@agenticprimitives/verifiable-credentials 0.0.0-alpha.10

package/dist/schema.js

@@ -0,0 +1,61 @@
+/**
+ * Schema registration helper — produces the `did:shape:<name>:<version>` ↔
+ * on-chain `ShapeRegistry.defineShape(...)` round-trip per PD-12.
+ *
+ * In W1 this module ships pure helpers (no on-chain call). The caller wires
+ * the actual `defineShape` call against their viem clients; we provide:
+ *  - the canonical schema URI form (`did:shape:<name>:<version>`)
+ *  - the canonical hash bytes (`keccak256` of the canonical SHACL string)
+ *  - a parser to round-trip schema URIs
+ */
+import { keccak_256 } from '@noble/hashes/sha3.js';
+import { utf8ToBytes } from '@noble/hashes/utils.js';
+export const SHAPE_DID_PREFIX = 'did:shape:';
+/**
+ * Build the canonical `did:shape:<name>:<version>` URI.
+ *
+ * @throws if name or version contains characters outside `[A-Za-z0-9-_.]`.
+ */
+export function buildShapeUri(name, version) {
+    if (!/^[A-Za-z0-9._-]+$/.test(name)) {
+        throw new Error(`[verifiable-credentials/schema] invalid shape name: ${name}`);
+    }
+    if (!/^[A-Za-z0-9._-]+$/.test(version)) {
+        throw new Error(`[verifiable-credentials/schema] invalid shape version: ${version}`);
+    }
+    return `${SHAPE_DID_PREFIX}${name}:${version}`;
+}
+/**
+ * Parse a `did:shape:<name>:<version>` URI.
+ */
+export function parseShapeUri(uri) {
+    if (!uri.startsWith(SHAPE_DID_PREFIX))
+        return null;
+    const body = uri.slice(SHAPE_DID_PREFIX.length);
+    const colonIdx = body.lastIndexOf(':');
+    if (colonIdx === -1)
+        return null;
+    const name = body.slice(0, colonIdx);
+    const version = body.slice(colonIdx + 1);
+    if (!name || !version)
+        return null;
+    return { name, version };
+}
+/**
+ * Canonicalise SHACL bytes for the on-chain hash. The canonical form is:
+ *  - UTF-8 normalised (callers are responsible for upstream NFC if needed)
+ *  - keccak256 of the raw bytes
+ *
+ * This matches the on-chain `ShapeRegistry.defineShape(shapeHash)` expectation
+ * — both sides hash the exact same SHACL string.
+ */
+export function shapeHash(shaclBytes) {
+    const bytes = typeof shaclBytes === 'string' ? utf8ToBytes(shaclBytes) : shaclBytes;
+    const digest = keccak_256(bytes);
+    let hex = '0x';
+    for (const v of digest) {
+        hex += v.toString(16).padStart(2, '0');
+    }
+    return hex;
+}
+//# sourceMappingURL=schema.js.map

package/dist/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAIrD,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAqB,CAAC;AAEtD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAAe;IACzD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,uDAAuD,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,0DAA0D,OAAO,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,GAAG,gBAAgB,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,QAAQ,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,UAA+B;IACvD,MAAM,KAAK,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IACpF,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAY,CAAC;AACtB,CAAC"}

