@agentcontextdistributionprotocol/acdp 0.8.1 → 0.8.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/index.d.ts +274 -266
  2. package/index.js +650 -262
  3. package/package.json +7 -7
package/index.d.ts CHANGED
@@ -1,159 +1,31 @@
1
- /* tslint:disable */
2
- /* eslint-disable */
3
-
4
1
  /* auto-generated by NAPI-RS */
5
-
6
- /**
7
- * A verification method resolved to raw public-key bytes, in the
8
- * base64 shape the host's pinned-key directory speaks.
9
- */
10
- export interface ResolvedDidKey {
11
- /** Verification-method id (full DID URL with `#fragment`). */
12
- keyId: string
13
- /** `ed25519` or `ecdsa-p256`. */
14
- algorithm: string
15
- /**
16
- * Standard base64 of the raw key bytes:
17
- * * ed25519 — 32 bytes
18
- * * ecdsa-p256 — 65-byte SEC1 uncompressed (`0x04 || x || y`)
19
- */
20
- publicKeyB64: string
21
- }
22
- /**
23
- * [`ResolvedDidKey`] plus the RFC-ACDP-0010 §9 lifecycle signal for
24
- * registry receipt keys.
25
- */
26
- export interface ResolvedReceiptKey {
27
- /** Verification-method id (full DID URL with `#fragment`). */
28
- keyId: string
29
- /** `ed25519` or `ecdsa-p256`. */
30
- algorithm: string
31
- /** Standard base64 of the raw key bytes (see [`ResolvedDidKey`]). */
32
- publicKeyB64: string
33
- /**
34
- * `true` when the key is retained in `verificationMethod` but no
35
- * longer referenced by `assertionMethod` — a retired receipt key.
36
- * Verify the receipt, but report it with the distinguishable
37
- * *historically authorized* status (RFC-ACDP-0010 §9).
38
- */
39
- historical: boolean
40
- }
41
- /**
42
- * Options for `buildPublishRequest`. Field names map directly to the
43
- * PublishRequest wire schema (camelCase on the JS side).
44
- */
45
- export interface PublishOpts {
46
- /** Human-readable title (1..=500 chars). */
47
- title: string
48
- /** Closed enum or namespaced custom (`^[a-z][a-z0-9_]*:[a-z][a-z0-9_-]*$`). */
49
- contextType: string
50
- /** `public` | `restricted` | `private`. Defaults to `public`. */
51
- visibility?: string
52
- /** Long human-readable description (≤ 5000 chars). */
53
- description?: string
54
- /**
55
- * Producer-supplied summary for search results (≤ 1000 chars).
56
- * Part of ProducerContent — included in the content_hash preimage.
57
- */
58
- summary?: string
59
- /** Free-form tags (each: `^[A-Za-z0-9][A-Za-z0-9_.-]*$`, ≤ 100 chars). */
60
- tags?: Array<string>
61
- /** Subject-domain identifier (≤ 200 chars). */
62
- domain?: string
63
- /**
64
- * Producer-specific structured metadata. MUST be a JSON-encoded
65
- * object string (it is re-parsed so it lands as a JSON object,
66
- * not a quoted string).
67
- */
68
- metadata?: string
69
- /**
70
- * Lineage of contexts this body was derived from (`acdp://…` ids,
71
- * ≤ 1000 unique).
72
- */
73
- derivedFrom?: Array<string>
74
- /** Audience DIDs — required (≥ 1) when `visibility = "restricted"`. */
75
- audience?: Array<string>
76
- /** Optional JSON Schema URI describing the metadata shape. */
77
- schemaUri?: string
78
- /** Contributors (DIDs, ≤ 100 unique). */
79
- contributors?: Array<string>
80
- /**
81
- * Data references — a JSON-encoded array of `acdp-data-ref` objects.
82
- * Part of ProducerContent, so it is included in the content_hash
83
- * preimage.
84
- */
85
- dataRefs?: string
86
- /**
87
- * RFC 3339 timestamp after which the conclusions should no longer be
88
- * relied upon. Truncated to millisecond precision.
