@ixo/credentials-kit 0.0.0-stage → 0.1.1

package/dist/display.js

@@ -0,0 +1,5 @@
+export { CARD_COLOR_PATTERN, CARD_DARK_TEXT, CARD_DISPLAY_MEMBERS, CARD_HUES, CARD_LIGHT_TEXT, CARD_PATTERNS, MAX_CARD_URI_LENGTH, MIN_TEXT_CONTRAST, cardLook, contrastRatio, markLook, parseCardColor, parseCardDisplay, parseCardUri } from './chunk-46VRPQPD.js';
+import './chunk-Q3MZNMCK.js';
+import './chunk-AQ3IINHC.js';
+//# sourceMappingURL=display.js.map
+//# sourceMappingURL=display.js.map

package/dist/display.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"display.js"}

package/dist/errors-BKQmNpXX.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The base class of every error the kit throws. `code` is a constant snake_case string from a
+ * documented set per module; `message` is a fixed sentence for that code. Neither ever carries
+ * credential contents, keys, tokens or other secrets, so both are safe to log.
+ */
+declare class CredentialsKitError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+
+export { CredentialsKitError as C };

package/dist/holder.d.ts

@@ -0,0 +1,85 @@
+import { CredentialsKitError } from './index.js';
+import { HostPolicy, FetchLike } from './did.js';
+import { BlockSenderResult, SenderBlockList, UnblockSenderResult } from './profile.js';
+export { SenderBlock } from './profile.js';
+import './display.js';
+
+/**
+ * `@ixo/credentials-kit/holder` — a wallet's calls to the Credentials worker as the person
+ * (ability `credentials/hold`, principal = the person). For now: the person's block list (SPEC
+ * §16.1): `blockSender`, `unblockSender`, `listBlocks`.
+ *
+ * Conventions (SPEC §5.1, §13.1), the same as every other call to the worker:
+ *   - every call carries a FRESH, single-use UCAN invocation, minted by the caller's `authorize`
+ *     for exactly that request: audience = the worker's did:web (its `/.well-known/did.json`),
+ *     capability `credentials/hold` on `ixo:credentials`, lifetime at most 300 s, and the
+ *     request-binding fact `{ method, path }` this module passes in (method upper-case, the full
+ *     path without the query string). The kit does not depend on a UCAN library: mint it with
+ *     `@ixo/ucan` (`createInvocation` + `serializeInvocation`) or your own;
+ *   - the worker's URL must pass the kit's host policy (https on a public host; local development
+ *     passes `allowHttp` / `allowLocal`); requests never follow redirects, always time out, and the
+ *     answer is read no further than 64 KB.
+ *
+ * Errors: `CredentialsServiceError` with the worker's error `code` (`blocked`, `too_many_blocks`,
+ * `invalid_request`, `unauthenticated`, `forbidden`, `rate_limited`, `unavailable`, …), the HTTP
+ * `status`, and `reference` (the worker's request id, for support); `unreachable` (network,
+ * timeout, redirect; status null or the 3xx) and `bad_response` (an answer that is not the
+ * documented shape) when the worker did not answer properly. A wrong argument throws `TypeError`.
+ */
+
+/** The request an invocation is bound to (SPEC §13.1). */
+interface RequestBinding {
+    /** Upper-case HTTP method. */
+    method: string;
+    /** The full request path, without the query string. */
+    path: string;
+}
+/** The request-binding fact for `method` + `url` (the path only, never the query). */
+declare function requestBinding(method: string, url: string): RequestBinding;
+interface HolderCallOptions extends HostPolicy {
+    /** The Credentials worker's origin, e.g. `https://credentials.ixo.world`. */
+    serviceUrl: string;
+    /**
+     * Mint a fresh, single-use UCAN invocation (base64 CAR) bound to `binding`: issuer = the
+     * person (or a key the person delegated `credentials/hold` to), audience = the worker's
+     * did:web, capability `credentials/hold` on `ixo:credentials`, at most 300 s, and the fact
+     * `{ method, path }` equal to `binding`.
+     */
+    authorize: (binding: RequestBinding) => Promise<string>;
+    fetch: FetchLike;
+    /** Default 10 s. */
+    timeoutMs?: number;
+}
+/** A call to the Credentials worker that did not succeed. */
+declare class CredentialsServiceError extends CredentialsKitError {
+    /** The HTTP status, or null when the worker could not be reached. */
+    readonly status: number | null;
+    /** The worker's request id (its `reference`), for support. */
+    readonly reference?: string | undefined;
+    constructor(code: string, message: string, 
+    /** The HTTP status, or null when the worker could not be reached. */
+    status: number | null, 
+    /** The worker's request id (its `reference`), for support. */
+    reference?: string | undefined);
+}
+/**
+ * `POST /v1/blocks`: the person blocks `sender` (a did:ixo or did:web in canonical form; the
+ * block covers exactly this DID, never another DID on the same host, SPEC §17.4). Idempotent. The worker closes the sender's waiting offers and requests for the person as
+ * declined (`closed`) and refuses its later deposits with 403 `blocked`. At most 500 blocks per
+ * person (`too_many_blocks`).
+ */
+declare function blockSender(opts: HolderCallOptions & {
+    sender: string;
+}): Promise<BlockSenderResult>;
+/** `POST /v1/blocks/remove`: the person unblocks `sender`. Idempotent (`removed: false`). */
+declare function unblockSender(opts: HolderCallOptions & {
+    sender: string;
+}): Promise<UnblockSenderResult>;
+/** `GET /v1/blocks`: one page of the person's blocks, newest first (`limit` 1–100, `cursor`). */
+declare function listBlocks(opts: HolderCallOptions & {
+    cursor?: string;
+    limit?: number;
+}): Promise<SenderBlockList>;
+
+export { BlockSenderResult, CredentialsServiceError, SenderBlockList, UnblockSenderResult, blockSender, listBlocks, requestBinding, unblockSender };
+export type { HolderCallOptions, RequestBinding };

