@ixo/credentials-kit 0.0.0-stage → 0.1.0

package/dist/sdjwt.d.ts

@@ -0,0 +1,133 @@
+import { CredentialsKitError } from './index.js';
+import { JsonObject } from './index.js';
+
+/** Largest SD-JWT (with KB-JWT) the kit parses: 32 KiB. */
+declare const MAX_SD_JWT_LENGTH: number;
+/** Most disclosures one SD-JWT may carry. */
+declare const MAX_DISCLOSURES = 256;
+interface Disclosure {
+    /** The disclosure exactly as it appears in the SD-JWT (base64url). */
+    raw: string;
+    salt: string;
+    /** The claim name; null for an array-element disclosure (`[salt, value]`). */
+    name: string | null;
+    value: unknown;
+    /** base64url(SHA-256(raw)), the value found in `_sd`. */
+    digest: string;
+}
+interface ParsedSdJwt {
+    /** The issuer-signed JWT. */
+    jwt: string;
+    header: JsonObject;
+    payload: JsonObject;
+    disclosures: Disclosure[];
+    /** The Key Binding JWT, when the input was an SD-JWT+KB. */
+    kbJwt?: string;
+}
+type SdJwtErrorCode = 'malformed' | 'bad_disclosure' | 'unknown_claim';
+/**
+ * Claim names refused anywhere in a credential (plaintext or disclosed): they would change an
+ * object's prototype or shadow its constructor in JavaScript consumers (SPEC §13.3).
+ */
+declare const REFUSED_CLAIM_NAMES: ReadonlySet<string>;
+/** Deepest nesting `processDisclosures` walks. */
+declare const MAX_CLAIM_DEPTH = 32;
+declare class SdJwtError extends CredentialsKitError {
+    readonly code: SdJwtErrorCode;
+    constructor(code: SdJwtErrorCode);
+}
+/** base64url(SHA-256(US-ASCII bytes of `s`)), the SD-JWT digest (sha-256 only). */
+declare function sdDigest(s: string): string;
+/**
+ * Parse an SD-JWT or SD-JWT+KB. Throws `SdJwtError` (`malformed`, `bad_disclosure`). Does not
+ * verify anything cryptographic and does not check that disclosures are referenced.
+ */
+declare function parseSdJwt(str: string): ParsedSdJwt;
+/**
+ * `<jwt>~<d1>~…~<dn>~` plus the KB-JWT when given. With no KB-JWT the result ends with `~`
+ * (RFC 9901 §4).
+ */
+declare function serializeSdJwt(jwt: string, disclosureRaws: readonly string[], kbJwt?: string): string;
+/**
+ * The raw disclosures for the TOP-LEVEL claim `names`: object-property disclosures whose digest
+ * is listed in the payload's own `_sd`, in the order the SD-JWT carries them. A claim name is an
+ * exact path of one segment: a disclosure of the same name nested inside another claim is never
+ * selected (it would release a value nobody asked for), and the nested disclosures inside a
+ * selected value are not released either. Throws `unknown_claim` when a name has no top-level
+ * disclosure, so a caller never silently presents less (or something else) than it meant to.
+ */
+declare function selectDisclosures(parsed: ParsedSdJwt, names: readonly string[]): string[];
+/**
+ * The KB-JWT `sd_hash` over `<jwt>~<d1>~…~<dn>~` (must end with `~`, as presented: the
+ * issuer-signed JWT and the chosen disclosures, without the KB-JWT).
+ */
+declare function sdHash(jwtAndDisclosures: string): string;
+interface ProcessedSdJwt {
+    /**
+     * The payload with every presented disclosure put in place, recursively, and every `_sd`,
+     * `_sd_alg` and unmatched `{"...": digest}` array element removed (RFC 9901 §7.1 step 3).
+     */
+    claims: JsonObject;
+    /** Names of the top-level claims that came from a disclosure, in payload order. */
+    disclosed: string[];
+}
+/**
+ * RFC 9901 §7.1 steps 3–5 over an (already signature-checked) payload: every `_sd` digest list
