@metalabel/dfos-client 0.52.0 → 0.53.0

package/dist/api-auth.d.ts

@@ -1,5 +1,5 @@
 export { ApiRequestVerifyError, DEFAULT_PROOF_SKEW_SECONDS, DEFAULT_PROOF_WINDOW_SECONDS, DFOS_AUTH_SCHEME, EMPTY_BODY_SHA256, IDENTITY_PROOF_JWS_TYP, IdentityProofPayload, MAX_BODY_BYTES, MAX_PROOF_FRESHNESS_SPAN_SECONDS, MAX_REQUEST_PROOF_SIZE, ProofExtraMembers, REQUEST_PROOF_JWS_TYP, RequestProofFailurePhase, RequestProofFailureReason, RequestProofPayload, SignApiIdentityRequestInput, SignApiRequestInput, apiIdentitySigningInput, apiRequestSigningInput, assertProofVerifierConfig, buildApiAuthHeaders, buildApiIdentityHeaders, parseDfosAuthorization, sha256BodyHash, signApiIdentityRequest, signApiRequest } from '@metalabel/dfos-protocol/credentials';
-import { a as Client } from './types-BbIEz7BN.js';
+import { a as Client } from './types-DClhQw33.js';
 import '@metalabel/dfos-protocol/chain';
 import '@metalabel/dfos-web-relay/peer-client';
 

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-import { C as ClientConfig, a as Client, b as Callbacks, R as RevChecker } from './types-BbIEz7BN.js';
-export { c as CallOptions, D as DocumentBlob, E as EffectiveIdentity, d as EverProvedIdentity, G as GlobalLogOptions, e as GlobalLogPage, f as GlobalLogResult, I as IndexCapabilities, g as IndexContentPage, h as IndexContentRow, i as IndexCountersignatureRow, j as IndexCountersignaturesPage, k as IndexCredentialRow, l as IndexCredentialsPage, m as IndexIdentitiesPage, n as IndexIdentityProfile, o as IndexIdentityRow, p as IndexOrder, q as IndexRecencyOrder, L as LogOp, P as Provenance, r as RelayHealth, s as RelayResponse, t as Resolution, u as Resolved, v as ResolvedContent, w as ResolvedCredential, S as Store, T as Trust, U as UnverifiableAxis, V as VerifyResult } from './types-BbIEz7BN.js';
-export { m as memoryStore } from './memory-B5WMnEUQ.js';
+import { C as ClientConfig, a as Client, b as Callbacks, R as RevChecker } from './types-DClhQw33.js';
+export { c as CallOptions, D as DocumentBlob, E as EffectiveIdentity, d as EverProvedIdentity, G as GlobalLogOptions, e as GlobalLogPage, f as GlobalLogResult, I as IndexCapabilities, g as IndexContentPage, h as IndexContentRow, i as IndexCountersignatureRow, j as IndexCountersignaturesPage, k as IndexCredentialRow, l as IndexCredentialsPage, m as IndexIdentitiesPage, n as IndexIdentityProfile, o as IndexIdentityRow, p as IndexOrder, q as IndexRecencyOrder, L as LogOp, P as Provenance, r as RelayHealth, s as RelayResponse, t as Resolution, u as Resolved, v as ResolvedContent, w as ResolvedCredential, S as Store, T as Trust, U as UnverifiableAxis, V as VerifyResult } from './types-DClhQw33.js';
+export { m as memoryStore } from './memory-aYqSas8m.js';
 import '@metalabel/dfos-protocol/chain';
 import '@metalabel/dfos-protocol/credentials';
 import '@metalabel/dfos-web-relay/peer-client';
@@ -65,7 +65,9 @@ declare const divergenceErrorFrom: (err: unknown) => DivergenceError | undefined
  * payload binds exactly the queried (issuerDID, credentialCID). Anything less —
  * unreachable relay, negative answer, forged or mismatched proof — moves on to
  * the next relay; false only after the full set has been consulted and at least
- * one relay answered with a parseable status body. Zero answers throws.
+ * one relay answered with a parseable status body. Zero answers throws, and so
+ * does a positive answer whose signing key this client could not resolve: a
+ * dependency failure is never a negative status.
  *
  * When the caller supplies `asOfUnix` (the protocol does, on every cold fold, with
  * each operation's own `createdAt`), a verified revocation only counts if its own

package/dist/index.js

@@ -12,6 +12,7 @@ import { dagCborCanonicalEncode, decodeJwsUnsafe as decodeJwsUnsafe2 } from "@me
 import { createHttpPeerClient } from "@metalabel/dfos-web-relay/peer-client";
 
