@kokuin/token 0.5.1 → 0.6.0

package/lib/did.d.ts

@@ -1,5 +1,5 @@
 import type { DIDResolver } from './cache.js';
-import { type MethodRegistry } from './method.js';
+import { type MethodRegistry, type ResolvedSigningKey } from './method.js';
 import type { DIDDoc } from './peer4.js';
 import type { SignatureAlgorithm } from './schemas.js';
 import type { DIDString } from './types.js';
@@ -142,3 +142,13 @@ export declare function normalizeDID(did: string): string;
  * A sender MUST use the published key: the derived one is a different key and will not decrypt.
  */
 export declare function getAgreementKey(doc: DIDDoc): Uint8Array | null;
+/**
+ * The signing keys a DID carries in its identifier, or `null` when it carries none. `did:key` is its
+ * key; a `did:peer:4` long form embeds the document, so its `authentication` keys (signing is what
+ * a pin or a membership is for) are readable from the string. Anything network-backed -- a
+ * short-form `did:peer:4`, `did:kokuin:` -- answers `null` rather than looking up.
+ *
+ * Throws on an identifier that claims to carry a key and does not; the caller treats that as no
+ * match.
+ */
+export declare function signingKeysOf(did: string): Array<ResolvedSigningKey> | null;

package/lib/did.js

@@ -365,3 +365,47 @@ function resolveKidFromDoc(doc, kid) {
     }
     return null;
 }
+/** As long as `resolveKidFromDoc` allows: base58 decoding is O(n^2). */ const MAX_KEY_ENCODED = 64;
+/**
+ * The signing keys a DID carries in its identifier, or `null` when it carries none. `did:key` is its
+ * key; a `did:peer:4` long form embeds the document, so its `authentication` keys (signing is what
+ * a pin or a membership is for) are readable from the string. Anything network-backed -- a
+ * short-form `did:peer:4`, `did:kokuin:` -- answers `null` rather than looking up.
+ *
+ * Throws on an identifier that claims to carry a key and does not; the caller treats that as no
+ * match.
+ */ export function signingKeysOf(did) {
+    if (did.startsWith('did:key:')) {
+        const [alg, publicKey] = getSignatureInfo(did);
+        return [
+            {
+                alg,
+                publicKey
+            }
+        ];
+    }
+    if (!isPeer4(did) || did === getPeer4ShortForm(did)) {
+        return null;
+    }
+    const { doc } = decodePeer4(did);
+    const keys = [];
+    for (const id of doc.authentication ?? []){
+        const method = doc.verificationMethod.find((entry)=>entry.id === id);
+        if (method == null || method.publicKeyMultibase.length > MAX_KEY_ENCODED) {
+            continue;
+        }
+        let info = null;
+        try {
+            info = getAlgorithmAndPublicKey(decodeMultibase(method.publicKeyMultibase));
+        } catch  {
+            continue;
+        }
+        if (info != null) {
+            keys.push({
+                alg: info[0],
+                publicKey: info[1]
+            });
+        }
+    }
+    return keys;
+}

package/lib/index.d.ts

@@ -10,10 +10,10 @@
  * @module token
  */
 export { type CreateInMemoryDIDCacheOptions, createInMemoryDIDCache, type DIDCache, type DIDResolver, } from './cache.js';
-export { CODECS, getAgreementKey, getAlgorithmAndPublicKey, getDID, getSignatureInfo, IssuerKeyNotFoundError, isIssuerKeyNotFoundError, isUnresolvableIssuerError, normalizeDID, type ResolveIssuerHeader, type ResolveIssuerMode, type ResolveIssuerWithDocResult, resolveIssuer, resolveIssuerWithDoc, UnresolvableIssuerError, } from './did.js';
+export { CODECS, getAgreementKey, getAlgorithmAndPublicKey, getDID, getSignatureInfo, IssuerKeyNotFoundError, isIssuerKeyNotFoundError, isUnresolvableIssuerError, normalizeDID, type ResolveIssuerHeader, type ResolveIssuerMode, type ResolveIssuerWithDocResult, resolveIssuer, resolveIssuerWithDoc, signingKeysOf, UnresolvableIssuerError, } from './did.js';
 export { type CreateIdentityInput, createFullIdentity, createIdentity, createKeyAgreementIdentity, createKeyAgreementIdentityForDID, createSigningIdentity, createSigningIdentityForDID, type FullIdentity, type Identity, type IdentityKeySpec, type IdentityProvider, isFullIdentity, isKeyAgreementIdentity, isOwnIdentity, isSigningIdentity, type KeyAgreementIdentity, type KeyAlg, type KeyPurpose, type MultiKeyIdentity, type OwnIdentity, type ResolvedKey, randomIdentity, type SigningIdentity, type SignTokenOptions, } from './identity.js';
 export type { KeyEntry, KeyStore, MutableKeyEntry } from './keystore.js';
-export { type AgreementAlgorithm, type DIDMethodResolver, findMethodResolver, type MethodRegistry, type ResolvedAgreementKey, type ResolvedSigningKey, } from './method.js';
+export { type AgreementAlgorithm, type DIDMethodResolver, findMethodResolver, type MemberQuery, type MethodRegistry, type ResolvedAgreementKey, type ResolvedMember, type ResolvedSigningKey, } from './method.js';
 export { decodeMultibase, encodeMultibase, multihashSHA256, verifyMultihash, } from './multibase.js';
 export { type DecodePeer4Options, type DIDDoc, decodePeer4, encodePeer4, getPeer4ShortForm, isPeer4, type VerificationMethod, validateDIDDoc, } from './peer4.js';
 export { capabilitySchema, type SignatureAlgorithm, type SignedHeader, type SignedPayload, type SupportedHeader, signedHeaderSchema, signedPayloadSchema, supportedHeaderSchema, type UnsignedHeader, unsignedHeaderSchema, validateAlgorithm, validateSignedHeader, validateSignedPayload, validateUnsignedHeader, } from './schemas.js';

