@kya-os/mcp 1.10.1 → 1.12.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/AUDITABILITY.md +441 -0
- package/CHANGELOG.md +108 -0
- package/CONFORMANCE.md +600 -0
- package/README.md +69 -6
- package/SPEC.md +1820 -0
- package/dist/audit/adapters/legacy-audit-log.d.ts +20 -0
- package/dist/audit/adapters/legacy-audit-log.d.ts.map +1 -0
- package/dist/audit/adapters/legacy-audit-log.js +56 -0
- package/dist/audit/adapters/legacy-audit-log.js.map +1 -0
- package/dist/audit/adapters/mcp.d.ts +105 -0
- package/dist/audit/adapters/mcp.d.ts.map +1 -0
- package/dist/audit/adapters/mcp.js +213 -0
- package/dist/audit/adapters/mcp.js.map +1 -0
- package/dist/audit/assurance.d.ts +22 -0
- package/dist/audit/assurance.d.ts.map +1 -0
- package/dist/audit/assurance.js +39 -0
- package/dist/audit/assurance.js.map +1 -0
- package/dist/audit/checkpoint-coordinator.d.ts +51 -0
- package/dist/audit/checkpoint-coordinator.d.ts.map +1 -0
- package/dist/audit/checkpoint-coordinator.js +112 -0
- package/dist/audit/checkpoint-coordinator.js.map +1 -0
- package/dist/audit/checkpoint.d.ts +59 -0
- package/dist/audit/checkpoint.d.ts.map +1 -0
- package/dist/audit/checkpoint.js +219 -0
- package/dist/audit/checkpoint.js.map +1 -0
- package/dist/audit/cli.d.ts +8 -0
- package/dist/audit/cli.d.ts.map +1 -0
- package/dist/audit/cli.js +85 -0
- package/dist/audit/cli.js.map +1 -0
- package/dist/audit/crypto.d.ts +37 -0
- package/dist/audit/crypto.d.ts.map +1 -0
- package/dist/audit/crypto.js +68 -0
- package/dist/audit/crypto.js.map +1 -0
- package/dist/audit/errors.d.ts +29 -0
- package/dist/audit/errors.d.ts.map +1 -0
- package/dist/audit/errors.js +33 -0
- package/dist/audit/errors.js.map +1 -0
- package/dist/audit/evidence.d.ts +45 -0
- package/dist/audit/evidence.d.ts.map +1 -0
- package/dist/audit/evidence.js +151 -0
- package/dist/audit/evidence.js.map +1 -0
- package/dist/audit/index.d.ts +30 -0
- package/dist/audit/index.d.ts.map +1 -0
- package/dist/audit/index.js +30 -0
- package/dist/audit/index.js.map +1 -0
- package/dist/audit/integrity.d.ts +19 -0
- package/dist/audit/integrity.d.ts.map +1 -0
- package/dist/audit/integrity.js +64 -0
- package/dist/audit/integrity.js.map +1 -0
- package/dist/audit/merkle.d.ts +31 -0
- package/dist/audit/merkle.d.ts.map +1 -0
- package/dist/audit/merkle.js +195 -0
- package/dist/audit/merkle.js.map +1 -0
- package/dist/audit/mirror-service.d.ts +19 -0
- package/dist/audit/mirror-service.d.ts.map +1 -0
- package/dist/audit/mirror-service.js +54 -0
- package/dist/audit/mirror-service.js.map +1 -0
- package/dist/audit/projection.d.ts +90 -0
- package/dist/audit/projection.d.ts.map +1 -0
- package/dist/audit/projection.js +142 -0
- package/dist/audit/projection.js.map +1 -0
- package/dist/audit/providers/anchor.d.ts +23 -0
- package/dist/audit/providers/anchor.d.ts.map +1 -0
- package/dist/audit/providers/anchor.js +25 -0
- package/dist/audit/providers/anchor.js.map +1 -0
- package/dist/audit/providers/evidence.d.ts +36 -0
- package/dist/audit/providers/evidence.d.ts.map +1 -0
- package/dist/audit/providers/evidence.js +2 -0
- package/dist/audit/providers/evidence.js.map +1 -0
- package/dist/audit/providers/journal.d.ts +35 -0
- package/dist/audit/providers/journal.d.ts.map +1 -0
- package/dist/audit/providers/journal.js +2 -0
- package/dist/audit/providers/journal.js.map +1 -0
- package/dist/audit/providers/memory-journal.d.ts +24 -0
- package/dist/audit/providers/memory-journal.d.ts.map +1 -0
- package/dist/audit/providers/memory-journal.js +73 -0
- package/dist/audit/providers/memory-journal.js.map +1 -0
- package/dist/audit/providers/observer.d.ts +30 -0
- package/dist/audit/providers/observer.d.ts.map +1 -0
- package/dist/audit/providers/observer.js +100 -0
- package/dist/audit/providers/observer.js.map +1 -0
- package/dist/audit/providers/outbox.d.ts +37 -0
- package/dist/audit/providers/outbox.d.ts.map +1 -0
- package/dist/audit/providers/outbox.js +52 -0
- package/dist/audit/providers/outbox.js.map +1 -0
- package/dist/audit/providers/recorder-client.d.ts +22 -0
- package/dist/audit/providers/recorder-client.d.ts.map +1 -0
- package/dist/audit/providers/recorder-client.js +17 -0
- package/dist/audit/providers/recorder-client.js.map +1 -0
- package/dist/audit/providers/source-state.d.ts +37 -0
- package/dist/audit/providers/source-state.d.ts.map +1 -0
- package/dist/audit/providers/source-state.js +94 -0
- package/dist/audit/providers/source-state.js.map +1 -0
- package/dist/audit/read-contract.d.ts +445 -0
- package/dist/audit/read-contract.d.ts.map +1 -0
- package/dist/audit/read-contract.js +126 -0
- package/dist/audit/read-contract.js.map +1 -0
- package/dist/audit/read-service.d.ts +99 -0
- package/dist/audit/read-service.d.ts.map +1 -0
- package/dist/audit/read-service.js +124 -0
- package/dist/audit/read-service.js.map +1 -0
- package/dist/audit/recorder-service.d.ts +78 -0
- package/dist/audit/recorder-service.d.ts.map +1 -0
- package/dist/audit/recorder-service.js +331 -0
- package/dist/audit/recorder-service.js.map +1 -0
- package/dist/audit/reference-recorder.d.ts +43 -0
- package/dist/audit/reference-recorder.d.ts.map +1 -0
- package/dist/audit/reference-recorder.js +131 -0
- package/dist/audit/reference-recorder.js.map +1 -0
- package/dist/audit/replay-bundle.d.ts +52 -0
- package/dist/audit/replay-bundle.d.ts.map +1 -0
- package/dist/audit/replay-bundle.js +551 -0
- package/dist/audit/replay-bundle.js.map +1 -0
- package/dist/audit/schemas.d.ts +1145 -0
- package/dist/audit/schemas.d.ts.map +1 -0
- package/dist/audit/schemas.js +483 -0
- package/dist/audit/schemas.js.map +1 -0
- package/dist/audit/service.d.ts +91 -0
- package/dist/audit/service.d.ts.map +1 -0
- package/dist/audit/service.js +222 -0
- package/dist/audit/service.js.map +1 -0
- package/dist/audit/testing/index.d.ts +2 -0
- package/dist/audit/testing/index.d.ts.map +1 -0
- package/dist/audit/testing/index.js +2 -0
- package/dist/audit/testing/index.js.map +1 -0
- package/dist/audit/testing/provider-contracts.d.ts +51 -0
- package/dist/audit/testing/provider-contracts.d.ts.map +1 -0
- package/dist/audit/testing/provider-contracts.js +391 -0
- package/dist/audit/testing/provider-contracts.js.map +1 -0
- package/dist/audit/types.d.ts +356 -0
- package/dist/audit/types.d.ts.map +1 -0
- package/dist/audit/types.js +49 -0
- package/dist/audit/types.js.map +1 -0
- package/dist/audit/verifier.d.ts +73 -0
- package/dist/audit/verifier.d.ts.map +1 -0
- package/dist/audit/verifier.js +322 -0
- package/dist/audit/verifier.js.map +1 -0
- package/dist/card/builder.d.ts +1 -1
- package/dist/card/builder.js +1 -1
- package/dist/card/emit.d.ts +3 -3
- package/dist/card/emit.d.ts.map +1 -1
- package/dist/card/emit.js.map +1 -1
- package/dist/card/index.d.ts +1 -1
- package/dist/card/index.js +1 -1
- package/dist/card/middleware.d.ts +6 -4
- package/dist/card/middleware.d.ts.map +1 -1
- package/dist/card/middleware.js +11 -7
- package/dist/card/middleware.js.map +1 -1
- package/dist/card/proof/build.d.ts +3 -3
- package/dist/card/proof/build.js +3 -3
- package/dist/card/proof/canonical.d.ts.map +1 -1
- package/dist/card/proof/canonical.js +19 -1
- package/dist/card/proof/canonical.js.map +1 -1
- package/dist/card/proof/http-sig.d.ts +1 -1
- package/dist/card/proof/http-sig.js +1 -1
- package/dist/card/proof/index.d.ts +2 -2
- package/dist/card/proof/index.js +2 -2
- package/dist/card/proof/nonce-cache.d.ts +1 -1
- package/dist/card/proof/nonce-cache.js +1 -1
- package/dist/card/proof/types.d.ts +16 -7
- package/dist/card/proof/types.d.ts.map +1 -1
- package/dist/card/proof/types.js +16 -7
- package/dist/card/proof/types.js.map +1 -1
- package/dist/card/proof/verify.d.ts +2 -2
- package/dist/card/proof/verify.js +2 -2
- package/dist/card/schema.d.ts +14 -6
- package/dist/card/schema.d.ts.map +1 -1