package/dist/holder.js

@@ -0,0 +1,8 @@
+export { CredentialsServiceError, blockSender, listBlocks, requestBinding, unblockSender } from './chunk-RKKRO4ZK.js';
+import './chunk-ZZY4WGQ6.js';
+import './chunk-WIEGZFUO.js';
+import './chunk-Q3MZNMCK.js';
+import './chunk-VXKONZK4.js';
+import './chunk-AQ3IINHC.js';
+//# sourceMappingURL=holder.js.map
+//# sourceMappingURL=holder.js.map

package/dist/holder.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"holder.js"}

package/dist/http-BhuJ_-RZ.d.ts

@@ -0,0 +1,25 @@
+/** The subset of `fetch` the kit uses. Pass `globalThis.fetch` (bound) or a test double. */
+type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+/**
+ * True when `hostname` (as `new URL(...).hostname` gives it: IPv4 normalised, IPv6 in brackets)
+ * is not a public internet host: a non-public IP literal (also embedded in 6to4, NAT64, Teredo,
+ * IPv4-mapped or IPv4-translated IPv6), a single-label name, `localhost`, or a name ending in
+ * `.localhost`, `.local`, `.internal`, `.lan`, `.home.arpa`, `.home`, `.corp`, `.intranet`,
+ * `.private` or `.localdomain`.
+ */
+declare function isPrivateHost(hostname: string): boolean;
+interface HostPolicy {
+    /** http on a loopback host (local development only). */
+    allowHttp?: boolean;
+    /** Loopback / private / link-local / local-name hosts (local development only). */
+    allowLocal?: boolean;
+}
+/**
+ * An https URL (or, only with `allowHttp`, an http URL on a loopback host) without credentials or
+ * fragment, whose host passes the host policy (`allowLocal` lifts it). Local development needs
+ * both flags for `http://localhost:…`.
+ */
+declare function isFetchableUrl(url: string, policy?: HostPolicy): boolean;
+
+export { isPrivateHost as a, isFetchableUrl as i };
+export type { FetchLike as F, HostPolicy as H };

