@metalabel/dfos-protocol 0.37.0 → 0.38.0

package/dist/credentials/index.d.ts

@@ -1,54 +1,408 @@
-export { b as Attenuation, c as AuthTokenClaims, f as CredentialVerificationError, D as DFOSCredentialPayload, i as MAX_CREDENTIAL_SIZE, R as RevocationChecker, V as VerifiedDFOSCredential, u as VerifiedDelegationChain, w as createDFOSCredential, x as decodeDFOSCredentialUnsafe, y as isAttenuated, z as matchesResource, E as verifyDFOSCredential, F as verifyDelegationChain } from '../dfos-credential-DU7WvoHE.js';
+export { b as Attenuation, e as CredentialVerificationError, D as DFOSCredentialPayload, h as MAX_CREDENTIAL_SIZE, R as RevocationChecker, V as VerifiedDFOSCredential, t as VerifiedDelegationChain, v as createDFOSCredential, w as decodeDFOSCredentialUnsafe, x as isAttenuated, y as matchesResource, B as verifyDFOSCredential, E as verifyDelegationChain } from '../dfos-credential-X6uvPIth.js';
 import 'zod';
 
-interface AuthTokenCreateOptions {
-    /** The DID proving identity */
-    iss: string;
-    /** Target relay hostname (prevents cross-relay replay) */
-    aud: string;
-    /** Expiration — unix seconds */
-    exp: number;
-    /** kid — DID URL: "did:dfos:xxx#key_yyy" */
+/**
+ * The normative JWS header `typ` for a request proof (API-AUTH.md). Signers MUST
+ * set it; the request-proof verifier rejects anything else — it is also what lets
+ * typ-routing dispatchers tell a proof apart from credentials and chain ops.
+ */
+declare const REQUEST_PROOF_JWS_TYP = "did:dfos:request-proof";
+/**
+ * The normative JWS header `typ` for an identity proof (API-AUTH.md) — the
+ * request proof's credential-less sibling.
+ *
+ * THE TYP GATE IS ABSOLUTE, IN BOTH DIRECTIONS. "Possession of a grant's
+ * audience key" and "possession of a bare identity's key" are different claims,
+ * so a route requiring a credential rejects an identity proof at the header gate
+ * and a route requiring bare identity rejects a request proof at the same gate.
+ * No verifier ambiguity, no downgrade.
+ */
+declare const IDENTITY_PROOF_JWS_TYP = "did:dfos:identity-proof";
+/**
+ * The digest of zero octets. A request with no body hashes the empty string —
+ * there is deliberately no absent-member form for bodyless requests, so every
+ * proof is checked the same way.
+ */
+declare const EMPTY_BODY_SHA256 = "47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU";
+/** Size cap on the serialized proof token, checked BEFORE any decode. */
+declare const MAX_REQUEST_PROOF_SIZE = 4096;
+/** RECOMMENDED acceptance window `W` — how old a proof may be, in seconds. */
+declare const DEFAULT_PROOF_WINDOW_SECONDS = 60;
+/** RECOMMENDED clock-skew allowance `S` — how forward-dated a proof may be. */
+declare const DEFAULT_PROOF_SKEW_SECONDS = 60;
+/**
+ * The binding cap on `W + S`: the total span over which any one proof is
+ * accepted, and therefore its worst-case replay window. A configuration
+ * exceeding it is refused rather than clamped — a deployment that silently got a
+ * 10-minute replay window it did not ask for is the failure this forbids.
+ */
+declare const MAX_PROOF_FRESHNESS_SPAN_SECONDS = 300;
+/**
+ * Default cap on the decoded body a verifier will hash, in bytes (1 MiB). The v0
+ * action registry is bodyless, so this never binds today; it is the defensive
+ * ceiling for the first body-bearing action, overridable per verifier.
+ */
+declare const MAX_BODY_BYTES = 1048576;
+/**
+ * The `Authorization` scheme this family rides — the token `DFOS`, deliberately
+ * NOT `Bearer`, because nothing carried here is a bearer token and naming it one
+ * invites bearer handling (logging, caching, forwarding) the artifact exists to
+ * make useless.
+ */
+declare const DFOS_AUTH_SCHEME = "DFOS";
+interface RequestProofPayload {
+    /** The HTTP method, uppercase. */
+    method: string;
+    /** The API's lowercase authority — `host` on 443, `host:port` otherwise. */
+    host: string;
+    /** The exact origin-form request target — path plus query string, byte for byte. */
+    path: string;
+    /** Canonical unpadded base64url of the SHA-256 of the raw request body octets. */
+    bodyHash: string;
+    /** CID of the leaf credential presented alongside this proof. */
+    credentialCID: string;
+    /** Issued-at — unix seconds (positive integer). */
+    iat: number;
+}
+/**
+ * The identity proof's payload: the request proof's five members MINUS
+ * `credentialCID`. All five are required, under the SAME member rules — there is
+ * no relaxation here, only one fewer member.
