@agenticprimitives/verifiable-credentials 0.0.0-alpha.10

package/dist/verifier.js

@@ -0,0 +1,207 @@
+/**
+ * Verifier — checks that a VC's proof is valid (findings VC-1 / VC-2, closed).
+ *
+ * `verifyCredential(vc, publicClient)` performs the ERC-1271 round-trip against
+ * the issuer SA on chain and FAILS CLOSED — `credentialHash` is mandatory, and
+ * the EIP-712 digest pins `verifyingContract` to the issuer SA + binds `chainId`,
+ * so an attacker can't substitute a different verifying domain. The structural
+ * helpers remain for callers that only need shape validation, but the authority
+ * check is `verifyCredential`; there is no fallback path (ADR-0013).
+ *
+ * Status-list resolution (StatusList2021): the verifier records whether a status
+ * entry was present + which list to fetch; the consumer fetches it (no silent
+ * fallback, ADR-0013).
+ */
+import { credentialHash, eip712Digest, isoToSeconds } from './proof.js';
+/** Parse an `eip155:<chainId>:0x…40` CAIP-10 account id, or null. Both `vc.issuer` and the
+ *  `verificationMethod` prefix use this form — the VC-2 domain-binding source of truth. */
+export function parseEip155Caip10(ref) {
+    const m = /^eip155:(\d+):(0x[0-9a-fA-F]{40})$/.exec(ref);
+    if (!m)
+        return null;
+    return { chainId: Number(m[1]), address: m[2] };
+}
+/**
+ * Structural verification — does NOT make a network call. Returns the
+ * expected digest + proof value the caller MUST forward to the issuer SA's
+ * `isValidSignatureNow` (or other ERC-1271-aware path).
+ */
+export function verifyCredentialStructural(vc) {
+    const issues = [];
+    if (!vc['@context'] || vc['@context'].length === 0) {
+        issues.push('missing @context');
+    }
+    if (!vc.type || vc.type[0] !== 'VerifiableCredential') {
+        issues.push('type[0] MUST be "VerifiableCredential"');
+    }
+    if (!vc.issuer)
+        issues.push('missing issuer');
+    if (!vc.validFrom)
+        issues.push('missing validFrom');
+    if (!vc.credentialSubject)
+        issues.push('missing credentialSubject');
+    const now = Math.floor(Date.now() / 1000);
+    // NEW-VC-2: enforce validFrom — a not-yet-active credential must NOT verify valid (the verifier
+    // previously gated only validUntil). NaN-safe: an unparseable validFrom fails closed.
+    if (vc.validFrom) {
+        const from = isoToSeconds(vc.validFrom);
+        if (!Number.isFinite(from)) {
+            issues.push(`validFrom is not a parseable date: ${vc.validFrom}`);
+        }
+        else if (from > now) {
+            issues.push(`credential not yet active (validFrom ${vc.validFrom})`);
+        }
+    }
+    if (vc.validUntil) {
+        const until = isoToSeconds(vc.validUntil);
+        if (!Number.isFinite(until)) {
+            issues.push(`validUntil is not a parseable date: ${vc.validUntil}`);
+        }
+        else if (until < now) {
+            issues.push(`credential expired at ${vc.validUntil}`);
+        }
+    }
+    if (!vc.proof) {
+        return {
+            structural: false,
+            expectedDigest: null,
+            proofValue: null,
+            issuerCaip10: null,
+            statusListId: vc.credentialStatus?.statusListCredential ?? null,
+            issues: [...issues, 'missing proof'],
+        };
+    }
+    if (vc.proof.type !== 'Eip712Signature2026') {
+        issues.push(`unsupported proof.type: ${vc.proof.type}`);
+        return {
+            structural: false,
+            expectedDigest: null,
+            proofValue: null,
+            issuerCaip10: null,
+            statusListId: vc.credentialStatus?.statusListCredential ?? null,
+            issues,
+        };
+    }
+    const proof = vc.proof;
+    if (!proof.eip712Domain) {
+        issues.push('Eip712Signature2026 proof MUST carry eip712Domain (for cross-stack verification)');
+        return {
+            structural: false,
+            expectedDigest: null,
+            proofValue: null,
+            issuerCaip10: null,
+            statusListId: vc.credentialStatus?.statusListCredential ?? null,
+            issues,
+        };
+    }
+    const bodyHash = credentialHash(vc);
+    // VC-1: `credentialHash` is MANDATORY — a forger must not be able to drop it to skip the
+    // body-integrity check. Missing OR mismatched is a structural failure.
