@agenticprimitives/verifiable-credentials 0.0.0-alpha.3 → 0.0.0-alpha.31
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +2 -0
- package/dist/canonical.d.ts +2 -9
- package/dist/canonical.d.ts.map +1 -1
- package/dist/canonical.js +5 -107
- package/dist/canonical.js.map +1 -1
- package/dist/index.d.ts +5 -4
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +2 -1
- package/dist/index.js.map +1 -1
- package/dist/proof.d.ts +31 -0
- package/dist/proof.d.ts.map +1 -1
- package/dist/proof.js +29 -7
- package/dist/proof.js.map +1 -1
- package/dist/situation.d.ts +6 -0
- package/dist/situation.d.ts.map +1 -1
- package/dist/situation.js +7 -0
- package/dist/situation.js.map +1 -1
- package/dist/types.d.ts +14 -0
- package/dist/types.d.ts.map +1 -1
- package/dist/types.js.map +1 -1
- package/dist/verifier.d.ts +52 -17
- package/dist/verifier.d.ts.map +1 -1
- package/dist/verifier.js +75 -22
- package/dist/verifier.js.map +1 -1
- package/package.json +31 -21
package/LICENSE
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2026 Agentic Trust Labs
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
package/README.md
CHANGED
|
@@ -1,5 +1,7 @@
|
|
|
1
1
|
# @agenticprimitives/verifiable-credentials
|
|
2
2
|
|
|
3
|
+
> Part of **[Agentic Primitives](https://agenticprimitives.dev)** — the open-source trust substrate for agentic applications: identity that can sign, authority checked at act time, evidence the owner carries. [Developer kit](https://github.com/agentictrustlabs/agentic-primitives) · [All packages](https://agenticprimitives.dev/developers)
|
|
4
|
+
|
|
3
5
|
**A credential is only as durable as the identity it points at.** Most verifiable-credential stacks bind claims to a key — and when the key rotates, the trust graph quietly breaks. Here the issuer and subject of every credential is a Smart Agent address: a persistent ERC-4337 account whose keys are replaceable facets. Rotate a passkey, recover from a lost device, swap a signer — the address persists, and every credential issued by or about it stays verifiable.
|
|
4
6
|
|
|
5
7
|
This package is the W3C VC 2.0 envelope for that model: an `Eip712Signature2026` proof signed by a smart account and verified with an ERC-1271 round-trip against the chain, plus the RFC 8785 (JCS) canonical hash that every downstream registry stores as the on-chain anchor. It is the substrate layer — specific credential types (associations, agreements, evidence, outcomes, receipts) are composed on top by consumer packages.
|
package/dist/canonical.d.ts
CHANGED
|
@@ -17,15 +17,8 @@
|
|
|
17
17
|
* subset of JSON (string / number / boolean / null / object / array). We do not
|
|
18
18
|
* handle BigInt or Date — callers must serialise those upstream.
|
|
19
19
|
*/
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
constructor(message: string, path: string);
|
|
23
|
-
}
|
|
24
|
-
/**
|
|
25
|
-
* Canonicalize a JSON-compatible value per RFC 8785.
|
|
26
|
-
* Returns the canonical string (UTF-8 text; callers wrap with `utf8ToBytes` to hash).
|
|
27
|
-
*/
|
|
28
|
-
export declare function jcsCanonicalize(value: unknown, path?: string): string;
|
|
20
|
+
import { JcsError, jcsCanonicalize } from '@agenticprimitives/types';
|
|
21
|
+
export { JcsError, jcsCanonicalize };
|
|
29
22
|
/**
|
|
30
23
|
* Compute the canonical hash of a value: `keccak256(jcsCanonicalize(value))`.
|
|
31
24
|
* Returns the 32-byte hex hash.
|
package/dist/canonical.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../src/canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;
|
|
1
|
+
{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../src/canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;AAKrC;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,MAAM,EAAE,CAK3D"}
|
package/dist/canonical.js
CHANGED
|
@@ -19,113 +19,11 @@
|
|
|
19
19
|
*/
|
|
20
20
|
import { keccak_256 } from '@noble/hashes/sha3.js';
|
|
21
21
|
import { utf8ToBytes } from '@noble/hashes/utils.js';
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
}
|
|
28
|
-
}
|
|
29
|
-
/**
|
|
30
|
-
* Canonicalize a JSON-compatible value per RFC 8785.
|
|
31
|
-
* Returns the canonical string (UTF-8 text; callers wrap with `utf8ToBytes` to hash).
|
|
32
|
-
*/
|
|
33
|
-
export function jcsCanonicalize(value, path = '$') {
|
|
34
|
-
if (value === null)
|
|
35
|
-
return 'null';
|
|
36
|
-
if (value === undefined) {
|
|
37
|
-
throw new JcsError('undefined is not JSON', path);
|
|
38
|
-
}
|
|
39
|
-
switch (typeof value) {
|
|
40
|
-
case 'boolean':
|
|
41
|
-
return value ? 'true' : 'false';
|
|
42
|
-
case 'string':
|
|
43
|
-
return serializeString(value);
|
|
44
|
-
case 'number':
|
|
45
|
-
return serializeNumber(value, path);
|
|
46
|
-
case 'object': {
|
|
47
|
-
if (Array.isArray(value)) {
|
|
48
|
-
const items = value.map((v, i) => jcsCanonicalize(v, `${path}[${i}]`));
|
|
49
|
-
return `[${items.join(',')}]`;
|
|
50
|
-
}
|
|
51
|
-
// Plain object
|
|
52
|
-
const entries = Object.entries(value)
|
|
53
|
-
.filter(([, v]) => v !== undefined)
|
|
54
|
-
.sort(([a], [b]) => sortByCodeUnit(a, b));
|
|
55
|
-
const items = entries.map(([k, v]) => `${serializeString(k)}:${jcsCanonicalize(v, `${path}.${k}`)}`);
|
|
56
|
-
return `{${items.join(',')}}`;
|
|
57
|
-
}
|
|
58
|
-
default:
|
|
59
|
-
throw new JcsError(`unsupported JSON type: ${typeof value}`, path);
|
|
60
|
-
}
|
|
61
|
-
}
|
|
62
|
-
/** UTF-16 code unit comparison — exactly what RFC 8785 §3.2.3 requires. */
|
|
63
|
-
function sortByCodeUnit(a, b) {
|
|
64
|
-
const len = Math.min(a.length, b.length);
|
|
65
|
-
for (let i = 0; i < len; i++) {
|
|
66
|
-
const av = a.charCodeAt(i);
|
|
67
|
-
const bv = b.charCodeAt(i);
|
|
68
|
-
if (av !== bv)
|
|
69
|
-
return av - bv;
|
|
70
|
-
}
|
|
71
|
-
return a.length - b.length;
|
|
72
|
-
}
|
|
73
|
-
/** RFC 8259 string serialisation with JCS-compatible escaping (RFC 8785 §3.2.2.2). */
|
|
74
|
-
function serializeString(s) {
|
|
75
|
-
let out = '"';
|
|
76
|
-
for (let i = 0; i < s.length; i++) {
|
|
77
|
-
const code = s.charCodeAt(i);
|
|
78
|
-
if (code === 0x22) {
|
|
79
|
-
out += '\\"';
|
|
80
|
-
}
|
|
81
|
-
else if (code === 0x5c) {
|
|
82
|
-
out += '\\\\';
|
|
83
|
-
}
|
|
84
|
-
else if (code < 0x20) {
|
|
85
|
-
// Control characters
|
|
86
|
-
switch (code) {
|
|
87
|
-
case 0x08:
|
|
88
|
-
out += '\\b';
|
|
89
|
-
break;
|
|
90
|
-
case 0x09:
|
|
91
|
-
out += '\\t';
|
|
92
|
-
break;
|
|
93
|
-
case 0x0a:
|
|
94
|
-
out += '\\n';
|
|
95
|
-
break;
|
|
96
|
-
case 0x0c:
|
|
97
|
-
out += '\\f';
|
|
98
|
-
break;
|
|
99
|
-
case 0x0d:
|
|
100
|
-
out += '\\r';
|
|
101
|
-
break;
|
|
102
|
-
default:
|
|
103
|
-
out += `\\u${code.toString(16).padStart(4, '0')}`;
|
|
104
|
-
}
|
|
105
|
-
}
|
|
106
|
-
else {
|
|
107
|
-
out += s[i];
|
|
108
|
-
}
|
|
109
|
-
}
|
|
110
|
-
out += '"';
|
|
111
|
-
return out;
|
|
112
|
-
}
|
|
113
|
-
/** RFC 8785 §3.2.2.3 — shortest round-tripping IEEE 754 representation. */
|
|
114
|
-
function serializeNumber(n, path) {
|
|
115
|
-
if (!Number.isFinite(n)) {
|
|
116
|
-
throw new JcsError(`non-finite number (${n})`, path);
|
|
117
|
-
}
|
|
118
|
-
if (Object.is(n, -0))
|
|
119
|
-
return '0';
|
|
120
|
-
if (n === 0)
|
|
121
|
-
return '0';
|
|
122
|
-
if (Number.isInteger(n) && Math.abs(n) < 1e21) {
|
|
123
|
-
return n.toString();
|
|
124
|
-
}
|
|
125
|
-
// Browsers + Node give us the shortest round-trip via `toString()`
|
|
126
|
-
// (per ECMA-262 §6.1.6.1.13). RFC 8785 expects the ES round-trip form.
