@agenticprimitives/types 1.0.0-alpha.15 → 1.0.0-alpha.17

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -0,0 +1,84 @@
1
+ import type { CanonicalAgentId, Hex32 } from './index.js';
2
+ /**
3
+ * A reference to a subject in any trust domain AP recognizes — a discriminated union, so a web2 identifier
4
+ * (OIDC `sub`, SPIFFE ID, OAuth agent-instance) and a web3 identifier (CAIP-10 Smart Agent) are the same shape
5
+ * but never conflated. **Ring 0 uses `caip10` for authority**; the rest are facets bound by proof.
6
+ */
7
+ export type SubjectRef = {
8
+ scheme: 'caip10';
9
+ id: CanonicalAgentId;
10
+ } | {
11
+ scheme: 'oidc';
12
+ issuer: string;
13
+ subject: string;
14
+ } | {
15
+ scheme: 'did';
16
+ id: string;
17
+ } | {
18
+ scheme: 'spiffe';
19
+ id: string;
20
+ trustDomain: string;
21
+ } | {
22
+ scheme: 'oauth-agent-instance';
23
+ issuer: string;
24
+ id: string;
25
+ };
26
+ /** Proof-of-possession key — proves control of a key, NOT who the agent is (web2: OAuth/OIDC `cnf`, RFC 7800;
27
+ * web3: the session-key / passkey credential). Rotating it must never change agent or instance identity. */
28
+ export interface ConfirmationKey {
29
+ method: 'jkt' | 'x5t#S256' | 'erc1271' | 'erc6492' | 'spiffe-key';
30
+ id: string;
31
+ }
32
+ /**
33
+ * The explicit actor roles carried on a hop (ADR-0052 §2). These roles may overlap in one hop and are
34
+ * INDEPENDENT of `AgentType` (person/org/service). Crucially `accountabilityRoot` ≠ `rootPrincipal`: the anchor
35
+ * is durable while the principal-as-represented may be pairwise/pseudonymous — that gap is the privacy story.
36
+ */
37
+ export interface ActorContextV1 {
38
+ /** The durable AP anchor everything traces back to (web2: accountable party / GDPR controller; web3: the
39
+ * ERC-4337 Smart Agent). Usually a Person or Organization SA. */
40
+ accountabilityRoot: SubjectRef;
41
+ /** The human/org ultimately represented (web2: OAuth/agency-law "principal"); MAY be pairwise/pseudonymous. */
42
+ rootPrincipal?: SubjectRef;
43
+ /** The agent that started the overall task. */
44
+ originatingAgent: SubjectRef;
45
+ /** The agent performing THIS hop — may be a sub-agent (web2: OAuth token-exchange `act` actor). */
46
+ actingAgent: SubjectRef;
47
+ /** The particular task/session/process/container runtime (web2: WIMSE/SPIFFE workload instance). */
48
+ agentInstance?: SubjectRef;
49
+ confirmationKey?: ConfirmationKey;
50
+ /** Pointer to the portable authority-chain projection (the on-chain authority chain, projected — spec 326 W2). */
51
+ authorityChain: {
52
+ profile: string;
53
+ digest: Hex32;
54
+ evidenceRef?: string;
55
+ };
56
+ /** Exact-invocation binding (spec 287) — what is being asked for, on this audience, once. */
57
+ invocation?: {
58
+ audience: string;
59
+ operation: string;
60
+ requestDigest: Hex32;
61
+ requestId: string;
62
+ expiresAt: string;
63
+ };
64
+ }
65
+ /** The typed cross-binding relationships (ADR-0052 §3 / spec 326 §3.3). A `SubjectBinding` is a signed, scoped,
66
+ * revocable RELATIONSHIP between two `SubjectRef`s — NEVER `owl:sameAs` / identifier equality. */
67
+ export type SubjectBindingRelationship = 'accountability-root-of' | 'represents-principal' | 'agent-identity-of' | 'runtime-instance-of' | 'controlled-by' | 'delegated-to' | 'executed-by-workload';
68
+ /** How strongly a binding is attested. Bilateral (`mutually-proven`) is preferred for cross-domain links. */
69
+ export type BindingAssurance = 'self-asserted' | 'mutually-proven' | 'third-party-attested';
70
+ /** A typed cross-binding credential (VC or signed JSON) — the proof that two identifiers in different trust
71
+ * domains refer to the same party, WITHOUT merging them. */
72
+ export interface SubjectBindingV1 {
73
+ type: 'SubjectBindingV1';
74
+ relationship: SubjectBindingRelationship;
75
+ from: SubjectRef;
76
+ to: SubjectRef;
77
+ assurance: BindingAssurance;
78
+ issuedAt?: string;
79
+ expiresAt?: string;
80
+ revocationRef?: string;
81
+ /** Digest both sides sign for a bilateral (`mutually-proven`) binding. */
82
+ bindingDigest?: Hex32;
83
+ }
84
