@agenticprimitives/verifiable-credentials 0.0.0-alpha.2 → 0.0.0-alpha.21
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +31 -6
- package/dist/canonical.d.ts +2 -9
- package/dist/canonical.d.ts.map +1 -1
- package/dist/canonical.js +5 -107
- package/dist/canonical.js.map +1 -1
- package/dist/index.d.ts +6 -5
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +3 -2
- package/dist/index.js.map +1 -1
- package/dist/proof.d.ts +31 -0
- package/dist/proof.d.ts.map +1 -1
- package/dist/proof.js +29 -7
- package/dist/proof.js.map +1 -1
- package/dist/situation.d.ts +6 -0
- package/dist/situation.d.ts.map +1 -1
- package/dist/situation.js +7 -0
- package/dist/situation.js.map +1 -1
- package/dist/types.d.ts +14 -0
- package/dist/types.d.ts.map +1 -1
- package/dist/types.js.map +1 -1
- package/dist/verifier.d.ts +87 -13
- package/dist/verifier.d.ts.map +1 -1
- package/dist/verifier.js +137 -13
- package/dist/verifier.js.map +1 -1
- package/package.json +6 -5
package/README.md
CHANGED
|
@@ -1,15 +1,40 @@
|
|
|
1
1
|
# @agenticprimitives/verifiable-credentials
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
**A credential is only as durable as the identity it points at.** Most verifiable-credential stacks bind claims to a key — and when the key rotates, the trust graph quietly breaks. Here the issuer and subject of every credential is a Smart Agent address: a persistent ERC-4337 account whose keys are replaceable facets. Rotate a passkey, recover from a lost device, swap a signer — the address persists, and every credential issued by or about it stays verifiable.
|
|
4
4
|
|
|
5
|
-
W3C
|
|
5
|
+
This package is the W3C VC 2.0 envelope for that model: an `Eip712Signature2026` proof signed by a smart account and verified with an ERC-1271 round-trip against the chain, plus the RFC 8785 (JCS) canonical hash that every downstream registry stores as the on-chain anchor. It is the substrate layer — specific credential types (associations, agreements, evidence, outcomes, receipts) are composed on top by consumer packages.
|
|
6
6
|
|
|
7
|
-
|
|
8
|
-
**Authoritative spec:** [`specs/242-*.md`](../../specs/) — see `spec.md` for the symlink to the canonical spec.
|
|
7
|
+
> Part of [agenticprimitives](../../README.md) — the trust substrate for the agent economy: one canonical Smart Agent identity with custody, delegation, naming, credentials, and audit evidence designed as one system.
|
|
9
8
|
|
|
10
|
-
## What
|
|
9
|
+
## What ships today
|
|
11
10
|
|
|
12
|
-
|
|
11
|
+
- **W3C VC 2.0 envelope** — `@context`, `type`, `issuer`, `validFrom`, `credentialSubject`, `proof`, `credentialStatus` (`VerifiableCredential`, `UnsignedCredential` types).
|
|
12
|
+
- **`Eip712Signature2026` proof** — `signCredential(unsigned, signer)` produces the proof; `eip712Digest(...)` matches the Solidity verifier byte-for-byte (cross-stack typehash equality, CI-gated per spec 242 §4.3).
|
|
13
|
+
- **Verifier** — `verifyCredential(vc, client)` runs structural checks, recomputes the digest, and verifies the issuer signature via ERC-1271 against the issuer's Smart Agent. One mechanism, no silent fallbacks ([ADR-0013](../../docs/architecture/decisions/0013-no-silent-fallbacks.md)). `verifyCredentialStructural(vc)` is the offline subset.
|
|
14
|
+
- **Canonical hash** — `credentialHash(vc)` / `canonicalHash(...)` / `jcsCanonicalize(...)`: the RFC 8785 JCS hash used as the credential anchor everywhere downstream (attestation registries, vault indexes, status lists).
|
|
15
|
+
- **DOLCE+DnS Situation pattern** — `buildSituation(...)` and the `Situation` / `DescriptionRef` / `RoleName` shapes that all substrate credential subjects compose against.
|
|
16
|
+
- **Schema URIs** — `buildShapeUri` / `parseShapeUri` / `shapeHash` for the `did:shape:<name>:<version>` convention that pairs with the on-chain `ShapeRegistry`.
|
|
17
|
+
|
|
18
|
+
```ts
|
|
19
|
+
import { credentialHash, verifyCredential } from '@agenticprimitives/verifiable-credentials';
|
|
20
|
+
|
|
21
|
+
const anchor = credentialHash(vc); // RFC 8785 JCS hash — what registries store
|
|
22
|
+
const result = await verifyCredential(vc, client); // ERC-1271 round-trip against the issuer Smart Agent
|
|
23
|
+
```
|
|
24
|
+
|
|
25
|
+
## How it's different
|
|
26
|
+
|
|
27
|
+
Veramo, Trinsic, and the broader W3C VC tooling ecosystem resolve issuers through DID methods and key registries — so credential validity is coupled to key material. Here the issuer is a CAIP-10 smart-account address and verification is ERC-1271 against the chain: **keys rotate, the address persists, credentials survive recovery** ([ADR-0011](../../docs/architecture/decisions/0011-credential-recovery-and-re-association.md)). And because the EIP-712 digest is locked to its Solidity counterpart by a CI gate, the contracts and the SDK are one artifact — the client cannot drift from the chain, which is precisely where stitched VC stacks decay.
|
|
28
|
+
|
|
29
|
+
The package is deliberately a leaf: it imports only `types`, `ontology`, `viem`, and `@noble/hashes`, and defines no specific credential types — `attestations`, `agreements`, `fulfillment`, and `payments` own those.
|
|
30
|
+
|
|
31
|
+
## Status
|
|
32
|
+
|
|
33
|
+
**W1 foundational — implemented and security-load-bearing.** The envelope, proof, canonical hash, and verifier ship today and are exercised by downstream packages; verifier findings VC-1/VC-2 are closed (see [AUDIT.md](./AUDIT.md)). Alternative proof types (BBS+ / SD-JWT / AnonCreds) have a reserved envelope slot and land in later waves per the [W1 implementation wave plan](../../docs/architecture/w1-implementation-wave-plan.md).
|
|
34
|
+
|
|
35
|
+
> Testnet/pilot-ready. Production launch is gated on the public checklist in the root README — including third-party contract audit and governance key rotation. Track every security finding live in [`docs/audits/findings.yaml`](../../docs/audits/findings.yaml).
|
|
36
|
+
|
|
37
|
+
**Authoritative spec:** [`specs/242-trust-credentials-and-public-assertions.md`](../../specs/242-trust-credentials-and-public-assertions.md) §4 — see `spec.md` for the symlink. Bounded surface: `CLAUDE.md` + `capability.manifest.json`.
|
|
13
38
|
|
|
14
39
|
## Build
|
|
15
40
|
|
package/dist/canonical.d.ts
CHANGED
|
@@ -17,15 +17,8 @@
|
|
|
17
17
|
* subset of JSON (string / number / boolean / null / object / array). We do not
|
|
18
18
|
* handle BigInt or Date — callers must serialise those upstream.
|
|
19
19
|
*/
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
constructor(message: string, path: string);
|
|
23
|
-
}
|
|
24
|
-
/**
|
|
25
|
-
* Canonicalize a JSON-compatible value per RFC 8785.
|
|
26
|
-
* Returns the canonical string (UTF-8 text; callers wrap with `utf8ToBytes` to hash).
|
|
27
|
-
*/
|
|
28
|
-
export declare function jcsCanonicalize(value: unknown, path?: string): string;
|
|
20
|
+
import { JcsError, jcsCanonicalize } from '@agenticprimitives/types';
|
|
21
|
+
export { JcsError, jcsCanonicalize };
|
|
29
22
|
/**
|
|
30
23
|
* Compute the canonical hash of a value: `keccak256(jcsCanonicalize(value))`.
|
|
31
24
|
* Returns the 32-byte hex hash.
|
package/dist/canonical.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../src/canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;
|
|
1
|
+
{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../src/canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;AAKrC;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,MAAM,EAAE,CAK3D"}
|
package/dist/canonical.js
CHANGED
|
@@ -19,113 +19,11 @@
|
|
|
19
19
|
*/
|
|
20
20
|
import { keccak_256 } from '@noble/hashes/sha3.js';
|
|
21
21
|
import { utf8ToBytes } from '@noble/hashes/utils.js';
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
}
|
|
28
|
-
}
|
|
29
|
-
/**
|
|
30
|
-
* Canonicalize a JSON-compatible value per RFC 8785.
|
|
31
|
-
* Returns the canonical string (UTF-8 text; callers wrap with `utf8ToBytes` to hash).
