@bsv/vsc 0.2.0-beta.1

package/dist/types.d.ts

@@ -0,0 +1,159 @@
+export type JsonObject = {
+    [key: string]: unknown;
+};
+export type DocumentLoader = (url: string) => Promise<{
+    document: JsonObject;
+    documentUrl?: string;
+    contextUrl?: string | null;
+}>;
+export interface Issue {
+    code: string;
+    path: string;
+    message: string;
+}
+export type CheckOutcome = 'verified' | 'invalid' | 'indeterminate' | 'unsupported' | 'not-required';
+export interface Check {
+    outcome: CheckOutcome;
+    issues: Issue[];
+    evidence?: string[];
+}
+export interface Proof extends JsonObject {
+    type: string;
+    verificationMethod: string;
+    proofPurpose: string;
+    proofValue: string;
+    created?: string;
+    cryptosuite?: string;
+}
+export interface Credential extends JsonObject {
+    '@context': string[];
+    type: string[];
+    id: string;
+    issuer: string;
+    validFrom: string;
+    validUntil?: string;
+    credentialSubject: JsonObject;
+    credentialStatus?: StatusEntry;
+    proof?: Proof | Proof[];
+}
+export interface StatusEntry extends JsonObject {
+    id: string;
+    type: 'BitstringStatusListEntry';
+    statusPurpose: 'revocation' | 'suspension';
+    statusListIndex: string;
+    statusListCredential: string;
+}
+export interface ProductIdentifier extends JsonObject {
+    scheme: string;
+    value: string;
+    schemeAuthority: string;
+    serialNumber?: string;
+}
+export type Topology = 'linear' | 'fork' | 'merge' | 'transform' | 'correction';
+export interface Seal extends Credential {
+    sealVersion: '1.0';
+    issuanceDate: string;
+    sealTimestamp: string;
+    correctionOf: string | null;
+    credentialStatus: StatusEntry;
+    eventVector: {
+        what: {
+            productIdentifiers: ProductIdentifier[];
+            quantity?: number;
+            quantityUnit?: string;
+            [key: string]: unknown;
+        };
+        when: {
+            eventTime: string;
+            recordedAt: string;
+            timezone: string;
+            timePrecision: 'millisecond' | 'second' | 'minute';
+        };
+        where: {
+            jurisdiction: string;
+            [key: string]: unknown;
+        };
+        who: {
+            actorDid: string;
+            actorRole: string;
+            assertionMethod: string;
+            [key: string]: unknown;
+        };
+        how: {
+            eventType: string;
+            eventTypeVocab: string;
+            businessStep: string;
+            disposition: string;
+            action: 'ADD' | 'OBSERVE' | 'DELETE';
+        };
+    };
+    extensions: {
+        '+Dn': Record<string, JsonObject>;
+    };
+    chainOfCustody: {
+        chainId: string;
+        sequenceNumber: number;
+        parentSeals: string[];
+        childSeals?: string[];
+        topology: Topology;
+        topologyNote?: string;
+    };
+}
+export interface StatusPolicy {
+    id: string;
+    resolve: (url: string) => Promise<Credential>;
+    /** Maximum age of the signed list's validFrom, not of an unauthenticated HTTP response. */
+    maxAgeMs: number;
+    /** Explicit policy grants for third-party list issuers, indexed by credential issuer DID. */
+    delegatedListIssuers?: Readonly<Record<string, readonly string[]>>;
+}
+export type AuthorityPolicy = {
+    id: string;
+    required: false;
+    reason: string;
+} | {
+    id: string;
+    required: true;
+    trustAnchors: readonly string[];
+    /** Returns signed VscEventAuthorisation credentials. This function does not decide validity. */
+    resolve: (issuer: string) => Promise<Credential[]>;
+};
+export interface VerificationOptions {
+    credential: Seal;
+    documentLoader: DocumentLoader;
+    evaluationTime?: string;
+    statusPolicy?: StatusPolicy;
+    authorityPolicy?: AuthorityPolicy;
+    resolveSeal?: (id: string) => Promise<Seal | undefined>;
+    /** The caller supplies the complete discovered candidate set for the stated evidence scope. */
+    corrections?: Seal[];
+    correctionPolicy?: {
+        id: string;
+        resolve: (originalIssuer: string, delegate: string) => Promise<Credential[]>;
+    };
+    limits?: {
+        maxDepth?: number;
+        maxNodes?: number;
+        maxParents?: number;
+        timeoutMs?: number;
+    };
+}
+export interface VerificationResult {