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+export { DecodedJws, ED25519_JWS_ALGS, Ed25519JwsAlg, Ed25519PublicJwk, Ed25519Signer, JoseError, JoseErrorCode, JwsHeader, MAX_JWS_LENGTH, MAX_KEY_STRING_LENGTHS, Signer, base58btc, base64url, decodeJws, ed25519, ed25519SeedFromMnemonic, isEd25519JwsAlg, multibaseToRaw, publicJwkFromRaw, rawFromPublicJwk, rawToMultibase, signJws, signerFromEd25519Seed, verifyEd25519, verifyJws } from './jose.js';
+export { DidDocument, DidResolver, DidWeb, IXO_ENTITY_DID, IXO_PERSON_DID, IxoResolverOptions, KeyRelationship, KeyValueCache, MAX_DID_WEB_LENGTH, MAX_METHODS_PER_RELATIONSHIP, ResolvedKey, ResolverSource, ResolverUnavailable, VerificationMethod, VerificationRelationshipEntry, WebResolverOptions, composeResolvers, createIxoResolver, createMemoryCache, createStaticResolver, createWebResolver, didFromKid, didWebUrl, ed25519KeyOfMethod, findKey, isCanonicalHost, keysFor, normalizeDidDocument, parseDidWeb } from './did.js';
+export { CredentialRecordOptions, Disclosure, MAX_CLAIM_DEPTH, MAX_DISCLOSURES, MAX_SD_JWT_LENGTH, ParsedSdJwt, ProcessedSdJwt, REFUSED_CLAIM_NAMES, SdJwtCredentialRecord, SdJwtError, SdJwtErrorCode, credentialCid, credentialRecordFromSdJwt, parseSdJwt, processDisclosures, sdDigest, sdHash, selectDisclosures, serializeSdJwt } from './sdjwt.js';
+export { CreateStatusListTokenInput, MAX_STATUS_LIST_BYTES, MAX_STATUS_LIST_TOKEN_LENGTH, STATUS_INVALID, STATUS_LIST_MEDIA_TYPE, STATUS_LIST_TYP, STATUS_SUSPENDED, STATUS_VALID, StatusListError, StatusListErrorCode, VerifiedStatusList, VerifyStatusListTokenOptions, createStatusListToken, deflateStatusList, getStatusBit, inflateStatusList, newStatusBits, randomFreeIndex, setStatusBit, statusAt, verifyStatusListToken } from './status.js';
+export { FailedPresentation, NonceCheck, UnavailableSource, VERIFY_FAILURE_DETAILS, VerificationUnavailable, VerifiedPresentation, VerifyDeps, VerifyFailureCode, VerifyIssuedCredentialOptions, VerifyPolicy, VerifyResult, verifyIssuedCredential, verifyPresentation } from './verify.js';
+export { SignWebhookInput, VerifyWebhookInput, WEBHOOK_MAX_AGE_SECONDS, WEBHOOK_MAX_FUTURE_SECONDS, WebhookFailure, WebhookVerification, signWebhook, verifyWebhook } from './webhook.js';
+export { ABILITIES, ABILITY_HOLD, ABILITY_ISSUE, ABILITY_OFFER, ABILITY_PRESENT, ABILITY_VERIFY, AGE_CLAIMS, Ability, AgeClaim, BLOCKED_ERROR, BlockSenderResult, CLIENT_ID_PREFIX, CREDENTIAL_FORMAT, CatalogClaim, CatalogIssuerEntry, CatalogIssuerType, CatalogVerifierAccept, CatalogVerifierEntry, ClaimDisclosure, DcqlQuerySummary, HEADERS, IDENTITY_LEVEL1_CONFIGURATION_ID, IDENTITY_LEVEL1_VCT, KB_JWT_TYP, KYC_AML_LEVEL1_VCT, MAX_BLOCKS_PER_PERSON, MEDIA_TYPES, OfferDisplay, OfferStatus, OfferSummary, PRE_AUTHORIZED_CODE_GRANT, PROOF_JWT_TYP, REGISTERED_CLAIMS, REQUEST_OBJECT_TYP, RequestStatus, RequestSummary, SD_JWT_TYP, STATUS_LIST_JWT_TYP, SenderBlock, SenderBlockList, UCAN_RESOURCE, UnblockSenderResult, VAULT_CREDENTIAL_CONTENT_FIELD, VAULT_CREDENTIAL_EVENT_TYPE, VAULT_CREDENTIAL_INDEX_TYPE, VCT_STATE_KEYS, WEBHOOK_EVENT_TYPES, WEBHOOK_SIGNATURE_HEADER, WebhookEvent, WebhookEventType, entityResource, stateKeyForVct } from './profile.js';