- package/dist/card/schema.js +14 -3
- package/dist/card/schema.js.map +1 -1
- package/dist/card/verify.d.ts +1 -1
- package/dist/card/verify.d.ts.map +1 -1
- package/dist/delegation/delegation-graph.d.ts +4 -0
- package/dist/delegation/delegation-graph.d.ts.map +1 -1
- package/dist/delegation/delegation-graph.js +28 -2
- package/dist/delegation/delegation-graph.js.map +1 -1
- package/dist/delegation/statuslist-manager.d.ts +5 -0
- package/dist/delegation/statuslist-manager.d.ts.map +1 -1
- package/dist/delegation/statuslist-manager.js.map +1 -1
- package/dist/delegation/storage/memory-graph-storage.d.ts +4 -2
- package/dist/delegation/storage/memory-graph-storage.d.ts.map +1 -1
- package/dist/delegation/storage/memory-graph-storage.js +18 -0
- package/dist/delegation/storage/memory-graph-storage.js.map +1 -1
- package/dist/delegation/storage/memory-statuslist-storage.d.ts +5 -2
- package/dist/delegation/storage/memory-statuslist-storage.d.ts.map +1 -1
- package/dist/delegation/storage/memory-statuslist-storage.js +21 -2
- package/dist/delegation/storage/memory-statuslist-storage.js.map +1 -1
- package/dist/delegation/utils.d.ts.map +1 -1
- package/dist/delegation/utils.js +2 -42
- package/dist/delegation/utils.js.map +1 -1
- package/dist/delegation/vc-verification-checks.d.ts.map +1 -1
- package/dist/delegation/vc-verification-checks.js +16 -1
- package/dist/delegation/vc-verification-checks.js.map +1 -1
- package/dist/delegation/vc-verifier.d.ts +4 -0
- package/dist/delegation/vc-verifier.d.ts.map +1 -1
- package/dist/delegation/vc-verifier.js +44 -13
- package/dist/delegation/vc-verifier.js.map +1 -1
- package/dist/errors.d.ts +1 -1
- package/dist/errors.js +1 -1
- package/dist/extension/declaration.d.ts +60 -0
- package/dist/extension/declaration.d.ts.map +1 -0
- package/dist/extension/declaration.js +75 -0
- package/dist/extension/declaration.js.map +1 -0
- package/dist/extension/gate.d.ts +110 -0
- package/dist/extension/gate.d.ts.map +1 -0
- package/dist/extension/gate.js +133 -0
- package/dist/extension/gate.js.map +1 -0
- package/dist/extension/index.d.ts +14 -0
- package/dist/extension/index.d.ts.map +1 -0
- package/dist/extension/index.js +14 -0
- package/dist/extension/index.js.map +1 -0
- package/dist/extension/settings.d.ts +70 -0
- package/dist/extension/settings.d.ts.map +1 -0
- package/dist/extension/settings.js +96 -0
- package/dist/extension/settings.js.map +1 -0
- package/dist/index.d.ts +4 -2
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +6 -2
- package/dist/index.js.map +1 -1
- package/dist/middleware/kya-os-transport.d.ts +1 -1
- package/dist/middleware/kya-os-transport.d.ts.map +1 -1
- package/dist/middleware/kya-os-transport.js +11 -4
- package/dist/middleware/kya-os-transport.js.map +1 -1
- package/dist/middleware/with-kya-os-server.d.ts +6 -0
- package/dist/middleware/with-kya-os-server.d.ts.map +1 -1
- package/dist/middleware/with-kya-os-server.js +2 -0
- package/dist/middleware/with-kya-os-server.js.map +1 -1
- package/dist/middleware/with-kya-os.config-types.d.ts +15 -0
- package/dist/middleware/with-kya-os.config-types.d.ts.map +1 -1
- package/dist/middleware/with-kya-os.config-types.js.map +1 -1
- package/dist/middleware/with-kya-os.d.ts.map +1 -1
- package/dist/middleware/with-kya-os.delegation-gate.d.ts.map +1 -1
- package/dist/middleware/with-kya-os.delegation-gate.js +96 -3
- package/dist/middleware/with-kya-os.delegation-gate.js.map +1 -1
- package/dist/middleware/with-kya-os.delegation-verify.d.ts.map +1 -1
- package/dist/middleware/with-kya-os.delegation-verify.js +2 -2
- package/dist/middleware/with-kya-os.delegation-verify.js.map +1 -1
- package/dist/middleware/with-kya-os.deps.d.ts +2 -0
- package/dist/middleware/with-kya-os.deps.d.ts.map +1 -1
- package/dist/middleware/with-kya-os.js +23 -0
- package/dist/middleware/with-kya-os.js.map +1 -1
- package/dist/middleware/with-kya-os.policy-gate.d.ts.map +1 -1
- package/dist/middleware/with-kya-os.policy-gate.js +29 -4
- package/dist/middleware/with-kya-os.policy-gate.js.map +1 -1
- package/dist/middleware/with-kya-os.protocol.d.ts.map +1 -1
- package/dist/middleware/with-kya-os.protocol.js +10 -0
- package/dist/middleware/with-kya-os.protocol.js.map +1 -1
- package/dist/middleware/with-kya-os.session.d.ts.map +1 -1
- package/dist/middleware/with-kya-os.session.js +208 -2
- package/dist/middleware/with-kya-os.session.js.map +1 -1
- package/dist/middleware/with-kya-os.types.d.ts +6 -0
- package/dist/middleware/with-kya-os.types.d.ts.map +1 -1
- package/dist/middleware/with-kya-os.types.js.map +1 -1
- package/dist/proof/generator.d.ts +14 -2
- package/dist/proof/generator.d.ts.map +1 -1
- package/dist/proof/generator.js +20 -7
- package/dist/proof/generator.js.map +1 -1
- package/dist/proof/index.d.ts +1 -1
- package/dist/proof/index.d.ts.map +1 -1
- package/dist/proof/index.js +1 -1
- package/dist/proof/index.js.map +1 -1
- package/dist/proof/verifier.d.ts +15 -2
- package/dist/proof/verifier.d.ts.map +1 -1
- package/dist/proof/verifier.js +48 -12
- package/dist/proof/verifier.js.map +1 -1
- package/dist/session/manager.js +1 -1
- package/dist/session/manager.js.map +1 -1
- package/dist/types/protocol.d.ts +22 -0
- package/dist/types/protocol.d.ts.map +1 -1
- package/dist/types/protocol.js +31 -5
- package/dist/types/protocol.js.map +1 -1
- package/dist/utils/canonical-json.d.ts +15 -0
- package/dist/utils/canonical-json.d.ts.map +1 -0
- package/dist/utils/canonical-json.js +109 -0
- package/dist/utils/canonical-json.js.map +1 -0
- package/dist/utils/crypto-service.d.ts.map +1 -1
- package/dist/utils/crypto-service.js +5 -0
- package/dist/utils/crypto-service.js.map +1 -1
- package/dist/utils/index.d.ts +1 -0
- package/dist/utils/index.d.ts.map +1 -1
- package/dist/utils/index.js +1 -0
- package/dist/utils/index.js.map +1 -1
- package/package.json +29 -11
- package/schemas/README.md +28 -1
- package/schemas/audit-anchor-receipt.schema.json +16 -0
- package/schemas/audit-bundle-manifest.schema.json +71 -0
- package/schemas/audit-checkpoint.schema.json +37 -0
- package/schemas/audit-consistency-proof.schema.json +17 -0
- package/schemas/audit-entry.schema.json +33 -0
- package/schemas/audit-event.schema.json +168 -0
- package/schemas/audit-inclusion-proof.schema.json +17 -0
- package/schemas/audit-observation.schema.json +40 -0
- package/schemas/audit-receipt.schema.json +32 -0
- package/schemas/audit-verification-policy.schema.json +71 -0
- package/schemas/audit-verification-report.schema.json +29 -0
- package/schemas/kya-os-card.schema.json +6 -6
- package/schemas/mcp-extension-settings.json +37 -0
- package/schemas/well-known-mcpi.json +17 -0
|
@@ -81,10 +81,28 @@ export async function es256VerifyRaw(publicJwk, signature, data) {
|
|
|
81
81
|
* underlying digests across formats.
|
|
82
82
|
*/
|
|
83
83
|
export async function computeRequestHash(req) {
|
|
84
|
-
const
|
|
84
|
+
const params = stripParamsMeta(req.params);
|
|
85
|
+
const canonicalRequest = { method: req.method, ...(params ? { params } : {}) };
|
|
85
86
|
const digest = await sha256(encoder.encode(canonicalize(canonicalRequest)));
|
|
86
87
|
return `sha-256=:${bytesToBase64(digest)}:`;
|
|
87
88
|
}
|
|
89
|
+
/**
|
|
90
|
+
* The §8.3 pre-signing transformation: remove the `_meta` member of `params` before
|
|
91
|
+
* canonicalizing. `_meta` is the transport-metadata carrier - it carries the proof itself, so it
|
|
92
|
+
* can never be part of the signed material; hashing it verbatim on the verify side would make the
|
|
93
|
+
* definition circular (the received `params._meta` contains the proof being verified). Only the
|
|
94
|
+
* top-level `_meta` member is removed; nothing nested below other members is touched. Requests
|
|
95
|
+
* without `params._meta` hash byte-identically to the untransformed shape.
