@didis/client 0.2.1 → 0.2.3

package/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to `@didis/client` are listed here. The format follows [Keep
 
 ## [Unreleased]
 
+## [0.2.3] - 2026-10-18
+
+### Added
+
+- Requests now carry `user-agent: didis-client/<version>` (Node, Deno, Bun and other non-browser runtimes; browsers keep their own user agent). Only the package name and version are sent, so DID.is can count SDK use separately from other HTTP clients. New export `VERSION`.
+
+- Type `LinkedAccountEvidence` and `Evidence.linkedAccounts`: each `alsoKnownAs` value with whether that website links back to the DID (`CONFIRMED`, `NOT_CONFIRMED`, `FAILED`, `UNSUPPORTED`, `UNREACHABLE`, `NOT_CHECKABLE`). A confirmation proves the same party controls the website origin and the DID; it does not prove who that party is.
+
+- Policy rule `linkedAccounts` in `PolicyRules`: 1–4 https origins (for example `["https://shop.example"]`) that must be listed in the DID's `alsoKnownAs` and confirm the DID back. Use it to require "this DID belongs to our official website" in one policy call.
+
+## [0.2.2] - 2026-10-18
+
+### Added
+
+- `verifyCredential` option `requiredClaims` (`ClaimRequirement[]`): check conditions such as `{ path: "/age_over_18", equals: true }` without receiving claim values. The response field `requirements` (`RequirementsOutcome`) reports `met` and a per-path result; conditions are evaluated only for a `VALID` credential.
+
 ## [0.2.1] - 2026-10-14
 
 ### Added
@@ -40,7 +56,9 @@ All notable changes to `@didis/client` are listed here. The format follows [Keep
 - `DidisError` carrying the RFC 9457 problem body and `Retry-After`.
 - Webhook helpers `verifyWebhookSignature` and `verifyCustomerMonitorSignature`.
 
-[Unreleased]: https://github.com/did-is/didis-js/compare/v0.2.1...HEAD
+[Unreleased]: https://github.com/did-is/didis-js/compare/v0.2.3...HEAD
+[0.2.3]: https://github.com/did-is/didis-js/compare/v0.2.2...v0.2.3
+[0.2.2]: https://github.com/did-is/didis-js/compare/v0.2.1...v0.2.2
 [0.2.1]: https://github.com/did-is/didis-js/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/did-is/didis-js/compare/v0.1.0...v0.2.0
 [0.1.0]: https://github.com/did-is/didis-js/releases/tag/v0.1.0

package/dist/index.d.ts

@@ -128,6 +128,19 @@ export interface DomainBindingEvidence {
     credentials: LinkageCredentialEvidence[];
     detail: string;
 }
+/** One `alsoKnownAs` value checked for a reciprocal link back to the DID. */
+export interface LinkedAccountEvidence {
+    /** The `alsoKnownAs` value exactly as declared. */
+    value: string;
+    /** `WEB_ORIGIN` | `WEB_PAGE` | `SAME_ORIGIN` | `DID` | `OTHER` */
+    kind: string;
+    origin?: string;
+    /** `CONFIRMED` | `NOT_CONFIRMED` | `FAILED` | `UNSUPPORTED` | `UNREACHABLE` | `NOT_CHECKABLE` */
+    status: string;
+    configurationStatus?: string;
+    configurationSha256?: string;
+    detail: string;
+}
 export interface LogEntryEvidence {
     versionId: string;
     versionNumber: number;
@@ -195,6 +208,8 @@ export interface Evidence {
     keys: KeyEvidence[];
     services: ServiceEvidence[];
     domainBinding?: DomainBindingEvidence;
+    /** Reciprocal checks of `alsoKnownAs`; absent when nothing is declared. */
+    linkedAccounts?: LinkedAccountEvidence[];
     tls?: TlsEvidence;
     history?: HistoryEvidence;
 }
@@ -254,6 +269,24 @@ export interface CredentialVerifyOptions {
     expectedNonce?: string;
     /** Caller-chosen X.509 anchors (PEM or base64 DER) for SD-JWT VC `x5c`. Without them `x5c` is never VALID. */
     trustedIssuerCertificates?: string[];
+    /**
+     * Conditions checked without returning claim values, e.g. `[{ path: "/age_over_18", equals: true }]`.
+     * Paths are JSON Pointers into the issuer-signed claims; `equals` is a boolean, integer or string.
+     * Evaluated only for a VALID credential; see `CredentialVerification.requirements`.
+     */
+    requiredClaims?: ClaimRequirement[];
+}
+export interface ClaimRequirement {
+    path: string;
+    equals: boolean | number | string;
+}
+export interface RequirementsOutcome {
+    /** True only when the credential is VALID and every condition is SATISFIED. */
+    met: boolean;
+    results: {
+        path: string;
+        result: "SATISFIED" | "NOT_SATISFIED" | "NOT_DISCLOSED" | "NOT_EVALUATED";
+    }[];
 }
 export interface CredentialVerification {
     status: string;
@@ -304,6 +337,8 @@ export interface CredentialVerification {
     issuerTrust?: IssuerTrust;
     /** SD-JWT VC only. No disclosed claim values are ever returned. */
     sdJwt?: SdJwtEvidence;
+    /** Present only when `requiredClaims` was sent. Never contains claim values. */
+    requirements?: RequirementsOutcome;
     /** For SD-JWT VC: disclosed claim paths and digests only, never values. */
     claims: unknown;
     credential: unknown;
@@ -532,6 +567,8 @@ export interface PolicyRules {
     requireKeyRelationship?: string;
     domainBinding?: "required" | "optional";
     tlsMinDaysRemaining?: number;
+    /** 1–4 bare https origins that must be declared in `alsoKnownAs` and link back to the DID. */
+    linkedAccounts?: string[];
     verifiableHistory?: "required";
     maxCacheAgeSeconds?: number;
     credentialStatus?: "active";
@@ -638,6 +675,8 @@ export interface DidisClientOptions {
 }
 /** Public DID.is API. Point `baseUrl` at your own deployment when self-hosting. */
 export declare const DEFAULT_BASE_URL = "https://did.is/api";
+/** Package version, kept equal to package.json (checked by the test suite). */
+export declare const VERSION = "0.2.3";
 export declare class DidisClient {
     private readonly baseUrl;
     private readonly adminToken?;

