@metalabel/dfos-protocol 0.52.0 → 0.52.1

package/dist/chain/index.js

@@ -52,9 +52,9 @@ import {
   verifyIdentityExtensionFromTrustedState,
   verifyRevocation,
   verifySignRequest
-} from "../chunk-OU2DPHCN.js";
-import "../chunk-IV3TIYKP.js";
-import "../chunk-QRCOMLAP.js";
+} from "../chunk-Q7FREWMY.js";
+import "../chunk-FZHHSC5N.js";
+import "../chunk-BMIOY5W5.js";
 import {
   ED25519_PRIV_MULTICODEC,
   ED25519_PUB_MULTICODEC,
@@ -62,7 +62,7 @@ import {
   decodeMultikey,
   encodeEd25519Multikey
 } from "../chunk-F7RHI2CK.js";
-import "../chunk-QTJZGXMH.js";
+import "../chunk-KAW4MT4P.js";
 export {
   ARTIFACT_CID_ANCHOR_RE,
   ArtifactPayload,

package/dist/{chunk-QRCOMLAP.js → chunk-BMIOY5W5.js}

@@ -9,7 +9,7 @@ import {
   isValidEd25519Signature,
   sha256,
   signPayloadEd25519
-} from "./chunk-QTJZGXMH.js";
+} from "./chunk-KAW4MT4P.js";
 
 // src/key-proof/role-set.ts
 var KEY_ROLES = ["auth", "assert", "controller"];

package/dist/{chunk-IV3TIYKP.js → chunk-FZHHSC5N.js}

@@ -10,7 +10,7 @@ import {
   decodeJwsUnsafe,
   sha256,
   verifyJws
-} from "./chunk-QTJZGXMH.js";
+} from "./chunk-KAW4MT4P.js";
 
 // src/credentials/schemas.ts
 import { z } from "zod";
@@ -438,6 +438,7 @@ var verifyDFOSCredential = async (jwsToken, options) => {
   }
   const payload = result.data;
   const kid = decoded.header.kid;
+  if (kid === void 0) throw new CredentialVerificationError("credential kid must be present");
   const hashIdx = kid.indexOf("#");
   if (hashIdx < 0) throw new CredentialVerificationError("credential kid must be a DID URL");
   const kidDid = kid.substring(0, hashIdx);
@@ -596,7 +597,7 @@ var matchesResource = async (att, resource, action) => {
 };
 var decodeDFOSCredentialUnsafe = (jwsToken) => {
   const decoded = decodeJwsUnsafe(jwsToken);
-  if (!decoded) return null;
+  if (!decoded || decoded.header.kid === void 0) return null;
   const result = DFOSCredentialPayload.safeParse(decoded.payload);
   if (!result.success) return null;
   return {

package/dist/{chunk-QTJZGXMH.js → chunk-KAW4MT4P.js}

@@ -178,7 +178,7 @@ var decodeJwsSegment = (segmentB64) => {
 var asJwsHeader = (raw) => {
   if (typeof raw["alg"] !== "string") return null;
   if (typeof raw["typ"] !== "string") return null;
-  if (typeof raw["kid"] !== "string") return null;
+  if ("kid" in raw && typeof raw["kid"] !== "string") return null;
   if ("cid" in raw && typeof raw["cid"] !== "string") return null;
   return raw;
 };

package/dist/{chunk-OU2DPHCN.js → chunk-Q7FREWMY.js}

@@ -6,13 +6,13 @@ import {
   matchesResource,
   verifyDFOSCredential,
   verifyDelegationChain
-} from "./chunk-IV3TIYKP.js";
+} from "./chunk-FZHHSC5N.js";
 import {
   KEY_ADD_JWS_TYP,
   KEY_ROLES,
   unsafeKeyProofSubject,
   verifyChainKeyProof
-} from "./chunk-QRCOMLAP.js";
+} from "./chunk-BMIOY5W5.js";
 import {
   decodeEd25519PublicMultikey
 } from "./chunk-F7RHI2CK.js";
@@ -25,7 +25,7 @@ import {
   decodeJwsUnsafe,
   generateIdNoPrefix,
   verifyJws
-} from "./chunk-QTJZGXMH.js";
+} from "./chunk-KAW4MT4P.js";
 
