@agenticprimitives/verifiable-credentials 0.0.0-alpha.10

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Agentic Trust Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,45 @@
+# @agenticprimitives/verifiable-credentials
+
+**A credential is only as durable as the identity it points at.** Most verifiable-credential stacks bind claims to a key — and when the key rotates, the trust graph quietly breaks. Here the issuer and subject of every credential is a Smart Agent address: a persistent ERC-4337 account whose keys are replaceable facets. Rotate a passkey, recover from a lost device, swap a signer — the address persists, and every credential issued by or about it stays verifiable.
+
+This package is the W3C VC 2.0 envelope for that model: an `Eip712Signature2026` proof signed by a smart account and verified with an ERC-1271 round-trip against the chain, plus the RFC 8785 (JCS) canonical hash that every downstream registry stores as the on-chain anchor. It is the substrate layer — specific credential types (associations, agreements, evidence, outcomes, receipts) are composed on top by consumer packages.
+
+> Part of [agenticprimitives](../../README.md) — the trust substrate for the agent economy: one canonical Smart Agent identity with custody, delegation, naming, credentials, and audit evidence designed as one system.
+
+## What ships today
+
+- **W3C VC 2.0 envelope** — `@context`, `type`, `issuer`, `validFrom`, `credentialSubject`, `proof`, `credentialStatus` (`VerifiableCredential`, `UnsignedCredential` types).
+- **`Eip712Signature2026` proof** — `signCredential(unsigned, signer)` produces the proof; `eip712Digest(...)` matches the Solidity verifier byte-for-byte (cross-stack typehash equality, CI-gated per spec 242 §4.3).
+- **Verifier** — `verifyCredential(vc, client)` runs structural checks, recomputes the digest, and verifies the issuer signature via ERC-1271 against the issuer's Smart Agent. One mechanism, no silent fallbacks ([ADR-0013](../../docs/architecture/decisions/0013-no-silent-fallbacks.md)). `verifyCredentialStructural(vc)` is the offline subset.
+- **Canonical hash** — `credentialHash(vc)` / `canonicalHash(...)` / `jcsCanonicalize(...)`: the RFC 8785 JCS hash used as the credential anchor everywhere downstream (attestation registries, vault indexes, status lists).
+- **DOLCE+DnS Situation pattern** — `buildSituation(...)` and the `Situation` / `DescriptionRef` / `RoleName` shapes that all substrate credential subjects compose against.
+- **Schema URIs** — `buildShapeUri` / `parseShapeUri` / `shapeHash` for the `did:shape:<name>:<version>` convention that pairs with the on-chain `ShapeRegistry`.
+
+```ts
+import { credentialHash, verifyCredential } from '@agenticprimitives/verifiable-credentials';
+
+const anchor = credentialHash(vc);                 // RFC 8785 JCS hash — what registries store
+const result = await verifyCredential(vc, client); // ERC-1271 round-trip against the issuer Smart Agent
+```
+
+## How it's different
+
+Veramo, Trinsic, and the broader W3C VC tooling ecosystem resolve issuers through DID methods and key registries — so credential validity is coupled to key material. Here the issuer is a CAIP-10 smart-account address and verification is ERC-1271 against the chain: **keys rotate, the address persists, credentials survive recovery** ([ADR-0011](../../docs/architecture/decisions/0011-credential-recovery-and-re-association.md)). And because the EIP-712 digest is locked to its Solidity counterpart by a CI gate, the contracts and the SDK are one artifact — the client cannot drift from the chain, which is precisely where stitched VC stacks decay.
+
+The package is deliberately a leaf: it imports only `types`, `ontology`, `viem`, and `@noble/hashes`, and defines no specific credential types — `attestations`, `agreements`, `fulfillment`, and `payments` own those.
+
+## Status
+
+**W1 foundational — implemented and security-load-bearing.** The envelope, proof, canonical hash, and verifier ship today and are exercised by downstream packages; verifier findings VC-1/VC-2 are closed (see [AUDIT.md](./AUDIT.md)). Alternative proof types (BBS+ / SD-JWT / AnonCreds) have a reserved envelope slot and land in later waves per the [W1 implementation wave plan](../../docs/architecture/w1-implementation-wave-plan.md).
+
+> Testnet/pilot-ready. Production launch is gated on the public checklist in the root README — including third-party contract audit and governance key rotation. Track every security finding live in [`docs/audits/findings.yaml`](../../docs/audits/findings.yaml).