 // src/transport.ts
+import { isDependencyMissing, markDependencyMissing } from "@metalabel/dfos-protocol";
 var PAGE_LIMIT = 1e3;
 var MAX_PAGES = 1e4;
 var normalizeRelays = (relays) => {
@@ -62,6 +63,14 @@ var fanOutLog = async (fetchPage, relays, quorum, verifyCandidate) => {
   const byDigest = /* @__PURE__ */ new Map();
   const badDigests = /* @__PURE__ */ new Set();
   let lastVerifyError;
+  let lastDependencyError;
+  const recordFailure = (err, digest) => {
+    if (!(err instanceof StaleAnswerError)) {
+      if (isDependencyMissing(err)) lastDependencyError = err;
+      else lastVerifyError = err;
+    }
+    badDigests.add(digest);
+  };
   for (const url of relays) {
     let entries = null;
     try {
@@ -89,8 +98,7 @@ var fanOutLog = async (fetchPage, relays, quorum, verifyCandidate) => {
           provenance: { answeredBy: group.url, responses, agreed: true, fromCache: false }
         };
       } catch (err) {
-        if (!(err instanceof StaleAnswerError)) lastVerifyError = err;
-        badDigests.add(digest);
+        recordFailure(err, digest);
       }
     }
   }
@@ -105,8 +113,7 @@ var fanOutLog = async (fetchPage, relays, quorum, verifyCandidate) => {
         provenance: { answeredBy: group.url, responses, agreed: false, fromCache: false }
       };
     } catch (err) {
-      if (!(err instanceof StaleAnswerError)) lastVerifyError = err;
-      badDigests.add(digest);
+      recordFailure(err, digest);
     }
   }
   if (lastVerifyError !== void 0) {
@@ -115,6 +122,14 @@ var fanOutLog = async (fetchPage, relays, quorum, verifyCandidate) => {
       cause: lastVerifyError
     });
   }
+  if (lastDependencyError !== void 0) {
+    const message = lastDependencyError instanceof Error ? lastDependencyError.message : "unknown error";
+    throw markDependencyMissing(
+      new Error(`candidate log verification could not complete: ${message}`, {
+        cause: lastDependencyError
+      })
+    );
+  }
   return {
     outcome: "unreachable",
     entries: [],
@@ -234,11 +249,13 @@ var createIndexQueries = (relays, fetchImpl) => {
 // src/resolvers.ts
 import {
   decodeMultikey,
+  IdentityStateNoSeenKeysError,
   verifyContentChain,
   verifyContentExtensionFromTrustedState,
   verifyIdentityChain,
   verifyIdentityExtensionFromTrustedState
 } from "@metalabel/dfos-protocol/chain";
+import { CredentialVerificationError } from "@metalabel/dfos-protocol/credentials";
 import { decodeJwsUnsafe } from "@metalabel/dfos-protocol/crypto";
 var DID_PREFIX = "did:dfos";
 var cacheKey = (kind, id) => `${kind}:${id}`;
@@ -292,6 +309,8 @@ var keyBytesFor = (state, keyId) => {
   );
   return key ? decodeMultikey(key.publicKeyMultibase).keyBytes : null;
 };
+var NoStateAsOfError = class extends CredentialVerificationError {
+};
 var createResolvers = (deps) => {
   const relaysFor = (o) => normalizeRelays(o?.relays ?? deps.relays);
   const getIdentityChain = async (did, options) => {
@@ -323,17 +342,28 @@ var createResolvers = (deps) => {
       let headCID = cached.headCID;
       let lastCreatedAt = cached.lastCreatedAt;
       const log = [...cached.log];
-      for (const entry of entries.slice(cached.log.length)) {
-        const r = await verifyIdentityExtensionFromTrustedState({
-          currentState: state,
-          headCID,
-          lastCreatedAt,
-          newOp: entry.jwsToken
-        });
-        state = r.state;
-        headCID = r.operationCID;
-        lastCreatedAt = r.createdAt;
-        log.push(entry.jwsToken);
+      try {
+        for (const entry of entries.slice(cached.log.length)) {
+          const r = await verifyIdentityExtensionFromTrustedState({
+            currentState: state,
+            headCID,
+            lastCreatedAt,
+            newOp: entry.jwsToken
+          });
+          state = r.state;
+          headCID = r.operationCID;
+          lastCreatedAt = r.createdAt;
+          log.push(entry.jwsToken);
+        }
+      } catch (e) {
+        if (!(e instanceof IdentityStateNoSeenKeysError)) throw e;
+        const full = entries.map((entry) => entry.jwsToken);
+        const replayed = await verifyIdentityChain({ didPrefix: DID_PREFIX, log: full });
+        if (replayed.did !== did) {
+          throw new Error(`relay served a mismatched identity: asked ${did}, got ${replayed.did}`);
+        }
+        const last = opMeta(full[full.length - 1]);
+        return { state: replayed, log: full, headCID: last.cid, lastCreatedAt: last.createdAt };
       }
       return { state, log, headCID, lastCreatedAt };
     };
@@ -375,13 +405,18 @@ var createResolvers = (deps) => {
     const { state, log } = resolution;
     const last = log[log.length - 1];
     if (basis === void 0 || last === void 0 || opMeta(last).createdAt <= basis) return state;
+    const first = log[0];
+    if (first !== void 0 && basis < opMeta(first).createdAt) {
+      throw new NoStateAsOfError(`identity has no state as of ${basis}`);
+    }
     const asOf = await verifyIdentityChain({ didPrefix: DID_PREFIX, log, asOf: basis });
-    return { ...asOf, isDeleted: state.isDeleted };
+    return { ...asOf, isDeleted: state.isDeleted, basisDeterminate: true };
   };
   const resolveIdentity = async (did, basis) => {
     try {
       return await stateAsOf(await getIdentityChain(did), basis);
-    } catch {
+    } catch (err) {
+      if (err instanceof NoStateAsOfError) throw err;
       return void 0;
     }
   };
@@ -506,12 +541,29 @@ var createResolvers = (deps) => {
 };
 
