@metalabel/dfos-protocol 0.37.0 → 0.38.0

package/dist/index.js

@@ -49,27 +49,48 @@ import {
   verifyIdentityExtensionFromTrustedState,
   verifyRevocation,
   verifySignRequest
-} from "./chunk-W7IFQNUH.js";
+} from "./chunk-SGPSXM56.js";
 import {
+  ApiRequestVerifyError,
   Attenuation,
-  AuthTokenClaims,
-  AuthTokenVerificationError,
   CredentialVerificationError,
+  DEFAULT_PROOF_SKEW_SECONDS,
+  DEFAULT_PROOF_WINDOW_SECONDS,
   DFOSCredentialPayload,
+  DFOS_AUTH_SCHEME,
   ED25519_PRIV_MULTICODEC,
   ED25519_PUB_MULTICODEC,
+  EMPTY_BODY_SHA256,
+  IDENTITY_PROOF_JWS_TYP,
+  MAX_BODY_BYTES,
   MAX_CREDENTIAL_SIZE,
-  createAuthToken,
+  MAX_PROOF_FRESHNESS_SPAN_SECONDS,
+  MAX_REQUEST_PROOF_SIZE,
+  REQUEST_PROOF_JWS_TYP,
+  apiIdentitySigningInput,
+  apiRequestSigningInput,
+  assertProofVerifierConfig,
+  buildApiAuthHeaders,
+  buildApiIdentityHeaders,
+  canonicalExtraMembers,
   createDFOSCredential,
   decodeDFOSCredentialUnsafe,
   decodeMultikey,
   encodeEd25519Multikey,
+  invalidProof,
   isAttenuated,
   matchesResource,
-  verifyAuthToken,
+  misconfiguredProof,
+  parseDfosAuthorization,
+  sha256BodyHash,
+  signApiIdentityRequest,
+  signApiRequest,
+  unverifiableProof,
   verifyDFOSCredential,
-  verifyDelegationChain
-} from "./chunk-XP644GQK.js";
+  verifyDelegationChain,
+  verifyIdentityProofEnvelope,
+  verifyRequestProofEnvelope
+} from "./chunk-NXQW6EBF.js";
 import {
   JwsVerificationError,
   JwtVerificationError,
@@ -106,34 +127,42 @@ import {
 } from "./chunk-XF7T45EQ.js";
 export {
   ARTIFACT_CID_ANCHOR_RE,
+  ApiRequestVerifyError,
   ArtifactPayload,
   Attenuation,
-  AuthTokenClaims,
-  AuthTokenVerificationError,
   CONTENT_ID_ANCHOR_RE,
   ContentOperation,
   CountersignPayload,
   CredentialVerificationError,
   CreditClaimPayload,
   CreditClaimVerifyError,
+  DEFAULT_PROOF_SKEW_SECONDS,
+  DEFAULT_PROOF_WINDOW_SECONDS,
   DFOSCredentialPayload,
+  DFOS_AUTH_SCHEME,
   ED25519_PRIV_MULTICODEC,
   ED25519_PUB_MULTICODEC,
+  EMPTY_BODY_SHA256,
+  IDENTITY_PROOF_JWS_TYP,
   INDEX_V1_SCHEMA,
   IdentityOperation,
   Iso8601,
   JwsVerificationError,
   JwtVerificationError,
   MAX_ARTIFACT_PAYLOAD_SIZE,
+  MAX_BODY_BYTES,
   MAX_CREDENTIAL_SIZE,
   MAX_CREDIT_CLAIM_SIZE,
   MAX_OPERATION_SIZE,
+  MAX_PROOF_FRESHNESS_SPAN_SECONDS,
+  MAX_REQUEST_PROOF_SIZE,
   MAX_SERVICES_ENTRIES,
   MAX_SERVICES_PAYLOAD_SIZE,
   MAX_SIGN_REQUEST_PAYLOAD_SIZE,
   MAX_SIGN_REQUEST_SIZE,
   MultikeyPublicKey,
   RECOGNIZED_SERVICE_TYPES,
+  REQUEST_PROOF_JWS_TYP,
   RevocationPayload,
   ServiceEntry,
   ServicesArray,
@@ -141,17 +170,22 @@ export {
   SignRequestVerifyError,
   VerifiedIdentity,
   anchorsByLabel,
+  apiIdentitySigningInput,
+  apiRequestSigningInput,
   assertCanonicalSignRequestPayload,
   assertJwsProfile,
+  assertProofVerifierConfig,
   assertServicesWithinCap,
   base64urlDecode,
   base64urlEncode,
+  buildApiAuthHeaders,
+  buildApiIdentityHeaders,
   buildSignRequest,
   byteCompare,
+  canonicalExtraMembers,
   classifyAnchor,
   compareHeadPreference,
   compareLinear,
-  createAuthToken,
   createDFOSCredential,
   createJws,
   createJwt,
@@ -169,6 +203,7 @@ export {
   generateId,
   generateIdNoPrefix,
   importEd25519Keypair,
+  invalidProof,
   isAttenuated,
   isCanonicallyEqual,
   isRecognizedServiceType,
@@ -176,11 +211,16 @@ export {
   isValidId,
   linearize,
   matchesResource,
+  misconfiguredProof,
   normalizedId,
   parseDagCborCID,
+  parseDfosAuthorization,
   parseProtocolTimestampUnix,
   relayEndpoints,
   sha256,
+  sha256BodyHash,
+  signApiIdentityRequest,
+  signApiRequest,
   signArtifact,
   signContentOperation,
   signCountersignature,
@@ -188,8 +228,8 @@ export {