+ */
+interface IdentityProofPayload {
+    /** The HTTP method, uppercase. */
+    method: string;
+    /** The API's lowercase authority — `host` on 443, `host:port` otherwise. */
+    host: string;
+    /** The exact origin-form request target — path plus query string, byte for byte. */
+    path: string;
+    /** Canonical unpadded base64url of the SHA-256 of the raw request body octets. */
+    bodyHash: string;
+    /** Issued-at — unix seconds (positive integer). */
+    iat: number;
+}
+/**
+ * ADDITIVE MEMBERS, appended AFTER the canonical order.
+ *
+ * API-AUTH.md's growth rule is additive members on this envelope, never a new
+ * envelope: "additional members register additively, appended to the canonical
+ * order". `jti` — the per-request uniqueness member a write-gating deployment
+ * requires — is the named one.
+ *
+ * TWO RULES MAKE THIS A BYTE-TWIN. (1) Extra members are emitted AFTER every
+ * canonical member, so a verifier that ignores them still reconstructs the same
+ * prefix. (2) Among themselves they are emitted in LEXICOGRAPHIC ORDER OF MEMBER
+ * NAME — not insertion order, because Go map iteration is randomized and a TS
+ * signer and a Go signer must emit identical bytes from identical inputs.
+ *
+ * Values are strings. The registered member (`jti`) is a string, and restricting
+ * the type keeps the two encoders from disagreeing about number formatting.
+ */
+type ProofExtraMembers = Readonly<Record<string, string>>;
+/** The internal union of both payloads; `credentialCID` is present iff credentialed. */
+interface ParsedProofPayload {
+    method: string;
+    host: string;
+    path: string;
+    bodyHash: string;
+    credentialCID?: string;
+    iat: number;
+}
+/**
+ * Validate and normalize additive members into their canonical emission order:
+ * lexicographic by name, after every canonical member. Returns `[]` for the
+ * common (no extras) case, so the bytes are unchanged from the five/six-member
+ * form when nothing additive is asked for.
+ */
+declare const canonicalExtraMembers: (extra: ProofExtraMembers | undefined, label: string) => [string, string][];
+/**
+ * The request proof's canonical signing input — six members, in the fixed order
+ * `method, host, path, bodyHash, credentialCID, iat`, plus any additive members
+ * in lexicographic order.
+ *
+ * PURE and clientless: import it in a signing backend and in a verifier alike.
+ */
+declare const apiRequestSigningInput: (payload: RequestProofPayload, extraMembers?: ProofExtraMembers) => Uint8Array;
+/**
+ * The identity proof's canonical signing input — five members, in the fixed
+ * order `method, host, path, bodyHash, iat`: the request proof's bytes minus
+ * `credentialCID`, from the same encoder, under the same member rules. Additive
+ * members follow in lexicographic order.
+ *
+ * PURE and clientless: import it in a signing backend and in a verifier alike.
+ */
+declare const apiIdentitySigningInput: (payload: IdentityProofPayload, extraMembers?: ProofExtraMembers) => Uint8Array;
+/**
+ * The `bodyHash` member: canonical unpadded base64url of the SHA-256 of the
+ * APPLICATION body octets — the bytes the sender handed its HTTP client, which a
+ * verifier obtains after reversing transfer encoding and content encoding. Zero
+ * octets hash to `EMPTY_BODY_SHA256`.
+ */
+declare const sha256BodyHash: (body: Uint8Array) => string;
+/**
+ * Parse an `Authorization: DFOS <token>` header, returning the bare token.
+ *
+ * The scheme is matched CASE-INSENSITIVELY per RFC 9110 §11.1 (`DFOS`, `dfos`,
+ * `Dfos` are one scheme), separated from the token by one or more spaces, with
+ * surrounding optional whitespace ignored. The token itself is case-sensitive
+ * and is not further decoded here. Returns `null` for an absent, differently
+ * schemed, or empty-token header — a `Bearer` header is NOT this family and
+ * never was.
