@kya-os/mcp 1.13.0 → 1.14.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +51 -0
- package/dist/card/delegation.d.ts +4 -4
- package/dist/card/delegation.d.ts.map +1 -1
- package/dist/card/delegation.js +2 -2
- package/dist/card/delegation.js.map +1 -1
- package/dist/card/revocation.d.ts +9 -3
- package/dist/card/revocation.d.ts.map +1 -1
- package/dist/card/revocation.js +6 -53
- package/dist/card/revocation.js.map +1 -1
- package/dist/card/verify.d.ts +2 -2
- package/dist/card/verify.d.ts.map +1 -1
- package/dist/card/verify.js.map +1 -1
- package/dist/delegation/bitstring.d.ts +6 -0
- package/dist/delegation/bitstring.d.ts.map +1 -1
- package/dist/delegation/bitstring.js +8 -48
- package/dist/delegation/bitstring.js.map +1 -1
- package/dist/delegation/did-key-resolver.d.ts +4 -0
- package/dist/delegation/did-key-resolver.d.ts.map +1 -1
- package/dist/delegation/did-key-resolver.js +2 -2
- package/dist/delegation/did-key-resolver.js.map +1 -1
- package/dist/delegation/index.d.ts +1 -0
- package/dist/delegation/index.d.ts.map +1 -1
- package/dist/delegation/index.js +1 -0
- package/dist/delegation/index.js.map +1 -1
- package/dist/delegation/statuslist-manager.d.ts.map +1 -1
- package/dist/delegation/statuslist-manager.js +4 -11
- package/dist/delegation/statuslist-manager.js.map +1 -1
- package/dist/delegation/vc-jwt-verify.d.ts.map +1 -1
- package/dist/delegation/vc-jwt-verify.js +5 -3
- package/dist/delegation/vc-jwt-verify.js.map +1 -1
- package/dist/delegation/vc-verification-checks.d.ts.map +1 -1
- package/dist/delegation/vc-verification-checks.js +3 -2
- package/dist/delegation/vc-verification-checks.js.map +1 -1
- package/dist/delegation/verification-method-key.d.ts +15 -0
- package/dist/delegation/verification-method-key.d.ts.map +1 -0
- package/dist/delegation/verification-method-key.js +56 -0
- package/dist/delegation/verification-method-key.js.map +1 -0
- package/dist/integrations/cheqd/dlr.d.ts +9 -1
- package/dist/integrations/cheqd/dlr.d.ts.map +1 -1
- package/dist/integrations/cheqd/dlr.js +25 -0
- package/dist/integrations/cheqd/dlr.js.map +1 -1
- package/dist/integrations/cheqd/index.d.ts +1 -0
- package/dist/integrations/cheqd/index.d.ts.map +1 -1
- package/dist/integrations/cheqd/index.js +1 -0
- package/dist/integrations/cheqd/index.js.map +1 -1
- package/dist/integrations/cheqd/statuslist-resolver.d.ts +74 -0
- package/dist/integrations/cheqd/statuslist-resolver.d.ts.map +1 -0
- package/dist/integrations/cheqd/statuslist-resolver.js +138 -0
- package/dist/integrations/cheqd/statuslist-resolver.js.map +1 -0
- package/dist/utils/statuslist-bits.d.ts +51 -0
- package/dist/utils/statuslist-bits.d.ts.map +1 -0
- package/dist/utils/statuslist-bits.js +106 -0
- package/dist/utils/statuslist-bits.js.map +1 -0
- package/package.json +1 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"statuslist-manager.d.ts","sourceRoot":"","sources":["../../src/delegation/statuslist-manager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,wBAAwB,EACxB,gBAAgB,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAoB,KAAK,mBAAmB,EAAE,KAAK,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;
|
|
1
|
+
{"version":3,"file":"statuslist-manager.d.ts","sourceRoot":"","sources":["../../src/delegation/statuslist-manager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,wBAAwB,EACxB,gBAAgB,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAoB,KAAK,mBAAmB,EAAE,KAAK,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAExG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAIxD,MAAM,WAAW,yBAAyB;IACxC,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAAC;IAC9E,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACtD;AAED,iFAAiF;AACjF,MAAM,WAAW,mCAAoC,SAAQ,yBAAyB;IACpF,oBAAoB,CAClB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAAC;IAC5C,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,IAAI,MAAM,CAAC;IACjB,QAAQ,IAAI,MAAM,CAAC;CACpB;AAED,qBAAa,qBAAqB;IAO9B,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,eAAe;IACvB,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,YAAY;IAVtB,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,eAAe,CAAS;IAChC,yFAAyF;IACzF,OAAO,CAAC,WAAW,CAAoC;gBAG7C,OAAO,EAAE,yBAAyB,EAClC,QAAQ,EAAE,0BAA0B,EACpC,eAAe,EAAE,iBAAiB,EAClC,UAAU,EAAE,mBAAmB,EAC/B,YAAY,EAAE,qBAAqB,EAC3C,OAAO,CAAC,EAAE;QACR,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B;IAMG,mBAAmB,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAkBpF,YAAY,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;YAezE,cAAc;IA6CtB,WAAW,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IA2BjE,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAelD,sBAAsB;IAgDpC,oBAAoB,IAAI,MAAM;IAI9B,kBAAkB,IAAI,MAAM;CAG7B;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,yBAAyB,EAClC,QAAQ,EAAE,0BAA0B,EACpC,eAAe,EAAE,iBAAiB,EAClC,UAAU,EAAE,mBAAmB,EAC/B,YAAY,EAAE,qBAAqB,EACnC,OAAO,CAAC,EAAE;IACR,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GACA,qBAAqB,CASvB"}
|
|
@@ -6,6 +6,7 @@
|
|
|
6
6
|
* Related Spec: W3C StatusList2021
|
|
7
7
|
*/
|
|
8
8
|
import { BitstringManager } from './bitstring.js';
|
|
9
|
+
import { parseStatusListIndex } from '../utils/statuslist-bits.js';
|
|
9
10
|
import { canonicalizeJSON } from './utils.js';
|
|
10
11
|
import { assertStatusPurpose } from '../utils/statuslist-purpose.js';
|
|
11
12
|
export class StatusList2021Manager {
|
|
@@ -89,17 +90,9 @@ export class StatusList2021Manager {
|
|
|
89
90
|
// wrong list — a fail-OPEN revocation bypass.
|
|
90
91
|
assertStatusPurpose(statusList.credentialSubject.statusPurpose, credentialStatus.statusPurpose);
|
|
91
92
|
const manager = await BitstringManager.decode(statusList.credentialSubject.encodedList, this.compressor, this.decompressor);
|
|
92
|
-
// Strict decimal, fail-closed
|
|
93
|
-
//
|
|
94
|
-
|
|
95
|
-
throw new Error(`Invalid statusListIndex "${statusListIndex}" — must be a canonical non-negative decimal`);
|
|
96
|
-
}
|
|
97
|
-
const index = Number(statusListIndex);
|
|
98
|
-
// A canonical-decimal string can still exceed 2^53-1 and lose precision; reject it explicitly at
|
|
99
|
-
// the parse layer (matches revocation.ts parseIndex) rather than leaning only on getBit's bounds.
|
|
100
|
-
if (!Number.isSafeInteger(index)) {
|
|
101
|
-
throw new Error(`statusListIndex "${statusListIndex}" exceeds the safe integer range`);
|
|
102
|
-
}
|
|
93
|
+
// Strict canonical-decimal parse, fail-closed (shared primitive — a lenient parse would read a
|
|
94
|
+
// DIFFERENT, often clear, bit than the credential names: a revocation bypass).