89
- */
90
- expiresAt?: string
91
- /**
92
- * Time window the data covers — a JSON object
93
- * `{"start": <rfc3339>, "end": <rfc3339>}`. Both ends truncated to
94
- * millisecond precision.
95
- */
96
- dataPeriod?: string
97
- /**
98
- * Self-verifying `lin:sha256:<hex>` lineage id. v2+ supersession
99
- * only — rejected on first-version publishes.
100
- */
101
- expectedLineageId?: string
2
+ /* eslint-disable */
3
+ /** RFC 8785 canonicalization utilities. All methods are static. */
4
+ export declare class AcdpCanonicalizer {
102
5
  /**
103
- * Explicit `acdp_version` string for the emitted request.
6
+ * Canonicalize a JSON document to its RFC 8785 (JCS) form.
104
7
  *
105
- * **SDK default (since 0.2): `acdp_version` is emitted explicitly,
106
- * set to the library's current ACDP protocol version
107
- * (`acdp::ACDP_VERSION` `"0.2.0"` as of this release).** Per
108
- * RFC-ACDP-0001 §6 consumers treat an absent field as `"0.1.0"`,
109
- * but the omitted and explicit forms are *different JCS preimages*
110
- * and therefore hash differently — pick one form per lineage and
111
- * never switch mid-lineage.
112
- */
113
- acdpVersion?: string
114
- /**
115
- * When `true`, omit `acdp_version` entirely (the 0.1.x SDK default
116
- * form). Use this only to reproduce hashes signed under the
117
- * omitted form (e.g. the sig-001 golden vector); takes precedence
118
- * over `acdpVersion`.
119
- */
120
- omitAcdpVersion?: boolean
121
- }
122
- /**
123
- * Options for `buildSupersedeRequest`. Any field omitted is carried
124
- * over from `previousBodyJson` unchanged (mirrors `new_version_from`).
125
- */
126
- export interface SupersedeOpts {
127
- title?: string
128
- summary?: string
129
- description?: string
130
- tags?: Array<string>
131
- domain?: string
132
- metadata?: string
133
- /**
134
- * JSON-encoded array of `acdp-data-ref` objects (replaces the
135
- * carried-over data refs when present).
136
- */
137
- dataRefs?: string
138
- /** RFC 3339 expiry timestamp. */
139
- expiresAt?: string
140
- /** JSON object `{"start": <rfc3339>, "end": <rfc3339>}`. */
141
- dataPeriod?: string
142
- /** Self-verifying `lin:sha256:<hex>` lineage id (v2+). */
143
- expectedLineageId?: string
144
- /**
145
- * Explicit `acdp_version` string. **By default (since 0.2) the
146
- * library's current ACDP protocol version (`acdp::ACDP_VERSION` —
147
- * `"0.2.0"` as of this release) is emitted explicitly** — see
148
- * `PublishOpts.acdpVersion`. Do not switch the form mid-lineage.
8
+ * * `jsonStr` any JSON document as a string.
9
+ *
10
+ * Returns the canonical UTF-8 JSON string (sorted object keys, no
11
+ * whitespace, `-0.0` normalized to `0`, ECMAScript number
12
+ * formatting). Throws on malformed JSON, or if the document nests
13
+ * past the canonicalizer's recursion ceiling.
149
14
  */
150
- acdpVersion?: string
15
+ static canonicalize(jsonStr: string): string
151
16
  /**
152
- * When `true`, omit `acdp_version` entirely (the 0.1.x form);
153
- * takes precedence over `acdpVersion`.
17
+ * SHA-256 over the canonical (JCS) form of a JSON document, returned
18
+ * as the ACDP envelope `"sha256:<64-lowercase-hex>"`.
19
+ *
20
+ * This is the hashing primitive behind `content_hash` /
21
+ * `data_ref.content_hash`. It hashes the document *as given* — it
22
+ * does NOT strip the RFC-ACDP-0001 §5.7 exclusion set, so to
23
+ * recompute a body's `content_hash` the caller passes the already
24
+ * producer-controlled object (or uses `AcdpVerifier.verifyContentHash`).