|
|
127
|
-
return n.toString();
|
|
128
|
-
}
|
|
22
|
+
// RFC 8785 JCS lives in `@agenticprimitives/types` — ONE implementation. It was byte-identical here
|
|
23
|
+
// and in the sibling package, and neither could import the other (the edge is a cycle). Imported for
|
|
24
|
+
// local use AND re-exported, so consumers of this package are unaffected.
|
|
25
|
+
import { JcsError, jcsCanonicalize } from '@agenticprimitives/types';
|
|
26
|
+
export { JcsError, jcsCanonicalize };
|
|
129
27
|
/**
|
|
130
28
|
* Compute the canonical hash of a value: `keccak256(jcsCanonicalize(value))`.
|
|
131
29
|
* Returns the 32-byte hex hash.
|
package/dist/canonical.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../src/canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,
|
|
1
|
+
{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../src/canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,oGAAoG;AACpG,qGAAqG;AACrG,0EAA0E;AAC1E,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;AAKrC;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,KAAK,UAAU,CAAC,MAAM,CAAC,EAAmB,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,CAAa;IAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAClB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -12,13 +12,14 @@ export declare const PACKAGE_NAME = "@agenticprimitives/verifiable-credentials";
|
|
|
12
12
|
export declare const PACKAGE_STATUS: "w1-foundational";
|
|
13
13
|
export declare const SPEC_REF = "specs/242-trust-credentials-and-public-assertions.md";
|
|
14
14
|
export { VC_CONTEXT_V2, EIP712_SIG_2026_CONTEXT, VC_DOMAIN_NAME, VC_DOMAIN_VERSION, VC_EIP712_TYPES, } from './types.js';
|
|
15
|
-
export type { Hex32, ISODate, ProofType, Eip712Signature2026Proof, Proof, CredentialStatus2021, VisibilityTier, DisclosurePolicy, VerifiableCredential, UnsignedCredential, } from './types.js';
|
|
15
|
+
export type { Hex32, ISODate, ProofType, Eip712Signature2026Proof, DelegatingSignerProof, Proof, CredentialStatus2021, VisibilityTier, DisclosurePolicy, VerifiableCredential, UnsignedCredential, } from './types.js';
|
|
16
16
|
export { jcsCanonicalize, canonicalHash, JcsError } from './canonical.js';
|
|
17
17
|
export { assertSituationRolesPresent, buildSituation, } from './situation.js';
|
|
18
18
|
export type { Situation, DescriptionRef, RoleName } from './situation.js';
|
|
19
|
-
export { credentialHash, eip712Digest, isoToSeconds, signCredential, viemSignerFromWallet, } from './proof.js';
|
|
20
|
-
export type { CredentialSigner } from './proof.js';
|
|
19
|
+
export { credentialHash, eip712Digest, isoToSeconds, signCredential, viemSignerFromWallet, kmsCredentialSigner, } from './proof.js';
|
|
20
|
+
export type { CredentialSigner, KmsSigningBackend } from './proof.js';
|
|
21
21
|
export { verifyCredential, verifyCredentialStructural, parseEip155Caip10 } from './verifier.js';
|
|
22
|
-
export type { VerificationResult, VerifyCredentialResult, Erc1271Verifier, Caip10Eip155, } from './verifier.js';
|
|
22
|
+
export type { VerificationResult, VerifyCredentialResult, VerifyCredentialOpts, CredentialStatusResolver, Erc1271Verifier, Caip10Eip155, } from './verifier.js';
|
|
23
23
|
export { SHAPE_DID_PREFIX, buildShapeUri, parseShapeUri, shapeHash } from './schema.js';
|
|
24
|
+
export { situationV2ToCredentialSubject } from './situation.js';
|
|
24
25
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,eAAO,MAAM,YAAY,8CAA8C,CAAC;AACxE,eAAO,MAAM,cAAc,EAAG,iBAA0B,CAAC;AACzD,eAAO,MAAM,QAAQ,yDAAyD,CAAC;AAG/E,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,KAAK,EACL,OAAO,EACP,SAAS,EACT,wBAAwB,EACxB,KAAK,EACL,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1E,OAAO,EACL,2BAA2B,EAC3B,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1E,OAAO,EACL,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,oBAAoB,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,eAAO,MAAM,YAAY,8CAA8C,CAAC;AACxE,eAAO,MAAM,cAAc,EAAG,iBAA0B,CAAC;AACzD,eAAO,MAAM,QAAQ,yDAAyD,CAAC;AAG/E,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,KAAK,EACL,OAAO,EACP,SAAS,EACT,wBAAwB,EACxB,qBAAqB,EACrB,KAAK,EACL,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1E,OAAO,EACL,2BAA2B,EAC3B,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1E,OAAO,EACL,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAGtE,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAChG,YAAY,EACV,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,YAAY,GACb,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,8BAA8B,EAAE,MAAM,gBAAgB,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -18,9 +18,10 @@ export { jcsCanonicalize, canonicalHash, JcsError } from './canonical.js';
|
|
|
18
18
|
// Situation pattern
|
|
19
19
|
export { assertSituationRolesPresent, buildSituation, } from './situation.js';
|
|
20
20
|
// Proof builder
|
|
21
|
-
export { credentialHash, eip712Digest, isoToSeconds, signCredential, viemSignerFromWallet, } from './proof.js';
|
|
21
|
+
export { credentialHash, eip712Digest, isoToSeconds, signCredential, viemSignerFromWallet, kmsCredentialSigner, } from './proof.js';
|
|
22
22
|
// Verifier
|
|
23
23
|
export { verifyCredential, verifyCredentialStructural, parseEip155Caip10 } from './verifier.js';
|
|
24
24
|
// Schema registration
|
|
25
25
|
export { SHAPE_DID_PREFIX, buildShapeUri, parseShapeUri, shapeHash } from './schema.js';
|
|
26
|
+
export { situationV2ToCredentialSubject } from './situation.js';
|
|
26
27
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,2CAA2C,CAAC;AACxE,MAAM,CAAC,MAAM,cAAc,GAAG,iBAA0B,CAAC;AACzD,MAAM,CAAC,MAAM,QAAQ,GAAG,sDAAsD,CAAC;AAE/E,oBAAoB;AACpB,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,eAAe,GAChB,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,2CAA2C,CAAC;AACxE,MAAM,CAAC,MAAM,cAAc,GAAG,iBAA0B,CAAC;AACzD,MAAM,CAAC,MAAM,QAAQ,GAAG,sDAAsD,CAAC;AAE/E,oBAAoB;AACpB,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,eAAe,GAChB,MAAM,YAAY,CAAC;AAepB,uBAAuB;AACvB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1E,oBAAoB;AACpB,OAAO,EACL,2BAA2B,EAC3B,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,gBAAgB;AAChB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAGpB,WAAW;AACX,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAUhG,sBAAsB;AACtB,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,8BAA8B,EAAE,MAAM,gBAAgB,CAAC"}
|
package/dist/proof.d.ts
CHANGED
|
@@ -46,6 +46,7 @@ export declare function isoToSeconds(iso: string | undefined): number;
|
|
|
46
46
|
*/
|
|
47
47
|
export declare function signCredential<TSubject extends Record<string, unknown>>(unsigned: UnsignedCredential<TSubject>, signer: CredentialSigner, opts?: {
|
|
48
48
|
proofPurpose?: Eip712Signature2026Proof['proofPurpose'];
|
|
49
|
+
delegatingSigner?: Eip712Signature2026Proof['delegatingSigner'];
|
|
49
50
|
}): Promise<VerifiableCredential<TSubject>>;
|
|
50
51
|
/** Convenience: a viem `WalletClient`-backed `CredentialSigner` (EOA-only path). */
|
|
51
52
|
export declare function viemSignerFromWallet(args: {
|
|
@@ -54,6 +55,36 @@ export declare function viemSignerFromWallet(args: {
|
|
|
54
55
|
chainId: number;
|
|
55
56
|
verifyingContract: Address;
|
|
56
57
|
}): CredentialSigner;
|
|
58
|
+
/**
|
|
59
|
+
* Minimal structural shape of a KMS signing backend (spec 276 KCS-D5). It is
|
|
60
|
+
* declared HERE — not imported from `@agenticprimitives/key-custody` — because
|
|
61
|
+
* `verifiable-credentials` is a leaf in the dependency graph (no `@agenticprimitives/*`
|
|
62
|
+
* imports beyond types/ontology). `key-custody`'s `KmsAccountBackend` structurally
|
|
63
|
+
* satisfies this, so `kmsCredentialSigner(kmsBackend, …)` just works without the
|
|
64
|
+
* cross-package edge.
