@union-networks/issuer 0.2.0-alpha.7

package/README.md

@@ -0,0 +1,127 @@
+# @union-networks/issuer
+
+Issuer-side helpers for U-net attestation providers.
+
+Use this package when your service issues attestations, such as an authority,
+membership provider, school, event organizer, or other domain that can approve
+or revoke claims for a scoped U-net user.
+
+This package is intentionally server-first. Issuer signing keys must stay in
+your backend environment and must never be included in frontend bundles.
+
+## Install
+
+```bash
+pnpm add @union-networks/issuer
+```
+
+## Generate an issuer keypair
+
+```ts
+import { generateIssuerKeyPairEnv } from '@union-networks/issuer';
+
+console.log(generateIssuerKeyPairEnv());
+```
+
+Store the printed values in your server environment:
+
+```bash
+UNET_ISSUER_ID=issuer:authority-portal
+UNET_ISSUER_KEY_ID=issuer:authority-portal#main
+UNET_ISSUER_PRIVATE_KEY_PEM="-----BEGIN PRIVATE KEY-----..."
+UNET_ISSUER_PUBLIC_KEY_PEM="-----BEGIN PUBLIC KEY-----..."
+```
+
+## Register your issuer key
+
+```ts
+import { registerIssuerKey } from '@union-networks/issuer';
+
+await registerIssuerKey({
+  serviceId: 'authority-portal',
+  issuerId: process.env.UNET_ISSUER_ID!,
+  keyId: process.env.UNET_ISSUER_KEY_ID!,
+  publicKeyPem: process.env.UNET_ISSUER_PUBLIC_KEY_PEM!,
+  providerToken: process.env.UNET_PROVIDER_API_KEY,
+});
+```
+
+## Create a holder-facing request
+
+In a miniapp, create or receive a scoped service session through the U-net
+miniapp bridge. Then ask trust-plane to open an attestation request for that
+scoped user:
+
+```ts
+import { createAttestationRequest } from '@union-networks/issuer';
+
+const request = await createAttestationRequest({
+  serviceId: 'authority-portal',
+  scopedUserId,
+  requestType: 'age_over_18',
+  claims: { source: 'issuer-example' },
+});
+```
+
+## Approve a request
+
+Approval must happen on your server, because it signs with your issuer private
+key:
+
+```ts
+import {
+  approveAttestationRequest,
+  createIssuerSignerFromEnv,
+} from '@union-networks/issuer';
+
+await approveAttestationRequest({
+  serviceId: 'authority-portal',
+  requestId,
+  signer: createIssuerSignerFromEnv(),
+  claims: { predicate: 'age_over_18', result: true },
+  providerToken: process.env.UNET_PROVIDER_API_KEY,
+});
+```
+
+Trust-plane verifies the issuer signature, checks that the issuer key is
+registered for the service/schema, anchors the commitment, and delivers the
+attestation to the holder.
+
+## Revoke an attestation
+
+```ts
+import { revokeAttestation, createIssuerSignerFromEnv } from '@union-networks/issuer';
+
+await revokeAttestation({
+  serviceId: 'authority-portal',
+  attestationHash,
+  reason: 'Revoked by issuer',
+  signer: createIssuerSignerFromEnv(),
+  providerToken: process.env.UNET_PROVIDER_API_KEY,
+});
+```
+
+## Miniapp manifest helper
+
+```ts
+import { createIssuerMiniappManifest } from '@union-networks/issuer';
+
+export const manifest = createIssuerMiniappManifest({
+  serviceId: 'authority-portal',
+  name: 'Authority Portal',
+  provider: 'Demo Authority',
+  launchUrl: 'https://your-domain.example/miniapp',
+  description: 'Request attestations from the issuer.',
+});
+```
+
+## Security notes
+
+- Keep issuer private keys server-side.
+- Use one issuer key per provider/service.
+- Rotate keys by registering a new `keyId`, deploying it, then retiring the old
+  key after pending requests are complete.
+- Browser code can create requests and display status, but approval/revocation
+  must happen on the server.
+- U-net receives scoped IDs, issuer signatures, and attestation commitments; it
+  should not receive unnecessary private user data.

