@bsv/dpp-core 0.3.0-beta.1

package/schemas/publisher-policy.schema.json

@@ -0,0 +1,173 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://bsv-blockchain.github.io/dpp/contracts/publisher-policy.schema.json",
+  "title": "DPP publisher key policy, version 1",
+  "description": "The bounded set of keys authorised to countersign admitted states and anchors for an operator or a federation (spec/services.md section 1). Each policy version is a complete statement; a new version names the digest of the one it supersedes and is authorised by a signature that the previous version's rules accept. A retired key keeps authenticating the states it signed while active, and a state is checked against the key active at the state's time, never against the newest list. Canonical JSON for this document: object keys sorted recursively by code point, no whitespace, arrays in order, undefined members omitted, and only strings, booleans and safe integers as values.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "policyFormat",
+    "policyVersion",
+    "scope",
+    "issuedAt",
+    "publishers",
+    "authorisation"
+  ],
+  "properties": {
+    "policyFormat": {
+      "const": "dpp-publisher-policy@1"
+    },
+    "policyVersion": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "Strictly increasing within one scope."
+    },
+    "scope": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "operatorProfile",
+        "operators"
+      ],
+      "properties": {
+        "operatorProfile": {
+          "enum": [
+            "single-operator@1",
+            "federated-operators@1"
+          ]
+        },
+        "operators": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 64,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Operator identifiers: a DID or a named deployment. Operator identity is distinct from every publisher key below."
+          }
+        },
+        "topics": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "The topics the policy covers; absent means every topic the operators serve."
+        }
+      }
+    },
+    "issuedAt": {
+      "$ref": "#/$defs/dateTime"
+    },
+    "supersedes": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "policyVersion",
+        "sha256"
+      ],
+      "properties": {
+        "policyVersion": {
+          "type": "integer",
+          "minimum": 1
+        },
+        "sha256": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{64}$",
+          "description": "SHA-256 of the superseded policy's canonical JSON, signatures included, so history is a chain and no version is silently rewritten."
+        }
+      }
+    },
+    "publishers": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 256,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "key",
+          "role",
+          "activeFrom"
+        ],
+        "properties": {
+          "key": {
+            "type": "string",
+            "pattern": "^0[23][0-9a-f]{64}$",
+            "description": "Compressed public key. For tm_dpp this is the identity key the service's BRC-42 countersignature derives from; for anchors it is the service identity the anchor's field-8 key derives from."
+          },
+          "role": {
+            "enum": [
+              "state-publisher",
+              "anchor-publisher"
+            ]
+          },
+          "operator": {
+            "type": "string",
+            "description": "Which operator holds the key; absent in a single-operator scope."
+          },
+          "activeFrom": {
+            "$ref": "#/$defs/dateTime"
+          },
+          "retiredAt": {
+            "$ref": "#/$defs/dateTime",
+            "description": "After this instant the key authorises nothing new; states it signed while active remain authentic."
+          },
+          "custody": {
+            "type": "string",
+            "description": "Where the key lives, in the vocabulary of spec/custody.md section 5; informative."
+          }
+        }
+      }
+    },
+    "authorisation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kind",
+        "signer",
+        "suite",
+        "value"
+      ],
+      "properties": {
+        "kind": {
+          "enum": [
+            "genesis",
+            "rotation",
+            "handover"
+          ],
+          "description": "genesis: the first version of a scope, authorised by the identity key of an operator named in scope.operators; rotation: the same operators replace keys, authorised by a key active under the superseded version and, in a federation, countersigned by another operator's identity key; handover: the operator set changes, authorised by a key active under the superseded version and countersigned by an incoming operator's identity key."
+        },
+        "signer": {
+          "type": "string",
+          "pattern": "^0[23][0-9a-f]{64}$"
+        },
+        "suite": {
+          "const": "bsv-ecdsa-der",
+          "description": "ECDSA over SHA-256 of the canonical JSON of this document without authorisation.value and authorisation.countersignature, DER encoded; the countersignature, when present, is over the same bytes."
