@agentidentitytrustprotocol/aitp 0.3.0 → 0.4.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/README.md +23 -22
  2. package/index.d.ts +12 -15
  3. package/index.js +2 -2
  4. package/package.json +7 -7
package/README.md CHANGED
@@ -15,33 +15,34 @@ the [NAPI-rs CLI](https://napi.rs):
15
15
 
16
16
  ```bash
17
17
  npm install
18
- npm run build:debug # default `.node` (v0.1 surface only)
19
- npm run build:experimental:debug # default + post-v0.1 features
18
+ npm run build:debug # full `.node` (all capabilities)
19
+ npm run build:minimal:debug # minimal `.node` (core surface only)
20
20
  # Release:
21
- npm run build # default release
22
- npm run build:experimental # default + experimental, release
21
+ npm run build # full release (all capabilities)
22
+ npm run build:minimal # minimal release (--no-default-features)
23
23
  ```
24
24
 
25
25
  This produces `aitp.node` and `index.js` in the package root. Generated
26
- TypeScript typings (`index.d.ts`) include the experimental surface only
27
- when the artifact was built with the `experimental` feature.
26
+ TypeScript typings (`index.d.ts`) cover the full surface; a
27
+ `--no-default-features` build narrows it accordingly.
28
28
 
29
29
  ### Cargo features
30
30
 
31
- The default `.node` exposes the v0.1 surface (handshake, TCT, delegation,
32
- manifest verify, revocation-list signing, OIDC identity). Three post-v0.1
33
- capabilities live behind opt-in Cargo features:
31
+ The published `.node` ships the **full** capability surface by default —
32
+ handshake, TCT, delegation, manifest verify, revocation-list signing, OIDC
33
+ identity, **plus** TCT renewal, session bundles, SPKI pinning, and multi-hop
34
+ delegation. Each capability is a named feature (all on by default) so a
35
+ minimal build can opt out with `--no-default-features`:
34
36
 
35
- | Feature | Enables | RFC |
36
- |---------------------------|--------------------------------------------------------------------------|----------------------|
37
- | `experimental-renewal` | `AitpAgent.buildRenewalRequest` / `processRenewalRequest` | RFC-AITP-0005 §10 |
38
- | `experimental-bundle` | `SessionBundleBuilder`, `verifySessionBundle` | RFC-AITP-0010 |
39
- | `experimental-pinning` | `computeSpkiHash`, `SpkiPinVerifier` | HPKP (RFC 7469) |
40
- | `experimental-multihop-delegation` | `verifyDelegationExperimentalMultihop` | RFC-AITP-0011 |
41
- | `experimental` (umbrella) | All four above | |
37
+ | Feature | Enables | RFC |
38
+ |-----------------------|--------------------------------------------------------------------------|----------------------|
39
+ | `renewal` | `AitpAgent.buildRenewalRequest` / `processRenewalRequest` | RFC-AITP-0005 §10 |
40
+ | `session-bundle` | `SessionBundleBuilder`, `verifySessionBundle` | RFC-AITP-0010 |
41
+ | `spki-pinning` | `computeSpkiHash`, `SpkiPinVerifier` | HPKP (RFC 7469) |
42
+ | `multihop-delegation` | `verifyDelegationMultihop` | RFC-AITP-0011 |
42
43
 
43
- Each post-v0.1 capability does **not** promise wire stability until the
44
- underlying RFC graduates.
44
+ Capabilities whose underlying RFC has not yet graduated do not promise wire
45
+ stability across binding versions.
45
46
 