+ */
+declare const parseDfosAuthorization: (header: string | undefined | null) => string | null;
+interface SignApiRequestInput {
+    /** The HTTP method, uppercase. */
+    method: string;
+    /** The API's lowercase authority — `host` on 443, `host:port` otherwise. */
+    host: string;
+    /** The exact origin-form request target this proof will ride. */
+    path: string;
+    /** Application body octets; omitted or empty hashes to `EMPTY_BODY_SHA256`. */
+    body?: Uint8Array;
+    /** CID of the leaf credential presented alongside this proof. */
+    credentialCID: string;
+    /**
+     * The signing key's DID URL. Its DID portion MUST be the leaf credential's
+     * `aud` — that equality IS the possession being proven.
+     */
     kid: string;
-    /** Issued-at override — unix seconds (defaults to Date.now()) */
-    iat?: number;
-    /** Signer function */
+    /** Raw Ed25519 signer over the JWS signing input. */
     sign: (message: Uint8Array) => Promise<Uint8Array>;
+    /** Issued-at override — unix seconds. Default `Math.floor(Date.now() / 1000)`. */
+    iat?: number;
+    /**
+     * ADDITIVE members, appended after the canonical order in lexicographic name
+     * order. `{ jti }` is the registered one — required by a deployment that gates
+     * WRITES with this envelope (API-AUTH.md, Security Considerations).
+     */
+    extraMembers?: ProofExtraMembers;
 }
-interface AuthTokenVerifyOptions {
-    /** The JWT token string */
-    token: string;
-    /** Raw Ed25519 public key bytes (32 bytes) */
-    publicKey: Uint8Array;
-    /** Expected audience (relay hostname) */
-    audience: string;
-    /** Current time in seconds (defaults to Date.now() / 1000) */
-    currentTime?: number;
-}
-interface VerifiedAuthToken {
-    /** The DID that created the token */
-    iss: string;
-    /** The target relay */
-    aud: string;
-    /** Token expiration (unix seconds) */
-    exp: number;
-    /** Token issued-at (unix seconds) */
-    iat: number;
-    /** kid from the JWT header */
+/**
+ * Sign one request. The producer half of the byte contract.
+ *
+ * `createJws` serializes the payload with `JSON.stringify`, so passing the
+ * fixed-order object makes the emitted payload segment EXACTLY
+ * `apiRequestSigningInput(payload, extraMembers)` — the equivalence is pinned by
+ * a test rather than assumed, because it is the whole reason there is one byte
+ * contract and not two.
+ */
+declare const signApiRequest: (input: SignApiRequestInput) => Promise<{
+    proof: string;
+    payload: RequestProofPayload;
+}>;
+interface SignApiIdentityRequestInput {
+    /** The HTTP method, uppercase. */
+    method: string;
+    /** The API's lowercase authority — `host` on 443, `host:port` otherwise. */
+    host: string;
+    /** The exact origin-form request target this proof will ride. */
+    path: string;
+    /** Application body octets; omitted or empty hashes to `EMPTY_BODY_SHA256`. */
+    body?: Uint8Array;
+    /**
+     * The signing key's DID URL. Its DID portion IS THE PRINCIPAL — the identity
+     * proof names no other party, and nothing is looked up from it.
+     */
     kid: string;
+    /** Raw Ed25519 signer over the JWS signing input. */
+    sign: (message: Uint8Array) => Promise<Uint8Array>;
+    /** Issued-at override — unix seconds. Default `Math.floor(Date.now() / 1000)`. */
+    iat?: number;
+    /**
+     * ADDITIVE members, appended after the canonical order in lexicographic name
+     * order. `{ jti }` is the registered one, and a WRITE-SHAPED surface — relay
+     * ingestion, blob upload — REQUIRES it (WEB-RELAY.md, Authentication).
+     */
+    extraMembers?: ProofExtraMembers;
+}
+/**
+ * Sign one request as a BARE IDENTITY — `signApiRequest`'s input minus the
+ * credential material, and its payload minus `credentialCID`. The producer half
+ * of the identity proof's byte contract.
+ *
+ * The emitted payload segment is EXACTLY
+ * `apiIdentitySigningInput(payload, extraMembers)`, the same
+ * construction-by-fixed-order the request proof uses, and pinned by a test
+ * rather than assumed.
+ */
+declare const signApiIdentityRequest: (input: SignApiIdentityRequestInput) => Promise<{
+    proof: string;
+    payload: IdentityProofPayload;
+}>;
+/**
+ * The two headers a credential-gated request carries. The `Authorization` scheme
+ * is the token `DFOS`, deliberately NOT `Bearer`.
+ */
+declare const buildApiAuthHeaders: (input: {
+    proof: string;
+    credential: string;
+}) => {
+    Authorization: string;
+    "X-Credential": string;
+};
+/**
+ * The ONE header an identity-proven request carries — the same `Authorization:
+ * DFOS <jws>`.