+ * in every object and every `{"...": digest}` element of every array, recursively into
+ * disclosed values. Throws `SdJwtError('bad_disclosure')` when a digest appears more than once,
+ * a disclosure matches no digest (or is presented twice), an object-property disclosure is
+ * found in an array (or the reverse), a disclosed name is `_sd`, `...` or `_sd_alg`, or a
+ * disclosed name already exists at its level. Throws `SdJwtError('malformed')` for a malformed
+ * `_sd` or `...` structure, a claim named `__proto__` / `constructor` / `prototype`, `_sd_alg`
+ * below the top level, or nesting deeper than `MAX_CLAIM_DEPTH`. `sha-256` digests only (the
+ * caller checks `_sd_alg`).
+ */
+declare function processDisclosures(payload: JsonObject, disclosures: readonly Disclosure[]): ProcessedSdJwt;
+/**
+ * The `ixo.credential` payload the portal / jambo / Self web app store
+ * (`SdJwtCredentialRecord`): the raw SD-JWT is authoritative; `claims` is a display cache with
+ * each claim's disclosure rule.
+ */
+interface SdJwtCredentialRecord {
+    recordType: 'SdJwtCredentialRecord';
+    format: 'dc+sd-jwt';
+    credential: string;
+    issuerDid: string;
+    issuerName?: string;
+    holderDid: string;
+    vct: string;
+    issuedAt: string;
+    expiresAt?: string;
+    claims: Record<string, {
+        value: unknown;
+        sd: 'never' | 'allowed' | 'always';
+    }>;
+    holderBinding: boolean;
+}
+interface CredentialRecordOptions {
+    /** Display name of the issuer (Self stores `'IXO Identity'`). Omitted when not given. */
+    issuerName?: string;
+    /** When given, the credential's `sub` must equal it (it was issued to this holder). */
+    holderDid?: string;
+}
+/**
+ * The Vault record of an issued SD-JWT VC, byte-identical (same members, same order) to Self's
+ * `toCredentialRecord` for the same flat credential, so the Hub and the browser de-duplicate by
+ * CID. Every field comes from the SD-JWT itself; the same credential always yields the same
+ * record. `claims` holds the TOP-LEVEL claims only: plaintext ones (`sd: 'never'`), then the
+ * top-level disclosures in the order the SD-JWT carries them (`sd: 'allowed'`). A nested
+ * disclosure stays inside its parent's value (RFC 9901 §7.1 processing), so it can never stand
+ * in for, or overwrite, a top-level claim of the same name. Throws `SdJwtError('malformed')`
+ * when `iss`, `sub`, `vct` or `iat` is missing, when `holderDid` does not match, or when a claim
+ * is named `__proto__`, `constructor` or `prototype`, and `SdJwtError('bad_disclosure')` (or
+ * `malformed`) when the disclosures break RFC 9901 §7.1 (unreferenced, repeated, overwriting).
+ *
+ * This only PARSES: it does not check the issuer's signature, `cnf` or validity. A wallet must
+ * call `verifyIssuedCredential` (kit `verify`) first and store only what passed (RFC 9901 §7.2).
+ */
+declare function credentialRecordFromSdJwt(sdjwt: string, opts?: CredentialRecordOptions): SdJwtCredentialRecord;
+/** `"sha256:" + hex(sha256(JSON.stringify(canonicalize(record))))`, the Vault's dedup key. */
+declare function credentialCid(record: unknown): string;
+
+export { MAX_CLAIM_DEPTH, MAX_DISCLOSURES, MAX_SD_JWT_LENGTH, REFUSED_CLAIM_NAMES, SdJwtError, credentialCid, credentialRecordFromSdJwt, parseSdJwt, processDisclosures, sdDigest, sdHash, selectDisclosures, serializeSdJwt };
+export type { CredentialRecordOptions, Disclosure, ParsedSdJwt, ProcessedSdJwt, SdJwtCredentialRecord, SdJwtErrorCode };