+
+**Authoritative spec:** [`specs/242-trust-credentials-and-public-assertions.md`](../../specs/242-trust-credentials-and-public-assertions.md) §4 — see `spec.md` for the symlink. Bounded surface: `CLAUDE.md` + `capability.manifest.json`.
+
+## Build
+
+```bash
+pnpm --filter @agenticprimitives/verifiable-credentials typecheck
+pnpm --filter @agenticprimitives/verifiable-credentials test
+pnpm --filter @agenticprimitives/verifiable-credentials build
+```

package/dist/canonical.d.ts

@@ -0,0 +1,34 @@
+/**
+ * RFC 8785 JSON Canonicalization Scheme (JCS) — deterministic JSON serialisation
+ * for cross-stack hash equality (TS ↔ Solidity ↔ Java/Go verifiers).
+ *
+ * The substrate's `credentialHash` is `keccak256(jcsCanonicalize(vc-without-proof))`.
+ * Every package that needs to recompute the hash MUST go through this helper.
+ *
+ * RFC 8785 rules:
+ *  - UTF-8 strings, NFC normalisation (browsers ship NFC already)
+ *  - Object keys sorted by UTF-16 code unit (== lexicographic in BMP)
+ *  - No insignificant whitespace
+ *  - Numbers as the shortest IEEE 754 round-trip representation
+ *  - Booleans `true` / `false` / `null` lowercase
+ *  - Strings JSON-escape U+0000..U+001F, U+0022, U+005C only; emit other code points as-is
+ *
+ * This implementation is intentionally narrow: substrate VCs use a constrained
+ * subset of JSON (string / number / boolean / null / object / array). We do not
+ * handle BigInt or Date — callers must serialise those upstream.
+ */
+export declare class JcsError extends Error {
+    readonly path: string;
+    constructor(message: string, path: string);
+}
+/**
+ * Canonicalize a JSON-compatible value per RFC 8785.
+ * Returns the canonical string (UTF-8 text; callers wrap with `utf8ToBytes` to hash).
+ */
+export declare function jcsCanonicalize(value: unknown, path?: string): string;
+/**
+ * Compute the canonical hash of a value: `keccak256(jcsCanonicalize(value))`.
+ * Returns the 32-byte hex hash.
+ */
+export declare function canonicalHash(value: unknown): `0x${string}`;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../src/canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,qBAAa,QAAS,SAAQ,KAAK;IACJ,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAtC,OAAO,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM;CAGnD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,GAAE,MAAY,GAAG,MAAM,CA2B1E;AAkED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,MAAM,EAAE,CAK3D"}

package/dist/canonical.js

@@ -0,0 +1,146 @@
+/**
+ * RFC 8785 JSON Canonicalization Scheme (JCS) — deterministic JSON serialisation
+ * for cross-stack hash equality (TS ↔ Solidity ↔ Java/Go verifiers).
+ *
+ * The substrate's `credentialHash` is `keccak256(jcsCanonicalize(vc-without-proof))`.
+ * Every package that needs to recompute the hash MUST go through this helper.
+ *
+ * RFC 8785 rules:
+ *  - UTF-8 strings, NFC normalisation (browsers ship NFC already)
+ *  - Object keys sorted by UTF-16 code unit (== lexicographic in BMP)
+ *  - No insignificant whitespace
+ *  - Numbers as the shortest IEEE 754 round-trip representation
+ *  - Booleans `true` / `false` / `null` lowercase
+ *  - Strings JSON-escape U+0000..U+001F, U+0022, U+005C only; emit other code points as-is
+ *
+ * This implementation is intentionally narrow: substrate VCs use a constrained
+ * subset of JSON (string / number / boolean / null / object / array). We do not
+ * handle BigInt or Date — callers must serialise those upstream.
+ */
+import { keccak_256 } from '@noble/hashes/sha3.js';
+import { utf8ToBytes } from '@noble/hashes/utils.js';
+export class JcsError extends Error {
+    path;
+    constructor(message, path) {
+        super(`[JCS] ${message} at ${path}`);
+        this.path = path;
+    }
+}
+/**
+ * Canonicalize a JSON-compatible value per RFC 8785.
+ * Returns the canonical string (UTF-8 text; callers wrap with `utf8ToBytes` to hash).
