@vallum/registry 0.0.0-prerelease

package/dist/iotaIdentityAdapter.js

@@ -0,0 +1,329 @@
+export function createInMemoryIotaIdentityVerificationCache() {
+    const entries = new Map();
+    return {
+        get(key) {
+            return entries.get(key);
+        },
+        set(key, entry) {
+            entries.set(key, entry);
+        },
+        delete(key) {
+            entries.delete(key);
+        },
+    };
+}
+export function createIotaIdentityVerifiedResolver(baseResolver, options) {
+    return {
+        async resolve(name) {
+            const resolved = await baseResolver.resolve(name);
+            if (!resolved.ok)
+                return resolved;
+            const identity = await verifyAgentProfileIdentity(resolved.profile, options);
+            if (identity.ok)
+                return resolved;
+            return {
+                ok: false,
+                error: {
+                    code: identityErrorToResolveCode(identity.error.code),
+                    message: identity.error.message,
+                    name: resolved.profile.name,
+                },
+            };
+        },
+    };
+}
+export async function verifyAgentProfileIdentity(profile, options) {
+    const now = options.now?.() ?? new Date();
+    const cacheKey = identityVerificationCacheKey(profile, options.trustPolicy);
+    if (options.forceRefresh)
+        options.verificationCache?.delete?.(cacheKey);
+    const cached = readFreshIdentityCache(options, cacheKey, now);
+    if (cached)
+        return withoutCacheMetadata(cached);
+    const agentDidDocument = await resolveDidDocument(profile.agentDid, options.didResolver);
+    if (!agentDidDocument.ok)
+        return agentDidDocument;
+    if (extractDidDocumentId(agentDidDocument.document) !== profile.agentDid) {
+        return failIdentity("PROFILE_UNVERIFIABLE", "Resolved agent DID document does not match the profile.");
+    }
+    const ownerDidDocument = await resolveDidDocument(profile.ownerDid, options.didResolver);
+    if (!ownerDidDocument.ok)
+        return ownerDidDocument;
+    if (extractDidDocumentId(ownerDidDocument.document) !== profile.ownerDid) {
+        return failIdentity("PROFILE_UNVERIFIABLE", "Resolved owner DID document does not match the profile.");
+    }
+    const credentialRefs = profileCredentialRefs(profile);
+    if (options.trustPolicy && !options.credentialValidator && credentialRefs.length > 0) {
+        return failIdentity("PROFILE_UNVERIFIABLE", "IOTA Identity credential validator is required by trust policy.");
+    }
+    if (options.credentialValidator) {
+        for (const credentialRef of credentialRefs) {
+            let credential;
+            try {
+                credential = await options.credentialValidator.validateCredentialRef(credentialRef, {
+                    profile,
+                    agentDidDocument: agentDidDocument.document,
+                    ownerDidDocument: ownerDidDocument.document,
+                });
+            }
+            catch {
+                return failIdentity("PROFILE_UNVERIFIABLE", "IOTA Identity credential validation failed.");
+            }
+            if (!credential.ok) {
+                return failIdentity(credentialErrorToIdentityCode(credential.code), credential.message);
+            }
+            const trusted = evaluateIotaIdentityCredentialTrustPolicy(credential.evidence, options.trustPolicy, now);
+            if (!trusted.ok) {
+                return failIdentity(credentialErrorToIdentityCode(trusted.code), trusted.message);
+            }
+        }
+    }
+    const verified = {
+        ok: true,
+        agentDidDocument: agentDidDocument.document,
+        ownerDidDocument: ownerDidDocument.document,
+        credentialRefsChecked: credentialRefs,
+    };
+    writeIdentityCache(options, cacheKey, verified, now);
+    return verified;
+}
+export function evaluateIotaIdentityCredentialTrustPolicy(evidence, policy, now = new Date()) {
+    if (!policy)
+        return { ok: true };
+    const policyShape = validateTrustPolicyShape(policy);
+    if (!policyShape.ok)
