@kubun/service-credential-api 0.17.2 → 0.17.3

package/lib/adapter.d.ts

@@ -1,5 +1,5 @@
 import { type Client } from '@enkaku/client';
-import type { AliasBindingCredentialProvider, CredentialProvider, ProviderAccount } from '@kubun/credential-types';
+import type { AliasBindingCredentialProvider, CredentialProvider, EntryPairedCredentialProvider, ProviderAccount } from '@kubun/credential-types';
 import type { CredentialServiceProtocol } from './index.js';
 /**
  * What a storage-only account peek discloses: the provider account and the
@@ -22,4 +22,4 @@ export type CredentialProviderWithProvenance = CredentialProvider & {
         writerDID: string | null;
     } | null>;
 };
-export declare function toCredentialProvider(client: Client<CredentialServiceProtocol>): CredentialProviderWithProvenance & AliasBindingCredentialProvider & Required<Pick<CredentialProviderWithProvenance, 'peekAccount'>>;
+export declare function toCredentialProvider(client: Client<CredentialServiceProtocol>): CredentialProviderWithProvenance & AliasBindingCredentialProvider & EntryPairedCredentialProvider & Required<Pick<CredentialProviderWithProvenance, 'peekAccount'>>;

package/lib/adapter.js

@@ -18,6 +18,28 @@ export function toCredentialProvider(client) {
             });
             return raw == null ? null : deserializeCredential(raw);
         },
+        async getCredentialRef (providerName, ownerDID) {
+            const ref = await client.request('credential/get-ref', {
+                param: {
+                    providerName,
+                    ownerDID
+                }
+            });
+            return ref == null ? null : {
+                credential: deserializeCredential(ref.credential),
+                entryID: ref.entryID
+            };
+        },
+        setCredentialForEntry ({ providerName, ownerDID, entryID, credential }) {
+            return client.request('credential/refresh-entry', {
+                param: {
+                    providerName,
+                    ownerDID,
+                    entryID,
+                    credential: serializeCredential(credential)
+                }
+            });
+        },
         async peekAccount (providerName, ownerDID) {
             let peeked;
             try {

package/lib/index.d.ts

@@ -24,6 +24,39 @@ export declare const credentialServiceProtocol: {
             }];
         };
     };
+    readonly 'credential/get-ref': {
+        readonly type: "request";
+        readonly param: {
+            readonly type: "object";
+            readonly properties: {
+                readonly providerName: {
+                    readonly type: "string";
+                };
+                readonly ownerDID: {
+                    readonly type: "string";
+                };
+            };
+            readonly required: readonly ["providerName", "ownerDID"];
+            readonly additionalProperties: false;
+        };
+        readonly result: {
+            readonly anyOf: [{
+                readonly type: "object";
+                readonly properties: {
+                    readonly credential: {
+                        readonly type: "string";
+                    };
+                    readonly entryID: {
+                        readonly type: "string";
+                    };
+                };
+                readonly required: readonly ["credential", "entryID"];
+                readonly additionalProperties: false;
+            }, {
+                readonly type: "null";
+            }];
+        };
+    };
     readonly 'credential/peek': {
         readonly type: "request";
         readonly param: {
@@ -165,6 +198,32 @@ export declare const credentialServiceProtocol: {
             readonly type: "null";
         };
     };
+    readonly 'credential/refresh-entry': {
+        readonly type: "request";
+        readonly param: {
+            readonly type: "object";
+            readonly properties: {
+                readonly providerName: {
+                    readonly type: "string";
+                };
+                readonly ownerDID: {
+                    readonly type: "string";
+                };
+                readonly entryID: {
+                    readonly type: "string";
+                };
+                readonly credential: {
+                    readonly type: "string";
+                };
+            };
+            readonly required: readonly ["providerName", "ownerDID", "entryID", "credential"];
+            readonly additionalProperties: false;
+        };
+        readonly result: {
+            readonly type: "string";
+            readonly enum: readonly ["updated", "absent"];
+        };
+    };
     readonly 'credential/delete': {
         readonly type: "request";
         readonly param: {

package/lib/index.js

@@ -12,7 +12,8 @@ export { CREDENTIAL_PEEK_UNSUPPORTED, CredentialPeekUnsupportedError } from './e
 // Enkaku message `sub` — the host rejects a `sub` that differs from `iss`, so a
 // caller acting for another owner carries that owner in the param, not the
 // envelope. Serialized credential bytes cross as a UTF string; the vault stores
-// the ciphertext, never the plaintext. Writes ack with `null`.
+// the ciphertext, never the plaintext. Entry-scoped writes report their outcome;
+// the other writes ack with `null`.
 export const credentialServiceProtocol = {
     'credential/get': {
         type: 'request',
@@ -43,6 +44,48 @@ export const credentialServiceProtocol = {
             ]
         }
     },
+    'credential/get-ref': {
+        type: 'request',
+        param: {
+            type: 'object',
+            properties: {
+                providerName: {
+                    type: 'string'
+                },
+                ownerDID: {
+                    type: 'string'
+                }
+            },
+            required: [
+                'providerName',
+                'ownerDID'
+            ],
+            additionalProperties: false
+        },
+        result: {
+            anyOf: [
+                {
+                    type: 'object',
+                    properties: {
+                        credential: {
+                            type: 'string'
+                        },
+                        entryID: {
+                            type: 'string'
+                        }
+                    },
+                    required: [
+                        'credential',
+                        'entryID'
+                    ],
+                    additionalProperties: false
+                },
+                {
+                    type: 'null'
+                }
+            ]
+        }
+    },
     // Storage-only, non-refreshing read of the stored credential's provider
     // account and the scopes it was granted — and nothing else: no token
     // material crosses the wire. The server
@@ -234,6 +277,40 @@ export const credentialServiceProtocol = {
             type: 'null'
         }
     },
+    'credential/refresh-entry': {
+        type: 'request',
+        param: {
+            type: 'object',
+            properties: {
+                providerName: {
+                    type: 'string'
+                },
+                ownerDID: {
+                    type: 'string'
+                },
+                entryID: {
+                    type: 'string'
+                },
+                credential: {
+                    type: 'string'
+                }
+            },
+            required: [
+                'providerName',
+                'ownerDID',
+                'entryID',
+                'credential'
+            ],
+            additionalProperties: false
+        },
+        result: {
+            type: 'string',
+            enum: [
+                'updated',
+                'absent'
+            ]
+        }
+    },
     'credential/delete': {
         type: 'request',
         param: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/service-credential-api",
-  "version": "0.17.2",
+  "version": "0.17.3",
   "keywords": [],
   "license": "see LICENSE.md",
   "sideEffects": false,
@@ -17,7 +17,7 @@
   "dependencies": {
     "@enkaku/client": "^0.21.2",
     "@enkaku/protocol": "^0.21.1",
-    "@kubun/credential": "^0.17.3",
+    "@kubun/credential": "^0.17.4",
     "@kubun/credential-types": "^0.17.2"
   },
   "publishConfig": {