package/dist/situation.d.ts

@@ -0,0 +1,48 @@
+/**
+ * DOLCE+DnS Situation pattern — the substrate's typed base for every credential
+ * subject. Per spec 242 §5: substrate credentials describe a `Situation` with
+ * a `Description`, `Roles`, and `Participants`.
+ *
+ *   Situation     — the thing the credential is about (e.g. "this agreement",
+ *                   "this validation result", "this evidence anchor")
+ *   Description   — the typed shape spec the situation conforms to (SHACL IRI)
+ *   Roles         — typed slots filled by participants (e.g. issuer, holder,
+ *                   beneficiary, validator)
+ *   Participants  — the SAs filling each role
+ *
+ * Owning vocabularies define their specific Situation subclasses; this module
+ * exports the substrate base types every consumer composes against.
+ */
+import type { Address } from '@agenticprimitives/types';
+/** Ontology IRI of the Description shape (e.g. `apagr:AgreementCredential`). */
+export type DescriptionRef = `${string}:${string}`;
+/** Role identifier — local name within a Description. */
+export type RoleName = string;
+/** A typed Situation as a credential subject. The `[k: string]: unknown`
+ *  index signature lets it satisfy `VerifiableCredential`'s `TSubject` constraint
+ *  while keeping the typed `description / roles / body` fields tight. */
+export interface Situation<TBody extends Record<string, unknown> = Record<string, unknown>> {
+    /** The Description shape the situation conforms to. */
+    description: DescriptionRef;
+    /** Typed slots — `{ roleName → AgentSA }`. */
+    roles: Record<RoleName, Address>;
+    /** Optional non-Agent participants (e.g. resource IRIs, document hashes). */
+    participants?: Record<string, string>;
+    /** The situation-specific payload. */
+    body: TBody;
+    /** Index signature so Situation satisfies VC's TSubject constraint. */
+    [key: string]: unknown;
+}
+/**
+ * Validate that a Situation declares the roles its Description requires.
+ * Used by SDK helpers before signing; production validation runs SHACL.
+ */
+export declare function assertSituationRolesPresent(s: Situation, requiredRoles: RoleName[]): void;
+/** Convenience constructor — builds the situation envelope from typed bits. */
+export declare function buildSituation<TBody extends Record<string, unknown>>(args: {
+    description: DescriptionRef;
+    roles: Record<RoleName, Address>;
+    body: TBody;
+    participants?: Record<string, string>;
+}): Situation<TBody>;
+//# sourceMappingURL=situation.d.ts.map

package/dist/situation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"situation.d.ts","sourceRoot":"","sources":["../src/situation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAExD,gFAAgF;AAChF,MAAM,MAAM,cAAc,GAAG,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC;AAEnD,yDAAyD;AACzD,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B;;yEAEyE;AACzE,MAAM,WAAW,SAAS,CAAC,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACxF,uDAAuD;IACvD,WAAW,EAAE,cAAc,CAAC;IAC5B,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjC,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,sCAAsC;IACtC,IAAI,EAAE,KAAK,CAAC;IACZ,uEAAuE;IACvE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,IAAI,CAQzF;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE;IAC1E,WAAW,EAAE,cAAc,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,EAAE,KAAK,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC,GAAG,SAAS,CAAC,KAAK,CAAC,CAOnB"}

package/dist/situation.js

@@ -0,0 +1,36 @@
+/**
+ * DOLCE+DnS Situation pattern — the substrate's typed base for every credential
+ * subject. Per spec 242 §5: substrate credentials describe a `Situation` with
+ * a `Description`, `Roles`, and `Participants`.
+ *
+ *   Situation     — the thing the credential is about (e.g. "this agreement",
+ *                   "this validation result", "this evidence anchor")
+ *   Description   — the typed shape spec the situation conforms to (SHACL IRI)
+ *   Roles         — typed slots filled by participants (e.g. issuer, holder,
+ *                   beneficiary, validator)
+ *   Participants  — the SAs filling each role
+ *
+ * Owning vocabularies define their specific Situation subclasses; this module
+ * exports the substrate base types every consumer composes against.
+ */
+/**
+ * Validate that a Situation declares the roles its Description requires.
+ * Used by SDK helpers before signing; production validation runs SHACL.
+ */
+export function assertSituationRolesPresent(s, requiredRoles) {
+    const have = new Set(Object.keys(s.roles));
+    const missing = requiredRoles.filter((r) => !have.has(r));
+    if (missing.length > 0) {
+        throw new Error(`[verifiable-credentials] Situation '${s.description}' is missing required roles: ${missing.join(', ')}`);
+    }
+}
+/** Convenience constructor — builds the situation envelope from typed bits. */
+export function buildSituation(args) {
+    return {
+        description: args.description,
+        roles: { ...args.roles },
+        participants: args.participants ? { ...args.participants } : undefined,
+        body: args.body,
+    };
+}
+//# sourceMappingURL=situation.js.map