+        return policyShape;
+    if (!evidence) {
+        return unverifiable("Credential evidence is missing trust-policy evidence.");
+    }
+    if (!policy.trustedIssuerDids.includes(evidence.issuerDid)) {
+        return unverifiable("Credential evidence was not issued by a trusted DID.");
+    }
+    if (!isVerificationMethodAllowed(evidence.issuerDid, evidence.verificationMethod, policy.allowedVerificationMethods)) {
+        return unverifiable("Credential evidence was not signed with an allowed verification method.");
+    }
+    for (const requiredType of policy.requiredCredentialTypes ?? []) {
+        if (!evidence.credentialTypes?.includes(requiredType)) {
+            return unverifiable("Credential evidence is missing a required credential type.");
+        }
+    }
+    if (policy.requireCredentialStatus && !evidence.credentialStatus) {
+        return unverifiable("Credential evidence is missing required revocation status evidence.");
+    }
+    if (evidence.credentialStatus) {
+        if (evidence.credentialStatus.revoked) {
+            return {
+                ok: false,
+                code: "CREDENTIAL_REVOKED",
+                message: "Credential evidence is revoked by trust-policy evidence.",
+            };
+        }
+        if (policy.acceptedCredentialStatusTypes
+            && !policy.acceptedCredentialStatusTypes.includes(evidence.credentialStatus.type)) {
+            return unverifiable("Credential evidence uses an unsupported credential status type.");
+        }
+    }
+    const expiresAt = parseOptionalTimestamp(evidence.expiresAt);
+    if (expiresAt === "invalid")
+        return unverifiable("Credential evidence has an invalid expiry timestamp.");
+    if (expiresAt && expiresAt.getTime() <= now.getTime()) {
+        return {
+            ok: false,
+            code: "CREDENTIAL_EXPIRED",
+            message: "Credential evidence is expired.",
+        };
+    }
+    if (policy.maxCredentialAgeMs !== undefined) {
+        const issuedAt = parseOptionalTimestamp(evidence.issuedAt);
+        if (issuedAt === "invalid" || !issuedAt) {
+            return unverifiable("Credential evidence is missing valid issuance evidence required by trust policy.");
+        }
+        if (issuedAt.getTime() > now.getTime()) {
+            return unverifiable("Credential evidence has a future issuance timestamp.");
+        }
+        if (now.getTime() - issuedAt.getTime() > policy.maxCredentialAgeMs) {
+            return {
+                ok: false,
+                code: "CREDENTIAL_EXPIRED",
+                message: "Credential evidence exceeds trust-policy max credential age.",
+            };
+        }
+    }
+    return { ok: true };
+}
+function readFreshIdentityCache(options, key, now) {
+    if (!isCacheEnabled(options))
+        return undefined;
+    const entry = options.verificationCache?.get(key);
+    if (!entry)
+        return undefined;
+    if (Date.parse(entry.expiresAt) > now.getTime())
+        return entry;
+    options.verificationCache?.delete?.(key);
+    return undefined;
+}
+function writeIdentityCache(options, key, result, now) {
+    if (!isCacheEnabled(options))
+        return;
+    const ttlMs = options.cacheTtlMs ?? 0;
+    options.verificationCache?.set(key, {
+        ...result,
+        cachedAt: now.toISOString(),
+        expiresAt: new Date(now.getTime() + ttlMs).toISOString(),
+    });
+}
+function withoutCacheMetadata(entry) {
+    return {
+        ok: true,
+        agentDidDocument: entry.agentDidDocument,
+        ownerDidDocument: entry.ownerDidDocument,
+        credentialRefsChecked: entry.credentialRefsChecked,
+    };
+}
+function isCacheEnabled(options) {
+    return Boolean(options.verificationCache
+        && options.cacheTtlMs
+        && Number.isFinite(options.cacheTtlMs)
+        && options.cacheTtlMs > 0);
+}
+function identityVerificationCacheKey(profile, trustPolicy) {
+    return JSON.stringify({
+        version: profile.version,
+        name: profile.name,
+        agentDid: profile.agentDid,
+        ownerDid: profile.ownerDid,