package/dist/index.d.ts

@@ -0,0 +1,147 @@
+import type { UnetClientOptions, UnetMiniAppManifest, VerificationRequestType } from '@union-networks/client';
+export type IssuerAction = 'attestation.approve' | 'attestation.deny' | 'attestation.revoke' | 'issuer.key.register';
+export interface IssuerSigner {
+    issuerId: string;
+    keyId: string;
+    privateKeyPem: string;
+    publicKeyPem?: string;
+}
+export interface IssuerActionEnvelope<TPayload extends Record<string, unknown> = Record<string, unknown>> {
+    v: 1;
+    issuerId: string;
+    keyId: string;
+    action: IssuerAction;
+    issuedAtIso: string;
+    nonce: string;
+    payload: TPayload;
+    signature: string;
+}
+export interface RegisterIssuerKeyInput {
+    serviceId: string;
+    issuerId: string;
+    keyId: string;
+    publicKeyPem: string;
+    providerToken?: string;
+}
+export interface AttestationRequest {
+    requestId: string;
+    serviceId: string;
+    scopedUserId: string;
+    requestType: VerificationRequestType | string;
+    status: 'pending' | 'verified' | 'denied' | 'revoked' | string;
+    claims?: Record<string, unknown>;
+    createdAt?: string;
+    updatedAt?: string;
+    decidedAt?: string;
+    reason?: string;
+}
+export interface IssuedAttestation {
+    attestationHash: string;
+    requestId?: string;
+    serviceId?: string;
+    scopedUserId?: string;
+    requestType?: VerificationRequestType | string;
+    status: 'active' | 'revoked' | string;
+    issuedAt?: string;
+    revokedAt?: string;
+    reason?: string;
+}
+export interface CreateAttestationRequestInput {
+    serviceId: string;
+    scopedUserId: string;
+    requestType: VerificationRequestType | string;
+    claims?: Record<string, unknown>;
+}
+export interface ListAttestationRequestsInput {
+    serviceId: string;
+    status?: string;
+    scopedUserId?: string;
+    providerToken?: string;
+}
+export interface ApproveAttestationRequestInput {
+    serviceId: string;
+    requestId: string;
+    signer: IssuerSigner;
+    claims?: Record<string, unknown>;
+    providerToken?: string;
+}
+export interface DenyAttestationRequestInput {
+    serviceId: string;
+    requestId: string;
+    reason?: string;
+    signer: IssuerSigner;
+    providerToken?: string;
+}
+export interface RevokeAttestationInput {
+    serviceId: string;
+    attestationHash: string;
+    reason?: string;
+    signer: IssuerSigner;
+    providerToken?: string;
+}
+export interface IssuerMiniappManifestInput {
+    serviceId: string;
+    name: string;
+    provider: string;
+    launchUrl: string;
+    description?: string;
+    icon?: string;
+    permissions?: string[];
+    notificationCategories?: string[];
+}
+export declare function generateIssuerKeyPair(): {
+    privateKeyPem: string;
+    publicKeyPem: string;
+};
+export declare function generateIssuerKeyPairEnv(input?: {
+    issuerId?: string;
+    keyId?: string;
+}): string;
+export declare function createIssuerSignerFromEnv(env?: Record<string, string | undefined>): IssuerSigner;
+export declare function signIssuerAction<TPayload extends Record<string, unknown>>(input: {
+    issuerId: string;
+    keyId: string;
+    privateKeyPem: string;
+    action: IssuerAction;
+    payload: TPayload;
+    issuedAtIso?: string;
+    nonce?: string;
+}): IssuerActionEnvelope<TPayload>;
+export declare function verifyIssuerEnvelopeSignature(envelope: IssuerActionEnvelope, publicKeyPem: string): boolean;
+export declare function createIssuerMiniappManifest(input: IssuerMiniappManifestInput): UnetMiniAppManifest;
+export declare const registerIssuerKey: (input: RegisterIssuerKeyInput, options?: UnetClientOptions) => Promise<{
+    success: true;
+    issuerId: string;
+    keyId: string;
+}>;
+export declare const createAttestationRequest: (input: CreateAttestationRequestInput, options?: UnetClientOptions) => Promise<{
+    success: true;
+    request: AttestationRequest;
+}>;
+export declare const listAttestationRequests: (input: ListAttestationRequestsInput, options?: UnetClientOptions) => Promise<{
