@agentidentitytrustprotocol/aitp 0.4.1 → 0.6.0

package/README.md

@@ -36,7 +36,7 @@ minimal build can opt out with `--no-default-features`:
 
 | Feature               | Enables                                                                  | RFC                  |
 |-----------------------|--------------------------------------------------------------------------|----------------------|
-| `renewal`             | `AitpAgent.buildRenewalRequest` / `processRenewalRequest`                | RFC-AITP-0005 §10    |
+| `renewal`             | `AitpAgent.buildRenewalRequest` / `processRenewalRequest`                | RFC-AITP-0013    |
 | `session-bundle`      | `SessionBundleBuilder`, `verifySessionBundle`                            | RFC-AITP-0010        |
 | `spki-pinning`        | `computeSpkiHash`, `SpkiPinVerifier`                                     | HPKP (RFC 7469)      |
 | `multihop-delegation` | `verifyDelegationMultihop`                                               | RFC-AITP-0011        |
@@ -105,7 +105,7 @@ opaque compact-JWS token strings** (`header.payload.signature`).
 | `TctStore` / `verifyTctCached()` | ✅ | Hot-path verify cache: skips the signature check for a byte-identical, still-valid TCT (keyed by SHA-256 of the token bytes) |
 | `verifyDelegation()`      |    ✅    | RFC-AITP-0006 — strict single-hop; rejects any multi-hop `chain`                                               |
 | `verifyManifestJson()`    |    ✅    | Control-plane manifest enrollment                                                                               |
-| `buildRenewalRequest()` / `processRenewalRequest()`           | `renewal` | RFC-AITP-0005 §10 |
+| `buildRenewalRequest()` / `processRenewalRequest()`           | `renewal` | RFC-AITP-0013 |
 | `SessionBundleBuilder`, `verifySessionBundle()`               | `session-bundle`  | RFC-AITP-0010      |
 | `computeSpkiHash()`, `SpkiPinVerifier`                        | `spki-pinning` | HPKP outbound pinning |
 | `verifyDelegationMultihop()`                      | `multihop-delegation` | RFC-AITP-0011 (draft) multi-hop opt-in |

package/index.d.ts

@@ -129,17 +129,17 @@ export interface JsDelegationVerified {
 export declare function verifyDelegation(token: string, verifierAid: string): JsDelegationVerified
 /**
  * Verify a delegation compact JWS allowing **RFC-AITP-0011 multi-hop**
- * chains up to `maxHops` total hops (`chain.length + 1`).
+ * chains up to `maxDelegationHops` total hops (`chain.length + 1`).
  *
  * The strict single-hop `verifyDelegation` is the safe default; this
  * function additionally allows multi-hop chains. Present by default (the
  * `multihop-delegation` feature); a `--no-default-features` build omits it.
  *
- * `maxHops` defaults to `DEFAULT_MAX_HOPS` (3, the RFC-AITP-0011 §2
+ * `maxDelegationHops` defaults to `DEFAULT_MAX_DELEGATION_HOPS` (3, the RFC-AITP-0011 §2
  * recommended ceiling). Pass a smaller value for a tighter bound;
- * `maxHops = 0` reverts to strict single-hop (rejects any non-empty chain).
+ * `maxDelegationHops = 0` reverts to strict single-hop (rejects any non-empty chain).
  */
-export declare function verifyDelegationMultihop(token: string, verifierAid: string, maxHops?: number | undefined | null): JsDelegationVerified
+export declare function verifyDelegationMultihop(token: string, verifierAid: string, maxDelegationHops?: number | undefined | null): JsDelegationVerified
 /**
  * Compute the RFC 7638 JWK thumbprint of the public key embedded in
  * an AID — the value an OIDC IdP MUST place in the JWT's `cnf.jkt`
@@ -157,6 +157,33 @@ export declare function computeAidJkt(aid: string): string
  * a 32-byte Buffer. Throws if `certDer` is not a parseable certificate.
  */
 export declare function computeSpkiHash(certDer: Buffer): Buffer
+/**
+ * Verify a `RevocationListEnvelope` JSON string against a pinned issuer.
+ *
+ * Resolves on success; on failure throws an `Error` whose **`code`** property
+ * is one of `signature_invalid`, `issuer_mismatch`, `version_unknown`,
+ * `expired`, `malformed`. Branch on `error.code`, never on `error.message`:
+ * the code is the contract, the message wording is not.
+ *
+ * Establishes **authenticity and non-expiry only** — that the snapshot was
+ * signed by the holder of `expectedIssuerAid` and that its `expires_at` has
+ * not passed. It deliberately does not check `published_at` staleness:
+ * RFC-AITP-0008 §3 puts freshness policy at the consuming peer, and
+ * collapsing authenticity and freshness into a single switch is how a
+ * `soft_fail` mode ends up reporting a *forged* snapshot as not-revoked.
+ * The caller owns the staleness budget.
+ */
+export declare function verifyRevocationList(envelopeJson: string, expectedIssuerAid: string, nowUnixSecs?: number | undefined | null): void
+/**
+ * The exact bytes a revocation snapshot's signature is computed over:
+ * `JCS(revocation_list)` — the **inner** body, not the transport wrapper.
+ *
+ * Exposed so a caller needing the signed bytes (an independent verifier, an
+ * HSM signing path, a debugging tool) obtains them rather than reconstructing
+ * the shape at the call site. Reconstructing it is how signer, verifier and
+ * conformance fixture drifted apart before 0.5.0.
+ */
+export declare function revocationSigningBytes(envelopeJson: string): Buffer
 /** Result of `processHello`: response body plus session id. */
 export interface JsHelloAckResult {
   /** `MUTUAL_HELLO_ACK` envelope JSON — set as the HTTP response body. */
@@ -332,7 +359,7 @@ export declare class AitpAgent {
   /**
    * Holder side: build a `TctRenewalPayload` JSON for an in-band
    * renewal of `currentTctToken` — the holder's current TCT as a
-   * compact-JWS string (RFC-AITP-0005 §10).
+   * compact-JWS string (RFC-AITP-0013).
    *
    * Behind the `renewal` Cargo feature, which is **on by default**; a
    * `--no-default-features` build omits it.