|
|
95
|
+
const index = parseStatusListIndex(statusListIndex);
|
|
103
96
|
return manager.getBit(index);
|
|
104
97
|
}
|
|
105
98
|
async getRevokedIndices(statusListId) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"statuslist-manager.js","sourceRoot":"","sources":["../../src/delegation/statuslist-manager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EAAE,gBAAgB,EAAwD,MAAM,gBAAgB,CAAC;
|
|
1
|
+
{"version":3,"file":"statuslist-manager.js","sourceRoot":"","sources":["../../src/delegation/statuslist-manager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EAAE,gBAAgB,EAAwD,MAAM,gBAAgB,CAAC;AACxG,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAsBrE,MAAM,OAAO,qBAAqB;IAOtB;IACA;IACA;IACA;IACA;IAVF,iBAAiB,CAAS;IAC1B,eAAe,CAAS;IAChC,yFAAyF;IACjF,WAAW,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEvD,YACU,OAAkC,EAClC,QAAoC,EACpC,eAAkC,EAClC,UAA+B,EAC/B,YAAmC,EAC3C,OAGC;QARO,YAAO,GAAP,OAAO,CAA2B;QAClC,aAAQ,GAAR,QAAQ,CAA4B;QACpC,oBAAe,GAAf,eAAe,CAAmB;QAClC,eAAU,GAAV,UAAU,CAAqB;QAC/B,iBAAY,GAAZ,YAAY,CAAuB;QAM3C,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,IAAI,4BAA4B,CAAC;QACpF,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,eAAe,IAAI,MAAM,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,OAAoC;QAC5D,MAAM,YAAY,GAAG,GAAG,IAAI,CAAC,iBAAiB,IAAI,OAAO,KAAK,CAAC;QAE/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAE7D,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAEzD,MAAM,gBAAgB,GAAqB;YACzC,EAAE,EAAE,GAAG,YAAY,IAAI,KAAK,EAAE;YAC9B,IAAI,EAAE,qBAAqB;YAC3B,aAAa,EAAE,OAAO;YACtB,eAAe,EAAE,KAAK,CAAC,QAAQ,EAAE;YACjC,oBAAoB,EAAE,YAAY;SACnC,CAAC;QAEF,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,gBAAkC,EAAE,OAAgB;QACrE,MAAM,EAAE,oBAAoB,EAAE,GAAG,gBAAgB,CAAC;QAElD,mFAAmF;QACnF,gEAAgE;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACjF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;QAEtF,gFAAgF;QAChF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,oBAAoB,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC;QAEtE,2CAA2C;QAC3C,MAAM,SAAS,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,gBAAkC,EAAE,OAAgB;QAC/E,MAAM,EAAE,oBAAoB,EAAE,eAAe,EAAE,GAAG,gBAAgB,CAAC;QAEnE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,0BAA0B,oBAAoB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAC3C,UAAU,CAAC,iBAAiB,CAAC,WAAW,EACxC,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QAEF,MAAM,KAAK,GAAG,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE/B,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;QAE3C,MAAM,iBAAiB,GAA6B;YAClD,GAAG,UAAU;YACb,iBAAiB,EAAE;gBACjB,GAAG,UAAU,CAAC,iBAAiB;gBAC/B,WAAW;aACZ;SACF,CAAC;QAEF,MAAM,kBAAkB,GAAG,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACpD,OAAQ,kBAA8C,CAAC,OAAO,CAAC,CAAC;QAEhE,MAAM,WAAW,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CACtC,WAAW,EACX,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EACtB,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CACzB,CAAC;QAEF,MAAM,gBAAgB,GAA6B;YACjD,GAAG,iBAAiB;YACpB,KAAK;SACN,CAAC;QAEF,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,gBAAkC;QAClD,MAAM,EAAE,oBAAoB,EAAE,eAAe,EAAE,GAAG,gBAAgB,CAAC;QAEnE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,0BAA0B,oBAAoB,uCAAuC,CACtF,CAAC;QACJ,CAAC;QAED,8FAA8F;QAC9F,6FAA6F;QAC7F,8CAA8C;QAC9C,mBAAmB,CAAC,UAAU,CAAC,iBAAiB,CAAC,aAAa,EAAE,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAEhG,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAC3C,UAAU,CAAC,iBAAiB,CAAC,WAAW,EACxC,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QAEF,+FAA+F;QAC/F,+EAA+E;QAC/E,MAAM,KAAK,GAAG,oBAAoB,CAAC,eAAe,CAAC,CAAC;QACpD,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,YAAoB;QAC1C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAC3C,UAAU,CAAC,iBAAiB,CAAC,WAAW,EACxC,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QAEF,OAAO,OAAO,CAAC,UAAU,EAAE,CAAC;IAC9B,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,YAAoB,EACpB,OAAoC;QAEpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAChE,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAClC,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;QAE3C,MAAM,kBAAkB,GAAG;YACzB,UAAU,EAAE;gBACV,wCAAwC;gBACxC,yCAAyC;aACtB;YACrB,EAAE,EAAE,YAAY;YAChB,IAAI,EAAE,CAAC,sBAAsB,EAAE,0BAA0B,CAAqB;YAC9E,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YAC9B,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACtC,iBAAiB,EAAE;gBACjB,EAAE,EAAE,GAAG,YAAY,OAAO;gBAC1B,IAAI,EAAE,gBAAyB;gBAC/B,aAAa,EAAE,OAAO;gBACtB,WAAW;aACZ;SACF,CAAC;QAEF,MAAM,WAAW,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CACtC,WAAW,EACX,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EACtB,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CACzB,CAAC;QAEF,MAAM,gBAAgB,GAA6B;YACjD,GAAG,kBAAkB;YACrB,KAAK;SACN,CAAC;QAEF,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;IACnE,CAAC;IAED,oBAAoB;QAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAkC,EAClC,QAAoC,EACpC,eAAkC,EAClC,UAA+B,EAC/B,YAAmC,EACnC,OAGC;IAED,OAAO,IAAI,qBAAqB,CAC9B,OAAO,EACP,QAAQ,EACR,eAAe,EACf,UAAU,EACV,YAAY,EACZ,OAAO,CACR,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"vc-jwt-verify.d.ts","sourceRoot":"","sources":["../../src/delegation/vc-jwt-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,KAAK,EACV,WAAW,EAEX,8BAA8B,EAC/B,MAAM,wBAAwB,CAAC;
|
|
1
|
+
{"version":3,"file":"vc-jwt-verify.d.ts","sourceRoot":"","sources":["../../src/delegation/vc-jwt-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,KAAK,EACV,WAAW,EAEX,8BAA8B,EAC/B,MAAM,wBAAwB,CAAC;AAShC;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,oBAAoB,GAC/B,MAAM,GAAG,SAAS,CAOpB;AAmBD,mFAAmF;AACnF,MAAM,MAAM,aAAa,GACrB;IACE,EAAE,EAAE,oBAAoB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;CACtB,GACD;IAAE,OAAO,EAAE,8BAA8B,CAAA;CAAE,CAAC;AAEhD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,GAChB,aAAa,CAmCf;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AASD;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,WAAW,EAAE,WAAW,GAAG,SAAS,GACnC,OAAO,CAAC,oBAAoB,CAAC,CA4C/B"}