+export { CARD_COLOR_PATTERN, CARD_DARK_TEXT, CARD_DISPLAY_MEMBERS, CARD_HUES, CARD_LIGHT_TEXT, CARD_PATTERNS, CardDisplay, CardDisplayMember, CardLook, MAX_CARD_URI_LENGTH, MIN_TEXT_CONTRAST, MarkLook, cardLook, contrastRatio, markLook, parseCardColor, parseCardDisplay, parseCardUri } from './display.js';
+export { CredentialsServiceError, HolderCallOptions, RequestBinding, blockSender, listBlocks, requestBinding, unblockSender } from './holder.js';
+export { senderKeyOf } from './sender.js';
+export { AuthorizationErrorCode, AuthorizationErrorTarget, AuthorizationRequest, AuthorizationResponse, CreateAuthorizationRequestInput, CreatePresentationInput, DEFAULT_RESPONSE_ENCRYPTION_ENC, DcqlClaimQuery, DcqlCredentialQuery, DcqlQuery, FailedQuery, JweEnc, MAX_CLAIMS_PER_QUERY, MAX_CREDENTIAL_QUERIES, MAX_REQUEST_LIFETIME_SECONDS, MAX_REQUEST_OBJECT_LENGTH, MAX_RESPONSE_BODY_LENGTH, MatchFailure, MatchResult, Oid4vpError, Oid4vpErrorCode, P256PrivateJwk, P256PublicJwk, ParsedAuthorizationResponse, QueryResult, RESPONSE_ENCRYPTION_ENC, RESPONSE_ENCRYPTION_ENCS, ResponseFailureCode, ResponseMode, SELF_ISSUED_AUDIENCE, SendAuthorizationErrorInput, VerifiedAuthorizationResponse, VerifyAuthorizationRequestOptions, VerifyAuthorizationResponseInput, VpToken, WalletLink, authorizationErrorFor, buildWalletLink, createAuthorizationErrorResponse, createAuthorizationRequest, createAuthorizationResponse, createPresentation, decodeOwnAuthorizationRequest, generateResponseKeyPair, matchCredential, parseAuthorizationResponse, parseWalletLink, sendAuthorizationError, summarizeDcql, validateDcql, verifyAuthorizationRequest, verifyAuthorizationResponse } from './oid4vp.js';
+export { AuthorizationServerMetadata, BuildIssuerMetadataInput, ClaimDescription, CredentialConfiguration, CredentialIssuerMetadata, CredentialOffer, CredentialRequest, CredentialResponse, DeferredCredentialRequest, DeferredCredentialResponse, DeferredResult, Display, IssuedResult, IssuerConfigurationInput, NonceResponse, NotificationEvent, NotificationRequest, OAuthErrorResponse, Oid4vciError, Oid4vciErrorCode, PreAuthorizedCodeGrant, RedeemOfferInput, TokenRequest, TokenResponse, TxCode, VerifiedProof, VerifyProofJwtOptions, authorizationServerMetadataUrl, buildAuthorizationServerMetadata, buildCredentialOffer, buildIssuerMetadata, createProofJwt, fetchCredentialOffer, fetchIssuerMetadata, issuerMetadataUrl, pollDeferred, redeemOffer, sendNotification, validateCredentialOffer, verifyProofJwt } from './oid4vci.js';
+export { C as CredentialsKitError } from './errors-BKQmNpXX.js';
+export { F as FetchLike, H as HostPolicy, i as isFetchableUrl, a as isPrivateHost } from './http-BhuJ_-RZ.js';
+export { J as JsonObject } from './util-DOTEZgTt.js';