+    if (!proof.credentialHash) {
+        issues.push('proof.credentialHash is required (binds the proof to the canonical credential body)');
+    }
+    else if (proof.credentialHash !== bodyHash) {
+        issues.push(`proof.credentialHash (${proof.credentialHash}) does not match canonical hash of credential body (${bodyHash})`);
+    }
+    // VC-2: the EIP-712 domain is attacker-supplied inside the proof. Bind it to the credential's
+    // declared `issuer` SA — the digest is meaningless if it can be computed against a contract /
+    // chain the attacker controls. `verifyingContract` MUST equal the issuer SA, `chainId` MUST equal
+    // the issuer's chain, and the `verificationMethod` address MUST resolve to the same SA.
+    const issuerAcct = parseEip155Caip10(vc.issuer);
+    if (!issuerAcct) {
+        issues.push(`vc.issuer is not a verifiable eip155 CAIP-10 account id: ${vc.issuer}`);
+    }
+    else {
+        if (proof.eip712Domain.verifyingContract.toLowerCase() !== issuerAcct.address.toLowerCase()) {
+            issues.push(`proof.eip712Domain.verifyingContract (${proof.eip712Domain.verifyingContract}) MUST equal the issuer SA (${issuerAcct.address})`);
+        }
+        if (proof.eip712Domain.chainId !== issuerAcct.chainId) {
+            issues.push(`proof.eip712Domain.chainId (${proof.eip712Domain.chainId}) MUST equal the issuer chainId (${issuerAcct.chainId})`);
+        }
+        const vmAcct = parseEip155Caip10(proof.verificationMethod.split('#')[0] ?? '');
+        if (!vmAcct || vmAcct.address.toLowerCase() !== issuerAcct.address.toLowerCase()) {
+            issues.push(`proof.verificationMethod (${proof.verificationMethod}) MUST resolve to the issuer SA (${issuerAcct.address})`);
+        }
+    }
+    const expectedDigest = eip712Digest({
+        credentialBodyHash: bodyHash,
+        issuer: vc.issuer,
+        validFrom: isoToSeconds(vc.validFrom),
+        validUntil: isoToSeconds(vc.validUntil),
+        proofPurpose: proof.proofPurpose,
+        chainId: proof.eip712Domain.chainId,
+        verifyingContract: proof.eip712Domain.verifyingContract,
+    });
+    const issuerCaip10 = parseCaip10IssuerFromVerificationMethod(proof.verificationMethod);
+    return {
+        structural: issues.length === 0,
+        expectedDigest,
+        proofValue: proof.proofValue,
+        issuerCaip10,
+        statusListId: vc.credentialStatus?.statusListCredential ?? null,
+        issues,
+    };
+}
+function parseCaip10IssuerFromVerificationMethod(method) {
+    // Format: `eip155:<chainId>:<address>#<keyName>`
+    const hashIdx = method.indexOf('#');
+    if (hashIdx === -1)
+        return null;
+    const ref = method.slice(0, hashIdx);
+    // Light sanity check
+    if (!/^eip155:\d+:0x[0-9a-fA-F]+$/.test(ref))
+        return null;
+    return ref;
+}
+export async function verifyCredential(vc, client, opts = {}) {
+    const structuralResult = verifyCredentialStructural(vc);
+    const issues = [...structuralResult.issues];
+    if (!structuralResult.structural || !structuralResult.expectedDigest || !structuralResult.proofValue) {
+        return { valid: false, structuralResult, issues };
+    }
+    const issuerAcct = parseEip155Caip10(vc.issuer);
+    if (!issuerAcct) {
+        issues.push('cannot resolve issuer SA for ERC-1271 verification');
+        return { valid: false, structuralResult, issues };
+    }
+    let ok;
+    try {
+        ok = await client.verifyHash({
+            address: issuerAcct.address,
+            hash: structuralResult.expectedDigest,
+            signature: structuralResult.proofValue,
+        });
+    }
+    catch (e) {
+        issues.push(`ERC-1271 verification call failed: ${e instanceof Error ? e.message : String(e)}`);
+        return { valid: false, structuralResult, issues };
+    }
+    if (!ok) {
+        issues.push('issuer ERC-1271 signature did not validate over the expected digest');
+        return { valid: false, structuralResult, issues };
+    }
+    // NEW-VC-1: a valid signature proves authorship, NOT current validity. If the VC declares a
+    // credentialStatus, confirm it is not revoked/suspended — fail closed when it can't be resolved.