|
|
@@ -20,6 +20,7 @@
|
|
|
20
20
|
import { compactVerify, importJWK } from "jose";
|
|
21
21
|
import { parseVCJWT } from "./utils.js";
|
|
22
22
|
import { validateBasicProperties } from "./vc-verification-checks.js";
|
|
23
|
+
import { verificationMethodJwk } from "./verification-method-key.js";
|
|
23
24
|
function errMsg(err) {
|
|
24
25
|
return err instanceof Error ? err.message : String(err);
|
|
25
26
|
}
|
|
@@ -116,11 +117,12 @@ export async function verifyVcJwtSignature(jwt, issuerDid, kid, didResolver) {
|
|
|
116
117
|
? `Verification method ${kid} not found in DID Document`
|
|
117
118
|
: "DID Document has no verification method");
|
|
118
119
|
}
|
|
119
|
-
|
|
120
|
-
|
|
120
|
+
const publicKeyJwk = verificationMethodJwk(vm);
|
|
121
|
+
if (!publicKeyJwk) {
|
|
122
|
+
return done(false, "Verification method has no usable public key (publicKeyJwk / publicKeyMultibase / publicKeyBase58)");
|
|
121
123
|
}
|
|
122
124
|
try {
|
|
123
|
-
const key = await importJWK(
|
|
125
|
+
const key = await importJWK(publicKeyJwk, "EdDSA");
|
|
124
126
|
await compactVerify(jwt, key, { algorithms: ["EdDSA"] });
|
|
125
127
|
return done(true);
|
|
126
128
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"vc-jwt-verify.js","sourceRoot":"","sources":["../../src/delegation/vc-jwt-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAQhD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;
|
|
1
|
+
{"version":3,"file":"vc-jwt-verify.js","sourceRoot":"","sources":["../../src/delegation/vc-jwt-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAQhD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErE,SAAS,MAAM,CAAC,GAAY;IAC1B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAgC;IAEhC,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC;IAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACjE,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CACtB,MAA0B,EAC1B,SAAiB,EACjB,YAAqB;IAErB,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,MAAM;QACN,KAAK,EAAE,OAAO;QACd,OAAO,EACL,YAAY,KAAK,SAAS;YACxB,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE;YACnD,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE;QACzC,MAAM,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE;KAC9B,CAAC;AACJ,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAW,EACX,SAAiB;IAEjB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,mCAAmC,EAAE,SAAS,CAAC,EAAE,CAAC;IACtF,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,EAA0B,CAAC;IACrD,MAAM,eAAe,GAAG,uBAAuB,CAAC,EAAE,EAAE;QAClD,oBAAoB,EAAE,KAAK;KAC5B,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;IAElD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC3B,OAAO;YACL,OAAO,EAAE,eAAe,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC;SAC1E,CAAC;IACJ,CAAC;IAED,IAAI,mBAAmB,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACnD,OAAO;YACL,OAAO,EAAE,eAAe,CACtB,wEAAwE,EACxE,SAAS,EACT,YAAY,CACb;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE;QACF,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG;QAC7B,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;QACtB,YAAY;KACb,CAAC;AACJ,CAAC;AAQD,SAAS,wBAAwB,CAC/B,OAA6B,EAC7B,GAAuB;IAEvB,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAW,EACX,SAAiB,EACjB,GAAuB,EACvB,WAAoC;IAEpC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,MAAe,EAAwB,EAAE,CAAC,CAAC;QACvE,KAAK;QACL,MAAM;QACN,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;KACnC,CAAC,CAAC;IAEH,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CACT,KAAK,EACL,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC,KAAK,EAAE,iCAAiC,SAAS,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,EAAE,GAAG,wBAAwB,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IAC1E,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,IAAI,CACT,KAAK,EACL,GAAG;YACD,CAAC,CAAC,uBAAuB,GAAG,4BAA4B;YACxD,CAAC,CAAC,yCAAyC,CAC9C,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,IAAI,CACT,KAAK,EACL,oGAAoG,CACrG,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,YAAmB,EAAE,OAAO,CAAC,CAAC;QAC1D,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,KAAK,EAAE,wCAAwC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"vc-verification-checks.d.ts","sourceRoot":"","sources":["../../src/delegation/vc-verification-checks.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,sBAAsB,CAAC;AAO9B,OAAO,KAAK,EACV,WAAW,EAGX,kBAAkB,EAClB,iBAAiB,EACjB,6BAA6B,EAC7B,8BAA8B,EAC/B,MAAM,wBAAwB,CAAC;
|
|
1
|
+
{"version":3,"file":"vc-verification-checks.d.ts","sourceRoot":"","sources":["../../src/delegation/vc-verification-checks.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,sBAAsB,CAAC;AAO9B,OAAO,KAAK,EACV,WAAW,EAGX,kBAAkB,EAClB,iBAAiB,EACjB,6BAA6B,EAC7B,8BAA8B,EAC/B,MAAM,wBAAwB,CAAC;AAUhC;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,oBAAoB,EACxB,OAAO,GAAE;IAAE,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/C;IACD,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAuCA;AAqCD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,eAAe,EAAE;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,EACzE,YAAY,EAAE,iBAAiB,EAC/B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB,8BAA8B,CAqBhC;AAED,gFAAgF;AAChF,wBAAsB,eAAe,CACnC,EAAE,EAAE,oBAAoB,EACxB,WAAW,EAAE,WAAW,GAAG,SAAS,EACpC,iBAAiB,EAAE,6BAA6B,GAAG,SAAS,GAC3D,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA8FnE;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,gBAAgB,EACxB,kBAAkB,EAAE,kBAAkB,GAAG,SAAS,GACjD,OAAO,CAAC,iBAAiB,CAAC,CAqC5B"}
|
|
@@ -6,6 +6,7 @@
|
|
|
6
6
|
* `./vc-verifier.ts`) so the class holds only orchestration + its cache.
