@oma3/omatrust 0.1.0-alpha.12 → 0.1.0-alpha.13

package/dist/reputation/index.cjs

@@ -5,10 +5,33 @@ var ethers = require('ethers');
 var jose = require('jose');
 var canonicalize = require('canonicalize');
 var promises = require('dns/promises');
+var cid = require('multiformats/cid');
+require('multiformats/hashes/sha2');
+var raw = require('multiformats/codecs/raw');
+var base32 = require('multiformats/bases/base32');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
+function _interopNamespace(e) {
+  if (e && e.__esModule) return e;
+  var n = Object.create(null);
+  if (e) {
+    Object.keys(e).forEach(function (k) {
+      if (k !== 'default') {
+        var d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: function () { return e[k]; }
+        });
+      }
+    });
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+
 var canonicalize__default = /*#__PURE__*/_interopDefault(canonicalize);
+var raw__namespace = /*#__PURE__*/_interopNamespace(raw);
 
 // src/reputation/submit.ts
 
@@ -16,10 +39,10 @@ var canonicalize__default = /*#__PURE__*/_interopDefault(canonicalize);
 var OmaTrustError = class extends Error {
   code;
   details;
-  constructor(code, message, details) {
+  constructor(code2, message, details) {
     super(message);
     this.name = "OmaTrustError";
-    this.code = code;
+    this.code = code2;
     this.details = details;
   }
 };
@@ -200,14 +223,14 @@ function extractExpirationTime(data) {
 }
 
 // src/shared/assert.ts
-function assertString(value, name, code = "INVALID_INPUT") {
+function assertString(value, name, code2 = "INVALID_INPUT") {
   if (typeof value !== "string" || value.trim().length === 0) {
-    throw new OmaTrustError(code, `${name} must be a non-empty string`, { value });
+    throw new OmaTrustError(code2, `${name} must be a non-empty string`, { value });
   }
 }
-function assertObject(value, name, code = "INVALID_INPUT") {
+function assertObject(value, name, code2 = "INVALID_INPUT") {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new OmaTrustError(code, `${name} must be an object`, { value });
+    throw new OmaTrustError(code2, `${name} must be an object`, { value });
   }
 }
 