+ *
+ * On an `api:<host>` surface an accompanying `X-Credential` is MALFORMED: the
+ * two headers would assert two different claims at once. A relay content-plane
+ * read is NOT that case — there the identity proof is the AuthN half and a DFOS
+ * credential presentation is a separate authorization artifact (WEB-RELAY.md,
+ * Authentication) — so that refusal belongs to the middleware of the surface
+ * being served, never to this builder.
+ */
+declare const buildApiIdentityHeaders: (input: {
+    proof: string;
+}) => {
+    Authorization: string;
+};
+/**
+ * The verdict class. Branch on `reason`, never on message text.
+ *
+ * - `invalid` — checked and failed.
+ * - `unverifiable` — could not check (an unresolvable presenter, an unreachable
+ *   revocation source). A transient resolution failure is the server's
+ *   condition, not the caller's.
+ * - `config` — the DEPLOYMENT is misconfigured (a `W + S` over the 300-second
+ *   ceiling, or an empty required action). Not a judgment about the artifact.
+ */
+type RequestProofFailureReason = 'invalid' | 'unverifiable' | 'config';
+/**
+ * The verification phase a failure arose in. Load-bearing for HTTP mapping: an
+ * `invalid` proof-layer failure is a 401 (with a `WWW-Authenticate: DFOS`
+ * challenge), an `invalid` credential-layer failure is a 403. `status` carries
+ * the recommended code directly so middleware never has to re-derive it.
+ */
+type RequestProofFailurePhase = 'proof' | 'credential' | 'config';
+/** Branch on `reason`/`phase`/`status`, never on message text. */
+declare class ApiRequestVerifyError extends Error {
+    readonly reason: RequestProofFailureReason;
+    readonly phase: RequestProofFailurePhase;
+    /** Recommended HTTP status: 401 proof-invalid, 403 credential-invalid, 503 unverifiable, 500 config. */
+    readonly status: number;
+    constructor(reason: RequestProofFailureReason, phase: RequestProofFailurePhase, status: number, message: string);
 }
+/** invalid, proof phase → 401. */
+declare const invalidProof: (message: string) => ApiRequestVerifyError;
+/** unverifiable, proof phase → 503. */
+declare const unverifiableProof: (message: string) => ApiRequestVerifyError;
+/** the DEPLOYMENT is misconfigured → 500. Never a judgment about the artifact. */
+declare const misconfiguredProof: (message: string) => ApiRequestVerifyError;
 /**
- * Create a DID-signed auth token JWT for relay authentication
+ * A presenter's CURRENT identity state, as the proof phase needs it.
+ *
+ * `keys` is the union of every CURRENT key role — auth, assert, controller —
+ * because API-AUTH's "key resolution is current-state" admits any of them. It is
+ * the CALLER's job to build this from current state only: a resolver answering
+ * from historical state would let a rotated-out key keep minting proofs, which
+ * removes the only lever a compromised presenter has.
  */
-declare const createAuthToken: (options: AuthTokenCreateOptions) => Promise<string>;
+interface ProofPresenterState {
+    /** Current-state deletion. A deleted presenter's proofs are INVALID (401). */
+    isDeleted: boolean;
+    /** Current keys, any role. */
+    keys: readonly {
+        id: string;
+        publicKeyMultibase: string;
+    }[];
+}
 /**
- * Verify a DID-signed auth token JWT
+ * Resolve a presenter DID to its CURRENT identity state.
  *
- * Checks signature, expiration, audience, and payload structure.
+ * Return `null`, or throw, when the state could not be established — both map to
+ * `unverifiable` (503), because "could not check" is the server's condition, not
+ * a judgment about the caller. Returning a state with `isDeleted: true` is a
+ * judgment, and maps to `invalid` (401).
+ */
+type ResolveProofPresenter = (did: string) => Promise<ProofPresenterState | null>;
+/**
+ * What the PROOF PHASE reads — the subset of a verifier's inputs that
+ * API-AUTH.md steps 1–7 touch.
  */
-declare const verifyAuthToken: (options: AuthTokenVerifyOptions) => VerifiedAuthToken;
-declare class AuthTokenVerificationError extends Error {
-    constructor(message: string);
+interface ProofEnvelopeInput {
+    /** The proof JWS — the `Authorization: DFOS <token>` token, scheme stripped. */
+    proof: string;
+    /**
+     * THE VERIFIER'S OWN CONFIGURED AUTHORITY for the route being served — a value
+     * the deployment holds, NEVER one read from the request. `Host`,
+     * `X-Forwarded-Host`, and the request URL's authority are all attacker-supplied:
+     * a verifier that compared the proof's `host` against a request header would
+     * have no host binding at all. Include the port when it is not 443.