+ */
+export function jcsCanonicalize(value, path = '$') {
+    if (value === null)
+        return 'null';
+    if (value === undefined) {
+        throw new JcsError('undefined is not JSON', path);
+    }
+    switch (typeof value) {
+        case 'boolean':
+            return value ? 'true' : 'false';
+        case 'string':
+            return serializeString(value);
+        case 'number':
+            return serializeNumber(value, path);
+        case 'object': {
+            if (Array.isArray(value)) {
+                const items = value.map((v, i) => jcsCanonicalize(v, `${path}[${i}]`));
+                return `[${items.join(',')}]`;
+            }
+            // Plain object
+            const entries = Object.entries(value)
+                .filter(([, v]) => v !== undefined)
+                .sort(([a], [b]) => sortByCodeUnit(a, b));
+            const items = entries.map(([k, v]) => `${serializeString(k)}:${jcsCanonicalize(v, `${path}.${k}`)}`);
+            return `{${items.join(',')}}`;
+        }
+        default:
+            throw new JcsError(`unsupported JSON type: ${typeof value}`, path);
+    }
+}
+/** UTF-16 code unit comparison — exactly what RFC 8785 §3.2.3 requires. */
+function sortByCodeUnit(a, b) {
+    const len = Math.min(a.length, b.length);
+    for (let i = 0; i < len; i++) {
+        const av = a.charCodeAt(i);
+        const bv = b.charCodeAt(i);
+        if (av !== bv)
+            return av - bv;
+    }
+    return a.length - b.length;
+}
+/** RFC 8259 string serialisation with JCS-compatible escaping (RFC 8785 §3.2.2.2). */
+function serializeString(s) {
+    let out = '"';
+    for (let i = 0; i < s.length; i++) {
+        const code = s.charCodeAt(i);
+        if (code === 0x22) {
+            out += '\\"';
+        }
+        else if (code === 0x5c) {
+            out += '\\\\';
+        }
+        else if (code < 0x20) {
+            // Control characters
+            switch (code) {
+                case 0x08:
+                    out += '\\b';
+                    break;
+                case 0x09:
+                    out += '\\t';
+                    break;
+                case 0x0a:
+                    out += '\\n';
+                    break;
+                case 0x0c:
+                    out += '\\f';
+                    break;
+                case 0x0d:
+                    out += '\\r';
+                    break;
+                default:
+                    out += `\\u${code.toString(16).padStart(4, '0')}`;
+            }
+        }
+        else {
+            out += s[i];
+        }
+    }
+    out += '"';
+    return out;
+}
+/** RFC 8785 §3.2.2.3 — shortest round-tripping IEEE 754 representation. */
+function serializeNumber(n, path) {
+    if (!Number.isFinite(n)) {
+        throw new JcsError(`non-finite number (${n})`, path);
+    }
+    if (Object.is(n, -0))
+        return '0';
+    if (n === 0)
+        return '0';
+    if (Number.isInteger(n) && Math.abs(n) < 1e21) {
+        return n.toString();
+    }
+    // Browsers + Node give us the shortest round-trip via `toString()`
+    // (per ECMA-262 §6.1.6.1.13). RFC 8785 expects the ES round-trip form.
+    return n.toString();
+}
+/**
+ * Compute the canonical hash of a value: `keccak256(jcsCanonicalize(value))`.
+ * Returns the 32-byte hex hash.
+ */
+export function canonicalHash(value) {
+    const canonical = jcsCanonicalize(value);
+    const bytes = utf8ToBytes(canonical);
+    const digest = keccak_256(bytes);
+    return `0x${bytesToHex(digest)}`;
+}
+function bytesToHex(b) {
+    let s = '';
+    for (const v of b) {
+        s += v.toString(16).padStart(2, '0');
+    }
+    return s;
+}
+//# sourceMappingURL=canonical.js.map

package/dist/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../src/canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,MAAM,OAAO,QAAS,SAAQ,KAAK;IACK;IAAtC,YAAY,OAAe,EAAW,IAAY;QAChD,KAAK,CAAC,SAAS,OAAO,OAAO,IAAI,EAAE,CAAC,CAAC;QADD,SAAI,GAAJ,IAAI,CAAQ;IAElD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,OAAe,GAAG;IAChE,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,QAAQ,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,QAAQ,OAAO,KAAK,EAAE,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAClC,KAAK,QAAQ;YACX,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;QAChC,KAAK,QAAQ;YACX,OAAO,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACtC,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBACvE,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAChC,CAAC;YACD,eAAe;YACf,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;iBAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;iBAClC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACrG,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAChC,CAAC;QACD;YACE,MAAM,IAAI,QAAQ,CAAC,0BAA0B,OAAO,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,SAAS,cAAc,CAAC,CAAS,EAAE,CAAS;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;AAC7B,CAAC;AAED,sFAAsF;AACtF,SAAS,eAAe,CAAC,CAAS;IAChC,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,GAAG,IAAI,KAAK,CAAC;QACf,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACzB,GAAG,IAAI,MAAM,CAAC;QAChB,CAAC;aAAM,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;YACvB,qBAAqB;YACrB,QAAQ,IAAI,EAAE,CAAC;gBACb,KAAK,IAAI;oBACP,GAAG,IAAI,KAAK,CAAC;oBACb,MAAM;gBACR,KAAK,IAAI;oBACP,GAAG,IAAI,KAAK,CAAC;oBACb,MAAM;gBACR,KAAK,IAAI;oBACP,GAAG,IAAI,KAAK,CAAC;oBACb,MAAM;gBACR,KAAK,IAAI;oBACP,GAAG,IAAI,KAAK,CAAC;oBACb,MAAM;gBACR,KAAK,IAAI;oBACP,GAAG,IAAI,KAAK,CAAC;oBACb,MAAM;gBACR;oBACE,GAAG,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YACtD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IACD,GAAG,IAAI,GAAG,CAAC;IACX,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2EAA2E;AAC3E,SAAS,eAAe,CAAC,CAAS,EAAE,IAAY;IAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IACxB,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;QAC9C,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtB,CAAC;IACD,mEAAmE;IACnE,uEAAuE;IACvE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,KAAK,UAAU,CAAC,MAAM,CAAC,EAAmB,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,CAAa;IAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAClB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @agenticprimitives/verifiable-credentials — W3C VC 2.0 envelope, EIP-712
+ * + ERC-1271 proof, DOLCE+DnS Situation bases, JCS canonical hash, and the
+ * schema-registration helper.
+ *
+ * Substrate for spine layers 12–15 credential classes; consumers (attestations,
+ * agreements, payments, fulfillment) compose specific credential types on top.
+ *
+ * Authoritative spec: specs/242-trust-credentials-and-public-assertions.md
+ */
+export declare const PACKAGE_NAME = "@agenticprimitives/verifiable-credentials";
+export declare const PACKAGE_STATUS: "w1-foundational";
+export declare const SPEC_REF = "specs/242-trust-credentials-and-public-assertions.md";
+export { VC_CONTEXT_V2, EIP712_SIG_2026_CONTEXT, VC_DOMAIN_NAME, VC_DOMAIN_VERSION, VC_EIP712_TYPES, } from './types.js';
+export type { Hex32, ISODate, ProofType, Eip712Signature2026Proof, DelegatingSignerProof, Proof, CredentialStatus2021, VisibilityTier, DisclosurePolicy, VerifiableCredential, UnsignedCredential, } from './types.js';
+export { jcsCanonicalize, canonicalHash, JcsError } from './canonical.js';
+export { assertSituationRolesPresent, buildSituation, } from './situation.js';
+export type { Situation, DescriptionRef, RoleName } from './situation.js';
+export { credentialHash, eip712Digest, isoToSeconds, signCredential, viemSignerFromWallet, kmsCredentialSigner, } from './proof.js';
+export type { CredentialSigner, KmsSigningBackend } from './proof.js';
+export { verifyCredential, verifyCredentialStructural, parseEip155Caip10 } from './verifier.js';
+export type { VerificationResult, VerifyCredentialResult, VerifyCredentialOpts, CredentialStatusResolver, Erc1271Verifier, Caip10Eip155, } from './verifier.js';
+export { SHAPE_DID_PREFIX, buildShapeUri, parseShapeUri, shapeHash } from './schema.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,eAAO,MAAM,YAAY,8CAA8C,CAAC;AACxE,eAAO,MAAM,cAAc,EAAG,iBAA0B,CAAC;AACzD,eAAO,MAAM,QAAQ,yDAAyD,CAAC;AAG/E,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,KAAK,EACL,OAAO,EACP,SAAS,EACT,wBAAwB,EACxB,qBAAqB,EACrB,KAAK,EACL,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1E,OAAO,EACL,2BAA2B,EAC3B,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1E,OAAO,EACL,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAGtE,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAChG,YAAY,EACV,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,YAAY,GACb,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,26 @@
+/**
+ * @agenticprimitives/verifiable-credentials — W3C VC 2.0 envelope, EIP-712
+ * + ERC-1271 proof, DOLCE+DnS Situation bases, JCS canonical hash, and the
+ * schema-registration helper.
+ *
+ * Substrate for spine layers 12–15 credential classes; consumers (attestations,
+ * agreements, payments, fulfillment) compose specific credential types on top.