154
25
  */
155
- omitAcdpVersion?: boolean
26
+ static contentHash(jsonStr: string): string
156
27
  }
28
+
157
29
  /** Stateless did:web string helpers. All methods are static. */
158
30
  export declare class AcdpDid {
159
31
  /**
@@ -173,6 +45,7 @@ export declare class AcdpDid {
173
45
  */
174
46
  static stripFragment(didUrl: string): string
175
47
  }
48
+
176
49
  /**
177
50
  * A parsed did:web DID document. Construct with
178
51
  * [`AcdpDidDocument::parse`], then resolve a signing key with
@@ -233,31 +106,7 @@ export declare class AcdpDidDocument {
233
106
  */
234
107
  receiptKeyForAlgorithm(requestedKeyId: string, requestedAlg: string): ResolvedReceiptKey
235
108
  }
236
- /** RFC 8785 canonicalization utilities. All methods are static. */
237
- export declare class AcdpCanonicalizer {
238
- /**
239
- * Canonicalize a JSON document to its RFC 8785 (JCS) form.
240
- *
241
- * * `jsonStr` — any JSON document as a string.
242
- *
243
- * Returns the canonical UTF-8 JSON string (sorted object keys, no
244
- * whitespace, `-0.0` normalized to `0`, ECMAScript number
245
- * formatting). Throws on malformed JSON, or if the document nests
246
- * past the canonicalizer's recursion ceiling.
247
- */
248
- static canonicalize(jsonStr: string): string
249
- /**
250
- * SHA-256 over the canonical (JCS) form of a JSON document, returned
251
- * as the ACDP envelope `"sha256:<64-lowercase-hex>"`.
252
- *
253
- * This is the hashing primitive behind `content_hash` /
254
- * `data_ref.content_hash`. It hashes the document *as given* — it
255
- * does NOT strip the RFC-ACDP-0001 §5.7 exclusion set, so to
256
- * recompute a body's `content_hash` the caller passes the already
257
- * producer-controlled object (or uses `AcdpVerifier.verifyContentHash`).
258
- */
259
- static contentHash(jsonStr: string): string
260
- }
109
+
261
110
  /** RFC-ACDP-0012 §5 Merkle helpers. All methods are static. */
262
111
  export declare class AcdpMerkle {
263
112
  /**
@@ -273,102 +122,19 @@ export declare class AcdpMerkle {
273
122
  static leafHash(leafJson: string): string
274
123
  /**
275
124
  * The §5.1 interior-node hash `SHA-256(0x01 ‖ left ‖ right)` over
276
- * the raw digests the two wire-form (`"sha256:<hex>"`) arguments
277
- * encode. The 0x00/0x01 domain-separation prefixes are what stop
278
- * leaf/node second-preimage forgeries — never hash without them.
279
- */
280
- static nodeHash(leftHash: string, rightHash: string): string
281
- /**
282
- * The §5.2 RFC 6962 Merkle tree hash `MTH(D[n])` over an ordered
283
- * JSON array of wire-form leaf hashes (`'["sha256:...", ...]'`).
284
- * An empty array yields the empty-tree root, `SHA-256("")`.
285
- */
286
- static rootHash(leafHashesJson: string): string
287
- }
288
- /**
289
- * An ACDP producer: an Ed25519 signing key and its DID identity
290
- * (`did:web`, or `did:key` via the `*DidKey` factories — ACDP 0.2).
291
- *
292
- * All methods return wire-ready JSON strings the caller sends via its
293
- * own HTTP client. No HTTP calls are made inside this class.
294
- */
295
- export declare class AcdpProducer {
296
- /** Generate a producer with a fresh random Ed25519 key (OsRng). */
297
- static generate(agentDid: string, keyId: string): AcdpProducer
298
- /**
299
- * Generate a producer whose identity **is** its fresh Ed25519 key
300
- * (`did:key`, ACDP 0.2). The `agentDid` and `keyId` are derived
301
- * from the public key — no domain, no DID-document hosting.
302
- * Consumers verify did:key contexts offline
303
- * (`AcdpVerifier.verifyBodyOffline`), with no dependency on the
304
- * producer's infrastructure remaining online.