package/index.js

@@ -310,7 +310,7 @@ if (!nativeBinding) {
   throw new Error(`Failed to load native binding`)
 }
 
-const { AitpAgent, SessionBundleBuilder, verifySessionBundle, verifyDelegation, verifyDelegationMultihop, computeAidJkt, JwksProvider, computeSpkiHash, SpkiPinVerifier, JsInitiatorSession, JsResponderSession, TctStore, verifyManifestJson } = nativeBinding
+const { AitpAgent, SessionBundleBuilder, verifySessionBundle, verifyDelegation, verifyDelegationMultihop, computeAidJkt, JwksProvider, computeSpkiHash, SpkiPinVerifier, verifyRevocationList, revocationSigningBytes, JsInitiatorSession, JsResponderSession, TctStore, verifyManifestJson } = nativeBinding
 
 module.exports.AitpAgent = AitpAgent
 module.exports.SessionBundleBuilder = SessionBundleBuilder
@@ -321,6 +321,8 @@ module.exports.computeAidJkt = computeAidJkt
 module.exports.JwksProvider = JwksProvider
 module.exports.computeSpkiHash = computeSpkiHash
 module.exports.SpkiPinVerifier = SpkiPinVerifier
+module.exports.verifyRevocationList = verifyRevocationList
+module.exports.revocationSigningBytes = revocationSigningBytes
 module.exports.JsInitiatorSession = JsInitiatorSession
 module.exports.JsResponderSession = JsResponderSession
 module.exports.TctStore = TctStore

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentidentitytrustprotocol/aitp",
-  "version": "0.4.1",
+  "version": "0.6.0",
   "description": "Agent Identity Trust Protocol — Node.js SDK",
   "license": "MIT OR Apache-2.0",
   "repository": {
@@ -53,9 +53,9 @@
     "registry": "https://registry.npmjs.org/"
   },
   "optionalDependencies": {
-    "@agentidentitytrustprotocol/aitp-darwin-x64": "0.4.1",
-    "@agentidentitytrustprotocol/aitp-darwin-arm64": "0.4.1",
-    "@agentidentitytrustprotocol/aitp-linux-x64-gnu": "0.4.1",
-    "@agentidentitytrustprotocol/aitp-linux-arm64-gnu": "0.4.1"
+    "@agentidentitytrustprotocol/aitp-darwin-x64": "0.6.0",
+    "@agentidentitytrustprotocol/aitp-darwin-arm64": "0.6.0",
+    "@agentidentitytrustprotocol/aitp-linux-x64-gnu": "0.6.0",
+    "@agentidentitytrustprotocol/aitp-linux-arm64-gnu": "0.6.0"
   }
 }