+     */
+    host: string;
+    /** The received request's method. */
+    method: string;
+    /** The received origin-form request target — path plus query string, byte for byte. */
+    path: string;
+    /** The received application body octets, post-content-decoding. Omitted = no body. */
+    body?: Uint8Array;
+    /** Cap on the decoded body this verifier will hash. Default `MAX_BODY_BYTES`. */
+    maxBodyBytes?: number;
+    /** Acceptance window `W`, seconds. Default 60. `W + S` MUST NOT exceed 300. */
+    windowSeconds?: number;
+    /** Clock-skew allowance `S`, seconds. Default 60. `W + S` MUST NOT exceed 300. */
+    skewSeconds?: number;
+    /** Clock injection (unix ms). Default `Date.now()`. */
+    now?: () => number;
 }
+/**
+ * API-AUTH.md step 4's CONFIG half, hoisted so a caller can run it BEFORE any
+ * request-dependent gate.
+ *
+ * ORDER IS LOAD-BEARING. A deployment whose freshness span is out of bounds must
+ * never verify anything, and its misconfiguration must never be REPORTED as a
+ * judgment about the request — a config verdict masked by a 401 for an oversized
+ * token would hide the deployment bug behind the caller's mistake. Every entry
+ * point calls this first.
+ */
+declare const assertProofVerifierConfig: (input: {
+    windowSeconds?: number;
+    skewSeconds?: number;
+    maxBodyBytes?: number;
+}) => {
+    window: number;
+    skew: number;
+    maxBodyBytes: number;
+};
+/** What a verified envelope hands back. */
+interface VerifiedProofEnvelope {
+    /** The validated canonical members. */
+    payload: ParsedProofPayload;
+    /**
+     * The DECODED payload object, unknown members included.
+     *
+     * ADDITIVE MEMBERS ARE READ FROM HERE, at the consuming layer, AFTER
+     * verification — the signature already covers them, and the canonical member
+     * set stays closed. `jti` is the case this exists for: the envelope verifier
+     * ignores it per MUST-ignore-unknown, and a write-gating deployment reads it
+     * off this object and applies its own replay discipline.
+     */
+    rawPayload: Record<string, unknown>;
+    /** THE PRINCIPAL — the `kid`'s DID. */
+    presenterDID: string;
+    /** The full `kid` DID URL that signed, key fragment included. */
+    kid: string;
+    /** The integer unix seconds the freshness check used. */
+    now: number;
+}
+/**
+ * Verify an IDENTITY proof's envelope — for this artifact steps 1–7 ARE the whole
+ * algorithm. Steps 8–11 do not exist: there is no credential to walk, so there is
+ * no chain, no revocation lookup, and no attenuation coverage.
+ *
+ * Verdicts are two, not three: `invalid` → 401 and `unverifiable` → 503, plus
+ * `config` → 500 for a deployment whose `W + S` is out of bounds. There is no 403
+ * tier — nothing credential-shaped can fail.
+ *
+ * A request proof presented here is rejected at the header gate, and the reverse
+ * holds for `verifyRequestProofEnvelope`.
+ */
+declare const verifyIdentityProofEnvelope: (input: ProofEnvelopeInput, resolvePresenter: ResolveProofPresenter) => Promise<VerifiedProofEnvelope>;
+/**
+ * Verify a REQUEST proof's envelope — API-AUTH.md steps 1–7 with the request
+ * `typ`. The caller then performs steps 8–11 (the credential walk), for which a
+ * verified proof signature is the gate.