+    success: true;
+    requests: AttestationRequest[];
+}>;
+export declare const approveAttestationRequest: (input: ApproveAttestationRequestInput, options?: UnetClientOptions) => Promise<{
+    success: true;
+    request: AttestationRequest;
+    attestation?: IssuedAttestation;
+}>;
+export declare const denyAttestationRequest: (input: DenyAttestationRequestInput, options?: UnetClientOptions) => Promise<{
+    success: true;
+    request: AttestationRequest;
+}>;
+export declare const listIssuedAttestations: (input: {
+    serviceId: string;
+    scopedUserId?: string;
+    providerToken?: string;
+}, options?: UnetClientOptions) => Promise<{
+    success: true;
+    attestations: IssuedAttestation[];
+}>;
+export declare const revokeAttestation: (input: RevokeAttestationInput, options?: UnetClientOptions) => Promise<{
+    success: true;
+    attestationHash: string;
+    status: string;
+}>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAI9G,MAAM,MAAM,YAAY,GAAG,qBAAqB,GAAG,kBAAkB,GAAG,oBAAoB,GAAG,qBAAqB,CAAC;AAErH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACtG,CAAC,EAAE,CAAC,CAAC;IACL,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,YAAY,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,QAAQ,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IAAG,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CAAE;AAC7I,MAAM,WAAW,kBAAkB;IAAG,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,uBAAuB,GAAG,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAAE;AACjU,MAAM,WAAW,iBAAiB;IAAG,eAAe,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,uBAAuB,GAAG,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAAE;AAC7Q,MAAM,WAAW,6BAA6B;IAAG,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,uBAAuB,GAAG,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAAE;AAC5K,MAAM,WAAW,4BAA4B;IAAG,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CAAE;AACpI,MAAM,WAAW,8BAA8B;IAAG,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CAAE;AACzK,MAAM,WAAW,2BAA2B;IAAG,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CAAE;AACrJ,MAAM,WAAW,sBAAsB;IAAG,SAAS,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CAAE;AACtJ,MAAM,WAAW,0BAA0B;IAAG,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;CAAE;AAmCrN,wBAAgB,qBAAqB;;;EAMpC;AAED,wBAAgB,wBAAwB,CAAC,KAAK,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,MAAM,CAQlG;AAED,wBAAgB,yBAAyB,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,YAAY,CAM7G;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,QAAQ,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAG3P;AAED,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAO3G;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,0BAA0B,GAAG,mBAAmB,CAGlG;AAED,eAAO,MAAM,iBAAiB,GAAI,OAAO,sBAAsB,EAAE,UAAU,iBAAiB;aAAwB,IAAI;cAAY,MAAM;WAAS,MAAM;EAAsN,CAAC;AAChX,eAAO,MAAM,wBAAwB,GAAI,OAAO,6BAA6B,EAAE,UAAU,iBAAiB;aAAwB,IAAI;aAAW,kBAAkB;EAAgF,CAAC;AACpP,eAAO,MAAM,uBAAuB,GAAI,OAAO,4BAA4B,EAAE,UAAU,iBAAiB;aAI5E,IAAI;cAAY,kBAAkB,EAAE;EAC/D,CAAC;AACF,eAAO,MAAM,yBAAyB,GAAI,OAAO,8BAA8B,EAAE,UAAU,iBAAiB;aAEhF,IAAI;aAAW,kBAAkB;kBAAgB,iBAAiB;EAC7F,CAAC;AACF,eAAO,MAAM,sBAAsB,GAAI,OAAO,2BAA2B,EAAE,UAAU,iBAAiB;aAE1E,IAAI;aAAW,kBAAkB;EAC5D,CAAC;AACF,eAAO,MAAM,sBAAsB,GAAI,OAAO;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,UAAU,iBAAiB;aAGnH,IAAI;kBAAgB,iBAAiB,EAAE;EAClE,CAAC;AACF,eAAO,MAAM,iBAAiB,GAAI,OAAO,sBAAsB,EAAE,UAAU,iBAAiB;aAEhE,IAAI;qBAAmB,MAAM;YAAU,MAAM;EACxE,CAAC"}

package/dist/index.js

@@ -0,0 +1,104 @@
+import { generateKeyPairSync, randomBytes, sign, verify } from 'node:crypto';
+import { UnetApiError } from '@union-networks/client';
+const DEFAULT_ISSUER = 'https://issuer.egress.live';
+const isObject = (value) => typeof value === 'object' && value !== null;
+const b64url = (bytes) => Buffer.from(bytes).toString('base64url');
+const randomNonce = () => b64url(randomBytes(18));
+const canonicalize = (value) => {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonicalize).join(',')}]`;
+    const entries = Object.entries(value).filter(([, item]) => item !== undefined).sort(([a], [b]) => a.localeCompare(b));