@@ -1597,10 +1620,10 @@ function validateReceiptPayload(payload) {
   }
   return { valid: true };
 }
-function failure(code, message, partial) {
+function failure(code2, message, partial) {
   return {
     valid: false,
-    error: { code, message },
+    error: { code: code2, message },
     ...partial
   };
 }
@@ -1798,10 +1821,10 @@ function validateReceiptPayload2(payload) {
   }
   return { valid: true };
 }
-function failure2(code, message, partial) {
+function failure2(code2, message, partial) {
   return {
     valid: false,
-    error: { code, message },
+    error: { code: code2, message },
     ...partial
   };
 }
@@ -2319,8 +2342,8 @@ async function readOwnerFromContract(provider, contractAddress, signature, metho
 }
 async function discoverContractOwner(provider, contractAddress) {
   try {
-    const code = await provider.getCode(contractAddress);
-    if (code === "0x" || code === "0x0") {
+    const code2 = await provider.getCode(contractAddress);
+    if (code2 === "0x" || code2 === "0x0") {
       return null;
     }
   } catch {
@@ -3016,8 +3039,8 @@ async function verifyDidPkhOwnership(params) {
       subjectDid: params.subjectDid
     });
   }
-  const code = await params.provider.getCode(subjectAddress);
-  const isContract = code !== "0x" && code !== "0x0";
+  const code2 = await params.provider.getCode(subjectAddress);
+  const isContract = code2 !== "0x" && code2 !== "0x0";
   if (!isContract) {
     if (ethers.getAddress(subjectAddress) === ethers.getAddress(connectedWalletAddress)) {
       return {
@@ -3487,6 +3510,364 @@ function verifyKeyBindingProofs(data) {
     reasons
   };
 }
+var DID_ARTIFACT_PREFIX = "did:artifact:";
+var CID_VERSION = 1;
+var RAW_CODEC = raw__namespace.code;
+var SHA2_256_CODE = 18;
+var SHA2_256_DIGEST_LENGTH = 32;
+function parseArtifactDid(did) {
+  if (typeof did !== "string" || !did.startsWith(DID_ARTIFACT_PREFIX)) {
+    throw new OmaTrustError("INVALID_DID", "Expected a did:artifact DID", { did });
+  }
+  const identifier = did.slice(DID_ARTIFACT_PREFIX.length);
+  if (!identifier || identifier.length === 0) {
+    throw new OmaTrustError("INVALID_DID", "Missing method-specific identifier", { did });
+  }
+  if (identifier[0] !== "b") {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `Invalid multibase prefix "${identifier[0]}", expected "b" (base32lower)`,
+      { did }
+    );
+  }
+  let cid$1;
+  try {
+    cid$1 = cid.CID.parse(identifier, base32.base32);
+  } catch (err) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      "Failed to decode base32 CID from did:artifact identifier",
+      { did, cause: err }
+    );
+  }
+  if (cid$1.version !== CID_VERSION) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `CID version must be 1, got ${cid$1.version}`,
+      { did }
+    );
+  }
+  if (cid$1.code !== RAW_CODEC) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `Multicodec must be raw (0x55), got 0x${cid$1.code.toString(16)}`,
+      { did }
+    );
+  }
+  if (cid$1.multihash.code !== SHA2_256_CODE) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `Multihash function must be sha2-256 (0x12), got 0x${cid$1.multihash.code.toString(16)}`,
+      { did }
+    );
+  }
+  if (cid$1.multihash.digest.length !== SHA2_256_DIGEST_LENGTH) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `SHA-256 digest must be 32 bytes, got ${cid$1.multihash.digest.length}`,
+      { did }
+    );
+  }
+  const digest = cid$1.multihash.digest;
+  const digestHex = Array.from(digest).map((b) => b.toString(16).padStart(2, "0")).join("");
+  return { did, identifier, digest, digestHex };
+}
+
+// src/reputation/artifact-verification.ts
+async function verifyResponsibilityClaim(params) {
+  const {
+    attestation,
+    artifactDid,
+    provider,
+    easContractAddress,
+    chain,
+    chainId,
+    responsibilityClaimSchemaString
+  } = params;
+  const reasons = [];
+  const checks = {
+    schemaValid: false,
+    subjectMatches: false,
+    notRevoked: false,
+    currentlyEffective: false,
+    controllerAuthorized: false,
+    issuedDuringAuthorizationWindow: false
+  };
+  let decoded;
+  try {
+    if (attestation.raw) {
+      decoded = decodeAttestationData(responsibilityClaimSchemaString, attestation.raw);
+    } else if (attestation.data && typeof attestation.data === "object") {
+      decoded = attestation.data;
+    } else {
+      reasons.push("No attestation data available to decode");
+      return buildFailedResult(checks, reasons);
+    }
+  } catch (err) {
+    reasons.push(
+      `Failed to decode attestation data: ${err instanceof Error ? err.message : "unknown error"}`
+    );
+    return buildFailedResult(checks, reasons);
+  }
+  const responsibleParty = decoded.responsibleParty;
+  const subject = decoded.subject;
+  const responsibilityType = decoded.responsibilityType;
+  const issuedAt = decoded.issuedAt;
+  const effectiveAt = decoded.effectiveAt;
+  const expiresAt = decoded.expiresAt;
+  const subjectLabel = decoded.subjectLabel;
+  if (!responsibleParty || !subject || !responsibilityType || !issuedAt) {
+    if (!responsibleParty) reasons.push("Missing required field: responsibleParty");
+    if (!subject) reasons.push("Missing required field: subject");
+    if (!responsibilityType) reasons.push("Missing required field: responsibilityType");
+    if (!issuedAt) reasons.push("Missing required field: issuedAt");
+    return buildFailedResult(checks, reasons, {
+      responsibleParty,
+      subjectLabel,
+      responsibilityType
+    });
+  }
+  if (!Array.isArray(responsibilityType) || responsibilityType.length === 0) {
+    reasons.push("responsibilityType must be a non-empty array");
+    return buildFailedResult(checks, reasons, {
+      responsibleParty,
+      subjectLabel,
+      responsibilityType
+    });
+  }
+  checks.schemaValid = true;
+  if (artifactDid) {
+    checks.subjectMatches = subject.toLowerCase() === artifactDid.toLowerCase();
+    if (!checks.subjectMatches) {
+      reasons.push(`Subject "${subject}" does not match expected artifact "${artifactDid}"`);
+    }
+  } else {
+    checks.subjectMatches = true;
+  }
+  checks.notRevoked = attestation.revocationTime === BigInt(0);
+  if (!checks.notRevoked) {
+    reasons.push("Attestation has been revoked");
+  }
+  const now = BigInt(Math.floor(Date.now() / 1e3));
+  const effectiveTime = toBigInt(effectiveAt);
+  const expirationTime = toBigInt(expiresAt);
+  const isEffective = effectiveTime === BigInt(0) || effectiveTime <= now;
+  const isNotExpired = expirationTime === BigInt(0) || expirationTime > now;
+  checks.currentlyEffective = isEffective && isNotExpired;
+  if (!isEffective) {
+    reasons.push("Attestation is not yet effective");
+  }
+  if (!isNotExpired) {
+    reasons.push("Attestation has expired");
+  }
+  const controllerDid = `did:pkh:eip155:${chainId}:${attestation.attester.toLowerCase()}`;
+  let authorization = null;