|
|
65
|
+
*/
|
|
66
|
+
export interface KmsSigningBackend {
|
|
67
|
+
/** Sign a 32-byte digest; returns a 65-byte secp256k1 `(r,s,v)` signature. */
|
|
68
|
+
signA2AAction(input: {
|
|
69
|
+
digest: Uint8Array;
|
|
70
|
+
}): Promise<{
|
|
71
|
+
signature: Uint8Array;
|
|
72
|
+
}>;
|
|
73
|
+
/** The signing key's EVM address (the credential the issuer SA validates via ERC-1271). */
|
|
74
|
+
getSignerAddress(): Promise<Address>;
|
|
75
|
+
}
|
|
76
|
+
/**
|
|
77
|
+
* Convenience: a `CredentialSigner` backed by a KMS-custodied secp256k1 key
|
|
78
|
+
* (the issuer SA's master / per-subject signer). Mirrors `viemSignerFromWallet`
|
|
79
|
+
* for the KMS path. `verifyingContract` defaults to the issuer SA itself (the
|
|
80
|
+
* ERC-1271 self-verification anchor).
|
|
81
|
+
*/
|
|
82
|
+
export declare function kmsCredentialSigner(args: {
|
|
83
|
+
backend: KmsSigningBackend;
|
|
84
|
+
issuerAddress: Address;
|
|
85
|
+
chainId: number;
|
|
86
|
+
verifyingContract?: Address;
|
|
87
|
+
}): CredentialSigner;
|
|
57
88
|
/** Re-export so callers see the Proof union from one place. */
|
|
58
89
|
export type { Proof };
|
|
59
90
|
//# sourceMappingURL=proof.d.ts.map
|
package/dist/proof.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../src/proof.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,
|
|
1
|
+
{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../src/proof.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAyC,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,KAAK,YAAY,EAAE,MAAM,MAAM,CAAC;AAGxG,OAAO,EAML,KAAK,wBAAwB,EAC7B,KAAK,KAAK,EACV,KAAK,KAAK,EACV,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EAC1B,MAAM,YAAY,CAAC;AAEpB,sFAAsF;AACtF,MAAM,WAAW,gBAAgB;IAC/B,yEAAyE;IACzE,aAAa,EAAE,OAAO,CAAC;IACvB,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,UAAU,CAAC,MAAM,EAAE,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;CACzC;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,kBAAkB,GAAG,oBAAoB,GAAG,KAAK,CAKzF;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE;IACjC,kBAAkB,EAAE,KAAK,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,wBAAwB,CAAC,cAAc,CAAC,CAAC;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;CAC5B,GAAG,KAAK,CAkBR;AAED,oEAAoE;AACpE,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAG5D;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3E,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EACtC,MAAM,EAAE,gBAAgB,EACxB,IAAI,GAAE;IAAE,YAAY,CAAC,EAAE,wBAAwB,CAAC,cAAc,CAAC,CAAC;IAAC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC,kBAAkB,CAAC,CAAA;CAAO,GACtI,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAuCzC;AAED,oFAAoF;AACpF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,MAAM,EAAE,YAAY,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;CAC5B,GAAG,gBAAgB,CAYnB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,8EAA8E;IAC9E,aAAa,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;IACjF,2FAA2F;IAC3F,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,OAAO,EAAE,iBAAiB,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B,GAAG,gBAAgB,CAUnB;AAQD,+DAA+D;AAC/D,YAAY,EAAE,KAAK,EAAE,CAAC"}
|
package/dist/proof.js
CHANGED
|
@@ -5,7 +5,7 @@
|
|
|
5
5
|
*
|
|
6
6
|
* Spec 242 §4.3 + ADR-0023 §D2.
|
|
7
7
|
*/
|
|
8
|
-
import { hashTypedData } from 'viem';
|
|
8
|
+
import { hashTypedData, hexToBytes, bytesToHex } from 'viem';
|
|
9
9
|
import { canonicalHash } from './canonical.js';
|
|
10
10
|
import { EIP712_SIG_2026_CONTEXT, VC_CONTEXT_V2, VC_DOMAIN_NAME, VC_DOMAIN_VERSION, VC_EIP712_TYPES, } from './types.js';
|
|
11
11
|
/**
|
|
@@ -52,12 +52,17 @@ export function isoToSeconds(iso) {
|
|
|
52
52
|
*/
|
|
53
53
|
export async function signCredential(unsigned, signer, opts = {}) {
|
|
54
54
|
const proofPurpose = opts.proofPurpose ?? 'assertionMethod';
|
|
55
|
-
|
|
55
|
+
// Expand `@context` BEFORE hashing so the emitted `credentialHash` matches the
|
|
56
|
+
// canonical hash of the emitted body. (Hashing the pre-expansion body and then
|
|
57
|
+
// adding the EIP-712 context to the output produced a VC whose stored hash never
|
|
58
|
+
// reconciled with its own body — structural verification would reject it.)
|
|
59
|
+
const contexted = { ...unsigned, '@context': ensureContexts(unsigned['@context']) };
|
|
60
|
+
const bodyHash = credentialHash(contexted);
|
|
56
61
|
const digest = eip712Digest({
|
|
57
62
|
credentialBodyHash: bodyHash,
|
|
58
|
-
issuer:
|
|
59
|
-
validFrom: isoToSeconds(
|
|
60
|
-
validUntil: isoToSeconds(
|
|
63
|
+
issuer: contexted.issuer,
|
|
64
|
+
validFrom: isoToSeconds(contexted.validFrom),
|
|
65
|
+
validUntil: isoToSeconds(contexted.validUntil),
|
|
61
66
|
proofPurpose,
|
|
62
67
|
chainId: signer.chainId,
|
|
63
68
|
verifyingContract: signer.verifyingContract,
|
|
@@ -76,10 +81,10 @@ export async function signCredential(unsigned, signer, opts = {}) {
|
|
|
76
81
|
verifyingContract: signer.verifyingContract,
|
|
77
82
|
},
|
|
78
83
|
credentialHash: bodyHash,
|
|
84
|
+
...(opts.delegatingSigner ? { delegatingSigner: opts.delegatingSigner } : {}),
|
|
79
85
|
};
|
|
80
86
|
return {
|
|
81
|
-
...
|
|
82
|
-
'@context': ensureContexts(unsigned['@context']),
|
|
87
|
+
...contexted,
|
|
83
88
|
proof,
|
|
84
89
|
};
|
|
85
90
|
}
|
|
@@ -97,6 +102,23 @@ export function viemSignerFromWallet(args) {
|
|
|
97
102
|
},
|
|
98
103
|
};
|
|
99
104
|
}
|
|
105
|
+
/**
|
|
106
|
+
* Convenience: a `CredentialSigner` backed by a KMS-custodied secp256k1 key
|
|
107
|
+
* (the issuer SA's master / per-subject signer). Mirrors `viemSignerFromWallet`
|
|
108
|
+
* for the KMS path. `verifyingContract` defaults to the issuer SA itself (the
|
|
109
|
+
* ERC-1271 self-verification anchor).