+    return `{${entries.map(([key, item]) => `${JSON.stringify(key)}:${canonicalize(item)}`).join(',')}}`;
+};
+const signatureInput = (envelope) => Buffer.from(canonicalize(envelope), 'utf8');
+const issuerBase = (options) => (options?.issuerBaseUrl ?? DEFAULT_ISSUER).replace(/\/+$/, '');
+const fetchImpl = (options) => {
+    const fetcher = options?.fetchImpl ?? globalThis.fetch;
+    return ((input, init) => fetcher.call(globalThis, input, init));
+};
+async function request(path, options = {}, clientOptions) {
+    const response = await fetchImpl(clientOptions)(`${issuerBase(clientOptions)}${path}`, {
+        method: options.method ?? 'GET',
+        headers: { accept: 'application/json', ...(options.body ? { 'content-type': 'application/json' } : {}), ...(options.providerToken ? { authorization: `Bearer ${options.providerToken}` } : {}) },
+        body: options.body ? JSON.stringify(options.body) : undefined,
+    });
+    const text = await response.text();
+    const payload = text ? JSON.parse(text) : undefined;
+    if (!response.ok) {
+        const obj = isObject(payload) ? payload : {};
+        throw new UnetApiError(typeof obj.message === 'string' ? obj.message : `U-net issuer API error ${response.status}`, response.status, typeof obj.errorCode === 'string' ? obj.errorCode : undefined, payload);
+    }
+    return payload;
+}
+export function generateIssuerKeyPair() {
+    const { privateKey, publicKey } = generateKeyPairSync('ed25519');
+    return {
+        privateKeyPem: privateKey.export({ type: 'pkcs8', format: 'pem' }).toString(),
+        publicKeyPem: publicKey.export({ type: 'spki', format: 'pem' }).toString(),
+    };
+}
+export function generateIssuerKeyPairEnv(input = {}) {
+    const keys = generateIssuerKeyPair();
+    return [
+        `UNET_ISSUER_ID=${input.issuerId ?? 'issuer:replace-me'}`,
+        `UNET_ISSUER_KEY_ID=${input.keyId ?? 'issuer:replace-me#main'}`,
+        `UNET_ISSUER_PRIVATE_KEY_PEM=${JSON.stringify(keys.privateKeyPem)}`,
+        `UNET_ISSUER_PUBLIC_KEY_PEM=${JSON.stringify(keys.publicKeyPem)}`,
+    ].join('\n');
+}
+export function createIssuerSignerFromEnv(env = process.env) {
+    const issuerId = env.UNET_ISSUER_ID;
+    const keyId = env.UNET_ISSUER_KEY_ID;
+    const privateKeyPem = env.UNET_ISSUER_PRIVATE_KEY_PEM;
+    if (!issuerId || !keyId || !privateKeyPem)
+        throw new Error('UNET_ISSUER_ID, UNET_ISSUER_KEY_ID, and UNET_ISSUER_PRIVATE_KEY_PEM are required');
+    return { issuerId, keyId, privateKeyPem, ...(env.UNET_ISSUER_PUBLIC_KEY_PEM ? { publicKeyPem: env.UNET_ISSUER_PUBLIC_KEY_PEM } : {}) };
+}
+export function signIssuerAction(input) {
+    const unsigned = { v: 1, issuerId: input.issuerId, keyId: input.keyId, action: input.action, issuedAtIso: input.issuedAtIso ?? new Date().toISOString(), nonce: input.nonce ?? randomNonce(), payload: input.payload };
+    return { ...unsigned, signature: b64url(sign(null, signatureInput(unsigned), input.privateKeyPem)) };
+}
+export function verifyIssuerEnvelopeSignature(envelope, publicKeyPem) {
+    const { signature, ...unsigned } = envelope;
+    try {
+        return verify(null, signatureInput(unsigned), publicKeyPem, Buffer.from(signature, 'base64url'));
+    }
+    catch {
+        return false;
+    }
+}
+export function createIssuerMiniappManifest(input) {
+    const permissions = Array.from(new Set(['identity.scoped', 'attestations.request', 'attestations.refresh', ...(input.permissions ?? [])]));
+    return { serviceId: input.serviceId, name: input.name, provider: input.provider, description: input.description ?? `Request attestations from ${input.provider}.`, ...(input.icon ? { icon: input.icon } : {}), launchUrl: input.launchUrl, permissions, ...(input.notificationCategories ? { notificationCategories: input.notificationCategories } : {}) };
+}
+export const registerIssuerKey = (input, options) => request('/v1/issuer/keys/register', { method: 'POST', providerToken: input.providerToken, body: { serviceId: input.serviceId, issuerId: input.issuerId, keyId: input.keyId, publicKeyPem: input.publicKeyPem } }, options);