+ *
+ * Authoritative spec: specs/242-trust-credentials-and-public-assertions.md
+ */
+export const PACKAGE_NAME = '@agenticprimitives/verifiable-credentials';
+export const PACKAGE_STATUS = 'w1-foundational';
+export const SPEC_REF = 'specs/242-trust-credentials-and-public-assertions.md';
+// Types + constants
+export { VC_CONTEXT_V2, EIP712_SIG_2026_CONTEXT, VC_DOMAIN_NAME, VC_DOMAIN_VERSION, VC_EIP712_TYPES, } from './types.js';
+// Canonical hash + JCS
+export { jcsCanonicalize, canonicalHash, JcsError } from './canonical.js';
+// Situation pattern
+export { assertSituationRolesPresent, buildSituation, } from './situation.js';
+// Proof builder
+export { credentialHash, eip712Digest, isoToSeconds, signCredential, viemSignerFromWallet, kmsCredentialSigner, } from './proof.js';
+// Verifier
+export { verifyCredential, verifyCredentialStructural, parseEip155Caip10 } from './verifier.js';
+// Schema registration
+export { SHAPE_DID_PREFIX, buildShapeUri, parseShapeUri, shapeHash } from './schema.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,2CAA2C,CAAC;AACxE,MAAM,CAAC,MAAM,cAAc,GAAG,iBAA0B,CAAC;AACzD,MAAM,CAAC,MAAM,QAAQ,GAAG,sDAAsD,CAAC;AAE/E,oBAAoB;AACpB,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,eAAe,GAChB,MAAM,YAAY,CAAC;AAepB,uBAAuB;AACvB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1E,oBAAoB;AACpB,OAAO,EACL,2BAA2B,EAC3B,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,gBAAgB;AAChB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAGpB,WAAW;AACX,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAUhG,sBAAsB;AACtB,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC"}

package/dist/proof.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Eip712Signature2026 proof builder — signs the canonical hash of a credential
+ * subject + envelope metadata with EIP-712 typed data, producing an
+ * ERC-1271-verifiable signature.
+ *
+ * Spec 242 §4.3 + ADR-0023 §D2.
+ */
+import { type Address, type Hex, type WalletClient } from 'viem';
+import { type Eip712Signature2026Proof, type Hex32, type Proof, type UnsignedCredential, type VerifiableCredential } from './types.js';
+/** A signer abstraction so callers can wire viem wallet client OR a custom signer. */
+export interface CredentialSigner {
+    /** Address of the SA that will be the issuer (verified via ERC-1271). */
+    issuerAddress: Address;
+    /** EIP-712 chain id + verifying-contract anchor for the SA. */
+    chainId: number;
+    /** Must match the SA's verifying contract (typically the SA itself for ERC-1271). */
+    verifyingContract: Address;
+    /**
+     * Sign an arbitrary 32-byte digest. Implementations route through whatever
+     * the SA's signing path is (passkey, EOA wrap, KMS, multi-sig, etc.).
+     */
+    signDigest(digest: Hex32): Promise<Hex>;
+}
+/**
+ * Compute the canonical hash of an unsigned credential — strips `proof`,
+ * applies RFC 8785 JCS canonicalisation, returns keccak256.
+ */
+export declare function credentialHash(unsigned: UnsignedCredential | VerifiableCredential): Hex32;
+/**
+ * Compute the EIP-712 typed-data digest the signer signs. Cross-stack typehash
+ * equality test (spec 242 §4.3) verifies this matches a Solidity verifier.
+ */
+export declare function eip712Digest(args: {
+    credentialBodyHash: Hex32;
+    issuer: string;
+    validFrom: number;
+    validUntil: number;
+    proofPurpose: Eip712Signature2026Proof['proofPurpose'];
+    chainId: number;
+    verifyingContract: Address;
+}): Hex32;
+/** Convert an ISO-8601 timestamp to a uint64-safe seconds value. */
+export declare function isoToSeconds(iso: string | undefined): number;
+/**
+ * Sign an `UnsignedCredential` and return a fully formed `VerifiableCredential`.