|
|
32
|
-
*/
|
|
33
|
-
export function jcsCanonicalize(value, path = '$') {
|
|
34
|
-
if (value === null)
|
|
35
|
-
return 'null';
|
|
36
|
-
if (value === undefined) {
|
|
37
|
-
throw new JcsError('undefined is not JSON', path);
|
|
38
|
-
}
|
|
39
|
-
switch (typeof value) {
|
|
40
|
-
case 'boolean':
|
|
41
|
-
return value ? 'true' : 'false';
|
|
42
|
-
case 'string':
|
|
43
|
-
return serializeString(value);
|
|
44
|
-
case 'number':
|
|
45
|
-
return serializeNumber(value, path);
|
|
46
|
-
case 'object': {
|
|
47
|
-
if (Array.isArray(value)) {
|
|
48
|
-
const items = value.map((v, i) => jcsCanonicalize(v, `${path}[${i}]`));
|
|
49
|
-
return `[${items.join(',')}]`;
|
|
50
|
-
}
|
|
51
|
-
// Plain object
|
|
52
|
-
const entries = Object.entries(value)
|
|
53
|
-
.filter(([, v]) => v !== undefined)
|
|
54
|
-
.sort(([a], [b]) => sortByCodeUnit(a, b));
|
|
55
|
-
const items = entries.map(([k, v]) => `${serializeString(k)}:${jcsCanonicalize(v, `${path}.${k}`)}`);
|
|
56
|
-
return `{${items.join(',')}}`;
|
|
57
|
-
}
|
|
58
|
-
default:
|
|
59
|
-
throw new JcsError(`unsupported JSON type: ${typeof value}`, path);
|
|
60
|
-
}
|
|
61
|
-
}
|
|
62
|
-
/** UTF-16 code unit comparison — exactly what RFC 8785 §3.2.3 requires. */
|
|
63
|
-
function sortByCodeUnit(a, b) {
|
|
64
|
-
const len = Math.min(a.length, b.length);
|
|
65
|
-
for (let i = 0; i < len; i++) {
|
|
66
|
-
const av = a.charCodeAt(i);
|
|
67
|
-
const bv = b.charCodeAt(i);
|
|
68
|
-
if (av !== bv)
|
|
69
|
-
return av - bv;
|
|
70
|
-
}
|
|
71
|
-
return a.length - b.length;
|
|
72
|
-
}
|
|
73
|
-
/** RFC 8259 string serialisation with JCS-compatible escaping (RFC 8785 §3.2.2.2). */
|
|
74
|
-
function serializeString(s) {
|
|
75
|
-
let out = '"';
|
|
76
|
-
for (let i = 0; i < s.length; i++) {
|
|
77
|
-
const code = s.charCodeAt(i);
|
|
78
|
-
if (code === 0x22) {
|
|
79
|
-
out += '\\"';
|
|
80
|
-
}
|
|
81
|
-
else if (code === 0x5c) {
|
|
82
|
-
out += '\\\\';
|
|
83
|
-
}
|
|
84
|
-
else if (code < 0x20) {
|
|
85
|
-
// Control characters
|
|
86
|
-
switch (code) {
|
|
87
|
-
case 0x08:
|
|
88
|
-
out += '\\b';
|
|
89
|
-
break;
|
|
90
|
-
case 0x09:
|
|
91
|
-
out += '\\t';
|
|
92
|
-
break;
|
|
93
|
-
case 0x0a:
|
|
94
|
-
out += '\\n';
|
|
95
|
-
break;
|
|
96
|
-
case 0x0c:
|
|
97
|
-
out += '\\f';
|
|
98
|
-
break;
|
|
99
|
-
case 0x0d:
|
|
100
|
-
out += '\\r';
|
|
101
|
-
break;
|
|
102
|
-
default:
|
|
103
|
-
out += `\\u${code.toString(16).padStart(4, '0')}`;
|
|
104
|
-
}
|
|
105
|
-
}
|
|
106
|
-
else {
|
|
107
|
-
out += s[i];
|
|
108
|
-
}
|
|
109
|
-
}
|
|
110
|
-
out += '"';
|
|
111
|
-
return out;
|
|
112
|
-
}
|
|
113
|
-
/** RFC 8785 §3.2.2.3 — shortest round-tripping IEEE 754 representation. */
|
|
114
|
-
function serializeNumber(n, path) {
|
|
115
|
-
if (!Number.isFinite(n)) {
|
|
116
|
-
throw new JcsError(`non-finite number (${n})`, path);
|
|
117
|
-
}
|
|
118
|
-
if (Object.is(n, -0))
|
|
119
|
-
return '0';
|
|
120
|
-
if (n === 0)
|
|
121
|
-
return '0';
|
|
122
|
-
if (Number.isInteger(n) && Math.abs(n) < 1e21) {
|
|
123
|
-
return n.toString();
|
|
124
|
-
}
|
|
125
|
-
// Browsers + Node give us the shortest round-trip via `toString()`
|
|
126
|
-
// (per ECMA-262 §6.1.6.1.13). RFC 8785 expects the ES round-trip form.
|
|
127
|
-
return n.toString();
|
|
128
|
-
}
|
|
22
|
+
// RFC 8785 JCS lives in `@agenticprimitives/types` — ONE implementation. It was byte-identical here
|
|
23
|
+
// and in the sibling package, and neither could import the other (the edge is a cycle). Imported for
|
|
24
|
+
// local use AND re-exported, so consumers of this package are unaffected.
|
|
25
|
+
import { JcsError, jcsCanonicalize } from '@agenticprimitives/types';
|
|
26
|
+
export { JcsError, jcsCanonicalize };
|
|
129
27
|
/**
|
|
130
28
|
* Compute the canonical hash of a value: `keccak256(jcsCanonicalize(value))`.
|
|
131
29
|
* Returns the 32-byte hex hash.
|
package/dist/canonical.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../src/canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,
|
|
1
|
+
{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../src/canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,oGAAoG;AACpG,qGAAqG;AACrG,0EAA0E;AAC1E,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;AAKrC;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,KAAK,UAAU,CAAC,MAAM,CAAC,EAAmB,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,CAAa;IAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAClB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -12,13 +12,14 @@ export declare const PACKAGE_NAME = "@agenticprimitives/verifiable-credentials";
|
|
|
12
12
|
export declare const PACKAGE_STATUS: "w1-foundational";
|
|
13
13
|
export declare const SPEC_REF = "specs/242-trust-credentials-and-public-assertions.md";
|
|
14
14
|
export { VC_CONTEXT_V2, EIP712_SIG_2026_CONTEXT, VC_DOMAIN_NAME, VC_DOMAIN_VERSION, VC_EIP712_TYPES, } from './types.js';
|
|
15
|
-
export type { Hex32, ISODate, ProofType, Eip712Signature2026Proof, Proof, CredentialStatus2021, VisibilityTier, DisclosurePolicy, VerifiableCredential, UnsignedCredential, } from './types.js';
|
|
15
|
+
export type { Hex32, ISODate, ProofType, Eip712Signature2026Proof, DelegatingSignerProof, Proof, CredentialStatus2021, VisibilityTier, DisclosurePolicy, VerifiableCredential, UnsignedCredential, } from './types.js';
|
|
16
16
|
export { jcsCanonicalize, canonicalHash, JcsError } from './canonical.js';
|
|
17
17
|
export { assertSituationRolesPresent, buildSituation, } from './situation.js';
|
|
18
18
|
export type { Situation, DescriptionRef, RoleName } from './situation.js';
|
|
19
|
-
export { credentialHash, eip712Digest, isoToSeconds, signCredential, viemSignerFromWallet, } from './proof.js';
|
|
20
|
-
export type { CredentialSigner } from './proof.js';
|
|
21
|
-
export { verifyCredentialStructural } from './verifier.js';
|
|
22
|
-
export type { VerificationResult } from './verifier.js';
|
|
19
|
+
export { credentialHash, eip712Digest, isoToSeconds, signCredential, viemSignerFromWallet, kmsCredentialSigner, } from './proof.js';
|
|
20
|
+
export type { CredentialSigner, KmsSigningBackend } from './proof.js';
|
|
21
|
+
export { verifyCredential, verifyCredentialStructural, parseEip155Caip10 } from './verifier.js';
|
|
22
|
+
export type { VerificationResult, VerifyCredentialResult, VerifyCredentialOpts, CredentialStatusResolver, Erc1271Verifier, Caip10Eip155, } from './verifier.js';
|
|
23
23
|
export { SHAPE_DID_PREFIX, buildShapeUri, parseShapeUri, shapeHash } from './schema.js';
|
|
24
|
+
export { situationV2ToCredentialSubject } from './situation.js';
|
|
24
25
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,eAAO,MAAM,YAAY,8CAA8C,CAAC;AACxE,eAAO,MAAM,cAAc,EAAG,iBAA0B,CAAC;AACzD,eAAO,MAAM,QAAQ,yDAAyD,CAAC;AAG/E,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,KAAK,EACL,OAAO,EACP,SAAS,EACT,wBAAwB,EACxB,KAAK,EACL,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1E,OAAO,EACL,2BAA2B,EAC3B,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1E,OAAO,EACL,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,oBAAoB,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,eAAO,MAAM,YAAY,8CAA8C,CAAC;AACxE,eAAO,MAAM,cAAc,EAAG,iBAA0B,CAAC;AACzD,eAAO,MAAM,QAAQ,yDAAyD,CAAC;AAG/E,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,KAAK,EACL,OAAO,EACP,SAAS,EACT,wBAAwB,EACxB,qBAAqB,EACrB,KAAK,EACL,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1E,OAAO,EACL,2BAA2B,EAC3B,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1E,OAAO,EACL,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAGtE,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAChG,YAAY,EACV,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,YAAY,GACb,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,8BAA8B,EAAE,MAAM,gBAAgB,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -18,9 +18,10 @@ export { jcsCanonicalize, canonicalHash, JcsError } from './canonical.js';
|
|
|
18
18
|
// Situation pattern
|
|
19
19
|
export { assertSituationRolesPresent, buildSituation, } from './situation.js';
|
|
