@originator-profile/verify 0.7.0-beta.2 → 0.7.0-beta.4

package/dist/index.d.ts

@@ -40,13 +40,13 @@ declare class CaVerifyFailed extends Error {
 }
 
 /**
- * 検証中の警告メッセージを受け取るハンドラー
- *
- * 検証を失敗とはしない後方互換性のための警告 (非推奨 Certificate や
- * digestSRI の欠落・不一致など) の通知に使用する。
- * デフォルトは `console.warn`。
+ * 検証中のメッセージを受け取るロガー
+ * - `warn`: 警告
+ *   主に互換性 (非推奨 Certificate や digestSRI の欠落・不一致など) の通知に使用
+ * - `info`: システムの正常な動作記録
+ *   (Profile Annotation Issuer 登録証 PA 未保有など、無効性を意味しない状態) の通知に使用する。
  */
-type WarnHandler = (message: string) => void;
+type Logger = Pick<Console, "warn" | "info">;
 
 /**
  * `digestSRI` の検証
@@ -69,8 +69,8 @@ declare function verifyDigestSri(content: DigestSriResult, fetcher?: typeof fetc
 declare function verifyImageDigestSri(value: Image | undefined, options?: {
     /** コンテンツの取得に用いる fetch 実装 */
     fetcher?: typeof fetch;
-    /** 警告ハンドラー (デフォルト: `console.warn`) */
-    warn?: WarnHandler;
+    /** ロガー (デフォルト: `console`) */
+    logger?: Logger;
 }): Promise<void>;
 
 declare class IntegrityFetchFailed extends Error {
@@ -415,31 +415,29 @@ declare function isProfileAnnotationIssuerRegistration(doc: Certificate): doc is
 /**
  * Profile Annotation Issuer 登録証 PA に基づく発行者の認可を確認
  *
- * 各 Profile Annotation の発行者が、Core Profile Issuer から発行された登録証 PA によって、その PA が準拠する 認証制度（Profile Annotation Policy）の発行を認可されているかを検証
- *
- * (2027年まで) 後方互換性のため、認可を確認できない場合も検証は失敗させず warn に留める。
+ * 各 Profile Annotation の発行者が、基底となる Profile Annotation Issuer 登録証 PA によって、その PA が準拠する 認証制度（Profile Annotation Policy）の発行を認可されているかを検証
  *
  * @param verifiedOps 検証済み Originator Profile Set
- * @param cpIssuer 基底となる Core Profile Issuer の OP ID
- * @param warn 警告ハンドラー (デフォルト: `console.warn`)
+ * @param paIssuerRegistrationIssuer 基底となる Profile Annotation Issuer 登録証 PA Issuer の OP ID
+ * @param logger ロガー (デフォルト: `console`)
  *
  * @see https://docs.originator-profile.org/opb/pa-model/profile-annotation-issuer-registration/
  */
-declare function verifyAnnotationIssuerRegistration(verifiedOps: VerifiedOps, cpIssuer: string | string[], warn?: WarnHandler): VerifiedOps;
+declare function verifyAnnotationIssuerRegistration(verifiedOps: VerifiedOps, paIssuerRegistrationIssuer: string | string[], logger?: Logger): VerifiedOps;
 
 /**
  * Originator Profile Set の検証者の作成
  * @param ops Originator Profile Set
  * @param keys Core Profile の発行者の検証鍵
  * @param issuer Core Profile の発行者
- * @param options バリデーターと警告ハンドラー
+ * @param options バリデーターとロガー
  * @returns 検証者
  */
 declare function OpsVerifier(ops: OriginatorProfileSet, keys: Keys, issuer: string | string[], options?: {
     /** バリデーター */
     validator?: typeof VcValidator;
-    /** 警告ハンドラー (デフォルト: `console.warn`) */
-    warn?: WarnHandler;
+    /** ロガー (デフォルト: `console`) */
+    logger?: Logger;
 }): () => Promise<OpsVerificationResult>;
 