+ */
+export declare function signCredential<TSubject extends Record<string, unknown>>(unsigned: UnsignedCredential<TSubject>, signer: CredentialSigner, opts?: {
+    proofPurpose?: Eip712Signature2026Proof['proofPurpose'];
+    delegatingSigner?: Eip712Signature2026Proof['delegatingSigner'];
+}): Promise<VerifiableCredential<TSubject>>;
+/** Convenience: a viem `WalletClient`-backed `CredentialSigner` (EOA-only path). */
+export declare function viemSignerFromWallet(args: {
+    wallet: WalletClient;
+    issuerAddress: Address;
+    chainId: number;
+    verifyingContract: Address;
+}): CredentialSigner;
+/**
+ * Minimal structural shape of a KMS signing backend (spec 276 KCS-D5). It is
+ * declared HERE — not imported from `@agenticprimitives/key-custody` — because
+ * `verifiable-credentials` is a leaf in the dependency graph (no `@agenticprimitives/*`
+ * imports beyond types/ontology). `key-custody`'s `KmsAccountBackend` structurally
+ * satisfies this, so `kmsCredentialSigner(kmsBackend, …)` just works without the
+ * cross-package edge.
+ */
+export interface KmsSigningBackend {
+    /** Sign a 32-byte digest; returns a 65-byte secp256k1 `(r,s,v)` signature. */
+    signA2AAction(input: {
+        digest: Uint8Array;
+    }): Promise<{
+        signature: Uint8Array;
+    }>;
+    /** The signing key's EVM address (the credential the issuer SA validates via ERC-1271). */
+    getSignerAddress(): Promise<Address>;
+}
+/**
+ * Convenience: a `CredentialSigner` backed by a KMS-custodied secp256k1 key
+ * (the issuer SA's master / per-subject signer). Mirrors `viemSignerFromWallet`
+ * for the KMS path. `verifyingContract` defaults to the issuer SA itself (the
+ * ERC-1271 self-verification anchor).
+ */
+export declare function kmsCredentialSigner(args: {
+    backend: KmsSigningBackend;
+    issuerAddress: Address;
+    chainId: number;
+    verifyingContract?: Address;
+}): CredentialSigner;
+/** Re-export so callers see the Proof union from one place. */
+export type { Proof };
+//# sourceMappingURL=proof.d.ts.map

package/dist/proof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../src/proof.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAyC,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,KAAK,YAAY,EAAE,MAAM,MAAM,CAAC;AAGxG,OAAO,EAML,KAAK,wBAAwB,EAC7B,KAAK,KAAK,EACV,KAAK,KAAK,EACV,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EAC1B,MAAM,YAAY,CAAC;AAEpB,sFAAsF;AACtF,MAAM,WAAW,gBAAgB;IAC/B,yEAAyE;IACzE,aAAa,EAAE,OAAO,CAAC;IACvB,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,UAAU,CAAC,MAAM,EAAE,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;CACzC;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,kBAAkB,GAAG,oBAAoB,GAAG,KAAK,CAKzF;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE;IACjC,kBAAkB,EAAE,KAAK,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,wBAAwB,CAAC,cAAc,CAAC,CAAC;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;CAC5B,GAAG,KAAK,CAkBR;AAED,oEAAoE;AACpE,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAG5D;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3E,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EACtC,MAAM,EAAE,gBAAgB,EACxB,IAAI,GAAE;IAAE,YAAY,CAAC,EAAE,wBAAwB,CAAC,cAAc,CAAC,CAAC;IAAC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC,kBAAkB,CAAC,CAAA;CAAO,GACtI,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAuCzC;AAED,oFAAoF;AACpF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,MAAM,EAAE,YAAY,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;CAC5B,GAAG,gBAAgB,CAYnB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,8EAA8E;IAC9E,aAAa,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;IACjF,2FAA2F;IAC3F,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,OAAO,EAAE,iBAAiB,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B,GAAG,gBAAgB,CAUnB;AAQD,+DAA+D;AAC/D,YAAY,EAAE,KAAK,EAAE,CAAC"}

package/dist/proof.js

@@ -0,0 +1,127 @@
+/**
+ * Eip712Signature2026 proof builder — signs the canonical hash of a credential
+ * subject + envelope metadata with EIP-712 typed data, producing an
+ * ERC-1271-verifiable signature.
+ *
+ * Spec 242 §4.3 + ADR-0023 §D2.
+ */
+import { hashTypedData, hexToBytes, bytesToHex } from 'viem';
+import { canonicalHash } from './canonical.js';
+import { EIP712_SIG_2026_CONTEXT, VC_CONTEXT_V2, VC_DOMAIN_NAME, VC_DOMAIN_VERSION, VC_EIP712_TYPES, } from './types.js';
+/**
+ * Compute the canonical hash of an unsigned credential — strips `proof`,
+ * applies RFC 8785 JCS canonicalisation, returns keccak256.
