@learncard/vc-plugin 1.5.12 → 1.6.0

package/dist/index.d.cts

@@ -1,3 +1,4 @@
 export { getVCPlugin } from './vc';
+export { refreshCredential } from './refreshCredential';
 export * from './types';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts

@@ -1,3 +1,4 @@
 export { getVCPlugin } from './vc';
+export { refreshCredential } from './refreshCredential';
 export * from './types';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AACnC,cAAc,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,cAAc,SAAS,CAAC"}

package/dist/refreshCredential.d.ts

@@ -0,0 +1,13 @@
+import { CredentialRefreshResult, VC } from '@learncard/types';
+import { RefreshCredentialOptions, VCDependentLearnCard, VCImplicitLearnCard } from './types';
+/** Rejects loopback, private, link-local, multicast, reserved, and cloud-metadata IPv4 ranges */
+export declare const isPrivateOrReservedIPv4: (ip: string) => boolean;
+/** Rejects loopback, private/transition, link-local, multicast, documentation, and mapped-private IPv6 */
+export declare const isPrivateOrReservedIPv6: (raw: string) => boolean;
+/**
+ * Holder-side refresh primitive. See the module docblock for the safety contract.
+ *
+ * Never includes the current credential or its claims in request headers or logs.
+ */
+export declare const refreshCredential: (_initLearnCard: VCDependentLearnCard) => (_learnCard: VCImplicitLearnCard, credential: VC, options?: RefreshCredentialOptions) => Promise<CredentialRefreshResult>;
+//# sourceMappingURL=refreshCredential.d.ts.map

package/dist/refreshCredential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refreshCredential.d.ts","sourceRoot":"","sources":["../src/refreshCredential.ts"],"names":[],"mappings":"AAAA,OAAO,EAGH,uBAAuB,EAGvB,EAAE,EAGL,MAAM,kBAAkB,CAAC;AAS1B,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AA6F9F,iGAAiG;AACjG,eAAO,MAAM,uBAAuB,GAAI,IAAI,MAAM,KAAG,OAqBpD,CAAC;AA8DF,0GAA0G;AAC1G,eAAO,MAAM,uBAAuB,GAAI,KAAK,MAAM,KAAG,OA0BrD,CAAC;AAmeF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,gBAAgB,oBAAoB,MAW9D,YAAY,mBAAmB,EAC/B,YAAY,EAAE,EACd,UAAS,wBAA6B,KACvC,OAAO,CAAC,uBAAuB,CA8MrC,CAAC"}

package/dist/refreshCredential.fetch.d.ts

@@ -0,0 +1,13 @@
+export type PinnedAddress = {
+    address: string;
+    family: 4 | 6;
+};
+/**
+ * Fetches through an already-validated IP address in Node without changing the URL
+ * hostname. Keeping the original URL lets Node perform SNI and certificate hostname
+ * verification against the refresh endpoint while the custom lookup prevents a
+ * second, potentially rebound DNS answer from selecting the socket destination.
+ * Browsers do not expose connection-level DNS controls and therefore use native fetch.
+ */
+export declare const fetchWithPinnedAddress: (url: URL, init: RequestInit, pinnedAddress?: PinnedAddress) => Promise<Response>;
+//# sourceMappingURL=refreshCredential.fetch.d.ts.map

package/dist/refreshCredential.fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refreshCredential.fetch.d.ts","sourceRoot":"","sources":["../src/refreshCredential.fetch.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAA;CAAE,CAAC;AA0C/D;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,GAC/B,KAAK,GAAG,EACR,MAAM,WAAW,EACjB,gBAAgB,aAAa,KAC9B,OAAO,CAAC,QAAQ,CAyGlB,CAAC"}

package/dist/refreshCredential.fetch.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=refreshCredential.fetch.test.d.ts.map

package/dist/refreshCredential.fetch.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refreshCredential.fetch.test.d.ts","sourceRoot":"","sources":["../src/refreshCredential.fetch.test.ts"],"names":[],"mappings":""}

package/dist/refreshCredential.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=refreshCredential.test.d.ts.map

package/dist/refreshCredential.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refreshCredential.test.d.ts","sourceRoot":"","sources":["../src/refreshCredential.test.ts"],"names":[],"mappings":""}