+        },
+        "value": {
+          "type": "string",
+          "pattern": "^[0-9a-f]+$"
+        },
+        "countersigner": {
+          "type": "string",
+          "pattern": "^0[23][0-9a-f]{64}$"
+        },
+        "countersignature": {
+          "type": "string",
+          "pattern": "^[0-9a-f]+$"
+        }
+      }
+    },
+    "notes": {
+      "type": "string"
+    }
+  },
+  "$defs": {
+    "dateTime": {
+      "type": "string",
+      "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d+)?Z$"
+    }
+  }
+}

package/schemas/verification-report.schema.json

@@ -0,0 +1,397 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://bsv-blockchain.github.io/dpp/contracts/verification-report.schema.json",
+  "title": "DPP verification report, version 1",
+  "description": "The report a verifier produces for one passport's evidence, as spec/verification.md defines. Sixteen named checks, four answers each, an independently expected subject, and an observation of the latest state that is never a proof.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "reportVersion",
+    "checkedAt",
+    "expectedSubject",
+    "suppliedTip",
+    "policyId",
+    "checks",
+    "observations",
+    "limits"
+  ],
+  "properties": {
+    "reportVersion": {
+      "const": "1"
+    },
+    "checkedAt": {
+      "$ref": "#/$defs/dateTime"
+    },
+    "expectedSubject": {
+      "$ref": "#/$defs/expectedSubject"
+    },
+    "suppliedTip": {
+      "oneOf": [
+        {
+          "$ref": "#/$defs/outpoint"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "policyId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256
+    },
+    "checks": {
+      "type": "array",
+      "minItems": 16,
+      "maxItems": 16,
+      "items": {
+        "$ref": "#/$defs/check"
+      },
+      "description": "Exactly one entry per check name, in the order the $defs/checkName enumeration lists them."
+    },
+    "observations": {
+      "$ref": "#/$defs/observations"
+    },
+    "limits": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "minLength": 1
+      }
+    }
+  },
+  "$defs": {
+    "dateTime": {
+      "type": "string",
+      "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})$"
+    },
+    "txid": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{64}$"
+    },
+    "outpoint": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "txid",
+        "outputIndex"
+      ],
+      "properties": {
+        "txid": {
+          "$ref": "#/$defs/txid"
+        },
+        "outputIndex": {
+          "type": "integer",
+          "minimum": 0
+        }
+      }
+    },
+    "expectedSubject": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "passportId",
+        "source"
+      ],
+      "properties": {
+        "passportId": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512
+        },
+        "source": {
+          "enum": [
+            "request-context",
+            "established-binding",
+            "none"
+          ]
+        },
+        "productIdentifier": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512
+        },
+        "expectedIssuer": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512
+        },
+        "expectedGenesisOutpoint": {
+          "$ref": "#/$defs/outpoint"
+        },
+        "expectedStateOutpoint": {
+          "$ref": "#/$defs/outpoint"
+        }
+      }
+    },
+    "checkName": {
+      "enum": [
+        "recordEncoding",
+        "actorSignatures",
+        "publisherSignatures",
+        "linkage",
+        "inclusion",
+        "nativeAttestationSignature",
+        "anchorSignature",
+        "anchorKeyDerivation",
+        "anchorDigestAndMetadataBinding",
+        "externalCredentialProof",
+        "subjectBinding",
+        "issuerAuthority",
+        "schema",
+        "credentialTime",
+        "credentialStatus",
+        "evidenceAvailability"
+      ]
+    },
+    "checkStatus": {
+      "enum": [
+        "pass",
+        "fail",
+        "unknown",
+        "not-applicable"
+      ]
+    },
+    "reasonCode": {
+      "type": "string",
+      "description": "A shared code from the sharedReasonCode list, or an implementation code beginning with x-.",
+      "anyOf": [
+        {
+          "$ref": "#/$defs/sharedReasonCode"
+        },
+        {
+          "pattern": "^x-[a-z0-9]+(-[a-z0-9]+)*$"
+        }
+      ]
+    },
+    "sharedReasonCode": {
+      "enum": [
+        "no-evidence",
+        "not-selected",
+        "publisher-not-selected",
+        "publisher-not-authorised",
+        "publisher-policy-invalid",
+        "decode-failed",
+        "signature-invalid",
+        "key-derivation-mismatch",
+        "link-broken",
