@kubun/service-credential-api 0.17.3 → 0.18.0

package/lib/adapter.d.ts

@@ -1,5 +1,5 @@
 import { type Client } from '@enkaku/client';
-import type { AliasBindingCredentialProvider, CredentialProvider, EntryPairedCredentialProvider, ProviderAccount } from '@kubun/credential-types';
+import type { AdoptGrantAPI, AliasBindingCredentialProvider, CredentialProvider, EntryPairedCredentialProvider, ProviderAccount, VersionedEntryCredentialProvider } from '@kubun/credential-types';
 import type { CredentialServiceProtocol } from './index.js';
 /**
  * What a storage-only account peek discloses: the provider account and the
@@ -22,4 +22,4 @@ export type CredentialProviderWithProvenance = CredentialProvider & {
         writerDID: string | null;
     } | null>;
 };
-export declare function toCredentialProvider(client: Client<CredentialServiceProtocol>): CredentialProviderWithProvenance & AliasBindingCredentialProvider & EntryPairedCredentialProvider & Required<Pick<CredentialProviderWithProvenance, 'peekAccount'>>;
+export declare function toCredentialProvider(client: Client<CredentialServiceProtocol>): CredentialProviderWithProvenance & AliasBindingCredentialProvider & EntryPairedCredentialProvider & VersionedEntryCredentialProvider & AdoptGrantAPI & Required<Pick<CredentialProviderWithProvenance, 'peekAccount'>>;

package/lib/adapter.js

@@ -6,7 +6,8 @@
 import { RequestError } from '@enkaku/client';
 import { ErrorCodes } from '@enkaku/protocol';
 import { deserializeCredential, serializeCredential } from '@kubun/credential';
-import { CredentialPeekUnsupportedError } from './errors.js';
+import { CredentialUpdateUnavailableError } from '@kubun/credential-types';
+import { CredentialPeekUnsupportedError, CredentialUnexpectedSupersededError } from './errors.js';
 export function toCredentialProvider(client) {
     return {
         async get (providerName, ownerDID) {
@@ -30,8 +31,58 @@ export function toCredentialProvider(client) {
                 entryID: ref.entryID
             };
         },
-        setCredentialForEntry ({ providerName, ownerDID, entryID, credential }) {
+        async getVersionedCredentialRef (providerName, ownerDID) {
+            const ref = await client.request('credential/get-ref', {
+                param: {
+                    providerName,
+                    ownerDID
+                }
+            });
+            return ref == null ? null : {
+                credential: deserializeCredential(ref.credential),
+                entryID: ref.entryID,
+                ...ref.version == null ? {} : {
+                    version: ref.version
+                }
+            };
+        },
+        setCredentialForEntryIfUnchanged ({ providerName, ownerDID, entryID, credential, expectedVersion }) {
             return client.request('credential/refresh-entry', {
+                param: {
+                    providerName,
+                    ownerDID,
+                    entryID,
+                    credential: serializeCredential(credential),
+                    expectedVersion
+                }
+            });
+        },
+        async update (address, change) {
+            for(;;){
+                const ref = await client.request('credential/get-ref', {
+                    param: {
+                        providerName: address.providerName,
+                        ownerDID: address.ownerDID,
+                        deviceDID: address.deviceDID
+                    }
+                });
+                if (ref == null || ref.version == null) throw new CredentialUpdateUnavailableError();
+                const result = await client.request('credential/refresh-entry', {
+                    param: {
+                        providerName: address.providerName,
+                        ownerDID: address.ownerDID,
+                        deviceDID: address.deviceDID,
+                        entryID: ref.entryID,
+                        credential: serializeCredential(change(deserializeCredential(ref.credential))),
+                        expectedVersion: ref.version
+                    }
+                });
+                if (result === 'updated') return;
+                if (result === 'absent') throw new CredentialUpdateUnavailableError();
+            }
+        },
+        async setCredentialForEntry ({ providerName, ownerDID, entryID, credential }) {
+            const result = await client.request('credential/refresh-entry', {
                 param: {
                     providerName,
                     ownerDID,
@@ -39,6 +90,8 @@ export function toCredentialProvider(client) {
                     credential: serializeCredential(credential)
                 }
             });
+            if (result === 'superseded') throw new CredentialUnexpectedSupersededError();
+            return result;
         },
         async peekAccount (providerName, ownerDID) {
             let peeked;
@@ -119,6 +172,11 @@ export function toCredentialProvider(client) {
                     entryID
                 }
             });
+        },
+        async adoptCredentialGrant (params) {
+            await client.request('credential/adopt-grant', {
+                param: params
+            });
         }
     };
 }