+  try {
+    const resolvedChain = chain ?? `eip155:${chainId}`;
+    authorization = await getControllerAuthorization({
+      subjectDid: responsibleParty,
+      controllerDid,
+      provider,
+      chain: resolvedChain,
+      easContractAddress
+    });
+    checks.controllerAuthorized = authorization.authorized;
+    if (!checks.controllerAuthorized) {
+      reasons.push(`Controller ${controllerDid} is not authorized for ${responsibleParty}`);
+    }
+    if (authorization.authorized && authorization.anchoredFrom !== null) {
+      const issuedAtBigInt = toBigInt(issuedAt);
+      const afterStart = issuedAtBigInt >= authorization.anchoredFrom;
+      const beforeEnd = authorization.until === null || issuedAtBigInt <= authorization.until;
+      checks.issuedDuringAuthorizationWindow = afterStart && beforeEnd;
+      if (!afterStart) {
+        reasons.push("Attestation was issued before the authorization window started");
+      }
+      if (!beforeEnd) {
+        reasons.push("Attestation was issued after the authorization window ended");
+      }
+    } else if (authorization.authorized && authorization.anchoredFrom === null) {
+      checks.issuedDuringAuthorizationWindow = true;
+    } else {
+      checks.issuedDuringAuthorizationWindow = false;
+    }
+  } catch (err) {
+    reasons.push(
+      `Controller authorization check failed: ${err instanceof Error ? err.message : "unknown error"}`
+    );
+    checks.controllerAuthorized = false;
+    checks.issuedDuringAuthorizationWindow = false;
+  }
+  const valid = Object.values(checks).every(Boolean);
+  return {
+    valid,
+    responsibleParty,
+    controllerDid,
+    responsibilityTypes: responsibilityType,
+    subjectLabel: subjectLabel || void 0,
+    authorization,
+    checks,
+    reasons
+  };
+}
+async function getVerifiedArtifactAttestations(params) {
+  const {
+    artifactDid,
+    provider,
+    easContractAddress,
+    chain,
+    chainId,
+    schemaUids,
+    responsibilityClaimSchemaUid,
+    responsibilityClaimSchemaString,
+    securityAssessmentSchemaUid,
+    certificationSchemaUid,
+    fromBlock,
+    limit
+  } = params;
+  parseArtifactDid(artifactDid);
+  if (schemaUids.length === 0) {
+    return {
+      artifactDid,
+      responsibilityClaims: [],
+      securityAssessments: [],
+      certifications: [],
+      otherAttestations: []
+    };
+  }
+  const results = await listAttestations({
+    subjectDid: artifactDid,
+    provider,
+    easContractAddress,
+    schemas: schemaUids,
+    limit: limit ?? 100,
+    fromBlock
+  });
+  const responsibilityClaims = [];
+  const securityAssessments = [];
+  const certifications = [];
+  const otherAttestations = [];
+  for (const att of results) {
+    const schemaUidLower = att.schema.toLowerCase();
+    if (schemaUidLower === responsibilityClaimSchemaUid.toLowerCase()) {
+      const verification = await verifyResponsibilityClaim({
+        attestation: att,
+        artifactDid,
+        provider,
+        easContractAddress,
+        chain,
+        chainId,
+        responsibilityClaimSchemaString
+      });
+      responsibilityClaims.push({ attestation: att, verification });
+    } else if (securityAssessmentSchemaUid && schemaUidLower === securityAssessmentSchemaUid.toLowerCase()) {
+      const verification = await runStandardVerification(att, provider);
+      securityAssessments.push({ attestation: att, verification });
+    } else if (certificationSchemaUid && schemaUidLower === certificationSchemaUid.toLowerCase()) {
+      const verification = await runStandardVerification(att, provider);
+      certifications.push({ attestation: att, verification });
+    } else {
+      const verification = await runStandardVerification(att, provider);
+      otherAttestations.push({ attestation: att, verification });
+    }
+  }
+  return {
+    artifactDid,
+    responsibilityClaims,
+    securityAssessments,
+    certifications,
+    otherAttestations
+  };
+}
+async function isArtifactClaimedBy(params) {
+  const { artifactDid, responsibleParty, responsibilityTypes } = params;
+  const result = await getVerifiedArtifactAttestations({
+    artifactDid,
+    provider: params.provider,
+    easContractAddress: params.easContractAddress,
+    chain: params.chain,
+    chainId: params.chainId,
+    schemaUids: params.schemaUids,
+    responsibilityClaimSchemaUid: params.responsibilityClaimSchemaUid,
+    responsibilityClaimSchemaString: params.responsibilityClaimSchemaString,
+    securityAssessmentSchemaUid: params.securityAssessmentSchemaUid,
+    certificationSchemaUid: params.certificationSchemaUid
+  });
+  const matchingClaims = result.responsibilityClaims.filter(
+    (claim) => claim.verification.responsibleParty.toLowerCase() === responsibleParty.toLowerCase()
+  );
+  const validClaims = matchingClaims.filter((claim) => claim.verification.valid);
+  let finalClaims = validClaims;
+  let matchedTypes = [];
+  if (responsibilityTypes && responsibilityTypes.length > 0) {
+    finalClaims = validClaims.filter(
+      (claim) => claim.verification.responsibilityTypes.some(
+        (t) => responsibilityTypes.includes(t)
+      )
+    );
+    matchedTypes = [
+      ...new Set(
+        finalClaims.flatMap(
+          (claim) => claim.verification.responsibilityTypes.filter(
+            (t) => responsibilityTypes.includes(t)
+          )
+        )
+      )
+    ];
+  } else {
+    matchedTypes = [
+      ...new Set(
+        validClaims.flatMap((claim) => claim.verification.responsibilityTypes)
+      )
+    ];
+  }
+  const reasons = [];
+  if (finalClaims.length === 0) {
+    if (matchingClaims.length === 0) {
+      reasons.push(
+        `No responsibility claims found from ${responsibleParty} for this artifact`
+      );
+    } else if (validClaims.length === 0) {
+      reasons.push(
+        `Claims from ${responsibleParty} exist but none passed verification`
+      );
+    } else if (responsibilityTypes) {
+      reasons.push(
+        `No claims matched the requested responsibility types: ${responsibilityTypes.join(", ")}`
+      );
+    }
+  }
+  return {
+    claimed: finalClaims.length > 0,
+    claims: finalClaims,
+    matchedResponsibilityTypes: matchedTypes,
+    reasons
+  };
+}
+function toBigInt(value) {
+  if (value === void 0 || value === null) return BigInt(0);
+  if (typeof value === "bigint") return value;
+  return BigInt(value);
+}
+function buildFailedResult(checks, reasons, decoded) {
+  return {
+    valid: false,
+    responsibleParty: decoded?.responsibleParty ?? "",
+    controllerDid: "",
+    responsibilityTypes: decoded?.responsibilityType ?? [],
+    subjectLabel: decoded?.subjectLabel || void 0,
+    authorization: null,
+    checks,
+    reasons
+  };
+}
+async function runStandardVerification(attestation, provider) {
+  try {
+    return await verifyAttestation({ attestation, provider });
+  } catch {
+    return void 0;
+  }
+}
 
