@metalabel/dfos-protocol 0.8.0 → 0.9.0

package/dist/chain/index.js

@@ -24,13 +24,13 @@ import {
   verifyIdentityChain,
   verifyIdentityExtensionFromTrustedState,
   verifyRevocation
-} from "../chunk-LQ56P4SU.js";
+} from "../chunk-UEJ364OG.js";
 import {
   ED25519_PRIV_MULTICODEC,
   ED25519_PUB_MULTICODEC,
   decodeMultikey,
   encodeEd25519Multikey
-} from "../chunk-MEV6QVLC.js";
+} from "../chunk-24VGJGUM.js";
 import "../chunk-ZXXP5W5N.js";
 export {
   ArtifactPayload,

package/dist/{chunk-MEV6QVLC.js → chunk-24VGJGUM.js}

@@ -315,7 +315,7 @@ var isAttenuated = (parentAtt, childAtt) => {
         if (!parentActions.has(a)) return false;
       }
       if (parentRes.type === "chain" && parentRes.id === "*") {
-        return true;
+        return childRes.type === "chain";
       }
       if (childRes.type === "chain" && childRes.id === "*") {
         return false;
@@ -323,17 +323,11 @@ var isAttenuated = (parentAtt, childAtt) => {
       if (childRes.type === "chain" && parentRes.type === "chain") {
         return childRes.id === parentRes.id;
       }
-      if (childRes.type === "chain" && parentRes.type === "manifest") {
-        return true;
-      }
-      if (childRes.type === "manifest" && parentRes.type === "manifest") {
-        return childRes.id === parentRes.id;
-      }
       return false;
     });
   });
 };
-var matchesResource = async (att, resource, action, options) => {
+var matchesResource = async (att, resource, action) => {
   const requestedRes = parseResource(resource);
   if (!requestedRes) return false;
   const requestedActions = parseActions(action);
@@ -355,12 +349,6 @@ var matchesResource = async (att, resource, action, options) => {
     if (entryRes.type === requestedRes.type && entryRes.id === requestedRes.id) {
       return true;
     }
-    if (entryRes.type === "manifest" && requestedRes.type === "chain") {
-      if (options?.manifestLookup) {
-        const indexed = await options.manifestLookup(entryRes.id);
-        if (indexed.includes(requestedRes.id)) return true;
-      }
-    }
   }
   return false;
 };

package/dist/{chunk-LQ56P4SU.js → chunk-UEJ364OG.js}

@@ -4,7 +4,7 @@ import {
   matchesResource,
   verifyDFOSCredential,
   verifyDelegationChain
-} from "./chunk-MEV6QVLC.js";
+} from "./chunk-24VGJGUM.js";
 import {
   createJws,
   dagCborCanonicalEncode,

package/dist/credentials/index.d.ts

@@ -179,12 +179,8 @@ declare const verifyDelegationChain: (credential: VerifiedDFOSCredential, option
  *
  * - `chain:X` covered by `chain:X` (exact match)
  * - `chain:X` covered by `chain:*` (narrowing from wildcard — valid)
- * - `chain:X` covered by `manifest:M` (narrowing from manifest — valid structurally)
- * - `manifest:M` covered by `chain:*` (narrowing from wildcard — valid)
- * - `manifest:M` covered by `manifest:M` (exact match)
- * - `manifest:M` NOT covered by `chain:X` (widening — invalid)
  * - `chain:*` covered by `chain:*` (exact match)
- * - `chain:*` NOT covered by `chain:X` or `manifest:M` (widening — invalid)
+ * - `chain:*` NOT covered by `chain:X` (widening — invalid)
  * - Actions: child action set must be a subset of parent action set
  */
 declare const isAttenuated: (parentAtt: Attenuation[], childAtt: Attenuation[]) => boolean;
@@ -193,14 +189,8 @@ declare const isAttenuated: (parentAtt: Attenuation[], childAtt: Attenuation[])
  *
  * Used at the relay to determine if a credential authorizes access to a
  * specific content chain.
- *
- * For `manifest:` resources, requires a `manifestLookup` callback to resolve
- * which contentIds the manifest indexes. Without the callback, `manifest:`
- * resources can only match exact `manifest:` requests, not `chain:` requests.
  */
-declare const matchesResource: (att: Attenuation[], resource: string, action: string, options?: {
-    manifestLookup?: (manifestContentId: string) => Promise<string[]>;
-}) => Promise<boolean>;
+declare const matchesResource: (att: Attenuation[], resource: string, action: string) => Promise<boolean>;
 /**
  * Decode a DFOS credential JWS without verifying the signature
  *

package/dist/credentials/index.js

@@ -12,7 +12,7 @@ import {
   verifyAuthToken,
   verifyDFOSCredential,
   verifyDelegationChain
-} from "../chunk-MEV6QVLC.js";
+} from "../chunk-24VGJGUM.js";
 import "../chunk-ZXXP5W5N.js";
 export {
   Attenuation,

package/dist/index.js

@@ -24,7 +24,7 @@ import {
   verifyIdentityChain,
   verifyIdentityExtensionFromTrustedState,
   verifyRevocation
-} from "./chunk-LQ56P4SU.js";
+} from "./chunk-UEJ364OG.js";
 import {
   buildMerkleTree,
   generateMerkleProof,
@@ -50,7 +50,7 @@ import {
   verifyAuthToken,
   verifyDFOSCredential,
   verifyDelegationChain
-} from "./chunk-MEV6QVLC.js";
+} from "./chunk-24VGJGUM.js";
 import {
   JwsVerificationError,
   JwtVerificationError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metalabel/dfos-protocol",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "type": "module",
   "description": "DFOS Protocol — Ed25519 signed chain primitives, beacons, merkle trees, and verification",
   "license": "MIT",