@kubun/service-credential-api 0.14.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/LICENSE.md +57 -0
  2. package/lib/adapter.d.ts +10 -0
  3. package/lib/adapter.js +59 -0
  4. package/lib/index.d.ts +137 -0
  5. package/lib/index.js +182 -0
  6. package/package.json +35 -0
package/LICENSE.md ADDED
@@ -0,0 +1,57 @@
1
+ # The Prosperity Public License 3.0.0
2
+
3
+ Contributor: Paul Le Cam
4
+
5
+ Source Code: https://github.com/PaulLeCam/kubun
6
+
7
+ ## Purpose
8
+
9
+ This license allows you to use and share this software for noncommercial purposes for free and to try this software for commercial purposes for thirty days.
10
+
11
+ ## Agreement
12
+
13
+ In order to receive this license, you have to agree to its rules. Those rules are both obligations under that agreement and conditions to your license. Don't do anything with this software that triggers a rule you can't or won't follow.
14
+
15
+ ## Notices
16
+
17
+ Make sure everyone who gets a copy of any part of this software from you, with or without changes, also gets the text of this license and the contributor and source code lines above.
18
+
19
+ ## Commercial Trial
20
+
21
+ Limit your use of this software for commercial purposes to a thirty-day trial period. If you use this software for work, your company gets one trial period for all personnel, not one trial per person.
22
+
23
+ ## Contributions Back
24
+
25
+ Developing feedback, changes, or additions that you contribute back to the contributor on the terms of a standardized public software license such as [the Blue Oak Model License 1.0.0](https://blueoakcouncil.org/license/1.0.0), [the Apache License 2.0](https://www.apache.org/licenses/LICENSE-2.0.html), [the MIT license](https://spdx.org/licenses/MIT.html), or [the two-clause BSD license](https://spdx.org/licenses/BSD-2-Clause.html) doesn't count as use for a commercial purpose.
26
+
27
+ ## Personal Uses
28
+
29
+ Personal use for research, experiment, and testing for the benefit of public knowledge, personal study, private entertainment, hobby projects, amateur pursuits, or religious observance, without any anticipated commercial application, doesn't count as use for a commercial purpose.
30
+
31
+ ## Noncommercial Organizations
32
+
33
+ Use by any charitable organization, educational institution, public research organization, public safety or health organization, environmental protection organization, or government institution doesn't count as use for a commercial purpose regardless of the source of funding or obligations resulting from the funding.
34
+
35
+ ## Defense
36
+
37
+ Don't make any legal claim against anyone accusing this software, with or without changes, alone or with other technology, of infringing any patent.
38
+
39
+ ## Copyright
40
+
41
+ The contributor licenses you to do everything with this software that would otherwise infringe their copyright in it.
42
+
43
+ ## Patent
44
+
45
+ The contributor licenses you to do everything with this software that would otherwise infringe any patents they can license or become able to license.
46
+
47
+ ## Reliability
48
+
49
+ The contributor can't revoke this license.
50
+
51
+ ## Excuse
52
+
53
+ You're excused for unknowingly breaking [Notices](#notices) if you take all practical steps to comply within thirty days of learning you broke the rule.
54
+
55
+ ## No Liability
56
+
57
+ ***As far as the law allows, this software comes as is, without any warranty or condition, and the contributor won't be liable to anyone for any damages related to this software or this license, under any kind of legal claim.***
package/lib/adapter.d.ts ADDED
@@ -0,0 +1,10 @@
1
+ import type { Client } from '@enkaku/client';
2
+ import type { CredentialProvider } from '@kubun/credential-types';
3
+ import type { CredentialServiceProtocol } from './index.js';
4
+ export type CredentialProviderWithProvenance = CredentialProvider & {
5
+ getCredentialProvenance(providerName: string, ownerDID: string): Promise<{
6
+ updatedAt: string | null;
7
+ writerDID: string | null;
8
+ } | null>;
9
+ };
10
+ export declare function toCredentialProvider(client: Client<CredentialServiceProtocol>): CredentialProviderWithProvenance;
package/lib/adapter.js ADDED
@@ -0,0 +1,59 @@
1
+ // Runtime adapter: turn an authenticated `Client<CredentialServiceProtocol>` into
2
+ // a `CredentialProvider` (plus provenance) the connector plugin can register as a
3
+ // single `credential-provider`. It reuses the exact encoding the local
4
+ // `DBCredentialProvider` writes, so a credential minted through the service reads
5
+ // back byte-identical to one minted standalone.