|
|
110
|
+
*/
|
|
111
|
+
export function kmsCredentialSigner(args) {
|
|
112
|
+
return {
|
|
113
|
+
issuerAddress: args.issuerAddress,
|
|
114
|
+
chainId: args.chainId,
|
|
115
|
+
verifyingContract: args.verifyingContract ?? args.issuerAddress,
|
|
116
|
+
async signDigest(digest) {
|
|
117
|
+
const { signature } = await args.backend.signA2AAction({ digest: hexToBytes(digest) });
|
|
118
|
+
return bytesToHex(signature);
|
|
119
|
+
},
|
|
120
|
+
};
|
|
121
|
+
}
|
|
100
122
|
function ensureContexts(existing) {
|
|
101
123
|
const needed = [VC_CONTEXT_V2, EIP712_SIG_2026_CONTEXT];
|
|
102
124
|
const have = new Set(existing);
|
package/dist/proof.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"proof.js","sourceRoot":"","sources":["../src/proof.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,aAAa,EAA6C,MAAM,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"proof.js","sourceRoot":"","sources":["../src/proof.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAA6C,MAAM,MAAM,CAAC;AAExG,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,eAAe,GAMhB,MAAM,YAAY,CAAC;AAiBpB;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAmD;IAChF,uDAAuD;IACvD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,YAAY,EAAE,GAAG,QAAgC,CAAC;IAC9E,KAAK,QAAQ,CAAC;IACd,OAAO,aAAa,CAAC,YAAY,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAQ5B;IACC,OAAO,aAAa,CAAC;QACnB,MAAM,EAAE;YACN,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,iBAAiB;YAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;SAC1C;QACD,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE,iCAAiC;QAC9C,OAAO,EAAE;YACP,cAAc,EAAE,IAAI,CAAC,kBAAkB;YACvC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YACjC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YACnC,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC;KACF,CAAU,CAAC;AACd,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,YAAY,CAAC,GAAuB;IAClD,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,CAAC;IACnB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;AACpD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAsC,EACtC,MAAwB,EACxB,OAAqI,EAAE;IAEvI,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,iBAAiB,CAAC;IAC5D,+EAA+E;IAC/E,+EAA+E;IAC/E,iFAAiF;IACjF,2EAA2E;IAC3E,MAAM,SAAS,GAAG,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAkC,CAAC;IACpH,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,kBAAkB,EAAE,QAAQ;QAC5B,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,SAAS,CAAC;QAC5C,UAAU,EAAE,YAAY,CAAC,SAAS,CAAC,UAAU,CAAC;QAC9C,YAAY;QACZ,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;KAC5C,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAEnD,MAAM,KAAK,GAA6B;QACtC,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACjC,kBAAkB,EAAE,UAAU,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,iBAAiB,kBAAkB;QAC1F,YAAY;QACZ,UAAU;QACV,YAAY,EAAE;YACZ,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,iBAAiB;YAC1B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C;QACD,cAAc,EAAE,QAAQ;QACxB,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC;IAEF,OAAO;QACL,GAAG,SAAS;QACZ,KAAK;KAC4B,CAAC;AACtC,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAAC,IAKpC;IACC,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,KAAK,CAAC,UAAU,CAAC,MAAM;YACrB,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;gBACzB,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;aACgB,CAAmB,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC;AAiBD;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAKnC;IACC,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,aAAa;QAC/D,KAAK,CAAC,UAAU,CAAC,MAAa;YAC5B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACvF,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAA2B;IACjD,MAAM,MAAM,GAAG,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC"}
|
package/dist/situation.d.ts
CHANGED
|
@@ -45,4 +45,10 @@ export declare function buildSituation<TBody extends Record<string, unknown>>(ar
|
|
|
45
45
|
body: TBody;
|
|
46
46
|
participants?: Record<string, string>;
|
|
47
47
|
}): Situation<TBody>;
|
|
48
|
+
import type { SituationV2 } from '@agenticprimitives/situations';
|
|
49
|
+
/** Bridge a substrate `SituationV2` (spec 324) into a credential subject. The subject IS the situation,
|
|
50
|
+
* faithfully (roleBindings + body + evidence preserved), widened to satisfy VC's `Record<string, unknown>`
|
|
51
|
+
* subject constraint — no lossy conversion to the legacy V1 `Situation`. Every credential whose subject is a
|
|
52
|
+
* SituationV2 (e.g. `OrganizationMembershipCredential`) composes through this. */
|
|
53
|
+
export declare function situationV2ToCredentialSubject<TBody extends Record<string, unknown>>(s: SituationV2<TBody>): SituationV2<TBody> & Record<string, unknown>;
|
|
48
54
|
//# sourceMappingURL=situation.d.ts.map
|
package/dist/situation.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"situation.d.ts","sourceRoot":"","sources":["../src/situation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAExD,gFAAgF;AAChF,MAAM,MAAM,cAAc,GAAG,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC;AAEnD,yDAAyD;AACzD,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B;;yEAEyE;AACzE,MAAM,WAAW,SAAS,CAAC,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACxF,uDAAuD;IACvD,WAAW,EAAE,cAAc,CAAC;IAC5B,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjC,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,sCAAsC;IACtC,IAAI,EAAE,KAAK,CAAC;IACZ,uEAAuE;IACvE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,IAAI,CAQzF;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE;IAC1E,WAAW,EAAE,cAAc,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,EAAE,KAAK,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC,GAAG,SAAS,CAAC,KAAK,CAAC,CAOnB"}
|
|
1
|
+
{"version":3,"file":"situation.d.ts","sourceRoot":"","sources":["../src/situation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAExD,gFAAgF;AAChF,MAAM,MAAM,cAAc,GAAG,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC;AAEnD,yDAAyD;AACzD,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B;;yEAEyE;AACzE,MAAM,WAAW,SAAS,CAAC,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACxF,uDAAuD;IACvD,WAAW,EAAE,cAAc,CAAC;IAC5B,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjC,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,sCAAsC;IACtC,IAAI,EAAE,KAAK,CAAC;IACZ,uEAAuE;IACvE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,IAAI,CAQzF;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE;IAC1E,WAAW,EAAE,cAAc,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,EAAE,KAAK,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC,GAAG,SAAS,CAAC,KAAK,CAAC,CAOnB;AAED,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE;;;mFAGmF;AACnF,wBAAgB,8BAA8B,CAAC,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClF,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,GACpB,WAAW,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE9C"}
|
package/dist/situation.js
CHANGED
|
@@ -33,4 +33,11 @@ export function buildSituation(args) {
|
|
|
33
33
|
body: args.body,
|
|
34
34
|
};
|
|
35
35
|
}
|
|
36
|
+
/** Bridge a substrate `SituationV2` (spec 324) into a credential subject. The subject IS the situation,
|
|
37
|
+
* faithfully (roleBindings + body + evidence preserved), widened to satisfy VC's `Record<string, unknown>`
|
|
38
|
+
* subject constraint — no lossy conversion to the legacy V1 `Situation`. Every credential whose subject is a
|
|
39
|
+
* SituationV2 (e.g. `OrganizationMembershipCredential`) composes through this. */
|
|
40
|
+
export function situationV2ToCredentialSubject(s) {
|
|
41
|
+
return s;
|
|
42
|
+
}
|
|
36
43
|
//# sourceMappingURL=situation.js.map
|
package/dist/situation.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"situation.js","sourceRoot":"","sources":["../src/situation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA0BH;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,CAAY,EAAE,aAAyB;IACjF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,uCAAuC,CAAC,CAAC,WAAW,gCAAgC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAwC,IAKrE;IACC,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE;QACxB,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS;QACtE,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC;AACJ,CAAC"}
|
|
1
|
+