+    if (vc.credentialStatus) {
+        if (opts.verifyStatus) {
+            let status;
+            try {
+                status = await opts.verifyStatus(vc.credentialStatus);
+            }
+            catch (e) {
+                issues.push(`credentialStatus resolution failed: ${e instanceof Error ? e.message : String(e)}`);
+                return { valid: false, structuralResult, issues };
+            }
+            if (status.revoked) {
+                issues.push('credential is revoked/suspended per its credentialStatus');
+                return { valid: false, structuralResult, issues };
+            }
+        }
+        else if (!opts.allowUnresolvedStatus) {
+            issues.push('credentialStatus present but no status resolver injected — cannot confirm the credential is not revoked (fail-closed; pass allowUnresolvedStatus to override)');
+            return { valid: false, structuralResult, issues };
+        }
+    }
+    return { valid: true, structuralResult, issues };
+}
+//# sourceMappingURL=verifier.js.map

package/dist/verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../src/verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAexE;2FAC2F;AAC3F,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,CAAC,GAAG,oCAAoC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAkB,EAAE,CAAC;AACnE,CAAC;AAiBD;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,EAAwB;IACjE,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,sBAAsB,EAAE,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9C,IAAI,CAAC,EAAE,CAAC,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE,CAAC,iBAAiB;QAAE,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAEpE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,gGAAgG;IAChG,sFAAsF;IACtF,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACpE,CAAC;aAAM,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QACtE,CAAC;aAAM,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QACd,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,EAAE,CAAC,gBAAgB,EAAE,oBAAoB,IAAI,IAAI;YAC/D,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,eAAe,CAAC;SACrC,CAAC;IACJ,CAAC;IAED,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,2BAA4B,EAAE,CAAC,KAAe,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,EAAE,CAAC,gBAAgB,EAAE,oBAAoB,IAAI,IAAI;YAC/D,MAAM;SACP,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,EAAE,CAAC,KAAiC,CAAC;IAEnD,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;QAChG,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,EAAE,CAAC,gBAAgB,EAAE,oBAAoB,IAAI,IAAI;YAC/D,MAAM;SACP,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;IACpC,yFAAyF;IACzF,uEAAuE;IACvE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;IACrG,CAAC;SAAM,IAAI,KAAK,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CACT,yBAAyB,KAAK,CAAC,cAAc,uDAAuD,QAAQ,GAAG,CAChH,CAAC;IACJ,CAAC;IAED,8FAA8F;IAC9F,8FAA8F;IAC9F,kGAAkG;IAClG,wFAAwF;IACxF,MAAM,UAAU,GAAG,iBAAiB,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,4DAA4D,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IACvF,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,CAAC,YAAY,CAAC,iBAAiB,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5F,MAAM,CAAC,IAAI,CACT,yCAAyC,KAAK,CAAC,YAAY,CAAC,iBAAiB,+BAA+B,UAAU,CAAC,OAAO,GAAG,CAClI,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,YAAY,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;YACtD,MAAM,CAAC,IAAI,CACT,+BAA+B,KAAK,CAAC,YAAY,CAAC,OAAO,oCAAoC,UAAU,CAAC,OAAO,GAAG,CACnH,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;YACjF,MAAM,CAAC,IAAI,CACT,6BAA6B,KAAK,CAAC,kBAAkB,oCAAoC,UAAU,CAAC,OAAO,GAAG,CAC/G,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,YAAY,CAAC;QAClC,kBAAkB,