+ //# sourceMappingURL=actor-context.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"actor-context.d.ts","sourceRoot":"","sources":["../src/actor-context.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAE1D;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,EAAE,EAAE,gBAAgB,CAAA;CAAE,GAC1C;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,MAAM,EAAE,sBAAsB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE;6GAC6G;AAC7G,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,KAAK,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAClE,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B;sEACkE;IAClE,kBAAkB,EAAE,UAAU,CAAC;IAC/B,+GAA+G;IAC/G,aAAa,CAAC,EAAE,UAAU,CAAC;IAC3B,+CAA+C;IAC/C,gBAAgB,EAAE,UAAU,CAAC;IAC7B,mGAAmG;IACnG,WAAW,EAAE,UAAU,CAAC;IACxB,oGAAoG;IACpG,aAAa,CAAC,EAAE,UAAU,CAAC;IAC3B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,kHAAkH;IAClH,cAAc,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,KAAK,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,6FAA6F;IAC7F,UAAU,CAAC,EAAE;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,KAAK,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED;mGACmG;AACnG,MAAM,MAAM,0BAA0B,GAClC,wBAAwB,GACxB,sBAAsB,GACtB,mBAAmB,GACnB,qBAAqB,GACrB,eAAe,GACf,cAAc,GACd,sBAAsB,CAAC;AAE3B,6GAA6G;AAC7G,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG,iBAAiB,GAAG,sBAAsB,CAAC;AAE5F;6DAC6D;AAC7D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,kBAAkB,CAAC;IACzB,YAAY,EAAE,0BAA0B,CAAC;IACzC,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,UAAU,CAAC;IACf,SAAS,EAAE,gBAAgB,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,KAAK,CAAC;CACvB"}
@@ -0,0 +1,9 @@
1
+ // Actor context + portable authority chain — spec 326 W1 (ADR-0052).
2
+ //
3
+ // TERMINOLOGY IS THE EXPLANATION. Every name here is deliberately the term a web2 IAM/security reader AND a
4
+ // web3 reader already recognize, pointing at the SAME concept — the machine-readable groundings live in
5
+ // `@agenticprimitives/ontology` (`GROUNDED_VOCABULARY` + `mappings/actor-context-standards.ttl`). Ring 0 uses
6
+ // the `caip10` SubjectRef for authority; every other scheme appears in bindings/projections only, NEVER as an
7
+ // authority source (ADR-0041) and NEVER as identifier equality with the SA (ADR-0052 §3).
8
+ export {};
9
+ //# sourceMappingURL=actor-context.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"actor-context.js","sourceRoot":"","sources":["../src/actor-context.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,4GAA4G;AAC5G,wGAAwG;AACxG,8GAA8G;AAC9G,8GAA8G;AAC9G,0FAA0F"}
package/dist/index.d.ts CHANGED
@@ -42,7 +42,7 @@ export interface Caip10Parts {
42
42
  /** Assurance ladder, ordered low→high. Threads into SSO step-up (ADR-0017). */
43
43
  export type Assurance = 'unverified' | 'asserted' | 'onchain-read' | 'onchain-confirmed';
44
44
  /** Credential facet kinds that can authenticate a session. */
45
- export type CredentialKind = 'passkey' | 'siwe-eoa' | 'hardware' | 'oidc';
45
+ export type CredentialKind = 'passkey' | 'siwe-eoa' | 'hardware' | 'oidc' | 'email' | 'phone';
46
46
  /** What a credential is trusted for. login-grade ≠ custody-grade (ADR-0017). */
47
47
  export type CredentialRole = 'login-grade' | 'custody-grade';
48
48
  /** The credential that authenticated a session — a facet key, NOT the identity. */
@@ -113,4 +113,20 @@ export interface NameContext {
113
113
  /** Discriminator for branching: person vs org vs service (treasury ⊂ service — not branched here). */
114
114
  agentType?: AgentType;
115
115
  }
116
+ /** 32-byte hash / digest hex (`0x` + 64 hex). Structurally a `Hex`; named for hash-shaped values. */
117
+ export type Hex32 = `0x${string}`;
118
+ /** A signature proof over a canonical digest. Verification is the runtime's job (ERC-1271/ECDSA/session-key);
119
+ * carrying this proof is never itself authorization. */
120
+ export interface SignatureProof {
121
+ signer: CanonicalAgentId;
122
+ scheme: 'erc1271' | 'ecdsa' | 'session-key';
123
+ signature: `0x${string}`;
124
+ }
125
+ /**
126
+ * Deterministic JSON canonicalization: sorted keys, `undefined` members dropped. The shared digest
127
+ * convention used across `messaging` / `verification-receipts` / `key-authorization` so cross-package tooling
128
+ * produces identical hashes. Pure (no clocks, no I/O, no crypto).