|
|
7
7
|
*/
|
|
8
8
|
import { isDelegationCredentialExpired, isDelegationCredentialNotYetValid, isSupportedCredentialProofType, validateDelegationCredential, } from "../types/protocol.js";
|
|
9
|
+
import { verificationMethodJwk } from "./verification-method-key.js";
|
|
9
10
|
/**
|
|
10
11
|
* Properties a DelegationCredential `credentialSubject` may carry. Anything
|
|
11
12
|
* else is treated as a claim-intended field and rejected by default — a
|
|
@@ -160,11 +161,11 @@ export async function verifySignature(vc, didResolver, signatureVerifier) {
|
|
|
160
161
|
durationMs: Date.now() - startTime,
|
|
161
162
|
};
|
|
162
163
|
}
|
|
163
|
-
const publicKeyJwk = verificationMethod
|
|
164
|
+
const publicKeyJwk = verificationMethodJwk(verificationMethod);
|
|
164
165
|
if (!publicKeyJwk) {
|
|
165
166
|
return {
|
|
166
167
|
valid: false,
|
|
167
|
-
reason: "Verification method
|
|
168
|
+
reason: "Verification method has no usable public key (publicKeyJwk / publicKeyMultibase / publicKeyBase58)",
|
|
168
169
|
durationMs: Date.now() - startTime,
|
|
169
170
|
};
|
|
170
171
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"vc-verification-checks.js","sourceRoot":"","sources":["../../src/delegation/vc-verification-checks.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EACL,6BAA6B,EAC7B,iCAAiC,EACjC,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;
|
|
1
|
+
{"version":3,"file":"vc-verification-checks.js","sourceRoot":"","sources":["../../src/delegation/vc-verification-checks.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EACL,6BAA6B,EAC7B,iCAAiC,EACjC,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AAU9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErE;;;;GAIG;AACH,MAAM,uBAAuB,GAAsB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,EAAwB,EACxB,UAA8C,EAAE;IAKhD,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,6BAA6B,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE;SACvE,CAAC;IACJ,CAAC;IAED,IAAI,6BAA6B,CAAC,EAAE,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,iCAAiC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC;IACnD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,oBAAoB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QACxD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,YAAY,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,EAAwB;IAIpD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,MAAM,CACzD,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAChD,CAAC;IAEF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,MAAM,EACJ,uDAAuD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAChF,sFAAsF;KACzF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,MAAmB,EACnB,oBAA4B;IAE5B,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,CACpC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,oBAAoB,CACvC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,eAAyE,EACzE,YAA+B,EAC/B,YAAoB,EACpB,SAAiB;IAEjB,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC;IAC7D,OAAO;QACL,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,CAAC,QAAQ;YACf,CAAC,CAAC,eAAe,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,IAAI,iBAAiB;YACpE,CAAC,CAAC,SAAS;QACb,aAAa,EAAE,YAAY,CAAC,OAAO;QACnC,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE;YACP,YAAY;YACZ,gBAAgB,EAAE,eAAe,CAAC,UAAU,IAAI,CAAC;YACjD,aAAa,EAAE,YAAY,CAAC,UAAU,IAAI,CAAC;YAC3C,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SAChC;QACD,MAAM,EAAE;YACN,UAAU,EAAE,IAAI;YAChB,cAAc,EAAE,eAAe,CAAC,KAAK;YACrC,WAAW,EAAE,YAAY,CAAC,KAAK;SAChC;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAwB,EACxB,WAAoC,EACpC,iBAA4D;IAE5D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,SAAS,GACb,OAAO,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QAE3D,IAAI,CAAC,WAAW,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EACJ,iFAAiF;gBACnF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,0EAA0E;QAC1E,6EAA6E;QAC7E,4EAA4E;QAC5E,0EAA0E;QAC1E,2EAA2E;QAC3E,6EAA6E;QAC7E,gEAAgE;QAChE,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,8BAA8B,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,sCAAsC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;gBACrE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,iCAAiC,SAAS,EAAE;gBACpD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YACd,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,MAAM,oBAAoB,GAAG,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC5D,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,kCAAkC;gBAC1C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,MAAM,kBAAkB,GAAG,sBAAsB,CAC/C,MAAM,EACN,oBAA8B,CAC/B,CAAC;QACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uBAAuB,oBAAoB,YAAY;gBAC/D,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;QAC/D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EACJ,oGAAoG;gBACtG,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,MAAM,kBAAkB,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAErE,OAAO;YACL,KAAK,EAAE,kBAAkB,CAAC,KAAK;YAC/B,MAAM,EAAE,kBAAkB,CAAC,MAAM;YACjC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;YACnG,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAwB,EACxB,kBAAkD;IAElD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EACJ,6GAA6G;gBAC/G,OAAO,EAAE,qBAAqB;gBAC9B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAE/D,IAAI,SAAS,EAAE,CAAC;YACd,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,0CAA0C,MAAM,CAAC,aAAa,GAAG;gBACzE,OAAO,EAAE,SAAS;gBAClB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,OAAO;YACL,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;YACzF,OAAO,EAAE,qBAAqB;YAC9B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC;IACJ,CAAC;AACH,CAAC"}
|
|
@@ -0,0 +1,15 @@
|
|
|
1
|
+
import type { VerificationMethod } from './vc-verifier.types.js';
|
|
2
|
+
/**
|
|
3
|
+
* The verification method's public key as an Ed25519 OKP JWK: an existing
|
|
4
|
+
* `publicKeyJwk` is returned untouched (byte-for-byte — zero behavior change
|
|
5
|
+
* for documents that already publish JWKs); otherwise one is synthesized from
|
|
6
|
+
* `publicKeyMultibase` (base58btc, with or without the 0xed01 multicodec
|
|
7
|
+
* prefix) or legacy `publicKeyBase58`. `undefined` when no usable Ed25519 key
|
|
8
|
+
* is present (fail-closed).
|
|
9
|
+
*/
|
|
10
|
+
export declare function verificationMethodJwk(method: VerificationMethod): {
|
|
11
|
+
kty: string;
|
|
12
|
+
crv: string;
|
|
13
|
+
x: string;
|
|
14
|
+
} | undefined;
|
|
15
|
+
//# sourceMappingURL=verification-method-key.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"verification-method-key.d.ts","sourceRoot":"","sources":["../../src/delegation/verification-method-key.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAKjE;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,kBAAkB,GACzB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAOrD"}
|
|
@@ -0,0 +1,56 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Verification-method key extraction — one place that answers "what Ed25519
|
|
3
|
+
* public key does this verification method publish?".
|
|
4
|
+
*
|
|
5
|
+
* The `VerificationMethod` type has always declared `publicKeyMultibase` and
|
|
6
|
+
* `publicKeyBase58` alongside `publicKeyJwk`, but both signature paths read
|
|
7
|
+
* only the JWK — so a did:cheqd issuer (which publishes multibase keys) could
|
|
8
|
+
* never verify end-to-end. This helper converts at the point of use; resolvers
|
|
9
|
+
* keep reporting DID documents exactly as published.
|
|
10
|
+
*
|
|
11
|
+
* FAIL-CLOSED: anything that is not provably a 32-byte Ed25519 key —
|
|
12
|
+
* non-`z` multibase, wrong multicodec, wrong length, malformed base58 —
|
|
13
|
+
* returns `undefined`, and the caller denies with its usual reason.
|
|
14
|
+
*/
|
|
15
|
+
import { base58Decode } from '../utils/base58.js';
|
|
16
|
+
import { publicKeyToJwk, ED25519_MULTICODEC_PREFIX, ED25519_PUBLIC_KEY_LENGTH, } from './did-key-resolver.js';
|
|
17
|
+
/** Multibase prefix for base58btc. */
|
|
18
|
+
const MULTIBASE_BASE58BTC = 'z';
|
|
19
|
+
/**
|
|
20
|
+
* The verification method's public key as an Ed25519 OKP JWK: an existing
|
|
21
|
+
* `publicKeyJwk` is returned untouched (byte-for-byte — zero behavior change
|
|
22
|
+
* for documents that already publish JWKs); otherwise one is synthesized from
|
|
23
|
+
* `publicKeyMultibase` (base58btc, with or without the 0xed01 multicodec
|
|
24
|
+
* prefix) or legacy `publicKeyBase58`. `undefined` when no usable Ed25519 key
|
|
25
|
+
* is present (fail-closed).