 exports.EIP1967_ADMIN_SLOT = EIP1967_ADMIN_SLOT;
 exports.OWNERSHIP_PATTERNS = OWNERSHIP_PATTERNS;
@@ -3529,7 +3910,9 @@ exports.getMajorVersion = getMajorVersion;
 exports.getOmaTrustProofEip712Types = getOmaTrustProofEip712Types;
 exports.getSchemaDetails = getSchemaDetails;
 exports.getSupportedChainIds = getSupportedChainIds;
+exports.getVerifiedArtifactAttestations = getVerifiedArtifactAttestations;
 exports.hashSeed = hashSeed;
+exports.isArtifactClaimedBy = isArtifactClaimedBy;
 exports.isChainSupported = isChainSupported;
 exports.listAttestations = listAttestations;
 exports.normalizeSchema = normalizeSchema;
@@ -3553,6 +3936,7 @@ exports.verifyEip712Signature = verifyEip712Signature;
 exports.verifyKeyBindingProofs = verifyKeyBindingProofs;
 exports.verifyLinkedIdentifierProofs = verifyLinkedIdentifierProofs;
 exports.verifyProof = verifyProof;
+exports.verifyResponsibilityClaim = verifyResponsibilityClaim;
 exports.verifySchemaExists = verifySchemaExists;
 exports.verifySubjectOwnership = verifySubjectOwnership;
 exports.verifyTransferProof = verifyTransferProof;