package/dist/sdjwt.js

@@ -0,0 +1,5 @@
+export { MAX_CLAIM_DEPTH, MAX_DISCLOSURES, MAX_SD_JWT_LENGTH, REFUSED_CLAIM_NAMES, SdJwtError, credentialCid, credentialRecordFromSdJwt, parseSdJwt, processDisclosures, sdDigest, sdHash, selectDisclosures, serializeSdJwt } from './chunk-XREZY53L.js';
+import './chunk-VXKONZK4.js';
+import './chunk-AQ3IINHC.js';
+//# sourceMappingURL=sdjwt.js.map
+//# sourceMappingURL=sdjwt.js.map

package/dist/sdjwt.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"sdjwt.js"}

package/dist/sender.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The sender key of `did`: the DID itself when it is a did:ixo person or entity DID, or a did:web
+ * in canonical form. Null for any other did:ixo or did:web spelling (refuse it) and for anything
+ * that is not a did:ixo or did:web.
+ */
+declare function senderKeyOf(did: string): string | null;
+
+export { senderKeyOf };

package/dist/sender.js

@@ -0,0 +1,7 @@
+export { senderKeyOf } from './chunk-ZZY4WGQ6.js';
+import './chunk-WIEGZFUO.js';
+import './chunk-Q3MZNMCK.js';
+import './chunk-VXKONZK4.js';
+import './chunk-AQ3IINHC.js';
+//# sourceMappingURL=sender.js.map
+//# sourceMappingURL=sender.js.map

package/dist/sender.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"sender.js"}