 type OpId = string;
@@ -492,7 +490,7 @@ type SpVerificationResult = VerifiedSp | SiteProfileInvalid | SiteProfileVerifyF
  * @param keys Core Profile の発行者の検証鍵
  * @param issuer Core Profile の発行者
  * @param origin 提示するWebサイトを識別するための RFC 6454 オリジン
- * @param options オリジン検証の可否・バリデーター・警告ハンドラー
+ * @param options オリジン検証の可否・バリデーター・ロガー
  * @returns 検証者
  */
 declare function SpVerifier(sp: SiteProfile, keys: Keys, issuer: string | string[], origin: URL["origin"], options?: {
@@ -500,8 +498,8 @@ declare function SpVerifier(sp: SiteProfile, keys: Keys, issuer: string | string
     verifyOrigin?: boolean;
     /** バリデーター */
     validator?: typeof VcValidator;
-    /** 警告ハンドラー (デフォルト: `console.warn`) */
-    warn?: WarnHandler;
+    /** ロガー (デフォルト: `console`) */
+    logger?: Logger;
 }): () => Promise<SpVerificationResult>;
 
 /**
@@ -513,4 +511,4 @@ declare function SpVerifier(sp: SiteProfile, keys: Keys, issuer: string | string
 declare function verifyAllowedOrigin(origin: URL["origin"], allowedOrigins: AllowedOrigin): boolean;
 
 export { CaInvalid, CaVerifier, CaVerifyFailed, CasVerifyFailed, CertificateExpired, CoreProfileNotFound, IntegrityFetchFailed, IntegrityVerificationFailed, OpInvalid, OpVerifyFailed, OpsInvalid, OpsVerifier, OpsVerifyFailed, SiteProfileInvalid, SiteProfileVerifyFailed, SpVerifier, TargetIntegrityAlgorithm, VerifyResultFactory, article, caId, caUrl, certificate, cp, decodeOps, getAnnotationPolicy, getMappedKeys, getTupledKeys, isProfileAnnotationIssuerRegistration, normalizeCasItem, opId, patch, verifyAllowedOrigin, verifyAnnotationIssuerRegistration, verifyCas, verifyDigestSri, verifyImageDigestSri, verifyIntegrity, wmp, wsp };
-export type { CaDecodingFailure, CaDecodingResult, CaVerificationFailure, CaVerificationResult, CasItem, CasVerificationFailure, CasVerificationResult, Certificate, DecodedCa, DecodedOp, DecodedOps, FetchIntegrityResult, IntegrityVerifyResult, MappedKeys, OpDecodingFailure, OpDecodingResult, OpVerificationFailure, OpVerificationResult, OpsDecodingFailure, OpsDecodingResult, OpsVerificationFailure, OpsVerificationResult, SpVerificationFailure, SpVerificationResult, TupledKeys, VerifiedCa, VerifiedCas, VerifiedOp, VerifiedOps, VerifiedSp, VerifyIntegrity, WarnHandler };
+export type { CaDecodingFailure, CaDecodingResult, CaVerificationFailure, CaVerificationResult, CasItem, CasVerificationFailure, CasVerificationResult, Certificate, DecodedCa, DecodedOp, DecodedOps, FetchIntegrityResult, IntegrityVerifyResult, Logger, MappedKeys, OpDecodingFailure, OpDecodingResult, OpVerificationFailure, OpVerificationResult, OpsDecodingFailure, OpsDecodingResult, OpsVerificationFailure, OpsVerificationResult, SpVerificationFailure, SpVerificationResult, TupledKeys, VerifiedCa, VerifiedCas, VerifiedOp, VerifiedOps, VerifiedSp, VerifyIntegrity };

package/dist/index.js

@@ -316,10 +316,10 @@ async function verifyDigestSri(content, fetcher = fetch) {
   }
 }
 async function verifyImageDigestSri(value, options = {}) {
-  const { fetcher = fetch, warn = console.warn } = options;
+  const { fetcher = fetch, logger = console } = options;
   if (!value) return;
   if (!value.digestSRI) {
-    warn(`digestSRI is missing. ${WARN_SUFFIX}`);
+    logger.warn(`digestSRI is missing. ${WARN_SUFFIX}`);
     return;
   }
   const valid = await verifyDigestSri(
@@ -327,7 +327,7 @@ async function verifyImageDigestSri(value, options = {}) {
     fetcher
   );
   if (!valid) {
-    warn(`digestSRI verification failed. ${WARN_SUFFIX}`);
+    logger.warn(`digestSRI verification failed. ${WARN_SUFFIX}`);
   }
 }
 