{"version":3,"file":"situation.js","sourceRoot":"","sources":["../src/situation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA0BH;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,CAAY,EAAE,aAAyB;IACjF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,uCAAuC,CAAC,CAAC,WAAW,gCAAgC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAwC,IAKrE;IACC,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE;QACxB,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS;QACtE,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC;AACJ,CAAC;AAID;;;mFAGmF;AACnF,MAAM,UAAU,8BAA8B,CAC5C,CAAqB;IAErB,OAAO,CAAiD,CAAC;AAC3D,CAAC"}
|
package/dist/types.d.ts
CHANGED
|
@@ -43,6 +43,20 @@ export interface Eip712Signature2026Proof {
|
|
|
43
43
|
};
|
|
44
44
|
/** Optional canonical-hash receipt of the credential body (RFC 8785 JCS). */
|
|
45
45
|
credentialHash?: Hex32;
|
|
46
|
+
/** Present when an issuer-AUTHORIZED operational key (e.g. Cloud KMS) signed this credential instead of
|
|
47
|
+
* the issuer's own custodian. `proofValue` is then the delegate key's signature; trust still roots in
|
|
48
|
+
* the issuer SA (`delegatorIssuer` == the credential's issuer). Lives in the proof (stripped from the
|
|
49
|
+
* credential hash), so attaching it does NOT change the signed digest. The verifier checks the leaf. */
|
|
50
|
+
delegatingSigner?: DelegatingSignerProof;
|
|
51
|
+
}
|
|
52
|
+
/** Issuer authorization of an operational signing key (mirrors content-primitives' DelegatingSigner). */
|
|
53
|
+
export interface DelegatingSignerProof {
|
|
54
|
+
/** The issuer SA the credential's trust roots in (== the credential issuer). */
|
|
55
|
+
delegatorIssuer: Address;
|
|
56
|
+
/** The operational key that actually signed (authorized by `delegatorIssuer`). */
|
|
57
|
+
delegateKey: Address;
|
|
58
|
+
/** The signed delegation binding `delegateKey` → `delegatorIssuer`. OPAQUE; the app validates it. */
|
|
59
|
+
delegationLeaf: unknown;
|
|
46
60
|
}
|
|
47
61
|
/** Discriminated union for all supported proof types (W1: Eip712Signature2026 only). */
|
|
48
62
|
export type Proof = Eip712Signature2026Proof;
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,MAAM,KAAK,GAAG,KAAK,MAAM,EAAE,CAAC;AAClC,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAE7B,kCAAkC;AAClC,eAAO,MAAM,aAAa,EAAG,sCAA+C,CAAC;AAE7E,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,EAClC,iEAA0E,CAAC;AAE7E;;;GAGG;AACH,MAAM,MAAM,SAAS,GACjB,qBAAqB,GACrB,oBAAoB,GACpB,YAAY,CAAC;AAEjB;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,iBAAiB,GAAG,gBAAgB,GAAG,sBAAsB,CAAC;IAC5E,iDAAiD;IACjD,UAAU,EAAE,GAAG,CAAC;IAChB,mEAAmE;IACnE,YAAY,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,iBAAiB,EAAE,OAAO,CAAC;KAC5B,CAAC;IACF,6EAA6E;IAC7E,cAAc,CAAC,EAAE,KAAK,CAAC;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,MAAM,KAAK,GAAG,KAAK,MAAM,EAAE,CAAC;AAClC,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAE7B,kCAAkC;AAClC,eAAO,MAAM,aAAa,EAAG,sCAA+C,CAAC;AAE7E,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,EAClC,iEAA0E,CAAC;AAE7E;;;GAGG;AACH,MAAM,MAAM,SAAS,GACjB,qBAAqB,GACrB,oBAAoB,GACpB,YAAY,CAAC;AAEjB;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,iBAAiB,GAAG,gBAAgB,GAAG,sBAAsB,CAAC;IAC5E,iDAAiD;IACjD,UAAU,EAAE,GAAG,CAAC;IAChB,mEAAmE;IACnE,YAAY,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,iBAAiB,EAAE,OAAO,CAAC;KAC5B,CAAC;IACF,6EAA6E;IAC7E,cAAc,CAAC,EAAE,KAAK,CAAC;IACvB;;;6GAGyG;IACzG,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;CAC1C;AAED,yGAAyG;AACzG,MAAM,WAAW,qBAAqB;IACpC,gFAAgF;IAChF,eAAe,EAAE,OAAO,CAAC;IACzB,kFAAkF;IAClF,WAAW,EAAE,OAAO,CAAC;IACrB,qGAAqG;IACrG,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,wFAAwF;AACxF,MAAM,MAAM,KAAK,GAAG,wBAAwB,CAAC;AAE7C,+DAA+D;AAC/D,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,qBAAqB,GAAG,0BAA0B,CAAC;IACzD,aAAa,CAAC,EAAE,YAAY,GAAG,YAAY,CAAC;IAC5C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB,QAAQ,GACR,cAAc,GACd,mBAAmB,GACnB,WAAW,GACX,cAAc,CAAC;AAEnB,MAAM,WAAW,gBAAgB;IAC/B,yCAAyC;IACzC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACjD,oDAAoD;IACpD,WAAW,EAAE,cAAc,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACtG,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,kFAAkF;IAClF,IAAI,EAAE,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC;IAC7B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,uBAAuB;IACvB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,mDAAmD;IACnD,iBAAiB,EAAE,QAAQ,CAAC;IAC5B,qDAAqD;IACrD,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,qFAAqF;IACrF,gBAAgB,CAAC,EAAE;QACjB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,YAAY,GAAG,YAAY,CAAC;KACnC,CAAC;IACF,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,2CAA2C;IAC3C,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED,yEAAyE;AACzE,MAAM,MAAM,kBAAkB,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,IAAI,CACvG,oBAAoB,CAAC,QAAQ,CAAC,EAC9B,OAAO,CACR,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;CAQlB,CAAC;AAEX,eAAO,MAAM,cAAc,EAAG,qBAA8B,CAAC;AAC7D,eAAO,MAAM,iBAAiB,EAAG,GAAY,CAAC"}
|
package/dist/types.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,kCAAkC;AAClC,MAAM,CAAC,MAAM,aAAa,GAAG,sCAA+C,CAAC;AAE7E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAClC,iEAA0E,CAAC;
|
|
1
|
+
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,kCAAkC;AAClC,MAAM,CAAC,MAAM,aAAa,GAAG,sCAA+C,CAAC;AAE7E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAClC,iEAA0E,CAAC;AAwH7E;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,+BAA+B,EAAE;QAC/B,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3C,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;QAClC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE;QACrC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE;QACtC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE;KACzC;CACO,CAAC;AAEX,MAAM,CAAC,MAAM,cAAc,GAAG,qBAA8B,CAAC;AAC7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAY,CAAC"}
|
package/dist/verifier.d.ts
CHANGED
|
@@ -1,18 +1,4 @@
|
|
|
1
|
-
|
|
2
|
-
* Verifier — checks that a VC's proof is valid (findings VC-1 / VC-2, closed).
|
|
3
|
-
*
|
|
4
|
-
* `verifyCredential(vc, publicClient)` performs the ERC-1271 round-trip against
|
|
5
|
-
* the issuer SA on chain and FAILS CLOSED — `credentialHash` is mandatory, and
|
|
6
|
-
* the EIP-712 digest pins `verifyingContract` to the issuer SA + binds `chainId`,
|
|
7
|
-
* so an attacker can't substitute a different verifying domain. The structural
|
|
8
|
-
* helpers remain for callers that only need shape validation, but the authority
|
|
9
|
-
* check is `verifyCredential`; there is no fallback path (ADR-0013).
|
|
10
|
-
*
|
|
11
|
-
* Status-list resolution (StatusList2021): the verifier records whether a status
|
|
12
|
-
* entry was present + which list to fetch; the consumer fetches it (no silent
|
|
13
|
-
* fallback, ADR-0013).
|
|
14
|
-
*/
|
|
15
|
-
import type { Hex32, VerifiableCredential } from './types.js';
|
|
1
|
+
import type { CredentialStatus2021, Hex32, VerifiableCredential } from './types.js';
|
|
16
2
|
/** Parsed `eip155:<chainId>:<address>` CAIP-10 reference. */
|
|
17
3
|
export interface Caip10Eip155 {
|
|
18
4
|
chainId: number;
|
|
@@ -53,13 +39,40 @@ export interface Erc1271Verifier {
|
|
|
53
39
|
}
|
|
54
40
|
export interface VerifyCredentialResult {
|
|
55
41
|
/** True ONLY when the structural checks pass AND the issuer SA's ERC-1271 path validates the
|
|
56
|
-
* signature over the expected digest. Fail-closed: any error/anomaly → false.
|
|
42
|
+
* signature over the expected digest. Fail-closed: any error/anomaly → false.
|
|
43
|
+
*
|
|
44
|
+
* VC-3 (spec 300 / ADR-0041): `valid` proves the credential was AUTHORED by whoever `vc.issuer`
|
|
45
|
+
* names — it does NOT prove that issuer has AUTHORITY over the subject. Any SA can self-sign a VC
|
|
46
|
+
* about any subject and it verifies `valid: true`. A consumer using a VC for AUTHORIZATION MUST NOT
|
|
47
|
+
* read `valid` as "trusted"; it must read `trustedForSubject` (below), which is only set when an
|
|
48
|
+
* explicit issuer→subject authority policy is supplied. `valid === issuerSigned` (kept for compat). */
|
|
57
49
|
valid: boolean;
|
|
50
|
+
/** VC-3: explicit alias for `valid` — "the named issuer signed this credential" (authorship). */
|
|
51
|
+
issuerSigned: boolean;
|
|
52
|
+
/** VC-3: the resolved issuer SA address (from `vc.issuer`), or null if it couldn't be parsed.