package/dist/situation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"situation.js","sourceRoot":"","sources":["../src/situation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA0BH;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,CAAY,EAAE,aAAyB;IACjF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,uCAAuC,CAAC,CAAC,WAAW,gCAAgC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAwC,IAKrE;IACC,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE;QACxB,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS;QACtE,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,149 @@
+/**
+ * W3C Verifiable Credentials 2.0 envelope types + `Eip712Signature2026` proof
+ * type. Substrate for all spine credential classes (Association, Evidence,
+ * Outcome, Validation, TrustUpdate, AgreementCredential, PaymentReceipt, ...).
+ *
+ * Authoritative spec: specs/242-trust-credentials-and-public-assertions.md §4.
+ * Architecture-of-record: ADR-0023 + ADR-0024 (composability table).
+ */
+import type { Address, Hex } from '@agenticprimitives/types';
+export type Hex32 = `0x${string}`;
+export type ISODate = string;
+/** W3C VC 2.0 default context. */
+export declare const VC_CONTEXT_V2: "https://www.w3.org/ns/credentials/v2";
+/** Substrate's Eip712Signature2026 context (proof-type alongside W3C VC). */
+export declare const EIP712_SIG_2026_CONTEXT: "https://agenticprimitives.dev/contexts/eip712-signature-2026/v1";
+/**
+ * Discriminator for the proof type. Primary in W1; BBS+ / SD-JWT reserved per
+ * PD-28 (privacy doc §2.3).
+ */
+export type ProofType = 'Eip712Signature2026' | 'DataIntegrityProof' | 'SdJwtProof';
+/**
+ * The primary W1 proof shape — EIP-712 typed-data signature verified via
+ * ERC-1271 against the issuer SA.
+ *
+ * Per ADR-0023:
+ * - `verificationMethod` SHOULD be a CAIP-10 reference to the issuer's SA.
+ * - `proofPurpose` is `assertionMethod` for issuer-attested credentials,
+ *   `authentication` for holder-asserted ones.
+ */
+export interface Eip712Signature2026Proof {
+    type: 'Eip712Signature2026';
+    created: ISODate;
+    verificationMethod: string;
+    proofPurpose: 'assertionMethod' | 'authentication' | 'capabilityInvocation';
+    /** Hex-encoded ERC-1271-verifiable signature. */
+    proofValue: Hex;
+    /** Optional EIP-712 domain hash for cross-stack reconciliation. */
+    eip712Domain?: {
+        name: string;
+        version: string;
+        chainId: number;
+        verifyingContract: Address;
+    };
+    /** Optional canonical-hash receipt of the credential body (RFC 8785 JCS). */
+    credentialHash?: Hex32;
+    /** Present when an issuer-AUTHORIZED operational key (e.g. Cloud KMS) signed this credential instead of
+     *  the issuer's own custodian. `proofValue` is then the delegate key's signature; trust still roots in
+     *  the issuer SA (`delegatorIssuer` == the credential's issuer). Lives in the proof (stripped from the
+     *  credential hash), so attaching it does NOT change the signed digest. The verifier checks the leaf. */
+    delegatingSigner?: DelegatingSignerProof;
+}
+/** Issuer authorization of an operational signing key (mirrors content-primitives' DelegatingSigner). */
+export interface DelegatingSignerProof {
+    /** The issuer SA the credential's trust roots in (== the credential issuer). */
+    delegatorIssuer: Address;
+    /** The operational key that actually signed (authorized by `delegatorIssuer`). */
+    delegateKey: Address;
+    /** The signed delegation binding `delegateKey` → `delegatorIssuer`. OPAQUE; the app validates it. */
+    delegationLeaf: unknown;
+}
+/** Discriminated union for all supported proof types (W1: Eip712Signature2026 only). */
+export type Proof = Eip712Signature2026Proof;
+/** W3C VC StatusList2021 envelope (per `credentialStatus`). */
+export interface CredentialStatus2021 {
+    id: string;
+    type: 'StatusList2021Entry' | 'RevocationList2020Status';
+    statusPurpose?: 'revocation' | 'suspension';
+    statusListIndex?: number;
+    statusListCredential?: string;
+}
+/**
+ * Per privacy doc D-42: every field MAY carry a per-field VisibilityTier
+ * override; consumers MAY render a partial VC by tier.
+ */
+export type VisibilityTier = 'Public' | 'PublicCoarse' | 'PrivateCommitment' | 'PrivateZK' | 'OffchainOnly';
+export interface DisclosurePolicy {
+    /** JSON-encoded { fieldPath → tier }. */
+    fieldDisclosure?: Record<string, VisibilityTier>;
+    /** Default tier applied to every unmapped field. */
+    defaultTier: VisibilityTier;
+}
+/**
+ * The canonical W3C VC 2.0 envelope, parameterised by the credential-subject
+ * shape. Implementations of substrate credential types (Association, Evidence,