package/dist/index.js

@@ -14,6 +14,14 @@ export class DidisError extends Error {
 }
 /** Public DID.is API. Point `baseUrl` at your own deployment when self-hosting. */
 export const DEFAULT_BASE_URL = "https://did.is/api";
+/** Package version, kept equal to package.json (checked by the test suite). */
+export const VERSION = "0.2.3";
+/**
+ * Identifies the SDK to the API so DID.is can count SDK use apart from other HTTP clients.
+ * Only the product name and version are sent. Browsers are left alone: there the browser
+ * controls the user agent and an extra header would add a CORS preflight to every call.
+ */
+const SDK_HEADERS = typeof globalThis.document === "undefined" ? { "user-agent": `didis-client/${VERSION}` } : {};
 const enc = (s) => encodeURIComponent(s.trim());
 export class DidisClient {
     baseUrl;
@@ -34,7 +42,7 @@ export class DidisClient {
             const res = await this.fetchImpl(`${this.baseUrl}${path}`, {
                 method,
                 signal: controller.signal,
-                headers: { accept: "application/json", ...(body !== undefined ? { "content-type": "application/json" } : {}), ...headers },
+                headers: { ...SDK_HEADERS, accept: "application/json", ...(body !== undefined ? { "content-type": "application/json" } : {}), ...headers },
                 body: body !== undefined ? JSON.stringify(body) : undefined,
             });
             const text = await res.text();
@@ -79,7 +87,7 @@ export class DidisClient {
     /** Live resolution over server-sent events. */
     async *stream(did, opts = { noCache: true }) {
         const res = await this.fetchImpl(`${this.baseUrl}/v1/stream/${enc(did)}${opts.noCache ? "?noCache=true" : ""}`, {
-            headers: { accept: "text/event-stream" },
+            headers: { ...SDK_HEADERS, accept: "text/event-stream" },
         });
         if (!res.ok || !res.body)
             throw new DidisError(res.status, { type: "about:blank", title: `HTTP ${res.status}`, detail: "stream failed" });
@@ -137,6 +145,7 @@ export class DidisClient {
             expectedAudience: options.expectedAudience,
             expectedNonce: options.expectedNonce,
             trustedIssuerCertificates: options.trustedIssuerCertificates,
+            requiredClaims: options.requiredClaims,
         });
     }
     evaluatePolicy(did, policy, credential) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@didis/client",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Official TypeScript/JavaScript SDK for the DID.is public API: DID resolution with evidence, credentials, policies and agent trust",
   "type": "module",
   "main": "./dist/index.js",