package/dist/index.js

@@ -0,0 +1,16 @@
+export { WEBHOOK_MAX_AGE_SECONDS, WEBHOOK_MAX_FUTURE_SECONDS, signWebhook, verifyWebhook } from './chunk-WND2LZ4O.js';
+export { CARD_COLOR_PATTERN, CARD_DARK_TEXT, CARD_DISPLAY_MEMBERS, CARD_HUES, CARD_LIGHT_TEXT, CARD_PATTERNS, MAX_CARD_URI_LENGTH, MIN_TEXT_CONTRAST, cardLook, contrastRatio, markLook, parseCardColor, parseCardDisplay, parseCardUri } from './chunk-46VRPQPD.js';
+export { CredentialsServiceError, blockSender, listBlocks, requestBinding, unblockSender } from './chunk-RKKRO4ZK.js';
+export { senderKeyOf } from './chunk-ZZY4WGQ6.js';
+export { Oid4vciError, authorizationServerMetadataUrl, buildAuthorizationServerMetadata, buildCredentialOffer, buildIssuerMetadata, createProofJwt, fetchCredentialOffer, fetchIssuerMetadata, issuerMetadataUrl, pollDeferred, redeemOffer, sendNotification, validateCredentialOffer, verifyProofJwt } from './chunk-FSKCDHZ7.js';
+export { DEFAULT_RESPONSE_ENCRYPTION_ENC, MAX_CLAIMS_PER_QUERY, MAX_CREDENTIAL_QUERIES, MAX_REQUEST_LIFETIME_SECONDS, MAX_REQUEST_OBJECT_LENGTH, MAX_RESPONSE_BODY_LENGTH, Oid4vpError, RESPONSE_ENCRYPTION_ENC, RESPONSE_ENCRYPTION_ENCS, SELF_ISSUED_AUDIENCE, authorizationErrorFor, buildWalletLink, createAuthorizationErrorResponse, createAuthorizationRequest, createAuthorizationResponse, createPresentation, decodeOwnAuthorizationRequest, generateResponseKeyPair, matchCredential, parseAuthorizationResponse, parseWalletLink, sendAuthorizationError, summarizeDcql, validateDcql, verifyAuthorizationRequest, verifyAuthorizationResponse } from './chunk-2SF56NEJ.js';
+export { ABILITIES, ABILITY_HOLD, ABILITY_ISSUE, ABILITY_OFFER, ABILITY_PRESENT, ABILITY_VERIFY, AGE_CLAIMS, BLOCKED_ERROR, CLIENT_ID_PREFIX, CREDENTIAL_FORMAT, HEADERS, IDENTITY_LEVEL1_CONFIGURATION_ID, IDENTITY_LEVEL1_VCT, KB_JWT_TYP, KYC_AML_LEVEL1_VCT, MAX_BLOCKS_PER_PERSON, MEDIA_TYPES, PRE_AUTHORIZED_CODE_GRANT, PROOF_JWT_TYP, REGISTERED_CLAIMS, REQUEST_OBJECT_TYP, SD_JWT_TYP, STATUS_LIST_JWT_TYP, UCAN_RESOURCE, VAULT_CREDENTIAL_CONTENT_FIELD, VAULT_CREDENTIAL_EVENT_TYPE, VAULT_CREDENTIAL_INDEX_TYPE, VCT_STATE_KEYS, WEBHOOK_EVENT_TYPES, WEBHOOK_SIGNATURE_HEADER, entityResource, stateKeyForVct } from './chunk-I6GBYFIJ.js';
+export { VERIFY_FAILURE_DETAILS, VerificationUnavailable, verifyIssuedCredential, verifyPresentation } from './chunk-STMMFNVW.js';
+export { MAX_CLAIM_DEPTH, MAX_DISCLOSURES, MAX_SD_JWT_LENGTH, REFUSED_CLAIM_NAMES, SdJwtError, credentialCid, credentialRecordFromSdJwt, parseSdJwt, processDisclosures, sdDigest, sdHash, selectDisclosures, serializeSdJwt } from './chunk-XREZY53L.js';
+export { MAX_STATUS_LIST_BYTES, MAX_STATUS_LIST_TOKEN_LENGTH, STATUS_INVALID, STATUS_LIST_MEDIA_TYPE, STATUS_LIST_TYP, STATUS_SUSPENDED, STATUS_VALID, StatusListError, createStatusListToken, deflateStatusList, getStatusBit, inflateStatusList, newStatusBits, randomFreeIndex, setStatusBit, statusAt, verifyStatusListToken } from './chunk-JBUX6V2Q.js';
+export { IXO_ENTITY_DID, IXO_PERSON_DID, MAX_DID_WEB_LENGTH, MAX_METHODS_PER_RELATIONSHIP, ResolverUnavailable, composeResolvers, createIxoResolver, createMemoryCache, createStaticResolver, createWebResolver, didFromKid, didWebUrl, ed25519KeyOfMethod, findKey, isCanonicalHost, keysFor, normalizeDidDocument, parseDidWeb } from './chunk-WIEGZFUO.js';
+export { isFetchableUrl, isPrivateHost } from './chunk-Q3MZNMCK.js';
+export { CredentialsKitError, ED25519_JWS_ALGS, JoseError, MAX_JWS_LENGTH, MAX_KEY_STRING_LENGTHS, base58btc, base64url, decodeJws, ed25519, ed25519SeedFromMnemonic, isEd25519JwsAlg, multibaseToRaw, publicJwkFromRaw, rawFromPublicJwk, rawToMultibase, signJws, signerFromEd25519Seed, verifyEd25519, verifyJws } from './chunk-VXKONZK4.js';
+import './chunk-AQ3IINHC.js';
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js"}