+        walletStatus: profile.wallet.status,
+        expiresAt: profile.expiresAt,
+        status: profile.status,
+        revocation: {
+            revoked: profile.revocation.revoked,
+            revokedAt: profile.revocation.revokedAt ?? "",
+        },
+        credentialRefs: profileCredentialRefs(profile),
+        trustPolicy: trustPolicyCacheKey(trustPolicy),
+    });
+}
+async function resolveDidDocument(did, resolver) {
+    try {
+        if (resolver.resolveDid) {
+            return { ok: true, document: await resolver.resolveDid(did) };
+        }
+        if (resolver.resolve) {
+            return { ok: true, document: await resolver.resolve(did) };
+        }
+    }
+    catch {
+        return {
+            ok: false,
+            error: {
+                code: "PROFILE_UNVERIFIABLE",
+                message: "IOTA Identity DID resolution failed.",
+            },
+        };
+    }
+    return {
+        ok: false,
+        error: {
+            code: "PROFILE_UNVERIFIABLE",
+            message: "IOTA Identity DID resolver is not configured.",
+        },
+    };
+}
+function extractDidDocumentId(document) {
+    if (!isRecord(document))
+        return undefined;
+    const id = document.id;
+    if (typeof id === "string")
+        return id;
+    if (typeof id === "function")
+        return String(id.call(document));
+    if (id && typeof id === "object" && "toString" in id && typeof id.toString === "function") {
+        return id.toString();
+    }
+    return undefined;
+}
+function profileCredentialRefs(profile) {
+    const refs = new Set();
+    profile.credentialRefs?.forEach((ref) => refs.add(ref));
+    for (const capability of profile.capabilities) {
+        capability.credentialRefs?.forEach((ref) => refs.add(ref));
+    }
+    return [...refs];
+}
+function credentialErrorToIdentityCode(code) {
+    if (code === "CREDENTIAL_REVOKED")
+        return "PROFILE_REVOKED";
+    if (code === "CREDENTIAL_EXPIRED")
+        return "PROFILE_EXPIRED";
+    return "PROFILE_UNVERIFIABLE";
+}
+function validateTrustPolicyShape(policy) {
+    if (policy.trustedIssuerDids.length === 0
+        || !policy.trustedIssuerDids.every((issuerDid) => issuerDid.startsWith("did:iota:"))) {
+        return unverifiable("IOTA Identity trust policy has no trusted issuers.");
+    }
+    if (policy.allowedVerificationMethods.length === 0
+        || !policy.allowedVerificationMethods.every((method) => method.startsWith("did:iota:") || method.startsWith("#"))) {
+        return unverifiable("IOTA Identity trust policy has no allowed verification methods.");
+    }
+    if (policy.requiredCredentialTypes?.some((credentialType) => credentialType.trim() === "")) {
+        return unverifiable("IOTA Identity trust policy has an invalid credential type requirement.");
+    }
+    if (policy.acceptedCredentialStatusTypes?.some((statusType) => statusType.trim() === "")) {
+        return unverifiable("IOTA Identity trust policy has an invalid credential status type.");
+    }
+    if (policy.maxCredentialAgeMs !== undefined
+        && (!Number.isFinite(policy.maxCredentialAgeMs) || policy.maxCredentialAgeMs <= 0)) {
+        return unverifiable("IOTA Identity trust policy has an invalid max credential age.");
+    }
+    return { ok: true };
+}
+function isVerificationMethodAllowed(issuerDid, verificationMethod, allowedVerificationMethods) {
+    if (!verificationMethod.startsWith(`${issuerDid}#`))
+        return false;
+    return allowedVerificationMethods.some((allowed) => {
+        if (allowed === verificationMethod)
+            return true;
+        return allowed.startsWith("#") && `${issuerDid}${allowed}` === verificationMethod;
+    });
+}
+function parseOptionalTimestamp(value) {
+    if (value === undefined)
+        return undefined;
+    const timestamp = Date.parse(value);
+    if (Number.isNaN(timestamp))
+        return "invalid";
+    return new Date(timestamp);
+}
+function trustPolicyCacheKey(policy) {
+    if (!policy)
+        return null;
+    return {
+        trustedIssuerDids: [...policy.trustedIssuerDids].sort(),