|
|
96
|
+
*/
|
|
97
|
+
function stripParamsMeta(params) {
|
|
98
|
+
if (params === null || typeof params !== 'object' || Array.isArray(params))
|
|
99
|
+
return params;
|
|
100
|
+
if (!('_meta' in params))
|
|
101
|
+
return params;
|
|
102
|
+
const rest = { ...params };
|
|
103
|
+
delete rest._meta;
|
|
104
|
+
return rest;
|
|
105
|
+
}
|
|
88
106
|
/** Hex of the SHA-256 digest carried by a `sha-256=:<base64>:` (RFC 9421) or `sha256:<hex>` (legacy)
|
|
89
107
|
* string, or `null` if it is neither form. Lets integrators compare the two formats by digest. */
|
|
90
108
|
function digestHex(value) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../../src/card/proof/canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAG7F,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAkClC,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,SAAS,EAAW,CAAC;AAC7C,MAAM,YAAY,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAW,CAAC;AACrE,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAW,CAAC;AAE/D,mGAAmG;AACnG,SAAS,MAAM;IACb,MAAM,CAAC,GAAI,UAAyD,CAAC,MAAM,CAAC;IAC5E,IAAI,CAAC,CAAC,EAAE,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACrF,OAAO,CAAC,CAAC,MAAM,CAAC;AAClB,CAAC;AAED,4BAA4B;AAC5B,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAAiB;IAC5C,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAyB,EAAE,IAAgB;IAC9E,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAwB,EACxB,SAAqB,EACrB,IAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7H,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAyB,EAAE,IAAgB;IAC5E,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAChF,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAwB,EACxB,SAAqB,EACrB,IAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,SAAS,CAC3B,KAAK,EACL,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,EAC1E,YAAY,EACZ,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAgB;IACvD,MAAM,gBAAgB,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,
|
|
1
|
+
{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../../src/card/proof/canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAG7F,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAkClC,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,SAAS,EAAW,CAAC;AAC7C,MAAM,YAAY,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAW,CAAC;AACrE,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAW,CAAC;AAE/D,mGAAmG;AACnG,SAAS,MAAM;IACb,MAAM,CAAC,GAAI,UAAyD,CAAC,MAAM,CAAC;IAC5E,IAAI,CAAC,CAAC,EAAE,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACrF,OAAO,CAAC,CAAC,MAAM,CAAC;AAClB,CAAC;AAED,4BAA4B;AAC5B,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAAiB;IAC5C,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAyB,EAAE,IAAgB;IAC9E,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAwB,EACxB,SAAqB,EACrB,IAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7H,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAyB,EAAE,IAAgB;IAC5E,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAChF,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAwB,EACxB,SAAqB,EACrB,IAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,SAAS,CAC3B,KAAK,EACL,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,EAC1E,YAAY,EACZ,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAgB;IACvD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,gBAAgB,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/E,MAAM,MAAM,GAAG,MAAM,MAAM,CACzB,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,gBAAsD,CAAC,CAAC,CACrF,CAAC;IACF,OAAO,YAAY,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,MAAe;IACtC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC1F,IAAI,CAAC,CAAC,OAAO,IAAK,MAAkC,CAAC;QAAE,OAAO,MAAM,CAAC;IACrE,MAAM,IAAI,GAA4B,EAAE,GAAI,MAAkC,EAAE,CAAC;IACjF,OAAO,IAAI,CAAC,KAAK,CAAC;IAClB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;mGACmG;AACnG,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,OAAO,GAAG,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACnE,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,CAAS,EAAE,CAAS;IAC/C,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,aAAa,CAAC,IAAmB;IAC/C,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,qBAAqB,CAAC,IAAmB;IACvD,OAAO,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI,CAAuC,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,aAAa,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;AACvD,CAAC"}
|
|
@@ -46,7 +46,7 @@ export declare function httpSignatureBase(proof: CardProofMeta): string;
|
|
|
46
46
|
/** The UTF-8 bytes of {@link httpSignatureBase} — the payload the `signRaw` seam signs at mint. */
|
|
47
47
|
export declare function httpSignatureBaseBytes(proof: CardProofMeta): Uint8Array;
|
|
48
48
|
/**
|
|
49
|
-
* Project a minted `org.kya-os/proof
|
|
49
|
+
* Project a minted `org.kya-os/proof.v1` into its RFC 9421 header set. Emits EVERY covered
|
|
50
50
|
* component as a real HTTP field — `Content-Digest`/`Kya-Audience`/`Kya-Nonce` (and `Kya-Cnf`
|
|
51
51
|
* when a `cnf` is present), each byte-identical to its {@link httpSignatureBase} line — plus
|
|
52
52
|
* `Signature-Input` (the covered-component list + params) and `Signature` (the RAW `httpSig` as a
|
|
@@ -56,7 +56,7 @@ export function httpSignatureBaseBytes(proof) {
|
|
|
56
56
|
return encoder.encode(httpSignatureBase(proof));
|
|
57
57
|
}
|
|
58
58
|
/**
|
|
59
|
-
* Project a minted `org.kya-os/proof
|
|
59
|
+
* Project a minted `org.kya-os/proof.v1` into its RFC 9421 header set. Emits EVERY covered
|
|
60
60
|
* component as a real HTTP field — `Content-Digest`/`Kya-Audience`/`Kya-Nonce` (and `Kya-Cnf`
|
|
61
61
|
* when a `cnf` is present), each byte-identical to its {@link httpSignatureBase} line — plus
|
|
62
62
|
* `Signature-Input` (the covered-component list + params) and `Signature` (the RAW `httpSig` as a
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* KYA-OS Entity Card — stateless per-request holder-of-key proof (`org.kya-os/proof
|
|
2
|
+
* KYA-OS Entity Card — stateless per-request holder-of-key proof (`org.kya-os/proof.v1`).
|
|
3
3
|
*
|
|
4
4
|
* The security-critical module, split into focused units re-exported here:
|
|
5
5
|
* - types (./types): CardProofMeta + the minting/verifying seams and result shapes.
|
|
@@ -12,7 +12,7 @@
|
|
|
12
12
|
* + the NonceCacheProvider adapter) so the safe consume is the default.
|
|
13
13
|
*
|
|
14
14
|
* Distinct from — and orthogonal to — the legacy session-bound proof in `src/proof`: the card proof
|
|
15
|
-
* rides its OWN `_meta['org.kya-os/proof
|
|
15
|
+
* rides its OWN `_meta['org.kya-os/request-proof']` key, separate from the legacy `org.kya-os/proof`, so
|
|
16
16
|
* both regimes can run on one server without either guard seeing the other's proof.
|
|
17
17
|
*/
|
|
18
18
|
export * from './types.js';
|
package/dist/card/proof/index.js
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* KYA-OS Entity Card — stateless per-request holder-of-key proof (`org.kya-os/proof
|
|
2
|
+
* KYA-OS Entity Card — stateless per-request holder-of-key proof (`org.kya-os/proof.v1`).
|
|
3
3
|
*
|
|
4
4
|
* The security-critical module, split into focused units re-exported here:
|
|
5
5
|
* - types (./types): CardProofMeta + the minting/verifying seams and result shapes.
|
|
@@ -12,7 +12,7 @@
|
|
|
12
12
|
* + the NonceCacheProvider adapter) so the safe consume is the default.
|
|
13
13
|
*
|
|
14
14
|
* Distinct from — and orthogonal to — the legacy session-bound proof in `src/proof`: the card proof
|
|
15
|
-
* rides its OWN `_meta['org.kya-os/proof
|
|
15
|
+
* rides its OWN `_meta['org.kya-os/request-proof']` key, separate from the legacy `org.kya-os/proof`, so
|
|
16
16
|
* both regimes can run on one server without either guard seeing the other's proof.
|
|
17
17
|
*/
|
|
18
18
|
export * from './types.js';
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* KYA-OS Entity Card — batteries-included replay defense for `org.kya-os/proof
|
|
2
|
+
* KYA-OS Entity Card — batteries-included replay defense for `org.kya-os/proof.v1`.
|
|
3
3
|
*
|
|
4
4
|
* The {@link ConsumeNonceIfFresh} seam is security-critical: it MUST be an ATOMIC test-AND-set
|
|
5
5
|
* (record the nonce AND report whether it was already seen, in one step). Hand-rolling it is the
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* KYA-OS Entity Card — batteries-included replay defense for `org.kya-os/proof
|
|
2
|
+
* KYA-OS Entity Card — batteries-included replay defense for `org.kya-os/proof.v1`.
|
|
3
3
|
*
|
|
4
4
|
* The {@link ConsumeNonceIfFresh} seam is security-critical: it MUST be an ATOMIC test-AND-set
|
|
5
5
|
* (record the nonce AND report whether it was already seen, in one step). Hand-rolling it is the
|
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* KYA-OS Entity Card — stateless per-request holder-of-key proof: shapes + seams.