+    profileId: string;
+    upstreamRevision: string;
+    evaluatedAt: string;
+    outcome: 'verified' | 'invalid' | 'indeterminate' | 'unsupported';
+    checks: {
+        structure: Check;
+        proof: Check;
+        temporal: Check;
+        status: Check;
+        authority: Check;
+        chain: Check;
+        corrections: Check;
+    };
+    issues: Issue[];
+    /** Verification is scoped to supplied/discovered evidence, and does not establish global freshness. */
+    evidenceScope: 'provided-evidence';
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AACpD,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,QAAQ,EAAE,UAAU,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAAC;AAClI,MAAM,WAAW,KAAK;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACtE,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,eAAe,GAAG,aAAa,GAAG,cAAc,CAAC;AACrG,MAAM,WAAW,KAAK;IAAG,OAAO,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE;AACtF,MAAM,WAAW,KAAM,SAAQ,UAAU;IACvC,IAAI,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CACxC;AACD,MAAM,WAAW,UAAW,SAAQ,UAAU;IAC5C,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IACjE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,UAAU,CAAC;IACtE,gBAAgB,CAAC,EAAE,WAAW,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,GAAG,KAAK,EAAE,CAAC;CACzD;AACD,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,0BAA0B,CAAC;IAAC,aAAa,EAAE,YAAY,GAAG,YAAY,CAAC;IACzF,eAAe,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAC;CACvD;AACD,MAAM,WAAW,iBAAkB,SAAQ,UAAU;IACnD,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAC/E;AACD,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,YAAY,CAAC;AAChF,MAAM,WAAW,IAAK,SAAQ,UAAU;IACtC,WAAW,EAAE,KAAK,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7F,gBAAgB,EAAE,WAAW,CAAC;IAC9B,WAAW,EAAE;QACX,IAAI,EAAE;YAAE,kBAAkB,EAAE,iBAAiB,EAAE,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;YAAC,YAAY,CAAC,EAAE,MAAM,CAAC;YAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC;QACpH,IAAI,EAAE;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,aAAa,EAAE,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAA;SAAE,CAAC;QACtH,KAAK,EAAE;YAAE,YAAY,EAAE,MAAM,CAAC;YAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC;QACxD,GAAG,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAC;YAAC,eAAe,EAAE,MAAM,CAAC;YAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC;QAC9F,GAAG,EAAE;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,cAAc,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,KAAK,GAAG,SAAS,GAAG,QAAQ,CAAA;SAAE,CAAC;KACrI,CAAC;IACF,UAAU,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;KAAE,CAAC;IAClD,cAAc,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,QAAQ,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACtJ;AACD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9C,2FAA2F;IAC3F,QAAQ,EAAE,MAAM,CAAC;IACjB,6FAA6F;IAC7F,oBAAoB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CACpE;AACD,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAC9E,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5D,gGAAgG;IAChG,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;CACpD,CAAC;AACF,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,IAAI,CAAC;IAAC,cAAc,EAAE,cAAc,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAC1E,YAAY,CAAC,EAAE,YAAY,CAAC;IAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC/D,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IACxD,+FAA+F;IAC/F,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC;IACrB,gBAAgB,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;KAAE,CAAC;IAChH,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5F;AACD,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IACjE,OAAO,EAAE,UAAU,GAAG,SAAS,GAAG,eAAe,GAAG,aAAa,CAAC;IAClE,MAAM,EAAE;QAAE,SAAS,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,KAAK,CAAC;QAAC,QAAQ,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,KAAK,CAAC;QAAC,SAAS,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,KAAK,CAAC;QAAC,WAAW,EAAE,KAAK,CAAA;KAAE,CAAC;IAC/H,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,uGAAuG;IACvG,aAAa,EAAE,mBAAmB,CAAC;CACpC"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/dist/validation.d.ts

@@ -0,0 +1,22 @@
+import type { Issue, Seal } from './types.js';
+export declare function validateSealStructure(value: unknown, { requireProof }?: {