package/dist/status.d.ts

@@ -0,0 +1,108 @@
+import { DidDocument } from './did.js';
+import { CredentialsKitError } from './index.js';
+import { Signer } from './jose.js';
+import './http-BhuJ_-RZ.js';
+import './util-DOTEZgTt.js';
+
+/**
+ * `@ixo/credentials-kit/status` — IETF Token Status List (draft-ietf-oauth-status-list), JWT
+ * form, as Self issues it today (`ixo-self/worker/src/service/credential/status-list.ts`):
+ *
+ *   header  { alg: 'EdDSA', typ: 'statuslist+jwt', kid: <issuer assertionMethod id> }
+ *   payload { sub: <the list's public URI>, iss: <issuer DID>, iat, exp, ttl,
+ *             status_list: { bits: 1, lst: base64url(ZLIB-DEFLATE(bytes)) } }
+ *   entry i byte i >> 3, bit i & 7 (least significant bit first); 0 = VALID, 1 = INVALID.
+ *
+ * DEFLATE/INFLATE use `CompressionStream` / `DecompressionStream('deflate')` (the ZLIB format,
+ * RFC 1950), available in workerd, Node 22 and browsers. Inflation is capped.
+ */
+
+declare const STATUS_LIST_TYP = "statuslist+jwt";
+declare const STATUS_LIST_MEDIA_TYPE = "application/statuslist+jwt";
+/** Largest status list a verifier inflates (1 MiB = 8,388,608 one-bit entries). */
+declare const MAX_STATUS_LIST_BYTES: number;
+/** Largest status list token accepted (64 KiB, the Credentials worker's limit). */
+declare const MAX_STATUS_LIST_TOKEN_LENGTH: number;
+declare const STATUS_VALID = 0;
+declare const STATUS_INVALID = 1;
+declare const STATUS_SUSPENDED = 2;
+type StatusListErrorCode = 'malformed' | 'wrong_type' | 'wrong_subject' | 'wrong_issuer' | 'issuer_key_unpublished' | 'bad_signature' | 'expired' | 'not_yet_valid' | 'rolled_back' | 'too_large' | 'out_of_range';
+declare class StatusListError extends CredentialsKitError {
+    readonly code: StatusListErrorCode;
+    constructor(code: StatusListErrorCode);
+}
+/** A new, all-VALID list of `bytes` bytes (`bytes * 8` entries). */
+declare function newStatusBits(bytes: number): Uint8Array;
+/** Set entry `idx` to INVALID (1), in place. Idempotent. */
+declare function setStatusBit(bits: Uint8Array, idx: number): void;
+/** The 1-bit entry at `idx` (0 VALID, 1 INVALID). */
+declare function getStatusBit(bits: Uint8Array, idx: number): 0 | 1;
+/**
+ * The status value at `idx` of a list with `bitsPerEntry` bits per entry (1, 2, 4 or 8;
+ * default 1). Throws `out_of_range` for an index past the list.
+ */
+declare function statusAt(bits: Uint8Array, idx: number, bitsPerEntry?: 1 | 2 | 4 | 8): number;
+/**
+ * A uniformly random index in `[0, size)` whose bit is 0 in `used`, a bitmap of indices
+ * already handed out (same LSB-first layout; pass the issuer's allocation bitmap, not the
+ * revocation bits, because a VALID entry is also 0 there). Random indices give herd privacy
+ * (TSL §12.5). Throws `out_of_range` when every index is taken.
+ */
+declare function randomFreeIndex(used: Uint8Array, size: number): number;
+/** ZLIB (RFC 1950) DEFLATE, as the `lst` member requires. */
+declare function deflateStatusList(bytes: Uint8Array): Promise<Uint8Array>;
+/** ZLIB INFLATE, at most `max` output bytes (default `MAX_STATUS_LIST_BYTES`). */
+declare function inflateStatusList(bytes: Uint8Array, max?: number): Promise<Uint8Array>;
+interface CreateStatusListTokenInput {
+    /** The list bytes (1 bit per entry). */
+    bits: Uint8Array;
+    /** The list's public URI, exactly as credentials carry it in `status.status_list.uri`. */
+    uri: string;
+    /** The issuer DID. */
+    iss: string;
+    /** Signs with the issuer's assertionMethod key; `signer.kid` becomes the header `kid`. */
+    signer: Signer;
+    /** Seconds a verifier may cache the token. */
+    ttl: number;
+    /** Expiry, unix seconds. */
+    exp: number;
+    /** Issued at, unix seconds; default now. */
+    iat?: number;
+}
+/** A signed `statuslist+jwt` (bits 1). */
+declare function createStatusListToken(input: CreateStatusListTokenInput): Promise<string>;
+interface VerifyStatusListTokenOptions {
+    /** The URI the credential points to; the token's `sub` must equal it exactly. */
+    uri: string;
+    /** The issuer's resolved DID document; the token must be signed by its assertionMethod key. */
+    issuerDoc: DidDocument;
+    /** ms since the epoch; default `Date.now()`. */
+    now?: number;
+    /**
+     * Refuse a token issued before this (unix seconds), e.g. the `iat` of the newest token already
+     * accepted for this URI (`rolled_back`).
+     */
+    minIat?: number;
+}
+interface VerifiedStatusList {
+    /** The inflated list bytes. */
+    bits: Uint8Array;
+    /** Bits per entry (1, 2, 4 or 8); pass to `statusAt`. */
+    bitsPerEntry: 1 | 2 | 4 | 8;
+    ttl: number | null;
+    exp: number | null;
+    iat: number;
+    /** The header `kid` that verified. */
+    kid: string;
+}
+/**
+ * Verify a `statuslist+jwt` for `uri` issued by `issuerDoc.id`: typ, Ed25519 signature (`alg`
+ * `EdDSA` or `Ed25519`) by the issuer's assertionMethod key named by `kid`, `sub` = `uri`, `iss`
+ * (when present) = the issuer, `iat` present (and ≥ `minIat`), `exp` not past and `nbf` not in
+ * the future (2 min skew), `bits` ∈ {1,2,4,8}, `lst` inflates within the cap. Throws
+ * `StatusListError`.
+ */
+declare function verifyStatusListToken(token: string, opts: VerifyStatusListTokenOptions): Promise<VerifiedStatusList>;
+
+export { MAX_STATUS_LIST_BYTES, MAX_STATUS_LIST_TOKEN_LENGTH, STATUS_INVALID, STATUS_LIST_MEDIA_TYPE, STATUS_LIST_TYP, STATUS_SUSPENDED, STATUS_VALID, StatusListError, createStatusListToken, deflateStatusList, getStatusBit, inflateStatusList, newStatusBits, randomFreeIndex, setStatusBit, statusAt, verifyStatusListToken };
+export type { CreateStatusListTokenInput, StatusListErrorCode, VerifiedStatusList, VerifyStatusListTokenOptions };

package/dist/status.js

@@ -0,0 +1,7 @@
+export { MAX_STATUS_LIST_BYTES, MAX_STATUS_LIST_TOKEN_LENGTH, STATUS_INVALID, STATUS_LIST_MEDIA_TYPE, STATUS_LIST_TYP, STATUS_SUSPENDED, STATUS_VALID, StatusListError, createStatusListToken, deflateStatusList, getStatusBit, inflateStatusList, newStatusBits, randomFreeIndex, setStatusBit, statusAt, verifyStatusListToken } from './chunk-JBUX6V2Q.js';
+import './chunk-WIEGZFUO.js';
+import './chunk-Q3MZNMCK.js';
+import './chunk-VXKONZK4.js';
+import './chunk-AQ3IINHC.js';
+//# sourceMappingURL=status.js.map
+//# sourceMappingURL=status.js.map