package/lib/errors.d.ts

@@ -16,3 +16,10 @@ export declare class CredentialPeekUnsupportedError extends Error {
     constructor(options?: ErrorOptions);
     get code(): typeof CREDENTIAL_PEEK_UNSUPPORTED;
 }
+/** An unconditional entry write received a result reserved for versioned writes. */
+export declare const CREDENTIAL_UNEXPECTED_SUPERSEDED = "CREDENTIAL_UNEXPECTED_SUPERSEDED";
+export declare class CredentialUnexpectedSupersededError extends Error {
+    #private;
+    constructor();
+    get code(): typeof CREDENTIAL_UNEXPECTED_SUPERSEDED;
+}

package/lib/errors.js

@@ -20,3 +20,15 @@
         return this.#code;
     }
 }
+/** An unconditional entry write received a result reserved for versioned writes. */ export const CREDENTIAL_UNEXPECTED_SUPERSEDED = 'CREDENTIAL_UNEXPECTED_SUPERSEDED';
+export class CredentialUnexpectedSupersededError extends Error {
+    #code;
+    constructor(){
+        super('The credential service superseded an unconditional entry write');
+        this.name = 'CredentialUnexpectedSupersededError';
+        this.#code = CREDENTIAL_UNEXPECTED_SUPERSEDED;
+    }
+    get code() {
+        return this.#code;
+    }
+}

package/lib/index.d.ts

@@ -1,5 +1,5 @@
 export { type CredentialAccountPeek, type CredentialProviderWithProvenance, toCredentialProvider, } from './adapter.js';
-export { CREDENTIAL_PEEK_UNSUPPORTED, CredentialPeekUnsupportedError } from './errors.js';
+export { CREDENTIAL_PEEK_UNSUPPORTED, CREDENTIAL_UNEXPECTED_SUPERSEDED, CredentialPeekUnsupportedError, CredentialUnexpectedSupersededError, } from './errors.js';
 export declare const credentialServiceProtocol: {
     readonly 'credential/get': {
         readonly type: "request";
@@ -35,6 +35,9 @@ export declare const credentialServiceProtocol: {
                 readonly ownerDID: {
                     readonly type: "string";
                 };
+                readonly deviceDID: {
+                    readonly type: "string";
+                };
             };
             readonly required: readonly ["providerName", "ownerDID"];
             readonly additionalProperties: false;
@@ -49,6 +52,9 @@ export declare const credentialServiceProtocol: {
                     readonly entryID: {
                         readonly type: "string";
                     };
+                    readonly version: {
+                        readonly type: "string";
+                    };
                 };
                 readonly required: readonly ["credential", "entryID"];
                 readonly additionalProperties: false;
@@ -209,19 +215,60 @@ export declare const credentialServiceProtocol: {
                 readonly ownerDID: {
                     readonly type: "string";
                 };
+                readonly deviceDID: {
+                    readonly type: "string";
+                };
                 readonly entryID: {
                     readonly type: "string";
                 };
                 readonly credential: {
                     readonly type: "string";
                 };
+                readonly expectedVersion: {
+                    readonly type: "string";
+                };
             };
             readonly required: readonly ["providerName", "ownerDID", "entryID", "credential"];
             readonly additionalProperties: false;
         };
         readonly result: {
             readonly type: "string";
-            readonly enum: readonly ["updated", "absent"];
+            readonly enum: readonly ["updated", "absent", "superseded"];
+        };
+    };
+    readonly 'credential/adopt-grant': {
+        readonly type: "request";
+        readonly param: {
+            readonly type: "object";
+            readonly properties: {
+                readonly providerName: {
+                    readonly type: "string";
+                };
+                readonly ownerDID: {
+                    readonly type: "string";
+                };
+                readonly fromDeviceDID: {
+                    readonly type: "string";
+                };
+                readonly toDeviceDID: {
+                    readonly type: "string";
+                };
+                readonly sourceKeyOwnerDID: {
+                    readonly type: "string";
+                };
+            };
+            readonly required: readonly ["providerName", "ownerDID", "fromDeviceDID", "toDeviceDID"];
+            readonly additionalProperties: false;
+        };
+        readonly result: {
+            readonly type: "object";
+            readonly properties: {
+                readonly adopted: {
+                    readonly type: "boolean";
+                };
+            };
+            readonly required: readonly ["adopted"];
+            readonly additionalProperties: false;
         };
     };
     readonly 'credential/delete': {