+    requireProof?: boolean | undefined;
+}): {
+    valid: boolean;
+    errors: Issue[];
+};
+export declare const disclosureSchema: any;
+export declare function validateSealPresentationStructure(value: unknown): {
+    valid: boolean;
+    errors: Issue[];
+};
+/** Parses exact input without replacing its bytes. Rejects duplicate keys before interpretation. */
+export declare function parseStrictJsonBytes(bytes: Uint8Array): unknown;
+export declare function parseSealBytes(bytes: Uint8Array): Seal;
+export declare function extractSealMetadata(seal: Seal): {
+    id: string;
+    issuer: string;
+    type: "VSC-SEAL";
+    subjects: string[];
+};
+//# sourceMappingURL=validation.d.ts.map

package/dist/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAK9C,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,YAAmB,EAAE;;CAAK,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,KAAK,EAAE,CAAA;CAAE,CA6BvH;AAED,eAAO,MAAM,gBAAgB,EAAE,GAAiC,CAAC;AAOjE,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,KAAK,EAAE,CAAA;CAAE,CASrG;AAED,oGAAoG;AACpG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAqB/D;AACD,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAKtD;AACD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI;;;;;EAE7C"}

package/dist/validation.js

@@ -0,0 +1,147 @@
+import { Ajv } from 'ajv';
+import addFormats from 'ajv-formats';
+import { sealSchema } from './schema.js';
+import { CONTEXT_URL } from './context.js';
+const ajv = new Ajv({ allErrors: true, strict: false });
+addFormats(ajv);
+const validateSecured = ajv.compile(sealSchema);
+const validateUnsigned = ajv.compile({ ...sealSchema, $id: `${sealSchema.$id}:unsigned`, required: sealSchema.required.filter(key => key !== 'proof') });
+export function validateSealStructure(value, { requireProof = true } = {}) {
+    const validate = requireProof ? validateSecured : validateUnsigned;
+    if (!validate(value))
+        return { valid: false, errors: (validate.errors ?? []).map(e => ({ code: 'schema', path: e.instancePath, message: e.message ?? 'Invalid field' })) };
+    const seal = value;
+    const errors = [];
+    const issue = (path, message) => errors.push({ code: 'structure', path, message });
+    if (seal['@context'][0] !== 'https://www.w3.org/ns/credentials/v2' || !seal['@context'].includes(CONTEXT_URL))
+        issue('/@context', 'The owned profile context and VC2 context are required');
+    if (requireProof && !seal.proof)
+        issue('/proof', 'A secured credential is required');
+    if (seal.issuer !== seal.eventVector.who.actorDid)
+        issue('/eventVector/who/actorDid', 'Actor DID must equal issuer');
+    if (seal.credentialSubject.id !== seal.id)
+        issue('/credentialSubject/id', 'This profile identifies the attestation as the credential subject; product identifiers are separate');
+    const { parentSeals, topology } = seal.chainOfCustody;
+    const mirrored = seal.credentialSubject.predecessorCredentials;
+    if (parentSeals.length && (!Array.isArray(mirrored) || JSON.stringify([...parentSeals].sort()) !== JSON.stringify([...mirrored].sort())))
+        issue('/credentialSubject/predecessorCredentials', 'Predecessor references must match the custody parents');
+    if (parentSeals.includes(seal.id))
+        issue('/chainOfCustody/parentSeals', 'A credential cannot be its own parent');
+    if (seal.correctionOf === null && topology === 'correction')
+        issue('/correctionOf', 'Correction topology requires a target');
+    if (seal.correctionOf !== null && (topology !== 'correction' || parentSeals.length !== 1 || parentSeals[0] !== seal.correctionOf))
+        issue('/correctionOf', 'This profile requires exactly the correction target as its parent');
+    if (topology === 'linear' && parentSeals.length > 1)
+        issue('/chainOfCustody/parentSeals', 'Linear records have at most one parent');
+    if (['merge', 'transform'].includes(topology) && parentSeals.length < 2)
+        issue('/chainOfCustody/parentSeals', 'Merge records require multiple parents');
+    if (topology === 'fork' && (seal.chainOfCustody.childSeals?.length ?? 0) < 2)
+        issue('/chainOfCustody/childSeals', 'Fork records preallocate at least two child identifiers');
+    const how = seal.eventVector.how;