+ */
+declare const verifyRequestProofEnvelope: (input: ProofEnvelopeInput, resolvePresenter: ResolveProofPresenter) => Promise<VerifiedProofEnvelope>;
 
-export { type AuthTokenCreateOptions, AuthTokenVerificationError, type AuthTokenVerifyOptions, type VerifiedAuthToken, createAuthToken, verifyAuthToken };
+export { ApiRequestVerifyError, DEFAULT_PROOF_SKEW_SECONDS, DEFAULT_PROOF_WINDOW_SECONDS, DFOS_AUTH_SCHEME, EMPTY_BODY_SHA256, IDENTITY_PROOF_JWS_TYP, type IdentityProofPayload, MAX_BODY_BYTES, MAX_PROOF_FRESHNESS_SPAN_SECONDS, MAX_REQUEST_PROOF_SIZE, type ParsedProofPayload, type ProofEnvelopeInput, type ProofExtraMembers, type ProofPresenterState, REQUEST_PROOF_JWS_TYP, type RequestProofFailurePhase, type RequestProofFailureReason, type RequestProofPayload, type ResolveProofPresenter, type SignApiIdentityRequestInput, type SignApiRequestInput, type VerifiedProofEnvelope, apiIdentitySigningInput, apiRequestSigningInput, assertProofVerifierConfig, buildApiAuthHeaders, buildApiIdentityHeaders, canonicalExtraMembers, invalidProof, misconfiguredProof, parseDfosAuthorization, sha256BodyHash, signApiIdentityRequest, signApiRequest, unverifiableProof, verifyIdentityProofEnvelope, verifyRequestProofEnvelope };

package/dist/credentials/index.js

@@ -1,33 +1,75 @@
 import {
+  ApiRequestVerifyError,
   Attenuation,
-  AuthTokenClaims,
-  AuthTokenVerificationError,
   CredentialVerificationError,
+  DEFAULT_PROOF_SKEW_SECONDS,
+  DEFAULT_PROOF_WINDOW_SECONDS,
   DFOSCredentialPayload,
+  DFOS_AUTH_SCHEME,
+  EMPTY_BODY_SHA256,
+  IDENTITY_PROOF_JWS_TYP,
+  MAX_BODY_BYTES,
   MAX_CREDENTIAL_SIZE,
-  createAuthToken,
+  MAX_PROOF_FRESHNESS_SPAN_SECONDS,
+  MAX_REQUEST_PROOF_SIZE,
+  REQUEST_PROOF_JWS_TYP,
+  apiIdentitySigningInput,
+  apiRequestSigningInput,
+  assertProofVerifierConfig,
+  buildApiAuthHeaders,
+  buildApiIdentityHeaders,
+  canonicalExtraMembers,
   createDFOSCredential,
   decodeDFOSCredentialUnsafe,
+  invalidProof,
   isAttenuated,
   matchesResource,
-  verifyAuthToken,
+  misconfiguredProof,
+  parseDfosAuthorization,
+  sha256BodyHash,
+  signApiIdentityRequest,
+  signApiRequest,
+  unverifiableProof,
   verifyDFOSCredential,
-  verifyDelegationChain
-} from "../chunk-XP644GQK.js";
+  verifyDelegationChain,
+  verifyIdentityProofEnvelope,
+  verifyRequestProofEnvelope
+} from "../chunk-NXQW6EBF.js";
 import "../chunk-4LG2GEB2.js";
 export {
+  ApiRequestVerifyError,
   Attenuation,
-  AuthTokenClaims,
-  AuthTokenVerificationError,
   CredentialVerificationError,
+  DEFAULT_PROOF_SKEW_SECONDS,
+  DEFAULT_PROOF_WINDOW_SECONDS,
   DFOSCredentialPayload,
+  DFOS_AUTH_SCHEME,
+  EMPTY_BODY_SHA256,
+  IDENTITY_PROOF_JWS_TYP,
+  MAX_BODY_BYTES,
   MAX_CREDENTIAL_SIZE,
-  createAuthToken,
+  MAX_PROOF_FRESHNESS_SPAN_SECONDS,
+  MAX_REQUEST_PROOF_SIZE,
+  REQUEST_PROOF_JWS_TYP,
+  apiIdentitySigningInput,
+  apiRequestSigningInput,
+  assertProofVerifierConfig,
+  buildApiAuthHeaders,
+  buildApiIdentityHeaders,
+  canonicalExtraMembers,
   createDFOSCredential,
   decodeDFOSCredentialUnsafe,
+  invalidProof,
   isAttenuated,
   matchesResource,
-  verifyAuthToken,
+  misconfiguredProof,
+  parseDfosAuthorization,
+  sha256BodyHash,
+  signApiIdentityRequest,
+  signApiRequest,
+  unverifiableProof,
   verifyDFOSCredential,
-  verifyDelegationChain
+  verifyDelegationChain,
+  verifyIdentityProofEnvelope,
+  verifyRequestProofEnvelope
 };

package/dist/{dfos-credential-DU7WvoHE.d.ts → dfos-credential-X6uvPIth.d.ts}

@@ -364,15 +364,6 @@ declare const DFOSCredentialPayload: z.ZodObject<{
     iat: z.ZodNumber;
 }, z.core.$loose>;