+ */
+export function credentialHash(unsigned) {
+    // Defensive: strip proof if a signed VC was passed in.
+    const { proof: _ignored, ...withoutProof } = unsigned;
+    void _ignored;
+    return canonicalHash(withoutProof);
+}
+/**
+ * Compute the EIP-712 typed-data digest the signer signs. Cross-stack typehash
+ * equality test (spec 242 §4.3) verifies this matches a Solidity verifier.
+ */
+export function eip712Digest(args) {
+    return hashTypedData({
+        domain: {
+            name: VC_DOMAIN_NAME,
+            version: VC_DOMAIN_VERSION,
+            chainId: args.chainId,
+            verifyingContract: args.verifyingContract,
+        },
+        types: VC_EIP712_TYPES,
+        primaryType: 'VerifiableCredentialAttestation',
+        message: {
+            credentialHash: args.credentialBodyHash,
+            issuer: args.issuer,
+            validFrom: BigInt(args.validFrom),
+            validUntil: BigInt(args.validUntil),
+            proofPurpose: args.proofPurpose,
+        },
+    });
+}
+/** Convert an ISO-8601 timestamp to a uint64-safe seconds value. */
+export function isoToSeconds(iso) {
+    if (!iso)
+        return 0;
+    return Math.floor(new Date(iso).getTime() / 1000);
+}
+/**
+ * Sign an `UnsignedCredential` and return a fully formed `VerifiableCredential`.
+ */
+export async function signCredential(unsigned, signer, opts = {}) {
+    const proofPurpose = opts.proofPurpose ?? 'assertionMethod';
+    // Expand `@context` BEFORE hashing so the emitted `credentialHash` matches the
+    // canonical hash of the emitted body. (Hashing the pre-expansion body and then
+    // adding the EIP-712 context to the output produced a VC whose stored hash never
+    // reconciled with its own body — structural verification would reject it.)
+    const contexted = { ...unsigned, '@context': ensureContexts(unsigned['@context']) };
+    const bodyHash = credentialHash(contexted);
+    const digest = eip712Digest({
+        credentialBodyHash: bodyHash,
+        issuer: contexted.issuer,
+        validFrom: isoToSeconds(contexted.validFrom),
+        validUntil: isoToSeconds(contexted.validUntil),
+        proofPurpose,
+        chainId: signer.chainId,
+        verifyingContract: signer.verifyingContract,
+    });
+    const proofValue = await signer.signDigest(digest);
+    const proof = {
+        type: 'Eip712Signature2026',
+        created: new Date().toISOString(),
+        verificationMethod: `eip155:${signer.chainId}:${signer.verifyingContract}#assertion-key-1`,
+        proofPurpose,
+        proofValue,
+        eip712Domain: {
+            name: VC_DOMAIN_NAME,
+            version: VC_DOMAIN_VERSION,
+            chainId: signer.chainId,
+            verifyingContract: signer.verifyingContract,
+        },
+        credentialHash: bodyHash,
+        ...(opts.delegatingSigner ? { delegatingSigner: opts.delegatingSigner } : {}),
+    };
+    return {
+        ...contexted,
+        proof,
+    };
+}
+/** Convenience: a viem `WalletClient`-backed `CredentialSigner` (EOA-only path). */
+export function viemSignerFromWallet(args) {
+    return {
+        issuerAddress: args.issuerAddress,
+        chainId: args.chainId,
+        verifyingContract: args.verifyingContract,
+        async signDigest(digest) {
+            return args.wallet.request({
+                method: 'eth_sign',
+                params: [args.issuerAddress, digest],
+            });
+        },
+    };
+}
+/**
+ * Convenience: a `CredentialSigner` backed by a KMS-custodied secp256k1 key
+ * (the issuer SA's master / per-subject signer). Mirrors `viemSignerFromWallet`
+ * for the KMS path. `verifyingContract` defaults to the issuer SA itself (the
+ * ERC-1271 self-verification anchor).