|
|
53
|
+
* A consumer binds authority against THIS address, not the credentialSubject's self-report. */
|
|
54
|
+
issuerAddress: `0x${string}` | null;
|
|
55
|
+
/** VC-3: whether the issuer is AUTHORIZED over the subject — the confused-deputy gate. Only present
|
|
56
|
+
* when `opts.authorityPolicy` is supplied; the generic verifier cannot decide it on its own (this
|
|
57
|
+
* package is a leaf and issuer→subject authority is app/registry policy). `undefined` means "not
|
|
58
|
+
* evaluated — the caller did not assert an authority model", which an authorization consumer MUST
|
|
59
|
+
* treat as untrusted. */
|
|
60
|
+
trustedForSubject?: boolean;
|
|
58
61
|
/** The structural sub-result (digest, proof value, issuer ref, issues). */
|
|
59
62
|
structuralResult: VerificationResult;
|
|
60
63
|
/** All issues — structural plus signature/verification failures. */
|
|
61
64
|
issues: string[];
|
|
62
65
|
}
|
|
66
|
+
/** VC-3: consumer-supplied issuer→subject authority policy. Given the verified issuer SA and the
|
|
67
|
+
* credential, decide whether that issuer is AUTHORIZED to make claims about the subject (e.g. issuer
|
|
68
|
+
* == subject principal, issuer is on-chain-delegated by the subject, or issuer is a registry-approved
|
|
69
|
+
* authority for this credential type). Returning false (or throwing) leaves `trustedForSubject` false. */
|
|
70
|
+
export interface CredentialAuthorityPolicy {
|
|
71
|
+
(args: {
|
|
72
|
+
issuer: `0x${string}`;
|
|
73
|
+
vc: VerifiableCredential;
|
|
74
|
+
}): Promise<boolean> | boolean;
|
|
75
|
+
}
|
|
63
76
|
/**
|
|
64
77
|
* Full credential verification (VC-1): structural checks PLUS the on-chain ERC-1271 round-trip
|
|
65
78
|
* against the issuer SA resolved from `vc.issuer`. This is the function consumers (content
|
|
@@ -69,5 +82,27 @@ export interface VerifyCredentialResult {
|
|
|
69
82
|
* Fail-closed per ADR-0013: a structural failure, an unresolvable issuer, a verification-call error,
|
|
70
83
|
* or a non-validating signature all return `valid: false` — never a silent accept.
|
|
71
84
|
*/
|
|
72
|
-
|
|
85
|
+
/** Resolve + check a credential's revocation/suspension status (NEW-VC-1). Returns `revoked: true` to
|
|
86
|
+
* fail the verification. Injected so the package stays a leaf (the StatusList2021 fetch is the
|
|
87
|
+
* consumer's effect). */
|
|
88
|
+
export interface CredentialStatusResolver {
|
|
89
|
+
(status: CredentialStatus2021): Promise<{
|
|
90
|
+
revoked: boolean;
|
|
91
|
+
}>;
|
|
92
|
+
}
|
|
93
|
+
export interface VerifyCredentialOpts {
|
|
94
|
+
/** NEW-VC-1: when the VC carries a `credentialStatus`, this resolver checks revocation/suspension.
|
|
95
|
+
* REQUIRED for any status-bearing credential unless `allowUnresolvedStatus` is set — otherwise a
|
|
96
|
+
* REVOKED credential would verify valid (the verifier can confirm the signature but not the status). */
|
|
97
|
+
verifyStatus?: CredentialStatusResolver;
|
|
98
|
+
/** NEW-VC-1 opt-out: accept a status-bearing credential WITHOUT resolving its status. Use ONLY where
|
|
99
|
+
* revocation genuinely doesn't matter; otherwise omitting the resolver fails closed (ADR-0013). */
|
|
100
|
+
allowUnresolvedStatus?: boolean;
|
|
101
|
+
/** VC-3: issuer→subject authority policy. When supplied, the verifier evaluates it (only after the
|
|
102
|
+
* signature + status checks pass) and reports the result as `trustedForSubject`. When omitted,
|
|
103
|
+
* `trustedForSubject` is left `undefined` — the verifier makes no authority claim, and an
|
|
104
|
+
* authorization consumer MUST treat that as untrusted. Never inferred; never defaulted to true. */
|
|
105
|
+
authorityPolicy?: CredentialAuthorityPolicy;
|
|
106
|
+
}
|
|
107
|
+
export declare function verifyCredential(vc: VerifiableCredential, client: Erc1271Verifier, opts?: VerifyCredentialOpts): Promise<VerifyCredentialResult>;
|
|
73
108
|
//# sourceMappingURL=verifier.d.ts.map
|
package/dist/verifier.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../src/verifier.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../src/verifier.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EACV,oBAAoB,EAEpB,KAAK,EAEL,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAEpB,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;CACxB;AAED;2FAC2F;AAC3F,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAOlE;AAED,MAAM,WAAW,kBAAkB;IACjC,uEAAuE;IACvE,UAAU,EAAE,OAAO,CAAC;IACpB,8DAA8D;IAC9D,cAAc,EAAE,KAAK,GAAG,IAAI,CAAC;IAC7B,sEAAsE;IACtE,UAAU,EAAE,KAAK,MAAM,EAAE,GAAG,IAAI,CAAC;IACjC,2EAA2E;IAC3E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,wEAAwE;IACxE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,0FAA0F;IAC1F,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,oBAAoB,GAAG,kBAAkB,CA+HvF;AAcD;;4DAE4D;AAC5D,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,IAAI,EAAE;QACf,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;QACvB,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;QACpB,SAAS,EAAE,KAAK,MAAM,EAAE,CAAC;KAC1B,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;;;;4GAOwG;IACxG,KAAK,EAAE,OAAO,CAAC;IACf,iGAAiG;IACjG,YAAY,EAAE,OAAO,CAAC;IACtB;oGACgG;IAChG,aAAa,EAAE,KAAK,MAAM,EAAE,GAAG,IAAI,CAAC;IACpC;;;;8BAI0B;IAC1B,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,2EAA2E;IAC3E,gBAAgB,EAAE,kBAAkB,CAAC;IACrC,oEAAoE;IACpE,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;2GAG2G;AAC3G,MAAM,WAAW,yBAAyB;IACxC,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,KAAK,MAAM,EAAE,CAAC;QAAC,EAAE,EAAE,oBAAoB,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACzF;AAED;;;;;;;;GAQG;AACH;;0BAE0B;AAC1B,MAAM,WAAW,wBAAwB;IACvC,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,oBAAoB;IACnC;;6GAEyG;IACzG,YAAY,CAAC,EAAE,wBAAwB,CAAC;IACxC;wGACoG;IACpG,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;wGAGoG;IACpG,eAAe,CAAC,EAAE,yBAAyB,CAAC;CAC7C;AAED,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,oBAAoB,EACxB,MAAM,EAAE,eAAe,EACvB,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAAC,sBAAsB,CAAC,CAuEjC"}
|
package/dist/verifier.js
CHANGED
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import { isEvmCaip10, parseCaip10Parts } from '@agenticprimitives/types';
|
|
1
2
|
/**
|
|
2
3
|
* Verifier — checks that a VC's proof is valid (findings VC-1 / VC-2, closed).
|
|
3
4
|
*
|
|
@@ -16,10 +17,13 @@ import { credentialHash, eip712Digest, isoToSeconds } from './proof.js';
|
|
|
16
17
|
/** Parse an `eip155:<chainId>:0x…40` CAIP-10 account id, or null. Both `vc.issuer` and the
|
|
17
18
|
* `verificationMethod` prefix use this form — the VC-2 domain-binding source of truth. */
|
|
18
19
|
export function parseEip155Caip10(ref) {
|
|
19
|
-
|
|
20
|
-
|
|
20
|
+
// Parsed via the shared grammar rather than a local regex. Note the parts are
|
|
21
|
+
// (namespace, reference, address) — NOT (chainId, address); reading them positionally is how the
|
|
22
|
+
// first version of this edit produced `{ chainId: NaN, address: '8453' }`.
|
|
23
|
+
if (!isEvmCaip10(ref))
|
|
21
24
|
return null;
|
|
22
|
-
|
|
25
|
+
const p = parseCaip10Parts(ref);
|
|
26
|
+
return { chainId: Number(p.reference), address: p.address };
|
|
23
27
|
}
|
|
24
28
|
/**
|
|
25
29
|
* Structural verification — does NOT make a network call. Returns the
|
|
@@ -40,10 +44,24 @@ export function verifyCredentialStructural(vc) {
|
|
|
40
44
|
issues.push('missing validFrom');
|
|
41
45
|
if (!vc.credentialSubject)
|
|
42
46
|
issues.push('missing credentialSubject');
|
|
47
|
+
const now = Math.floor(Date.now() / 1000);
|
|
48
|
+
// NEW-VC-2: enforce validFrom — a not-yet-active credential must NOT verify valid (the verifier
|
|
49
|
+
// previously gated only validUntil). NaN-safe: an unparseable validFrom fails closed.