   signIdentityOperation,
   signPayloadEd25519,
   signRevocation,
+  unverifiableProof,
   verifyArtifact,
-  verifyAuthToken,
   verifyContentChain,
   verifyContentExtensionFromTrustedState,
   verifyCountersignature,
@@ -199,8 +239,10 @@ export {
   verifyDelegationChain,
   verifyIdentityChain,
   verifyIdentityExtensionFromTrustedState,
+  verifyIdentityProofEnvelope,
   verifyJws,
   verifyJwt,
+  verifyRequestProofEnvelope,
   verifyRevocation,
   verifySignRequest
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metalabel/dfos-protocol",
-  "version": "0.37.0",
+  "version": "0.38.0",
   "type": "module",
   "description": "DFOS Protocol — Ed25519 signed chain primitives, services, credentials, and verification",
   "license": "MIT",

package/dist/chunk-XP644GQK.js

@@ -1,394 +0,0 @@
-import {
-  createJws,
-  createJwt,
-  dagCborCanonicalEncode,
-  decodeJwsUnsafe,
-  verifyJws,
-  verifyJwt
-} from "./chunk-4LG2GEB2.js";
-
-// src/credentials/schemas.ts
-import { z } from "zod";
-var MAX_ATT = 32;
-var MAX_PRF = 1;
-var MAX_CREDENTIAL_SIZE = 262144;
-var Attenuation = z.looseObject({
-  resource: z.string().min(1),
-  action: z.string().min(1)
-});
-var DFOSCredentialPayload = z.looseObject({
-  version: z.literal(1),
-  type: z.literal("DFOSCredential"),
-  /** Issuer DID */
-  iss: z.string().min(1),
-  /** Audience DID or "*" for public credentials */
-  aud: z.string().min(1),
-  /** Attenuations — resource + action pairs */
-  att: z.array(Attenuation).min(1).max(MAX_ATT),
-  /** Parent credential JWS tokens (for delegation chains) */
-  prf: z.array(z.string()).max(MAX_PRF).default([]),
-  /** Expiration — unix seconds */
-  exp: z.number().int().positive(),
-  /** Issued at — unix seconds */
-  iat: z.number().int().positive()
-});
-var AuthTokenClaims = z.looseObject({
-  /** Issuer — the DID proving identity */
-  iss: z.string(),
-  /** Subject — same as iss for auth tokens */
-  sub: z.string(),
-  /** Audience — target relay hostname (prevents cross-relay replay) */
-  aud: z.string(),
-  /** Expiration — unix seconds, short-lived (minutes) */
-  exp: z.number().int().positive(),
-  /** Issued at — unix seconds */
-  iat: z.number().int().positive()
-});
-
-// src/credentials/auth-token.ts
-var createAuthToken = async (options) => {
-  if (!options.kid.includes("#")) {
-    throw new Error("kid must be a DID URL (did:dfos:xxx#key_yyy)");
-  }
-  const kidDid = options.kid.substring(0, options.kid.indexOf("#"));
-  if (kidDid !== options.iss) {
-    throw new Error("kid DID does not match iss");
-  }
-  const now = options.iat ?? Math.floor(Date.now() / 1e3);
-  const header = { alg: "EdDSA", typ: "JWT", kid: options.kid };
-  const payload = {
-    iss: options.iss,
-    sub: options.iss,
-    aud: options.aud,
-    exp: options.exp,
-    iat: now
-  };
-  return createJwt({ header, payload, sign: options.sign });
-};
-var verifyAuthToken = (options) => {
-  const { header, payload } = verifyJwt({
-    token: options.token,
-    publicKey: options.publicKey,
-    audience: options.audience,
-    ...options.currentTime !== void 0 ? { currentTime: options.currentTime } : {}
-  });
-  const result = AuthTokenClaims.safeParse(payload);
-  if (!result.success) {
-    const messages = result.error.issues.map((e) => e.message).join(", ");
-    throw new AuthTokenVerificationError(`invalid auth token claims: ${messages}`);
-  }
-  const currentTime = options.currentTime ?? Math.floor(Date.now() / 1e3);
-  if (result.data.iat > currentTime) {
-    throw new AuthTokenVerificationError("auth token not yet valid (iat is in the future)");
-  }
-  const kid = header.kid;
-  if (!kid || !kid.includes("#")) {