|
|
26
|
+
*/
|
|
27
|
+
export function verificationMethodJwk(method) {
|
|
28
|
+
if (method.publicKeyJwk) {
|
|
29
|
+
return method.publicKeyJwk;
|
|
30
|
+
}
|
|
31
|
+
const raw = rawEd25519Key(method);
|
|
32
|
+
return raw ? publicKeyToJwk(raw) : undefined;
|
|
33
|
+
}
|
|
34
|
+
/** Decode multibase/base58 key material to raw bytes; `undefined` unless it is exactly a 32-byte Ed25519 key. */
|
|
35
|
+
function rawEd25519Key(method) {
|
|
36
|
+
try {
|
|
37
|
+
if (method.publicKeyMultibase?.startsWith(MULTIBASE_BASE58BTC)) {
|
|
38
|
+
const decoded = base58Decode(method.publicKeyMultibase.slice(1));
|
|
39
|
+
const stripped = decoded.length === ED25519_PUBLIC_KEY_LENGTH + ED25519_MULTICODEC_PREFIX.length &&
|
|
40
|
+
decoded[0] === ED25519_MULTICODEC_PREFIX[0] &&
|
|
41
|
+
decoded[1] === ED25519_MULTICODEC_PREFIX[1]
|
|
42
|
+
? decoded.slice(ED25519_MULTICODEC_PREFIX.length)
|
|
43
|
+
: decoded;
|
|
44
|
+
return stripped.length === ED25519_PUBLIC_KEY_LENGTH ? stripped : undefined;
|
|
45
|
+
}
|
|
46
|
+
if (method.publicKeyBase58) {
|
|
47
|
+
const decoded = base58Decode(method.publicKeyBase58);
|
|
48
|
+
return decoded.length === ED25519_PUBLIC_KEY_LENGTH ? decoded : undefined;
|
|
49
|
+
}
|
|
50
|
+
}
|
|
51
|
+
catch {
|
|
52
|
+
return undefined; // malformed base58 → fail-closed
|
|
53
|
+
}
|
|
54
|
+
return undefined;
|
|
55
|
+
}
|
|
56
|
+
//# sourceMappingURL=verification-method-key.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"verification-method-key.js","sourceRoot":"","sources":["../../src/delegation/verification-method-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAG/B,sCAAsC;AACtC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA0B;IAE1B,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,YAAuD,CAAC;IACxE,CAAC;IAED,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,iHAAiH;AACjH,SAAS,aAAa,CAAC,MAA0B;IAC/C,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,kBAAkB,EAAE,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC/D,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACjE,MAAM,QAAQ,GACZ,OAAO,CAAC,MAAM,KAAK,yBAAyB,GAAG,yBAAyB,CAAC,MAAM;gBAC/E,OAAO,CAAC,CAAC,CAAC,KAAK,yBAAyB,CAAC,CAAC,CAAC;gBAC3C,OAAO,CAAC,CAAC,CAAC,KAAK,yBAAyB,CAAC,CAAC,CAAC;gBACzC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,MAAM,CAAC;gBACjD,CAAC,CAAC,OAAO,CAAC;YACd,OAAO,QAAQ,CAAC,MAAM,KAAK,yBAAyB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,CAAC;QACD,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YACrD,OAAO,OAAO,CAAC,MAAM,KAAK,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,iCAAiC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
|
|
@@ -1,6 +1,14 @@
|
|
|
1
1
|
import type { CryptoProvider } from '../../providers/base.js';
|
|
2
2
|
import type { CheqdCreateResourceBody } from './registrar.js';
|
|
3
|
-
|
|
3
|
+
/**
|
|
4
|
+
* Artifact kinds KYA-OS anchors as DID-Linked Resources. The taxonomy — and
|
|
5
|
+
* the JCS-canonicalize → sha256 content addressing in
|
|
6
|
+
* {@link prepareCheqdDlrResource} — is protocol-level rather than
|
|
7
|
+
* cheqd-specific: the day a SECOND anchoring integration lands, both graduate
|
|
8
|
+
* to a central module with deprecated aliases kept here (rule-of-two,
|
|
9
|
+
* recorded now so that PR is mechanical).
|
|
10
|
+
*/
|
|
11
|
+
export declare const CHEQD_DLR_ARTIFACT_TYPES: readonly ["CapabilityManifest", "ConformanceManifest", "AccessHashManifest", "TrustConfigManifest", "StatusListCredential"];
|
|
4
12
|
export type CheqdDlrArtifactType = (typeof CHEQD_DLR_ARTIFACT_TYPES)[number];
|
|
5
13
|
export interface CheqdDlrArtifact {
|
|
6
14
|
id?: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"dlr.d.ts","sourceRoot":"","sources":["../../../src/integrations/cheqd/dlr.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;
|
|
1
|
+
{"version":3,"file":"dlr.d.ts","sourceRoot":"","sources":["../../../src/integrations/cheqd/dlr.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAI9D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAE9D;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,6HAM3B,CAAC;AAEX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7E,MAAM,WAAW,gBAAgB;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,oBAAoB,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,EAAE,uBAAuB,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAKD,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,OAAO,GAChB;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA4CrC;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,oBAAoB,CAG/B;AAED,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,gBAAgB,EAC1B,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,wBAAwB,CAAC,CAgCnC;AACD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,iBAAiB,CAoBpB"}
|
|
@@ -1,11 +1,21 @@
|
|
|
1
1
|
import { canonicalize } from 'json-canonicalize';
|
|
2
2
|
import { bytesToBase64 } from '../../utils/base64.js';
|
|
3
3
|
import { isRecord, stripTrailingSlashes } from '../../utils/index.js';
|
|
4
|
+
import { assertAnchorableStatusListCredential } from '../../utils/statuslist-bits.js';
|
|
5
|
+
/**
|
|
6
|
+
* Artifact kinds KYA-OS anchors as DID-Linked Resources. The taxonomy — and
|
|
7
|
+
* the JCS-canonicalize → sha256 content addressing in
|
|
8
|
+
* {@link prepareCheqdDlrResource} — is protocol-level rather than
|
|
9
|
+
* cheqd-specific: the day a SECOND anchoring integration lands, both graduate
|
|
10
|
+
* to a central module with deprecated aliases kept here (rule-of-two,
|
|
11
|
+
* recorded now so that PR is mechanical).
|
|
12
|
+
*/
|
|
4
13
|
export const CHEQD_DLR_ARTIFACT_TYPES = [
|
|
5
14
|
'CapabilityManifest',
|
|
6
15
|
'ConformanceManifest',
|
|
7
16
|
'AccessHashManifest',
|
|
8
17
|
'TrustConfigManifest',
|
|
18
|
+
'StatusListCredential',
|
|
9
19
|
];
|
|
10
20
|
const SHA256_HASH_REGEX = /^sha256:[a-f0-9]{64}$/;
|
|
11
21
|
const RESOURCE_ID_REGEX = /^[a-z0-9-]{36}$/;
|
|
@@ -22,6 +32,21 @@ export function validateCheqdDlrArtifact(artifact) {
|
|
|
22
32
|
if (artifact['content'] === undefined) {
|
|
23
33
|
return { valid: false, reason: 'DLR artifact content is required' };
|
|
24
34
|
}
|
|
35
|
+
// A status list's content is the WHOLE SIGNED VC (hash-what-you-publish:
|
|
36
|
+
// the canonical bytes anchored on-chain are exactly the credential a
|
|
37
|
+
// verifier fetches). The shared guard enforces anchor-fitness — signed,
|
|
38
|
+
// bitstring present — method-agnostically.