+    const epcis = ['ObjectEvent', 'AggregationEvent', 'TransformationEvent', 'TransactionEvent', 'AssociationEvent'];
+    if (how.eventTypeVocab === 'urn:epcis:cbv:v2' ? !epcis.includes(how.eventType) : !how.eventType.startsWith('urn:'))
+        issue('/eventVector/how/eventType', 'Event type must belong to its declared vocabulary');
+    const proofs = Array.isArray(seal.proof) ? seal.proof : seal.proof ? [seal.proof] : [];
+    for (const proof of proofs) {
+        if (proof.verificationMethod !== seal.eventVector.who.assertionMethod)
+            issue('/proof/verificationMethod', 'Proof key must match the asserting key in the event');
+        if (proof.type === 'Ed25519Signature2020' && !proof.created)
+            issue('/proof/created', 'Ed25519Signature2020 proof requires its creation time');
+        if (proof.type === 'DataIntegrityProof' && proof.cryptosuite !== 'bbs-2023')
+            issue('/proof/cryptosuite', 'Only the declared BBS suite is supported');
+    }
+    return { valid: errors.length === 0, errors };
+}
+export const disclosureSchema = structuredClone(sealSchema);
+disclosureSchema.$id += ':disclosure';
+disclosureSchema.required = ['@context', 'type', 'id', 'issuer', 'validFrom', 'sealVersion', 'sealTimestamp', 'correctionOf', 'credentialSubject', 'credentialStatus', 'eventVector', 'chainOfCustody', 'proof'];
+disclosureSchema.properties.eventVector.properties.when.required = ['eventTime', 'timezone'];
+disclosureSchema.properties.eventVector.properties.how.required = ['eventType', 'eventTypeVocab', 'disposition'];
+disclosureSchema.properties.chainOfCustody.required = ['chainId'];
+const validateDisclosure = ajv.compile(disclosureSchema);
+export function validateSealPresentationStructure(value) {
+    if (!validateDisclosure(value))
+        return { valid: false, errors: (validateDisclosure.errors ?? []).map(e => ({ code: 'presentation_schema', path: e.instancePath, message: e.message ?? 'Invalid disclosed field' })) };
+    const credential = value;
+    const errors = [];
+    if (credential.issuer !== credential.eventVector.who.actorDid)
+        errors.push({ code: 'issuer_binding', path: '/eventVector/who/actorDid', message: 'Disclosed actor must equal issuer' });
+    if (credential.credentialSubject.id !== credential.id)
+        errors.push({ code: 'subject_binding', path: '/credentialSubject/id', message: 'Disclosed subject must identify this attestation' });
+    const proofs = Array.isArray(credential.proof) ? credential.proof : [credential.proof];
+    if (proofs.some(p => p.verificationMethod !== credential.eventVector.who.assertionMethod))
+        errors.push({ code: 'key_binding', path: '/proof/verificationMethod', message: 'Disclosed assertion key must match the proof' });
+    return { valid: errors.length === 0, errors };
+}
+/** Parses exact input without replacing its bytes. Rejects duplicate keys before interpretation. */
+export function parseStrictJsonBytes(bytes) {
+    if (bytes.byteLength > 1_048_576)
+        throw new Error('Credential exceeds the 1 MiB profile limit');
+    const text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    const value = JSON.parse(text);
+    let index = 0;
+    const whitespace = () => { while (/\s/.test(text[index] ?? '') && index < text.length)
+        index++; };
+    const string = () => { const start = index++; while (index < text.length) {
+        if (text[index] === '\\')
+            index += 2;
+        else if (text[index++] === '"')
+            return JSON.parse(text.slice(start, index));
+    } throw new Error('Unterminated string'); };
+    const visit = (depth) => {
+        if (depth > 64)
+            throw new Error('JSON nesting exceeds the profile limit');
+        whitespace();
+        if (text[index] === '{') {
+            index++;
+            whitespace();
+            const keys = new Set();
+            while (text[index] !== '}') {
+                const key = string();
+                if (keys.has(key))
+                    throw new Error(`Duplicate JSON key: ${key}`);
+                keys.add(key);
+                whitespace();
+                index++;
+                visit(depth + 1);
+                whitespace();
+                if (text[index] !== ',')
+                    break;
+                index++;
+                whitespace();
+            }