305
- *
306
- * Tradeoff: did:key cannot rotate — a new key is a new identity,
307
- * and `supersedes` requires the same `agent_id`, so lineage
308
- * continuity ends with the key. Use `did:web` for long-lived
309
- * organizational anchors; use did:key for ephemeral or
310
- * archival-critical producers.
311
- */
312
- static generateDidKey(): AcdpProducer
313
- /**
314
- * Construct a `did:key` producer from a 32-byte Ed25519 seed.
315
- *
316
- * Deterministic — the same seed always derives the same
317
- * `agentDid` / `keyId`. The seed is the private key — protect it
318
- * as such. See [`AcdpProducer::generate_did_key`] for the did:key
319
- * rotation tradeoff.
320
- */
321
- static fromSeedDidKey(seed: Buffer): AcdpProducer
322
- /** Construct from a 32-byte Ed25519 seed (deterministic). */
323
- static fromSeed(seed: Buffer, agentDid: string, keyId: string): AcdpProducer
324
- /** The producer's DID (`did:web:…` or `did:key:…`). */
325
- get agentDid(): string
326
- /**
327
- * The producer's signing-key DID URL (`did:web:…#key-1`, or the
328
- * `did:key:z…#z…` self-fragment form).
329
- */
330
- get keyId(): string
331
- /**
332
- * Raw Ed25519 public key as standard base64 (44 chars with padding).
333
- * Use this to populate a did:web verification method.
334
- */
335
- get publicKeyB64(): string
336
- /**
337
- * The raw 32-byte seed, for storage in a key vault. Returns a
338
- * fresh `Buffer` each call — JS owns the bytes.
339
- */
340
- seedBytes(): Buffer
341
- /**
342
- * Build and sign a first-version PublishRequest. Returns the
343
- * wire JSON string.
344
- *
345
- * **By default (since 0.2) `acdp_version` is emitted explicitly,
346
- * set to the library's current ACDP protocol version
347
- * (`acdp::ACDP_VERSION` — `"0.2.0"` as of this release).** Pass
348
- * `omitAcdpVersion: true` to reproduce the 0.1.x omitted form (a
349
- * distinct JCS preimage, so a distinct `content_hash`), or
350
- * `acdpVersion` to pin another string.
351
- */
352
- buildPublishRequest(opts: PublishOpts): string
353
- /**
354
- * Build and sign a supersession PublishRequest from a previous
355
- * version's `Body` JSON. Version is propagated automatically
356
- * (`previous.version + 1`) and `lineage_id` is carried forward.
357
- *
358
- * **By default (since 0.2) `acdp_version` is emitted explicitly,
359
- * set to the library's current ACDP protocol version
360
- * (`acdp::ACDP_VERSION` — `"0.2.0"` as of this release)** — see
361
- * `buildPublishRequest`. Do not switch between the omitted and
362
- * explicit forms mid-lineage.
125
+ * the raw digests the two wire-form (`"sha256:<hex>"`) arguments
126
+ * encode. The 0x00/0x01 domain-separation prefixes are what stop
127
+ * leaf/node second-preimage forgeries — never hash without them.
363
128
  */
364
- buildSupersedeRequest(previousBodyJson: string, opts: SupersedeOpts): string
129
+ static nodeHash(leftHash: string, rightHash: string): string
365
130
  /**
366
- * Sign a registry auth-challenge `signingInput` string. Returns
367
- * the base64-encoded Ed25519 signature (88 chars with padding).
368
- * Used by the ACDP registry's bearer-token flow.
131
+ * The §5.2 RFC 6962 Merkle tree hash `MTH(D[n])` over an ordered
132
+ * JSON array of wire-form leaf hashes (`'["sha256:...", ...]'`).
133
+ * An empty array yields the empty-tree root, `SHA-256("")`.
369
134
  */
370
- signChallenge(signingInput: string): string
135
+ static rootHash(leafHashesJson: string): string
371
136
  }
137
+
372
138
  /**
373
139
  * An ACDP producer signing with ECDSA-P256 (`ecdsa-p256`) instead of
374
140
  * the Ed25519 baseline.
