@metalabel/dfos-protocol 0.49.0 → 0.50.0

package/dist/chain/index.js

@@ -52,8 +52,8 @@ import {
   verifyIdentityExtensionFromTrustedState,
   verifyRevocation,
   verifySignRequest
-} from "../chunk-ZRA7FRBE.js";
-import "../chunk-D4IZXFPM.js";
+} from "../chunk-JGFFADPR.js";
+import "../chunk-MHSBBYDO.js";
 import "../chunk-JVSC67DC.js";
 import {
   ED25519_PRIV_MULTICODEC,

package/dist/{chunk-ZRA7FRBE.js → chunk-JGFFADPR.js}

@@ -1,10 +1,12 @@
 import {
   MAX_CREDENTIAL_SIZE,
+  carryDependencyMissing,
   decodeDFOSCredentialUnsafe,
+  markDependencyMissing,
   matchesResource,
   verifyDFOSCredential,
   verifyDelegationChain
-} from "./chunk-D4IZXFPM.js";
+} from "./chunk-MHSBBYDO.js";
 import {
   KEY_ADD_JWS_TYP,
   KEY_ROLES,
@@ -846,7 +848,10 @@ var verifyContentChain = async (input) => {
         });
       } catch (err) {
         const message = err instanceof Error ? err.message : "unknown error";
-        throw new Error(`log[${idx}]: authorization verification failed: ${message}`);
+        throw carryDependencyMissing(
+          err,
+          new Error(`log[${idx}]: authorization verification failed: ${message}`)
+        );
       }
     }
     const encoded = await dagCborCanonicalEncode(op);
@@ -951,7 +956,7 @@ var verifyContentExtensionFromTrustedState = async (input) => {
       });
     } catch (err) {
       const message = err instanceof Error ? err.message : "unknown error";
-      throw new Error(`authorization verification failed: ${message}`);
+      throw carryDependencyMissing(err, new Error(`authorization verification failed: ${message}`));
     }
   }
   const encoded = await dagCborCanonicalEncode(op);
@@ -1151,7 +1156,7 @@ var resolveKeyFromIdentity = (identity, kid) => {
   const allKeys = [...identity.authKeys, ...identity.assertKeys, ...identity.controllerKeys];
   const key = allKeys.find((k) => k.id === keyId);
   if (!key) {
-    throw invalid(`key ${keyId} not found on identity ${identity.did}`);
+    throw markDependencyMissing(invalid(`key ${keyId} not found on identity ${identity.did}`));
   }
   const { keyBytes } = decodeMultikey(key.publicKeyMultibase);
   return keyBytes;
@@ -1241,7 +1246,7 @@ var verifyCreditClaim = async (jwsToken, options) => {
     throw unverifiable(`could not resolve claimant identity ${payload.did}: ${detail}`);
   }
   if (!identity) {
-    throw unverifiable(`claimant identity not found: ${payload.did}`);
+    throw markDependencyMissing(unverifiable(`claimant identity not found: ${payload.did}`));
   }
   const publicKey = resolveKeyFromIdentity(identity, kid);
   try {

package/dist/{chunk-D4IZXFPM.js → chunk-MHSBBYDO.js}

@@ -364,6 +364,11 @@ var verifyProofEnvelope = async (input, shape, resolvePresenter) => {
 var verifyIdentityProofEnvelope = (input, resolvePresenter) => verifyProofEnvelope(input, IDENTITY_PROOF_SHAPE, resolvePresenter);
 var verifyRequestProofEnvelope = (input, resolvePresenter) => verifyProofEnvelope(input, REQUEST_PROOF_SHAPE, resolvePresenter);
 
+// src/dependency.ts
+var markDependencyMissing = (err) => Object.assign(err, { dependencyMissing: true });
+var isDependencyMissing = (err) => err instanceof Error && err.dependencyMissing === true;
+var carryDependencyMissing = (cause, wrapped) => isDependencyMissing(cause) ? markDependencyMissing(wrapped) : wrapped;
+
 // src/credentials/dfos-credential.ts
 var resolveKeyFromIdentity = (identity, kid) => {
   const hashIdx = kid.indexOf("#");
@@ -372,7 +377,9 @@ var resolveKeyFromIdentity = (identity, kid) => {
   const allKeys = [...identity.authKeys, ...identity.assertKeys, ...identity.controllerKeys];
   const key = allKeys.find((k) => k.id === keyId);
   if (!key) {
-    throw new CredentialVerificationError(`key ${keyId} not found on identity ${identity.did}`);
+    throw markDependencyMissing(
+      new CredentialVerificationError(`key ${keyId} not found on identity ${identity.did}`)
+    );
   }
   const { keyBytes } = decodeMultikey(key.publicKeyMultibase);
   return keyBytes;
@@ -430,7 +437,9 @@ var verifyDFOSCredential = async (jwsToken, options) => {
   }
   const identity = await options.resolveIdentity(payload.iss);
   if (!identity) {
-    throw new CredentialVerificationError(`issuer identity not found: ${payload.iss}`);
+    throw markDependencyMissing(
+      new CredentialVerificationError(`issuer identity not found: ${payload.iss}`)
+    );
   }
   if (identity.isDeleted) {
     throw new CredentialVerificationError(`issuer identity is deleted: ${payload.iss}`);
@@ -594,6 +603,9 @@ var CredentialVerificationError = class extends Error {
 };
 