|
|
3
3
|
*
|
|
4
|
-
* `org.kya-os/proof
|
|
5
|
-
* `_meta` key ({@link KYA_OS_CARD_PROOF_META_KEY} = `org.kya-os/proof
|
|
4
|
+
* `org.kya-os/proof.v1` is the STATELESS, sender-constrained proof profile. It rides its OWN
|
|
5
|
+
* `_meta` key ({@link KYA_OS_CARD_PROOF_META_KEY} = `org.kya-os/request-proof`), DISTINCT from the legacy
|
|
6
6
|
* session-bound `ProofMeta` (which carries `sessionId` + a handshake nonce under
|
|
7
7
|
* `org.kya-os/proof`). Separate keys let the two regimes coexist on one server without either guard
|
|
8
8
|
* seeing — or rejecting — the other's proof. Every request self-proves; there is no session state.
|
|
@@ -14,16 +14,25 @@
|
|
|
14
14
|
import { z } from 'zod';
|
|
15
15
|
import { type ProofPublicJwk } from '../schema.js';
|
|
16
16
|
/** The stateless per-request proof profile tag (the `prf` discriminator). */
|
|
17
|
-
export declare const PROOF_PROFILE_V1 = "org.kya-os/proof
|
|
17
|
+
export declare const PROOF_PROFILE_V1 = "org.kya-os/proof.v1";
|
|
18
18
|
/**
|
|
19
19
|
* The `_meta` key the STATELESS card proof rides under — DISTINCT from the legacy session proof's
|
|
20
20
|
* `org.kya-os/proof` (`KYA_OS_PROOF_META_KEY`). Sharing one key made the two regimes mutually
|
|
21
21
|
* exclusive on a server (a legacy proof failed the card schema and was 401'd; a card proof failed
|
|
22
22
|
* the legacy structure check). With separate keys each guard reads its OWN key and simply does not
|
|
23
23
|
* see the other's proof, so both can run on one server — genuinely additive, no legacy coupling. The
|
|
24
|
-
* key
|
|
24
|
+
* key names the slot by ROLE (the request proof), pairing with the response proof's
|
|
25
|
+
* `org.kya-os/response-proof`; the profile VERSION lives inside the object, in its `prf` field.
|
|
26
|
+
* Keys carry no versions and no `@` (which MCP's `_meta` key grammar forbids anyway).
|
|
25
27
|
*/
|
|
26
|
-
export declare const KYA_OS_CARD_PROOF_META_KEY = "org.kya-os/proof
|
|
28
|
+
export declare const KYA_OS_CARD_PROOF_META_KEY = "org.kya-os/request-proof";
|
|
29
|
+
/**
|
|
30
|
+
* The earlier draft carrier key, which used the then-profile-id verbatim and therefore violated
|
|
31
|
+
* MCP's `_meta` key grammar. Verifiers accept it for one major version (SPEC-ENTITY-CARD §8.1);
|
|
32
|
+
* producers emit {@link KYA_OS_CARD_PROOF_META_KEY} and MAY mirror under this key for verifiers
|
|
33
|
+
* older than the rename. When both keys are present, the canonical key wins.
|
|
34
|
+
*/
|
|
35
|
+
export declare const LEGACY_CARD_PROOF_META_KEY = "org.kya-os/proof@1";
|
|
27
36
|
/** Default proof lifetime in seconds (SPEC §8: short-lived, ≤ 60s). */
|
|
28
37
|
export declare const DEFAULT_TTL_SEC = 60;
|
|
29
38
|
/** Maximum accepted proof lifetime in seconds — a longer window fails closed. */
|
|
@@ -47,7 +56,7 @@ export declare const CardProofCnfSchema: z.ZodObject<{
|
|
|
47
56
|
jkt: z.ZodString;
|
|
48
57
|
}, z.core.$strip>;
|
|
49
58
|
/**
|
|
50
|
-
* The `org.kya-os/proof
|
|
59
|
+
* The `org.kya-os/proof.v1` payload. Every field except the two signatures (`jws`, `httpSig`) is a
|
|
51
60
|
* COVERED claim: the detached EdDSA `jws` signs the RFC 8785 (JCS) canonicalization of the claims,
|
|
52
61
|
* so tampering any of them fails the signature. `cnf.jkt` is OPTIONAL — present it degrades to
|
|
53
62
|
* L3-minus rather than blocking when the authorization server does not emit an RFC 9449 `cnf`.
|
|
@@ -60,7 +69,7 @@ export declare const CardProofCnfSchema: z.ZodObject<{
|
|
|
60
69
|
* It degrades gracefully: a signer without a `signRaw` seam mints a JWS-only proof (no sibling).
|
|
61
70
|
*/
|
|
62
71
|
export declare const CardProofMetaSchema: z.ZodObject<{
|
|
63
|
-
prf: z.ZodLiteral<"org.kya-os/proof@1">;
|
|
72
|
+
prf: z.ZodUnion<readonly [z.ZodLiteral<"org.kya-os/proof.v1">, z.ZodLiteral<"org.kya-os/proof@1">]>;
|
|
64
73
|
alg: z.ZodEnum<{
|
|
65
74
|
EdDSA: "EdDSA";
|
|
66
75
|
ES256: "ES256";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/card/proof/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/card/proof/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAkD,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnG,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,wBAAmB,CAAC;AAEjD;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,6BAA6B,CAAC;AAErE;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,uBAA0B,CAAC;AAElE,uEAAuE;AACvE,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC,iFAAiF;AACjF,eAAO,MAAM,WAAW,KAAK,CAAC;AAE9B,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,QAAyC,CAAC;AAY1E,8FAA8F;AAC9F,eAAO,MAAM,kBAAkB;;iBAE7B,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;kBAerB,CAAC;AAEZ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,mGAAmG;AACnG,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,KAAK,CAAC;IACX,GAAG,EAAE,SAAS,CAAC;IACf,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,OAAO,CAAC;IACb,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,sEAAsE;AACtE,MAAM,MAAM,eAAe,GAAG,iBAAiB,GAAG,cAAc,CAAC;AAEjE;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,0GAA0G;IAC1G,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IACjC,qGAAqG;IACrG,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C;;;;;OAKG;IACH,OAAO,CAAC,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAChD;AAED,gGAAgG;AAChG,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;AAEnF,gGAAgG;AAChG,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,cAAc,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;AAE3F;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAE7F;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,UAAU,CAAC;IACvB;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;;;;OAOG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,oFAAoF;IACpF,gBAAgB,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,UAAU,CAAC;AAE/C,6FAA6F;AAC7F,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,uFAAuF;IACvF,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB"}
|
package/dist/card/proof/types.js
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* KYA-OS Entity Card — stateless per-request holder-of-key proof: shapes + seams.
|
|
3
3
|
*
|
|
4
|
-
* `org.kya-os/proof
|
|
5
|
-
* `_meta` key ({@link KYA_OS_CARD_PROOF_META_KEY} = `org.kya-os/proof
|
|
4
|
+
* `org.kya-os/proof.v1` is the STATELESS, sender-constrained proof profile. It rides its OWN
|
|
5
|
+
* `_meta` key ({@link KYA_OS_CARD_PROOF_META_KEY} = `org.kya-os/request-proof`), DISTINCT from the legacy
|
|
6
6
|
* session-bound `ProofMeta` (which carries `sessionId` + a handshake nonce under
|
|
7
7
|
* `org.kya-os/proof`). Separate keys let the two regimes coexist on one server without either guard
|
|
8
8
|
* seeing — or rejecting — the other's proof. Every request self-proves; there is no session state.
|
|
@@ -12,7 +12,7 @@
|
|
|
12
12
|
* uses only `jose` + `json-canonicalize`, already direct dependencies.
|
|
13
13
|
*/
|
|
14
14
|
import { z } from 'zod';
|
|
15
|
-
import { Did, PROOF_PROFILE_ID } from '../schema.js';
|
|
15
|
+
import { Did, LEGACY_PROOF_PROFILE_ID, PROOF_PROFILE_ID } from '../schema.js';
|
|
16
16
|
/** The stateless per-request proof profile tag (the `prf` discriminator). */
|
|
17
17
|
export const PROOF_PROFILE_V1 = PROOF_PROFILE_ID;
|
|
18
18
|
/**
|
|
@@ -21,9 +21,18 @@ export const PROOF_PROFILE_V1 = PROOF_PROFILE_ID;
|
|
|
21
21
|
* exclusive on a server (a legacy proof failed the card schema and was 401'd; a card proof failed
|
|
22
22
|
* the legacy structure check). With separate keys each guard reads its OWN key and simply does not
|
|
23
23
|
* see the other's proof, so both can run on one server — genuinely additive, no legacy coupling. The
|
|
24
|
-
* key
|
|
24
|
+
* key names the slot by ROLE (the request proof), pairing with the response proof's
|
|
25
|
+
* `org.kya-os/response-proof`; the profile VERSION lives inside the object, in its `prf` field.
|
|
26
|
+
* Keys carry no versions and no `@` (which MCP's `_meta` key grammar forbids anyway).
|
|
25
27
|
*/
|
|
26
|
-
export const KYA_OS_CARD_PROOF_META_KEY =
|
|
28
|
+
export const KYA_OS_CARD_PROOF_META_KEY = 'org.kya-os/request-proof';
|
|
29
|
+
/**
|
|
30
|
+
* The earlier draft carrier key, which used the then-profile-id verbatim and therefore violated
|
|
31
|
+
* MCP's `_meta` key grammar. Verifiers accept it for one major version (SPEC-ENTITY-CARD §8.1);
|
|
32
|
+
* producers emit {@link KYA_OS_CARD_PROOF_META_KEY} and MAY mirror under this key for verifiers
|
|
33
|
+
* older than the rename. When both keys are present, the canonical key wins.
