@oxyhq/contracts 0.3.0 → 0.4.0

package/dist/esm/civic.js

@@ -0,0 +1,160 @@
+/**
+ * Civic / Commons API contracts (Fase 1 — DNI + crypto-owned reputation).
+ *
+ * SINGLE SOURCE OF TRUTH for the wire shape of the public "DNI" card a Commons
+ * user shows (and others scan): the user's DID, display identity, trust tier,
+ * personhood status, verified domains, and credential badges — sealed with an
+ * Oxy custodial attestation so a scanner can verify it OFFLINE against the Oxy
+ * public key (the same `ES256K-DER-SHA256` scheme as the signed data export).
+ *
+ * The QR encodes ONLY the DID (`oxydni://card?did=…`) — never trust data — so a
+ * card cannot be spoofed by crafting a QR; the scanner resolves the signed card
+ * server-side and verifies the Oxy signature. The attestation is computed over
+ * the canonical-JSON of the `card` object, so a consumer re-canonicalizes the
+ * card it received and verifies `attestation.signature` against
+ * `attestation.publicKey` (which MUST be a current verification method of the
+ * Oxy DID).
+ *
+ * Explicit-`interface` exports (PublicCard, SignedPublicCard) follow the same
+ * node-resolution rationale as `UserNameResponse` / the identity contracts: a
+ * nested `z.infer<>` can degrade to `{}` under a consumer's
+ * `moduleResolution: "node"`, so the load-bearing shapes are declared as literal
+ * interfaces and the runtime schemas are annotated `z.ZodType<Interface>`.
+ *
+ * The `attestation` reuses the export-bundle `ExportAttestation` shape from
+ * `./identity` (mirrored, not duplicated): `{ issuer, publicKey, alg, signature,
+ * signedAt }`. It is `null` ONLY when the Oxy signing key is unconfigured (dev).
+ *
+ * Platform-agnostic — zod only, no react/react-native/expo, ESM-safe.
+ */
+import { z } from 'zod';
+import { exportAttestationSchema } from './identity.js';
+export const publicCardSchema = z.object({
+    did: z.string(),
+    userId: z.string(),
+    name: z.string(),
+    username: z.string().optional(),
+    avatarUrl: z.string().optional(),
+    trustTier: z.enum(['restricted', 'new', 'trusted', 'high_trust', 'verified']),
+    personhoodStatus: z.enum(['unverified', 'pending', 'verified']),
+    verifiedDomains: z.array(z.string()),
+    credentialBadges: z.array(z.string()),
+    issuedAt: z.number(),
+});
+export const signedPublicCardSchema = z.object({
+    card: publicCardSchema,
+    attestation: exportAttestationSchema.nullable(),
+});
+export const realLifeAttestationRecordSchema = z.object({
+    about: z.string(),
+    context: z.string(),
+    nonce: z.string(),
+    exp: z.number(),
+    geohash: z.string().optional(),
+    biometricOk: z.boolean().optional(),
+});
+export const realLifeAttestationResultSchema = z.object({
+    accepted: z.literal(true),
+    recordId: z.string(),
+    subjectUserId: z.string(),
+    attestorUserId: z.string(),
+    points: z.number(),
+});
+export const validationVerdictRecordSchema = z.object({
+    requestId: z.string(),
+    payloadHash: z.string(),
+    verdict: z.enum(['valid', 'invalid', 'abstain']),
+});
+/** Request body for opening a validation request (`POST /civic/validations`). */
+export const validationOpenRequestSchema = z.object({
+    subjectUserId: z.string(),
+    actionType: z.string().min(1),
+    sourceActionId: z.string().min(1),
+    payload: z.record(z.unknown()),
+    highValue: z.boolean().optional(),
+});
+export const validationOpenResultSchema = z.object({
+    requestId: z.string(),
+    selectedValidatorCount: z.number(),
+    expiresAt: z.string(),
+});
+export const validationRequestSummarySchema = z.object({
+    id: z.string(),
+    subjectUserId: z.string(),
+    actionType: z.string(),
+    payload: z.record(z.unknown()),
+    payloadHash: z.string(),
+    status: z.enum(['pending', 'quorum_met', 'validated', 'rejected', 'expired']),
+    highValue: z.boolean(),
+    expiresAt: z.string(),
+});
+export const validationVoteResultSchema = z.object({
+    recorded: z.literal(true),
+    requestId: z.string(),
+    verdict: z.enum(['valid', 'invalid', 'abstain']),
+    status: z.enum(['pending', 'quorum_met', 'validated', 'rejected', 'expired']),
+});
+export const personhoodVouchRecordSchema = z.object({
+    about: z.string(),
+    context: z.string().optional(),
+    stake: z.number().optional(),
+});
+export const personhoodBreakdownSchema = z.object({
+    vouchSignal: z.number(),
+    realLifeSignal: z.number(),
+    biometricSignal: z.number(),
+    evidence: z.number(),
+    sybilPenalty: z.number(),
+    seed: z.boolean(),
+});
+export const personhoodStatusResultSchema = z.object({
+    userId: z.string(),
+    score: z.number(),
+    isRealPerson: z.boolean(),
+    vouchCount: z.number(),
+    realLifeCount: z.number(),
+    biometricBound: z.boolean(),
+    sybilPenalty: z.number(),
+    breakdown: personhoodBreakdownSchema.nullable(),
+    updatedAt: z.string().nullable(),
+});
+export const vouchResultSchema = z.object({
+    accepted: z.literal(true),
+    recordId: z.string(),
+    subjectUserId: z.string(),
+    voucherUserId: z.string(),
+    stakeAmount: z.number(),
+    points: z.number(),
+});
+export const credentialRecordSchema = z.object({
+    about: z.string(),
+    types: z.array(z.string().min(1)).min(1),
+    claims: z.record(z.unknown()),
+    expiresAt: z.number().optional(),
+});
+export const verifiableCredentialResponseSchema = z.object({
+    id: z.string(),
+    recordId: z.string(),
+    holderUserId: z.string(),
+    holderDid: z.string(),
+    issuerUserId: z.string().optional(),
+    issuerDid: z.string(),
+    types: z.array(z.string()),
+    claims: z.record(z.unknown()),
+    status: z.enum(['active', 'revoked', 'expired']),
+    issuedAt: z.number(),
+    expiresAt: z.number().optional(),
+    revokedAt: z.number().optional(),
+});
+export const credentialIssueResultSchema = z.object({
+    accepted: z.literal(true),
+    credential: verifiableCredentialResponseSchema,
+});
+export const credentialListResultSchema = z.object({
+    credentials: z.array(verifiableCredentialResponseSchema),
+});
+export const credentialVerifyResultSchema = z.object({
+    valid: z.boolean(),
+    reason: z.string().optional(),
+    credential: verifiableCredentialResponseSchema.nullable(),
+});