+ * Outcome, Validation, TrustUpdate, AgreementCredential, PaymentReceipt) live
+ * in their owning packages; this envelope is substrate-wide.
+ */
+export interface VerifiableCredential<TSubject extends Record<string, unknown> = Record<string, unknown>> {
+    '@context': readonly string[];
+    /** First element MUST be `'VerifiableCredential'`; subsequent are class names. */
+    type: readonly [...string[]];
+    /** CAIP-10 reference to the issuer SA (preferred), or a DID. */
+    issuer: string;
+    /** Issuance time. */
+    validFrom: ISODate;
+    /** Optional expiry. */
+    validUntil?: ISODate;
+    /** Credential subject — discriminated by class. */
+    credentialSubject: TSubject;
+    /** Optional revocation envelope (StatusList2021). */
+    credentialStatus?: CredentialStatus2021;
+    /** Optional schema pointer — `did:shape:<name>:<version>` (per PD-12 round-trip). */
+    credentialSchema?: {
+        id: string;
+        type: 'JsonSchema' | 'ShaclShape';
+    };
+    /** Substrate per-field DisclosurePolicy (D-42). */
+    disclosurePolicy?: DisclosurePolicy;
+    /** The proof (W1: Eip712Signature2026). */
+    proof?: Proof;
+}
+/** Convenience alias for a VC without a proof attached (pre-signing). */
+export type UnsignedCredential<TSubject extends Record<string, unknown> = Record<string, unknown>> = Omit<VerifiableCredential<TSubject>, 'proof'>;
+/**
+ * Standard EIP-712 domain for the substrate's `Eip712Signature2026` proof.
+ *
+ * Cross-stack typehash equality: any Solidity verifier MUST compute the same
+ * `typeHash` from the same primary type string + same field types. The
+ * canonical primary type is `VerifiableCredentialAttestation`:
+ *
+ *   VerifiableCredentialAttestation(
+ *     bytes32 credentialHash,
+ *     string  issuer,
+ *     uint64  validFrom,
+ *     uint64  validUntil,
+ *     string  proofPurpose
+ *   )
+ */
+export declare const VC_EIP712_TYPES: {
+    readonly VerifiableCredentialAttestation: readonly [{
+        readonly name: "credentialHash";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "issuer";
+        readonly type: "string";
+    }, {
+        readonly name: "validFrom";
+        readonly type: "uint64";
+    }, {
+        readonly name: "validUntil";
+        readonly type: "uint64";
+    }, {
+        readonly name: "proofPurpose";
+        readonly type: "string";
+    }];
+};
+export declare const VC_DOMAIN_NAME: "AgenticPrimitivesVC";
+export declare const VC_DOMAIN_VERSION: "1";
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,MAAM,KAAK,GAAG,KAAK,MAAM,EAAE,CAAC;AAClC,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAE7B,kCAAkC;AAClC,eAAO,MAAM,aAAa,EAAG,sCAA+C,CAAC;AAE7E,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,EAClC,iEAA0E,CAAC;AAE7E;;;GAGG;AACH,MAAM,MAAM,SAAS,GACjB,qBAAqB,GACrB,oBAAoB,GACpB,YAAY,CAAC;AAEjB;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,iBAAiB,GAAG,gBAAgB,GAAG,sBAAsB,CAAC;IAC5E,iDAAiD;IACjD,UAAU,EAAE,GAAG,CAAC;IAChB,mEAAmE;IACnE,YAAY,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,iBAAiB,EAAE,OAAO,CAAC;KAC5B,CAAC;IACF,6EAA6E;IAC7E,cAAc,CAAC,EAAE,KAAK,CAAC;IACvB;;;6GAGyG;IACzG,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;CAC1C;AAED,yGAAyG;AACzG,MAAM,WAAW,qBAAqB;IACpC,gFAAgF;IAChF,eAAe,EAAE,OAAO,CAAC;IACzB,kFAAkF;IAClF,WAAW,EAAE,OAAO,CAAC;IACrB,qGAAqG;IACrG,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,wFAAwF;AACxF,MAAM,MAAM,KAAK,GAAG,wBAAwB,CAAC;AAE7C,+DAA+D;AAC/D,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,qBAAqB,GAAG,0BAA0B,CAAC;IACzD,aAAa,CAAC,EAAE,YAAY,GAAG,YAAY,CAAC;IAC5C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB,QAAQ,GACR,cAAc,GACd,mBAAmB,GACnB,WAAW,GACX,cAAc,CAAC;AAEnB,MAAM,WAAW,gBAAgB;IAC/B,yCAAyC;IACzC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACjD,oDAAoD;IACpD,WAAW,EAAE,cAAc,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACtG,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,kFAAkF;IAClF,IAAI,EAAE,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC;IAC7B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,uBAAuB;IACvB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,mDAAmD;IACnD,iBAAiB,EAAE,QAAQ,CAAC;IAC5B,qDAAqD;IACrD,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,qFAAqF;IACrF,gBAAgB,CAAC,EAAE;QACjB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,YAAY,GAAG,YAAY,CAAC;KACnC,CAAC;IACF,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,2CAA2C;IAC3C,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED,yEAAyE;AACzE,MAAM,MAAM,kBAAkB,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,IAAI,CACvG,oBAAoB,CAAC,QAAQ,CAAC,EAC9B,OAAO,CACR,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;CAQlB,CAAC;AAEX,eAAO,MAAM,cAAc,EAAG,qBAA8B,CAAC;AAC7D,eAAO,MAAM,iBAAiB,EAAG,GAAY,CAAC"}