-    throw new AuthTokenVerificationError("auth token kid must be a DID URL");
-  }
-  const kidDid = kid.substring(0, kid.indexOf("#"));
-  if (kidDid !== result.data.iss) {
-    throw new AuthTokenVerificationError("auth token kid DID does not match iss");
-  }
-  return {
-    iss: result.data.iss,
-    aud: result.data.aud,
-    exp: result.data.exp,
-    iat: result.data.iat,
-    kid
-  };
-};
-var AuthTokenVerificationError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "AuthTokenVerificationError";
-  }
-};
-
-// src/chain/multikey.ts
-import { base58btc } from "multiformats/bases/base58";
-var ED25519_PUB_PREFIX = new Uint8Array([237, 1]);
-var ED25519_PRIV_PREFIX = new Uint8Array([128, 38]);
-var ED25519_PUB_MULTICODEC = 237;
-var ED25519_PRIV_MULTICODEC = 4864;
-var encodeEd25519Multikey = (publicKeyBytes) => {
-  if (publicKeyBytes.length !== 32) {
-    throw new Error(`expected 32-byte Ed25519 public key, got ${publicKeyBytes.length}`);
-  }
-  const prefixed = new Uint8Array(ED25519_PUB_PREFIX.length + publicKeyBytes.length);
-  prefixed.set(ED25519_PUB_PREFIX);
-  prefixed.set(publicKeyBytes, ED25519_PUB_PREFIX.length);
-  return base58btc.encode(prefixed);
-};
-var decodeMultikey = (multibase) => {
-  const bytes = base58btc.decode(multibase);
-  if (bytes.length < 2) {
-    throw new Error("multikey too short");
-  }
-  if (bytes[0] === ED25519_PUB_PREFIX[0] && bytes[1] === ED25519_PUB_PREFIX[1]) {
-    const keyBytes = bytes.slice(2);
-    if (keyBytes.length !== 32) {
-      throw new Error(`expected 32-byte Ed25519 public key, got ${keyBytes.length}`);
-    }
-    return { keyBytes, codec: ED25519_PUB_MULTICODEC };
-  }
-  if (bytes[0] === ED25519_PRIV_PREFIX[0] && bytes[1] === ED25519_PRIV_PREFIX[1]) {
-    const keyBytes = bytes.slice(2);
-    if (keyBytes.length !== 32) {
-      throw new Error(`expected 32-byte Ed25519 private key, got ${keyBytes.length}`);
-    }
-    return { keyBytes, codec: ED25519_PRIV_MULTICODEC };
-  }
-  throw new Error(
-    `unsupported multikey codec: [0x${bytes[0]?.toString(16)}, 0x${bytes[1]?.toString(16)}]`
-  );
-};
-
-// src/credentials/dfos-credential.ts
-var resolveKeyFromIdentity = (identity, kid) => {
-  const hashIdx = kid.indexOf("#");
-  if (hashIdx < 0) throw new CredentialVerificationError("kid must be a DID URL");
-  const keyId = kid.substring(hashIdx + 1);
-  const allKeys = [...identity.authKeys, ...identity.assertKeys, ...identity.controllerKeys];
-  const key = allKeys.find((k) => k.id === keyId);
-  if (!key) {
-    throw new CredentialVerificationError(`key ${keyId} not found on identity ${identity.did}`);
-  }
-  const { keyBytes } = decodeMultikey(key.publicKeyMultibase);
-  return keyBytes;
-};
-var createDFOSCredential = async (options) => {
-  const kid = `${options.issuerDID}#${options.keyId}`;
-  const now = options.iat ?? Math.floor(Date.now() / 1e3);
-  const payload = {
-    version: 1,
-    type: "DFOSCredential",
-    iss: options.issuerDID,
-    aud: options.audienceDID,
-    att: options.att,
-    prf: options.prf ?? [],
-    exp: options.exp,
-    iat: now
-  };
-  const parseResult = DFOSCredentialPayload.safeParse(payload);
-  if (!parseResult.success) {
-    const messages = parseResult.error.issues.map((e) => e.message).join(", ");
-    throw new Error(`invalid credential payload: ${messages}`);
-  }
-  const encoded = await dagCborCanonicalEncode(payload);
-  const credentialCID = encoded.cid.toString();
-  const jwsToken = await createJws({
-    header: { alg: "EdDSA", typ: "did:dfos:credential", kid, cid: credentialCID },
-    payload,
-    sign: options.signer
-  });
-  return jwsToken;
-};
-var verifyDFOSCredential = async (jwsToken, options) => {
-  if (jwsToken.length > MAX_CREDENTIAL_SIZE) {