 // src/revocation.ts
+import { isDependencyMissing as isDependencyMissing2 } from "@metalabel/dfos-protocol";
 import { parseProtocolTimestampUnix, verifyRevocation } from "@metalabel/dfos-protocol/chain";
+import { CredentialVerificationError as CredentialVerificationError2 } from "@metalabel/dfos-protocol/credentials";
 import { REVOCATIONS_BASE_PATH } from "@metalabel/dfos-web-relay/peer-client";
+var unavailable = (why) => new Error(`revocation status unavailable: ${why}`);
+var KeyUnresolvableError = class extends Error {
+};
+var isResolverVerdict = (err) => err instanceof CredentialVerificationError2 && !isDependencyMissing2(err);
 var createRevocationChecker = (relays, fetchImpl, resolveKey) => {
   const relaySet = normalizeRelays(relays);
+  const guardedResolveKey = async (kid, basis) => {
+    try {
+      return await resolveKey(kid, basis);
+    } catch (err) {
+      if (isResolverVerdict(err)) throw err;
+      throw new KeyUnresolvableError(`could not resolve the revocation signing key ${kid}`, {
+        cause: err
+      });
+    }
+  };
   return async (issuerDID, credentialCID, asOfUnix) => {
     let answered = false;
+    let unresolvable;
     for (const url of relaySet) {
       let body = null;
       try {
@@ -532,17 +584,22 @@ var createRevocationChecker = (relays, fetchImpl, resolveKey) => {
       }
       if (!body?.revoked || !body.revocation) continue;
       try {
-        const verified = await verifyRevocation({ jwsToken: body.revocation, resolveKey });
+        const verified = await verifyRevocation({
+          jwsToken: body.revocation,
+          resolveKey: guardedResolveKey
+        });
         if (verified.did === issuerDID && verified.credentialCID === credentialCID) {
           if (asOfUnix === void 0 || asOfUnix <= 0) return true;
           const revokedAtUnix = parseProtocolTimestampUnix(verified.createdAt);
           if (revokedAtUnix === null || revokedAtUnix <= asOfUnix) return true;
           continue;
         }
-      } catch {
+      } catch (err) {
+        if (err instanceof KeyUnresolvableError) unresolvable = err;
       }
     }
-    if (!answered) throw new Error("revocation status unavailable: no relay answered");
+    if (!answered) throw unavailable("no relay answered");
+    if (unresolvable) throw unavailable(unresolvable.message);
     return false;
   };
 };

