@registrystack/client 0.31.0 → 0.33.0

package/evidence/index.d.ts

@@ -6,6 +6,8 @@
  * FFI boundary until the caller asks for it.
  */
 export declare class AudienceScopedResult {
+  /** Exact serialized pre-response trust snapshot for offline re-verification. */
+  get retainedVerification(): Buffer
   get responseFormat(): string
   get evidence(): any
   get traceId(): string | null
@@ -36,6 +38,12 @@ export declare class EvidenceClient {
    * client and are likewise redacted there.
    */
   static fromProfile(path: string, privateKeyJwk?: any): EvidenceClient
+  /**
+   * Build a profile-driven client with a context-bound staff exchange.
+   * The profile's discovered authority and pinned OAuth request parameters
+   * must match the immutable provider before the first token is acquired.
+   */
+  static fromProfileWithAuthorization(path: string, authorization: any): EvidenceClient
   /**
    * Close the expectations for one request and generate its nonce. No I/O
    * happens here. The returned request is good for exactly one exchange:
@@ -257,8 +265,8 @@ export declare class SdJwtVcBatchResponse {
  * selector or disclosed value is copied into it here.
  */
 export type SubjectContinuity =
-  | { status: 'firstUse', receipt: any }
-  | { status: 'matched', receipt: any }
+  | { status: 'firstUse'; receipt: any }
+  | { status: 'matched'; receipt: any }
 
 /**
  * A response that satisfied every expectation.
@@ -298,5 +306,17 @@ export interface VerifiedEvidenceRequestBatch {
  * `{ status: "available", verified } | { status: "notAvailable" }`.
  */
 export type VerifiedEvidenceRequestBatchItem =
-  | { status: 'available', verified: VerifiedEvidence }
+  | { status: 'available'; verified: VerifiedEvidence }
   | { status: 'notAvailable' }
+
+/**
+ * Verify exact retained response bytes against a bounded pre-response trust
+ * snapshot without constructing a client or performing network I/O.
+ */
+export declare function verifyRetained(context: Buffer, response: Buffer): VerifiedEvidence
+
+/**
+ * Replay an earlier decision at its recorded instant. Current decisions use
+ * `verify_retained` so expired assertions cannot be accepted as current.
+ */
+export declare function verifyRetainedAsOf(context: Buffer, response: Buffer, asOfMillis: number): VerifiedEvidence

package/native.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const PACKAGE_VERSION = '0.31.0';
+const PACKAGE_VERSION = '0.33.0';
 const PRODUCTS = new Set(['discovery', 'evidence', 'relay', 'breg', 'casework']);
 
 function target() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@registrystack/client",
-  "version": "0.31.0",
+  "version": "0.33.0",
   "description": "Unified Node.js client for Registry Stack products.",
   "license": "Apache-2.0",
   "homepage": "https://docs.registrystack.org/reference/client-api/",
@@ -57,8 +57,8 @@
     "typescript": "6.0.3"
   },
   "optionalDependencies": {
-    "@registrystack/client-darwin-arm64": "0.31.0",
-    "@registrystack/client-linux-arm64-gnu": "0.31.0",
-    "@registrystack/client-linux-x64-gnu": "0.31.0"
+    "@registrystack/client-darwin-arm64": "0.33.0",
+    "@registrystack/client-linux-arm64-gnu": "0.33.0",
+    "@registrystack/client-linux-x64-gnu": "0.33.0"
   }
 }

package/relay/client.d.ts

@@ -39,9 +39,45 @@ export interface PrivateKeyJwtConfig {
   trustedRootCertificates?: string | null
 }
 
+/** One immutable verified person or grant context. Reconstruct after host source facts change. */
+export interface ExchangeContext {
+  issuer: string
+  subject: string
+  audience: string
+  generation: string
+  deadlineSeconds: SafeInteger
+  grantId?: string | null
+}
+
+export type ExchangePrivateKeyJwtConfig = PrivateKeyJwtConfig & {
+  resource: string
+  scopes: ReadonlyArray<string>
+}
+
+export interface FirstPartyExchangeSource {
+  key: PrivateJwk
+  attributes: Readonly<Record<string, JsonValue>>
+}
+
+export interface RemoteExchangeSource {
+  endpoint: string
+  bootstrap: ExchangePrivateKeyJwtConfig
+  bootstrapResource: string
+  bootstrapScope: string
+  requestTimeoutMilliseconds?: SafeInteger | null
+  connectTimeoutMilliseconds?: SafeInteger | null
+  userAgent?: string | null
+  trustedRootCertificates?: string | null
+}
+
+export type ExchangeAuthorizationConfig =
+  | { client: ExchangePrivateKeyJwtConfig; context: ExchangeContext; firstParty: FirstPartyExchangeSource }
+  | { client: ExchangePrivateKeyJwtConfig; context: ExchangeContext; remote: RemoteExchangeSource }
+
 export type RelayAuthorization =
   | { static: string }
   | { privateKeyJwt: PrivateKeyJwtConfig }
+  | { exchange: ExchangeAuthorizationConfig }
 
 export interface RelayClientConfig {
   baseUrl: string