+            index++;
+        }
+        else if (text[index] === '[') {
+            index++;
+            whitespace();
+            while (text[index] !== ']') {
+                visit(depth + 1);
+                whitespace();
+                if (text[index] !== ',')
+                    break;
+                index++;
+            }
+            index++;
+        }
+        else if (text[index] === '"')
+            string();
+        else {
+            while (index < text.length && !/[\s,\]}]/.test(text[index]))
+                index++;
+        }
+    };
+    visit(0);
+    return value;
+}
+export function parseSealBytes(bytes) {
+    const value = parseStrictJsonBytes(bytes);
+    const result = validateSealStructure(value);
+    if (!result.valid)
+        throw new Error(result.errors.map(e => `${e.path}: ${e.message}`).join('; '));
+    return value;
+}
+export function extractSealMetadata(seal) {
+    return { id: seal.id, issuer: seal.issuer, type: 'VSC-SEAL', subjects: [...new Set(seal.eventVector.what.productIdentifiers.map(p => p.value))] };
+}
+//# sourceMappingURL=validation.js.map

package/dist/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAC1B,OAAO,UAAU,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AACvD,UAA0C,CAAC,GAAG,CAAC,CAAC;AACjD,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AAChD,MAAM,gBAAgB,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,GAAG,WAAW,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC;AACzJ,MAAM,UAAU,qBAAqB,CAAC,KAAc,EAAE,EAAE,YAAY,GAAG,IAAI,EAAE,GAAG,EAAE;IAChF,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACnE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,eAAe,EAAE,CAAC,CAAC,EAAE,CAAC;IAC3K,MAAM,IAAI,GAAG,KAAa,CAAC;IAC3B,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACnG,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,sCAAsC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,KAAK,CAAC,WAAW,EAAE,wDAAwD,CAAC,CAAC;IAC5L,IAAI,YAAY,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,KAAK,CAAC,QAAQ,EAAE,kCAAkC,CAAC,CAAC;IACrF,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ;QAAE,KAAK,CAAC,2BAA2B,EAAE,6BAA6B,CAAC,CAAC;IACrH,IAAI,IAAI,CAAC,iBAAiB,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,uBAAuB,EAAE,qGAAqG,CAAC,CAAC;IACjL,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,sBAAsB,CAAC;IAC/D,IAAI,WAAW,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAAE,KAAK,CAAC,2CAA2C,EAAE,uDAAuD,CAAC,CAAC;IACtP,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,KAAK,CAAC,6BAA6B,EAAE,uCAAuC,CAAC,CAAC;IACjH,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,IAAI,QAAQ,KAAK,YAAY;QAAE,KAAK,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;IAC7H,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,YAAY,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC;QAAE,KAAK,CAAC,eAAe,EAAE,mEAAmE,CAAC,CAAC;IAC/N,IAAI,QAAQ,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,6BAA6B,EAAE,wCAAwC,CAAC,CAAC;IACpI,IAAI,CAAC,OAAO,EAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,6BAA6B,EAAE,wCAAwC,CAAC,CAAC;IACvJ,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QAAE,KAAK,CAAC,4BAA4B,EAAE,yDAAyD,CAAC,CAAC;IAC7K,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;IACjC,MAAM,KAAK,GAAG,CAAC,aAAa,EAAC,kBAAkB,EAAC,qBAAqB,EAAC,kBAAkB,EAAC,kBAAkB,CAAC,CAAC;IAC7G,IAAI,GAAG,CAAC,cAAc,KAAK,kBAAkB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,KAAK,CAAC,4BAA4B,EAAE,mDAAmD,CAAC,CAAC;IAC7M,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,eAAe;YAAE,KAAK,CAAC,2BAA2B,EAAE,qDAAqD,CAAC,CAAC;QACjK,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAsB,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,KAAK,CAAC,gBAAgB,EAAE,uDAAuD,CAAC,CAAC;QAC9I,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,IAAI,KAAK,CAAC,WAAW,KAAK,UAAU;YAAE,KAAK,CAAC,oBAAoB,EAAE,0CAA0C,CAAC,CAAC;IACvJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAQ,eAAe,CAAC,UAAU,CAAC,CAAC;AACjE,gBAAgB,CAAC,GAAG,IAAI,aAAa,CAAC;AACtC,gBAAgB,CAAC,QAAQ,GAAG,CAAC,UAAU,EAAC,MAAM,EAAC,IAAI,EAAC,QAAQ,EAAC,WAAW,EAAC,aAAa,EAAC,eAAe,EAAC,cAAc,EAAC,mBAAmB,EAAC,kBAAkB,EAAC,aAAa,EAAC,gBAAgB,EAAC,OAAO,CAAC,CAAC;AACrM,gBAAgB,CAAC,UAAU,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,WAAW,EAAC,UAAU,CAAC,CAAC;AAC5F,gBAAgB,CAAC,UAAU,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,WAAW,EAAC,gBAAgB,EAAC,aAAa,CAAC