package/dist/status.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"status.js"}

package/dist/util-DOTEZgTt.d.ts

@@ -0,0 +1,3 @@
+type JsonObject = Record<string, unknown>;
+
+export type { JsonObject as J };

package/dist/verify.d.ts

@@ -0,0 +1,144 @@
+import { DidResolver, KeyValueCache } from './did.js';
+import { CredentialsKitError } from './index.js';
+import { FetchLike } from './did.js';
+import { JsonObject } from './index.js';
+import { Ed25519PublicJwk } from './jose.js';
+
+type VerifyFailureCode = 'malformed' | 'untrusted_issuer' | 'wrong_type' | 'issuer_key_unpublished' | 'bad_signature' | 'expired' | 'not_yet_valid' | 'bad_disclosure' | 'wrong_subject' | 'key_binding_required' | 'bad_key_binding' | 'revoked' | 'no_status';
+declare const VERIFY_FAILURE_DETAILS: Record<VerifyFailureCode, string>;
+/** Checks a KB-JWT nonce: the exact value, or a callback (e.g. a single-use nonce store). */
+type NonceCheck = string | ((nonce: string) => boolean | Promise<boolean>);
+interface VerifyPolicy {
+    /** Accepted issuer DIDs, or a predicate. */
+    issuers: readonly string[] | ((did: string) => boolean);
+    /** Accepted `vct` values. */
+    vcts: readonly string[];
+    /**
+     * The KB-JWT `aud`: the verifier's full OpenID4VP client_id (or the audience your own protocol
+     * fixed). REQUIRED when key binding is required.
+     */
+    audience?: string;
+    /**
+     * The nonce the KB-JWT must carry: the one you issued for THIS check, or a callback that
+     * accepts each issued nonce once. REQUIRED when key binding is required.
+     */
+    nonce?: NonceCheck;
+    /** Default true. */
+    requireKeyBinding?: boolean;
+    /** Default true. */
+    requireStatus?: boolean;
+    /**
+     * The credential's `sub` must equal this (`wrong_subject`). Also what makes a failure
+     * `holderAuthenticated`: without it no answer is bound to a person you expected, so
+     * `holderAuthenticated` is always false (see `keyBindingValid`).
+     */
+    expectedSubject?: string;
+    /** ms since the epoch; default `Date.now()`. */
+    now?: number;
+}
+interface VerifyDeps {
+    resolver: DidResolver;
+    fetch: FetchLike;
+    /**
+     * Verified status list tokens (pass a KV binding or `createMemoryCache()`). Without one every
+     * verification fetches the list.
+     */
+    statusCache?: KeyValueCache;
+    /** Fetch a status list on a loopback host over http (local development only; needs `allowLocal`). */
+    allowHttp?: boolean;
+    /** Fetch a status list on a loopback / private / local-name host (local development only). */
+    allowLocal?: boolean;
+}
+interface VerifiedPresentation {
+    ok: true;
+    issuer: string;
+    subject: string;
+    vct: string;
+    /**
+     * The processed claims: plaintext claims (registered claims removed) plus the disclosed ones,
+     * with nested disclosures in place. Never contains `_sd`, `_sd_alg` or `...`.
+     */
+    claims: JsonObject;
+    /** Names of the top-level claims that came from a disclosure. */
+    disclosed: string[];
+    /** The credential's `exp` (unix seconds). */
+    expiresAt: number | null;
+    /** Lower-case hex SHA-256 of the issuer-signed JWT: one value per credential, whatever is disclosed. */
+    credentialSha256: string;
+    /** The credential's `cnf.jwk`, when it has one. */
+    holderKey: Ed25519PublicJwk | null;
+}
+interface FailedPresentation {
+    ok: false;
+    code: VerifyFailureCode;
+    /** A fixed sentence for the code (no credential content). */
+    detail: string;
+    /**
+     * True only when the failure came AFTER the answer was bound to the person you expected: a
+     * trusted issuer's valid signature, the key binding for this nonce and audience, AND
+     * `policy.expectedSubject` given and equal to `sub`. The person really answered, and their
+     * answer does not meet the policy (wrong type, expired, revoked, …). False for everything a
