@kubun/plugin-credential 0.17.0 → 0.17.2

package/lib/service.js

@@ -1,5 +1,5 @@
 import { isSigningIdentity, normalizeDID } from '@kokuin/token';
-import { createCredentialAPI, createCredentialManager } from '@kubun/credential';
+import { CredentialAliasAlreadyBound, CredentialBindNotAuthorized, CredentialEntryAlreadyAliased, CredentialInvalidEntry, CredentialKeyVersionMismatch, CredentialNotFound, CredentialSupersededBranch, createCredentialAPI, createCredentialManager } from '@kubun/credential';
 import { authorizeRead, authorizeWrite, ServiceAuthorizationError } from '@kubun/plugin-service-server';
 import { credentialStoreDefinition, getCredentialStore } from '@kubun/store-credential';
 // The spelling of a DID that can be encrypted to. A did:peer:4 identity carries a
@@ -9,6 +9,44 @@ function wrappableDID(identity) {
     const longForm = identity.longForm;
     return typeof longForm === 'string' ? longForm : identity.id;
 }
+// The service boundary has no CREDENTIAL_* → KB* mapping; toHandlerError forwards
+// a thrown error's `code` only when it is already a registered KubunErrorCode,
+// preserving `data`. This maps the known credential outcomes to an envelope code
+// plus a stable `data.reason`, so a remote caller can branch on it without seeing
+// the internal CREDENTIAL_* code or message. `ServiceAuthorizationError` (Gate A)
+// already carries KB07 on its own `code` getter and never reaches this function —
+// it throws before the try/catch below. An unmapped error stays opaque.
+function translateCredentialError(err) {
+    if (err instanceof CredentialBindNotAuthorized) {
+        return withCode(err, 'KB07', 'CREDENTIAL_NOT_AUTHORIZED');
+    }
+    if (err instanceof CredentialAliasAlreadyBound) {
+        return withCode(err, 'KB04', 'CREDENTIAL_ALIAS_ALREADY_BOUND');
+    }
+    if (err instanceof CredentialEntryAlreadyAliased) {
+        return withCode(err, 'KB04', 'CREDENTIAL_ENTRY_ALREADY_ALIASED');
+    }
+    if (err instanceof CredentialNotFound) {
+        return withCode(err, 'KB02', 'CREDENTIAL_NOT_FOUND');
+    }
+    if (err instanceof CredentialInvalidEntry) {
+        return withCode(err, 'KB01', 'CREDENTIAL_INVALID_ENTRY');
+    }
+    if (err instanceof CredentialSupersededBranch || err instanceof CredentialKeyVersionMismatch) {
+        return withCode(err, 'KB01', 'CREDENTIAL_INVALID_ENTRY');
+    }
+    return err;
+}
+function withCode(cause, code, reason) {
+    return {
+        code,
+        message: cause.message,
+        data: {
+            reason
+        },
+        cause
+    };
+}
 /**
  * The credential service provider. Unlike {@link createCredentialPlugin}
  * (graph-schema-only, for an engine that consumes credentials), this registers a
@@ -146,6 +184,19 @@ function wrappableDID(identity) {
                 });
                 await writeInTx((seam)=>seam.deleteCredential(param.providerName, param.ownerDID));
                 return null;
+            },
+            'credential/bind-alias': async (context)=>{
+                const param = context.param;
+                await authorizeWrite({
+                    context,
+                    subject: param.ownerDID
+                }); // Gate A
+                try {
+                    await writeInTx((seam)=>seam.bindAlias(param.providerName, param.ownerDID, param.entryID));
+                } catch (err) {
+                    throw translateCredentialError(err);
+                }
+                return null;
             }
         };
         params.registerProvider('service', {
@@ -166,6 +217,9 @@ function wrappableDID(identity) {
                 },
                 'credential/delete': {
                     allow: true
+                },
+                'credential/bind-alias': {
+                    allow: true
                 }
             }
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/plugin-credential",
-  "version": "0.17.0",
+  "version": "0.17.2",
   "license": "see LICENSE.md",
   "sideEffects": false,
   "type": "module",
@@ -15,18 +15,19 @@
   ],
   "dependencies": {
     "@kokuin/token": "^0.5.0",
-    "@kubun/credential": "^0.17.0",
+    "@kubun/credential": "^0.17.1",
     "@kubun/db": "^0.17.0",
-    "@kubun/engine": "^0.17.0",
-    "@kubun/graphql": "^0.17.0",
+    "@kubun/engine": "^0.17.1",
+    "@kubun/graphql": "^0.17.1",
     "@kubun/hlc": "^0.17.0",
     "@kubun/id": "^0.17.0",
     "@kubun/plugin-service-api": "^0.17.0",
     "@kubun/plugin-service-server": "^0.17.0",
-    "@kubun/store-credential": "^0.17.0",
+    "@kubun/protocol": "^0.17.0",
+    "@kubun/store-credential": "^0.17.3",
     "@sozai/codec": "^0.4.0",
     "@sozai/runtime": "^0.1.0",
-    "graphql": "^16.14.2"
+    "graphql": "^17.0.2"
   },
   "devDependencies": {
     "@enkaku/client": "^0.21.2",
@@ -34,7 +35,7 @@
     "@kokuin/capability": "^0.3.0",
     "@kokuin/controller": "^0.1.0",
     "@kubun/db-better-sqlite": "^0.17.0",
-    "@kubun/service-credential-api": "^0.17.0",
+    "@kubun/service-credential-api": "^0.17.1",
     "@kubun/store-controller": "^0.17.0",
     "@kubun/store-graph": "^0.17.0",
     "@kubun/test-utils": "^0.0.0"