|
|
34
|
+
*/
|
|
35
|
+
export const LEGACY_CARD_PROOF_META_KEY = LEGACY_PROOF_PROFILE_ID;
|
|
27
36
|
/** Default proof lifetime in seconds (SPEC §8: short-lived, ≤ 60s). */
|
|
28
37
|
export const DEFAULT_TTL_SEC = 60;
|
|
29
38
|
/** Maximum accepted proof lifetime in seconds — a longer window fails closed. */
|
|
@@ -56,7 +65,7 @@ export const CardProofCnfSchema = z.object({
|
|
|
56
65
|
jkt: z.string().min(1).regex(BASE64URL, 'cnf.jkt must be a base64url RFC 7638 thumbprint'),
|
|
57
66
|
});
|
|
58
67
|
/**
|
|
59
|
-
* The `org.kya-os/proof
|
|
68
|
+
* The `org.kya-os/proof.v1` payload. Every field except the two signatures (`jws`, `httpSig`) is a
|
|
60
69
|
* COVERED claim: the detached EdDSA `jws` signs the RFC 8785 (JCS) canonicalization of the claims,
|
|
61
70
|
* so tampering any of them fails the signature. `cnf.jkt` is OPTIONAL — present it degrades to
|
|
62
71
|
* L3-minus rather than blocking when the authorization server does not emit an RFC 9449 `cnf`.
|
|
@@ -69,7 +78,7 @@ export const CardProofCnfSchema = z.object({
|
|
|
69
78
|
* It degrades gracefully: a signer without a `signRaw` seam mints a JWS-only proof (no sibling).
|
|
70
79
|
*/
|
|
71
80
|
export const CardProofMetaSchema = z.object({
|
|
72
|
-
prf: z.literal(PROOF_PROFILE_V1),
|
|
81
|
+
prf: z.union([z.literal(PROOF_PROFILE_V1), z.literal(LEGACY_PROOF_PROFILE_ID)]),
|
|
73
82
|
alg: z.enum(['EdDSA', 'ES256']),
|
|
74
83
|
did: Did,
|
|
75
84
|
// The signing key reference MUST carry a `#fragment` (a verificationMethod id); the runtime also
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/card/proof/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAuB,MAAM,cAAc,CAAC;
|
|
1
|
+
{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/card/proof/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,GAAG,EAAE,uBAAuB,EAAE,gBAAgB,EAAuB,MAAM,cAAc,CAAC;AAEnG,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAEjD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,0BAA0B,CAAC;AAErE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,uBAAuB,CAAC;AAElE,uEAAuE;AACvE,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAElC,iFAAiF;AACjF,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAE9B,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAElC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,GAAG,CAAC,GAAG,gBAAgB,GAAG,CAAC,CAAC;AAE1E;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAErC,8FAA8F;AAC9F,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,iDAAiD,CAAC;CAC3F,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC/E,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/B,GAAG,EAAE,GAAG;IACR,iGAAiG;IACjG,8FAA8F;IAC9F,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,EAAE,8DAA8D,CAAC;IAC9G,QAAQ,EAAE,GAAG;IACb,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,uFAAuF,CAAC;IAClI,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,GAAG,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,uFAAuF"}
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* KYA-OS Entity Card proof — VERIFY (`verifyCardProof`), fail-closed.
|
|
3
3
|
*
|
|
4
|
-
* Recompute EVERY binding a stateless `org.kya-os/proof
|
|
4
|
+
* Recompute EVERY binding a stateless `org.kya-os/proof.v1` asserts and reject on the first thing
|
|
5
5
|
* that does not hold. The signature only proves the proof is AUTHENTIC (signed by the holder of
|
|
6
6
|
* `kid`); accountability requires binding that key to the accountable principal `did`:
|
|
7
7
|
*
|
|
@@ -19,7 +19,7 @@
|
|
|
19
19
|
import type { ToolRequest } from '../../proof/generator.js';
|
|
20
20
|
import { type ProofVerifyResult, type VerifyProofDeps } from './types.js';
|
|
21
21
|
/**
|
|
22
|
-
* Verify an `org.kya-os/proof
|
|
22
|
+
* Verify an `org.kya-os/proof.v1` against the request it should bind and the injected seams.
|
|
23
23
|
* Fail-closed: returns `{ ok:false, reasons }` on any broken binding; on success returns the
|
|
24
24
|
* derived assurance (`L3` on full cnf fusion, `L3-minus` without an AS `cnf`) and the principal.
|
|
25
25
|
*/
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* KYA-OS Entity Card proof — VERIFY (`verifyCardProof`), fail-closed.
|
|
3
3
|
*
|
|
4
|
-
* Recompute EVERY binding a stateless `org.kya-os/proof
|
|
4
|
+
* Recompute EVERY binding a stateless `org.kya-os/proof.v1` asserts and reject on the first thing
|
|
5
5
|
* that does not hold. The signature only proves the proof is AUTHENTIC (signed by the holder of
|
|
6
6
|
* `kid`); accountability requires binding that key to the accountable principal `did`:
|
|
7
7
|
*
|
|
@@ -21,7 +21,7 @@ import { base64urlDecodeToString, base64urlEncodeFromBytes } from '../../utils/b
|
|
|
21
21
|
import { canonicalPayloadBytes, computeRequestHash } from './canonical.js';
|
|
22
22
|
import { CardProofMetaSchema, DEFAULT_SKEW_SEC, MAX_TTL_SEC, } from './types.js';
|
|
23
23
|
/**
|
|
24
|
-
* Verify an `org.kya-os/proof
|
|
24
|
+
* Verify an `org.kya-os/proof.v1` against the request it should bind and the injected seams.
|
|
25
25
|
* Fail-closed: returns `{ ok:false, reasons }` on any broken binding; on success returns the
|
|
26
26
|
* derived assurance (`L3` on full cnf fusion, `L3-minus` without an AS `cnf`) and the principal.
|
|
27
27
|
*/
|
package/dist/card/schema.d.ts
CHANGED
|
@@ -7,10 +7,10 @@ import { z } from 'zod';
|
|
|
7
7
|
/** A `did:key` or `did:web` DID — the single source of truth for the DID shape (imported, never re-declared). */
|
|
8
8
|
export declare const Did: z.ZodString;
|
|
9
9
|
export declare const EntityTypeSchema: z.ZodEnum<{
|
|
10
|
+
verifier: "verifier";
|
|
10
11
|
mcp: "mcp";
|
|
11
12
|
agent: "agent";
|
|
12
13
|
client: "client";
|
|
13
|
-
verifier: "verifier";
|
|
14
14
|
human: "human";
|
|
15
15
|
}>;
|
|
16
16
|
export declare const ConformanceLevelSchema: z.ZodEnum<{
|
|
@@ -80,14 +80,22 @@ export declare const AttestationSchema: z.ZodObject<{
|
|
|
80
80
|
}, z.core.$strict>;
|
|
81
81
|
/** The canonical per-request proof profile id — the ONE source of truth every consumer
|
|
82
82
|
* references (the proof's `prf` tag, its `_meta` key, and the card's `proofProfile` field). */
|
|
83
|
-
export declare const PROOF_PROFILE_ID = "org.kya-os/proof
|
|
83
|
+
export declare const PROOF_PROFILE_ID = "org.kya-os/proof.v1";
|
|
84
|
+
/**
|
|
85
|
+
* The profile id of the earlier draft (`proof@1`), replaced because the `@`
|
|
86
|
+
* spelling collided with MCP's `_meta` key grammar and duplicated the version
|
|
87
|
+
* the `prf` field already carries. Verifiers accept it (in `prf` and in
|
|
88
|
+
* `proofProfile`) for one major version; producers emit only
|
|
89
|
+
* {@link PROOF_PROFILE_ID}.
|
|
90
|
+
*/
|
|
91
|
+
export declare const LEGACY_PROOF_PROFILE_ID = "org.kya-os/proof@1";
|
|
84
92
|
/**
|
|
85
93
|
* Self-declared per-request holder-of-key proof profile. A card carrying this advertises
|
|
86
|
-
* that its requests ride the stateless, sender-constrained `org.kya-os/proof
|
|
94
|
+
* that its requests ride the stateless, sender-constrained `org.kya-os/proof.v1` envelope
|
|
87
95
|
* (distinct from the legacy session-bound ProofMeta). The proof itself is NEVER on the
|
|
88
96
|
* static card — it rides per-request `_meta`; this field only names the profile.
