# Sources

All accessed 2026-10-23. Local copies of the main specs are in docs/spec/.

## Receipt format
- W3C Verifiable Credentials Data Model v2.0 (Recommendation, 15 May 2025): https://www.w3.org/TR/vc-data-model-2.0/
  - §4.3 Contexts: `@context` must start with `https://www.w3.org/ns/credentials/v2`. We add an inline context object defining DeliveryReceipt, fileSha256, deliveredAt, byteLength under `urn:wayreceipt:v1#` (we do not rely on `@vocab`; see §5.2 Extensibility).
  - §4.4 Identifiers (`id` = urn:uuid), §4.5 Types, §4.7 Issuer (seller DID), §4.8 Credential Subject (buyer DID + file hash), §4.9 Validity Period (`validFrom`).
- W3C Verifiable Credential Data Integrity 1.0 (Recommendation, 15 May 2025): https://www.w3.org/TR/vc-data-integrity/
  - §2.1 Proofs (id, type, cryptosuite, created, verificationMethod, proofPurpose, proofValue, previousProof).
  - §2.1.2 Proof Chains: the buyer proof sets `previousProof` to the seller proof `id`, so the countersignature covers the seller's proof.
  - §4.3 Add Proof Set/Chain, §4.5 Verify Proof Sets and Chains (algorithms followed).
- W3C Data Integrity EdDSA Cryptosuites v1.0 (Recommendation, 15 May 2025): https://www.w3.org/TR/vc-di-eddsa/
  - §3.3 eddsa-jcs-2022 (transformation = JCS, hashing = SHA-256 of proof config || SHA-256 of document, Ed25519 signature, proofValue base58btc multibase).
  - §2.1.1 Multikey (0xed01 public key prefix, base58btc `z`).
  - Test vector B.3 is reproduced in test/receipt.test.js.
  - Interpretation note: for the first (seller) proof we sign the document without any `proof` member; for the buyer proof the document includes `proof: [sellerProof]` as §4.3 Add Proof Set/Chain describes.
- RFC 8785 JSON Canonicalization Scheme: https://www.rfc-editor.org/rfc/rfc8785
- did:key Method v0.9 (W3C CCG draft): https://w3c-ccg.github.io/did-key-spec/
- did:web Method (W3C CCG): https://w3c-ccg.github.io/did-method-web/

## Agent interfaces
- MCP Streamable HTTP, current version 2026-07-28: https://modelcontextprotocol.io/specification/2026-07-28/basic/transports ; schema https://modelcontextprotocol.io/specification/2026-07-28/schema (server/discover, resultType, HeaderMismatch -32020, UnsupportedProtocolVersion -32022).
- MCP Streamable HTTP, earlier versions (initialize handshake): https://modelcontextprotocol.io/specification/2025-06-18/basic/transports
- MCP Registry docs: https://github.com/modelcontextprotocol/registry/tree/main/docs/modelcontextprotocol-io (remote-servers.mdx, authentication.mdx); server.json schema https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json
- A2A Protocol 1.0.0, Agent Card §4.4.1, well-known URI §8.2 (`/.well-known/agent-card.json`): https://a2a-protocol.org/latest/specification/
- llms.txt proposal: https://llmstxt.org/
- OpenAPI 3.1.0: https://spec.openapis.org/oas/v3.1.0

## Hosting (Cloudflare free plan)
- Workers limits: https://developers.cloudflare.com/workers/platform/limits/
- D1 limits: https://developers.cloudflare.com/d1/platform/limits/ and pricing https://developers.cloudflare.com/d1/platform/pricing/
- Pages limits: https://developers.cloudflare.com/pages/platform/limits/

## Publishing
- npm 2FA for publishing: https://docs.npmjs.com/requiring-2fa-for-package-publishing-and-settings-modification ; account creation: https://docs.npmjs.com/creating-a-new-npm-user-account
- Codeberg first steps: https://docs.codeberg.org/getting-started/first-steps/