+     * third party could have sent, always false without key binding, and always false without
+     * `expectedSubject` (a stranger's own credential would pass every other step).
+     */
+    holderAuthenticated: boolean;
+    /**
+     * True when the failure came after the KB-JWT verified for this nonce and audience with the
+     * presented credential's OWN `cnf` key (trusted issuer, valid signature). It proves that the
+     * holder of THAT credential answered, not that it is the person you meant: never close a
+     * check on it alone. Always false without key binding.
+     */
+    keyBindingValid: boolean;
+}
+type VerifyResult = VerifiedPresentation | FailedPresentation;
+type UnavailableSource = 'resolver' | 'status_list';
+/** A dependency could not answer; nothing can be concluded about the credential (answer 503). */
+declare class VerificationUnavailable extends CredentialsKitError {
+    readonly code: 'verification_unavailable';
+    readonly source: UnavailableSource;
+    /** A constant cause code (`unreachable`, `http_status`, `too_large`, a `StatusListError` code, …). */
+    readonly reason: string;
+    constructor(source: UnavailableSource, reason: string);
+}
+/**
+ * Verify an SD-JWT VC presentation (`<jwt>~<disclosures>~<kb-jwt>`). Returns
+ * `{ ok: true, … }` or `{ ok: false, code, detail, holderAuthenticated, keyBindingValid }`
+ * (`holderAuthenticated` needs `policy.expectedSubject`); throws
+ * `VerificationUnavailable` when a dependency cannot answer, and `TypeError` when key binding is
+ * required but `policy.audience` or `policy.nonce` is missing.
+ */
+declare function verifyPresentation(presentation: string, policy: VerifyPolicy, deps: VerifyDeps): Promise<VerifyResult>;
+interface VerifyIssuedCredentialOptions {
+    /**
+     * The issuer DID the credential must name in `iss` (for example the DID that deposited the
+     * offer). REQUIRED. `false` accepts any issuer whose own DID document holds the signing key:
+     * UNSAFE, since the credential is then authentic but anyone may have issued it (a foreign
+     * issuer can mint your types); judge `result.issuer` yourself before storing or showing it.
+     */
+    issuer: string | false;
+    /** The holder DID: the credential's `sub` must equal it. */
+    subject: string;
+    /** The key the wallet proved possession of: the credential's `cnf.jwk` must be exactly it. */
+    holderKey: Ed25519PublicJwk | Uint8Array;
+    /** The `vct` of the offered credential configuration (or the accepted list). */
+    vct: string | readonly string[];
+    resolver: DidResolver;
+    /** ms since the epoch; default `Date.now()`. */
+    now?: number;
+}
+/**
+ * Check a credential a wallet just received from an issuer, before storing it (RFC 9901 §7.2,
+ * SPEC §13.3): no KB-JWT, header and shape as `verifyPresentation`, `iss` = `opts.issuer` when
+ * given (`untrusted_issuer`), the issuer's signature by its `assertionMethod` key named by `kid`,
+ * every disclosure matching exactly one digest (recursive, `bad_disclosure`), `sub` =
+ * `opts.subject` (`wrong_subject`), `cnf.jwk` = `opts.holderKey` (`bad_key_binding`), `vct` as
+ * offered (`wrong_type`), `exp`/`nbf` (`expired`, `not_yet_valid`). The status list is not read
+ * (a just-issued credential); verifiers check it at presentation. Returns the same result shape
+ * as `verifyPresentation` (`holderAuthenticated` and `keyBindingValid` are always false); throws
+ * `VerificationUnavailable` when the issuer's DID document cannot be read and `TypeError` when
+ * `issuer` is neither a DID nor `false`.
+ */
+declare function verifyIssuedCredential(credential: string, opts: VerifyIssuedCredentialOptions): Promise<VerifyResult>;
+
+export { VERIFY_FAILURE_DETAILS, VerificationUnavailable, verifyIssuedCredential, verifyPresentation };
+export type { FailedPresentation, NonceCheck, UnavailableSource, VerifiedPresentation, VerifyDeps, VerifyFailureCode, VerifyIssuedCredentialOptions, VerifyPolicy, VerifyResult };