 type DFOSCredentialPayload = z.infer<typeof DFOSCredentialPayload>;
-/** Claims for a DID-signed auth token (relay AuthN) */
-declare const AuthTokenClaims: z.ZodObject<{
-    iss: z.ZodString;
-    sub: z.ZodString;
-    aud: z.ZodString;
-    exp: z.ZodNumber;
-    iat: z.ZodNumber;
-}, z.core.$loose>;
-type AuthTokenClaims = z.infer<typeof AuthTokenClaims>;
 
 interface VerifiedDFOSCredential {
     /** Issuer DID */
@@ -531,4 +522,4 @@ declare class CredentialVerificationError extends Error {
     constructor(message: string);
 }
 
-export { ARTIFACT_CID_ANCHOR_RE as A, parseProtocolTimestampUnix as B, CONTENT_ID_ANCHOR_RE as C, DFOSCredentialPayload as D, verifyDFOSCredential as E, verifyDelegationChain as F, IdentityOperation as I, MAX_ARTIFACT_PAYLOAD_SIZE as M, type RevocationChecker as R, ServiceEntry as S, type VerifiedDFOSCredential as V, ArtifactPayload as a, Attenuation as b, AuthTokenClaims as c, ContentOperation as d, CountersignPayload as e, CredentialVerificationError as f, CreditClaimPayload as g, Iso8601 as h, MAX_CREDENTIAL_SIZE as i, MAX_CREDIT_CLAIM_SIZE as j, MAX_OPERATION_SIZE as k, MAX_SERVICES_ENTRIES as l, MAX_SERVICES_PAYLOAD_SIZE as m, MAX_SIGN_REQUEST_PAYLOAD_SIZE as n, MAX_SIGN_REQUEST_SIZE as o, MultikeyPublicKey as p, RevocationPayload as q, ServicesArray as r, SignRequestPayload as s, type Signer as t, type VerifiedDelegationChain as u, VerifiedIdentity as v, createDFOSCredential as w, decodeDFOSCredentialUnsafe as x, isAttenuated as y, matchesResource as z };
+export { ARTIFACT_CID_ANCHOR_RE as A, verifyDFOSCredential as B, CONTENT_ID_ANCHOR_RE as C, DFOSCredentialPayload as D, verifyDelegationChain as E, IdentityOperation as I, MAX_ARTIFACT_PAYLOAD_SIZE as M, type RevocationChecker as R, ServiceEntry as S, type VerifiedDFOSCredential as V, ArtifactPayload as a, Attenuation as b, ContentOperation as c, CountersignPayload as d, CredentialVerificationError as e, CreditClaimPayload as f, Iso8601 as g, MAX_CREDENTIAL_SIZE as h, MAX_CREDIT_CLAIM_SIZE as i, MAX_OPERATION_SIZE as j, MAX_SERVICES_ENTRIES as k, MAX_SERVICES_PAYLOAD_SIZE as l, MAX_SIGN_REQUEST_PAYLOAD_SIZE as m, MAX_SIGN_REQUEST_SIZE as n, MultikeyPublicKey as o, RevocationPayload as p, ServicesArray as q, SignRequestPayload as r, type Signer as s, type VerifiedDelegationChain as t, VerifiedIdentity as u, createDFOSCredential as v, decodeDFOSCredentialUnsafe as w, isAttenuated as x, matchesResource as y, parseProtocolTimestampUnix as z };

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { JwsHeader, JwsVerificationError, JwtClaims, JwtCreateOptions, JwtHeader, JwtVerificationError, JwtVerifyOptions, PrefixedID, assertJwsProfile, base64urlDecode, base64urlEncode, createJws, createJwt, createNewEd25519Keypair, dagCborCanonicalEncode, decodeJwsUnsafe, decodeJwtUnsafe, generateId, generateIdNoPrefix, importEd25519Keypair, isCanonicallyEqual, isValidEd25519Signature, isValidId, normalizedId, parseDagCborCID, sha256, signPayloadEd25519, verifyJws, verifyJwt } from './crypto/index.js';
-export { A as ARTIFACT_CID_ANCHOR_RE, a as ArtifactPayload, b as Attenuation, c as AuthTokenClaims, C as CONTENT_ID_ANCHOR_RE, d as ContentOperation, e as CountersignPayload, f as CredentialVerificationError, g as CreditClaimPayload, D as DFOSCredentialPayload, I as IdentityOperation, h as Iso8601, M as MAX_ARTIFACT_PAYLOAD_SIZE, i as MAX_CREDENTIAL_SIZE, j as MAX_CREDIT_CLAIM_SIZE, k as MAX_OPERATION_SIZE, l as MAX_SERVICES_ENTRIES, m as MAX_SERVICES_PAYLOAD_SIZE, n as MAX_SIGN_REQUEST_PAYLOAD_SIZE, o as MAX_SIGN_REQUEST_SIZE, p as MultikeyPublicKey, R as RevocationChecker, q as RevocationPayload, S as ServiceEntry, r as ServicesArray, s as SignRequestPayload, t as Signer, V as VerifiedDFOSCredential, u as VerifiedDelegationChain, v as VerifiedIdentity, w as createDFOSCredential, x as decodeDFOSCredentialUnsafe, y as isAttenuated, z as matchesResource, B as parseProtocolTimestampUnix, E as verifyDFOSCredential, F as verifyDelegationChain } from './dfos-credential-DU7WvoHE.js';