@@ -1006,12 +1006,12 @@ const isProfileAnnotation = (doc) => doc.type.includes("ProfileAnnotation");
 function isProfileAnnotationIssuerRegistration(doc) {
   return doc.credentialSubject.type === "ProfileAnnotationIssuerRegistration";
 }
-function buildProfileAnnotationPolicy(verifiedOps, cpIssuers) {
+function buildProfileAnnotationPolicy(verifiedOps, paIssuerRegistrationIssuers) {
   const policy = /* @__PURE__ */ new Map();
   const annotations = verifiedOps.flatMap((op) => op.annotations ?? []);
   for (const { doc } of annotations) {
     if (!isProfileAnnotationIssuerRegistration(doc)) continue;
-    if (!cpIssuers.has(doc.issuer)) continue;
+    if (!paIssuerRegistrationIssuers.has(doc.issuer)) continue;
     const { id: registrationIssuer, annotationScheme } = doc.credentialSubject;
     const allowedPolicy = policy.get(registrationIssuer) ?? /* @__PURE__ */ new Set();
     for (const scheme of annotationScheme) allowedPolicy.add(scheme);
@@ -1024,30 +1024,31 @@ function reportUnauthorizedAnnotation({
   opIndex,
   paIndex,
   policy,
-  cpIssuers,
-  warn
+  logger
 }) {
   const { doc } = annotation;
   const { issuer: profileAnnotationIssuer } = doc;
   const location = `OP[${opIndex}].PA[${paIndex}]`;
   if (!isProfileAnnotation(doc)) {
-    warn(`Certificate is deprecated (${location})`);
-    return;
-  }
-  if (isProfileAnnotationIssuerRegistration(doc) && cpIssuers.has(profileAnnotationIssuer)) {
+    logger.warn(`Certificate is deprecated (${location})`);
     return;
   }
   const policyId = getAnnotationPolicy(doc)?.id;
   const isAllowed = policyId && policy.get(profileAnnotationIssuer)?.has(policyId);
   if (!isAllowed) {
-    warn(
+    logger.info(
       `Profile Annotation Issuer is not registered for this annotation scheme (${location} issuer: ${profileAnnotationIssuer}, scheme: ${policyId ?? "unknown"})`
     );
   }
 }
-function verifyAnnotationIssuerRegistration(verifiedOps, cpIssuer, warn = console.warn) {
-  const cpIssuers = new Set([cpIssuer].flat());
-  const policy = buildProfileAnnotationPolicy(verifiedOps, cpIssuers);
+function verifyAnnotationIssuerRegistration(verifiedOps, paIssuerRegistrationIssuer, logger = console) {
+  const paIssuerRegistrationIssuers = new Set(
+    [paIssuerRegistrationIssuer].flat()
+  );
+  const policy = buildProfileAnnotationPolicy(
+    verifiedOps,
+    paIssuerRegistrationIssuers
+  );
   for (const [opIndex, op] of verifiedOps.entries()) {
     for (const [paIndex, annotation] of op.annotations?.entries() ?? []) {
       reportUnauthorizedAnnotation({
@@ -1055,8 +1056,7 @@ function verifyAnnotationIssuerRegistration(verifiedOps, cpIssuer, warn = consol
         opIndex,
         paIndex,
         policy,
-        cpIssuers,
-        warn
+        logger
       });
     }
   }
@@ -1086,7 +1086,7 @@ function validateCertificateExpiry(verifiedVc) {
   return verifiedVc;
 }
 async function verifyAnnotations(paIssuerKeys, annotations, options = {}) {
-  const { validator, warn } = options;
+  const { validator, logger = console } = options;
   if (!annotations) return;
   return await Promise.all(
     annotations.map(async (annotation) => {
@@ -1112,14 +1112,16 @@ async function verifyAnnotations(paIssuerKeys, annotations, options = {}) {
       if (valid instanceof CertificateExpired) {
         return valid;
       }
-      await verifyImageDigestSri(valid.doc.credentialSubject.image, { warn });
+      await verifyImageDigestSri(valid.doc.credentialSubject.image, {
+        logger
+      });
       return valid;
     })
   );
 }
 