package/dist/verify.js

@@ -0,0 +1,9 @@
+export { VERIFY_FAILURE_DETAILS, VerificationUnavailable, verifyIssuedCredential, verifyPresentation } from './chunk-STMMFNVW.js';
+import './chunk-XREZY53L.js';
+import './chunk-JBUX6V2Q.js';
+import './chunk-WIEGZFUO.js';
+import './chunk-Q3MZNMCK.js';
+import './chunk-VXKONZK4.js';
+import './chunk-AQ3IINHC.js';
+//# sourceMappingURL=verify.js.map
+//# sourceMappingURL=verify.js.map

package/dist/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"verify.js"}

package/dist/webhook.d.ts

@@ -0,0 +1,62 @@
+import { DidResolver } from './did.js';
+import { Signer } from './jose.js';
+import './errors-BKQmNpXX.js';
+import './http-BhuJ_-RZ.js';
+import './util-DOTEZgTt.js';
+
+/**
+ * `@ixo/credentials-kit/webhook` — signed webhooks (Credentials worker → Hub, SPEC §5.4).
+ *
+ * Header value (`x-ixo-signature`): `t=<unix seconds>,kid=<DID URL>,sig=<base64url>` where `sig`
+ * is Ed25519 over the UTF-8 bytes of `"<t>.<body>"` and `body` is the exact request body string.
+ * The timestamp is inside the signed bytes. The verifier resolves `expectedDid`, takes the key
+ * `kid` names under `assertionMethod`, and refuses a timestamp older than `toleranceSeconds`
+ * (default and maximum 300: SPEC §13.3) or more than 60 seconds in the future. A signed webhook
+ * still verifies again within that window: receivers MUST de-duplicate on the event `id`
+ * (`evt_…`) for at least the window (the Hub keeps every id it took). Senders sign at every
+ * delivery attempt (a fresh `t`).
+ */
+
+interface SignWebhookInput {
+    /** The exact request body that will be sent. */
+    body: string;
+    signer: Signer;
+    /** ms since the epoch; default `Date.now()`. */
+    now?: number;
+}
+/** The `x-ixo-signature` header value for `body`. */
+declare function signWebhook(input: SignWebhookInput): Promise<string>;
+type WebhookFailure = 'malformed' | 'stale' | 'wrong_did' | 'unknown_key' | 'bad_signature';
+type WebhookVerification = {
+    ok: true;
+    kid: string;
+    timestamp: number;
+} | {
+    ok: false;
+    code: WebhookFailure;
+};
+interface VerifyWebhookInput {
+    body: string;
+    /** The `x-ixo-signature` header value (null/undefined when absent). */
+    header: string | null | undefined;
+    resolver: DidResolver;
+    /** The only DID allowed to sign (e.g. the Credentials worker's did:web). */
+    expectedDid: string;
+    /** How old a signature may be, in seconds: default and maximum 300 (RangeError above). */
+    toleranceSeconds?: number;
+    /** ms since the epoch; default `Date.now()`. */
+    now?: number;
+}
+/** Most the signed timestamp may be ahead of the receiver's clock. */
+declare const WEBHOOK_MAX_FUTURE_SECONDS = 60;
+/** Largest (and default) `toleranceSeconds`. */
+declare const WEBHOOK_MAX_AGE_SECONDS = 300;
+/**
+ * Verify a webhook. Returns `{ ok: false, code }` for every refusal; throws only
+ * `ResolverUnavailable` (the signer's DID document could not be read — answer 503, the
+ * sender retries).
+ */
+declare function verifyWebhook(input: VerifyWebhookInput): Promise<WebhookVerification>;
+
+export { WEBHOOK_MAX_AGE_SECONDS, WEBHOOK_MAX_FUTURE_SECONDS, signWebhook, verifyWebhook };
+export type { SignWebhookInput, VerifyWebhookInput, WebhookFailure, WebhookVerification };

package/dist/webhook.js

@@ -0,0 +1,7 @@
+export { WEBHOOK_MAX_AGE_SECONDS, WEBHOOK_MAX_FUTURE_SECONDS, signWebhook, verifyWebhook } from './chunk-WND2LZ4O.js';
+import './chunk-WIEGZFUO.js';
+import './chunk-Q3MZNMCK.js';
+import './chunk-VXKONZK4.js';
+import './chunk-AQ3IINHC.js';
+//# sourceMappingURL=webhook.js.map
+//# sourceMappingURL=webhook.js.map

package/dist/webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"webhook.js"}