|
|
39
|
+
if (artifact['type'] === 'StatusListCredential') {
|
|
40
|
+
try {
|
|
41
|
+
assertAnchorableStatusListCredential(artifact['content']);
|
|
42
|
+
}
|
|
43
|
+
catch (error) {
|
|
44
|
+
return {
|
|
45
|
+
valid: false,
|
|
46
|
+
reason: error instanceof Error ? error.message : String(error),
|
|
47
|
+
};
|
|
48
|
+
}
|
|
49
|
+
}
|
|
25
50
|
if (artifact['contentHash'] !== undefined &&
|
|
26
51
|
(typeof artifact['contentHash'] !== 'string' || !SHA256_HASH_REGEX.test(artifact['contentHash']))) {
|
|
27
52
|
return { valid: false, reason: 'DLR artifact contentHash must match sha256:<64 hex chars>' };
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"dlr.js","sourceRoot":"","sources":["../../../src/integrations/cheqd/dlr.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;
|
|
1
|
+
{"version":3,"file":"dlr.js","sourceRoot":"","sources":["../../../src/integrations/cheqd/dlr.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,oCAAoC,EAAE,MAAM,gCAAgC,CAAC;AAGtF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,oBAAoB;IACpB,qBAAqB;IACrB,oBAAoB;IACpB,qBAAqB;IACrB,sBAAsB;CACd,CAAC;AAiCX,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAClD,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAE5C,MAAM,UAAU,wBAAwB,CACtC,QAAiB;IAEjB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,CAAC,+BAA+B,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,OAAO,QAAQ,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7F,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IACzE,CAAC;IAED,IAAI,QAAQ,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IACtE,CAAC;IAED,yEAAyE;IACzE,qEAAqE;IACrE,wEAAwE;IACxE,2CAA2C;IAC3C,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,sBAAsB,EAAE,CAAC;QAChD,IAAI,CAAC;YACH,oCAAoC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC/D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IACE,QAAQ,CAAC,aAAa,CAAC,KAAK,SAAS;QACrC,CAAC,OAAO,QAAQ,CAAC,aAAa,CAAC,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EACjG,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,2DAA2D,EAAE,CAAC;IAC/F,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACpH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8DAA8D,EAAE,CAAC;IAClG,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,KAAc;IAEd,OAAO,OAAO,KAAK,KAAK,QAAQ;QAC7B,wBAA8C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAA0B,EAC1B,cAA8B;IAE9B,MAAM,UAAU,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,IAAI,sBAAsB,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,gBAAgB,GAAG,YAAY,CAAC,QAAQ,CAAC,OAA6C,CAAC,CAAC;IAC9F,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAChE,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,IAAI,MAAM,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEpF,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,kBAAkB,GAAqB;QAC3C,GAAG,QAAQ;QACX,WAAW;KACZ,CAAC;IAEF,OAAO;QACL,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE;YACR,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI;YACpC,IAAI,EAAE,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,IAAI;YAC5C,IAAI,EAAE,aAAa,CAAC,YAAY,CAAC;YACjC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;YAC/F,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D;QACD,WAAW;QACX,gBAAgB;KACjB,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,sBAAsB,CAAC,OAMtC;IACC,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,WAAW,IAAI,4BAA4B,CAAC,CAAC;IACvF,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACvD,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU;QAC5B,CAAC,CAAC,GAAG,eAAe,IAAI,OAAO,CAAC,GAAG,cAAc,OAAO,CAAC,UAAU,EAAE;QACrE,CAAC,CAAC,GAAG,eAAe,IAAI,OAAO,CAAC,GAAG,iBAAiB,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,iBAAiB,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;IAE1J,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,GAAG;KACJ,CAAC;AACJ,CAAC"}
|
|
@@ -2,4 +2,5 @@ export { DidCheqdResolver, cheqdResolver, createDidCheqdResolver, didCheqdToReso
|
|
|
2
2
|
export { CheqdDidRegistrarClient, createLocalEd25519CheqdRegistrarSigner, type CheqdCreateResourceBody, type CheqdRegistrarClientOptions, type CheqdRegistrarOperation, type CheqdRegistrarResult, type CheqdRegistrarSigner, type CheqdRegistrarSigningRequest, type CheqdRegistrarSigningResponse, type CreateCheqdDidOptions, type CreateCheqdResourceOptions, type LocalCheqdRegistrarSignerOptions, type UpdateCheqdDidOptions, } from './registrar.js';
|
|
3
3
|
export { updateCheqdAlsoKnownAs, type UpdateCheqdAlsoKnownAsOptions, type UpdateCheqdAlsoKnownAsResult, } from './linkage.js';
|
|
4
4
|
export { CHEQD_DLR_ARTIFACT_TYPES, buildCheqdDlrReference, isSupportedCheqdDlrArtifactType, prepareCheqdDlrResource, validateCheqdDlrArtifact, type CheqdDlrArtifact, type CheqdDlrArtifactType, type CheqdDlrReference, type PreparedCheqdDlrResource, } from './dlr.js';
|
|
5
|
+
export { CheqdStatusListResolver, createCheqdStatusListResolver, type CheqdStatusListResolverOptions, } from './statuslist-resolver.js';
|
|
5
6
|
//# sourceMappingURL=index.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/integrations/cheqd/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,sBAAsB,EACtB,qBAAqB,EACrB,UAAU,EACV,aAAa,EACb,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,uBAAuB,EACvB,sCAAsC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,EAClC,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,gCAAgC,EACrC,KAAK,qBAAqB,GAC3B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,EAClC,KAAK,4BAA4B,GAClC,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,GAC9B,MAAM,UAAU,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/integrations/cheqd/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,sBAAsB,EACtB,qBAAqB,EACrB,UAAU,EACV,aAAa,EACb,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,uBAAuB,EACvB,sCAAsC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,EAClC,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,gCAAgC,EACrC,KAAK,qBAAqB,GAC3B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,EAClC,KAAK,4BAA4B,GAClC,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,GAC9B,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,KAAK,8BAA8B,GACpC,MAAM,0BAA0B,CAAC"}
|
|
@@ -2,4 +2,5 @@ export { DidCheqdResolver, cheqdResolver, createDidCheqdResolver, didCheqdToReso
|
|
|
2
2
|
export { CheqdDidRegistrarClient, createLocalEd25519CheqdRegistrarSigner, } from './registrar.js';
|
|
3
3
|
export { updateCheqdAlsoKnownAs, } from './linkage.js';
|
|
4
4
|
export { CHEQD_DLR_ARTIFACT_TYPES, buildCheqdDlrReference, isSupportedCheqdDlrArtifactType, prepareCheqdDlrResource, validateCheqdDlrArtifact, } from './dlr.js';
|
|
5
|
+
export { CheqdStatusListResolver, createCheqdStatusListResolver, } from './statuslist-resolver.js';
|
|
5
6
|
//# sourceMappingURL=index.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/integrations/cheqd/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,sBAAsB,EACtB,qBAAqB,EACrB,UAAU,EACV,aAAa,GAId,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,uBAAuB,EACvB,sCAAsC,GAYvC,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,sBAAsB,GAGvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,wBAAwB,GAKzB,MAAM,UAAU,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/integrations/cheqd/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,sBAAsB,EACtB,qBAAqB,EACrB,UAAU,EACV,aAAa,GAId,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,uBAAuB,EACvB,sCAAsC,GAYvC,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,sBAAsB,GAGvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,wBAAwB,GAKzB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,uBAAuB,EACvB,6BAA6B,GAE9B,MAAM,0BAA0B,CAAC"}
|
|
@@ -0,0 +1,74 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* CheqdStatusListResolver — StatusList2021 revocation checks against a cheqd
|
|
3
|
+
* DID-Linked Resource (the on-chain status list the DEF CON 34 "REVOKED" demo
|
|
4
|
+
* ran, upstreamed as a thin consumer of the shared primitives).
|
|
5
|
+
*
|
|
6
|
+
* Implements the delegation `StatusListResolver` seam: `checkStatus` returns
|
|
7
|
+
* TRUE when the credential's bit is set (revoked) and THROWS on anything
|
|
8
|
+
* unprovable — `DelegationCredentialVerifier` then denies fail-closed
|
|
9
|
+
* (`status_unresolvable`). Unlike the package's other status-list readers,
|
|
10
|
+
* this one also verifies the LIST itself: issuer pinned to
|
|
11
|
+
* `expectedIssuerDid`, and the Ed25519Signature2020 proof checked against the
|
|
12
|
+
* issuer's (on-chain) DID document. The chain provides availability and
|
|
13
|
+
* append-only history; the cryptographic root stays the issuer's signature —
|
|
14
|
+
* "the resolver returned it" is never sufficient on its own.