+        allowedVerificationMethods: [...policy.allowedVerificationMethods].sort(),
+        requiredCredentialTypes: [...(policy.requiredCredentialTypes ?? [])].sort(),
+        acceptedCredentialStatusTypes: [...(policy.acceptedCredentialStatusTypes ?? [])].sort(),
+        requireCredentialStatus: Boolean(policy.requireCredentialStatus),
+        maxCredentialAgeMs: policy.maxCredentialAgeMs ?? null,
+    };
+}
+function unverifiable(message) {
+    return {
+        ok: false,
+        code: "CREDENTIAL_UNVERIFIABLE",
+        message,
+    };
+}
+function identityErrorToResolveCode(code) {
+    return code;
+}
+function failIdentity(code, message) {
+    return {
+        ok: false,
+        error: { code, message },
+    };
+}
+function isRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+//# sourceMappingURL=iotaIdentityAdapter.js.map

package/dist/iotaNamesAdapter.d.ts

@@ -0,0 +1,49 @@
+import { type AgentResolver } from "./resolveAgent.js";
+import { type IotaIdentityVerificationOptions } from "./iotaIdentityAdapter.js";
+export declare const IOTA_NAMES_RESOLVE_ADDRESS_QUERY = "\nquery ResolveIotaNamesAddress($name: String!) {\n  resolveIotaNamesAddress(name: $name) {\n    address\n  }\n}\n";
+export interface IotaNamesGraphQLRequest {
+    readonly query: string;
+    readonly variables: Readonly<Record<string, unknown>>;
+}
+export interface IotaNamesGraphQLError {
+    readonly message?: string;
+}
+export interface IotaNamesGraphQLResponse<TData> {
+    readonly data?: TData;
+    readonly errors?: readonly IotaNamesGraphQLError[];
+}
+export interface IotaNamesGraphQLClient {
+    readonly query: <TData>(request: IotaNamesGraphQLRequest) => Promise<IotaNamesGraphQLResponse<TData>>;
+}
+export type IotaNamesAddressResolution = {
+    readonly ok: true;
+    readonly name: string;
+    readonly address: string;
+    readonly source: "iota-names-graphql";
+} | {
+    readonly ok: false;
+    readonly error: {
+        readonly code: "IOTA_NAME_NOT_FOUND" | "IOTA_NAMES_GRAPHQL_ERROR" | "IOTA_NAMES_MALFORMED_RESPONSE";
+        readonly message: string;
+    };
+    readonly name: string;
+};
+export interface FetchIotaNamesGraphQLClientOptions {
+    readonly endpoint: string;
+    readonly fetch?: typeof fetch;
+}
+export interface IotaNamesProfileSource {
+    readonly getProfileByAddress: (address: string, context: {
+        readonly name: string;
+    }) => Promise<unknown | undefined>;
+}
+export interface IotaNamesAgentResolverOptions {
+    readonly graphQL: IotaNamesGraphQLClient;
+    readonly profileSource: IotaNamesProfileSource;
+    readonly identity?: IotaIdentityVerificationOptions;
+    readonly now?: () => Date;
+}
+export declare function createFetchIotaNamesGraphQLClient(options: FetchIotaNamesGraphQLClientOptions): IotaNamesGraphQLClient;
+export declare function resolveIotaNamesAddress(name: string, graphQL: IotaNamesGraphQLClient): Promise<IotaNamesAddressResolution>;
+export declare function createIotaNamesAgentResolver(options: IotaNamesAgentResolverOptions): AgentResolver;
+//# sourceMappingURL=iotaNamesAdapter.d.ts.map

package/dist/iotaNamesAdapter.js

@@ -0,0 +1,188 @@
+import { validateAgentProfile, } from "./profileSchema.js";
+import { resolveAgentValidationErrorCode, } from "./resolveAgent.js";
+import { verifyAgentProfileIdentity } from "./iotaIdentityAdapter.js";
+export const IOTA_NAMES_RESOLVE_ADDRESS_QUERY = `
+query ResolveIotaNamesAddress($name: String!) {
+  resolveIotaNamesAddress(name: $name) {
+    address
+  }
+}
+`;
+export function createFetchIotaNamesGraphQLClient(options) {
+    const fetchImpl = options.fetch ?? fetch;
+    return {
+        async query(request) {
+            const response = await fetchImpl(options.endpoint, {
+                method: "POST",
+                headers: {
+                    "content-type": "application/json",
+                },
+                body: JSON.stringify(request),
+            });
+            if (!response.ok) {
+                return {
+                    errors: [{ message: `IOTA Names GraphQL request failed with HTTP ${response.status}.` }],