package/dist/types.js

@@ -0,0 +1,39 @@
+/**
+ * W3C Verifiable Credentials 2.0 envelope types + `Eip712Signature2026` proof
+ * type. Substrate for all spine credential classes (Association, Evidence,
+ * Outcome, Validation, TrustUpdate, AgreementCredential, PaymentReceipt, ...).
+ *
+ * Authoritative spec: specs/242-trust-credentials-and-public-assertions.md §4.
+ * Architecture-of-record: ADR-0023 + ADR-0024 (composability table).
+ */
+/** W3C VC 2.0 default context. */
+export const VC_CONTEXT_V2 = 'https://www.w3.org/ns/credentials/v2';
+/** Substrate's Eip712Signature2026 context (proof-type alongside W3C VC). */
+export const EIP712_SIG_2026_CONTEXT = 'https://agenticprimitives.dev/contexts/eip712-signature-2026/v1';
+/**
+ * Standard EIP-712 domain for the substrate's `Eip712Signature2026` proof.
+ *
+ * Cross-stack typehash equality: any Solidity verifier MUST compute the same
+ * `typeHash` from the same primary type string + same field types. The
+ * canonical primary type is `VerifiableCredentialAttestation`:
+ *
+ *   VerifiableCredentialAttestation(
+ *     bytes32 credentialHash,
+ *     string  issuer,
+ *     uint64  validFrom,
+ *     uint64  validUntil,
+ *     string  proofPurpose
+ *   )
+ */
+export const VC_EIP712_TYPES = {
+    VerifiableCredentialAttestation: [
+        { name: 'credentialHash', type: 'bytes32' },
+        { name: 'issuer', type: 'string' },
+        { name: 'validFrom', type: 'uint64' },
+        { name: 'validUntil', type: 'uint64' },
+        { name: 'proofPurpose', type: 'string' },
+    ],
+};
+export const VC_DOMAIN_NAME = 'AgenticPrimitivesVC';
+export const VC_DOMAIN_VERSION = '1';
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,kCAAkC;AAClC,MAAM,CAAC,MAAM,aAAa,GAAG,sCAA+C,CAAC;AAE7E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAClC,iEAA0E,CAAC;AAwH7E;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,+BAA+B,EAAE;QAC/B,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3C,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;QAClC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE;QACrC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE;QACtC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE;KACzC;CACO,CAAC;AAEX,MAAM,CAAC,MAAM,cAAc,GAAG,qBAA8B,CAAC;AAC7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAY,CAAC"}

