middleware verifies it before the agent calls a tool. SD-JWT/EdDSA today, ZKP upgrade path tomorrow.","main":"dist/index.js","types":"dist/index.d.ts","scripts":{"build":"tsc","test":"jest --passWithNoTests","typecheck":"tsc --noEmit","prepublishOnly":"npm run typecheck && npm test && npm run build"},"dependencies":{"jose":"^5.9.6"},"devDependencies":{"typescript":"^5.5.0","@types/node":"^26.0.0","jest":"^30.4.2","ts-jest":"^29.2.0","@types/jest":"^30.0.0"},"keywords":["agent","ai-agent","delegation","authorization","consent","ed25519","jwt","sd-jwt","agentic-commerce","mcp","langchain","openai-agents"],"repository":{"type":"git","url":"git+https://github.com/bolyra/bolyra.git","directory":"delegation"},"homepage":"https://bolyra.ai","publishConfig":{"access":"public"},"license":"Apache-2.0","author":{"name":"ZKProva Inc."},"gitHead":"d38d4c68228f2f51c48babbcf357b5269bff9928","_id":"@bolyra/delegation@0.2.3","bugs":{"url":"https://github.com/bolyra/bolyra/issues"},"_nodeVersion":"22.23.1","_npmVersion":"11.18.0","dist":{"integrity":"sha512-wpgwiPi5zbZaTAh+FAZEg5J0cbi7GRFQkOUQ6xGuvF0XERaI0ZzJnPBSkpz3LZd6wWoIY1ZTI1zwyr7bFyVRiQ==","shasum":"92d36f7d13bc8861b2135859f9f26311bf41f52b","tarball":"https://registry.npmjs.org/@bolyra/delegation/-/delegation-0.2.3.tgz","fileCount":74,"unpackedSize":214566,"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@bolyra%2fdelegation@0.2.3","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQC+pRMwnqLw5Lt7FLZvutDNSaea4nY8hblGbv2jf98TWgIhAP4V3pODtarVTpjkVPIX99+mdk9fxrLJBjedI748ojxf"}]},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:9b0adad9-1003-44d7-aa25-1009086b9694"}},"directories":{},"maintainers":[{"name":"saneguy","email":"kondojuviswanadha@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/delegation_0.2.3_1783700092331_0.7926917220728984"},"_hasShrinkwrap":false}},"time":{"created":"2026-05-05T03:18:36.547Z","modified":"2026-07-10T16:14:52.845Z","0.1.0":"2026-05-05T03:18:36.785Z","0.1.1":"2026-05-05T03:43:24.220Z","0.2.0":"2026-05-13T02:19:51.908Z","0.2.1":"2026-05-13T02:53:36.167Z","0.2.2":"2026-05-13T02:55:01.744Z","0.2.3":"2026-07-10T16:14:52.485Z"},"bugs":{"url":"https://github.com/bolyra/bolyra/issues"},"author":{"name":"ZKProva Inc."},"license":"Apache-2.0","homepage":"https://bolyra.ai","keywords":["agent","ai-agent","delegation","authorization","consent","ed25519","jwt","sd-jwt","agentic-commerce","mcp","langchain","openai-agents"],"repository":{"type":"git","url":"git+https://github.com/bolyra/bolyra.git","directory":"delegation"},"description":"Verifiable delegated authority for agent actions. Human signs a scoped receipt; middleware verifies it before the agent calls a tool. SD-JWT/EdDSA today, ZKP upgrade path tomorrow.","maintainers":[{"name":"saneguy","email":"kondojuviswanadha@gmail.com"}],"readme":"# @bolyra/delegation v0.2\n\n> SD-JWT (draft-20) + KB-JWT delegation receipts with IETF status-list (draft-20) revocation.