-    throw new CredentialVerificationError(
-      `credential exceeds max size: ${jwsToken.length} > ${MAX_CREDENTIAL_SIZE}`
-    );
-  }
-  const decoded = decodeJwsUnsafe(jwsToken);
-  if (!decoded) throw new CredentialVerificationError("failed to decode credential JWS");
-  if (decoded.header.typ !== "did:dfos:credential") {
-    throw new CredentialVerificationError(`invalid typ: ${decoded.header.typ}`);
-  }
-  const result = DFOSCredentialPayload.safeParse(decoded.payload);
-  if (!result.success) {
-    const messages = result.error.issues.map((e) => e.message).join(", ");
-    throw new CredentialVerificationError(`invalid credential payload: ${messages}`);
-  }
-  const payload = result.data;
-  const kid = decoded.header.kid;
-  const hashIdx = kid.indexOf("#");
-  if (hashIdx < 0) throw new CredentialVerificationError("credential kid must be a DID URL");
-  const kidDid = kid.substring(0, hashIdx);
-  if (kidDid !== payload.iss) {
-    throw new CredentialVerificationError("credential kid DID does not match iss");
-  }
-  const identity = await options.resolveIdentity(payload.iss);
-  if (!identity) {
-    throw new CredentialVerificationError(`issuer identity not found: ${payload.iss}`);
-  }
-  if (identity.isDeleted) {
-    throw new CredentialVerificationError(`issuer identity is deleted: ${payload.iss}`);
-  }
-  const publicKey = resolveKeyFromIdentity(identity, kid);
-  try {
-    verifyJws({ token: jwsToken, publicKey });
-  } catch {
-    throw new CredentialVerificationError("invalid credential signature");
-  }
-  const encoded = await dagCborCanonicalEncode(payload);
-  const credentialCID = encoded.cid.toString();
-  if (!decoded.header.cid) {
-    throw new CredentialVerificationError("missing cid in credential header");
-  }
-  if (decoded.header.cid !== credentialCID) {
-    throw new CredentialVerificationError("credential cid mismatch");
-  }
-  const now = options.now ?? Math.floor(Date.now() / 1e3);
-  if (payload.iat > now) {
-    throw new CredentialVerificationError("credential not yet valid (iat is in the future)");
-  }
-  if (payload.exp <= now) {
-    throw new CredentialVerificationError("credential expired");
-  }
-  return {
-    iss: payload.iss,
-    aud: payload.aud,
-    att: payload.att,
-    prf: payload.prf,
-    exp: payload.exp,
-    iat: payload.iat,
-    credentialCID,
-    signerKeyId: kid
-  };
-};
-var verifyDelegationChain = async (credential, options) => {
-  const chain = [credential];
-  let current = credential;
-  const maxDepth = 16;
-  for (let depth = 0; depth < maxDepth; depth++) {
-    if (current.prf.length === 0) {
-      if (current.iss !== options.rootDID) {
-        throw new CredentialVerificationError(
-          `delegation chain root issuer ${current.iss} does not match expected root ${options.rootDID}`
-        );
-      }
-      return { credential, chain, rootDID: options.rootDID };
-    }
-    if (current.prf.length > 1) {
-      throw new CredentialVerificationError(
-        "delegation chain: multi-parent credentials are not supported (prf must have at most one entry)"
-      );
-    }
-    const parent = await verifyDFOSCredential(current.prf[0], {
-      resolveIdentity: options.resolveIdentity,
-      ...options.now !== void 0 ? { now: options.now } : {}
-    });
-    if (options.isRevoked) {
-      const revoked = await options.isRevoked(parent.iss, parent.credentialCID, options.asOfUnix);
-      if (revoked) {
-        throw new CredentialVerificationError("parent credential in delegation chain is revoked");
-      }
-    }
-    if (parent.aud !== "*" && parent.aud !== current.iss) {
-      throw new CredentialVerificationError(