package/dist/{memory-B5WMnEUQ.d.ts → memory-aYqSas8m.d.ts}

@@ -1,4 +1,4 @@
-import { S as Store } from './types-BbIEz7BN.js';
+import { S as Store } from './types-DClhQw33.js';
 
 declare const memoryStore: () => Store;
 

package/dist/siwd.d.ts

@@ -1,5 +1,5 @@
 import { Signer, VerifiedIdentity, VerifiedSignRequest } from '@metalabel/dfos-protocol/chain';
-import { a as Client, V as VerifyResult } from './types-BbIEz7BN.js';
+import { a as Client, V as VerifyResult } from './types-DClhQw33.js';
 import '@metalabel/dfos-protocol/credentials';
 import '@metalabel/dfos-web-relay/peer-client';
 

package/dist/store/index.d.ts

@@ -1,5 +1,5 @@
-export { m as memoryStore } from '../memory-B5WMnEUQ.js';
-import { S as Store } from '../types-BbIEz7BN.js';
+export { m as memoryStore } from '../memory-aYqSas8m.js';
+import { S as Store } from '../types-DClhQw33.js';
 import '@metalabel/dfos-protocol/chain';
 import '@metalabel/dfos-protocol/credentials';
 import '@metalabel/dfos-web-relay/peer-client';

package/dist/{types-BbIEz7BN.d.ts → types-DClhQw33.d.ts}

@@ -5,6 +5,12 @@ import { PeerClient } from '@metalabel/dfos-web-relay/peer-client';
 /** Head/as-of state; excludes the credit-claim projection. */
 type EffectiveIdentity = VerifiedIdentity & {
     readonly resolution?: 'effective';
+    /**
+     * True when no operation dated at or before the basis can still arrive and
+     * change this key state — the protocol's `ResolvedIdentity.basisDeterminate`,
+     * which decides whether a missing key is a verdict or a retryable miss.
+     */
+    basisDeterminate?: boolean;
 };
 /** Every key ever proved, including memberships absent from effective state. */
 type EverProvedIdentity = VerifiedIdentity & {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metalabel/dfos-client",
-  "version": "0.52.0",
+  "version": "0.53.0",
   "type": "module",
   "description": "DFOS Client — the client-side kit for participating in the protocol: resolve, verify, prove. Fetch, resolve, verify-orchestration and cache over untrusted relays, plus the SIWD and API-AUTH proof surfaces. Holds no keys; all crypto truth comes from @metalabel/dfos-protocol",
   "license": "MIT",
@@ -47,16 +47,16 @@
     "README.md"
   ],
   "peerDependencies": {
-    "@metalabel/dfos-protocol": "^0.52.0",
-    "@metalabel/dfos-web-relay": "^0.52.0"
+    "@metalabel/dfos-protocol": "^0.53.0",
+    "@metalabel/dfos-web-relay": "^0.53.0"
   },
   "devDependencies": {
     "@types/node": "^24.10.4",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
     "vitest": "^4.1.8",
-    "@metalabel/dfos-protocol": "0.52.0",
-    "@metalabel/dfos-web-relay": "0.52.0"
+    "@metalabel/dfos-protocol": "0.53.0",
+    "@metalabel/dfos-web-relay": "0.53.0"
   },
   "scripts": {
     "build": "tsup",