@@ -464,6 +230,92 @@ export declare class AcdpP256Producer {
464
230
  */
465
231
  signChallenge(signingInput: string): string
466
232
  }
233
+
234
+ /**
235
+ * An ACDP producer: an Ed25519 signing key and its DID identity
236
+ * (`did:web`, or `did:key` via the `*DidKey` factories — ACDP 0.2).
237
+ *
238
+ * All methods return wire-ready JSON strings the caller sends via its
239
+ * own HTTP client. No HTTP calls are made inside this class.
240
+ */
241
+ export declare class AcdpProducer {
242
+ /** Generate a producer with a fresh random Ed25519 key (OsRng). */
243
+ static generate(agentDid: string, keyId: string): AcdpProducer
244
+ /**
245
+ * Generate a producer whose identity **is** its fresh Ed25519 key
246
+ * (`did:key`, ACDP 0.2). The `agentDid` and `keyId` are derived
247
+ * from the public key — no domain, no DID-document hosting.
248
+ * Consumers verify did:key contexts offline
249
+ * (`AcdpVerifier.verifyBodyOffline`), with no dependency on the
250
+ * producer's infrastructure remaining online.
251
+ *
252
+ * Tradeoff: did:key cannot rotate — a new key is a new identity,
253
+ * and `supersedes` requires the same `agent_id`, so lineage
254
+ * continuity ends with the key. Use `did:web` for long-lived
255
+ * organizational anchors; use did:key for ephemeral or
256
+ * archival-critical producers.
257
+ */
258
+ static generateDidKey(): AcdpProducer
259
+ /**
260
+ * Construct a `did:key` producer from a 32-byte Ed25519 seed.
261
+ *
262
+ * Deterministic — the same seed always derives the same
263
+ * `agentDid` / `keyId`. The seed is the private key — protect it
264
+ * as such. See [`AcdpProducer::generate_did_key`] for the did:key
265
+ * rotation tradeoff.
266
+ */
267
+ static fromSeedDidKey(seed: Buffer): AcdpProducer
268
+ /** Construct from a 32-byte Ed25519 seed (deterministic). */
269
+ static fromSeed(seed: Buffer, agentDid: string, keyId: string): AcdpProducer
270
+ /** The producer's DID (`did:web:…` or `did:key:…`). */
271
+ get agentDid(): string
272
+ /**
273
+ * The producer's signing-key DID URL (`did:web:…#key-1`, or the
274
+ * `did:key:z…#z…` self-fragment form).
275
+ */
276
+ get keyId(): string
277
+ /**
278
+ * Raw Ed25519 public key as standard base64 (44 chars with padding).
279
+ * Use this to populate a did:web verification method.
280
+ */
281
+ get publicKeyB64(): string
282
+ /**
283
+ * The raw 32-byte seed, for storage in a key vault. Returns a
284
+ * fresh `Buffer` each call — JS owns the bytes.
285
+ */
286
+ seedBytes(): Buffer
287
+ /**
288
+ * Build and sign a first-version PublishRequest. Returns the
289
+ * wire JSON string.
290
+ *
291
+ * **By default (since 0.2) `acdp_version` is emitted explicitly,
292
+ * set to the library's current ACDP protocol version
293
+ * (`acdp::ACDP_VERSION` — `"0.2.0"` as of this release).** Pass
294
+ * `omitAcdpVersion: true` to reproduce the 0.1.x omitted form (a
295
+ * distinct JCS preimage, so a distinct `content_hash`), or
296
+ * `acdpVersion` to pin another string.
297
+ */
298
+ buildPublishRequest(opts: PublishOpts): string
299
+ /**
300
+ * Build and sign a supersession PublishRequest from a previous
301
+ * version's `Body` JSON. Version is propagated automatically
302
+ * (`previous.version + 1`) and `lineage_id` is carried forward.
303
+ *
304
+ * **By default (since 0.2) `acdp_version` is emitted explicitly,
305
+ * set to the library's current ACDP protocol version
306
+ * (`acdp::ACDP_VERSION` — `"0.2.0"` as of this release)** — see
307
+ * `buildPublishRequest`. Do not switch between the omitted and
308
+ * explicit forms mid-lineage.