\n\n`@bolyra/delegation` is the lightweight on-ramp into the [Bolyra](https://bolyra.ai) protocol. A human (or upstream agent) issues a scoped, holder-bound receipt; the holder presents it with a fresh key-binding JWT; middleware verifies before the agent calls a tool. Standards-aligned wire format means downstream verifiers can audit the receipt with off-the-shelf SD-JWT tooling.\n\n## Wire format\n\n```\n<issuer-jws>~~<kb-jwt>\n```\n\n- **Issuer JWS** — `typ: \"bolyra-delegation+sd-jwt\"`, `alg: \"EdDSA\"`, `_sd_alg: \"sha-256\"`. Payload includes `cnf.jwk` (holder pubkey) and `_sd: []` (zero disclosures in v0.2).\n- **KB-JWT** — `typ: \"kb+jwt\"`, signed by the holder. Payload `{aud, nonce, sd_hash, iat}` per SD-JWT draft-20 §4.3.\n- The empty middle segment between the two `~` separators is the zero-disclosure slot mandated by `draft-ietf-oauth-selective-disclosure-jwt-20`.\n\n## Install\n\n```bash\nnpm install @bolyra/delegation\n```\n\n## API\n\n```ts\nimport {\n  allow,\n  present,\n  verify,\n  staticIssuerResolver,\n  fetchStatusList,\n} from \"@bolyra/delegation\";\n\n// Issuer signs a scoped, holder-bound receipt.\nconst receipt = await allow(\n  {\n    iss: \"https://issuer.example\",\n    sub: \"did:bolyra:holder\",\n    aud: \"https://merchant.example\",\n    act: \"spend\",\n    perm: \"FINANCIAL_SMALL\",\n    agentPubKey: holderPublicKey,\n    ttlSeconds: 3600,\n    max: { amount: 5000, currency: \"USD\" },\n  },\n  { privateKey: issuerPrivateKey, kid: \"k1\" },\n);\n\n// Holder produces a presentation with a fresh KB-JWT.\nconst presented = await present(receipt, holderPrivateKey, {\n  audience: \"https://merchant.example\",\n  nonce: \"fresh-server-nonce\",\n});\n\n// Verifier validates the receipt + KB-JWT + (optionally) status-list.\nconst trustedIssuers = staticIssuerResolver({\n  \"https://issuer.example\": { k1: issuerPublicKey },\n});\n\nconst result = await verify(presented, {\n  audience: \"https://merchant.example\",\n  action: \"spend\",\n  perm: \"FINANCIAL_SMALL\",\n  kbNonce: \"fresh-server-nonce\",\n  amount: 1000,\n  currency: \"USD\",\n  trustedIssuers,\n  // Optional: revocation via IETF status-list draft-20.\n  checkStatus: (uri, idx, expectedIss) =>\n    fetchStatusList(uri, idx, expectedIss, { verifyKey: trustedIssuers }),\n});\n\nif (!result.ok) throw new Error(`delegation rejected: ${result.reason}`);\n// proceed with the call\n```\n\n## Permission model\n\nThe 8-bit cumulative encoding mirrors `circuits/Delegation.circom` so receipts are upgrade-compatible with full ZKP delegation later.\n\n| Bit | Permission | Notes |\n|-----|------------|-------|\n| 0 | `READ_DATA` | |\n| 1 | `WRITE_DATA` | |\n| 2 | `FINANCIAL_SMALL` | < $100 |\n| 3 | `FINANCIAL_MEDIUM` | < $10K (implies bit 2) |\n| 4 | `FINANCIAL_UNLIMITED` | implies bits 2 + 3 |\n| 5 | `SIGN_ON_BEHALF` | |\n| 6 | `SUB_DELEGATE` | |\n| 7 | `ACCESS_PII` | |\n\nIn v0.2, `perm` is passed as the string label (e.g. `\"FINANCIAL_SMALL\"`); the verifier expands cumulative implication internally.