package/lib/index.js

@@ -5,7 +5,7 @@
 // authenticated client into the `credential-provider` the connector registers, so
 // this package is no longer type-only.
 export { toCredentialProvider } from './adapter.js';
-export { CREDENTIAL_PEEK_UNSUPPORTED, CredentialPeekUnsupportedError } from './errors.js';
+export { CREDENTIAL_PEEK_UNSUPPORTED, CREDENTIAL_UNEXPECTED_SUPERSEDED, CredentialPeekUnsupportedError, CredentialUnexpectedSupersededError } from './errors.js';
 // Param↔seam mapping. `providerName`/`ownerDID` are the alias key the seam
 // resolves. `ownerDID` is ALSO the authorization subject: each handler passes it
 // to `context.authorize(ownerDID)` (the per-serve `callerMayActFor`), NOT the
@@ -54,6 +54,9 @@ export const credentialServiceProtocol = {
                 },
                 ownerDID: {
                     type: 'string'
+                },
+                deviceDID: {
+                    type: 'string'
                 }
             },
             required: [
@@ -72,6 +75,9 @@ export const credentialServiceProtocol = {
                         },
                         entryID: {
                             type: 'string'
+                        },
+                        version: {
+                            type: 'string'
                         }
                     },
                     required: [
@@ -288,11 +294,17 @@ export const credentialServiceProtocol = {
                 ownerDID: {
                     type: 'string'
                 },
+                deviceDID: {
+                    type: 'string'
+                },
                 entryID: {
                     type: 'string'
                 },
                 credential: {
                     type: 'string'
+                },
+                expectedVersion: {
+                    type: 'string'
                 }
             },
             required: [
@@ -307,10 +319,53 @@ export const credentialServiceProtocol = {
             type: 'string',
             enum: [
                 'updated',
-                'absent'
+                'absent',
+                'superseded'
             ]
         }
     },
+    'credential/adopt-grant': {
+        type: 'request',
+        param: {
+            type: 'object',
+            properties: {
+                providerName: {
+                    type: 'string'
+                },
+                ownerDID: {
+                    type: 'string'
+                },
+                fromDeviceDID: {
+                    type: 'string'
+                },
+                toDeviceDID: {
+                    type: 'string'
+                },
+                sourceKeyOwnerDID: {
+                    type: 'string'
+                }
+            },
+            required: [
+                'providerName',
+                'ownerDID',
+                'fromDeviceDID',
+                'toDeviceDID'
+            ],
+            additionalProperties: false
+        },
+        result: {
+            type: 'object',
+            properties: {
+                adopted: {
+                    type: 'boolean'
+                }
+            },
+            required: [
+                'adopted'
+            ],
+            additionalProperties: false
+        }
+    },
     'credential/delete': {
         type: 'request',
         param: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/service-credential-api",
-  "version": "0.17.3",
+  "version": "0.18.0",
   "keywords": [],
   "license": "see LICENSE.md",
   "sideEffects": false,
@@ -15,10 +15,10 @@
     "LICENSE.md"
   ],
   "dependencies": {
-    "@enkaku/client": "^0.21.2",
-    "@enkaku/protocol": "^0.21.1",
-    "@kubun/credential": "^0.17.4",
-    "@kubun/credential-types": "^0.17.2"
+    "@enkaku/client": "^0.21.5",
+    "@enkaku/protocol": "^0.21.5",
+    "@kubun/credential": "^0.18.0",
+    "@kubun/credential-types": "^0.18.0"
   },
   "publishConfig": {
     "access": "public"