+                };
+            }
+            return await response.json();
+        },
+    };
+}
+export async function resolveIotaNamesAddress(name, graphQL) {
+    const normalizedName = normalizeName(name);
+    let response;
+    try {
+        response = await graphQL.query({
+            query: IOTA_NAMES_RESOLVE_ADDRESS_QUERY,
+            variables: { name: normalizedName },
+        });
+    }
+    catch {
+        return {
+            ok: false,
+            name: normalizedName,
+            error: {
+                code: "IOTA_NAMES_GRAPHQL_ERROR",
+                message: "IOTA Names GraphQL request failed.",
+            },
+        };
+    }
+    if (response.errors?.length) {
+        return {
+            ok: false,
+            name: normalizedName,
+            error: {
+                code: "IOTA_NAMES_GRAPHQL_ERROR",
+                message: "IOTA Names GraphQL returned errors.",
+            },
+        };
+    }
+    const resolved = response.data?.resolveIotaNamesAddress;
+    if (resolved === null) {
+        return {
+            ok: false,
+            name: normalizedName,
+            error: {
+                code: "IOTA_NAME_NOT_FOUND",
+                message: "IOTA name did not resolve to an address.",
+            },
+        };
+    }
+    if (!isRecord(resolved) || typeof resolved.address !== "string" || resolved.address.trim() === "") {
+        return {
+            ok: false,
+            name: normalizedName,
+            error: {
+                code: "IOTA_NAMES_MALFORMED_RESPONSE",
+                message: "IOTA Names GraphQL returned a malformed address response.",
+            },
+        };
+    }
+    return {
+        ok: true,
+        name: normalizedName,
+        address: resolved.address,
+        source: "iota-names-graphql",
+    };
+}
+export function createIotaNamesAgentResolver(options) {
+    return {
+        async resolve(name) {
+            const normalizedName = normalizeName(name);
+            const addressResolution = await resolveIotaNamesAddress(normalizedName, options.graphQL);
+            if (!addressResolution.ok) {
+                return resolveNamesError(normalizedName, addressResolution.error.message, addressResolution.error.code);
+            }
+            let profile;
+            try {
+                profile = await options.profileSource.getProfileByAddress(addressResolution.address, {
+                    name: normalizedName,
+                });
+            }
+            catch {
+                return unresolvedProfile(normalizedName, "Agent Profile metadata source failed.");
+            }
+            if (!profile) {
+                return {
+                    ok: false,
+                    error: {
+                        code: "PROFILE_NOT_FOUND",
+                        message: "No Agent Profile metadata was found for the resolved IOTA name address.",
+                        name: normalizedName,
+                    },
+                };
+            }
+            return validateNamesProfile(normalizedName, addressResolution.address, profile, options);
+        },
+    };
+}
+async function validateNamesProfile(name, address, profile, options) {
+    const validation = validateAgentProfile(profile, { now: options.now?.() });
+    if (!validation.ok) {
+        return {
+            ok: false,
+            error: {
+                code: resolveAgentValidationErrorCode(validation.errors),
+                message: "Agent profile failed validation.",
+                name,
+                validationErrors: validation.errors,
+            },
+        };
+    }
+    if (validation.profile.name !== name) {
+        return unresolvedProfile(name, "Resolved profile name does not match the IOTA name.");
+    }
+    if (normalizeAddress(validation.profile.wallet.address) !== normalizeAddress(address)) {
+        return unresolvedProfile(name, "Resolved profile wallet address does not match the IOTA name target.");
+    }
+    if (options.identity) {