20
20
|
// Proof builder
|
|
21
|
-
export { credentialHash, eip712Digest, isoToSeconds, signCredential, viemSignerFromWallet, } from './proof.js';
|
|
21
|
+
export { credentialHash, eip712Digest, isoToSeconds, signCredential, viemSignerFromWallet, kmsCredentialSigner, } from './proof.js';
|
|
22
22
|
// Verifier
|
|
23
|
-
export { verifyCredentialStructural } from './verifier.js';
|
|
23
|
+
export { verifyCredential, verifyCredentialStructural, parseEip155Caip10 } from './verifier.js';
|
|
24
24
|
// Schema registration
|
|
25
25
|
export { SHAPE_DID_PREFIX, buildShapeUri, parseShapeUri, shapeHash } from './schema.js';
|
|
26
|
+
export { situationV2ToCredentialSubject } from './situation.js';
|
|
26
27
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,2CAA2C,CAAC;AACxE,MAAM,CAAC,MAAM,cAAc,GAAG,iBAA0B,CAAC;AACzD,MAAM,CAAC,MAAM,QAAQ,GAAG,sDAAsD,CAAC;AAE/E,oBAAoB;AACpB,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,eAAe,GAChB,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,2CAA2C,CAAC;AACxE,MAAM,CAAC,MAAM,cAAc,GAAG,iBAA0B,CAAC;AACzD,MAAM,CAAC,MAAM,QAAQ,GAAG,sDAAsD,CAAC;AAE/E,oBAAoB;AACpB,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,eAAe,GAChB,MAAM,YAAY,CAAC;AAepB,uBAAuB;AACvB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1E,oBAAoB;AACpB,OAAO,EACL,2BAA2B,EAC3B,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,gBAAgB;AAChB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAGpB,WAAW;AACX,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAUhG,sBAAsB;AACtB,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,8BAA8B,EAAE,MAAM,gBAAgB,CAAC"}
|
package/dist/proof.d.ts
CHANGED
|
@@ -46,6 +46,7 @@ export declare function isoToSeconds(iso: string | undefined): number;
|
|
|
46
46
|
*/
|
|
47
47
|
export declare function signCredential<TSubject extends Record<string, unknown>>(unsigned: UnsignedCredential<TSubject>, signer: CredentialSigner, opts?: {
|
|
48
48
|
proofPurpose?: Eip712Signature2026Proof['proofPurpose'];
|
|
49
|
+
delegatingSigner?: Eip712Signature2026Proof['delegatingSigner'];
|
|
49
50
|
}): Promise<VerifiableCredential<TSubject>>;
|
|
50
51
|
/** Convenience: a viem `WalletClient`-backed `CredentialSigner` (EOA-only path). */
|
|
51
52
|
export declare function viemSignerFromWallet(args: {
|
|
@@ -54,6 +55,36 @@ export declare function viemSignerFromWallet(args: {
|
|
|
54
55
|
chainId: number;
|
|
55
56
|
verifyingContract: Address;
|
|
56
57
|
}): CredentialSigner;
|
|
58
|
+
/**
|
|
59
|
+
* Minimal structural shape of a KMS signing backend (spec 276 KCS-D5). It is
|
|
60
|
+
* declared HERE — not imported from `@agenticprimitives/key-custody` — because
|
|
61
|
+
* `verifiable-credentials` is a leaf in the dependency graph (no `@agenticprimitives/*`
|
|
62
|
+
* imports beyond types/ontology). `key-custody`'s `KmsAccountBackend` structurally
|
|
63
|
+
* satisfies this, so `kmsCredentialSigner(kmsBackend, …)` just works without the
|
|
64
|
+
* cross-package edge.
|
|
65
|
+
*/
|
|
66
|
+
export interface KmsSigningBackend {
|
|
67
|
+
/** Sign a 32-byte digest; returns a 65-byte secp256k1 `(r,s,v)` signature. */
|
|
68
|
+
signA2AAction(input: {
|
|
69
|
+
digest: Uint8Array;
|
|
70
|
+
}): Promise<{
|
|
71
|
+
signature: Uint8Array;
|
|
72
|
+
}>;
|
|
73
|
+
/** The signing key's EVM address (the credential the issuer SA validates via ERC-1271). */
|
|
74
|
+
getSignerAddress(): Promise<Address>;
|
|
75
|
+
}
|
|
76
|
+
/**
|
|
77
|
+
* Convenience: a `CredentialSigner` backed by a KMS-custodied secp256k1 key
|
|
78
|
+
* (the issuer SA's master / per-subject signer). Mirrors `viemSignerFromWallet`
|
|
79
|
+
* for the KMS path. `verifyingContract` defaults to the issuer SA itself (the
|
|
80
|
+
* ERC-1271 self-verification anchor).
|
|
81
|
+
*/
|
|
82
|
+
export declare function kmsCredentialSigner(args: {
|
|
83
|
+
backend: KmsSigningBackend;
|
|
84
|
+
issuerAddress: Address;
|
|
85
|
+
chainId: number;
|
|
86
|
+
verifyingContract?: Address;
|
|
87
|
+
}): CredentialSigner;
|
|
57
88
|
/** Re-export so callers see the Proof union from one place. */
|
|
58
89
|
export type { Proof };
|
|
59
90
|
//# sourceMappingURL=proof.d.ts.map
|
package/dist/proof.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../src/proof.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,
|
|
1
|
+
{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../src/proof.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAyC,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,KAAK,YAAY,EAAE,MAAM,MAAM,CAAC;AAGxG,OAAO,EAML,KAAK,wBAAwB,EAC7B,KAAK,KAAK,EACV,KAAK,KAAK,EACV,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EAC1B,MAAM,YAAY,CAAC;AAEpB,sFAAsF;AACtF,MAAM,WAAW,gBAAgB;IAC/B,yEAAyE;IACzE,aAAa,EAAE,OAAO,CAAC;IACvB,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,UAAU,CAAC,MAAM,EAAE,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;CACzC;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,kBAAkB,GAAG,oBAAoB,GAAG,KAAK,CAKzF;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE;IACjC,kBAAkB,EAAE,KAAK,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,wBAAwB,CAAC,cAAc,CAAC,CAAC;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;CAC5B,GAAG,KAAK,CAkBR;AAED,oEAAoE;AACpE,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAG5D;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3E,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EACtC,MAAM,EAAE,gBAAgB,EACxB,IAAI,GAAE;IAAE,YAAY,CAAC,EAAE,wBAAwB,CAAC,cAAc,CAAC,CAAC;IAAC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC,kBAAkB,CAAC,CAAA;CAAO,GACtI,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAuCzC;AAED,oFAAoF;AACpF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,MAAM,EAAE,YAAY,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;CAC5B,GAAG,gBAAgB,CAYnB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,8EAA8E;IAC9E,aAAa,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;IACjF,2FAA2F;IAC3F,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,OAAO,EAAE,iBAAiB,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B,GAAG,gBAAgB,CAUnB;AAQD,+DAA+D;AAC/D,YAAY,EAAE,KAAK,EAAE,CAAC"}
|
package/dist/proof.js
CHANGED
|
@@ -5,7 +5,7 @@
|
|
|
5
5
|
*
|
|
6
6
|
* Spec 242 §4.3 + ADR-0023 §D2.
|
|
7
7
|
*/
|
|
8
|
-
import { hashTypedData } from 'viem';
|
|
8
|
+
import { hashTypedData, hexToBytes, bytesToHex } from 'viem';
|
|
9
9
|
import { canonicalHash } from './canonical.js';
|
|
10
10
|
import { EIP712_SIG_2026_CONTEXT, VC_CONTEXT_V2, VC_DOMAIN_NAME, VC_DOMAIN_VERSION, VC_EIP712_TYPES, } from './types.js';
|
|
11
11
|
/**
|
|
@@ -52,12 +52,17 @@ export function isoToSeconds(iso) {
|
|
|
52
52
|
*/
|
|
53
53
|
export async function signCredential(unsigned, signer, opts = {}) {
|
|
54
54
|
const proofPurpose = opts.proofPurpose ?? 'assertionMethod';
|
|
55
|
-
|
|
55
|
+
// Expand `@context` BEFORE hashing so the emitted `credentialHash` matches the
|
|
56
|
+
// canonical hash of the emitted body. (Hashing the pre-expansion body and then
|
|
57
|
+
// adding the EIP-712 context to the output produced a VC whose stored hash never
|
|
58
|
+
// reconciled with its own body — structural verification would reject it.)
|
|
59
|
+
const contexted = { ...unsigned, '@context': ensureContexts(unsigned['@context']) };
|
|
60
|
+
const bodyHash = credentialHash(contexted);
|
|
56
61
|
const digest = eip712Digest({
|
|
57
62
|
credentialBodyHash: bodyHash,
|
|
58
|
-
issuer:
|
|
59
|
-
validFrom: isoToSeconds(
|
|
60
|
-
validUntil: isoToSeconds(
|
|
63
|
+
issuer: contexted.issuer,
|
|
64
|
+
validFrom: isoToSeconds(contexted.validFrom),
|
|
65
|
+
validUntil: isoToSeconds(contexted.validUntil),
|
|
61
66
|
proofPurpose,
|
|
62
67
|
chainId: signer.chainId,
|
|
63
68
|
verifyingContract: signer.verifyingContract,
|
|
@@ -76,10 +81,10 @@ export async function signCredential(unsigned, signer, opts = {}) {
|
|
|
76
81
|
verifyingContract: signer.verifyingContract,
|
|
77
82
|
},
|
|
78
83
|
credentialHash: bodyHash,
|
|
84
|
+
...(opts.delegatingSigner ? { delegatingSigner: opts.delegatingSigner } : {}),
|
|
79
85
|
};
|
|
80
86
|
return {
|
|
81
|
-
...