|
|
89
97
|
*/
|
|
90
|
-
export declare const ProofProfileSchema: z.ZodLiteral<"org.kya-os/proof@1">;
|
|
98
|
+
export declare const ProofProfileSchema: z.ZodUnion<readonly [z.ZodLiteral<"org.kya-os/proof.v1">, z.ZodLiteral<"org.kya-os/proof@1">]>;
|
|
91
99
|
/**
|
|
92
100
|
* CIMD (draft-ietf-oauth-client-id-metadata-document) binding — the L1 on-ramp
|
|
93
101
|
* coordinates. `clientId` is the `did:web` HTTPS form; `jwksUri` is the DID-keyed JWKS the
|
|
@@ -108,10 +116,10 @@ export declare const BitstringStatusListEntrySchema: z.ZodObject<{
|
|
|
108
116
|
export declare const EntityCardSchema: z.ZodObject<{
|
|
109
117
|
id: z.ZodString;
|
|
110
118
|
entityType: z.ZodEnum<{
|
|
119
|
+
verifier: "verifier";
|
|
111
120
|
mcp: "mcp";
|
|
112
121
|
agent: "agent";
|
|
113
122
|
client: "client";
|
|
114
|
-
verifier: "verifier";
|
|
115
123
|
human: "human";
|
|
116
124
|
}>;
|
|
117
125
|
name: z.ZodString;
|
|
@@ -148,7 +156,7 @@ export declare const EntityCardSchema: z.ZodObject<{
|
|
|
148
156
|
issuer: z.ZodOptional<z.ZodString>;
|
|
149
157
|
}, z.core.$strict>>>;
|
|
150
158
|
didDocument: z.ZodOptional<z.ZodString>;
|
|
151
|
-
proofProfile: z.ZodOptional<z.ZodLiteral<"org.kya-os/proof@1">>;
|
|
159
|
+
proofProfile: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"org.kya-os/proof.v1">, z.ZodLiteral<"org.kya-os/proof@1">]>>;
|
|
152
160
|
cimd: z.ZodOptional<z.ZodObject<{
|
|
153
161
|
clientId: z.ZodString;
|
|
154
162
|
jwksUri: z.ZodString;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/card/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AAEH,iHAAiH;AACjH,eAAO,MAAM,GAAG,aAA6E,CAAC;AAE9F,eAAO,MAAM,gBAAgB;;;;;;EAA0D,CAAC;AAExF,eAAO,MAAM,sBAAsB;;;;EAA6B,CAAC;AAEjE,eAAO,MAAM,sBAAsB;;;;;;kBAQxB,CAAC;AAEZ,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB;;;;;;;kBASrB,CAAC;AAEZ,iGAAiG;AACjG,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;oBAAyD,CAAC;AAK3F;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;iBAEtC,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;kBAKxB,CAAC;AAEZ,kEAAkE;AAClE,eAAO,MAAM,gBAAgB;;;;;oBAAuD,CAAC;AAErF,eAAO,MAAM,iBAAiB;;;;;;;;kBAOnB,CAAC;AAEZ;gGACgG;AAChG,eAAO,MAAM,gBAAgB,uBAAuB,CAAC;
|
|
1
|
+
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/card/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AAEH,iHAAiH;AACjH,eAAO,MAAM,GAAG,aAA6E,CAAC;AAE9F,eAAO,MAAM,gBAAgB;;;;;;EAA0D,CAAC;AAExF,eAAO,MAAM,sBAAsB;;;;EAA6B,CAAC;AAEjE,eAAO,MAAM,sBAAsB;;;;;;kBAQxB,CAAC;AAEZ,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB;;;;;;;kBASrB,CAAC;AAEZ,iGAAiG;AACjG,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;oBAAyD,CAAC;AAK3F;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;iBAEtC,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;kBAKxB,CAAC;AAEZ,kEAAkE;AAClE,eAAO,MAAM,gBAAgB;;;;;oBAAuD,CAAC;AAErF,eAAO,MAAM,iBAAiB;;;;;;;;kBAOnB,CAAC;AAEZ;gGACgG;AAChG,eAAO,MAAM,gBAAgB,wBAAwB,CAAC;AAEtD;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAE5D;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,gGAG7B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;;;kBAKnB,CAAC;AAEZ;;;GAGG;AACH,eAAO,MAAM,8BAA8B;;;kBAKhC,CAAC;AAEZ,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAyBlB,CAAC;AAEZ,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,oFAAoF;AACpF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,CAE5D"}
|
package/dist/card/schema.js
CHANGED
|
@@ -57,14 +57,25 @@ export const AttestationSchema = z
|
|
|
57
57
|
.strict();
|
|
58
58
|
/** The canonical per-request proof profile id — the ONE source of truth every consumer
|
|
59
59
|
* references (the proof's `prf` tag, its `_meta` key, and the card's `proofProfile` field). */
|
|
60
|
-
export const PROOF_PROFILE_ID = 'org.kya-os/proof
|
|
60
|
+
export const PROOF_PROFILE_ID = 'org.kya-os/proof.v1';
|
|
61
|
+
/**
|
|
62
|
+
* The profile id of the earlier draft (`proof@1`), replaced because the `@`
|
|
63
|
+
* spelling collided with MCP's `_meta` key grammar and duplicated the version
|
|
64
|
+
* the `prf` field already carries. Verifiers accept it (in `prf` and in
|
|
65
|
+
* `proofProfile`) for one major version; producers emit only
|
|
66
|
+
* {@link PROOF_PROFILE_ID}.
|
|
67
|
+
*/
|
|
68
|
+
export const LEGACY_PROOF_PROFILE_ID = 'org.kya-os/proof@1';
|
|
61
69
|
/**
|
|
62
70
|
* Self-declared per-request holder-of-key proof profile. A card carrying this advertises
|
|
63
|
-
* that its requests ride the stateless, sender-constrained `org.kya-os/proof
|
|
71
|
+
* that its requests ride the stateless, sender-constrained `org.kya-os/proof.v1` envelope
|
|
64
72
|
* (distinct from the legacy session-bound ProofMeta). The proof itself is NEVER on the
|
|
65
73
|
* static card — it rides per-request `_meta`; this field only names the profile.
|
|
66
74
|
*/
|
|
67
|
-
export const ProofProfileSchema = z.
|
|
75
|
+
export const ProofProfileSchema = z.union([
|
|
76
|
+
z.literal(PROOF_PROFILE_ID),
|
|
77
|
+
z.literal(LEGACY_PROOF_PROFILE_ID),
|
|
78
|
+
]);
|
|
68
79
|
/**
|
|
69
80
|
* CIMD (draft-ietf-oauth-client-id-metadata-document) binding — the L1 on-ramp
|
|
70
81
|
* coordinates. `clientId` is the `did:web` HTTPS form; `jwksUri` is the DID-keyed JWKS the
|
package/dist/card/schema.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/card/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AAEH,iHAAiH;AACjH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE,kCAAkC,CAAC,CAAC;AAE9F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAExF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACrB,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACzB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACpB,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACvB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,iGAAiG;AACjG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAE3F,gFAAgF;AAChF,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAEzE;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAErF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,sBAAsB,EAAE,uBAAuB,CAAC,CAAC;IAC/D,EAAE,EAAE,OAAO;IACX,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE;IACvB,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE;CACvB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;gGACgG;AAChG,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;
|
|
1
|
+
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/card/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AAEH,iHAAiH;AACjH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE,kCAAkC,CAAC,CAAC;AAE9F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAExF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACrB,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACzB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACpB,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACvB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,iGAAiG;AACjG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAE3F,gFAAgF;AAChF,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAEzE;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAErF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,sBAAsB,EAAE,uBAAuB,CAAC,CAAC;IAC/D,EAAE,EAAE,OAAO;IACX,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE;IACvB,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE;CACvB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;gGACgG;AAChG,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC;IACxC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IAC3B,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC;CACnC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,MAAM,CAAC;IACN,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,0DAA0D,CAAC;CAC1G,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,EAAE,EAAE,GAAG;IACP,UAAU,EAAE,gBAAgB;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,YAAY,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAClD,2EAA2E;IAC3E,gBAAgB,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IACnD,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,sFAAsF;IACtF,YAAY,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC3C,8EAA8E;IAC9E,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAClC,kFAAkF;IAClF,UAAU,EAAE,8BAA8B,CAAC,QAAQ,EAAE;CACtD,CAAC;IACF,mFAAmF;IACnF,mFAAmF;KAClF,MAAM,EAAE,CAAC;AAiBZ,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,IAAkB;IAChD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC"}
|
package/dist/card/verify.d.ts
CHANGED
|
@@ -79,7 +79,7 @@ export interface VerifyCardDeps {
|
|
|
79
79
|
attestationVerifier?: AttestationVerifier;
|
|
80
80
|
/** Verifies the accountability edge (delegationRef → responsibleParty, leaf-invoker join). */
|
|
81
81
|
accountabilityVerifier?: AccountabilityVerifier;
|
|
82
|
-
/** The per-request holder-of-key proof that rode `_meta['org.kya-os/proof
|
|
82
|
+
/** The per-request holder-of-key proof that rode `_meta['org.kya-os/request-proof']` (recomputed here). */
|
|
83
83
|
proof?: unknown;
|
|
84
84
|
/** The request the proof must bind (`method` + `params`); required alongside `proof`. */
|
|
85
85
|
