@kubun/credential 0.14.2 → 0.15.0

package/lib/api.d.ts

@@ -37,6 +37,15 @@ export type CredentialAPI = {
         credential: string;
     }) => Promise<void>;
     deleteCredential: (providerName: string, ownerDID: string) => Promise<void>;
+    /**
+     * The normalized owner DIDs that currently hold a credential for `providerName`.
+     *
+     * A credential is pointed at by an alias keyed `(providerName, normalizeDID(
+     * ownerDID))`, so the alias keys under a provider namespace are exactly its
+     * authenticated owners — already normalized, so a caller can key sync state or
+     * a schedule on them directly. Empty when no owner holds one.
+     */
+    listSubjects: (providerName: string) => Promise<Array<string>>;
     /**
      * The controller resolvers for this API's (request-scoped) transaction
      * provider — the exact `methods` the credential mint passes to `createKey`.

package/lib/api.js

@@ -6,6 +6,9 @@ export function createCredentialAPI(params) {
     const getAliasStore = ()=>getCredentialStore(params.stores);
     const getCredentials = ()=>params.getCredentialManager(params.stores);
     return {
+        async listSubjects (providerName) {
+            return (await getAliasStore()).listAliasKeys(providerName);
+        },
         async getCredential (providerName, ownerDID) {
             const store = await getAliasStore();
             const entryID = await store.getAliasEntryID(providerName, normalizeDID(ownerDID));

package/lib/manager.d.ts

@@ -200,7 +200,7 @@ export type CredentialManager = {
     /** Zero the cached content key. TTL eviction does the same thing. */
     lock(keyID: string): void;
     lockAll(): void;
-    status(keyID: string): Promise<CredentialKeyStatus>;
+    status(keyID: string, version?: number): Promise<CredentialKeyStatus>;
     /**
      * Add a factor to THIS device's wrapping, leaving every other recipient's
      * alone. Adding a `pin` therefore gates this device and no other, which is the

package/lib/manager.js

@@ -480,7 +480,7 @@ export function createCredentialManager(params) {
             lockAllEpoch += 1;
             cache.evictAll();
         },
-        async status (keyID) {
+        async status (keyID, version) {
             const key = await store.getKey(keyID);
             if (key == null) {
                 throw new CredentialNotFound('Credential key', keyID);
@@ -494,12 +494,16 @@ export function createCredentialManager(params) {
                     reason: 'unsupported-suite'
                 };
             }
-            if (cache.has(keyID, key.version)) {
+            // Defaults to the key's current version; a caller checking a manifest
+            // target passes the expected version so a stale wrapping is never
+            // reported openable for a newer one, or vice versa.
+            const targetVersion = version ?? key.version;
+            if (cache.has(keyID, targetVersion)) {
                 return {
                     state: 'unlocked'
                 };
             }
-            const wrappings = await store.listWrappings(keyID, key.version);
+            const wrappings = await store.listWrappings(keyID, targetVersion);
             if (wrappings.length === 0) {
                 return {
                     state: 'unopenable',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/credential",
-  "version": "0.14.2",
+  "version": "0.15.0",
   "keywords": [],
   "license": "see LICENSE.md",
   "sideEffects": false,
@@ -17,12 +17,12 @@
   "dependencies": {
     "@kokuin/jwe": "^0.1.0",
     "@kokuin/token": "^0.5.0",
-    "@kubun/credential-types": "^0.14.0",
-    "@kubun/db": "^0.14.0",
-    "@kubun/hlc": "^0.14.0",
-    "@kubun/id": "^0.14.0",
-    "@kubun/logger": "^0.14.0",
-    "@kubun/store-credential": "^0.14.0",
+    "@kubun/credential-types": "^0.15.0",
+    "@kubun/db": "^0.15.0",
+    "@kubun/hlc": "^0.15.0",
+    "@kubun/id": "^0.15.0",
+    "@kubun/logger": "^0.15.0",
+    "@kubun/store-credential": "^0.15.0",
     "@noble/ciphers": "^2.4.0",
     "@noble/hashes": "^2.4.0",
     "@sozai/codec": "^0.4.0",
@@ -30,7 +30,7 @@
     "@sozai/runtime": "^0.1.0"
   },
   "devDependencies": {
-    "@kubun/db-better-sqlite": "^0.14.0"
+    "@kubun/db-better-sqlite": "^0.15.0"
   },
   "publishConfig": {
     "access": "public"