|
|
82
|
-
'@context': ensureContexts(unsigned['@context']),
|
|
87
|
+
...contexted,
|
|
83
88
|
proof,
|
|
84
89
|
};
|
|
85
90
|
}
|
|
@@ -97,6 +102,23 @@ export function viemSignerFromWallet(args) {
|
|
|
97
102
|
},
|
|
98
103
|
};
|
|
99
104
|
}
|
|
105
|
+
/**
|
|
106
|
+
* Convenience: a `CredentialSigner` backed by a KMS-custodied secp256k1 key
|
|
107
|
+
* (the issuer SA's master / per-subject signer). Mirrors `viemSignerFromWallet`
|
|
108
|
+
* for the KMS path. `verifyingContract` defaults to the issuer SA itself (the
|
|
109
|
+
* ERC-1271 self-verification anchor).
|
|
110
|
+
*/
|
|
111
|
+
export function kmsCredentialSigner(args) {
|
|
112
|
+
return {
|
|
113
|
+
issuerAddress: args.issuerAddress,
|
|
114
|
+
chainId: args.chainId,
|
|
115
|
+
verifyingContract: args.verifyingContract ?? args.issuerAddress,
|
|
116
|
+
async signDigest(digest) {
|
|
117
|
+
const { signature } = await args.backend.signA2AAction({ digest: hexToBytes(digest) });
|
|
118
|
+
return bytesToHex(signature);
|
|
119
|
+
},
|
|
120
|
+
};
|
|
121
|
+
}
|
|
100
122
|
function ensureContexts(existing) {
|
|
101
123
|
const needed = [VC_CONTEXT_V2, EIP712_SIG_2026_CONTEXT];
|
|
102
124
|
const have = new Set(existing);
|
package/dist/proof.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"proof.js","sourceRoot":"","sources":["../src/proof.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,aAAa,EAA6C,MAAM,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"proof.js","sourceRoot":"","sources":["../src/proof.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAA6C,MAAM,MAAM,CAAC;AAExG,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,eAAe,GAMhB,MAAM,YAAY,CAAC;AAiBpB;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAmD;IAChF,uDAAuD;IACvD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,YAAY,EAAE,GAAG,QAAgC,CAAC;IAC9E,KAAK,QAAQ,CAAC;IACd,OAAO,aAAa,CAAC,YAAY,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAQ5B;IACC,OAAO,aAAa,CAAC;QACnB,MAAM,EAAE;YACN,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,iBAAiB;YAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;SAC1C;QACD,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE,iCAAiC;QAC9C,OAAO,EAAE;YACP,cAAc,EAAE,IAAI,CAAC,kBAAkB;YACvC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YACjC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YACnC,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC;KACF,CAAU,CAAC;AACd,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,YAAY,CAAC,GAAuB;IAClD,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,CAAC;IACnB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;AACpD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAsC,EACtC,MAAwB,EACxB,OAAqI,EAAE;IAEvI,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,iBAAiB,CAAC;IAC5D,+EAA+E;IAC/E,+EAA+E;IAC/E,iFAAiF;IACjF,2EAA2E;IAC3E,MAAM,SAAS,GAAG,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAkC,CAAC;IACpH,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,kBAAkB,EAAE,QAAQ;QAC5B,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,SAAS,CAAC;QAC5C,UAAU,EAAE,YAAY,CAAC,SAAS,CAAC,UAAU,CAAC;QAC9C,YAAY;QACZ,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;KAC5C,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAEnD,MAAM,KAAK,GAA6B;QACtC,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACjC,kBAAkB,EAAE,UAAU,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,iBAAiB,kBAAkB;QAC1F,YAAY;QACZ,UAAU;QACV,YAAY,EAAE;YACZ,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,iBAAiB;YAC1B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C;QACD,cAAc,EAAE,QAAQ;QACxB,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC;IAEF,OAAO;QACL,GAAG,SAAS;QACZ,KAAK;KAC4B,CAAC;AACtC,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAAC,IAKpC;IACC,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,KAAK,CAAC,UAAU,CAAC,MAAM;YACrB,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;gBACzB,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;aACgB,CAAmB,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC;AAiBD;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAKnC;IACC,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,aAAa;QAC/D,KAAK,CAAC,UAAU,CAAC,MAAa;YAC5B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACvF,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAA2B;IACjD,MAAM,MAAM,GAAG,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC"}
|
package/dist/situation.d.ts
CHANGED
|
@@ -45,4 +45,10 @@ export declare function buildSituation<TBody extends Record<string, unknown>>(ar
|
|
|
45
45
|
body: TBody;
|
|
46
46
|
participants?: Record<string, string>;
|
|
47
47
|
}): Situation<TBody>;
|
|
48
|
+
import type { SituationV2 } from '@agenticprimitives/situations';
|
|
49
|
+
/** Bridge a substrate `SituationV2` (spec 324) into a credential subject. The subject IS the situation,
|
|
50
|
+
* faithfully (roleBindings + body + evidence preserved), widened to satisfy VC's `Record<string, unknown>`
|
|
51
|
+
* subject constraint — no lossy conversion to the legacy V1 `Situation`. Every credential whose subject is a
|
|
52
|
+
* SituationV2 (e.g. `OrganizationMembershipCredential`) composes through this. */
|
|
53
|
+
export declare function situationV2ToCredentialSubject<TBody extends Record<string, unknown>>(s: SituationV2<TBody>): SituationV2<TBody> & Record<string, unknown>;
|
|
48
54
|
//# sourceMappingURL=situation.d.ts.map
|
package/dist/situation.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"situation.d.ts","sourceRoot":"","sources":["../src/situation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAExD,gFAAgF;AAChF,MAAM,MAAM,cAAc,GAAG,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC;AAEnD,yDAAyD;AACzD,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B;;yEAEyE;AACzE,MAAM,WAAW,SAAS,CAAC,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACxF,uDAAuD;IACvD,WAAW,EAAE,cAAc,CAAC;IAC5B,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjC,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,sCAAsC;IACtC,IAAI,EAAE,KAAK,CAAC;IACZ,uEAAuE;IACvE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,IAAI,CAQzF;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE;IAC1E,WAAW,EAAE,cAAc,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,EAAE,KAAK,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC,GAAG,SAAS,CAAC,KAAK,CAAC,CAOnB"}
|
|
1
|
+
{"version":3,"file":"situation.d.ts","sourceRoot":"","sources":["../src/situation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAExD,gFAAgF;AAChF,MAAM,MAAM,cAAc,GAAG,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC;AAEnD,yDAAyD;AACzD,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B;;yEAEyE;AACzE,MAAM,WAAW,SAAS,CAAC,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACxF,uDAAuD;IACvD,WAAW,EAAE,cAAc,CAAC;IAC5B,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjC,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,sCAAsC;IACtC,IAAI,EAAE,KAAK,CAAC;IACZ,uEAAuE;IACvE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,IAAI,CAQzF;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE;IAC1E,WAAW,EAAE,cAAc,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,EAAE,KAAK,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC,GAAG,SAAS,CAAC,KAAK,CAAC,CAOnB;AAED,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE;;;mFAGmF;AACnF,wBAAgB,8BAA8B,CAAC,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClF,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,GACpB,WAAW,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE9C"}
|
package/dist/situation.js
CHANGED
|
@@ -33,4 +33,11 @@ export function buildSituation(args) {
|
|
|
33
33
|
body: args.body,
|
|
34
34
|
};
|
|
35
35
|
}
|
|
36
|
+
/** Bridge a substrate `SituationV2` (spec 324) into a credential subject. The subject IS the situation,
|
|
37
|
+
* faithfully (roleBindings + body + evidence preserved), widened to satisfy VC's `Record<string, unknown>`
|
|
38
|
+
* subject constraint — no lossy conversion to the legacy V1 `Situation`. Every credential whose subject is a
|
|
39
|
+
* SituationV2 (e.g. `OrganizationMembershipCredential`) composes through this. */
|
|
40
|
+
export function situationV2ToCredentialSubject(s) {
|
|
41
|
+
return s;
|
|
42
|
+
}
|
|
36
43
|
//# sourceMappingURL=situation.js.map
|