package/dist/esm/identity.js

@@ -59,16 +59,97 @@ export const didDocumentSchema = z.object({
     alsoKnownAs: z.array(z.string()),
     service: z.array(didServiceSchema),
 });
-export const signedRecordEnvelopeSchema = z.object({
-    version: z.literal(1),
-    type: z.enum(['identity', 'profile']),
+export const signedRecordEnvelopeSchema = z
+    .object({
+    version: z.union([z.literal(1), z.literal(2)]),
+    type: z.enum([
+        'identity',
+        'profile',
+        'reputation_attestation',
+        'real_life_attestation',
+        'validation_verdict',
+        'personhood_vouch',
+        'credential',
+        'node',
+    ]),
     subject: z.string(),
     issuer: z.string(),
     record: z.record(z.unknown()),
     issuedAt: z.number(),
+    seq: z.number().int().nonnegative().optional(),
+    prev: z.string().nullable().optional(),
+    collection: z.string().min(1).optional(),
+    rkey: z.string().min(1).optional(),
     publicKey: z.string(),
     alg: z.literal('ES256K-DER-SHA256'),
     signature: z.string(),
+})
+    .superRefine((env, ctx) => {
+    if (env.version === 2) {
+        // v2 REQUIRES the hash-chain fields. `prev` may be `null` at genesis,
+        // but the key must be present (it is part of the signed bytes), so we
+        // reject only when it is entirely absent.
+        if (typeof env.seq !== 'number') {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: 'v2 envelope requires `seq`',
+                path: ['seq'],
+            });
+        }
+        if (env.prev === undefined) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: 'v2 envelope requires `prev` (use `null` at genesis)',
+                path: ['prev'],
+            });
+        }
+        if (typeof env.collection !== 'string') {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: 'v2 envelope requires `collection`',
+                path: ['collection'],
+            });
+        }
+        if (typeof env.rkey !== 'string') {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: 'v2 envelope requires `rkey`',
+                path: ['rkey'],
+            });
+        }
+    }
+    else {
+        // v1 FORBIDS the v2 chain fields entirely, so a legacy envelope keeps
+        // its exact byte shape and cannot smuggle unsigned chain metadata.
+        if (env.seq !== undefined) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: 'v1 envelope must not carry `seq`',
+                path: ['seq'],
+            });
+        }
+        if (env.prev !== undefined) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: 'v1 envelope must not carry `prev`',
+                path: ['prev'],
+            });
+        }
+        if (env.collection !== undefined) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: 'v1 envelope must not carry `collection`',
+                path: ['collection'],
+            });
+        }
+        if (env.rkey !== undefined) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: 'v1 envelope must not carry `rkey`',
+                path: ['rkey'],
+            });
+        }
+    }
 });
 export const verifiedDomainSchema = z.object({
     domain: z.string(),

package/dist/esm/index.js

@@ -26,3 +26,8 @@ recommendationExcludeTypeSchema, recommendationBoostSchema, recommendationSignal
 export { 
 // Schemas
 verificationMethodSchema, didServiceSchema, didDocumentSchema, signedRecordEnvelopeSchema, verifiedDomainSchema, domainVerificationRequestSchema, domainVerificationInstructionsSchema, authMethodEntrySchema, authMethodsResponseSchema, exportAttestationSchema, exportBundleSchema, } from './identity.js';
+export { 
+// Schemas
+publicCardSchema, signedPublicCardSchema, realLifeAttestationRecordSchema, realLifeAttestationResultSchema, validationVerdictRecordSchema, validationOpenRequestSchema, validationOpenResultSchema, validationRequestSummarySchema, validationVoteResultSchema, personhoodVouchRecordSchema, personhoodBreakdownSchema, personhoodStatusResultSchema, vouchResultSchema, 
+// Verifiable Credentials (Fase 4 — NEW)
+credentialRecordSchema, verifiableCredentialResponseSchema, credentialIssueResultSchema, credentialListResultSchema, credentialVerifyResultSchema, } from './civic.js';