6
+ import { deserializeCredential, serializeCredential } from '@kubun/credential';
7
+ export function toCredentialProvider(client) {
8
+ return {
9
+ async get (providerName, ownerDID) {
10
+ const raw = await client.request('credential/get', {
11
+ param: {
12
+ providerName,
13
+ ownerDID
14
+ }
15
+ });
16
+ return raw == null ? null : deserializeCredential(raw);
17
+ },
18
+ async set ({ providerName, ownerDID, credential, ownerWrappableDID, controllerWrappableDID }) {
19
+ // Create-vs-refresh dispatches on the owner's wrappable DID, mirroring
20
+ // `DBCredentialProvider.set`: present ⇒ the mint (which fixes who can read),
21
+ // absent ⇒ a re-encrypt that cannot change the recipients.
22
+ if (ownerWrappableDID != null) {
23
+ await client.request('credential/create', {
24
+ param: {
25
+ providerName,
26
+ ownerDID,
27
+ ownerWrappableDID,
28
+ controllerWrappableDID,
29
+ credential: serializeCredential(credential)
30
+ }
31
+ });
32
+ return;
33
+ }
34
+ await client.request('credential/refresh', {
35
+ param: {
36
+ providerName,
37
+ ownerDID,
38
+ credential: serializeCredential(credential)
39
+ }
40
+ });
41
+ },
42
+ async delete (providerName, ownerDID) {
43
+ await client.request('credential/delete', {
44
+ param: {
45
+ providerName,
46
+ ownerDID
47
+ }
48
+ });
49
+ },
50
+ getCredentialProvenance (providerName, ownerDID) {
51
+ return client.request('credential/provenance', {
52
+ param: {
53
+ providerName,
54
+ ownerDID
55
+ }
56
+ });
57
+ }
58
+ };
59
+ }
package/lib/index.d.ts ADDED
@@ -0,0 +1,137 @@
1
+ export { type CredentialProviderWithProvenance, toCredentialProvider, } from './adapter.js';
2
+ export declare const credentialServiceProtocol: {
3
+ readonly 'credential/get': {
4
+ readonly type: "request";
5
+ readonly param: {
6
+ readonly type: "object";
7
+ readonly properties: {
8
+ readonly providerName: {
9
+ readonly type: "string";
10
+ };
11
+ readonly ownerDID: {
12
+ readonly type: "string";
13
+ };
14
+ };
15
+ readonly required: readonly ["providerName", "ownerDID"];
16
+ readonly additionalProperties: false;
17
+ };
18
+ readonly result: {
19
+ readonly anyOf: [{
20
+ readonly type: "string";
21
+ }, {
22
+ readonly type: "null";
23
+ }];
24
+ };
25
+ };
26
+ readonly 'credential/provenance': {
27
+ readonly type: "request";
28
+ readonly param: {
29
+ readonly type: "object";
30
+ readonly properties: {
31
+ readonly providerName: {
32
+ readonly type: "string";
33
+ };
34
+ readonly ownerDID: {
35
+ readonly type: "string";
36
+ };
37
+ };
38
+ readonly required: readonly ["providerName", "ownerDID"];
39
+ readonly additionalProperties: false;
40
+ };
41
+ readonly result: {
42
+ readonly anyOf: [{
43
+ readonly type: "object";
44
+ readonly properties: {
45
+ readonly updatedAt: {
46
+ readonly anyOf: readonly [{
47
+ readonly type: "string";
48
+ }, {
49
+ readonly type: "null";
50
+ }];
51
+ };
52
+ readonly writerDID: {
53
+ readonly anyOf: readonly [{
54
+ readonly type: "string";
55
+ }, {
56
+ readonly type: "null";
57
+ }];
58
+ };
59
+ };
60
+ readonly required: readonly ["updatedAt", "writerDID"];