309
+ */
310
+ buildSupersedeRequest(previousBodyJson: string, opts: SupersedeOpts): string
311
+ /**
312
+ * Sign a registry auth-challenge `signingInput` string. Returns
313
+ * the base64-encoded Ed25519 signature (88 chars with padding).
314
+ * Used by the ACDP registry's bearer-token flow.
315
+ */
316
+ signChallenge(signingInput: string): string
317
+ }
318
+
467
319
  /**
468
320
  * An SSRF policy: the synchronous classification half of the Rust
469
321
  * `SsrfPolicy`, exposed verdict-only (no DNS, no sockets).
@@ -510,6 +362,7 @@ export declare class AcdpSsrfPolicy {
510
362
  */
511
363
  checkRedirectAuthority(fromUrl: string, toUrl: string): void
512
364
  }
365
+
513
366
  /** Consumer-side verification utilities. All methods are static. */
514
367
  export declare class AcdpVerifier {
515
368
  /**
@@ -942,3 +795,158 @@ export declare class AcdpVerifier {
942
795
  */
943
796
  static evaluateWitnessQuorum(cosignaturesJson: string, expectedCheckpointJson: string, trustedWitnessDidsJson: string, witnessDidDocsJson: string, policyJson: string, nowRfc3339?: string | undefined | null): string
944
797
  }
798
+
799
+ /**
800
+ * Options for `buildPublishRequest`. Field names map directly to the
801
+ * PublishRequest wire schema (camelCase on the JS side).
802
+ */
803
+ export interface PublishOpts {
804
+ /** Human-readable title (1..=500 chars). */
805
+ title: string
806
+ /** Closed enum or namespaced custom (`^[a-z][a-z0-9_]*:[a-z][a-z0-9_-]*$`). */
807
+ contextType: string
808
+ /** `public` | `restricted` | `private`. Defaults to `public`. */
809
+ visibility?: string
810
+ /** Long human-readable description (≤ 5000 chars). */
811
+ description?: string
812
+ /**
813
+ * Producer-supplied summary for search results (≤ 1000 chars).
814
+ * Part of ProducerContent — included in the content_hash preimage.
815
+ */
816
+ summary?: string
817
+ /** Free-form tags (each: `^[A-Za-z0-9][A-Za-z0-9_.-]*$`, ≤ 100 chars). */
818
+ tags?: Array<string>
819
+ /** Subject-domain identifier (≤ 200 chars). */
820
+ domain?: string
821
+ /**
822
+ * Producer-specific structured metadata. MUST be a JSON-encoded
823
+ * object string (it is re-parsed so it lands as a JSON object,
824
+ * not a quoted string).
825
+ */
826
+ metadata?: string
827
+ /**
828
+ * Lineage of contexts this body was derived from (`acdp://…` ids,
829
+ * ≤ 1000 unique).
830
+ */
831
+ derivedFrom?: Array<string>
832
+ /** Audience DIDs — required (≥ 1) when `visibility = "restricted"`. */
833
+ audience?: Array<string>
834
+ /** Optional JSON Schema URI describing the metadata shape. */
835
+ schemaUri?: string
836
+ /** Contributors (DIDs, ≤ 100 unique). */
837
+ contributors?: Array<string>
838
+ /**
839
+ * Data references — a JSON-encoded array of `acdp-data-ref` objects.
840
+ * Part of ProducerContent, so it is included in the content_hash
841
+ * preimage.
842
+ */
843
+ dataRefs?: string
844
+ /**
845
+ * RFC 3339 timestamp after which the conclusions should no longer be
846
+ * relied upon. Truncated to millisecond precision.
847
+ */
848
+ expiresAt?: string
849
+ /**
850
+ * Time window the data covers — a JSON object
851
+ * `{"start": <rfc3339>, "end": <rfc3339>}`. Both ends truncated to
852
+ * millisecond precision.
853
+ */
854
+ dataPeriod?: string
855
+ /**
856
+ * Self-verifying `lin:sha256:<hex>` lineage id. v2+ supersession
857
+ * only — rejected on first-version publishes.
858
+ */
859
+ expectedLineageId?: string
860
+ /**
861
+ * Explicit `acdp_version` string for the emitted request.