package/dist/situation.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"situation.js","sourceRoot":"","sources":["../src/situation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA0BH;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,CAAY,EAAE,aAAyB;IACjF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,uCAAuC,CAAC,CAAC,WAAW,gCAAgC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAwC,IAKrE;IACC,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE;QACxB,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS;QACtE,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC;AACJ,CAAC"}
|
|
1
|
+
{"version":3,"file":"situation.js","sourceRoot":"","sources":["../src/situation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA0BH;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,CAAY,EAAE,aAAyB;IACjF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,uCAAuC,CAAC,CAAC,WAAW,gCAAgC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAwC,IAKrE;IACC,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE;QACxB,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS;QACtE,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC;AACJ,CAAC;AAID;;;mFAGmF;AACnF,MAAM,UAAU,8BAA8B,CAC5C,CAAqB;IAErB,OAAO,CAAiD,CAAC;AAC3D,CAAC"}
|
package/dist/types.d.ts
CHANGED
|
@@ -43,6 +43,20 @@ export interface Eip712Signature2026Proof {
|
|
|
43
43
|
};
|
|
44
44
|
/** Optional canonical-hash receipt of the credential body (RFC 8785 JCS). */
|
|
45
45
|
credentialHash?: Hex32;
|
|
46
|
+
/** Present when an issuer-AUTHORIZED operational key (e.g. Cloud KMS) signed this credential instead of
|
|
47
|
+
* the issuer's own custodian. `proofValue` is then the delegate key's signature; trust still roots in
|
|
48
|
+
* the issuer SA (`delegatorIssuer` == the credential's issuer). Lives in the proof (stripped from the
|
|
49
|
+
* credential hash), so attaching it does NOT change the signed digest. The verifier checks the leaf. */
|
|
50
|
+
delegatingSigner?: DelegatingSignerProof;
|
|
51
|
+
}
|
|
52
|
+
/** Issuer authorization of an operational signing key (mirrors content-primitives' DelegatingSigner). */
|
|
53
|
+
export interface DelegatingSignerProof {
|
|
54
|
+
/** The issuer SA the credential's trust roots in (== the credential issuer). */
|
|
55
|
+
delegatorIssuer: Address;
|
|
56
|
+
/** The operational key that actually signed (authorized by `delegatorIssuer`). */
|
|
57
|
+
delegateKey: Address;
|
|
58
|
+
/** The signed delegation binding `delegateKey` → `delegatorIssuer`. OPAQUE; the app validates it. */
|
|
59
|
+
delegationLeaf: unknown;
|
|
46
60
|
}
|
|
47
61
|
/** Discriminated union for all supported proof types (W1: Eip712Signature2026 only). */
|
|
48
62
|
export type Proof = Eip712Signature2026Proof;
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,MAAM,KAAK,GAAG,KAAK,MAAM,EAAE,CAAC;AAClC,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAE7B,kCAAkC;AAClC,eAAO,MAAM,aAAa,EAAG,sCAA+C,CAAC;AAE7E,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,EAClC,iEAA0E,CAAC;AAE7E;;;GAGG;AACH,MAAM,MAAM,SAAS,GACjB,qBAAqB,GACrB,oBAAoB,GACpB,YAAY,CAAC;AAEjB;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,iBAAiB,GAAG,gBAAgB,GAAG,sBAAsB,CAAC;IAC5E,iDAAiD;IACjD,UAAU,EAAE,GAAG,CAAC;IAChB,mEAAmE;IACnE,YAAY,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,iBAAiB,EAAE,OAAO,CAAC;KAC5B,CAAC;IACF,6EAA6E;IAC7E,cAAc,CAAC,EAAE,KAAK,CAAC;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,MAAM,KAAK,GAAG,KAAK,MAAM,EAAE,CAAC;AAClC,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAE7B,kCAAkC;AAClC,eAAO,MAAM,aAAa,EAAG,sCAA+C,CAAC;AAE7E,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,EAClC,iEAA0E,CAAC;AAE7E;;;GAGG;AACH,MAAM,MAAM,SAAS,GACjB,qBAAqB,GACrB,oBAAoB,GACpB,YAAY,CAAC;AAEjB;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,iBAAiB,GAAG,gBAAgB,GAAG,sBAAsB,CAAC;IAC5E,iDAAiD;IACjD,UAAU,EAAE,GAAG,CAAC;IAChB,mEAAmE;IACnE,YAAY,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,iBAAiB,EAAE,OAAO,CAAC;KAC5B,CAAC;IACF,6EAA6E;IAC7E,cAAc,CAAC,EAAE,KAAK,CAAC;IACvB;;;6GAGyG;IACzG,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;CAC1C;AAED,yGAAyG;AACzG,MAAM,WAAW,qBAAqB;IACpC,gFAAgF;IAChF,eAAe,EAAE,OAAO,CAAC;IACzB,kFAAkF;IAClF,WAAW,EAAE,OAAO,CAAC;IACrB,qGAAqG;IACrG,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,wFAAwF;AACxF,MAAM,MAAM,KAAK,GAAG,wBAAwB,CAAC;AAE7C,+DAA+D;AAC/D,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,qBAAqB,GAAG,0BAA0B,CAAC;IACzD,aAAa,CAAC,EAAE,YAAY,GAAG,YAAY,CAAC;IAC5C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB,QAAQ,GACR,cAAc,GACd,mBAAmB,GACnB,WAAW,GACX,cAAc,CAAC;AAEnB,MAAM,WAAW,gBAAgB;IAC/B,yCAAyC;IACzC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACjD,oDAAoD;IACpD,WAAW,EAAE,cAAc,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACtG,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,kFAAkF;IAClF,IAAI,EAAE,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC;IAC7B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,uBAAuB;IACvB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,mDAAmD;IACnD,iBAAiB,EAAE,QAAQ,CAAC;IAC5B,qDAAqD;IACrD,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,qFAAqF;IACrF,gBAAgB,CAAC,EAAE;QACjB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,YAAY,GAAG,YAAY,CAAC;KACnC,CAAC;IACF,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,2CAA2C;IAC3C,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED,yEAAyE;AACzE,MAAM,MAAM,kBAAkB,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,IAAI,CACvG,oBAAoB,CAAC,QAAQ,CAAC,EAC9B,OAAO,CACR,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;CAQlB,CAAC;AAEX,eAAO,MAAM,cAAc,EAAG,qBAA8B,CAAC;AAC7D,eAAO,MAAM,iBAAiB,EAAG,GAAY,CAAC"}
|
package/dist/types.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,kCAAkC;AAClC,MAAM,CAAC,MAAM,aAAa,GAAG,sCAA+C,CAAC;AAE7E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAClC,iEAA0E,CAAC;
|
|
1
|
+
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,kCAAkC;AAClC,MAAM,CAAC,MAAM,aAAa,GAAG,sCAA+C,CAAC;AAE7E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAClC,iEAA0E,CAAC;AAwH7E;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,+BAA+B,EAAE;QAC/B,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3C,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;QAClC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE;QACrC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE;QACtC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE;KACzC;CACO,CAAC;AAEX,MAAM,CAAC,MAAM,cAAc,GAAG,qBAA8B,CAAC;AAC7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAY,CAAC"}
|
package/dist/verifier.d.ts
CHANGED
|
@@ -1,16 +1,12 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
*
|
|
9
|
-
|
|
10
|
-
* record whether a status entry was present + which list to fetch. Per
|
|
11
|
-
* ADR-0013 (no silent fallbacks) the consumer fetches the status list itself.
|
|
12
|
-
*/
|
|
13
|
-
import type { Hex32, VerifiableCredential } from './types.js';
|
|
1
|
+
import type { CredentialStatus2021, Hex32, VerifiableCredential } from './types.js';
|
|
2
|
+
/** Parsed `eip155:<chainId>:<address>` CAIP-10 reference. */
|
|
3
|
+
export interface Caip10Eip155 {
|
|
4
|
+
chainId: number;
|
|
5
|
+
address: `0x${string}`;
|
|
6
|
+
}
|
|
7
|
+
/** Parse an `eip155:<chainId>:0x…40` CAIP-10 account id, or null. Both `vc.issuer` and the
|
|
8
|
+
* `verificationMethod` prefix use this form — the VC-2 domain-binding source of truth. */
|
|
9
|
+
export declare function parseEip155Caip10(ref: string): Caip10Eip155 | null;
|
|
14
10
|
export interface VerificationResult {
|
|
15
11
|
/** Structural validity (envelope shape + canonical hash agreement). */
|
|
16
12
|
structural: boolean;
|
|
@@ -31,4 +27,82 @@ export interface VerificationResult {
|
|
|
31
27
|
* `isValidSignatureNow` (or other ERC-1271-aware path).
|
|
32
28
|
*/
|
|
33
29
|
export declare function verifyCredentialStructural(vc: VerifiableCredential): VerificationResult;
|
|
30
|
+
/** Minimal ERC-1271 verifier seam — satisfied structurally by a viem `PublicClient`
|
|
31
|
+
* (`client.verifyHash({ address, hash, signature })`). Kept structural so the package stays a
|
|
32
|
+
* graph leaf and isn't pinned to a single viem version. */
|
|
33
|
+
export interface Erc1271Verifier {
|
|
34
|
+
verifyHash(args: {
|
|
35
|
+
address: `0x${string}`;
|
|
36
|
+
hash: `0x${string}`;
|
|
37
|
+
signature: `0x${string}`;
|
|
38
|
+
}): Promise<boolean>;
|
|
39
|
+
}
|
|
40
|
+
export interface VerifyCredentialResult {
|
|
41
|
+
/** True ONLY when the structural checks pass AND the issuer SA's ERC-1271 path validates the
|
|
42
|
+
* signature over the expected digest. Fail-closed: any error/anomaly → false.
