@prismer/sdk 2.0.7 → 2.2.55

package/node_modules/@prismer/aip-sdk/dist/cli/chunk-QUQXZ2LD.js

@@ -0,0 +1,99 @@
+import {
+  didKeyToPublicKey,
+  publicKeyToDIDKey
+} from "./chunk-LIJDUCHB.js";
+
+// src/identity.ts
+var _ed25519 = null;
+async function getEd25519() {
+  if (_ed25519) return _ed25519;
+  const mod = await import("@noble/curves/ed25519.js");
+  _ed25519 = mod.ed25519;
+  return _ed25519;
+}
+var AIPIdentity = class _AIPIdentity {
+  constructor(priv, pub, did) {
+    this.privateKey = priv;
+    this.publicKey = pub;
+    this.did = did;
+  }
+  static async create() {
+    const ed = await getEd25519();
+    const priv = ed.utils.randomSecretKey();
+    const pub = ed.getPublicKey(priv);
+    return new _AIPIdentity(priv, pub, publicKeyToDIDKey(pub));
+  }
+  /**
+   * @deprecated Compatibility derivation for existing Prismer Cloud identities.
+   * New applications should create and persist a random identity with create().
+   * The deterministic output remains unchanged throughout the 2.x release line.
+   */
+  static async fromApiKey(apiKey) {
+    const ed = await getEd25519();
+    const keyBytes = new TextEncoder().encode(apiKey);
+    const hashBuffer = await crypto.subtle.digest("SHA-256", keyBytes);
+    const seed = new Uint8Array(hashBuffer);
+    const pub = ed.getPublicKey(seed);
+    return new _AIPIdentity(seed, pub, publicKeyToDIDKey(pub));
+  }
+  static async fromPrivateKey(key) {
+    const ed = await getEd25519();
+    const pub = ed.getPublicKey(key);
+    return new _AIPIdentity(key, pub, publicKeyToDIDKey(pub));
+  }
+  get publicKeyBase64() {
+    return typeof Buffer !== "undefined" ? Buffer.from(this.publicKey).toString("base64") : btoa(String.fromCharCode(...this.publicKey));
+  }
+  async sign(data) {
+    const ed = await getEd25519();
+    const sig = ed.sign(data, this.privateKey);
+    return typeof Buffer !== "undefined" ? Buffer.from(sig).toString("base64") : btoa(String.fromCharCode(...sig));
+  }
+  static async verify(data, sigB64, signerDid) {
+    try {
+      const ed = await getEd25519();
+      const pub = didKeyToPublicKey(signerDid);
+      const sig = typeof Buffer !== "undefined" ? new Uint8Array(Buffer.from(sigB64, "base64")) : new Uint8Array(
+        atob(sigB64).split("").map((c) => c.charCodeAt(0))
+      );
+      return ed.verify(sig, data, pub);
+    } catch (e) {
+      return false;
+    }
+  }
+  getDIDDocument(params) {
+    var _a, _b;
+    const keyId = `${this.did}#keys-1`;
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const doc = {
+      "@context": ["https://www.w3.org/ns/did/v1", "https://w3id.org/security/suites/ed25519-2020/v1"],
+      id: this.did,
+      controller: this.did,
+      verificationMethod: [
+        { id: keyId, type: "Ed25519VerificationKey2020", controller: this.did, publicKeyMultibase: this.did.slice(8) }
+      ],
+      authentication: [keyId],
+      assertionMethod: [keyId],
+      capabilityDelegation: [keyId],
+      capabilityInvocation: [keyId],
+      created: now,
+      updated: now
+    };
+    if ((_a = params == null ? void 0 : params.services) == null ? void 0 : _a.length) {
+      doc.service = params.services.map((s, i) => ({
+        id: `${this.did}#service-${i}`,
+        type: s.type,
+        serviceEndpoint: s.endpoint
+      }));
+    }
+    if ((_b = params == null ? void 0 : params.capabilities) == null ? void 0 : _b.length) doc["aip:capabilities"] = params.capabilities;
+    return doc;
+  }
+  exportPrivateKey() {
+    return typeof Buffer !== "undefined" ? Buffer.from(this.privateKey).toString("base64") : btoa(String.fromCharCode(...this.privateKey));
+  }
+};
+
+export {
+  AIPIdentity
+};