EAAE,QAAQ;QAC5B,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC,SAAS,CAAC;QACrC,UAAU,EAAE,YAAY,CAAC,EAAE,CAAC,UAAU,CAAC;QACvC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,OAAO;QACnC,iBAAiB,EAAE,KAAK,CAAC,YAAY,CAAC,iBAAiB;KACxD,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,uCAAuC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAEvF,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC/B,cAAc;QACd,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY;QACZ,YAAY,EAAE,EAAE,CAAC,gBAAgB,EAAE,oBAAoB,IAAI,IAAI;QAC/D,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,uCAAuC,CAAC,MAAc;IAC7D,iDAAiD;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACrC,qBAAqB;IACrB,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,GAAG,CAAC;AACb,CAAC;AAiDD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAwB,EACxB,MAAuB,EACvB,OAA6B,EAAE;IAE/B,MAAM,gBAAgB,GAAG,0BAA0B,CAAC,EAAE,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,gBAAgB,CAAC,UAAU,IAAI,CAAC,gBAAgB,CAAC,cAAc,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC;QACrG,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,UAAU,GAAG,iBAAiB,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,EAAW,CAAC;IAChB,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC;YAC3B,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,IAAI,EAAE,gBAAgB,CAAC,cAAc;YACrC,SAAS,EAAE,gBAAgB,CAAC,UAAU;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChG,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;QACnF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IACpD,CAAC;IAED,4FAA4F;IAC5F,iGAAiG;IACjG,IAAI,EAAE,CAAC,gBAAgB,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,MAA4B,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACjG,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;YACpD,CAAC;YACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;gBACxE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;YACpD,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CACT,+JAA+J,CAChK,CAAC;YACF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;QACpD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;AACnD,CAAC"}

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "@agenticprimitives/verifiable-credentials",
+  "version": "0.0.0-alpha.10",
+  "description": "W3C Verifiable Credentials envelope + Eip712Signature2026 proof + DOLCE+DnS Situation bases + ontology-shape schema registration. Substrate for layers 12–15 credential types.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/agentictrustlabs/agenticprimitives.git",
+    "directory": "packages/verifiable-credentials"
+  },
+  "homepage": "https://github.com/agentictrustlabs/agenticprimitives/tree/master/packages/verifiable-credentials",
+  "bugs": {
+    "url": "https://github.com/agentictrustlabs/agenticprimitives/issues"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "LICENSE",
+    "dist",
+    "spec.md",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "peerDependencies": {
+    "viem": "^2.52.2",
+    "@agenticprimitives/types": "1.0.0-alpha.13",
+    "@agenticprimitives/ontology": "1.0.0-alpha.13"
+  },
+  "dependencies": {
+    "@noble/hashes": "^2.2.0"
+  },
+  "devDependencies": {
+    "vitest": "^4.1.8",
+    "viem": "^2.52.2"
+  },
+  "keywords": [
+    "agentic",
+    "primitives",
+    "verifiable-credentials"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "test:unit": "vitest run test/unit --passWithNoTests",
+    "test:watch": "vitest",
+    "clean": "rm -rf dist"
+  }
+}

package/spec.md

@@ -0,0 +1,5 @@
+# Spec pointer
+
+Canonical spec: [`../../specs/242-*.md`](../../specs/)
+
+Owning layers (per [coordination-substrate.md](../../docs/architecture/coordination-substrate.md)): envelope.