package/dist/jose.d.ts

@@ -0,0 +1,134 @@
+import { C as CredentialsKitError } from './errors-BKQmNpXX.js';
+import { J as JsonObject } from './util-DOTEZgTt.js';
+
+/** base64url without padding (RFC 7515 §2). */
+declare function base64urlEncode(bytes: Uint8Array): string;
+/**
+ * Strict base64url decode: only the URL-safe alphabet, no padding, no whitespace, and the
+ * canonical encoding only (unused trailing bits must be zero), so one byte string has exactly
+ * one accepted text form. Throws on anything else.
+ */
+declare function base64urlDecode(s: string): Uint8Array<ArrayBuffer>;
+/** base58btc (Bitcoin alphabet), as used by did:key, multibase `z` and IXO key ids. */
+declare function base58btcEncode(bytes: Uint8Array): string;
+declare function base58btcDecode(s: string): Uint8Array<ArrayBuffer>;
+
+/** Signs bytes with one Ed25519 key. `kid` is the key's DID URL (`<did>#<fragment>`). */
+interface Signer {
+    kid: string;
+    sign(bytes: Uint8Array): Promise<Uint8Array>;
+}
+/** A `Signer` built from a local seed, which also knows its public key. */
+interface Ed25519Signer extends Signer {
+    publicKey: Uint8Array;
+    publicJwk: Ed25519PublicJwk;
+}
+/** An Ed25519 public key as an OKP JWK (RFC 8037). */
+interface Ed25519PublicJwk {
+    kty: 'OKP';
+    crv: 'Ed25519';
+    x: string;
+}
+/** The JWS `alg` values the kit accepts for an Ed25519 signature (RFC 8037, RFC 9864). */
+declare const ED25519_JWS_ALGS: readonly ["EdDSA", "Ed25519"];
+type Ed25519JwsAlg = (typeof ED25519_JWS_ALGS)[number];
+/** True for `"EdDSA"` and `"Ed25519"`. */
+declare function isEd25519JwsAlg(alg: unknown): alg is Ed25519JwsAlg;
+interface JwsHeader {
+    /** The kit's own artefacts use `EdDSA`; `Ed25519` is allowed for callers that need it. */
+    alg: Ed25519JwsAlg;
+    typ?: string;
+    kid?: string;
+    [name: string]: unknown;
+}
+interface DecodedJws {
+    header: JsonObject;
+    payload: JsonObject;
+    signature: Uint8Array;
+    /** `<base64url header>.<base64url payload>`, the bytes the signature covers. */
+    signingInput: string;
+}
+type JoseErrorCode = 'malformed' | 'unsupported_alg' | 'bad_signature' | 'bad_key';
+declare class JoseError extends CredentialsKitError {
+    readonly code: JoseErrorCode;
+    constructor(code: JoseErrorCode);
+}
+/** Largest compact JWS `decodeJws` accepts (1 MiB). */
+declare const MAX_JWS_LENGTH: number;
+/**
+ * Sign `payload` under exactly `header` (`alg` `"EdDSA"` or `"Ed25519"`). The caller sets `typ`
+ * and `kid`; nothing is added implicitly.
+ */
+declare function signJws(header: JwsHeader, payload: JsonObject, signer: Pick<Signer, 'sign'>): Promise<string>;
+/**
+ * Split and decode a compact JWS without verifying it. Throws `JoseError('malformed')`, also for
+ * a header carrying `crit` (no extension is understood).
+ */
+declare function decodeJws(compact: string): DecodedJws;
+/** Ed25519 signature check (strict RFC 8032). False for any malformed input. */
+declare function verifyEd25519(signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array): boolean;
+/**
+ * Decode and verify a compact JWS with an Ed25519 public key. Requires `alg` `"EdDSA"` or
+ * `"Ed25519"`.
+ * Returns the decoded JWS; throws `JoseError` (`malformed`, `unsupported_alg`,
+ * `bad_signature`). Checks nothing in the payload: callers check `typ`, `exp`, `aud`, ….
+ */
+declare function verifyJws(compact: string, publicKey: Uint8Array): Promise<DecodedJws>;
+/** The OKP JWK of a raw 32-byte Ed25519 public key. */