package/dist/types.d.ts

@@ -1,4 +1,4 @@
-import { UnsignedVC, VC, UnsignedVP, VP, VerificationCheck, DidDocument, JWKWithPrivateKey } from '@learncard/types';
+import { UnsignedVC, VC, UnsignedVP, VP, VerificationCheck, DidDocument, JWKWithPrivateKey, CredentialRefreshResult } from '@learncard/types';
 import { Plugin, LearnCard } from '@learncard/core';
 import { ProofOptions, InputMetadata } from '@learncard/didkit-plugin';
 /** @group VC Plugin */
@@ -20,6 +20,37 @@ export type VCPluginMethods = {
     getTestVc: (subject?: string) => UnsignedVC;
     getTestVp: (credential?: VC) => Promise<UnsignedVP>;
     getDidAuthVp: (options?: ProofOptions) => Promise<VP | string>;
+    refreshCredential: (credential: VC, options?: RefreshCredentialOptions) => Promise<CredentialRefreshResult>;
+};
+/**
+ * Options for the generic holder-side credential refresh primitive.
+ *
+ * @group VC Plugin
+ */
+export type RefreshCredentialOptions = {
+    /** Previously seen ETag validator for the credential; sent as `If-None-Match` */
+    etag?: string;
+    /** Per-request timeout in milliseconds (default 10_000) */
+    timeoutMs?: number;
+    /** Maximum number of followed redirects (default 3) */
+    maxRedirects?: number;
+    /** Maximum accepted response size in bytes (default 1 MiB) */
+    maxResponseBytes?: number;
+    /**
+     * Explicit local-development opt-in allowing plain-HTTP endpoints. HTTPS is required
+     * unless this is set.
+     */
+    allowInsecureHttp?: boolean;
+    /**
+     * Explicit local-development opt-in allowing private, loopback, or link-local
+     * endpoint addresses. Never enable this for credentials from untrusted issuers.
+     */
+    allowPrivateAddresses?: boolean;
+    /**
+     * Hostname resolution override used for SSRF checks. Defaults to Node's DNS resolver
+     * in Node runtimes; browsers skip DNS resolution and reject only unsafe host literals.
+     */
+    resolveHost?: (hostname: string) => Promise<string[]>;
 };
 /** @group VC Plugin */
 export type VCDependentLearnCard = LearnCard<any, any, VCPluginDependentMethods>;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,UAAU,EACV,EAAE,EACF,UAAU,EACV,EAAE,EACF,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEvE,uBAAuB;AACvB,MAAM,MAAM,wBAAwB,GAAG;IACnC,uBAAuB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACvF,uBAAuB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,eAAe,EAAE,CACb,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,iBAAiB,KACzB,OAAO,CAAC,EAAE,CAAC,CAAC;IACjB,gBAAgB,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACzF,iBAAiB,EAAE,CACf,YAAY,EAAE,UAAU,EACxB,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,iBAAiB,KACzB,OAAO,CAAC,EAAE,CAAC,CAAC;IACjB,kBAAkB,EAAE,CAChB,YAAY,EAAE,EAAE,GAAG,MAAM,EACzB,OAAO,CAAC,EAAE,YAAY,KACrB,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAChC,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CACpF,CAAC;AAEF,uBAAuB;AACvB,MAAM,MAAM,eAAe,GAAG;IAC1B,eAAe,EAAE,CACb,UAAU,EAAE,UAAU,EACtB,cAAc,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,KACrC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjB,gBAAgB,EAAE,CACd,UAAU,EAAE,EAAE,EACd,OAAO,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,KAC9B,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAChC,iBAAiB,EAAE,CACf,UAAU,EAAE,UAAU,EACtB,cAAc,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,KACrC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjB,kBAAkB,EAAE,CAChB,YAAY,EAAE,EAAE,GAAG,MAAM,EACzB,OAAO,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,KAC9B,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAChC,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,KAAK,UAAU,CAAC;IAC5C,SAAS,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACpD,YAAY,EAAE,CAAC,OAAO,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;CAClE,CAAC;AAEF,uBAAuB;AACvB,MAAM,MAAM,oBAAoB,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;AAEjF,uBAAuB;AACvB,MAAM,MAAM,mBAAmB,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,eAAe,GAAG,wBAAwB,CAAC,CAAC;AAEnG,uBAAuB;AACvB,MAAM,MAAM,eAAe,GAAG;IAC1B,gBAAgB,EAAE,CACd,UAAU,EAAE,EAAE,EACd,OAAO,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,KAC9B,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACnC,CAAC;AAEF,uBAAuB;AACvB,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,wBAAwB,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,UAAU,EACV,EAAE,EACF,UAAU,EACV,EAAE,EACF,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,uBAAuB,EAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEvE,uBAAuB;AACvB,MAAM,MAAM,wBAAwB,GAAG;IACnC,uBAAuB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACvF,uBAAuB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,eAAe,EAAE,CACb,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,iBAAiB,KACzB,OAAO,CAAC,EAAE,CAAC,CAAC;IACjB,gBAAgB,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACzF,iBAAiB,EAAE,CACf,YAAY,EAAE,UAAU,EACxB,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,iBAAiB,KACzB,OAAO,CAAC,EAAE,CAAC,CAAC;IACjB,kBAAkB,EAAE,CAChB,YAAY,EAAE,EAAE,GAAG,MAAM,EACzB,OAAO,CAAC,EAAE,YAAY,KACrB,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAChC,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CACpF,CAAC;AAEF,uBAAuB;AACvB,MAAM,MAAM,eAAe,GAAG;IAC1B,eAAe,EAAE,CACb,UAAU,EAAE,UAAU,EACtB,cAAc,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,KACrC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjB,gBAAgB,EAAE,CACd,UAAU,EAAE,EAAE,EACd,OAAO,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,KAC9B,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAChC,iBAAiB,EAAE,CACf,UAAU,EAAE,UAAU,EACtB,cAAc,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,KACrC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjB,kBAAkB,EAAE,CAChB,YAAY,EAAE,EAAE,GAAG,MAAM,EACzB,OAAO,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,KAC9B,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAChC,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,KAAK,UAAU,CAAC;IAC5C,SAAS,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACpD,YAAY,EAAE,CAAC,OAAO,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;IAC/D,iBAAiB,EAAE,CACf,UAAU,EAAE,EAAE,EACd,OAAO,CAAC,EAAE,wBAAwB,KACjC,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACzC,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACnC,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;OAGG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACzD,CAAC;AAEF,uBAAuB;AACvB,MAAM,MAAM,oBAAoB,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;AAEjF,uBAAuB;AACvB,MAAM,MAAM,mBAAmB,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,eAAe,GAAG,wBAAwB,CAAC,CAAC;AAEnG,uBAAuB;AACvB,MAAM,MAAM,eAAe,GAAG;IAC1B,gBAAgB,EAAE,CACd,UAAU,EAAE,EAAE,EACd,OAAO,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,KAC9B,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACnC,CAAC;AAEF,uBAAuB;AACvB,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,wBAAwB,CAAC,CAAC"}