package/node_modules/@prismer/aip-sdk/dist/cli/credentials-5GGZEJFG.js

@@ -0,0 +1,56 @@
+import {
+  AIPIdentity
+} from "./chunk-QUQXZ2LD.js";
+import {
+  __objRest,
+  __spreadProps,
+  __spreadValues
+} from "./chunk-LIJDUCHB.js";
+
+// src/credentials.ts
+async function buildCredential(params) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const body = {
+    "@context": ["https://www.w3.org/ns/credentials/v2"],
+    type: ["VerifiableCredential", params.type],
+    issuer: params.issuer.did,
+    validFrom: now,
+    credentialSubject: __spreadValues({ id: params.holderDid }, params.claims)
+  };
+  const data = new TextEncoder().encode(JSON.stringify(body));
+  const proofValue = await params.issuer.sign(data);
+  return __spreadProps(__spreadValues({}, body), { proof: { type: "Ed25519Signature2020", verificationMethod: `${params.issuer.did}#keys-1`, proofPurpose: "assertionMethod", created: now, proofValue } });
+}
+async function buildPresentation(params) {
+  const body = {
+    "@context": ["https://www.w3.org/ns/credentials/v2"],
+    type: ["VerifiablePresentation"],
+    holder: params.holder.did,
+    verifiableCredential: params.credentials
+  };
+  const data = new TextEncoder().encode(JSON.stringify(body) + params.challenge);
+  const proofValue = await params.holder.sign(data);
+  return __spreadProps(__spreadValues({}, body), { proof: { type: "Ed25519Signature2020", verificationMethod: `${params.holder.did}#keys-1`, challenge: params.challenge, proofValue } });
+}
+async function verifyCredential(vc) {
+  const _a = vc, { proof } = _a, body = __objRest(_a, ["proof"]);
+  const data = new TextEncoder().encode(JSON.stringify(body));
+  return AIPIdentity.verify(data, proof.proofValue, vc.issuer);
+}
+async function verifyPresentation(vp, expectedChallenge) {
+  if (vp.proof.challenge !== expectedChallenge) return false;
+  const _a = vp, { proof } = _a, body = __objRest(_a, ["proof"]);
+  const data = new TextEncoder().encode(JSON.stringify(body) + expectedChallenge);
+  const holderValid = await AIPIdentity.verify(data, proof.proofValue, vp.holder);
+  if (!holderValid) return false;
+  for (const vc of vp.verifiableCredential) {
+    if (!await verifyCredential(vc)) return false;
+  }
+  return true;
+}
+export {
+  buildCredential,
+  buildPresentation,
+  verifyCredential,
+  verifyPresentation
+};

package/node_modules/@prismer/aip-sdk/dist/cli/delegation-3J35VGBZ.js

@@ -0,0 +1,64 @@
+import {
+  AIPIdentity
+} from "./chunk-QUQXZ2LD.js";
+import {
+  __objRest,
+  __spreadProps,
+  __spreadValues
+} from "./chunk-LIJDUCHB.js";
+
+// src/delegation.ts
+async function buildDelegation(params) {
+  const now = /* @__PURE__ */ new Date();
+  const validUntil = params.validDays ? new Date(now.getTime() + params.validDays * 864e5) : void 0;
+  const body = __spreadProps(__spreadValues({
+    "@context": ["https://www.w3.org/ns/credentials/v2"],
+    type: ["VerifiableCredential", "AgentDelegation"],
+    issuer: params.issuer.did,
+    validFrom: now.toISOString()
+  }, validUntil && { validUntil: validUntil.toISOString() }), {
+    credentialSubject: __spreadValues({
+      id: params.subjectDid,
+      "aip:scope": params.scope
+    }, params.role && { "aip:role": params.role })
+  });
+  const data = new TextEncoder().encode(JSON.stringify(body));
+  const proofValue = await params.issuer.sign(data);
+  return __spreadProps(__spreadValues({}, body), { proof: { type: "Ed25519Signature2020", verificationMethod: `${params.issuer.did}#keys-1`, proofPurpose: "assertionMethod", created: now.toISOString(), proofValue } });
+}
+async function buildEphemeralDelegation(params) {
+  const now = /* @__PURE__ */ new Date();
+  const validUntil = new Date(now.getTime() + params.ttlSeconds * 1e3);
+  const nonce = Array.from(crypto.getRandomValues(new Uint8Array(16)), (b) => b.toString(16).padStart(2, "0")).join("");
+  const body = {
+    type: "EphemeralDelegation",
+    parentDid: params.parent.did,
+    sessionId: `sub_${nonce.slice(0, 8)}`,
+    scope: params.scope,
+    validFrom: now.toISOString(),
+    validUntil: validUntil.toISOString(),
+    nonce
+  };
+  const data = new TextEncoder().encode(JSON.stringify(body));
+  const proofValue = await params.parent.sign(data);
+  return __spreadProps(__spreadValues({}, body), { proof: { type: "Ed25519Signature2020", verificationMethod: `${params.parent.did}#keys-1`, proofValue } });
+}
+async function verifyDelegation(delegation) {
+  if (new Date(delegation.validFrom) > /* @__PURE__ */ new Date()) return false;
+  if (delegation.validUntil && new Date(delegation.validUntil) < /* @__PURE__ */ new Date()) return false;
+  const _a = delegation, { proof } = _a, body = __objRest(_a, ["proof"]);
+  const data = new TextEncoder().encode(JSON.stringify(body));
+  return AIPIdentity.verify(data, proof.proofValue, delegation.issuer);
+}
+async function verifyEphemeralDelegation(token) {
+  if (new Date(token.validUntil) < /* @__PURE__ */ new Date()) return false;
+  const _a = token, { proof } = _a, body = __objRest(_a, ["proof"]);
+  const data = new TextEncoder().encode(JSON.stringify(body));
+  return AIPIdentity.verify(data, proof.proofValue, token.parentDid);
+}
+export {
+  buildDelegation,
+  buildEphemeralDelegation,
+  verifyDelegation,
+  verifyEphemeralDelegation
+};