|
|
43
|
+
*
|
|
44
|
+
* VC-3 (spec 300 / ADR-0041): `valid` proves the credential was AUTHORED by whoever `vc.issuer`
|
|
45
|
+
* names — it does NOT prove that issuer has AUTHORITY over the subject. Any SA can self-sign a VC
|
|
46
|
+
* about any subject and it verifies `valid: true`. A consumer using a VC for AUTHORIZATION MUST NOT
|
|
47
|
+
* read `valid` as "trusted"; it must read `trustedForSubject` (below), which is only set when an
|
|
48
|
+
* explicit issuer→subject authority policy is supplied. `valid === issuerSigned` (kept for compat). */
|
|
49
|
+
valid: boolean;
|
|
50
|
+
/** VC-3: explicit alias for `valid` — "the named issuer signed this credential" (authorship). */
|
|
51
|
+
issuerSigned: boolean;
|
|
52
|
+
/** VC-3: the resolved issuer SA address (from `vc.issuer`), or null if it couldn't be parsed.
|
|
53
|
+
* A consumer binds authority against THIS address, not the credentialSubject's self-report. */
|
|
54
|
+
issuerAddress: `0x${string}` | null;
|
|
55
|
+
/** VC-3: whether the issuer is AUTHORIZED over the subject — the confused-deputy gate. Only present
|
|
56
|
+
* when `opts.authorityPolicy` is supplied; the generic verifier cannot decide it on its own (this
|
|
57
|
+
* package is a leaf and issuer→subject authority is app/registry policy). `undefined` means "not
|
|
58
|
+
* evaluated — the caller did not assert an authority model", which an authorization consumer MUST
|
|
59
|
+
* treat as untrusted. */
|
|
60
|
+
trustedForSubject?: boolean;
|
|
61
|
+
/** The structural sub-result (digest, proof value, issuer ref, issues). */
|
|
62
|
+
structuralResult: VerificationResult;
|
|
63
|
+
/** All issues — structural plus signature/verification failures. */
|
|
64
|
+
issues: string[];
|
|
65
|
+
}
|
|
66
|
+
/** VC-3: consumer-supplied issuer→subject authority policy. Given the verified issuer SA and the
|
|
67
|
+
* credential, decide whether that issuer is AUTHORIZED to make claims about the subject (e.g. issuer
|
|
68
|
+
* == subject principal, issuer is on-chain-delegated by the subject, or issuer is a registry-approved
|
|
69
|
+
* authority for this credential type). Returning false (or throwing) leaves `trustedForSubject` false. */
|
|
70
|
+
export interface CredentialAuthorityPolicy {
|
|
71
|
+
(args: {
|
|
72
|
+
issuer: `0x${string}`;
|
|
73
|
+
vc: VerifiableCredential;
|
|
74
|
+
}): Promise<boolean> | boolean;
|
|
75
|
+
}
|
|
76
|
+
/**
|
|
77
|
+
* Full credential verification (VC-1): structural checks PLUS the on-chain ERC-1271 round-trip
|
|
78
|
+
* against the issuer SA resolved from `vc.issuer`. This is the function consumers (content
|
|
79
|
+
* entitlements, agent-skills, geo-features, related-agents) MUST gate on — `verifyCredentialStructural`
|
|
80
|
+
* alone proves nothing about the signature.
|
|
81
|
+
*
|
|
82
|
+
* Fail-closed per ADR-0013: a structural failure, an unresolvable issuer, a verification-call error,
|
|
83
|
+
* or a non-validating signature all return `valid: false` — never a silent accept.
|
|
84
|
+
*/
|
|
85
|
+
/** Resolve + check a credential's revocation/suspension status (NEW-VC-1). Returns `revoked: true` to
|
|
86
|
+
* fail the verification. Injected so the package stays a leaf (the StatusList2021 fetch is the
|
|
87
|
+
* consumer's effect). */
|
|
88
|
+
export interface CredentialStatusResolver {
|
|
89
|
+
(status: CredentialStatus2021): Promise<{
|
|
90
|
+
revoked: boolean;
|
|
91
|
+
}>;
|
|
92
|
+
}
|
|
93
|
+
export interface VerifyCredentialOpts {
|
|
94
|
+
/** NEW-VC-1: when the VC carries a `credentialStatus`, this resolver checks revocation/suspension.
|
|
95
|
+
* REQUIRED for any status-bearing credential unless `allowUnresolvedStatus` is set — otherwise a
|
|
96
|
+
* REVOKED credential would verify valid (the verifier can confirm the signature but not the status). */
|
|
97
|
+
verifyStatus?: CredentialStatusResolver;
|
|
98
|
+
/** NEW-VC-1 opt-out: accept a status-bearing credential WITHOUT resolving its status. Use ONLY where
|
|
99
|
+
* revocation genuinely doesn't matter; otherwise omitting the resolver fails closed (ADR-0013). */
|
|
100
|
+
allowUnresolvedStatus?: boolean;
|
|
101
|
+
/** VC-3: issuer→subject authority policy. When supplied, the verifier evaluates it (only after the
|
|
102
|
+
* signature + status checks pass) and reports the result as `trustedForSubject`. When omitted,
|
|
103
|
+
* `trustedForSubject` is left `undefined` — the verifier makes no authority claim, and an
|
|
104
|
+
* authorization consumer MUST treat that as untrusted. Never inferred; never defaulted to true. */
|
|
105
|
+
authorityPolicy?: CredentialAuthorityPolicy;
|
|
106
|
+
}
|
|
107
|
+
export declare function verifyCredential(vc: VerifiableCredential, client: Erc1271Verifier, opts?: VerifyCredentialOpts): Promise<VerifyCredentialResult>;
|
|
34
108
|
//# sourceMappingURL=verifier.d.ts.map
|
package/dist/verifier.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../src/verifier.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../src/verifier.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EACV,oBAAoB,EAEpB,KAAK,EAEL,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAEpB,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;CACxB;AAED;2FAC2F;AAC3F,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAOlE;AAED,MAAM,WAAW,kBAAkB;IACjC,uEAAuE;IACvE,UAAU,EAAE,OAAO,CAAC;IACpB,8DAA8D;IAC9D,cAAc,EAAE,KAAK,GAAG,IAAI,CAAC;IAC7B,sEAAsE;IACtE,UAAU,EAAE,KAAK,MAAM,EAAE,GAAG,IAAI,CAAC;IACjC,2EAA2E;IAC3E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,wEAAwE;IACxE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,0FAA0F;IAC1F,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,oBAAoB,GAAG,kBAAkB,CA+HvF;AAcD;;4DAE4D;AAC5D,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,IAAI,EAAE;QACf,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;QACvB,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;QACpB,SAAS,EAAE,KAAK,MAAM,EAAE,CAAC;KAC1B,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;;;;4GAOwG;IACxG,KAAK,EAAE,OAAO,CAAC;IACf,iGAAiG;IACjG,YAAY,EAAE,OAAO,CAAC;IACtB;oGACgG;IAChG,aAAa,EAAE,KAAK,MAAM,EAAE,GAAG,IAAI,CAAC;IACpC;;;;8BAI0B;IAC1B,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,2EAA2E;IAC3E,gBAAgB,EAAE,kBAAkB,CAAC;IACrC,oEAAoE;IACpE,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;2GAG2G;AAC3G,MAAM,WAAW,yBAAyB;IACxC,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,KAAK,MAAM,EAAE,CAAC;QAAC,EAAE,EAAE,oBAAoB,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACzF;AAED;;;;;;;;GAQG;AACH;;0BAE0B;AAC1B,MAAM,WAAW,wBAAwB;IACvC,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,oBAAoB;IACnC;;6GAEyG;IACzG,YAAY,CAAC,EAAE,wBAAwB,CAAC;IACxC;wGACoG;IACpG,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;wGAGoG;IACpG,eAAe,CAAC,EAAE,yBAAyB,CAAC;CAC7C;AAED,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,oBAAoB,EACxB,MAAM,EAAE,eAAe,EACvB,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAAC,sBAAsB,CAAC,CAuEjC"}
|
package/dist/verifier.js
CHANGED
|
@@ -1,16 +1,30 @@
|
|
|
1
|
+
import { isEvmCaip10, parseCaip10Parts } from '@agenticprimitives/types';
|
|
1
2
|
/**
|
|
2
|
-
* Verifier — checks that a VC's proof is valid.
|
|
3
|
+
* Verifier — checks that a VC's proof is valid (findings VC-1 / VC-2, closed).
|
|
3
4
|
*
|
|
4
|
-
*
|
|
5
|
-
*
|
|
6
|
-
*
|
|
7
|
-
*
|
|
5
|
+
* `verifyCredential(vc, publicClient)` performs the ERC-1271 round-trip against
|
|
6
|
+
* the issuer SA on chain and FAILS CLOSED — `credentialHash` is mandatory, and
|
|
7
|
+
* the EIP-712 digest pins `verifyingContract` to the issuer SA + binds `chainId`,
|
|
8
|
+
* so an attacker can't substitute a different verifying domain. The structural
|
|
9
|
+
* helpers remain for callers that only need shape validation, but the authority
|
|
10
|
+
* check is `verifyCredential`; there is no fallback path (ADR-0013).
|
|
8
11
|
*
|
|
9
|
-
* Status-list resolution (StatusList2021)
|
|
10
|
-
*
|
|
11
|
-
* ADR-0013
|
|
12
|
+
* Status-list resolution (StatusList2021): the verifier records whether a status
|
|
13
|
+
* entry was present + which list to fetch; the consumer fetches it (no silent
|
|
14
|
+
* fallback, ADR-0013).