request?: ToolRequest;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/card/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,WAAW,EACjB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EAA6B,CAAC;AAE5E,eAAO,MAAM,uBAAuB,kCAAmC,CAAC;AAIxE,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,wEAAwE;IACxE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,6HAA6H;IAC7H,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAC/B,YAAY,EAAE,UAAU,EAAE,EAC1B,GAAG,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,KAC3D,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAEpC,8EAA8E;AAC9E,MAAM,MAAM,mBAAmB,GAAG,CAChC,WAAW,EAAE,WAAW,EACxB,GAAG,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,KAC3D,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,wGAAwG;IACxG,QAAQ,EAAE,OAAO,CAAC;IAClB,uGAAuG;IACvG,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,sBAAsB,GAAG,CACnC,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE;IAAE,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,KAC1D,OAAO,CAAC,OAAO,GAAG,oBAAoB,CAAC,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,WAAW,KACjB,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEhC,MAAM,WAAW,cAAc;IAC7B,yFAAyF;IACzF,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,0FAA0F;IAC1F,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,8FAA8F;IAC9F,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IAChD,
|
|
1
|
+
{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/card/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,WAAW,EACjB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EAA6B,CAAC;AAE5E,eAAO,MAAM,uBAAuB,kCAAmC,CAAC;AAIxE,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,wEAAwE;IACxE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,6HAA6H;IAC7H,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAC/B,YAAY,EAAE,UAAU,EAAE,EAC1B,GAAG,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,KAC3D,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAEpC,8EAA8E;AAC9E,MAAM,MAAM,mBAAmB,GAAG,CAChC,WAAW,EAAE,WAAW,EACxB,GAAG,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,KAC3D,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,wGAAwG;IACxG,QAAQ,EAAE,OAAO,CAAC;IAClB,uGAAuG;IACvG,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,sBAAsB,GAAG,CACnC,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE;IAAE,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,KAC1D,OAAO,CAAC,OAAO,GAAG,oBAAoB,CAAC,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,WAAW,KACjB,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEhC,MAAM,WAAW,cAAc;IAC7B,yFAAyF;IACzF,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,0FAA0F;IAC1F,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,8FAA8F;IAC9F,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IAChD,2GAA2G;IAC3G,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yFAAyF;IACzF,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,iGAAiG;IACjG,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,qFAAqF;IACrF,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,oGAAoG;IACpG,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,oEAAoE;IACpE,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,gBAAgB;IAC/B,kHAAkH;IAClH,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,EAAE,UAAU,CAAC;IACvB,iFAAiF;IACjF,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,cAAc,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACvG,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC3E,2EAA2E;IAC3E,KAAK,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,cAAc,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACvF,0FAA0F;IAC1F,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;IAClD,kFAAkF;IAClF,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA8BlG;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,qBAAqB,EAC5B,OAAO,EAAE,OAAO,EAChB,eAAe,UAAO,GACrB,gBAAgB,CAIlB"}
|
|
@@ -22,6 +22,10 @@ export interface DelegationGraphStorageProvider {
|
|
|
22
22
|
getDescendants(delegationId: string): Promise<DelegationNode[]>;
|
|
23
23
|
deleteNode(delegationId: string): Promise<void>;
|
|
24
24
|
}
|
|
25
|
+
/** Optional transaction seam for providers that can link parent and child atomically. */
|
|
26
|
+
export interface AtomicDelegationGraphStorageProvider extends DelegationGraphStorageProvider {
|
|
27
|
+
registerNodeAtomic(node: DelegationNode): Promise<void>;
|
|
28
|
+
}
|
|
25
29
|
export declare class DelegationGraphManager {
|
|
26
30
|
private storage;
|
|
27
31
|
constructor(storage: DelegationGraphStorageProvider);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"delegation-graph.d.ts","sourceRoot":"","sources":["../../src/delegation/delegation-graph.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,8BAA8B;IAC7C,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC9D,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC7D,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC1D,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAChE,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED,qBAAa,sBAAsB;IACrB,OAAO,CAAC,OAAO;gBAAP,OAAO,EAAE,8BAA8B;IAErD,kBAAkB,CAAC,MAAM,EAAE;QAC/B,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC,cAAc,CAAC;
|
|
1
|
+
{"version":3,"file":"delegation-graph.d.ts","sourceRoot":"","sources":["../../src/delegation/delegation-graph.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,8BAA8B;IAC7C,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC9D,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC7D,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC1D,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAChE,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED,yFAAyF;AACzF,MAAM,WAAW,oCAAqC,SAAQ,8BAA8B;IAC1F,kBAAkB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD;AASD,qBAAa,sBAAsB;IACrB,OAAO,CAAC,OAAO;gBAAP,OAAO,EAAE,8BAA8B;IAErD,kBAAkB,CAAC,MAAM,EAAE;QAC/B,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC,cAAc,CAAC;YA0Cb,gBAAgB;IAYxB,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAI7D,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAI5D,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAI/D,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAIzD,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKtE,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK/C,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA6BjF,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAc5D;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,8BAA8B,GACtC,sBAAsB,CAExB"}
|
|
@@ -6,6 +6,10 @@
|
|
|
6
6
|
*
|
|
7
7
|
* Related Spec: KYA-OS §4.4, Delegation Chains
|
|
8
8
|
*/
|
|
9
|
+
function supportsAtomicRegistration(storage) {
|
|
10
|
+
return 'registerNodeAtomic' in storage &&
|
|
11
|
+
typeof storage.registerNodeAtomic === 'function';
|
|
12
|
+
}
|
|
9
13
|
export class DelegationGraphManager {
|
|
10
14
|
storage;
|
|
11
15
|
constructor(storage) {
|
|
@@ -20,9 +24,31 @@ export class DelegationGraphManager {
|
|
|
20
24
|
subjectDid: params.subjectDid,
|
|
21
25
|
credentialStatusId: params.credentialStatusId,
|
|
22
26
|
};
|
|
23
|
-
await this.storage.setNode(node);
|
|
24
27
|
if (params.parentId) {
|
|
25
|
-
await this.
|
|
28
|
+
const parent = await this.storage.getNode(params.parentId);
|
|
29
|
+
if (!parent) {
|
|
30
|
+
throw new Error(`Parent delegation not found: ${params.parentId}`);
|
|
31
|
+
}
|
|
32
|
+
}
|
|
33
|
+
if (supportsAtomicRegistration(this.storage)) {
|
|
34
|
+
await this.storage.registerNodeAtomic(node);
|
|
35
|
+
}
|
|
36
|
+
else {
|
|
37
|
+
await this.storage.setNode(node);
|
|
38
|
+
if (params.parentId) {
|
|
39
|
+
try {
|
|
40
|
+
await this.addChildToParent(params.parentId, params.id);
|
|
41
|
+
}
|
|
42
|
+
catch (error) {
|
|
43
|
+
try {
|
|
44
|
+
await this.storage.deleteNode(params.id);
|
|
45
|
+
}
|
|
46
|
+
catch (rollbackError) {
|
|
47
|
+
throw new AggregateError([error, rollbackError], 'Delegation registration failed and its non-atomic rollback also failed', { cause: error });
|
|
48
|
+
}
|
|
49
|
+
throw error;
|
|
50
|
+
}
|
|
51
|
+
}
|
|
26
52
|
}
|
|
27
53
|
return node;
|
|
28
54
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"delegation-graph.js","sourceRoot":"","sources":["../../src/delegation/delegation-graph.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;
|
|
1
|
+
{"version":3,"file":"delegation-graph.js","sourceRoot":"","sources":["../../src/delegation/delegation-graph.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAyBH,SAAS,0BAA0B,CACjC,OAAuC;IAEvC,OAAO,oBAAoB,IAAI,OAAO;QACpC,OAAO,OAAO,CAAC,kBAAkB,KAAK,UAAU,CAAC;AACrD,CAAC;AAED,MAAM,OAAO,sBAAsB;IACb;IAApB,YAAoB,OAAuC;QAAvC,YAAO,GAAP,OAAO,CAAgC;IAAG,CAAC;IAE/D,KAAK,CAAC,kBAAkB,CAAC,MAMxB;QACC,MAAM,IAAI,GAAmB;YAC3B,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;SAC9C,CAAC;QAEF,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QAED,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC1D,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAC3C,CAAC;oBAAC,OAAO,aAAa,EAAE,CAAC;wBACvB,MAAM,IAAI,cAAc,CACtB,CAAC,KAAK,EAAE,aAAa,CAAC,EACtB,wEAAwE,EACxE,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;oBACJ,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,QAAgB,EAAE,OAAe;QAC9D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAoB;QAChC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,YAAoB;QACpC,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,YAAoB;QACvC,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,YAAoB;QACjC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAAkB,EAAE,YAAoB;QACvD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,YAAoB;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,YAAoB;QACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAEhD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QAC1D,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YAExB,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC1C,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,kBAAkB,KAAK,CAAC,EAAE,cAAc,KAAK,CAAC,SAAS,eAAe,MAAM,CAAC,EAAE,eAAe,MAAM,CAAC,UAAU,EAAE;iBAC1H,CAAC;YACJ,CAAC;YAED,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;gBACjC,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,kBAAkB,KAAK,CAAC,EAAE,aAAa,KAAK,CAAC,QAAQ,yBAAyB,MAAM,CAAC,EAAE,EAAE;iBAClG,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,YAAoB;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;gBACtE,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAuC;IAEvC,OAAO,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC"}