|
|
15
|
+
*
|
|
16
|
+
* Fail-closed matrix (all throw → verifier denies as `status_unresolvable`):
|
|
17
|
+
* non-https URL, malformed index, network error / non-200, malformed VC,
|
|
18
|
+
* unsigned VC, wrong issuer, purpose mismatch, missing proofValue,
|
|
19
|
+
* unresolvable issuer DID, no usable verification method, bad signature,
|
|
20
|
+
* out-of-range index.
|
|
21
|
+
*
|
|
22
|
+
* Freshness: an internal {@link TtlCache} holds the VERIFIED document
|
|
23
|
+
* (default 10 s — one fetch amortizes across every credential on a list;
|
|
24
|
+
* `cacheTtlMs: 0` disables). Compose `withStatusCache` on top for a
|
|
25
|
+
* declared per-bit staleness SLA. `invalidateCache()` drops the document and
|
|
26
|
+
* defeats upstream HTTP caches on the next fetch.
|
|
27
|
+
*/
|
|
28
|
+
import type { FetchProvider, CryptoProvider } from '../../providers/base.js';
|
|
29
|
+
import type { DIDResolver, StatusListResolver } from '../../delegation/vc-verifier.types.js';
|
|
30
|
+
import type { DecompressionFunction } from '../../delegation/bitstring.js';
|
|
31
|
+
import type { CredentialStatus } from '../../types/protocol.js';
|
|
32
|
+
export interface CheqdStatusListResolverOptions {
|
|
33
|
+
/**
|
|
34
|
+
* Transport for fetching the status-list resource. The resolver enforces
|
|
35
|
+
* `https://` on the URL; SSRF guarding beyond the scheme (private-range
|
|
36
|
+
* blocking, redirects) is the injected provider's duty —
|
|
37
|
+
* `RuntimeFetchProvider` provides it.
|
|
38
|
+
*/
|
|
39
|
+
fetchProvider: FetchProvider;
|
|
40
|
+
/** Resolves the status list ISSUER's DID document (did:cheqd, on-chain). */
|
|
41
|
+
didResolver: DIDResolver;
|
|
42
|
+
/** Verifies the list's Ed25519 signature (raw bytes + base64 public key). */
|
|
43
|
+
cryptoProvider: CryptoProvider;
|
|
44
|
+
/** Only status lists issued (and signed) by this DID are trusted. */
|
|
45
|
+
expectedIssuerDid: string;
|
|
46
|
+
/** Inflates the gzip `encodedList` (same seam as `BitstringManager`). */
|
|
47
|
+
decompressor: DecompressionFunction;
|
|
48
|
+
/** In-memory TTL for the fetched VERIFIED list; 0 disables. Default 10s. */
|
|
49
|
+
cacheTtlMs?: number;
|
|
50
|
+
}
|
|
51
|
+
export declare class CheqdStatusListResolver implements StatusListResolver {
|
|
52
|
+
private readonly opts;
|
|
53
|
+
private readonly cacheTtlMs;
|
|
54
|
+
private cache;
|
|
55
|
+
private bustNextFetch;
|
|
56
|
+
constructor(options: CheqdStatusListResolverOptions);
|
|
57
|
+
/** Drop the cached list and defeat upstream HTTP caches on the next fetch. */
|
|
58
|
+
invalidateCache(): void;
|
|
59
|
+
/** TRUE = revoked. Throws on anything unprovable — the verifier fails closed. */
|
|
60
|
+
checkStatus(status: CredentialStatus): Promise<boolean>;
|
|
61
|
+
private fetchAndVerifyList;
|
|
62
|
+
private assertShape;
|
|
63
|
+
private assertIssuer;
|
|
64
|
+
/**
|
|
65
|
+
* Verify the Ed25519Signature2020 proof over the JCS-canonicalized VC
|
|
66
|
+
* (minus `proof`) against the issuer's on-chain DID document. Key material
|
|
67
|
+
* arrives however the DID method publishes it — `verificationMethodJwk`
|
|
68
|
+
* accepts `publicKeyJwk`, `publicKeyMultibase` (cheqd's format), or legacy
|
|
69
|
+
* `publicKeyBase58`.
|
|
70
|
+
*/
|
|
71
|
+
private assertSignature;
|
|
72
|
+
}
|
|
73
|
+
export declare function createCheqdStatusListResolver(options: CheqdStatusListResolverOptions): CheqdStatusListResolver;
|
|
74
|
+
//# sourceMappingURL=statuslist-resolver.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"statuslist-resolver.d.ts","sourceRoot":"","sources":["../../../src/integrations/cheqd/statuslist-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EACnB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,KAAK,EACV,gBAAgB,EAEjB,MAAM,yBAAyB,CAAC;AAYjC,MAAM,WAAW,8BAA8B;IAC7C;;;;;OAKG;IACH,aAAa,EAAE,aAAa,CAAC;IAC7B,4EAA4E;IAC5E,WAAW,EAAE,WAAW,CAAC;IACzB,6EAA6E;IAC7E,cAAc,EAAE,cAAc,CAAC;IAC/B,qEAAqE;IACrE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,YAAY,EAAE,qBAAqB,CAAC;IACpC,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,uBAAwB,YAAW,kBAAkB;IAChE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiC;IACtD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,aAAa,CAAS;gBAElB,OAAO,EAAE,8BAA8B;IAWnD,8EAA8E;IAC9E,eAAe,IAAI,IAAI;IAKvB,iFAAiF;IAC3E,WAAW,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;YAwB/C,kBAAkB;IAiChC,OAAO,CAAC,WAAW;IAoBnB,OAAO,CAAC,YAAY;IASpB;;;;;;OAMG;YACW,eAAe;CA2C9B;AAED,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,8BAA8B,GACtC,uBAAuB,CAEzB"}
|
|
@@ -0,0 +1,138 @@
|
|
|
1
|
+
import { verificationMethodJwk } from '../../delegation/verification-method-key.js';
|
|
2
|
+
import { canonicalizeJSON } from '../../delegation/utils.js';
|
|
3
|
+
import { decodeStatusListPayload, parseStatusListIndex, readStatusBit, } from '../../utils/statuslist-bits.js';
|
|
4
|
+
import { assertStatusPurpose } from '../../utils/statuslist-purpose.js';
|
|
5
|
+
import { base64urlDecodeToBytes, bytesToBase64 } from '../../utils/base64.js';
|
|
6
|
+
import { TtlCache } from '../../utils/ttl-cache.js';
|
|
7
|
+
export class CheqdStatusListResolver {
|
|
8
|
+
opts;
|
|
9
|
+
cacheTtlMs;
|
|
10
|
+
cache;
|
|
11
|
+
bustNextFetch = false;
|
|
12
|
+
constructor(options) {
|
|
13
|
+
this.opts = options;
|
|
14
|
+
this.cacheTtlMs = options.cacheTtlMs ?? 10_000;
|
|
15
|
+
// A single issuer realistically publishes a handful of lists; 16 entries
|
|
16
|
+
// is generous without being unbounded.