46
47
  ## Usage
47
48
 
@@ -104,10 +105,10 @@ opaque compact-JWS token strings** (`header.payload.signature`).
104
105
  | `TctStore` / `verifyTctCached()` | ✅ | Hot-path verify cache: skips the signature check for a byte-identical, still-valid TCT (keyed by SHA-256 of the token bytes) |
105
106
  | `verifyDelegation()` | ✅ | RFC-AITP-0006 — strict single-hop; rejects any multi-hop `chain` |
106
107
  | `verifyManifestJson()` | ✅ | Control-plane manifest enrollment |
107
- | `buildRenewalRequest()` / `processRenewalRequest()` | `experimental-renewal` | RFC-AITP-0005 §10 |
108
- | `SessionBundleBuilder`, `verifySessionBundle()` | `experimental-bundle` | RFC-AITP-0010 |
109
- | `computeSpkiHash()`, `SpkiPinVerifier` | `experimental-pinning` | HPKP outbound pinning |
110
- | `verifyDelegationExperimentalMultihop()` | `experimental-multihop-delegation` | RFC-AITP-0011 (draft) multi-hop opt-in |
108
+ | `buildRenewalRequest()` / `processRenewalRequest()` | `renewal` | RFC-AITP-0005 §10 |
109
+ | `SessionBundleBuilder`, `verifySessionBundle()` | `session-bundle` | RFC-AITP-0010 |
110
+ | `computeSpkiHash()`, `SpkiPinVerifier` | `spki-pinning` | HPKP outbound pinning |
111
+ | `verifyDelegationMultihop()` | `multihop-delegation` | RFC-AITP-0011 (draft) multi-hop opt-in |
111
112
 
112
113
  ### Revocation
113
114
 
package/index.d.ts CHANGED
@@ -121,27 +121,25 @@ export interface JsDelegationVerified {
121
121
  * string — it MUST equal the delegation's `aud` (the root grantor), and
122
122
  * the embedded voucher MUST verify under the verifier's own key.
123
123
  *
124
- * Any token carrying a non-empty `chain` (a draft RFC-AITP-0011 multi-hop
124
+ * Any token carrying a non-empty `chain` (an RFC-AITP-0011 multi-hop
125
125
  * delegation) is **rejected** with `DELEGATION_MULTIHOP_NOT_SUPPORTED`,
126
- * matching the Rust core default. To opt into multi-hop, build the SDK with
127
- * the `experimental-multihop-delegation` feature and call
128
- * `verifyDelegationExperimentalMultihop`.
126
+ * matching the Rust core default. To allow multi-hop chains, call
127
+ * `verifyDelegationMultihop` instead.
129
128
  */
130
129
  export declare function verifyDelegation(token: string, verifierAid: string): JsDelegationVerified
131
130
  /**
132
- * Verify a delegation compact JWS allowing **draft RFC-AITP-0011
133
- * multi-hop** chains up to `maxHops` total hops (`chain.length + 1`).
131
+ * Verify a delegation compact JWS allowing **RFC-AITP-0011 multi-hop**
132
+ * chains up to `maxHops` total hops (`chain.length + 1`).
134
133
  *
135
- * This opts into behavior that is **not** part of the v0.2 strict
136
- * default. It is only compiled in under the
137
- * `experimental-multihop-delegation` feature; a default build exposes
138
- * only the strict `verifyDelegation`.
134
+ * The strict single-hop `verifyDelegation` is the safe default; this
135
+ * function additionally allows multi-hop chains. Present by default (the
136
+ * `multihop-delegation` feature); a `--no-default-features` build omits it.
139
137
  *
140
138
  * `maxHops` defaults to `DEFAULT_MAX_HOPS` (3, the RFC-AITP-0011 §2
141
139
  * recommended ceiling). Pass a smaller value for a tighter bound;
142
140
  * `maxHops = 0` reverts to strict single-hop (rejects any non-empty chain).
143
141
  */
144
- export declare function verifyDelegationExperimentalMultihop(token: string, verifierAid: string, maxHops?: number | undefined | null): JsDelegationVerified
142
+ export declare function verifyDelegationMultihop(token: string, verifierAid: string, maxHops?: number | undefined | null): JsDelegationVerified
145
143
  /**
146
144
  * Compute the RFC 7638 JWK thumbprint of the public key embedded in
147
145
  * an AID — the value an OIDC IdP MUST place in the JWT's `cnf.jkt`
@@ -336,16 +334,15 @@ export declare class AitpAgent {
336
334
  * renewal of `currentTctToken` — the holder's current TCT as a
337
335
  * compact-JWS string (RFC-AITP-0005 §10).
338
336
  *
339
- * **Gated by the `experimental-renewal` Cargo feature.** Off in
340
- * the default `.node` artifact; build with
341
- * `napi build --release -- --features experimental-renewal`.
337
+ * Behind the `renewal` Cargo feature, which is **on by default**; a
338
+ * `--no-default-features` build omits it.
342
339
  */
343
340
  buildRenewalRequest(currentTctToken: string): string
344
341
  /**
345
342
  * Issuer side: verify a `TctRenewalPayload` JSON request and mint a
346
343
  * fresh TCT, returned as a compact-JWS token string.
347
344
  *
348
- * **Gated by the `experimental-renewal` Cargo feature.**
345
+ * Behind the `renewal` Cargo feature (on by default).
349
346
  */
350
347
  processRenewalRequest(requestPayloadJson: string, manifestExpUnixSecs: number, newTtlSecs: number): string
351
348
  }
package/index.js CHANGED
@@ -310,13 +310,13 @@ if (!nativeBinding) {
310
310
  throw new Error(`Failed to load native binding`)
311
311
  }
312
312
 