61
+ readonly additionalProperties: false;
62
+ }, {
63
+ readonly type: "null";
64
+ }];
65
+ };
66
+ };
67
+ readonly 'credential/create': {
68
+ readonly type: "request";
69
+ readonly param: {
70
+ readonly type: "object";
71
+ readonly properties: {
72
+ readonly providerName: {
73
+ readonly type: "string";
74
+ };
75
+ readonly ownerDID: {
76
+ readonly type: "string";
77
+ };
78
+ readonly ownerWrappableDID: {
79
+ readonly type: "string";
80
+ };
81
+ readonly controllerWrappableDID: {
82
+ readonly type: "string";
83
+ };
84
+ readonly credential: {
85
+ readonly type: "string";
86
+ };
87
+ };
88
+ readonly required: readonly ["providerName", "ownerDID", "ownerWrappableDID", "credential"];
89
+ readonly additionalProperties: false;
90
+ };
91
+ readonly result: {
92
+ readonly type: "null";
93
+ };
94
+ };
95
+ readonly 'credential/refresh': {
96
+ readonly type: "request";
97
+ readonly param: {
98
+ readonly type: "object";
99
+ readonly properties: {
100
+ readonly providerName: {
101
+ readonly type: "string";
102
+ };
103
+ readonly ownerDID: {
104
+ readonly type: "string";
105
+ };
106
+ readonly credential: {
107
+ readonly type: "string";
108
+ };
109
+ };
110
+ readonly required: readonly ["providerName", "ownerDID", "credential"];
111
+ readonly additionalProperties: false;
112
+ };
113
+ readonly result: {
114
+ readonly type: "null";
115
+ };
116
+ };
117
+ readonly 'credential/delete': {
118
+ readonly type: "request";
119
+ readonly param: {
120
+ readonly type: "object";
121
+ readonly properties: {
122
+ readonly providerName: {
123
+ readonly type: "string";
124
+ };
125
+ readonly ownerDID: {
126
+ readonly type: "string";
127
+ };
128
+ };
129
+ readonly required: readonly ["providerName", "ownerDID"];
130
+ readonly additionalProperties: false;
131
+ };
132
+ readonly result: {
133
+ readonly type: "null";
134
+ };
135
+ };
136
+ };
137
+ export type CredentialServiceProtocol = typeof credentialServiceProtocol;
package/lib/index.js ADDED
@@ -0,0 +1,182 @@
1
+ // Cross-plugin contract for the credential service: the Enkaku protocol a
2
+ // consuming engine drives over a transport and the credential plugin serves as a
3
+ // `service` provider. Alongside the protocol schema it carries the runtime
4
+ // `toCredentialProvider` adapter (see `./adapter.js`), which maps an
5
+ // authenticated client into the `credential-provider` the connector registers, so
6
+ // this package is no longer type-only.
7
+ export { toCredentialProvider } from './adapter.js';
8
+ // Param↔seam mapping. `providerName`/`ownerDID` are the alias key the seam
9
+ // resolves. `ownerDID` is ALSO the authorization subject: each handler passes it
10
+ // to `context.authorize(ownerDID)` (the per-serve `callerMayActFor`), NOT the
11
+ // Enkaku message `sub` — the host rejects a `sub` that differs from `iss`, so a
12
+ // caller acting for another owner carries that owner in the param, not the
13
+ // envelope. Serialized credential bytes cross as a UTF string; the vault stores
14
+ // the ciphertext, never the plaintext. Writes ack with `null`.
