@didis/client 0.2.2 → 0.2.3

package/CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to `@didis/client` are listed here. The format follows [Keep
 
 ## [Unreleased]
 
+## [0.2.3] - 2026-10-18
+
+### Added
+
+- Requests now carry `user-agent: didis-client/<version>` (Node, Deno, Bun and other non-browser runtimes; browsers keep their own user agent). Only the package name and version are sent, so DID.is can count SDK use separately from other HTTP clients. New export `VERSION`.
+
+- Type `LinkedAccountEvidence` and `Evidence.linkedAccounts`: each `alsoKnownAs` value with whether that website links back to the DID (`CONFIRMED`, `NOT_CONFIRMED`, `FAILED`, `UNSUPPORTED`, `UNREACHABLE`, `NOT_CHECKABLE`). A confirmation proves the same party controls the website origin and the DID; it does not prove who that party is.
+
+- Policy rule `linkedAccounts` in `PolicyRules`: 1–4 https origins (for example `["https://shop.example"]`) that must be listed in the DID's `alsoKnownAs` and confirm the DID back. Use it to require "this DID belongs to our official website" in one policy call.
+
 ## [0.2.2] - 2026-10-18
 
 ### Added
@@ -46,7 +56,8 @@ All notable changes to `@didis/client` are listed here. The format follows [Keep
 - `DidisError` carrying the RFC 9457 problem body and `Retry-After`.
 - Webhook helpers `verifyWebhookSignature` and `verifyCustomerMonitorSignature`.
 
-[Unreleased]: https://github.com/did-is/didis-js/compare/v0.2.2...HEAD
+[Unreleased]: https://github.com/did-is/didis-js/compare/v0.2.3...HEAD
+[0.2.3]: https://github.com/did-is/didis-js/compare/v0.2.2...v0.2.3
 [0.2.2]: https://github.com/did-is/didis-js/compare/v0.2.1...v0.2.2
 [0.2.1]: https://github.com/did-is/didis-js/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/did-is/didis-js/compare/v0.1.0...v0.2.0

package/dist/index.d.ts

@@ -128,6 +128,19 @@ export interface DomainBindingEvidence {
     credentials: LinkageCredentialEvidence[];
     detail: string;
 }
+/** One `alsoKnownAs` value checked for a reciprocal link back to the DID. */
+export interface LinkedAccountEvidence {
+    /** The `alsoKnownAs` value exactly as declared. */
+    value: string;
+    /** `WEB_ORIGIN` | `WEB_PAGE` | `SAME_ORIGIN` | `DID` | `OTHER` */
+    kind: string;
+    origin?: string;
+    /** `CONFIRMED` | `NOT_CONFIRMED` | `FAILED` | `UNSUPPORTED` | `UNREACHABLE` | `NOT_CHECKABLE` */
+    status: string;
+    configurationStatus?: string;
+    configurationSha256?: string;
+    detail: string;
+}
 export interface LogEntryEvidence {
     versionId: string;
     versionNumber: number;
@@ -195,6 +208,8 @@ export interface Evidence {
     keys: KeyEvidence[];
     services: ServiceEvidence[];
     domainBinding?: DomainBindingEvidence;
+    /** Reciprocal checks of `alsoKnownAs`; absent when nothing is declared. */
+    linkedAccounts?: LinkedAccountEvidence[];
     tls?: TlsEvidence;
     history?: HistoryEvidence;
 }
@@ -552,6 +567,8 @@ export interface PolicyRules {
     requireKeyRelationship?: string;
     domainBinding?: "required" | "optional";
     tlsMinDaysRemaining?: number;
+    /** 1–4 bare https origins that must be declared in `alsoKnownAs` and link back to the DID. */
+    linkedAccounts?: string[];
     verifiableHistory?: "required";
     maxCacheAgeSeconds?: number;
     credentialStatus?: "active";
@@ -658,6 +675,8 @@ export interface DidisClientOptions {
 }
 /** Public DID.is API. Point `baseUrl` at your own deployment when self-hosting. */
 export declare const DEFAULT_BASE_URL = "https://did.is/api";
+/** Package version, kept equal to package.json (checked by the test suite). */
+export declare const VERSION = "0.2.3";
 export declare class DidisClient {
     private readonly baseUrl;
     private readonly adminToken?;

package/dist/index.js

@@ -14,6 +14,14 @@ export class DidisError extends Error {
 }
 /** Public DID.is API. Point `baseUrl` at your own deployment when self-hosting. */
 export const DEFAULT_BASE_URL = "https://did.is/api";
+/** Package version, kept equal to package.json (checked by the test suite). */
+export const VERSION = "0.2.3";
+/**
+ * Identifies the SDK to the API so DID.is can count SDK use apart from other HTTP clients.
+ * Only the product name and version are sent. Browsers are left alone: there the browser
+ * controls the user agent and an extra header would add a CORS preflight to every call.
+ */
+const SDK_HEADERS = typeof globalThis.document === "undefined" ? { "user-agent": `didis-client/${VERSION}` } : {};
 const enc = (s) => encodeURIComponent(s.trim());
 export class DidisClient {
     baseUrl;
@@ -34,7 +42,7 @@ export class DidisClient {
             const res = await this.fetchImpl(`${this.baseUrl}${path}`, {
                 method,
                 signal: controller.signal,
-                headers: { accept: "application/json", ...(body !== undefined ? { "content-type": "application/json" } : {}), ...headers },
+                headers: { ...SDK_HEADERS, accept: "application/json", ...(body !== undefined ? { "content-type": "application/json" } : {}), ...headers },
                 body: body !== undefined ? JSON.stringify(body) : undefined,
             });
             const text = await res.text();
@@ -79,7 +87,7 @@ export class DidisClient {
     /** Live resolution over server-sent events. */
     async *stream(did, opts = { noCache: true }) {
         const res = await this.fetchImpl(`${this.baseUrl}/v1/stream/${enc(did)}${opts.noCache ? "?noCache=true" : ""}`, {
-            headers: { accept: "text/event-stream" },
+            headers: { ...SDK_HEADERS, accept: "text/event-stream" },
         });
         if (!res.ok || !res.body)
             throw new DidisError(res.status, { type: "about:blank", title: `HTTP ${res.status}`, detail: "stream failed" });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@didis/client",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Official TypeScript/JavaScript SDK for the DID.is public API: DID resolution with evidence, credentials, policies and agent trust",
   "type": "module",
   "main": "./dist/index.js",