@metalabel/dfos-client 0.29.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Metalabel
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,88 @@
+# @metalabel/dfos-client
+
+The high-level read client for the [DFOS protocol](https://protocol.dfos.com). The protocol library owns the crypto truth (CID re-derivation, signature verification, chain folding); this client owns the four things it deliberately refuses to do: **fetch, resolve, verify-orchestration, and cache** — over an untrusted set of relays. It holds no keys and never writes.
+
+If verification logic appears in this package, that is the bug: every proof comes from `@metalabel/dfos-protocol`.
+
+## Install
+
+> **Not yet published — pre-release.** This package is `private` until it ships with a stamped release; until then it is consumable only inside this workspace.
+
+```bash
+npm install @metalabel/dfos-client @metalabel/dfos-protocol @metalabel/dfos-web-relay
+```
+
+`@metalabel/dfos-protocol` and `@metalabel/dfos-web-relay` are peer dependencies — one source of truth for the crypto kernel and the relay transport, no double-ship. The client imports only the relay package's lightweight `./peer-client` subpath (fetch + paging + route constants), never the relay server graph.
+
+## The surface
+
+```typescript
+import { createClient } from '@metalabel/dfos-client';
+
+const client = createClient({ relays: ['https://relay.example'] });
+
+// The product: bound protocol-lib callbacks — spread straight into any verifier.
+const { resolveKey, resolveIdentity, isRevoked } = client.callbacks();
+
+// Display verbs → Resolved<T>. Trust is DATA, not exceptions.
+const id = await client.identity('did:dfos:…');
+const content = await client.content('…'); // contentId
+const cred = await client.credential('<jws>');
+const doc = await client.document('…'); // contentId → current document blob
+
+// Paste-a-string dispatcher (did / contentId / credential JWS).
+const anything = await client.resolve(userInput);
+
+// No-throw "is this legit" one-liner.
+const verdict = await client.verify('<jws>'); // VerifyResult<unknown>
+```
+
+Every resolution returns a `Resolved<T>`:
+
+```typescript
+interface Resolved<T> {
+  value: T; // the protocol lib's proven type, untouched
+  trust: { ok: boolean; unverifiable?: ('revocation' | 'tip')[] };
+  provenance: { answeredBy; responses; agreed; fromCache };
+}
+```
+
+Trust degrades honestly: `revocation` when non-revocation cannot be proven, `tip` whenever an answer's freshness rests on the cache — either the cache alone (relays unreachable) or a fully drained relay log that exactly matches the cached log. **Tip freshness is never proven in v1**: a relay's complete answer can verify the known history but cannot prove that no newer operation exists, so the client refuses to launder that claim into proof (relay head-proofs / `tipProven` are v2). Nothing is ever claimed as proven that was not.
+
+### Quorum
+
+```typescript
+createClient({ relays: [...], quorum: 2 }); // require 2 relays to return the same log (by digest)
+```
+
+`quorum: 1` (default) is first-wins with failover. `provenance.agreed` reports whether the threshold was met.
+
+### The free floor
+
+```typescript
+import { resolvers } from '@metalabel/dfos-client';
+
+const { resolveKey } = resolvers(['https://relay.example']); // zero object graph, one-off verify
+```
+
+## Subpaths
+
+### `@metalabel/dfos-client/store`
+
+```typescript
+import { indexedDbStore, memoryStore } from '@metalabel/dfos-client/store';
+```
+
+`memoryStore()` (the isomorphic default) caches the **log**. Chain reads fully drain from zero, require the fetched JWS tokens to match the trusted cached prefix, and verify forward only the suffix, so a key rotation costs one verification op and the cache is never stale-wrong. `indexedDbStore()` is the browser-only durable adapter — the only heavy dependency, quarantined behind this subpath.
+
+### `@metalabel/dfos-client/siwd`
+
+```typescript
+import { createSiwdChallenge, siwdSigningInput, verifySiwd } from '@metalabel/dfos-client/siwd';
+```
+
+Sign In With DFOS. `siwdSigningInput(challenge)` is the pure byte contract both the signer and the verifier share (see [SIWD.md](../../specs/SIWD.md)); `verifySiwd` is a no-throw verifier that accepts only a current `authKeys` entry of a non-deleted identity.
+
+## License
+
+MIT

package/dist/chunk-63XCFYOE.js

@@ -0,0 +1,16 @@
+// src/store/memory.ts
+var memoryStore = () => {
+  const map = /* @__PURE__ */ new Map();
+  return {
+    async get(key) {
+      return map.get(key);
+    },
+    async set(key, value) {
+      map.set(key, value);
+    }
+  };
+};
+
+export {
+  memoryStore
+};

package/dist/index.d.ts

@@ -0,0 +1,32 @@
+import { C as ClientConfig, a as Client, b as Callbacks, R as RevChecker } from './types-ByxTj1u-.js';
+export { c as CallOptions, D as DocumentBlob, G as GlobalLogOptions, d as GlobalLogPage, e as GlobalLogResult, I as IndexCapabilities, f as IndexContentPage, g as IndexContentRow, h as IndexCountersignatureRow, i as IndexCountersignaturesPage, j as IndexCredentialRow, k as IndexCredentialsPage, l as IndexIdentitiesPage, m as IndexIdentityProfile, n as IndexIdentityRow, o as IndexOrder, p as IndexRecencyOrder, L as LogOp, P as Provenance, q as RelayHealth, r as RelayResponse, s as Resolution, t as Resolved, u as ResolvedContent, v as ResolvedCredential, S as Store, T as Trust, U as UnverifiableAxis, V as VerifyResult } from './types-ByxTj1u-.js';
+export { m as memoryStore } from './memory-CL1DM6Ud.js';
+import '@metalabel/dfos-protocol/chain';
+import '@metalabel/dfos-protocol/credentials';
+import '@metalabel/dfos-web-relay/peer-client';
+
+declare const createClient: (config: ClientConfig) => Client;
+/**
+ * The true minimalist floor: the bound protocol-lib callbacks over a relay set,
+ * with no client object, no cache tuning, no verbs. For a one-off verify.
+ */
+declare const resolvers: (relays: string[]) => Callbacks;
+
+/**
+ * Build the default revocation checker over an ordered relay set.
+ *
+ * Returns true only for a revocation JWS that VERIFIES via the protocol
+ * (`verifyRevocation`: signature, CID integrity, issuer-only rule) and whose
+ * payload binds exactly the queried (issuerDID, credentialCID). Anything less —
+ * unreachable relay, negative answer, forged or mismatched proof — moves on to
+ * the next relay; false only after the full set has been consulted.
+ *
+ * When the caller supplies `asOfUnix` (the protocol does, on every cold fold, with
+ * each operation's own `createdAt`), a verified revocation only counts if its own
+ * signed `createdAt` is at or before that instant. This is what heals cold
+ * verification of history: without it, revoking a credential today would make
+ * every already-committed operation it ever authorized fail to verify tomorrow.
+ */
+declare const createRevocationChecker: (relays: string[], fetchImpl: typeof fetch, resolveKey: (kid: string) => Promise<Uint8Array>) => RevChecker;
+
+export { Callbacks, Client, ClientConfig, RevChecker, createClient, createRevocationChecker, resolvers };