package/node_modules/@prismer/aip-sdk/dist/cli/identity-LXVWKSVB.js

@@ -0,0 +1,7 @@
+import {
+  AIPIdentity
+} from "./chunk-QUQXZ2LD.js";
+import "./chunk-LIJDUCHB.js";
+export {
+  AIPIdentity
+};

package/node_modules/@prismer/aip-sdk/dist/cli/index.js

@@ -0,0 +1,259 @@
+#!/usr/bin/env node
+
+// src/cli/index.ts
+import { readFileSync } from "fs";
+import { resolve } from "path";
+async function getIdentity() {
+  return (await import("./identity-LXVWKSVB.js")).AIPIdentity;
+}
+async function getDelegation() {
+  return await import("./delegation-3J35VGBZ.js");
+}
+async function getCredentials() {
+  return await import("./credentials-5GGZEJFG.js");
+}
+async function getResolver() {
+  return (await import("./resolver-TGOPKW52.js")).KeyResolver;
+}
+var args = process.argv.slice(2);
+var cmd = args[0];
+var sub = args[1];
+function flag(name) {
+  const idx = args.indexOf(`--${name}`);
+  return idx >= 0 && idx + 1 < args.length ? args[idx + 1] : void 0;
+}
+function printJSON(obj) {
+  console.log(JSON.stringify(obj, null, 2));
+}
+async function main() {
+  var _a, _b, _c, _d, _e, _f, _g, _h;
+  if (!cmd || cmd === "--help" || cmd === "-h") {
+    console.log(`aip \u2014 Agent Identity Protocol CLI
+
+Commands:
+  identity create              Generate new identity
+  identity from-key <apiKey>   Legacy deterministic compatibility derivation
+  identity show                Show current identity
+
+  resolve <did>                Resolve did:key locally
+
+  sign <file>                  Sign file (uses AIP_PRIVATE_KEY env)
+  verify <file> --sig <b64> --did <did>   Verify signature
+
+  delegate --to <did> --scope <scopes> [--days N]
+  delegate verify <file.json>
+
+  credential issue --to <did> --type <type> --claims <json>
+  credential verify <file.json>
+
+  inspect <file.json>          Inspect signed AIP artifact
+
+Environment:
+  AIP_PRIVATE_KEY   Base64 Ed25519 private key (for sign/delegate/credential)
+  AIP_API_KEY       API key (for deterministic identity derivation)
+`);
+    return;
+  }
+  if (cmd === "identity") {
+    const AIPIdentity = await getIdentity();
+    if (sub === "create") {
+      const id = await AIPIdentity.create();
+      console.log(`DID:         ${id.did}`);
+      console.log(`Public Key:  ${id.publicKeyBase64}`);
+      console.log(`Private Key: ${id.exportPrivateKey()}`);
+      console.log(`
+Store the private key securely. Set AIP_PRIVATE_KEY env to use with other commands.`);
+      return;
+    }
+    if (sub === "from-key") {
+      const apiKey = args[2] || process.env.AIP_API_KEY;
+      if (!apiKey) {
+        console.error("Usage: aip identity from-key <apiKey>");
+        process.exit(1);
+      }
+      const id = await AIPIdentity.fromApiKey(apiKey);
+      console.log(`DID:         ${id.did}`);
+      console.log(`Public Key:  ${id.publicKeyBase64}`);
+      console.error(
+        "Deprecated: from-key is retained for 2.x compatibility. Use `aip identity create` for new identities."
+      );
+      console.log(`(Compatibility DID \u2014 same API key preserves the existing DID)`);
+      return;
+    }
+    if (sub === "show") {
+      const key = process.env.AIP_PRIVATE_KEY;
+      if (!key) {
+        console.error("Set AIP_PRIVATE_KEY env");
+        process.exit(1);
+      }
+      const privBytes = typeof Buffer !== "undefined" ? new Uint8Array(Buffer.from(key, "base64")) : new Uint8Array(
+        atob(key).split("").map((c) => c.charCodeAt(0))
+      );
+      const id = await AIPIdentity.fromPrivateKey(privBytes);
+      console.log(`DID:         ${id.did}`);