-        `delegation gap: parent credential audience ${parent.aud} does not match child issuer ${current.iss}`
-      );
-    }
-    if (current.exp > parent.exp) {
-      throw new CredentialVerificationError(
-        "delegation chain: child credential expiry exceeds parent expiry"
-      );
-    }
-    if (!isAttenuated(parent.att, current.att)) {
-      throw new CredentialVerificationError(
-        "delegation chain: child credential scope exceeds parent scope"
-      );
-    }
-    chain.push(parent);
-    current = parent;
-  }
-  throw new CredentialVerificationError("delegation chain too deep (max 16 credentials)");
-};
-var parseResource = (resource) => {
-  const colonIdx = resource.indexOf(":");
-  if (colonIdx < 0) return null;
-  return { type: resource.substring(0, colonIdx), id: resource.substring(colonIdx + 1) };
-};
-var parseActions = (action) => new Set(
-  action.split(",").map((a) => a.trim()).filter((a) => a !== "")
-);
-var isAttenuated = (parentAtt, childAtt) => {
-  return childAtt.every((childEntry) => {
-    const childRes = parseResource(childEntry.resource);
-    if (!childRes) return false;
-    const childActions = parseActions(childEntry.action);
-    return parentAtt.some((parentEntry) => {
-      const parentRes = parseResource(parentEntry.resource);
-      if (!parentRes) return false;
-      const parentActions = parseActions(parentEntry.action);
-      for (const a of childActions) {
-        if (!parentActions.has(a)) return false;
-      }
-      if (parentRes.type === "chain" && parentRes.id === "*") {
-        return childRes.type === "chain";
-      }
-      if (childRes.type === "chain" && childRes.id === "*") {
-        return false;
-      }
-      if (childRes.type === "chain" && parentRes.type === "chain") {
-        return childRes.id === parentRes.id;
-      }
-      if (childRes.type !== "chain" && parentRes.type !== "chain") {
-        return childEntry.resource === parentEntry.resource;
-      }
-      return false;
-    });
-  });
-};
-var matchesResource = async (att, resource, action) => {
-  const requestedRes = parseResource(resource);
-  if (!requestedRes) return false;
-  const requestedActions = parseActions(action);
-  for (const entry of att) {
-    const entryRes = parseResource(entry.resource);
-    if (!entryRes) continue;
-    const entryActions = parseActions(entry.action);
-    let actionsCovered = true;
-    for (const a of requestedActions) {
-      if (!entryActions.has(a)) {
-        actionsCovered = false;
-        break;
-      }
-    }
-    if (!actionsCovered) continue;
-    if (entryRes.type === "chain" && entryRes.id === "*" && requestedRes.type === "chain") {
-      return true;
-    }
-    if (entryRes.type === requestedRes.type && entryRes.id === requestedRes.id) {
-      return true;
-    }
-  }
-  return false;
-};
-var decodeDFOSCredentialUnsafe = (jwsToken) => {
-  const decoded = decodeJwsUnsafe(jwsToken);
-  if (!decoded) return null;
-  const result = DFOSCredentialPayload.safeParse(decoded.payload);
-  if (!result.success) return null;
-  return {
-    header: decoded.header,
-    payload: result.data
-  };
-};
-var CredentialVerificationError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "CredentialVerificationError";
-  }
-};
-
-export {
-  ED25519_PUB_MULTICODEC,
-  ED25519_PRIV_MULTICODEC,
-  encodeEd25519Multikey,
-  decodeMultikey,
-  MAX_CREDENTIAL_SIZE,
-  Attenuation,
-  DFOSCredentialPayload,
-  AuthTokenClaims,
-  createAuthToken,
-  verifyAuthToken,
-  AuthTokenVerificationError,
-  createDFOSCredential,
-  verifyDFOSCredential,
-  verifyDelegationChain,
-  isAttenuated,
-  matchesResource,
-  decodeDFOSCredentialUnsafe,
-  CredentialVerificationError
-};