313
- const { AitpAgent, SessionBundleBuilder, verifySessionBundle, verifyDelegation, verifyDelegationExperimentalMultihop, computeAidJkt, JwksProvider, computeSpkiHash, SpkiPinVerifier, JsInitiatorSession, JsResponderSession, TctStore, verifyManifestJson } = nativeBinding
313
+ const { AitpAgent, SessionBundleBuilder, verifySessionBundle, verifyDelegation, verifyDelegationMultihop, computeAidJkt, JwksProvider, computeSpkiHash, SpkiPinVerifier, JsInitiatorSession, JsResponderSession, TctStore, verifyManifestJson } = nativeBinding
314
314
 
315
315
  module.exports.AitpAgent = AitpAgent
316
316
  module.exports.SessionBundleBuilder = SessionBundleBuilder
317
317
  module.exports.verifySessionBundle = verifySessionBundle
318
318
  module.exports.verifyDelegation = verifyDelegation
319
- module.exports.verifyDelegationExperimentalMultihop = verifyDelegationExperimentalMultihop
319
+ module.exports.verifyDelegationMultihop = verifyDelegationMultihop
320
320
  module.exports.computeAidJkt = computeAidJkt
321
321
  module.exports.JwksProvider = JwksProvider
322
322
  module.exports.computeSpkiHash = computeSpkiHash
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@agentidentitytrustprotocol/aitp",
3
- "version": "0.3.0",
3
+ "version": "0.4.1",
4
4
  "description": "Agent Identity Trust Protocol — Node.js SDK",
5
5
  "license": "MIT OR Apache-2.0",
6
6
  "repository": {
@@ -31,8 +31,8 @@
31
31
  "scripts": {
32
32
  "build": "napi build --platform --release",
33
33
  "build:debug": "napi build --platform",
34
- "build:experimental": "napi build --platform --release --features experimental",
35
- "build:experimental:debug": "napi build --platform --features experimental",
34
+ "build:minimal": "napi build --platform --release --no-default-features",
35
+ "build:minimal:debug": "napi build --platform --no-default-features",
36
36
  "artifacts": "napi artifacts",
37
37
  "prepublishOnly": "napi prepublish -t npm",
38
38
  "version": "napi version",
@@ -53,9 +53,9 @@
53
53
  "registry": "https://registry.npmjs.org/"
54
54
  },
55
55
  "optionalDependencies": {
56
- "@agentidentitytrustprotocol/aitp-darwin-x64": "0.3.0",
57
- "@agentidentitytrustprotocol/aitp-darwin-arm64": "0.3.0",
58
- "@agentidentitytrustprotocol/aitp-linux-x64-gnu": "0.3.0",
59
- "@agentidentitytrustprotocol/aitp-linux-arm64-gnu": "0.3.0"
56
+ "@agentidentitytrustprotocol/aitp-darwin-x64": "0.4.1",
57
+ "@agentidentitytrustprotocol/aitp-darwin-arm64": "0.4.1",
58
+ "@agentidentitytrustprotocol/aitp-linux-x64-gnu": "0.4.1",
59
+ "@agentidentitytrustprotocol/aitp-linux-arm64-gnu": "0.4.1"
60
60
  }
61
61
  }