+      console.log(`Public Key:  ${id.publicKeyBase64}`);
+      printJSON(id.getDIDDocument());
+      return;
+    }
+    console.error("Unknown identity command. Try: aip identity create|from-key|show");
+    process.exit(1);
+  }
+  if (cmd === "resolve") {
+    const did = sub;
+    if (!did) {
+      console.error("Usage: aip resolve <did>");
+      process.exit(1);
+    }
+    const KeyResolver = await getResolver();
+    const resolver = new KeyResolver();
+    const doc = await resolver.resolve(did);
+    printJSON(doc);
+    return;
+  }
+  if (cmd === "sign") {
+    const file = sub;
+    if (!file) {
+      console.error("Usage: aip sign <file>");
+      process.exit(1);
+    }
+    const key = process.env.AIP_PRIVATE_KEY;
+    if (!key) {
+      console.error("Set AIP_PRIVATE_KEY env");
+      process.exit(1);
+    }
+    const AIPIdentity = await getIdentity();
+    const privBytes = typeof Buffer !== "undefined" ? new Uint8Array(Buffer.from(key, "base64")) : new Uint8Array(
+      atob(key).split("").map((c) => c.charCodeAt(0))
+    );
+    const id = await AIPIdentity.fromPrivateKey(privBytes);
+    const data = readFileSync(resolve(file));
+    const sig = await id.sign(new Uint8Array(data));
+    console.log(`DID:       ${id.did}`);
+    console.log(`Signature: ${sig}`);
+    return;
+  }
+  if (cmd === "verify") {
+    const file = sub;
+    const sig = flag("sig");
+    const did = flag("did");
+    if (!file || !sig || !did) {
+      console.error("Usage: aip verify <file> --sig <b64> --did <did>");
+      process.exit(1);
+    }
+    const AIPIdentity = await getIdentity();
+    const data = readFileSync(resolve(file));
+    const valid = await AIPIdentity.verify(new Uint8Array(data), sig, did);
+    console.log(valid ? "\u2705 Signature valid" : "\u274C Signature INVALID");
+    process.exit(valid ? 0 : 1);
+  }
+  if (cmd === "delegate") {
+    if (sub === "verify") {
+      const file = args[2];
+      if (!file) {
+        console.error("Usage: aip delegate verify <file.json>");
+        process.exit(1);
+      }
+      const { verifyDelegation } = await getDelegation();
+      const delegation2 = JSON.parse(readFileSync(resolve(file), "utf-8"));
+      const valid = await verifyDelegation(delegation2);
+      console.log(valid ? "\u2705 Delegation valid" : "\u274C Delegation INVALID");
+      process.exit(valid ? 0 : 1);
+    }
+    const to = flag("to");
+    const scope = flag("scope");
+    const days = flag("days");
+    const key = process.env.AIP_PRIVATE_KEY;
+    if (!to || !scope || !key) {
+      console.error("Usage: aip delegate --to <did> --scope <s1,s2> [--days N]\nRequires AIP_PRIVATE_KEY env");
+      process.exit(1);
+    }
+    const AIPIdentity = await getIdentity();
+    const { buildDelegation } = await getDelegation();
+    const privBytes = typeof Buffer !== "undefined" ? new Uint8Array(Buffer.from(key, "base64")) : new Uint8Array(
+      atob(key).split("").map((c) => c.charCodeAt(0))
+    );
+    const issuer = await AIPIdentity.fromPrivateKey(privBytes);
+    const delegation = await buildDelegation({
+      issuer,
+      subjectDid: to,
+      scope: scope.split(","),
+      validDays: days ? parseInt(days) : void 0
+    });
+    printJSON(delegation);
+    return;
+  }
+  if (cmd === "credential") {
+    if (sub === "verify") {
+      const file = args[2];
+      if (!file) {
+        console.error("Usage: aip credential verify <file.json>");
+        process.exit(1);
+      }
+      const { verifyCredential } = await getCredentials();
+      const vc2 = JSON.parse(readFileSync(resolve(file), "utf-8"));