package/lib/index.js

@@ -9,7 +9,7 @@
  *
  * @module token
  */ export { createInMemoryDIDCache } from './cache.js';
-export { CODECS, getAgreementKey, getAlgorithmAndPublicKey, getDID, getSignatureInfo, IssuerKeyNotFoundError, isIssuerKeyNotFoundError, isUnresolvableIssuerError, normalizeDID, resolveIssuer, resolveIssuerWithDoc, UnresolvableIssuerError } from './did.js';
+export { CODECS, getAgreementKey, getAlgorithmAndPublicKey, getDID, getSignatureInfo, IssuerKeyNotFoundError, isIssuerKeyNotFoundError, isUnresolvableIssuerError, normalizeDID, resolveIssuer, resolveIssuerWithDoc, signingKeysOf, UnresolvableIssuerError } from './did.js';
 export { createFullIdentity, createIdentity, createKeyAgreementIdentity, createKeyAgreementIdentityForDID, createSigningIdentity, createSigningIdentityForDID, isFullIdentity, isKeyAgreementIdentity, isOwnIdentity, isSigningIdentity, randomIdentity } from './identity.js';
 export { findMethodResolver } from './method.js';
 export { decodeMultibase, encodeMultibase, multihashSHA256, verifyMultihash } from './multibase.js';

package/lib/method.d.ts

@@ -5,6 +5,17 @@ export type ResolvedSigningKey = {
     alg: SignatureAlgorithm;
     publicKey: Uint8Array;
 };
+/** The member of a subject's management tier being asked about: its DID, `add` digest and generation. */
+export type MemberQuery = {
+    did: string;
+    add: string;
+    gen: number;
+};
+/** The signing key a subject's log pins for a member, and when that membership lapses (unix seconds). */
+export type ResolvedMember = {
+    key: ResolvedSigningKey;
+    lease: number;
+};
 export type AgreementAlgorithm = 'X25519';
 /** A key agreement key a DID method resolved for a recipient. */
 export type ResolvedAgreementKey = {
@@ -64,6 +75,17 @@ export type DIDMethodResolver = {
      * break every implementation for a member most methods have no answer for.
      */
     resolveDenySet?(did: string): Promise<ReadonlySet<string>>;
+    /**
+     * The key and lease the subject's log holds for one **member** of its management tier, answered for
+     * **now**. A grant issued by a member rather than by the subject's own key is valid only while that
+     * membership is live, so the verifier asks the log rather than trusting the grant's claims.
+     *
+     * Optional, and its **absence fails closed**: a method that cannot answer refuses every
+     * member-issued grant rather than falling back to {@link resolve}, which names the subject's own
+     * keys and would answer a different question. A member that is unknown, removed or lapsed must
+     * reject, never resolve.
+     */
+    resolveMember?(subject: string, member: MemberQuery): Promise<ResolvedMember>;
 };
 export type MethodRegistry = ReadonlyArray<DIDMethodResolver>;
 /** Total: a malformed DID yields `undefined` rather than throwing. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kokuin/token",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "JWT signing and verification",
   "keywords": [
     "json",
@@ -30,13 +30,13 @@
     "@noble/curves": "^2.4.0",
     "@noble/hashes": "^2.4.0",
     "@scure/base": "^2.4.0",
-    "@sozai/codec": "^0.4.2",
-    "@sozai/otel": "^0.3.3",
+    "@sozai/codec": "^0.4.3",
+    "@sozai/otel": "^0.3.4",
     "@sozai/schema": "^0.1.6"
   },
   "devDependencies": {
-    "@opentelemetry/sdk-trace-base": "^2.12.0",
-    "@opentelemetry/sdk-trace-node": "^2.12.0",
+    "@opentelemetry/api": "^1.10.0",
+    "@opentelemetry/sdk-trace": "^3.0.0",
     "uint8arrays": "^6.1.1"
   },
   "publishConfig": {