package/dist/verifier.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Verifier — checks that a VC's proof is valid (findings VC-1 / VC-2, closed).
+ *
+ * `verifyCredential(vc, publicClient)` performs the ERC-1271 round-trip against
+ * the issuer SA on chain and FAILS CLOSED — `credentialHash` is mandatory, and
+ * the EIP-712 digest pins `verifyingContract` to the issuer SA + binds `chainId`,
+ * so an attacker can't substitute a different verifying domain. The structural
+ * helpers remain for callers that only need shape validation, but the authority
+ * check is `verifyCredential`; there is no fallback path (ADR-0013).
+ *
+ * Status-list resolution (StatusList2021): the verifier records whether a status
+ * entry was present + which list to fetch; the consumer fetches it (no silent
+ * fallback, ADR-0013).
+ */
+import type { CredentialStatus2021, Hex32, VerifiableCredential } from './types.js';
+/** Parsed `eip155:<chainId>:<address>` CAIP-10 reference. */
+export interface Caip10Eip155 {
+    chainId: number;
+    address: `0x${string}`;
+}
+/** Parse an `eip155:<chainId>:0x…40` CAIP-10 account id, or null. Both `vc.issuer` and the
+ *  `verificationMethod` prefix use this form — the VC-2 domain-binding source of truth. */
+export declare function parseEip155Caip10(ref: string): Caip10Eip155 | null;
+export interface VerificationResult {
+    /** Structural validity (envelope shape + canonical hash agreement). */
+    structural: boolean;
+    /** The digest the issuer SA's ERC-1271 path MUST validate. */
+    expectedDigest: Hex32 | null;
+    /** The proof value the consumer presents to `isValidSignatureNow`. */
+    proofValue: `0x${string}` | null;
+    /** The CAIP-10 issuer reference extracted from the verification method. */
+    issuerCaip10: string | null;
+    /** Status-list entry (if present); consumer fetches the list itself. */
+    statusListId: string | null;
+    /** Issues found — empty array if everything passes structural + canonical-hash checks. */
+    issues: string[];
+}
+/**
+ * Structural verification — does NOT make a network call. Returns the
+ * expected digest + proof value the caller MUST forward to the issuer SA's
+ * `isValidSignatureNow` (or other ERC-1271-aware path).
+ */
+export declare function verifyCredentialStructural(vc: VerifiableCredential): VerificationResult;
+/** Minimal ERC-1271 verifier seam — satisfied structurally by a viem `PublicClient`
+ *  (`client.verifyHash({ address, hash, signature })`). Kept structural so the package stays a
+ *  graph leaf and isn't pinned to a single viem version. */
+export interface Erc1271Verifier {
+    verifyHash(args: {
+        address: `0x${string}`;
+        hash: `0x${string}`;
+        signature: `0x${string}`;
+    }): Promise<boolean>;
+}
+export interface VerifyCredentialResult {
+    /** True ONLY when the structural checks pass AND the issuer SA's ERC-1271 path validates the
+     *  signature over the expected digest. Fail-closed: any error/anomaly → false. */
+    valid: boolean;
+    /** The structural sub-result (digest, proof value, issuer ref, issues). */
+    structuralResult: VerificationResult;
+    /** All issues — structural plus signature/verification failures. */
+    issues: string[];
+}
+/**
+ * Full credential verification (VC-1): structural checks PLUS the on-chain ERC-1271 round-trip
+ * against the issuer SA resolved from `vc.issuer`. This is the function consumers (content
+ * entitlements, agent-skills, geo-features, related-agents) MUST gate on — `verifyCredentialStructural`
+ * alone proves nothing about the signature.
+ *
+ * Fail-closed per ADR-0013: a structural failure, an unresolvable issuer, a verification-call error,
+ * or a non-validating signature all return `valid: false` — never a silent accept.
+ */
+/** Resolve + check a credential's revocation/suspension status (NEW-VC-1). Returns `revoked: true` to
+ *  fail the verification. Injected so the package stays a leaf (the StatusList2021 fetch is the
+ *  consumer's effect). */
+export interface CredentialStatusResolver {
+    (status: CredentialStatus2021): Promise<{
+        revoked: boolean;
+    }>;
+}
+export interface VerifyCredentialOpts {
+    /** NEW-VC-1: when the VC carries a `credentialStatus`, this resolver checks revocation/suspension.
+     *  REQUIRED for any status-bearing credential unless `allowUnresolvedStatus` is set — otherwise a
+     *  REVOKED credential would verify valid (the verifier can confirm the signature but not the status). */
+    verifyStatus?: CredentialStatusResolver;
+    /** NEW-VC-1 opt-out: accept a status-bearing credential WITHOUT resolving its status. Use ONLY where
+     *  revocation genuinely doesn't matter; otherwise omitting the resolver fails closed (ADR-0013). */
+    allowUnresolvedStatus?: boolean;
+}
+export declare function verifyCredential(vc: VerifiableCredential, client: Erc1271Verifier, opts?: VerifyCredentialOpts): Promise<VerifyCredentialResult>;
+//# sourceMappingURL=verifier.d.ts.map