+      const valid = await verifyCredential(vc2);
+      console.log(valid ? "\u2705 Credential valid" : "\u274C Credential INVALID");
+      process.exit(valid ? 0 : 1);
+    }
+    const to = flag("to");
+    const type = flag("type");
+    const claims = flag("claims");
+    const key = process.env.AIP_PRIVATE_KEY;
+    if (!to || !type || !key) {
+      console.error(
+        "Usage: aip credential issue --to <did> --type <type> --claims <json>\nRequires AIP_PRIVATE_KEY env"
+      );
+      process.exit(1);
+    }
+    const AIPIdentity = await getIdentity();
+    const { buildCredential } = await getCredentials();
+    const privBytes = typeof Buffer !== "undefined" ? new Uint8Array(Buffer.from(key, "base64")) : new Uint8Array(
+      atob(key).split("").map((c) => c.charCodeAt(0))
+    );
+    const issuer = await AIPIdentity.fromPrivateKey(privBytes);
+    const vc = await buildCredential({
+      issuer,
+      holderDid: to,
+      type,
+      claims: claims ? JSON.parse(claims) : {}
+    });
+    printJSON(vc);
+    return;
+  }
+  if (cmd === "inspect") {
+    const file = sub;
+    if (!file) {
+      console.error("Usage: aip inspect <file.json>");
+      process.exit(1);
+    }
+    const obj = JSON.parse(readFileSync(resolve(file), "utf-8"));
+    if ((_a = obj.type) == null ? void 0 : _a.includes("VerifiableCredential")) {
+      console.log("Type: Verifiable Credential");
+      console.log(`Issuer:  ${obj.issuer}`);
+      console.log(`Subject: ${(_b = obj.credentialSubject) == null ? void 0 : _b.id}`);
+      console.log(`Types:   ${obj.type.join(", ")}`);
+      console.log(`Valid:   ${obj.validFrom} \u2192 ${obj.validUntil || "no expiry"}`);
+      console.log(`Proof:   ${(_c = obj.proof) == null ? void 0 : _c.type} by ${(_d = obj.proof) == null ? void 0 : _d.verificationMethod}`);
+    } else if (obj.type === "EphemeralDelegation") {
+      console.log("Type: Ephemeral Delegation");
+      console.log(`Parent:  ${obj.parentDid}`);
+      console.log(`Session: ${obj.sessionId}`);
+      console.log(`Scope:   ${(_e = obj.scope) == null ? void 0 : _e.join(", ")}`);
+      console.log(`Valid:   ${obj.validFrom} \u2192 ${obj.validUntil}`);
+    } else if ((_f = obj.type) == null ? void 0 : _f.includes("VerifiablePresentation")) {
+      console.log("Type: Verifiable Presentation");
+      console.log(`Holder:  ${obj.holder}`);
+      console.log(`VCs:     ${(_g = obj.verifiableCredential) == null ? void 0 : _g.length}`);
+      console.log(`Challenge: ${(_h = obj.proof) == null ? void 0 : _h.challenge}`);
+    } else {
+      printJSON(obj);
+    }
+    return;
+  }
+  console.error(`Unknown command: ${cmd}. Run 'aip --help' for usage.`);
+  process.exit(1);
+}
+main().catch((e) => {
+  console.error(e.message);
+  process.exit(1);
+});

package/node_modules/@prismer/aip-sdk/dist/cli/resolver-TGOPKW52.js

@@ -0,0 +1,26 @@
+import {
+  didKeyToPublicKey
+} from "./chunk-LIJDUCHB.js";
+
+// src/resolver.ts
+var KeyResolver = class {
+  async resolve(did) {
+    if (!did.startsWith("did:key:")) {
+      throw new Error(`KeyResolver only supports did:key, got: ${did}`);
+    }
+    const pubBytes = didKeyToPublicKey(did);
+    const keyId = `${did}#keys-1`;
+    const multibase = did.slice(8);
+    return {
+      "@context": ["https://www.w3.org/ns/did/v1"],
+      id: did,
+      controller: did,
+      verificationMethod: [{ id: keyId, type: "Ed25519VerificationKey2020", controller: did, publicKeyMultibase: multibase }],
+      authentication: [keyId],
+      assertionMethod: [keyId]
+    };
+  }
+};
+export {
+  KeyResolver
+};