|
|
12
15
|
*/
|
|
13
16
|
import { credentialHash, eip712Digest, isoToSeconds } from './proof.js';
|
|
17
|
+
/** Parse an `eip155:<chainId>:0x…40` CAIP-10 account id, or null. Both `vc.issuer` and the
|
|
18
|
+
* `verificationMethod` prefix use this form — the VC-2 domain-binding source of truth. */
|
|
19
|
+
export function parseEip155Caip10(ref) {
|
|
20
|
+
// Parsed via the shared grammar rather than a local regex. Note the parts are
|
|
21
|
+
// (namespace, reference, address) — NOT (chainId, address); reading them positionally is how the
|
|
22
|
+
// first version of this edit produced `{ chainId: NaN, address: '8453' }`.
|
|
23
|
+
if (!isEvmCaip10(ref))
|
|
24
|
+
return null;
|
|
25
|
+
const p = parseCaip10Parts(ref);
|
|
26
|
+
return { chainId: Number(p.reference), address: p.address };
|
|
27
|
+
}
|
|
14
28
|
/**
|
|
15
29
|
* Structural verification — does NOT make a network call. Returns the
|
|
16
30
|
* expected digest + proof value the caller MUST forward to the issuer SA's
|
|
@@ -30,10 +44,24 @@ export function verifyCredentialStructural(vc) {
|
|
|
30
44
|
issues.push('missing validFrom');
|
|
31
45
|
if (!vc.credentialSubject)
|
|
32
46
|
issues.push('missing credentialSubject');
|
|
47
|
+
const now = Math.floor(Date.now() / 1000);
|
|
48
|
+
// NEW-VC-2: enforce validFrom — a not-yet-active credential must NOT verify valid (the verifier
|
|
49
|
+
// previously gated only validUntil). NaN-safe: an unparseable validFrom fails closed.
|
|
50
|
+
if (vc.validFrom) {
|
|
51
|
+
const from = isoToSeconds(vc.validFrom);
|
|
52
|
+
if (!Number.isFinite(from)) {
|
|
53
|
+
issues.push(`validFrom is not a parseable date: ${vc.validFrom}`);
|
|
54
|
+
}
|
|
55
|
+
else if (from > now) {
|
|
56
|
+
issues.push(`credential not yet active (validFrom ${vc.validFrom})`);
|
|
57
|
+
}
|
|
58
|
+
}
|
|
33
59
|
if (vc.validUntil) {
|
|
34
60
|
const until = isoToSeconds(vc.validUntil);
|
|
35
|
-
|
|
36
|
-
|
|
61
|
+
if (!Number.isFinite(until)) {
|
|
62
|
+
issues.push(`validUntil is not a parseable date: ${vc.validUntil}`);
|
|
63
|
+
}
|
|
64
|
+
else if (until < now) {
|
|
37
65
|
issues.push(`credential expired at ${vc.validUntil}`);
|
|
38
66
|
}
|
|
39
67
|
}
|
|
@@ -71,9 +99,34 @@ export function verifyCredentialStructural(vc) {
|
|
|
71
99
|
};
|
|
72
100
|
}
|
|
73
101
|
const bodyHash = credentialHash(vc);
|
|
74
|
-
|
|
102
|
+
// VC-1: `credentialHash` is MANDATORY — a forger must not be able to drop it to skip the
|
|
103
|
+
// body-integrity check. Missing OR mismatched is a structural failure.
|
|
104
|
+
if (!proof.credentialHash) {
|
|
105
|
+
issues.push('proof.credentialHash is required (binds the proof to the canonical credential body)');
|
|
106
|
+
}
|
|
107
|
+
else if (proof.credentialHash !== bodyHash) {
|
|
75
108
|
issues.push(`proof.credentialHash (${proof.credentialHash}) does not match canonical hash of credential body (${bodyHash})`);
|
|
76
109
|
}
|
|
110
|
+
// VC-2: the EIP-712 domain is attacker-supplied inside the proof. Bind it to the credential's
|
|
111
|
+
// declared `issuer` SA — the digest is meaningless if it can be computed against a contract /
|
|
112
|
+
// chain the attacker controls. `verifyingContract` MUST equal the issuer SA, `chainId` MUST equal
|
|
113
|
+
// the issuer's chain, and the `verificationMethod` address MUST resolve to the same SA.
|
|
114
|
+
const issuerAcct = parseEip155Caip10(vc.issuer);
|
|
115
|
+
if (!issuerAcct) {
|
|
116
|
+
issues.push(`vc.issuer is not a verifiable eip155 CAIP-10 account id: ${vc.issuer}`);
|
|
117
|
+
}
|
|
118
|
+
else {
|
|
119
|
+
if (proof.eip712Domain.verifyingContract.toLowerCase() !== issuerAcct.address.toLowerCase()) {
|
|
120
|
+
issues.push(`proof.eip712Domain.verifyingContract (${proof.eip712Domain.verifyingContract}) MUST equal the issuer SA (${issuerAcct.address})`);
|
|
121
|
+
}
|
|
122
|
+
if (proof.eip712Domain.chainId !== issuerAcct.chainId) {
|
|
123
|
+
issues.push(`proof.eip712Domain.chainId (${proof.eip712Domain.chainId}) MUST equal the issuer chainId (${issuerAcct.chainId})`);
|
|
124
|
+
}
|
|
125
|
+
const vmAcct = parseEip155Caip10(proof.verificationMethod.split('#')[0] ?? '');
|
|
126
|
+
if (!vmAcct || vmAcct.address.toLowerCase() !== issuerAcct.address.toLowerCase()) {
|
|
127
|
+
issues.push(`proof.verificationMethod (${proof.verificationMethod}) MUST resolve to the issuer SA (${issuerAcct.address})`);
|
|
128
|
+
}
|
|
129
|
+
}
|
|
77
130
|
const expectedDigest = eip712Digest({
|
|
78
131
|
credentialBodyHash: bodyHash,
|
|
79
132
|
issuer: vc.issuer,
|
|
@@ -99,9 +152,80 @@ function parseCaip10IssuerFromVerificationMethod(method) {
|
|
|
99
152
|
if (hashIdx === -1)
|
|
100
153
|
return null;
|
|
101
154
|
const ref = method.slice(0, hashIdx);
|
|
102
|
-
//
|
|
103
|
-
|
|
155
|
+
// Was `0x[0-9a-fA-F]+` — NO length bound — while `parseEip155Caip10` above, in this same file,
|
|
156
|
+
// required 40 hex. Two patterns for one concept, disagreeing about whether `eip155:1:0x1` is a
|
|
157
|
+
// valid verification method. It is not.
|
|
158
|
+
if (!isEvmCaip10(ref))
|
|
104
159
|
return null;
|
|
105
160
|
return ref;
|
|
106
161
|
}
|
|
162
|
+
export async function verifyCredential(vc, client, opts = {}) {
|
|
163
|
+
const structuralResult = verifyCredentialStructural(vc);
|
|
164
|
+
const issues = [...structuralResult.issues];
|
|
165
|
+
if (!structuralResult.structural || !structuralResult.expectedDigest || !structuralResult.proofValue) {
|
|
166
|
+
return { valid: false, issuerSigned: false, issuerAddress: null, structuralResult, issues };
|
|
167
|
+
}
|
|
168
|
+
const issuerAcct = parseEip155Caip10(vc.issuer);
|
|
169
|
+
if (!issuerAcct) {
|
|
170
|
+
issues.push('cannot resolve issuer SA for ERC-1271 verification');
|
|
171
|
+
return { valid: false, issuerSigned: false, issuerAddress: null, structuralResult, issues };
|
|
172
|
+
}
|
|
173
|
+
const issuerAddress = issuerAcct.address;
|
|
174
|
+
let ok;
|
|
175
|
+
try {
|
|
176
|
+
ok = await client.verifyHash({
|
|
177
|
+
address: issuerAcct.address,
|
|
178
|
+
hash: structuralResult.expectedDigest,
|
|
179
|
+
signature: structuralResult.proofValue,
|
|
180
|
+
});
|
|
181
|
+
}
|
|
182
|
+
catch (e) {
|
|
183
|
+
issues.push(`ERC-1271 verification call failed: ${e instanceof Error ? e.message : String(e)}`);
|
|
184
|
+
return { valid: false, issuerSigned: false, issuerAddress, structuralResult, issues };
|
|
185
|
+
}
|
|
186
|
+
if (!ok) {
|
|
187
|
+
issues.push('issuer ERC-1271 signature did not validate over the expected digest');
|
|
188
|
+
return { valid: false, issuerSigned: false, issuerAddress, structuralResult, issues };
|
|
189
|
+
}
|
|
190
|
+
// NEW-VC-1: a valid signature proves authorship, NOT current validity. If the VC declares a
|
|
191
|
+
// credentialStatus, confirm it is not revoked/suspended — fail closed when it can't be resolved.