+export const createAttestationRequest = (input, options) => request('/v1/issuer/attestation-requests', { method: 'POST', body: input }, options);
+export const listAttestationRequests = (input, options) => {
+    const query = new URLSearchParams({ serviceId: input.serviceId });
+    if (input.status)
+        query.set('status', input.status);
+    if (input.scopedUserId)
+        query.set('scopedUserId', input.scopedUserId);
+    return request(`/v1/issuer/attestation-requests?${query.toString()}`, { providerToken: input.providerToken }, options);
+};
+export const approveAttestationRequest = (input, options) => {
+    const envelope = signIssuerAction({ issuerId: input.signer.issuerId, keyId: input.signer.keyId, privateKeyPem: input.signer.privateKeyPem, action: 'attestation.approve', payload: { serviceId: input.serviceId, requestId: input.requestId, claims: input.claims ?? {} } });
+    return request(`/v1/issuer/attestation-requests/${encodeURIComponent(input.requestId)}/decision`, { method: 'POST', providerToken: input.providerToken, body: { serviceId: input.serviceId, decision: 'verify', envelope } }, options);
+};
+export const denyAttestationRequest = (input, options) => {
+    const envelope = signIssuerAction({ issuerId: input.signer.issuerId, keyId: input.signer.keyId, privateKeyPem: input.signer.privateKeyPem, action: 'attestation.deny', payload: { serviceId: input.serviceId, requestId: input.requestId, reason: input.reason ?? 'Denied by issuer' } });
+    return request(`/v1/issuer/attestation-requests/${encodeURIComponent(input.requestId)}/decision`, { method: 'POST', providerToken: input.providerToken, body: { serviceId: input.serviceId, decision: 'deny', reason: input.reason, envelope } }, options);
+};
+export const listIssuedAttestations = (input, options) => {
+    const query = new URLSearchParams({ serviceId: input.serviceId });
+    if (input.scopedUserId)
+        query.set('scopedUserId', input.scopedUserId);
+    return request(`/v1/issuer/attestations?${query.toString()}`, { providerToken: input.providerToken }, options);
+};
+export const revokeAttestation = (input, options) => {
+    const envelope = signIssuerAction({ issuerId: input.signer.issuerId, keyId: input.signer.keyId, privateKeyPem: input.signer.privateKeyPem, action: 'attestation.revoke', payload: { serviceId: input.serviceId, attestationHash: input.attestationHash, reason: input.reason ?? 'Revoked by issuer' } });
+    return request(`/v1/issuer/attestations/${encodeURIComponent(input.attestationHash)}/revoke`, { method: 'POST', providerToken: input.providerToken, body: { serviceId: input.serviceId, reason: input.reason, envelope } }, options);
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAGtD,MAAM,cAAc,GAAG,4BAA4B,CAAC;AAgCpD,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACnH,MAAM,MAAM,GAAG,CAAC,KAA0B,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAChG,MAAM,WAAW,GAAG,GAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AAE1D,MAAM,YAAY,GAAG,CAAC,KAAc,EAAU,EAAE;IAC9C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACjJ,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AACvG,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,QAAiD,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;AAClI,MAAM,UAAU,GAAG,CAAC,OAA2B,EAAU,EAAE,CAAC,CAAC,OAAO,EAAE,aAAa,IAAI,cAAc,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC3H,MAAM,SAAS,GAAG,CAAC,OAA2B,EAAgB,EAAE;IAC9D,MAAM,OAAO,GAAG,OAAO,EAAE,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACvD,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,CAAiB,CAAC;AAClF,CAAC,CAAC;AAEF,KAAK,UAAU,OAAO,CAAI,IAAY,EAAE,UAAuE,EAAE,EAAE,aAAiC;IAClJ,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,CAAC,GAAG,UAAU,CAAC,aAAa,CAAC,GAAG,IAAI,EAAE,EAAE;QACrF,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;QAC/B,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QAChM,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;KAC9D,