|
|
@@ -13,6 +13,11 @@ export interface StatusListStorageProvider {
|
|
|
13
13
|
setStatusList(statusListId: string, credential: StatusList2021Credential): Promise<void>;
|
|
14
14
|
allocateIndex(statusListId: string): Promise<number>;
|
|
15
15
|
}
|
|
16
|
+
/** Optional immutable-history extension used by audit replay/export adapters. */
|
|
17
|
+
export interface HistoricalStatusListStorageProvider extends StatusListStorageProvider {
|
|
18
|
+
getStatusListVersion(statusListId: string, version: number): Promise<StatusList2021Credential | null>;
|
|
19
|
+
getStatusListVersionCount(statusListId: string): Promise<number>;
|
|
20
|
+
}
|
|
16
21
|
export interface StatusListIdentityProvider {
|
|
17
22
|
getDid(): string;
|
|
18
23
|
getKeyId(): string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"statuslist-manager.d.ts","sourceRoot":"","sources":["../../src/delegation/statuslist-manager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,wBAAwB,EACxB,gBAAgB,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAoB,KAAK,mBAAmB,EAAE,KAAK,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACxG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAIxD,MAAM,WAAW,yBAAyB;IACxC,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAAC;IAC9E,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,IAAI,MAAM,CAAC;IACjB,QAAQ,IAAI,MAAM,CAAC;CACpB;AAED,qBAAa,qBAAqB;IAO9B,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,eAAe;IACvB,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,YAAY;IAVtB,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,eAAe,CAAS;IAChC,yFAAyF;IACzF,OAAO,CAAC,WAAW,CAAoC;gBAG7C,OAAO,EAAE,yBAAyB,EAClC,QAAQ,EAAE,0BAA0B,EACpC,eAAe,EAAE,iBAAiB,EAClC,UAAU,EAAE,mBAAmB,EAC/B,YAAY,EAAE,qBAAqB,EAC3C,OAAO,CAAC,EAAE;QACR,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B;IAMG,mBAAmB,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAkBpF,YAAY,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;YAezE,cAAc;IA6CtB,WAAW,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAmCjE,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAelD,sBAAsB;IAgDpC,oBAAoB,IAAI,MAAM;IAI9B,kBAAkB,IAAI,MAAM;CAG7B;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,yBAAyB,EAClC,QAAQ,EAAE,0BAA0B,EACpC,eAAe,EAAE,iBAAiB,EAClC,UAAU,EAAE,mBAAmB,EAC/B,YAAY,EAAE,qBAAqB,EACnC,OAAO,CAAC,EAAE;IACR,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GACA,qBAAqB,CASvB"}
|
|
1
|
+
{"version":3,"file":"statuslist-manager.d.ts","sourceRoot":"","sources":["../../src/delegation/statuslist-manager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,wBAAwB,EACxB,gBAAgB,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAoB,KAAK,mBAAmB,EAAE,KAAK,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACxG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAIxD,MAAM,WAAW,yBAAyB;IACxC,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAAC;IAC9E,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACtD;AAED,iFAAiF;AACjF,MAAM,WAAW,mCAAoC,SAAQ,yBAAyB;IACpF,oBAAoB,CAClB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAAC;IAC5C,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,IAAI,MAAM,CAAC;IACjB,QAAQ,IAAI,MAAM,CAAC;CACpB;AAED,qBAAa,qBAAqB;IAO9B,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,eAAe;IACvB,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,YAAY;IAVtB,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,eAAe,CAAS;IAChC,yFAAyF;IACzF,OAAO,CAAC,WAAW,CAAoC;gBAG7C,OAAO,EAAE,yBAAyB,EAClC,QAAQ,EAAE,0BAA0B,EACpC,eAAe,EAAE,iBAAiB,EAClC,UAAU,EAAE,mBAAmB,EAC/B,YAAY,EAAE,qBAAqB,EAC3C,OAAO,CAAC,EAAE;QACR,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B;IAMG,mBAAmB,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAkBpF,YAAY,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;YAezE,cAAc;IA6CtB,WAAW,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAmCjE,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAelD,sBAAsB;IAgDpC,oBAAoB,IAAI,MAAM;IAI9B,kBAAkB,IAAI,MAAM;CAG7B;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,yBAAyB,EAClC,QAAQ,EAAE,0BAA0B,EACpC,eAAe,EAAE,iBAAiB,EAClC,UAAU,EAAE,mBAAmB,EAC/B,YAAY,EAAE,qBAAqB,EACnC,OAAO,CAAC,EAAE;IACR,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GACA,qBAAqB,CASvB"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"statuslist-manager.js","sourceRoot":"","sources":["../../src/delegation/statuslist-manager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EAAE,gBAAgB,EAAwD,MAAM,gBAAgB,CAAC;AAExG,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;
|
|
1
|
+
{"version":3,"file":"statuslist-manager.js","sourceRoot":"","sources":["../../src/delegation/statuslist-manager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EAAE,gBAAgB,EAAwD,MAAM,gBAAgB,CAAC;AAExG,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAsBrE,MAAM,OAAO,qBAAqB;IAOtB;IACA;IACA;IACA;IACA;IAVF,iBAAiB,CAAS;IAC1B,eAAe,CAAS;IAChC,yFAAyF;IACjF,WAAW,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEvD,YACU,OAAkC,EAClC,QAAoC,EACpC,eAAkC,EAClC,UAA+B,EAC/B,YAAmC,EAC3C,OAGC;QARO,YAAO,GAAP,OAAO,CAA2B;QAClC,aAAQ,GAAR,QAAQ,CAA4B;QACpC,oBAAe,GAAf,eAAe,CAAmB;QAClC,eAAU,GAAV,UAAU,CAAqB;QAC/B,iBAAY,GAAZ,YAAY,CAAuB;QAM3C,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,IAAI,4BAA4B,CAAC;QACpF,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,eAAe,IAAI,MAAM,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,OAAoC;QAC5D,MAAM,YAAY,GAAG,GAAG,IAAI,CAAC,iBAAiB,IAAI,OAAO,KAAK,CAAC;QAE/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAE7D,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAEzD,MAAM,gBAAgB,GAAqB;YACzC,EAAE,EAAE,GAAG,YAAY,IAAI,KAAK,EAAE;YAC9B,IAAI,EAAE,qBAAqB;YAC3B,aAAa,EAAE,OAAO;YACtB,eAAe,EAAE,KAAK,CAAC,QAAQ,EAAE;YACjC,oBAAoB,EAAE,YAAY;SACnC,CAAC;QAEF,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,gBAAkC,EAAE,OAAgB;QACrE,MAAM,EAAE,oBAAoB,EAAE,GAAG,gBAAgB,CAAC;QAElD,mFAAmF;QACnF,gEAAgE;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACjF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;QAEtF,gFAAgF;QAChF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,oBAAoB,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC;QAEtE,2CAA2C;QAC3C,MAAM,SAAS,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,gBAAkC,EAAE,OAAgB;QAC/E,MAAM,EAAE,oBAAoB,EAAE,eAAe,EAAE,GAAG,gBAAgB,CAAC;QAEnE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,0BAA0B,oBAAoB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAC3C,UAAU,CAAC,iBAAiB,CAAC,WAAW,EACxC,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QAEF,MAAM,KAAK,GAAG,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE/B,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;QAE3C,MAAM,iBAAiB,GAA6B;YAClD,GAAG,UAAU;YACb,iBAAiB,EAAE;gBACjB,GAAG,UAAU,CAAC,iBAAiB;gBAC/B,WAAW;aACZ;SACF,CAAC;QAEF,MAAM,kBAAkB,GAAG,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACpD,OAAQ,kBAA8C,CAAC,OAAO,CAAC,CAAC;QAEhE,MAAM,WAAW,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CACtC,WAAW,EACX,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EACtB,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CACzB,CAAC;QAEF,MAAM,gBAAgB,GAA6B;YACjD,GAAG,iBAAiB;YACpB,KAAK;SACN,CAAC;QAEF,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,gBAAkC;QAClD,MAAM,EAAE,oBAAoB,EAAE,eAAe,EAAE,GAAG,gBAAgB,CAAC;QAEnE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,0BAA0B,oBAAoB,uCAAuC,CACtF,CAAC;QACJ,CAAC;QAED,8FAA8F;QAC9F,6FAA6F;QAC7F,8CAA8C;QAC9C,mBAAmB,CAAC,UAAU,CAAC,iBAAiB,CAAC,aAAa,EAAE,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAEhG,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAC3C,UAAU,CAAC,iBAAiB,CAAC,WAAW,EACxC,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QAEF,8FAA8F;QAC9F,+FAA+F;QAC/F,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,4BAA4B,eAAe,8CAA8C,CAAC,CAAC;QAC7G,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;QACtC,iGAAiG;QACjG,kGAAkG;QAClG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,oBAAoB,eAAe,kCAAkC,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,YAAoB;QAC1C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAC3C,UAAU,CAAC,iBAAiB,CAAC,WAAW,EACxC,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QAEF,OAAO,OAAO,CAAC,UAAU,EAAE,CAAC;IAC9B,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,YAAoB,EACpB,OAAoC;QAEpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAChE,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAClC,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;QAE3C,MAAM,kBAAkB,GAAG;YACzB,UAAU,EAAE;gBACV,wCAAwC;gBACxC,yCAAyC;aACtB;YACrB,EAAE,EAAE,YAAY;YAChB,IAAI,EAAE,CAAC,sBAAsB,EAAE,0BAA0B,CAAqB;YAC9E,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YAC9B,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACtC,iBAAiB,EAAE;gBACjB,EAAE,EAAE,GAAG,YAAY,OAAO;gBAC1B,IAAI,EAAE,gBAAyB;gBAC/B,aAAa,EAAE,OAAO;gBACtB,WAAW;aACZ;SACF,CAAC;QAEF,MAAM,WAAW,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CACtC,WAAW,EACX,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EACtB,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CACzB,CAAC;QAEF,MAAM,gBAAgB,GAA6B;YACjD,GAAG,kBAAkB;YACrB,KAAK;SACN,CAAC;QAEF,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;IACnE,CAAC;IAED,oBAAoB;QAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAkC,EAClC,QAAoC,EACpC,eAAkC,EAClC,UAA+B,EAC/B,YAAmC,EACnC,OAGC;IAED,OAAO,IAAI,qBAAqB,CAC9B,OAAO,EACP,QAAQ,EACR,eAAe,EACf,UAAU,EACV,YAAY,EACZ,OAAO,CACR,CAAC;AACJ,CAAC"}
|