+export { A as ARTIFACT_CID_ANCHOR_RE, a as ArtifactPayload, b as Attenuation, C as CONTENT_ID_ANCHOR_RE, c as ContentOperation, d as CountersignPayload, e as CredentialVerificationError, f as CreditClaimPayload, D as DFOSCredentialPayload, I as IdentityOperation, g as Iso8601, M as MAX_ARTIFACT_PAYLOAD_SIZE, h as MAX_CREDENTIAL_SIZE, i as MAX_CREDIT_CLAIM_SIZE, j as MAX_OPERATION_SIZE, k as MAX_SERVICES_ENTRIES, l as MAX_SERVICES_PAYLOAD_SIZE, m as MAX_SIGN_REQUEST_PAYLOAD_SIZE, n as MAX_SIGN_REQUEST_SIZE, o as MultikeyPublicKey, R as RevocationChecker, p as RevocationPayload, S as ServiceEntry, q as ServicesArray, r as SignRequestPayload, s as Signer, V as VerifiedDFOSCredential, t as VerifiedDelegationChain, u as VerifiedIdentity, v as createDFOSCredential, w as decodeDFOSCredentialUnsafe, x as isAttenuated, y as matchesResource, z as parseProtocolTimestampUnix, B as verifyDFOSCredential, E as verifyDelegationChain } from './dfos-credential-X6uvPIth.js';
 export { AnchorKind, CreditClaimFailureReason, CreditClaimVerifyError, CreditEntry, CreditEntryState, ED25519_PRIV_MULTICODEC, ED25519_PUB_MULTICODEC, RECOGNIZED_SERVICE_TYPES, SignRequestFailureReason, SignRequestVerifyError, VerifiedArtifact, VerifiedContentChain, VerifiedCountersignature, VerifiedCreditClaim, VerifiedCreditEntry, VerifiedRevocation, VerifiedSignRequest, anchorsByLabel, assertCanonicalSignRequestPayload, assertServicesWithinCap, buildSignRequest, classifyAnchor, decodeMultikey, deriveChainIdentifier, deriveContentId, encodeEd25519Multikey, isRecognizedServiceType, relayEndpoints, signArtifact, signContentOperation, signCountersignature, signCreditClaim, signIdentityOperation, signRevocation, verifyArtifact, verifyContentChain, verifyContentExtensionFromTrustedState, verifyCountersignature, verifyCreditClaim, verifyCreditEntry, verifyIdentityChain, verifyIdentityExtensionFromTrustedState, verifyRevocation, verifySignRequest } from './chain/index.js';
-export { AuthTokenCreateOptions, AuthTokenVerificationError, AuthTokenVerifyOptions, VerifiedAuthToken, createAuthToken, verifyAuthToken } from './credentials/index.js';
+export { ApiRequestVerifyError, DEFAULT_PROOF_SKEW_SECONDS, DEFAULT_PROOF_WINDOW_SECONDS, DFOS_AUTH_SCHEME, EMPTY_BODY_SHA256, IDENTITY_PROOF_JWS_TYP, IdentityProofPayload, MAX_BODY_BYTES, MAX_PROOF_FRESHNESS_SPAN_SECONDS, MAX_REQUEST_PROOF_SIZE, ParsedProofPayload, ProofEnvelopeInput, ProofExtraMembers, ProofPresenterState, REQUEST_PROOF_JWS_TYP, RequestProofFailurePhase, RequestProofFailureReason, RequestProofPayload, ResolveProofPresenter, SignApiIdentityRequestInput, SignApiRequestInput, VerifiedProofEnvelope, apiIdentitySigningInput, apiRequestSigningInput, assertProofVerifierConfig, buildApiAuthHeaders, buildApiIdentityHeaders, canonicalExtraMembers, invalidProof, misconfiguredProof, parseDfosAuthorization, sha256BodyHash, signApiIdentityRequest, signApiRequest, unverifiableProof, verifyIdentityProofEnvelope, verifyRequestProofEnvelope } from './credentials/index.js';
 export { FoldOperation, INDEX_V1_SCHEMA, IndexDelta, IndexDocument, IndexEntry, LwwDelta, OrderKey, byteCompare, compareHeadPreference, compareLinear, foldIndexV1, foldLwwMap, linearize } from './fold/index.js';
 import 'multiformats';
 import 'multiformats/cid';