@openentity/sdk 0.3.0 → 0.5.1

package/dist/index.d.ts

@@ -20,7 +20,7 @@ export interface KeyPair {
 }
 export declare function keyPairFromJwk(privateJwk: JsonWebKey): Promise<KeyPair>;
 export declare function generateKeyPair(): Promise<KeyPair>;
-/** Deterministic key pair from a 32-byte seed. For test vectors only. */
+/** Deterministic key pair from a 32-byte seed: test vectors, and `Identity` (sdk/ts/src/node.ts), which keeps the seed. */
 export declare function keyPairFromSeed(seed32: Uint8Array): Promise<KeyPair>;
 export declare function didKeyFromPublicKey(pk: Uint8Array): string;
 export declare function publicKeyFromDidKey(did: string): Uint8Array;
@@ -208,4 +208,186 @@ export declare function agentCard(doc: {
         tags: string[];
     }[];
 };
+type IssuerOpts = {
+    issuer?: string;
+    keyId?: string;
+    now?: Date;
+};
+/** A signed Attestation (spec 8.2). `ttlSeconds` defaults to 90 days and is capped at one year. */
+export declare function signAttestation(kp: KeyPair, o: IssuerOpts & {
+    subject: string;
+    claimType: string;
+    claim: object;
+    evidence?: object;
+    confidence?: number;
+    ttlSeconds?: number;
+}): Promise<{
+    spec: string;
+    type: string;
+    issuer: string;
+    subject: string;
+    claim_type: string;
+    claim: object;
+    evidence?: object | undefined;
+    confidence?: number | undefined;
+    created: string;
+    expires: string;
+} & {
+    proof: Proof;
+}>;
+/** A signed Revocation naming the attestation (the object, or its SHA-256 hex) (spec 8.4). */
+export declare function signRevocation(kp: KeyPair, attested: object | string, o?: IssuerOpts & {
+    reason?: string;
+}): Promise<{
+    spec: string;
+    type: string;
+    issuer: string;
+    attestation_sha256: string;
+    reason?: string | undefined;
+    created: string;
+} & {
+    proof: Proof;
+}>;
+/** The body of `https://<domain>/.well-known/did.json` for a did:web issuer. */
+export declare function buildDidDocument(did: string, publicKey: Uint8Array, keyId?: string): {
+    "@context": string[];
+    id: string;
+    verificationMethod: {
+        id: string;
+        type: string;
+        controller: string;
+        publicKeyMultibase: string;
+    }[];
+    assertionMethod: string[];
+    authentication: string[];
+};
+/** The unsigned body of `https://<domain>/.well-known/openentity.json`: the domain alias proof (spec 3.4) and, under
+ * `extensions["openentity:observer"]`, an observer's methodology (spec 8.4). */
+export declare function buildOpenEntityJson(did: string, publicKey: Uint8Array, o: {
+    name: string;
+    description: string;
+    keyId?: string;
+    operator?: object;
+    extensions?: object;
+}): {
+    spec: string;
+    eid: string;
+    name: string;
+    description: string;
+    keys: {
+        id: string;
+        type: string;
+        publicKeyMultibase: string;
+    }[];
+    operator: object;
+    extensions?: object | undefined;
+};
+/** The registry's allowlist for the unsigned `client` label on POST /v1/adopt. */
+export declare const CLIENTS: readonly ["adk", "goose", "langchain", "ui-tars", "cli", "other"];
+export type Client = (typeof CLIENTS)[number];
+/** Adopt `kp` on a registry: document, Declaration and the seq-1 declaration entry (spec 5.2, 6.2, 7.3). `client` is not signed. */
+export declare function adopt(kp: KeyPair, o: {
+    name: string;
+    description?: string;
+    registry?: string;
+    client?: Client;
+}): Promise<{
+    response: any;
+    did: string;
+    document: object & {
+        proof: Proof;
+    };
+    declaration: object & {
+        proof: Proof;
+    };
+    recordEntry: {
+        spec: string;
+        type: string;
+        eid: string;
+        seq: number;
+        prev: null;
+        kind: string;
+        at: string;
+        payload: {
+            declaration_version: string;
+            sha256: string;
+        };
+    } & {
+        proof: Proof;
+    };
+    recordPushed: boolean;
+}>;
+export interface TrustReport {
+    eid: string;
+    /** false: a read failed or a signature did not verify. Treat the entity as untrusted. */
+    ok: boolean;
+    error?: string;
+    level?: string;
+    withdrawn: boolean;
+    /** issuer DID to its newest live tier (0 to 4) */
+    trustTier: Record<string, number>;
+    /** claim of the newest live custom:securemyagent:security_posture */
+    securityPosture: Record<string, any> | null;
+    /** live custom:clawgrc:violation */
+    violations: {
+        issuer: string;
+        severity: string;
+        policy: string;
+        observed_at: string;
+        sha256: string;
+    }[];
+    /** verified revocations of the accepted attestations */
+    revocations: {
+        sha256: string;
+        claim_type: string;
+        issuer: string;
+        reason?: string;
+        at: string;
+    }[];
+}
+type FetchJson = (url: string) => Promise<any>;
+export declare const clearTrustCache: () => void;
+/** did:web through /.well-known/did.json (or <path>/did.json); everything else offline. */
+export declare function didWebResolver(fetchJson?: FetchJson): Resolver;
+/**
+ * One TrustReport from `GET /v1/entities/{eid}` and `/attestations` only. Every attestation and revocation from the accepted
+ * issuers is verified locally against the issuer's key; any failure returns an untrusted report. Cached for 5 minutes.
+ */
+export declare function trust(eid: string, o?: {
+    registry?: string;
+    now?: Date;
+    fetchJson?: FetchJson;
+    resolver?: Resolver;
+}): Promise<TrustReport>;
+export declare class HttpSigError extends Error {
+    code: string;
+    constructor(code: string);
+}
+export declare function httpSigBase(method: string, url: string, components: string[], digest: string | undefined, params: string): Uint8Array;
+/** Sign a request. `privateKey` is a KeyPair or a 32-byte Ed25519 seed. Returns Signature-Input, Signature and, for a non-empty body, Content-Digest. */
+export declare function signRequest(o: {
+    method: string;
+    url: string;
+    body?: Uint8Array;
+    privateKey: KeyPair | Uint8Array;
+    did: string;
+    created?: number;
+    expiresIn?: number;
+    nonce?: string;
+}): Promise<Record<string, string>>;
+/** Verify a request signed by signRequest. Throws HttpSigError with `.code`. Nonce replay tracking is the caller's job. */
+export declare function verifyRequest(o: {
+    method: string;
+    url: string;
+    headers: Record<string, string>;
+    body?: Uint8Array;
+    now?: number;
+    maxAge?: number;
+}): Promise<{
+    did: string;
+    keyid: string;
+    created: number;
+    expires: number;
+    nonce: string;
+}>;
 export {};