 // src/chain/schemas.ts
 import { z } from "zod";
@@ -560,6 +560,7 @@ var verifyIdentityChain = async (input) => {
       throw new Error(`log[${idx}]: cid mismatch in protected header`);
     }
     const kid = decoded.header.kid;
+    if (kid === void 0) throw new Error(`log[${idx}]: kid must be present`);
     let signingKeyId;
     if (kid.includes("#")) {
       const hashIdx = kid.indexOf("#");
@@ -704,6 +705,7 @@ var verifyIdentityExtensionFromTrustedState = async (input) => {
   if (!decoded.header.cid) throw new Error("missing cid in protected header");
   if (decoded.header.cid !== operationCID) throw new Error("cid mismatch in protected header");
   const kid = decoded.header.kid;
+  if (kid === void 0) throw new Error("kid must be present");
   if (!kid.includes("#")) {
     throw new Error("non-genesis op kid must be DID URL, got bare key ID");
   }
@@ -892,6 +894,7 @@ var verifyContentChain = async (input) => {
       }
     }
     const kid = decoded.header.kid;
+    if (kid === void 0) throw new Error(`log[${idx}]: kid must be present`);
     const hashIdx = kid.indexOf("#");
     if (hashIdx < 0) throw new Error(`log[${idx}]: kid must be a DID URL`);
     const kidDid = kid.substring(0, hashIdx);
@@ -1002,6 +1005,7 @@ var verifyContentExtensionFromTrustedState = async (input) => {
     throw new Error("createdAt must be after last op");
   }
   const kid = decoded.header.kid;
+  if (kid === void 0) throw new Error("kid must be present");
   const hashIdx = kid.indexOf("#");
   if (hashIdx < 0) throw new Error("kid must be a DID URL");
   const kidDid = kid.substring(0, hashIdx);
@@ -1080,6 +1084,7 @@ var verifyCountersignature = async (input) => {
   }
   const payload = result.data;
   const kid = decoded.header.kid;
+  if (kid === void 0) throw new Error("kid must be present");
   const hashIdx = kid.indexOf("#");
   if (hashIdx < 0) throw new Error("countersignature kid must be a DID URL");
   const kidDid = kid.substring(0, hashIdx);
@@ -1133,6 +1138,7 @@ var verifyArtifact = async (input) => {
     throw new Error(`invalid artifact typ: ${decoded.header.typ}`);
   }
   const kid = decoded.header.kid;
+  if (kid === void 0) throw new Error("kid must be present");
   const hashIdx = kid.indexOf("#");
   if (hashIdx < 0) throw new Error("artifact kid must be a DID URL");
   const kidDid = kid.substring(0, hashIdx);
@@ -1190,6 +1196,7 @@ var verifyRevocation = async (input) => {
     throw new Error(`invalid revocation typ: ${decoded.header.typ}`);
   }
   const kid = decoded.header.kid;
+  if (kid === void 0) throw new Error("kid must be present");
   const hashIdx = kid.indexOf("#");
   if (hashIdx < 0) throw new Error("revocation kid must be a DID URL");
   const kidDid = kid.substring(0, hashIdx);
@@ -1295,8 +1302,7 @@ var verifyCreditClaim = async (jwsToken, options) => {
   }
   const decoded = decodeJwsUnsafe(jwsToken);
   if (!decoded) throw invalid("failed to decode credit claim JWS");
-  const rawHeader = decoded.header;
-  if (typeof rawHeader["typ"] !== "string" || typeof rawHeader["kid"] !== "string") {
+  if (typeof decoded.header.kid !== "string") {
     throw invalid("credit claim header must carry a string typ and kid");
   }
   if (decoded.header.typ !== "did:dfos:credit-claim") {
@@ -1522,7 +1528,7 @@ var verifySignRequest = async (jwsToken, options) => {
       throw invalid2("sign request protected header must be an object");
     }
     assertJwsProfile(rawHeader, invalid2);
-    if (typeof rawHeader["typ"] !== "string" || typeof rawHeader["kid"] !== "string") {
+    if (typeof rawHeader["typ"] !== "string" || typeof decoded.header.kid !== "string") {
       throw invalid2("sign request header must carry a string typ and kid");
     }
     if (decoded.header.typ !== "did:dfos:sign-request") {