+declare function publicJwkFromRaw(raw: Uint8Array): Ed25519PublicJwk;
+/** The raw 32-byte key of an Ed25519 OKP public JWK. Refuses a private JWK (one with `d`). */
+declare function rawFromPublicJwk(jwk: unknown): Uint8Array;
+/**
+ * Longest key strings decoded (SPEC §13.3: cap before decoding; base58 decoding is quadratic).
+ * A 34-byte multicodec key is at most 47 base58 characters plus `z`; a bare 32-byte key at most
+ * 44; hex is exactly 64; a JWK `x` exactly 43.
+ */
+declare const MAX_KEY_STRING_LENGTHS: {
+    readonly multibase: 60;
+    readonly base58: 50;
+    readonly hex: 64;
+    readonly jwkX: 43;
+};
+/**
+ * A multibase (`z` + base58btc) Ed25519 public key to raw bytes. Accepts the multicodec-prefixed
+ * form (`z6Mk…`, as did:key and Ed25519VerificationKey2020) and a bare 32-byte key.
+ */
+declare function multibaseToRaw(multibase: string): Uint8Array;
+/** A raw Ed25519 public key as multibase with the ed25519-pub multicodec (`z6Mk…`). */
+declare function rawToMultibase(raw: Uint8Array): string;
+declare const base58btc: {
+    readonly encode: typeof base58btcEncode;
+    readonly decode: typeof base58btcDecode;
+};
+declare const base64url: {
+    readonly encode: typeof base64urlEncode;
+    readonly decode: typeof base64urlDecode;
+};
+/** Ed25519 helpers (SPEC §4 names), grouped. Each is also exported on its own. */
+declare const ed25519: {
+    readonly publicJwkFromRaw: typeof publicJwkFromRaw;
+    readonly rawFromPublicJwk: typeof rawFromPublicJwk;
+    readonly base58btc: {
+        readonly encode: typeof base58btcEncode;
+        readonly decode: typeof base58btcDecode;
+    };
+    readonly multibaseToRaw: typeof multibaseToRaw;
+    readonly rawToMultibase: typeof rawToMultibase;
+    readonly verify: typeof verifyEd25519;
+    /** The raw 32-byte public key of a 32-byte seed. */
+    readonly publicKeyFromSeed: (seed: Uint8Array) => Uint8Array;
+};
+/**
+ * A `Signer` for a 32-byte Ed25519 seed (RFC 8032 secret key). The seed stays in the closure;
+ * `kid` must be the DID URL under which the matching public key is published.
+ */
+declare function signerFromEd25519Seed(seed: Uint8Array, kid: string): Ed25519Signer;
+/**
+ * The IXO service-key convention (VFS, kyc-server, UCAN store, Self): seed =
+ * SHA-256(UTF-8(mnemonic.trim())). Use with `signerFromEd25519Seed`. This is NOT a BIP-39
+ * derivation; wallets that derive keys from a mnemonic differently must use their own.
+ */
+declare function ed25519SeedFromMnemonic(mnemonic: string): Uint8Array;
+
+export { CredentialsKitError, ED25519_JWS_ALGS, JoseError, JsonObject, MAX_JWS_LENGTH, MAX_KEY_STRING_LENGTHS, base58btc, base64url, decodeJws, ed25519, ed25519SeedFromMnemonic, isEd25519JwsAlg, multibaseToRaw, publicJwkFromRaw, rawFromPublicJwk, rawToMultibase, signJws, signerFromEd25519Seed, verifyEd25519, verifyJws };
+export type { DecodedJws, Ed25519JwsAlg, Ed25519PublicJwk, Ed25519Signer, JoseErrorCode, JwsHeader, Signer };

package/dist/jose.js

@@ -0,0 +1,4 @@
+export { CredentialsKitError, ED25519_JWS_ALGS, JoseError, MAX_JWS_LENGTH, MAX_KEY_STRING_LENGTHS, base58btc, base64url, decodeJws, ed25519, ed25519SeedFromMnemonic, isEd25519JwsAlg, multibaseToRaw, publicJwkFromRaw, rawFromPublicJwk, rawToMultibase, signJws, signerFromEd25519Seed, verifyEd25519, verifyJws } from './chunk-VXKONZK4.js';
+import './chunk-AQ3IINHC.js';
+//# sourceMappingURL=jose.js.map
+//# sourceMappingURL=jose.js.map

package/dist/jose.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"jose.js"}