+ */
+export function kmsCredentialSigner(args) {
+    return {
+        issuerAddress: args.issuerAddress,
+        chainId: args.chainId,
+        verifyingContract: args.verifyingContract ?? args.issuerAddress,
+        async signDigest(digest) {
+            const { signature } = await args.backend.signA2AAction({ digest: hexToBytes(digest) });
+            return bytesToHex(signature);
+        },
+    };
+}
+function ensureContexts(existing) {
+    const needed = [VC_CONTEXT_V2, EIP712_SIG_2026_CONTEXT];
+    const have = new Set(existing);
+    return [...existing, ...needed.filter((c) => !have.has(c))];
+}
+//# sourceMappingURL=proof.js.map

package/dist/proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof.js","sourceRoot":"","sources":["../src/proof.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAA6C,MAAM,MAAM,CAAC;AAExG,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,eAAe,GAMhB,MAAM,YAAY,CAAC;AAiBpB;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAmD;IAChF,uDAAuD;IACvD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,YAAY,EAAE,GAAG,QAAgC,CAAC;IAC9E,KAAK,QAAQ,CAAC;IACd,OAAO,aAAa,CAAC,YAAY,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAQ5B;IACC,OAAO,aAAa,CAAC;QACnB,MAAM,EAAE;YACN,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,iBAAiB;YAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;SAC1C;QACD,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE,iCAAiC;QAC9C,OAAO,EAAE;YACP,cAAc,EAAE,IAAI,CAAC,kBAAkB;YACvC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YACjC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YACnC,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC;KACF,CAAU,CAAC;AACd,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,YAAY,CAAC,GAAuB;IAClD,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,CAAC;IACnB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;AACpD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAsC,EACtC,MAAwB,EACxB,OAAqI,EAAE;IAEvI,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,iBAAiB,CAAC;IAC5D,+EAA+E;IAC/E,+EAA+E;IAC/E,iFAAiF;IACjF,2EAA2E;IAC3E,MAAM,SAAS,GAAG,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAkC,CAAC;IACpH,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,kBAAkB,EAAE,QAAQ;QAC5B,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,SAAS,CAAC;QAC5C,UAAU,EAAE,YAAY,CAAC,SAAS,CAAC,UAAU,CAAC;QAC9C,YAAY;QACZ,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;KAC5C,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAEnD,MAAM,KAAK,GAA6B;QACtC,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACjC,kBAAkB,EAAE,UAAU,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,iBAAiB,kBAAkB;QAC1F,YAAY;QACZ,UAAU;QACV,YAAY,EAAE;YACZ,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,iBAAiB;YAC1B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C;QACD,cAAc,EAAE,QAAQ;QACxB,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC;IAEF,OAAO;QACL,GAAG,SAAS;QACZ,KAAK;KAC4B,CAAC;AACtC,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAAC,IAKpC;IACC,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,KAAK,CAAC,UAAU,CAAC,MAAM;YACrB,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;gBACzB,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;aACgB,CAAmB,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC;AAiBD;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAKnC;IACC,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,aAAa;QAC/D,KAAK,CAAC,UAAU,CAAC,MAAa;YAC5B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACvF,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAA2B;IACjD,MAAM,MAAM,GAAG,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC"}

package/dist/schema.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Schema registration helper — produces the `did:shape:<name>:<version>` ↔
+ * on-chain `ShapeRegistry.defineShape(...)` round-trip per PD-12.
+ *
+ * In W1 this module ships pure helpers (no on-chain call). The caller wires
+ * the actual `defineShape` call against their viem clients; we provide:
+ *  - the canonical schema URI form (`did:shape:<name>:<version>`)
+ *  - the canonical hash bytes (`keccak256` of the canonical SHACL string)
+ *  - a parser to round-trip schema URIs
+ */
+import type { Hex32 } from './types.js';
+export declare const SHAPE_DID_PREFIX: "did:shape:";
+/**
+ * Build the canonical `did:shape:<name>:<version>` URI.
+ *
+ * @throws if name or version contains characters outside `[A-Za-z0-9-_.]`.
+ */
+export declare function buildShapeUri(name: string, version: string): string;
+/**
+ * Parse a `did:shape:<name>:<version>` URI.
+ */
+export declare function parseShapeUri(uri: string): {
+    name: string;
+    version: string;
+} | null;
+/**
+ * Canonicalise SHACL bytes for the on-chain hash. The canonical form is:
+ *  - UTF-8 normalised (callers are responsible for upstream NFC if needed)
+ *  - keccak256 of the raw bytes
+ *
+ * This matches the on-chain `ShapeRegistry.defineShape(shapeHash)` expectation
+ * — both sides hash the exact same SHACL string.
+ */
+export declare function shapeHash(shaclBytes: string | Uint8Array): Hex32;
+//# sourceMappingURL=schema.d.ts.map

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC,eAAO,MAAM,gBAAgB,EAAG,YAAqB,CAAC;AAEtD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAQnE;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CASnF;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,KAAK,CAQhE"}