package/dist/credentials/index.js

@@ -34,9 +34,9 @@ import {
   verifyDelegationChain,
   verifyIdentityProofEnvelope,
   verifyRequestProofEnvelope
-} from "../chunk-IV3TIYKP.js";
+} from "../chunk-FZHHSC5N.js";
 import "../chunk-F7RHI2CK.js";
-import "../chunk-QTJZGXMH.js";
+import "../chunk-KAW4MT4P.js";
 export {
   ApiRequestVerifyError,
   Attenuation,

package/dist/crypto/index.d.ts

@@ -85,7 +85,7 @@ declare const normalizedId: <T extends string>(prefix: T, id: string) => `${T}_$
 interface JwsHeader {
     alg: 'EdDSA';
     typ: string;
-    kid: string;
+    kid?: string;
     /** CIDv1 of the operation payload (dag-cbor + SHA-256), signed in the protected header */
     cid?: string;
 }
@@ -96,7 +96,9 @@ interface JwsHeader {
  * signature (64 bytes)
  */
 declare const createJws: (options: {
-    header: JwsHeader;
+    header: JwsHeader & {
+        kid: string;
+    };
     payload: Record<string, unknown>;
     sign: (message: Uint8Array) => Promise<Uint8Array>;
 }) => Promise<string>;

package/dist/crypto/index.js

@@ -23,7 +23,7 @@ import {
   signPayloadEd25519,
   verifyJws,
   verifyJwt
-} from "../chunk-QTJZGXMH.js";
+} from "../chunk-KAW4MT4P.js";
 export {
   JwsVerificationError,
   JwtVerificationError,

package/dist/index.js

@@ -52,7 +52,7 @@ import {
   verifyIdentityExtensionFromTrustedState,
   verifyRevocation,
   verifySignRequest
-} from "./chunk-OU2DPHCN.js";
+} from "./chunk-Q7FREWMY.js";
 import {
   ApiRequestVerifyError,
   Attenuation,
@@ -92,7 +92,7 @@ import {
   verifyDelegationChain,
   verifyIdentityProofEnvelope,
   verifyRequestProofEnvelope
-} from "./chunk-IV3TIYKP.js";
+} from "./chunk-FZHHSC5N.js";
 import {
   DEFAULT_KEY_PROOF_SKEW_SECONDS,
   KEY_ADD_JWS_TYP,
@@ -109,7 +109,7 @@ import {
   unsafeKeyProofSubject,
   verifyChainKeyProof,
   verifyKeyProof
-} from "./chunk-QRCOMLAP.js";
+} from "./chunk-BMIOY5W5.js";
 import {
   ED25519_PRIV_MULTICODEC,
   ED25519_PUB_MULTICODEC,
@@ -142,7 +142,7 @@ import {
   signPayloadEd25519,
   verifyJws,
   verifyJwt
-} from "./chunk-QTJZGXMH.js";
+} from "./chunk-KAW4MT4P.js";
 import {
   INDEX_V1_SCHEMA,
   byteCompare,

package/dist/key-proof/index.d.ts

@@ -143,7 +143,7 @@ interface SignKeyProofInput {
  * The protected header is EXACTLY `{"alg":"EdDSA","typ":"<purpose>"}` — two
  * members, no `kid` (the key is in no chain and rides in the payload) and no
  * `cid` (there is no operation to bind). It is assembled by hand rather than
- * through `createJws`, whose `JwsHeader` requires a `kid` this envelope must not
+ * through `createJws`, whose header input requires a `kid` this envelope must not
  * carry.
  *
  * HOLDER OBLIGATIONS THIS FUNCTION CANNOT DISCHARGE (INTEGRATIONS.md, Holder

package/dist/key-proof/index.js

@@ -14,9 +14,9 @@ import {
   unsafeKeyProofSubject,
   verifyChainKeyProof,
   verifyKeyProof
-} from "../chunk-QRCOMLAP.js";
+} from "../chunk-BMIOY5W5.js";
 import "../chunk-F7RHI2CK.js";
-import "../chunk-QTJZGXMH.js";
+import "../chunk-KAW4MT4P.js";
 export {
   DEFAULT_KEY_PROOF_SKEW_SECONDS,
   KEY_ADD_JWS_TYP,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metalabel/dfos-protocol",
-  "version": "0.52.0",
+  "version": "0.52.1",
   "type": "module",
   "description": "DFOS Protocol — Ed25519 signed chain primitives, services, credentials, and verification",
   "license": "MIT",