\n\n## Migration from v0.1\n\n- v0.1 plain-JWS receipts still verify if you pass `acceptLegacyV01: true` to `verify()`. The result includes `legacyV01: true`.\n- New issuance must use `allow()` (v0.2 only — produces SD-JWT issuer form).\n- Holders must sign the KB-JWT with the private key matching `cnf.jwk` in the receipt.\n- Status-list revocation is opt-in: set `claims.status.status_list = { uri, idx }` at issuance and pass `checkStatus` to `verify()`.\n\n## Failure reasons\n\n`VerifyFailureReason` is a discriminated union of 51 enumerated reasons (plus `\"UNKNOWN\"` as a catch-all default). Every enumerated reason is exercised by at least one test under `test/conformance/`. The negative-space gate (`test/conformance/negative-space.test.ts`) enforces full coverage in CI.\n\nReasons partition into five families:\n\n- **Envelope** — `BAD_FORMAT`, `INVALID_SIGNATURE`, `UNSUPPORTED_ALG`, `TYP_MISMATCH`, `KID_MISSING`, `KID_RESOLVER_ERROR`, `UNKNOWN_ISSUER_KID`, `LEGACY_V01_REJECTED`\n- **Claims** — `EXPIRED`, `FUTURE_NBF`, `WRONG_ISSUER`, `WRONG_AUDIENCE`, `WRONG_SUBJECT`, `WRONG_ACTION`, `MISSING_CLAIM`, `PARENT_NOT_FOUND`, `DELEGATION_LOOP`, `PERMISSION_VIOLATION`, `AMOUNT_EXCEEDS_CAP`, `CURRENCY_MISMATCH`\n- **Selective disclosure** — `DISCLOSURE_TAMPERED`, `DISCLOSURE_HASH_MISMATCH`, `UNDISCLOSED_CLAIM_REQUIRED`, `DUPLICATE_DISCLOSURE`, `MALFORMED_DISCLOSURE`, `SD_ALG_UNSUPPORTED`, `SD_JWT_MALFORMED`\n- **Key binding** — `CNF_MISSING`, `CNF_KEY_MISMATCH`, `CNF_JWK_INVALID`, `KB_MISSING`, `KB_NONCE_REQUIRED`, `KB_BAD_FORMAT`, `KB_INVALID_SIGNATURE`, `KB_WRONG_NONCE`, `KB_WRONG_AUDIENCE`, `KB_WRONG_SD_HASH`, `KB_TYP_INVALID`, `KB_ALG_UNSUPPORTED`, `KB_IAT_FUTURE`, `KB_IAT_TOO_OLD`, `KB_BINDING_MISMATCH`\n- **Status list** — `STATUS_REVOKED`, `STATUS_SUSPENDED`, `STATUS_CHECK_UNCONFIGURED`, `STATUS_LIST_INVALID`, `STATUS_LIST_SIG_INVALID`, `STATUS_LIST_ISSUER_MISMATCH`, `STATUS_LIST_UNREACHABLE`, `STATUS_INDEX_OUT_OF_RANGE`\n\n## Standards\n\n- **SD-JWT:** `draft-ietf-oauth-selective-disclosure-jwt-20`\n- **KB-JWT:** same draft, §4.3\n- **Status list:** `draft-ietf-oauth-status-list-20` (2-bit slots, zlib RFC 1950, base64url)\n- **JWK thumbprint:** RFC 7638\n- **Media types:** `application/bolyra-delegation+sd-jwt`, `application/statuslist+jwt`, `application/kb+jwt`\n\n## Roadmap\n\n- **v0.1:** EdDSA-signed plain JWS receipts (back-compat shim retained in v0.2).\n- **v0.2 (now):** SD-JWT + KB-JWT + IETF status-list revocation.\n- **v0.3:** ZKP-wrapped receipts (via `@bolyra/sdk` + Circom `Delegation` circuit). Privacy-preserving issuer + agent identity.\n\n## License\n\nApache-2.0. Patent grant per Apache 2.0 §3 (US provisional 64/043,898 filed 2026-04-20). DCO sign-off required for contributions (see `CONTRIBUTING.md` in repo root).\n","readmeFilename":"README.md"}