package/dist/verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../src/verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EACV,oBAAoB,EAEpB,KAAK,EAEL,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAEpB,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;CACxB;AAED;2FAC2F;AAC3F,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAIlE;AAED,MAAM,WAAW,kBAAkB;IACjC,uEAAuE;IACvE,UAAU,EAAE,OAAO,CAAC;IACpB,8DAA8D;IAC9D,cAAc,EAAE,KAAK,GAAG,IAAI,CAAC;IAC7B,sEAAsE;IACtE,UAAU,EAAE,KAAK,MAAM,EAAE,GAAG,IAAI,CAAC;IACjC,2EAA2E;IAC3E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,wEAAwE;IACxE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,0FAA0F;IAC1F,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,oBAAoB,GAAG,kBAAkB,CA+HvF;AAYD;;4DAE4D;AAC5D,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,IAAI,EAAE;QACf,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;QACvB,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;QACpB,SAAS,EAAE,KAAK,MAAM,EAAE,CAAC;KAC1B,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC;sFACkF;IAClF,KAAK,EAAE,OAAO,CAAC;IACf,2EAA2E;IAC3E,gBAAgB,EAAE,kBAAkB,CAAC;IACrC,oEAAoE;IACpE,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH;;0BAE0B;AAC1B,MAAM,WAAW,wBAAwB;IACvC,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,oBAAoB;IACnC;;6GAEyG;IACzG,YAAY,CAAC,EAAE,wBAAwB,CAAC;IACxC;wGACoG;IACpG,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,oBAAoB,EACxB,MAAM,EAAE,eAAe,EACvB,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAAC,sBAAsB,CAAC,CAmDjC"}