+        "consent-not-proven",
+        "acceptance-commitment-absent",
+        "version-transition-invalid",
+        "control-not-proven",
+        "lineage-retired",
+        "proof-absent",
+        "proof-refuted",
+        "header-source-unavailable",
+        "digest-mismatch",
+        "metadata-mismatch",
+        "secured-bytes-absent",
+        "representation-unsupported",
+        "suite-unsupported",
+        "no-external-credential",
+        "subject-mismatch",
+        "subject-not-independent",
+        "genesis-ambiguous",
+        "genesis-mismatch",
+        "state-mismatch",
+        "issuer-mismatch",
+        "policy-missing",
+        "authority-not-required",
+        "authority-unconfirmed",
+        "authority-unavailable",
+        "schema-invalid",
+        "schema-unavailable",
+        "not-yet-valid",
+        "expired",
+        "time-invalid",
+        "status-unset",
+        "status-revoked",
+        "status-suspended",
+        "status-unknown",
+        "status-unauthenticated",
+        "status-stale",
+        "status-purpose-unsupported",
+        "format-defines-no-status",
+        "referenced-artefact-unavailable",
+        "referenced-artefact-mismatch",
+        "verifier-not-supplied",
+        "not-inspected",
+        "resource-limit"
+      ]
+    },
+    "check": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "name",
+        "status",
+        "evidenceRefs"
+      ],
+      "properties": {
+        "name": {
+          "$ref": "#/$defs/checkName"
+        },
+        "status": {
+          "$ref": "#/$defs/checkStatus"
+        },
+        "reasonCode": {
+          "$ref": "#/$defs/reasonCode"
+        },
+        "evidenceRefs": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "scope": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "artefact": {
+              "type": "string"
+            },
+            "digest": {
+              "type": "string",
+              "pattern": "^[0-9a-f]{64}$"
+            },
+            "outpoint": {
+              "$ref": "#/$defs/outpoint"
+            },
+            "stateIndex": {
+              "type": "integer",
+              "minimum": 0
+            }
+          }
+        },
+        "detail": {}
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "status": {
+                "enum": [
+                  "fail",
+                  "unknown",
+                  "not-applicable"
+                ]
+              }
+            }
+          },
+          "then": {
+            "required": [
+              "reasonCode"
+            ]
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "status": {
+                "const": "pass"
+              }
+            }
+          },
+          "then": {
+            "properties": {
+              "evidenceRefs": {
+                "minItems": 1
+              }
+            }
+          }
+        }
+      ]
+    },
+    "observationSource": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "kind",
+        "observedAt",
+        "result"
+      ],
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1
+        },
+        "kind": {
+          "enum": [
+            "overlay-lookup",
+            "spend-status",
+            "header-source",
+            "registry",
+            "other"
+          ]
+        },
+        "observedAt": {
+          "$ref": "#/$defs/dateTime"
+        },
+        "result": {
+          "enum": [
+            "unspent",
+            "spent",
+            "not-found",
+            "unavailable",
+            "conflicting"
+          ]
+        },
+        "height": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "blockHash": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{64}$"
+        },
+        "spendingTxid": {
+          "$ref": "#/$defs/txid"
+        },
+        "detail": {
+          "type": "string"
+        }
+      }
+    },
+    "observations": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "latestState",
+        "sources",
+        "queryScope",
+        "observedAt",
+        "candidateOutpoints"
+      ],
+      "properties": {
+        "latestState": {
+          "enum": [
+            "observed",
+            "superseded",
+            "conflicting",
+            "unknown"
+          ]
+        },
+        "sources": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/observationSource"
+          }
+        },
+        "queryScope": {
+          "type": "string"
+        },
+        "observedAt": {
+          "$ref": "#/$defs/dateTime"
+        },
+        "candidateOutpoints": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/outpoint"
+          }
+        }
+      }
+    }
+  }
+}