|
|
192
|
+
if (vc.credentialStatus) {
|
|
193
|
+
if (opts.verifyStatus) {
|
|
194
|
+
let status;
|
|
195
|
+
try {
|
|
196
|
+
status = await opts.verifyStatus(vc.credentialStatus);
|
|
197
|
+
}
|
|
198
|
+
catch (e) {
|
|
199
|
+
issues.push(`credentialStatus resolution failed: ${e instanceof Error ? e.message : String(e)}`);
|
|
200
|
+
return { valid: false, issuerSigned: true, issuerAddress, structuralResult, issues };
|
|
201
|
+
}
|
|
202
|
+
if (status.revoked) {
|
|
203
|
+
issues.push('credential is revoked/suspended per its credentialStatus');
|
|
204
|
+
return { valid: false, issuerSigned: false, issuerAddress, structuralResult, issues };
|
|
205
|
+
}
|
|
206
|
+
}
|
|
207
|
+
else if (!opts.allowUnresolvedStatus) {
|
|
208
|
+
issues.push('credentialStatus present but no status resolver injected — cannot confirm the credential is not revoked (fail-closed; pass allowUnresolvedStatus to override)');
|
|
209
|
+
return { valid: false, issuerSigned: false, issuerAddress, structuralResult, issues };
|
|
210
|
+
}
|
|
211
|
+
}
|
|
212
|
+
// VC-3: signature + status prove AUTHORSHIP. Authority over the subject is a separate question the
|
|
213
|
+
// generic verifier cannot answer — evaluate the consumer's authority policy if (and only if) one was
|
|
214
|
+
// supplied. `trustedForSubject` stays undefined otherwise, and an authorization consumer treats that
|
|
215
|
+
// as untrusted. A throwing/false policy → not trusted (fail-closed), but authorship still holds.
|
|
216
|
+
let trustedForSubject;
|
|
217
|
+
if (opts.authorityPolicy) {
|
|
218
|
+
try {
|
|
219
|
+
trustedForSubject = (await opts.authorityPolicy({ issuer: issuerAddress, vc })) === true;
|
|
220
|
+
}
|
|
221
|
+
catch (e) {
|
|
222
|
+
trustedForSubject = false;
|
|
223
|
+
issues.push(`authorityPolicy threw — issuer NOT trusted for subject: ${e instanceof Error ? e.message : String(e)}`);
|
|
224
|
+
}
|
|
225
|
+
if (!trustedForSubject) {
|
|
226
|
+
issues.push('issuer signed the credential but is NOT authorized over the subject (authorityPolicy)');
|
|
227
|
+
}
|
|
228
|
+
}
|
|
229
|
+
return { valid: true, issuerSigned: true, issuerAddress, trustedForSubject, structuralResult, issues };
|
|
230
|
+
}
|
|
107
231
|
//# sourceMappingURL=verifier.js.map
|
package/dist/verifier.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../src/verifier.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../src/verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACzE;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAexE;2FAC2F;AAC3F,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,8EAA8E;IAC9E,iGAAiG;IACjG,2EAA2E;IAC3E,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAE,CAAC;IACjC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAwB,EAAE,CAAC;AAC/E,CAAC;AAiBD;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,EAAwB;IACjE,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,sBAAsB,EAAE,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9C,IAAI,CAAC,EAAE,CAAC,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE,CAAC,iBAAiB;QAAE,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAEpE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,gGAAgG;IAChG,sFAAsF;IACtF,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACpE,CAAC;aAAM,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QACtE,CAAC;aAAM,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QACd,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,EAAE,CAAC,gBAAgB,EAAE,oBAAoB,IAAI,IAAI;YAC/D,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,eAAe,CAAC;SACrC,CAAC;IACJ,CAAC;IAED,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,2BAA4B,EAAE,CAAC,KAAe,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,EAAE,CAAC,gBAAgB,EAAE,oBAAoB,IAAI,IAAI;YAC/D,MAAM;SACP,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,EAAE,CAAC,KAAiC,CAAC;IAEnD,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;QAChG,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,EAAE,CAAC,gBAAgB,EAAE,oBAAoB,IAAI,IAAI;YAC/D,MAAM;SACP,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;IACpC,yFAAyF;IACzF,uEAAuE;IACvE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;IACrG,CAAC;SAAM,IAAI,KAAK,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CACT,yBAAyB,KAAK,CAAC,cAAc,uDAAuD,QAAQ,GAAG,CAChH,CAAC;IACJ,CAAC;IAED,8FAA8F;IAC9F,8FAA8F;IAC9F,kGAAkG;IAClG,wFAAwF;IACxF,MAAM,UAAU,GAAG,iBAAiB,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,4DAA4D,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IACvF,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,CAAC,YAAY,CAAC,iBAAiB,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5F,MAAM,CAAC,IAAI,CACT,yCAAyC,KAAK,CAAC,YAAY,CAAC,iBAAiB,+BAA+B,UAAU,CAAC,OAAO,GAAG,CAClI,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,YAAY,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;YACtD,MAAM,CAAC,IAAI,CACT,+BAA+B,KAAK,CAAC,YAAY,CAAC,OAAO,oCAAoC,UAAU,CAAC,OAAO,GAAG,CACnH,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;YACjF,MAAM,CAAC,IAAI,CACT,6BAA6B,KAAK,CAAC,kBAAkB,oCAAoC,UAAU,CAAC,OAAO,GAAG,CAC/G,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,YAAY,CAAC;QAClC,kBAAkB,EAAE,QAAQ;QAC5B,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC,SAAS,CAAC;QACrC,UAAU,EAAE,YAAY,CAAC,EAAE,CAAC,UAAU,CAAC;QACvC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,OAAO;QACnC,iBAAiB,EAAE,KAAK,CAAC,YAAY,CAAC,iBAAiB;KACxD,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,uCAAuC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAEvF,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC/B,cAAc;QACd,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY;QACZ,YAAY,EAAE,EAAE,CAAC,gBAAgB,EAAE,oBAAoB,IAAI,IAAI;QAC/D,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,uCAAuC,CAAC,MAAc;IAC7D,iDAAiD;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACrC,+FAA+F;IAC/F,+FAA+F;IAC/F,wCAAwC;IACxC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,GAAG,CAAC;AACb,CAAC;AA+ED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAwB,EACxB,MAAuB,EACvB,OAA6B,EAAE;IAE/B,MAAM,gBAAgB,GAAG,0BAA0B,CAAC,EAAE,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,gBAAgB,CAAC,UAAU,IAAI,CAAC,gBAAgB,CAAC,cAAc,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC;QACrG,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC9F,CAAC;IACD,MAAM,UAAU,GAAG,iBAAiB,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC9F,CAAC;IACD,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,CAAC;IACzC,IAAI,EAAW,CAAC;IAChB,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC;YAC3B,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,IAAI,EAAE,gBAAgB,CAAC,cAAc;YACrC,SAAS,EAAE,gBAAgB,CAAC,UAAU;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChG,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;QACnF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IACxF,CAAC;IAED,4FAA4F;IAC5F,iGAAiG;IACjG,IAAI,EAAE,CAAC,gBAAgB,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,MAA4B,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACjG,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;YACvF,CAAC;YACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;gBACxE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;YACxF,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CACT,+JAA+J,CAChK,CAAC;YACF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;QACxF,CAAC;IACH,CAAC;IAED,mGAAmG;IACnG,qGAAqG;IACrG,qGAAqG;IACrG,iGAAiG;IACjG,IAAI,iBAAsC,CAAC;IAC3C,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,iBAAiB,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;QAC3F,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,iBAAiB,GAAG,KAAK,CAAC;YAC1B,MAAM,CAAC,IAAI,CACT,2DAA2D,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACxG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,uFAAuF,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;AACzG,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@agenticprimitives/verifiable-credentials",
|
|
3
|
-
"version": "0.0.0-alpha.
|
|
3
|
+
"version": "0.0.0-alpha.21",
|
|
4
4
|
"description": "W3C Verifiable Credentials envelope + Eip712Signature2026 proof + DOLCE+DnS Situation bases + ontology-shape schema registration. Substrate for layers 12–15 credential types.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"repository": {
|
|
@@ -32,11 +32,12 @@
|
|
|
32
32
|
},
|
|
33
33
|
"peerDependencies": {
|
|
34
34
|
"viem": "^2.52.2",
|
|
35
|
-
"@agenticprimitives/types": "1.0.0-alpha.
|
|
36
|
-
"@agenticprimitives/ontology": "1.0.0-alpha.
|
|
35
|
+
"@agenticprimitives/types": "1.0.0-alpha.24",
|
|
36
|
+
"@agenticprimitives/ontology": "1.0.0-alpha.24"
|
|
37
37
|
},
|
|
38
38
|
"dependencies": {
|
|
39
|
-
"@noble/hashes": "^2.2.0"
|
|
39
|
+
"@noble/hashes": "^2.2.0",
|
|
40
|
+
"@agenticprimitives/situations": "0.0.0-alpha.8"
|
|
40
41
|
},
|
|
41
42
|
"devDependencies": {
|
|
42
43
|
"vitest": "^4.1.8",
|
|
@@ -50,7 +51,7 @@
|
|
|
50
51
|
"scripts": {
|
|
51
52
|
"build": "tsc -p tsconfig.build.json",
|
|
52
53
|
"typecheck": "tsc -p tsconfig.json --noEmit",
|
|
53
|
-
"test": "vitest run
|
|
54
|
+
"test": "vitest run",
|
|
54
55
|
"test:unit": "vitest run test/unit --passWithNoTests",
|
|
55
56
|
"test:watch": "vitest",
|
|
56
57
|
"clean": "rm -rf dist"
|