 async function verifyMedia(wmpIssuerKeys, media, options = {}) {
-  const { validator, warn } = options;
+  const { validator, logger = console } = options;
   if (!media) return;
   return await Promise.all(
     media.map(async (m) => {
@@ -1132,7 +1134,9 @@ async function verifyMedia(wmpIssuerKeys, media, options = {}) {
       if (result instanceof Error) {
         return result;
       }
-      await verifyImageDigestSri(result.doc.credentialSubject.logo, { warn });
+      await verifyImageDigestSri(result.doc.credentialSubject.logo, {
+        logger
+      });
       return result;
     })
   );
@@ -1149,7 +1153,7 @@ function generateErrorDetails(items, opIndex, prefix, sources) {
 }
 const isVerifiedOps = (ops) => ops.every((op) => !(op instanceof OpVerifyFailed));
 function OpsVerifier(ops, keys, issuer, options = {}) {
-  const { validator, warn } = options;
+  const { validator, logger = console } = options;
   const decoded = decodeOps(ops);
   const verifyCp = JwtVcVerifier(
     keys,
@@ -1167,11 +1171,11 @@ function OpsVerifier(ops, keys, issuer, options = {}) {
         const annotations = await verifyAnnotations(
           paOrWmpIssuerKeys,
           op.annotations,
-          { validator, warn }
+          { validator, logger }
         );
         const media = await verifyMedia(paOrWmpIssuerKeys, op.media, {
           validator,
-          warn
+          logger
         });
         const resultOp = { core, annotations, media };
         if (core instanceof Error) {
@@ -1207,7 +1211,7 @@ function OpsVerifier(ops, keys, issuer, options = {}) {
       const msg = verifyFailedIndexes.length > 0 ? `Originator Profile Set verify failed (${verifyFailedIndexes.map((i) => `OP[${i}]`).join(", ")})` : "Originator Profile Set verify failed";
       return new OpsVerifyFailed(msg, resultOps);
     }
-    return verifyAnnotationIssuerRegistration(resultOps, issuer, warn);
+    return verifyAnnotationIssuerRegistration(resultOps, issuer, logger);
   }
   return verify;
 }
@@ -1256,11 +1260,11 @@ const decodeWebsiteProfiles = (sp, opsVerified) => {
   };
 };
 function SpVerifier(sp, keys, issuer, origin, options = {}) {
-  const { verifyOrigin = true, validator, warn } = options;
+  const { verifyOrigin = true, validator, logger = console } = options;
   async function verify() {
     const verifyOps = OpsVerifier(sp.originators, keys, issuer, {
       validator,
-      warn
+      logger
     });
     const opsVerified = await verifyOps();
     if (opsVerified instanceof OpsInvalid) {
@@ -1311,7 +1315,7 @@ function SpVerifier(sp, keys, issuer, origin, options = {}) {
           }
         }
         await verifyImageDigestSri(verified.doc.credentialSubject.image, {
-          warn
+          logger
         });
         return verified;
       })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@originator-profile/verify",
-  "version": "0.7.0-beta.2",
+  "version": "0.7.0-beta.4",
   "license": "Apache-2.0",
   "homepage": "https://docs.originator-profile.org",
   "repository": {
@@ -27,11 +27,11 @@
     "jose": "^6.2.2",
     "jsonld": "^9.0.0",
     "zod": "^4.3.6",
-    "@originator-profile/core": "0.7.0-beta.2",
-    "@originator-profile/securing-mechanism": "0.7.0-beta.2",
-    "@originator-profile/cryptography": "0.7.0-beta.2",
-    "@originator-profile/sign": "0.7.0-beta.2",
-    "@originator-profile/model": "0.7.0-beta.2"
+    "@originator-profile/cryptography": "0.7.0-beta.4",
+    "@originator-profile/securing-mechanism": "0.7.0-beta.4",
+    "@originator-profile/core": "0.7.0-beta.4",
+    "@originator-profile/sign": "0.7.0-beta.4",
+    "@originator-profile/model": "0.7.0-beta.4"
   },
   "devDependencies": {
     "@playwright/test": "1.59.1",
@@ -48,7 +48,7 @@
     "vite": "8.0.16",
     "vitest": "4.1.4",
     "websri": "1.0.1",
-    "@originator-profile/tsconfig": "0.7.0-beta.2"
+    "@originator-profile/tsconfig": "0.7.0-beta.4"
   },
   "scripts": {
     "build": "pkgroll --clean-dist",