862
+ *
863
+ * **SDK default (since 0.2): `acdp_version` is emitted explicitly,
864
+ * set to the library's current ACDP protocol version
865
+ * (`acdp::ACDP_VERSION` — `"0.2.0"` as of this release).** Per
866
+ * RFC-ACDP-0001 §6 consumers treat an absent field as `"0.1.0"`,
867
+ * but the omitted and explicit forms are *different JCS preimages*
868
+ * and therefore hash differently — pick one form per lineage and
869
+ * never switch mid-lineage.
870
+ */
871
+ acdpVersion?: string
872
+ /**
873
+ * When `true`, omit `acdp_version` entirely (the 0.1.x SDK default
874
+ * form). Use this only to reproduce hashes signed under the
875
+ * omitted form (e.g. the sig-001 golden vector); takes precedence
876
+ * over `acdpVersion`.
877
+ */
878
+ omitAcdpVersion?: boolean
879
+ }
880
+
881
+ /**
882
+ * A verification method resolved to raw public-key bytes, in the
883
+ * base64 shape the host's pinned-key directory speaks.
884
+ */
885
+ export interface ResolvedDidKey {
886
+ /** Verification-method id (full DID URL with `#fragment`). */
887
+ keyId: string
888
+ /** `ed25519` or `ecdsa-p256`. */
889
+ algorithm: string
890
+ /**
891
+ * Standard base64 of the raw key bytes:
892
+ * * ed25519 — 32 bytes
893
+ * * ecdsa-p256 — 65-byte SEC1 uncompressed (`0x04 || x || y`)
894
+ */
895
+ publicKeyB64: string
896
+ }
897
+
898
+ /**
899
+ * [`ResolvedDidKey`] plus the RFC-ACDP-0010 §9 lifecycle signal for
900
+ * registry receipt keys.
901
+ */
902
+ export interface ResolvedReceiptKey {
903
+ /** Verification-method id (full DID URL with `#fragment`). */
904
+ keyId: string
905
+ /** `ed25519` or `ecdsa-p256`. */
906
+ algorithm: string
907
+ /** Standard base64 of the raw key bytes (see [`ResolvedDidKey`]). */
908
+ publicKeyB64: string
909
+ /**
910
+ * `true` when the key is retained in `verificationMethod` but no
911
+ * longer referenced by `assertionMethod` — a retired receipt key.
912
+ * Verify the receipt, but report it with the distinguishable
913
+ * *historically authorized* status (RFC-ACDP-0010 §9).
914
+ */
915
+ historical: boolean
916
+ }
917
+
918
+ /**
919
+ * Options for `buildSupersedeRequest`. Any field omitted is carried
920
+ * over from `previousBodyJson` unchanged (mirrors `new_version_from`).
921
+ */
922
+ export interface SupersedeOpts {
923
+ title?: string
924
+ summary?: string
925
+ description?: string
926
+ tags?: Array<string>
927
+ domain?: string
928
+ metadata?: string
929
+ /**
930
+ * JSON-encoded array of `acdp-data-ref` objects (replaces the
931
+ * carried-over data refs when present).
932
+ */
933
+ dataRefs?: string
934
+ /** RFC 3339 expiry timestamp. */
935
+ expiresAt?: string
936
+ /** JSON object `{"start": <rfc3339>, "end": <rfc3339>}`. */
937
+ dataPeriod?: string
938
+ /** Self-verifying `lin:sha256:<hex>` lineage id (v2+). */
939
+ expectedLineageId?: string
940
+ /**
941
+ * Explicit `acdp_version` string. **By default (since 0.2) the
942
+ * library's current ACDP protocol version (`acdp::ACDP_VERSION` —
943
+ * `"0.2.0"` as of this release) is emitted explicitly** — see
944
+ * `PublishOpts.acdpVersion`. Do not switch the form mid-lineage.
945
+ */
946
+ acdpVersion?: string
947
+ /**
948
+ * When `true`, omit `acdp_version` entirely (the 0.1.x form);
949
+ * takes precedence over `acdpVersion`.
950
+ */
951
+ omitAcdpVersion?: boolean
952
+ }