 export {
+  markDependencyMissing,
+  isDependencyMissing,
+  carryDependencyMissing,
   MAX_CREDENTIAL_SIZE,
   Attenuation,
   DFOSCredentialPayload,

package/dist/credentials/index.js

@@ -34,7 +34,7 @@ import {
   verifyDelegationChain,
   verifyIdentityProofEnvelope,
   verifyRequestProofEnvelope
-} from "../chunk-D4IZXFPM.js";
+} from "../chunk-MHSBBYDO.js";
 import "../chunk-IDVYITX7.js";
 import "../chunk-4LG2GEB2.js";
 export {

package/dist/index.d.ts

@@ -7,3 +7,24 @@ export { FoldOperation, INDEX_V1_SCHEMA, IndexDelta, IndexDocument, IndexEntry,
 import 'multiformats';
 import 'multiformats/cid';
 import 'zod';
+
+/**
+ * Mark an error as "a referenced identity or key is not resolvable HERE".
+ *
+ * Returns the same error so it can be marked inline at a throw site:
+ * `throw markDependencyMissing(new CredentialVerificationError(...))`.
+ */
+declare const markDependencyMissing: <E extends Error>(err: E) => E;
+/** True if `err` carries the marker. */
+declare const isDependencyMissing: (err: unknown) => boolean;
+/**
+ * Carry the marker from a caught error onto the error that replaces it.
+ *
+ * This is the TypeScript spelling of Go's `%w`: a layer that re-throws with more
+ * context must not eat the one fact only the inner layer knew. Every re-wrap
+ * between a resolver and a relay's classifier goes through this, or the marker
+ * is lost at that boundary and the classification silently reverts to a guess.
+ */
+declare const carryDependencyMissing: <E extends Error>(cause: unknown, wrapped: E) => E;
+
+export { carryDependencyMissing, isDependencyMissing, markDependencyMissing };

package/dist/index.js

@@ -52,7 +52,7 @@ import {
   verifyIdentityExtensionFromTrustedState,
   verifyRevocation,
   verifySignRequest
-} from "./chunk-ZRA7FRBE.js";
+} from "./chunk-JGFFADPR.js";
 import {
   ApiRequestVerifyError,
   Attenuation,
@@ -74,10 +74,13 @@ import {
   buildApiAuthHeaders,
   buildApiIdentityHeaders,
   canonicalExtraMembers,
+  carryDependencyMissing,
   createDFOSCredential,
   decodeDFOSCredentialUnsafe,
   invalidProof,
   isAttenuated,
+  isDependencyMissing,
+  markDependencyMissing,
   matchesResource,
   misconfiguredProof,
   parseDfosAuthorization,
@@ -89,7 +92,7 @@ import {
   verifyDelegationChain,
   verifyIdentityProofEnvelope,
   verifyRequestProofEnvelope
-} from "./chunk-D4IZXFPM.js";
+} from "./chunk-MHSBBYDO.js";
 import {
   DEFAULT_KEY_PROOF_SKEW_SECONDS,
   KEY_ADD_JWS_TYP,
@@ -213,6 +216,7 @@ export {
   buildSignRequest,
   byteCompare,
   canonicalExtraMembers,
+  carryDependencyMissing,
   classifyAnchor,
   compareHeadPreference,
   compareLinear,
@@ -237,12 +241,14 @@ export {
   isAttenuated,
   isCanonicalRoleSet,
   isCanonicallyEqual,
+  isDependencyMissing,
   isRecognizedServiceType,
   isValidEd25519Signature,
   isValidId,
   keyProofSigningInput,
   keyWordFingerprint,
   linearize,
+  markDependencyMissing,
   matchesResource,
   misconfiguredProof,
   normalizedId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metalabel/dfos-protocol",
-  "version": "0.49.0",
+  "version": "0.50.0",
   "type": "module",
   "description": "DFOS Protocol — Ed25519 signed chain primitives, services, credentials, and verification",
   "license": "MIT",