@atlasauth/pca-sdjwt 0.1.0 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/LICENSE +21 -0
  2. package/README.md +54 -0
  3. package/package.json +26 -3
package/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2026 Atlas Authorization
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
package/README.md ADDED
@@ -0,0 +1,54 @@
1
+ # @atlasauth/pca-sdjwt
2
+
3
+ SD-JWT serialization of a Proof-Carrying Authority action proof (PCActn), so PCA proofs drop into existing JWT / SD-JWT tooling. The standard claims (`iss`, `sub`, `aud`, `iat`, `exp`, `ver`) stay in the clear; the capability claims (`action`, `plan`, `cap_chain`, `sig`, and so on) are selectively disclosable, with optional holder key binding (KB-JWT). It is a bridge, not a replacement: the PCActn's own canonical signature rides along as a disclosable `sig` claim and stays the source of truth.
4
+
5
+ ## Install
6
+
7
+ ```sh
8
+ npm i @atlasauth/pca-sdjwt @atlasauth/pca jose
9
+ ```
10
+
11
+ ## Usage
12
+
13
+ ```ts
14
+ import { issuePcaSdJwt, present, verifyPcaSdJwt, importEd25519PrivateKey } from '@atlasauth/pca-sdjwt';
15
+
16
+ // Issuer: serialize a signed PCActn. `keyBinding: {}` embeds the leaf holder as the `cnf` key.
17
+ const sdjwt = await issuePcaSdJwt(pcactn, { issuerKey, keyBinding: {} });
18
+
19
+ // Holder: disclose only some claims and bind the presentation to the verifier (KB-JWT).
20
+ const presentation = await present(sdjwt, ['action', 'sig'], {
21
+ keyBinding: {
22
+ holderKey: importEd25519PrivateKey(agentSecretKey), // raw 32-byte PCA seed -> jose key
23
+ audience: 'https://rs.example.com',
24
+ nonce: 'n-123',
25
+ },
26
+ });
27
+
28
+ // Verifier: fail-closed.
29
+ const res = await verifyPcaSdJwt(presentation, {
30
+ issuerKey: issuerPublicKey,
31
+ expectedAudience: 'https://rs.example.com',
32
+ requireKeyBinding: true,
33
+ expectedNonce: 'n-123',
34
+ requiredDisclosures: ['action'],
35
+ });
36
+ if (res.ok) console.log(res.disclosed, res.keyBinding); // { action, sig }, { presented, verified, aud, nonce }
37
+ else console.error(res.reason);
38
+ ```
39
+
40
+ `issuerKey` is a jose `KeyLike` (a Node `KeyObject` works); the default algorithm is EdDSA.
41
+
42
+ ## API
43
+
44
+ - `issuePcaSdJwt(pcactn, options)`, `present(sdjwt, claimNames, options?)`, `verifyPcaSdJwt(sdjwt, options)`.
45
+ - Key helpers: `ed25519PublicJwk`, `importEd25519PrivateKey`, `importEd25519PublicKey` (bridge raw PCA Ed25519 keys to jose).
46
+ - Constants: `PCA_CAPABILITY_CLAIMS`, `SD_ALG`, `PCA_SD_JWT_TYP`, `KB_JWT_TYP`, `DEFAULT_SIGNING_ALG`.
47
+
48
+ ## Status
49
+
50
+ Experimental. Verifying an SD-JWT checks the issuer's JWT signature, disclosure digests and key binding. It does not re-run the PCA verification of the embedded chain, plan and `sig`; do that with `@atlasauth/pca` on the recovered claims. The SD-JWT specification is still moving, and this package is unaudited.
51
+
52
+ ## License
53
+
54
+ MIT - see LICENSE
package/package.json CHANGED
@@ -1,7 +1,26 @@
1
1
  {
2
2
  "name": "@atlasauth/pca-sdjwt",
3
- "version": "0.1.0",
3
+ "version": "0.2.0",
4
4
  "description": "SD-JWT serialization of a PCActn for PCA: emit/verify a PCActn (and its capability claims) as a selectively-disclosable SD-JWT so PCA proofs drop into existing JWT/SD-JWT verifiers and align with WIMSE / AP2 mandate shape.",
5
+ "keywords": [
6
+ "sd-jwt",
7
+ "selective disclosure",
8
+ "jwt",
9
+ "agent authorization",
10
+ "proof-carrying authority",
11
+ "pca",
12
+ "ai agents"
13
+ ],
14
+ "license": "MIT",
15
+ "homepage": "https://github.com/Atlas-Authorization/pca#readme",
16
+ "bugs": {
17
+ "url": "https://github.com/Atlas-Authorization/pca/issues"
18
+ },
19
+ "repository": {
20
+ "type": "git",
21
+ "url": "git+https://github.com/Atlas-Authorization/pca.git",
22
+ "directory": "packages/pca-sdjwt"
23
+ },
5
24
  "main": "./dist/index.js",
6
25
  "types": "./dist/index.d.ts",
7
26
  "exports": {
@@ -13,7 +32,7 @@
13
32
  },
14
33
  "dependencies": {
15
34
  "jose": "^5.9.6",
16
- "@atlasauth/pca": "0.1.0"
35
+ "@atlasauth/pca": "0.2.0"
17
36
  },
18
37
  "devDependencies": {
19
38
  "typescript": "^5.6.3",
@@ -21,8 +40,12 @@
21
40
  },
22
41
  "files": [
23
42
  "dist",
24
- "README.md"
43
+ "README.md",
44
+ "LICENSE"
25
45
  ],
46
+ "engines": {
47
+ "node": ">=20"
48
+ },
26
49
  "publishConfig": {
27
50
  "access": "public"
28
51
  },