|
|
50
|
+
if (vc.validFrom) {
|
|
51
|
+
const from = isoToSeconds(vc.validFrom);
|
|
52
|
+
if (!Number.isFinite(from)) {
|
|
53
|
+
issues.push(`validFrom is not a parseable date: ${vc.validFrom}`);
|
|
54
|
+
}
|
|
55
|
+
else if (from > now) {
|
|
56
|
+
issues.push(`credential not yet active (validFrom ${vc.validFrom})`);
|
|
57
|
+
}
|
|
58
|
+
}
|
|
43
59
|
if (vc.validUntil) {
|
|
44
60
|
const until = isoToSeconds(vc.validUntil);
|
|
45
|
-
|
|
46
|
-
|
|
61
|
+
if (!Number.isFinite(until)) {
|
|
62
|
+
issues.push(`validUntil is not a parseable date: ${vc.validUntil}`);
|
|
63
|
+
}
|
|
64
|
+
else if (until < now) {
|
|
47
65
|
issues.push(`credential expired at ${vc.validUntil}`);
|
|
48
66
|
}
|
|
49
67
|
}
|
|
@@ -134,31 +152,25 @@ function parseCaip10IssuerFromVerificationMethod(method) {
|
|
|
134
152
|
if (hashIdx === -1)
|
|
135
153
|
return null;
|
|
136
154
|
const ref = method.slice(0, hashIdx);
|
|
137
|
-
//
|
|
138
|
-
|
|
155
|
+
// Was `0x[0-9a-fA-F]+` — NO length bound — while `parseEip155Caip10` above, in this same file,
|
|
156
|
+
// required 40 hex. Two patterns for one concept, disagreeing about whether `eip155:1:0x1` is a
|
|
157
|
+
// valid verification method. It is not.
|
|
158
|
+
if (!isEvmCaip10(ref))
|
|
139
159
|
return null;
|
|
140
160
|
return ref;
|
|
141
161
|
}
|
|
142
|
-
|
|
143
|
-
* Full credential verification (VC-1): structural checks PLUS the on-chain ERC-1271 round-trip
|
|
144
|
-
* against the issuer SA resolved from `vc.issuer`. This is the function consumers (content
|
|
145
|
-
* entitlements, agent-skills, geo-features, related-agents) MUST gate on — `verifyCredentialStructural`
|
|
146
|
-
* alone proves nothing about the signature.
|
|
147
|
-
*
|
|
148
|
-
* Fail-closed per ADR-0013: a structural failure, an unresolvable issuer, a verification-call error,
|
|
149
|
-
* or a non-validating signature all return `valid: false` — never a silent accept.
|
|
150
|
-
*/
|
|
151
|
-
export async function verifyCredential(vc, client) {
|
|
162
|
+
export async function verifyCredential(vc, client, opts = {}) {
|
|
152
163
|
const structuralResult = verifyCredentialStructural(vc);
|
|
153
164
|
const issues = [...structuralResult.issues];
|
|
154
165
|
if (!structuralResult.structural || !structuralResult.expectedDigest || !structuralResult.proofValue) {
|
|
155
|
-
return { valid: false, structuralResult, issues };
|
|
166
|
+
return { valid: false, issuerSigned: false, issuerAddress: null, structuralResult, issues };
|
|
156
167
|
}
|
|
157
168
|
const issuerAcct = parseEip155Caip10(vc.issuer);
|
|
158
169
|
if (!issuerAcct) {
|
|
159
170
|
issues.push('cannot resolve issuer SA for ERC-1271 verification');
|
|
160
|
-
return { valid: false, structuralResult, issues };
|
|
171
|
+
return { valid: false, issuerSigned: false, issuerAddress: null, structuralResult, issues };
|
|
161
172
|
}
|
|
173
|
+
const issuerAddress = issuerAcct.address;
|
|
162
174
|
let ok;
|
|
163
175
|
try {
|
|
164
176
|
ok = await client.verifyHash({
|
|
@@ -169,10 +181,51 @@ export async function verifyCredential(vc, client) {
|
|
|
169
181
|
}
|
|
170
182
|
catch (e) {
|
|
171
183
|
issues.push(`ERC-1271 verification call failed: ${e instanceof Error ? e.message : String(e)}`);
|
|
172
|
-
return { valid: false, structuralResult, issues };
|
|
184
|
+
return { valid: false, issuerSigned: false, issuerAddress, structuralResult, issues };
|
|
173
185
|
}
|
|
174
|
-
if (!ok)
|
|
186
|
+
if (!ok) {
|
|
175
187
|
issues.push('issuer ERC-1271 signature did not validate over the expected digest');
|
|
176
|
-
|
|
188
|
+
return { valid: false, issuerSigned: false, issuerAddress, structuralResult, issues };
|
|
189
|
+
}
|
|
190
|
+
// NEW-VC-1: a valid signature proves authorship, NOT current validity. If the VC declares a
|
|
191
|
+
// credentialStatus, confirm it is not revoked/suspended — fail closed when it can't be resolved.
|
|
192
|
+
if (vc.credentialStatus) {
|
|
193
|
+
if (opts.verifyStatus) {
|
|
194
|
+
let status;
|
|
195
|
+
try {
|
|
196
|
+
status = await opts.verifyStatus(vc.credentialStatus);
|
|
197
|
+
}
|
|
198
|
+
catch (e) {
|
|
199
|
+
issues.push(`credentialStatus resolution failed: ${e instanceof Error ? e.message : String(e)}`);
|
|
200
|
+
return { valid: false, issuerSigned: true, issuerAddress, structuralResult, issues };
|
|
201
|
+
}
|
|
202
|
+
if (status.revoked) {
|
|
203
|
+
issues.push('credential is revoked/suspended per its credentialStatus');
|
|
204
|
+
return { valid: false, issuerSigned: false, issuerAddress, structuralResult, issues };
|
|
205
|
+
}
|
|
206
|
+
}
|
|
207
|
+
else if (!opts.allowUnresolvedStatus) {
|
|
208
|
+
issues.push('credentialStatus present but no status resolver injected — cannot confirm the credential is not revoked (fail-closed; pass allowUnresolvedStatus to override)');
|
|
209
|
+
return { valid: false, issuerSigned: false, issuerAddress, structuralResult, issues };
|
|
210
|
+
}
|
|
211
|
+
}
|
|
212
|
+
// VC-3: signature + status prove AUTHORSHIP. Authority over the subject is a separate question the
|
|
213
|
+
// generic verifier cannot answer — evaluate the consumer's authority policy if (and only if) one was
|
|
214
|
+
// supplied. `trustedForSubject` stays undefined otherwise, and an authorization consumer treats that
|
|
215
|
+
// as untrusted. A throwing/false policy → not trusted (fail-closed), but authorship still holds.