,CAAC;AAC/G,gBAAgB,CAAC,UAAU,CAAC,cAAc,CAAC,QAAQ,GAAG,CAAC,SAAS,CAAC,CAAC;AAClE,MAAM,kBAAkB,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AACzD,MAAM,UAAU,iCAAiC,CAAC,KAAc;IAC9D,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,kBAAkB,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,yBAAyB,EAAE,CAAC,CAAC,EAAE,CAAC;IACtN,MAAM,UAAU,GAAG,KAAa,CAAC;IACjC,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,IAAI,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC;IACxL,IAAI,UAAU,CAAC,iBAAiB,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC,CAAC;IAC5L,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAM,CAAC,CAAC;IACxF,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,KAAK,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC,CAAC;IAC5N,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,oBAAoB,CAAC,KAAiB;IACpD,IAAI,KAAK,CAAC,UAAU,GAAG,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChG,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,UAAU,GAAG,GAAG,EAAE,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,MAAM;QAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,GAAW,EAAE,GAAG,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI;YAAE,KAAK,IAAI,CAAC,CAAC;aAAM,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAAC,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC;IACnP,MAAM,KAAK,GAAG,CAAC,KAAa,EAAQ,EAAE;QACpC,IAAI,KAAK,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC1E,UAAU,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YACxB,KAAK,EAAE,CAAC;YAAC,UAAU,EAAE,CAAC;YAAC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YACtD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;gBAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;gBAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAAC,UAAU,EAAE,CAAC;gBAAC,KAAK,EAAE,CAAC;gBAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAAC,UAAU,EAAE,CAAC;gBAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG;oBAAE,MAAM;gBAAC,KAAK,EAAE,CAAC;gBAAC,UAAU,EAAE,CAAC;YAAC,CAAC;YACpP,KAAK,EAAE,CAAC;QACV,CAAC;aAAM,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YAC/B,KAAK,EAAE,CAAC;YAAC,UAAU,EAAE,CAAC;YAAC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAAC,UAAU,EAAE,CAAC;gBAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG;oBAAE,MAAM;gBAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YAAC,KAAK,EAAE,CAAC;QAC1I,CAAC;aAAM,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG;YAAE,MAAM,EAAE,CAAC;aACpC,CAAC;YAAC,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAAE,KAAK,EAAE,CAAC;QAAC,CAAC;IAChF,CAAC,CAAC;IACF,KAAK,CAAC,CAAC,CAAC,CAAC;IACT,OAAO,KAAK,CAAC;AACf,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC9C,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACjG,OAAO,KAAa,CAAC;AACvB,CAAC;AACD,MAAM,UAAU,mBAAmB,CAAC,IAAU;IAC5C,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,UAAmB,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7J,CAAC"}

package/dist/verification.d.ts

@@ -0,0 +1,10 @@
+import type { Check, Credential, Seal, VerificationOptions, VerificationResult } from './types.js';
+export declare function verifyTemporal(credential: Credential, evaluationTime: string): Check;
+export declare function verifyCredentialStatus(credential: Credential, options: Pick<VerificationOptions, 'documentLoader' | 'statusPolicy'> & {
+    evaluationTime: string;
+}): Promise<Check>;
+export declare function verifyIssuerAuthority(seal: Seal, options: VerificationOptions & {
+    evaluationTime: string;
+}): Promise<Check>;
+export declare function verifySeal(options: VerificationOptions): Promise<VerificationResult>;
+//# sourceMappingURL=verification.d.ts.map

package/dist/verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification.d.ts","sourceRoot":"","sources":["../src/verification.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAS,IAAI,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAK1G,wBAAgB,cAAc,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,GAAG,KAAK,CAMpF;AACD,wBAAsB,sBAAsB,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,gBAAgB,GAAG,cAAc,CAAC,GAAG;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CA6BvL;AACD,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,GAAG;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAsBjI;AAuBD,wBAAsB,UAAU,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAqH1F"}