15
+ export const credentialServiceProtocol = {
16
+ 'credential/get': {
17
+ type: 'request',
18
+ param: {
19
+ type: 'object',
20
+ properties: {
21
+ providerName: {
22
+ type: 'string'
23
+ },
24
+ ownerDID: {
25
+ type: 'string'
26
+ }
27
+ },
28
+ required: [
29
+ 'providerName',
30
+ 'ownerDID'
31
+ ],
32
+ additionalProperties: false
33
+ },
34
+ result: {
35
+ anyOf: [
36
+ {
37
+ type: 'string'
38
+ },
39
+ {
40
+ type: 'null'
41
+ }
42
+ ]
43
+ }
44
+ },
45
+ 'credential/provenance': {
46
+ type: 'request',
47
+ param: {
48
+ type: 'object',
49
+ properties: {
50
+ providerName: {
51
+ type: 'string'
52
+ },
53
+ ownerDID: {
54
+ type: 'string'
55
+ }
56
+ },
57
+ required: [
58
+ 'providerName',
59
+ 'ownerDID'
60
+ ],
61
+ additionalProperties: false
62
+ },
63
+ result: {
64
+ anyOf: [
65
+ {
66
+ type: 'object',
67
+ properties: {
68
+ updatedAt: {
69
+ anyOf: [
70
+ {
71
+ type: 'string'
72
+ },
73
+ {
74
+ type: 'null'
75
+ }
76
+ ]
77
+ },
78
+ writerDID: {
79
+ anyOf: [
80
+ {
81
+ type: 'string'
82
+ },
83
+ {
84
+ type: 'null'
85
+ }
86
+ ]
87
+ }
88
+ },
89
+ required: [
90
+ 'updatedAt',
91
+ 'writerDID'
92
+ ],
93
+ additionalProperties: false
94
+ },
95
+ {
96
+ type: 'null'
97
+ }
98
+ ]
99
+ }
100
+ },
101
+ 'credential/create': {
102
+ type: 'request',
103
+ param: {
104
+ type: 'object',
105
+ properties: {
106
+ providerName: {
107
+ type: 'string'
108
+ },
109
+ ownerDID: {
110
+ type: 'string'
111
+ },
112
+ ownerWrappableDID: {
113
+ type: 'string'
114
+ },
115
+ controllerWrappableDID: {
116
+ type: 'string'
117
+ },
118
+ credential: {
119
+ type: 'string'
120
+ }
121
+ },
122
+ required: [
123
+ 'providerName',
124
+ 'ownerDID',
125
+ 'ownerWrappableDID',
126
+ 'credential'
127
+ ],
128
+ additionalProperties: false
129
+ },
130
+ result: {
131
+ type: 'null'
132
+ }
133
+ },
134
+ 'credential/refresh': {
135
+ type: 'request',
136
+ param: {
137
+ type: 'object',
138
+ properties: {
139
+ providerName: {
140
+ type: 'string'
141
+ },
142
+ ownerDID: {
143
+ type: 'string'
144
+ },
145
+ credential: {
146
+ type: 'string'
147
+ }
148
+ },
149
+ required: [
150
+ 'providerName',
151
+ 'ownerDID',
152
+ 'credential'
153
+ ],
154
+ additionalProperties: false
155
+ },
156
+ result: {
157
+ type: 'null'
158
+ }
159
+ },
160
+ 'credential/delete': {
161
+ type: 'request',
162
+ param: {
163
+ type: 'object',
164
+ properties: {
165
+ providerName: {
166
+ type: 'string'
167
+ },
168
+ ownerDID: {
169
+ type: 'string'
170
+ }
171
+ },
172
+ required: [
173
+ 'providerName',
174
+ 'ownerDID'
175
+ ],
176
+ additionalProperties: false
177
+ },
178
+ result: {
179
+ type: 'null'
180
+ }
181
+ }
182
+ };
package/package.json ADDED
@@ -0,0 +1,35 @@
1
+ {
2
+ "name": "@kubun/service-credential-api",
3
+ "version": "0.14.0",
4
+ "keywords": [],
5
+ "license": "see LICENSE.md",
6
+ "sideEffects": false,
7
+ "type": "module",
8
+ "exports": {
9
+ ".": "./lib/index.js"
10
+ },
11
+ "main": "lib/index.js",
12
+ "types": "lib/index.d.ts",
13
+ "files": [
14
+ "lib/*",
15
+ "LICENSE.md"
16
+ ],
17
+ "dependencies": {
18
+ "@enkaku/client": "^0.21.0",
19
+ "@enkaku/protocol": "^0.21.0",
20
+ "@kubun/credential": "^0.14.0",
21
+ "@kubun/credential-types": "^0.14.0"
22
+ },
23
+ "publishConfig": {
24
+ "access": "public"
25
+ },
26
+ "scripts": {
27
+ "build": "pnpm run build:clean && pnpm run build:js && pnpm run build:types",
28
+ "build:clean": "del lib",
29
+ "build:js": "swc src -d ./lib --config-file ../../node_modules/@kigu/dev/swc.json --strip-leading-paths",
30
+ "build:types": "tsc --emitDeclarationOnly --skipLibCheck",
31
+ "build:types:ci": "tsc --emitDeclarationOnly --declarationMap false",
32
+ "test": "pnpm run test:types",
33
+ "test:types": "tsc --noEmit --skipLibCheck"
34
+ }
35
+ }