129
+ */
130
+ export declare function canonicalizeJson(v: unknown): string;
131
+ export type { SubjectRef, ConfirmationKey, ActorContextV1, SubjectBindingRelationship, BindingAssurance, SubjectBindingV1, } from './actor-context.js';
116
132
  //# sourceMappingURL=index.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,OAAO,GAAG,KAAK,MAAM,EAAE,CAAC;AACpC,MAAM,MAAM,GAAG,GAAG,KAAK,MAAM,EAAE,CAAC;AAChC,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,OAAO,MAAM,CAAA;CAAE,CAAC;AACrE,MAAM,MAAM,SAAS,CAAC,CAAC,SAAS,MAAM,IAAI,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;CAAE,CAAC;AAE3E;;;;;;;;GAQG;AACH,MAAM,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAQ7C;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEpE;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAE7C,gFAAgF;AAChF,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AASD,+EAA+E;AAC/E,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,UAAU,GAAG,cAAc,GAAG,mBAAmB,CAAC;AAEzF,8DAA8D;AAC9D,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,CAAC;AAE1E,gFAAgF;AAChF,MAAM,MAAM,cAAc,GAAG,aAAa,GAAG,eAAe,CAAC;AAE7D,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,cAAc,CAAC;IACrB,8EAA8E;IAC9E,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,SAAS,CAAC;IACrB,mFAAmF;IACnF,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,GAAG,EAAE,gBAAgB,CAAC;IACtB,sDAAsD;IACtD,SAAS,EAAE,mBAAmB,CAAC;IAC/B,oEAAoE;IACpE,SAAS,EAAE,SAAS,CAAC;IACrB,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,iBAAiB;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAYD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,KAAK,GAAG,SAAS,CAAC;AAErD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sGAAsG;IACtG,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,OAAO,GAAG,KAAK,MAAM,EAAE,CAAC;AACpC,MAAM,MAAM,GAAG,GAAG,KAAK,MAAM,EAAE,CAAC;AAChC,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,OAAO,MAAM,CAAA;CAAE,CAAC;AACrE,MAAM,MAAM,SAAS,CAAC,CAAC,SAAS,MAAM,IAAI,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;CAAE,CAAC;AAE3E;;;;;;;;GAQG;AACH,MAAM,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAQ7C;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEpE;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAE7C,gFAAgF;AAChF,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AASD,+EAA+E;AAC/E,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,UAAU,GAAG,cAAc,GAAG,mBAAmB,CAAC;AAEzF,8DAA8D;AAI9D,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAE9F,gFAAgF;AAChF,MAAM,MAAM,cAAc,GAAG,aAAa,GAAG,eAAe,CAAC;AAE7D,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,cAAc,CAAC;IACrB,8EAA8E;IAC9E,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,SAAS,CAAC;IACrB,mFAAmF;IACnF,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,GAAG,EAAE,gBAAgB,CAAC;IACtB,sDAAsD;IACtD,SAAS,EAAE,mBAAmB,CAAC;IAC/B,oEAAoE;IACpE,SAAS,EAAE,SAAS,CAAC;IACrB,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,iBAAiB;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAYD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,KAAK,GAAG,SAAS,CAAC;AAErD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sGAAsG;IACtG,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAOD,qGAAqG;AACrG,MAAM,MAAM,KAAK,GAAG,KAAK,MAAM,EAAE,CAAC;AAElC;yDACyD;AACzD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,gBAAgB,CAAC;IACzB,MAAM,EAAE,SAAS,GAAG,OAAO,GAAG,aAAa,CAAC;IAC5C,SAAS,EAAE,KAAK,MAAM,EAAE,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,CASnD;AAID,YAAY,EACV,UAAU,EACV,eAAe,EACf,cAAc,EACd,0BAA0B,EAC1B,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC"}
package/dist/index.js CHANGED
@@ -1,3 +1,19 @@
1
1
  // @agenticprimitives/types — cross-cutting branded primitives. Types-only.
2
- export {};
2
+ /**
3
+ * Deterministic JSON canonicalization: sorted keys, `undefined` members dropped. The shared digest
4
+ * convention used across `messaging` / `verification-receipts` / `key-authorization` so cross-package tooling
5
+ * produces identical hashes. Pure (no clocks, no I/O, no crypto).
6
+ */
7
+ export function canonicalizeJson(v) {
8
+ if (v === null || typeof v !== 'object')
9
+ return JSON.stringify(v) ?? 'null';
10
+ if (Array.isArray(v))
11
+ return `[${v.map(canonicalizeJson).join(',')}]`;
12
+ const o = v;
13
+ return `{${Object.keys(o)
14
+ .sort()
15
+ .filter((k) => o[k] !== undefined)
16
+ .map((k) => `${JSON.stringify(k)}:${canonicalizeJson(o[k])}`)
17
+ .join(',')}}`;
18
+ }
3
19
  //# sourceMappingURL=index.js.map
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,2EAA2E"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAqK3E;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAU;IACzC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IAC5E,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACtE,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;SACtB,IAAI,EAAE;SACN,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClB,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@agenticprimitives/types",
3
- "version": "1.0.0-alpha.15",
3
+ "version": "1.0.0-alpha.17",
4
4
  "description": "Cross-cutting branded types and chain primitives shared across @agenticprimitives/* packages.",
5
5
  "license": "MIT",
6
6
  "repository": {