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,YAAY,CAAC,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,QAAQ,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC/M,CAAC;IACD,OAAO,OAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjE,OAAO;QACL,aAAa,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC7E,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC3E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,QAA+C,EAAE;IACxF,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;IACrC,OAAO;QACL,kBAAkB,KAAK,CAAC,QAAQ,IAAI,mBAAmB,EAAE;QACzD,sBAAsB,KAAK,CAAC,KAAK,IAAI,wBAAwB,EAAE;QAC/D,+BAA+B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE;QACnE,8BAA8B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE;KAClE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAA0C,OAAO,CAAC,GAAG;IAC7F,MAAM,QAAQ,GAAG,GAAG,CAAC,cAAc,CAAC;IACpC,MAAM,KAAK,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACrC,MAAM,aAAa,GAAG,GAAG,CAAC,2BAA2B,CAAC;IACtD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IAC/I,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,0BAA0B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACzI,CAAC;AAED,MAAM,UAAU,gBAAgB,CAA2C,KAAgJ;IACzN,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAChO,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;AACvG,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,QAA8B,EAAE,YAAoB;IAChG,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC;IAC5C,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IACnG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAiC;IAC3E,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3I,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,6BAA6B,KAAK,CAAC,QAAQ,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,KAAK,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC/V,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAA6B,EAAE,OAA2B,EAAE,EAAE,CAAC,OAAO,CAAqD,0BAA0B,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;AAChX,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,KAAoC,EAAE,OAA2B,EAAE,EAAE,CAAC,OAAO,CAAiD,iCAAiC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;AACpP,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,KAAmC,EAAE,OAA2B,EAAE,EAAE;IAC1G,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,MAAM;QAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,YAAY;QAAE,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACtE,OAAO,OAAO,CAAoD,mCAAmC,KAAK,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,EAAE,OAAO,CAAC,CAAC;AAC5K,CAAC,CAAC;AACF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,KAAqC,EAAE,OAA2B,EAAE,EAAE;IAC9G,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7Q,OAAO,OAAO,CAAkF,mCAAmC,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;AAC1T,CAAC,CAAC;AACF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAkC,EAAE,OAA2B,EAAE,EAAE;IACxG,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC1R,OAAO,OAAO,CAAiD,mCAAmC,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;AAC7S,CAAC,CAAC;AACF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAA2E,EAAE,OAA2B,EAAE,EAAE;IACjJ,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,YAAY;QAAE,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACtE,OAAO,OAAO,CAAuD,2BAA2B,KAAK,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,EAAE,OAAO,CAAC,CAAC;AACvK,CAAC,CAAC;AACF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAA6B,EAAE,OAA2B,EAAE,EAAE;IAC9F,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACzS,OAAO,OAAO,CAA6D,2BAA2B,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;AACnS,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,27 @@
+{
+  "name": "@union-networks/issuer",
+  "version": "0.2.0-alpha.7",
+  "description": "Issuer-side helpers for U-net attestation providers.",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "sideEffects": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@union-networks/client": "0.2.0-alpha.7"
+  },
+  "devDependencies": {
+    "vitest": "^3.2.4"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run --passWithNoTests"
+  }
+}