|
|
216
|
+
let trustedForSubject;
|
|
217
|
+
if (opts.authorityPolicy) {
|
|
218
|
+
try {
|
|
219
|
+
trustedForSubject = (await opts.authorityPolicy({ issuer: issuerAddress, vc })) === true;
|
|
220
|
+
}
|
|
221
|
+
catch (e) {
|
|
222
|
+
trustedForSubject = false;
|
|
223
|
+
issues.push(`authorityPolicy threw — issuer NOT trusted for subject: ${e instanceof Error ? e.message : String(e)}`);
|
|
224
|
+
}
|
|
225
|
+
if (!trustedForSubject) {
|
|
226
|
+
issues.push('issuer signed the credential but is NOT authorized over the subject (authorityPolicy)');
|
|
227
|
+
}
|
|
228
|
+
}
|
|
229
|
+
return { valid: true, issuerSigned: true, issuerAddress, trustedForSubject, structuralResult, issues };
|
|
177
230
|
}
|
|
178
231
|
//# sourceMappingURL=verifier.js.map
|
package/dist/verifier.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../src/verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../src/verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACzE;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAexE;2FAC2F;AAC3F,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,8EAA8E;IAC9E,iGAAiG;IACjG,2EAA2E;IAC3E,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAE,CAAC;IACjC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAwB,EAAE,CAAC;AAC/E,CAAC;AAiBD;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,EAAwB;IACjE,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,sBAAsB,EAAE,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9C,IAAI,CAAC,EAAE,CAAC,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE,CAAC,iBAAiB;QAAE,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAEpE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,gGAAgG;IAChG,sFAAsF;IACtF,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACpE,CAAC;aAAM,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QACtE,CAAC;aAAM,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QACd,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,EAAE,CAAC,gBAAgB,EAAE,oBAAoB,IAAI,IAAI;YAC/D,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,eAAe,CAAC;SACrC,CAAC;IACJ,CAAC;IAED,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,2BAA4B,EAAE,CAAC,KAAe,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,EAAE,CAAC,gBAAgB,EAAE,oBAAoB,IAAI,IAAI;YAC/D,MAAM;SACP,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,EAAE,CAAC,KAAiC,CAAC;IAEnD,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;QAChG,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,EAAE,CAAC,gBAAgB,EAAE,oBAAoB,IAAI,IAAI;YAC/D,MAAM;SACP,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;IACpC,yFAAyF;IACzF,uEAAuE;IACvE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;IACrG,CAAC;SAAM,IAAI,KAAK,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CACT,yBAAyB,KAAK,CAAC,cAAc,uDAAuD,QAAQ,GAAG,CAChH,CAAC;IACJ,CAAC;IAED,8FAA8F;IAC9F,8FAA8F;IAC9F,kGAAkG;IAClG,wFAAwF;IACxF,MAAM,UAAU,GAAG,iBAAiB,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,4DAA4D,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IACvF,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,CAAC,YAAY,CAAC,iBAAiB,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5F,MAAM,CAAC,IAAI,CACT,yCAAyC,KAAK,CAAC,YAAY,CAAC,iBAAiB,+BAA+B,UAAU,CAAC,OAAO,GAAG,CAClI,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,YAAY,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;YACtD,MAAM,CAAC,IAAI,CACT,+BAA+B,KAAK,CAAC,YAAY,CAAC,OAAO,oCAAoC,UAAU,CAAC,OAAO,GAAG,CACnH,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;YACjF,MAAM,CAAC,IAAI,CACT,6BAA6B,KAAK,CAAC,kBAAkB,oCAAoC,UAAU,CAAC,OAAO,GAAG,CAC/G,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,YAAY,CAAC;QAClC,kBAAkB,EAAE,QAAQ;QAC5B,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC,SAAS,CAAC;QACrC,UAAU,EAAE,YAAY,CAAC,EAAE,CAAC,UAAU,CAAC;QACvC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,OAAO;QACnC,iBAAiB,EAAE,KAAK,CAAC,YAAY,CAAC,iBAAiB;KACxD,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,uCAAuC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAEvF,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC/B,cAAc;QACd,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY;QACZ,YAAY,EAAE,EAAE,CAAC,gBAAgB,EAAE,oBAAoB,IAAI,IAAI;QAC/D,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,uCAAuC,CAAC,MAAc;IAC7D,iDAAiD;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACrC,+FAA+F;IAC/F,+FAA+F;IAC/F,wCAAwC;IACxC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,GAAG,CAAC;AACb,CAAC;AA+ED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAwB,EACxB,MAAuB,EACvB,OAA6B,EAAE;IAE/B,MAAM,gBAAgB,GAAG,0BAA0B,CAAC,EAAE,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,gBAAgB,CAAC,UAAU,IAAI,CAAC,gBAAgB,CAAC,cAAc,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC;QACrG,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC9F,CAAC;IACD,MAAM,UAAU,GAAG,iBAAiB,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC9F,CAAC;IACD,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,CAAC;IACzC,IAAI,EAAW,CAAC;IAChB,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC;YAC3B,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,IAAI,EAAE,gBAAgB,CAAC,cAAc;YACrC,SAAS,EAAE,gBAAgB,CAAC,UAAU;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChG,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;QACnF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IACxF,CAAC;IAED,4FAA4F;IAC5F,iGAAiG;IACjG,IAAI,EAAE,CAAC,gBAAgB,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,MAA4B,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACjG,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;YACvF,CAAC;YACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;gBACxE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;YACxF,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CACT,+JAA+J,CAChK,CAAC;YACF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;QACxF,CAAC;IACH,CAAC;IAED,mGAAmG;IACnG,qGAAqG;IACrG,qGAAqG;IACrG,iGAAiG;IACjG,IAAI,iBAAsC,CAAC;IAC3C,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,iBAAiB,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;QAC3F,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,iBAAiB,GAAG,KAAK,CAAC;YAC1B,MAAM,CAAC,IAAI,CACT,2DAA2D,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACxG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,uFAAuF,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;AACzG,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,17 +1,21 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@agenticprimitives/verifiable-credentials",
|
|
3
|
-
"version": "0.0.0-alpha.
|
|
3
|
+
"version": "0.0.0-alpha.31",
|
|
4
4
|
"description": "W3C Verifiable Credentials envelope + Eip712Signature2026 proof + DOLCE+DnS Situation bases + ontology-shape schema registration. Substrate for layers 12–15 credential types.",
|
|
5
|
+
"homepage": "https://agenticprimitives.dev",
|
|
6
|
+
"bugs": {
|
|
7
|
+
"url": "https://github.com/agentictrustlabs/agenticprimitives/issues"
|
|
8
|
+
},
|
|
9
|
+
"author": {
|
|
10
|
+
"name": "Agentic Trust Labs",
|
|
11
|
+
"url": "https://agenticprimitives.dev"
|
|
12
|
+
},
|
|
5
13
|
"license": "MIT",
|
|
6
14
|
"repository": {
|
|
7
15
|
"type": "git",
|
|
8
16
|
"url": "git+https://github.com/agentictrustlabs/agenticprimitives.git",
|
|
9
17
|
"directory": "packages/verifiable-credentials"
|
|
10
18
|
},
|
|
11
|
-
"homepage": "https://github.com/agentictrustlabs/agenticprimitives/tree/master/packages/verifiable-credentials",
|
|
12
|
-
"bugs": {
|
|
13
|
-
"url": "https://github.com/agentictrustlabs/agenticprimitives/issues"
|
|
14
|
-
},
|
|
15
19
|
"type": "module",
|
|
16
20
|
"main": "./dist/index.js",
|
|
17
21
|
"types": "./dist/index.d.ts",
|
|
@@ -27,32 +31,38 @@
|
|
|
27
31
|
"spec.md",
|
|
28
32
|
"README.md"
|
|
29
33
|
],
|
|
30
|
-
"scripts": {
|
|
31
|
-
"build": "tsc -p tsconfig.build.json",
|
|
32
|
-
"typecheck": "tsc -p tsconfig.json --noEmit",
|
|
33
|
-
"test": "vitest run",
|
|
34
|
-
"test:unit": "vitest run test/unit --passWithNoTests",
|
|
35
|
-
"test:watch": "vitest",
|
|
36
|
-
"clean": "rm -rf dist"
|
|
37
|
-
},
|
|
38
34
|
"publishConfig": {
|
|
39
35
|
"access": "public"
|
|
40
36
|
},
|
|
41
37
|
"peerDependencies": {
|
|
42
|
-
"
|
|
43
|
-
"@agenticprimitives/
|
|
44
|
-
"
|
|
38
|
+
"viem": "^2.52.2",
|
|
39
|
+
"@agenticprimitives/types": "^1.0.0-alpha.34",
|
|
40
|
+
"@agenticprimitives/ontology": "^1.0.0-alpha.34"
|
|
45
41
|
},
|
|
46
42
|
"dependencies": {
|
|
47
|
-
"@noble/hashes": "^2.2.0"
|
|
43
|
+
"@noble/hashes": "^2.2.0",
|
|
44
|
+
"@agenticprimitives/situations": "0.0.0-alpha.18"
|
|
48
45
|
},
|
|
49
46
|
"devDependencies": {
|
|
50
|
-
"vitest": "^4.1.
|
|
47
|
+
"vitest": "^4.1.11",
|
|
51
48
|
"viem": "^2.52.2"
|
|
52
49
|
},
|
|
53
50
|
"keywords": [
|
|
54
51
|
"agentic",
|
|
55
52
|
"primitives",
|
|
56
|
-
"verifiable-credentials"
|
|
57
|
-
|
|
58
|
-
|
|
53
|
+
"verifiable-credentials",
|
|
54
|
+
"agentic-primitives",
|
|
55
|
+
"agenticprimitives",
|
|
56
|
+
"ai-agents",
|
|
57
|
+
"agent-authority",
|
|
58
|
+
"agentic-trust"
|
|
59
|
+
],
|
|
60
|
+
"scripts": {
|
|
61
|
+
"build": "tsc -p tsconfig.build.json",
|
|
62
|
+
"typecheck": "tsc -p tsconfig.json --noEmit",
|
|
63
|
+
"test": "vitest run",
|
|
64
|
+
"test:unit": "vitest run test/unit --passWithNoTests",
|
|
65
|
+
"test:watch": "vitest",
|
|
66
|
+
"clean": "rm -rf dist"
|
|
67
|
+
}
|
|
68
|
+
}
|