|
|
17
|
+
this.cache = new TtlCache({
|
|
18
|
+
ttlMs: this.cacheTtlMs,
|
|
19
|
+
maxEntries: 16,
|
|
20
|
+
});
|
|
21
|
+
}
|
|
22
|
+
/** Drop the cached list and defeat upstream HTTP caches on the next fetch. */
|
|
23
|
+
invalidateCache() {
|
|
24
|
+
this.cache.clear();
|
|
25
|
+
this.bustNextFetch = true;
|
|
26
|
+
}
|
|
27
|
+
/** TRUE = revoked. Throws on anything unprovable — the verifier fails closed. */
|
|
28
|
+
async checkStatus(status) {
|
|
29
|
+
const url = status.statusListCredential;
|
|
30
|
+
if (typeof url !== 'string' || !/^https:\/\//.test(url)) {
|
|
31
|
+
throw new Error('credentialStatus.statusListCredential must be an https URL');
|
|
32
|
+
}
|
|
33
|
+
const index = parseStatusListIndex(status.statusListIndex);
|
|
34
|
+
const credential = await this.fetchAndVerifyList(url);
|
|
35
|
+
// Purpose parity, fail-closed (shared validator): a clear bit on the WRONG
|
|
36
|
+
// KIND of list would report "not revoked" from a list that never tracked
|
|
37
|
+
// revocation.
|
|
38
|
+
assertStatusPurpose(credential.credentialSubject.statusPurpose, status.statusPurpose);
|
|
39
|
+
const bits = await decodeStatusListPayload(credential.credentialSubject.encodedList, (bytes) => this.opts.decompressor.decompress(bytes));
|
|
40
|
+
return readStatusBit(bits, index);
|
|
41
|
+
}
|
|
42
|
+
async fetchAndVerifyList(url) {
|
|
43
|
+
const cached = this.cache.get(url);
|
|
44
|
+
if (cached) {
|
|
45
|
+
return cached;
|
|
46
|
+
}
|
|
47
|
+
// NEVER append query params here: the cheqd resolver parses the query as
|
|
48
|
+
// DID URL dereferencing input and 400s (invalidDidUrl) on unknown params
|
|
49
|
+
// (verified live). The endpoint is served cf-cache-status DYNAMIC, so
|
|
50
|
+
// post-revocation freshness only needs a no-cache header.
|
|
51
|
+
const response = await this.opts.fetchProvider.fetch(url, {
|
|
52
|
+
method: 'GET',
|
|
53
|
+
headers: {
|
|
54
|
+
Accept: 'application/json',
|
|
55
|
+
...(this.bustNextFetch
|
|
56
|
+
? { 'Cache-Control': 'no-cache', Pragma: 'no-cache' }
|
|
57
|
+
: {}),
|
|
58
|
+
},
|
|
59
|
+
});
|
|
60
|
+
if (!response.ok) {
|
|
61
|
+
throw new Error(`Status list fetch failed: HTTP ${response.status} for ${url}`);
|
|
62
|
+
}
|
|
63
|
+
const body = (await response.json());
|
|
64
|
+
this.assertShape(body);
|
|
65
|
+
this.assertIssuer(body);
|
|
66
|
+
await this.assertSignature(body);
|
|
67
|
+
this.bustNextFetch = false;
|
|
68
|
+
this.cache.set(url, body);
|
|
69
|
+
return body;
|
|
70
|
+
}
|
|
71
|
+
assertShape(vc) {
|
|
72
|
+
const types = Array.isArray(vc?.type) ? vc.type : [];
|
|
73
|
+
if (!types.includes('StatusList2021Credential')) {
|
|
74
|
+
throw new Error('Fetched resource is not a StatusList2021Credential');
|
|
75
|
+
}
|
|
76
|
+
const subject = vc.credentialSubject;
|
|
77
|
+
if (subject?.type !== 'StatusList2021' ||
|
|
78
|
+
typeof subject.encodedList !== 'string' ||
|
|
79
|
+
subject.encodedList.length === 0) {
|
|
80
|
+
throw new Error('Status list credentialSubject is malformed (missing StatusList2021 encodedList)');
|
|
81
|
+
}
|
|
82
|
+
if (!vc.proof || typeof vc.proof !== 'object') {
|
|
83
|
+
throw new Error('Status list credential is unsigned');
|
|
84
|
+
}
|
|
85
|
+
}
|
|
86
|
+
assertIssuer(vc) {
|
|
87
|
+
const issuer = typeof vc.issuer === 'string' ? vc.issuer : vc.issuer?.id;
|
|
88
|
+
if (issuer !== this.opts.expectedIssuerDid) {
|
|
89
|
+
throw new Error(`Status list issuer "${issuer}" is not the expected issuer "${this.opts.expectedIssuerDid}"`);
|
|
90
|
+
}
|
|
91
|
+
}
|
|
92
|
+
/**
|
|
93
|
+
* Verify the Ed25519Signature2020 proof over the JCS-canonicalized VC
|
|
94
|
+
* (minus `proof`) against the issuer's on-chain DID document. Key material
|
|
95
|
+
* arrives however the DID method publishes it — `verificationMethodJwk`
|
|
96
|
+
* accepts `publicKeyJwk`, `publicKeyMultibase` (cheqd's format), or legacy
|
|
97
|
+
* `publicKeyBase58`.
|
|
98
|
+
*/
|
|
99
|
+
async assertSignature(vc) {
|
|
100
|
+
const proof = vc.proof;
|
|
101
|
+
const proofValue = proof['proofValue'];
|
|
102
|
+
if (typeof proofValue !== 'string' || proofValue.length === 0) {
|
|
103
|
+
throw new Error('Status list proof is missing proofValue');
|
|
104
|
+
}
|
|
105
|
+
const unsigned = { ...vc };
|
|
106
|
+
delete unsigned['proof'];
|
|
107
|
+
const data = new TextEncoder().encode(canonicalizeJSON(unsigned));
|
|
108
|
+
const signature = base64urlDecodeToBytes(proofValue);
|
|
109
|
+
const didDoc = await this.opts.didResolver.resolve(this.opts.expectedIssuerDid);
|
|
110
|
+
if (!didDoc) {
|
|
111
|
+
throw new Error(`Could not resolve issuer DID ${this.opts.expectedIssuerDid}`);
|
|
112
|
+
}
|
|
113
|
+
const verificationMethodId = typeof proof['verificationMethod'] === 'string'
|
|
114
|
+
? proof['verificationMethod']
|
|
115
|
+
: undefined;
|
|
116
|
+
const methods = didDoc.verificationMethod ?? [];
|
|
117
|
+
const candidates = verificationMethodId
|
|
118
|
+
? methods.filter((m) => m.id === verificationMethodId)
|
|
119
|
+
: methods;
|
|
120
|
+
if (candidates.length === 0) {
|
|
121
|
+
throw new Error(`Issuer DID document has no verification method matching "${verificationMethodId ?? '(any)'}"`);
|
|
122
|
+
}
|
|
123
|
+
for (const method of candidates) {
|
|
124
|
+
const jwk = verificationMethodJwk(method);
|
|
125
|
+
if (!jwk)
|
|
126
|
+
continue;
|
|
127
|
+
const publicKeyBase64 = bytesToBase64(base64urlDecodeToBytes(jwk.x));
|
|
128
|
+
if (await this.opts.cryptoProvider.verify(data, signature, publicKeyBase64)) {
|
|
129
|
+
return;
|
|
130
|
+
}
|
|
131
|
+
}
|
|
132
|
+
throw new Error('Status list signature verification FAILED against the issuer DID document');
|
|
133
|
+
}
|
|
134
|
+
}
|
|
135
|
+
export function createCheqdStatusListResolver(options) {
|
|
136
|
+
return new CheqdStatusListResolver(options);
|
|
137
|
+
}
|
|
138
|
+
//# sourceMappingURL=statuslist-resolver.js.map
|