+        const identity = await verifyAgentProfileIdentity(validation.profile, options.identity);
+        if (!identity.ok) {
+            return {
+                ok: false,
+                error: {
+                    code: identity.error.code,
+                    message: identity.error.message,
+                    name,
+                },
+            };
+        }
+    }
+    return {
+        ok: true,
+        profile: validation.profile,
+    };
+}
+function resolveNamesError(name, message, code) {
+    if (code === "IOTA_NAME_NOT_FOUND") {
+        return {
+            ok: false,
+            error: {
+                code: "PROFILE_NOT_FOUND",
+                message,
+                name,
+            },
+        };
+    }
+    return unresolvedProfile(name, message);
+}
+function unresolvedProfile(name, message) {
+    return {
+        ok: false,
+        error: {
+            code: "PROFILE_UNVERIFIABLE",
+            message,
+            name,
+        },
+    };
+}
+function normalizeName(name) {
+    return name.trim();
+}
+function normalizeAddress(address) {
+    return address.trim().toLowerCase();
+}
+function isRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+//# sourceMappingURL=iotaNamesAdapter.js.map

package/dist/profileSchema.d.ts

@@ -0,0 +1,76 @@
+export declare const AGENT_PROFILE_VERSION: "agent-profile/v1";
+export type AgentProfileStatus = "active" | "revoked" | "expired";
+export type AgentWalletStatus = "active" | "disabled" | "revoked" | "rotated";
+export interface AgentProfileWallet {
+    readonly walletId: string;
+    readonly address: string;
+    readonly signerRef: string;
+    readonly creationSource: "agent_created" | "operator_provisioned" | "imported_reference";
+    readonly status: AgentWalletStatus;
+    readonly rotatedToWalletId?: string;
+}
+export interface AgentProfileEndpoint {
+    readonly type: "mcp" | "a2a" | "agent_card" | "https";
+    readonly url: string;
+}
+export interface AgentProfileCapability {
+    readonly id: string;
+    readonly displayName?: string;
+    readonly contracts?: readonly string[];
+    readonly scopes?: readonly string[];
+    readonly credentialRefs?: readonly string[];
+}
+export interface AgentProfileContractTemplate {
+    readonly id: string;
+    readonly packageId?: string;
+    readonly module?: string;
+    readonly functionName?: string;
+}
+export interface AgentProfilePaymentMethod {
+    readonly type: "iota" | "x402" | "external";
+    readonly asset: string;
+    readonly address?: string;
+}
+export interface AgentProfileRevocation {
+    readonly revoked: boolean;
+    readonly reason?: string;
+    readonly revokedAt?: string;
+}
+export interface AgentProfile {
+    readonly version: typeof AGENT_PROFILE_VERSION;
+    readonly name: string;
+    readonly agentDid: string;
+    readonly ownerDid: string;
+    readonly wallet: AgentProfileWallet;
+    readonly capabilities: readonly AgentProfileCapability[];
+    readonly endpoints: readonly AgentProfileEndpoint[];
+    readonly credentialRefs?: readonly string[];
+    readonly supportedContracts?: readonly AgentProfileContractTemplate[];
+    readonly paymentMethods?: readonly AgentProfilePaymentMethod[];
+    readonly spendPolicyRef?: string;
+    readonly reputationRef?: string;
+    readonly expiresAt: string;
+    readonly status: AgentProfileStatus;
+    readonly revocation: AgentProfileRevocation;
+    readonly metadata?: Record<string, string>;
+}
+export type AgentProfileValidationErrorCode = "PROFILE_NOT_OBJECT" | "UNSUPPORTED_VERSION" | "REQUIRED_FIELD_MISSING" | "FIELD_INVALID" | "PROFILE_REVOKED" | "PROFILE_EXPIRED" | "SECRET_FIELD_NOT_ALLOWED";
+export interface AgentProfileValidationError {
+    readonly code: AgentProfileValidationErrorCode;
+    readonly path: string;
+    readonly message: string;
+}
+export type AgentProfileValidationResult = {
+    readonly ok: true;
+    readonly profile: AgentProfile;
+} | {
+    readonly ok: false;
+    readonly errors: readonly AgentProfileValidationError[];
+    readonly status?: AgentProfileStatus;
+};
+export interface AgentProfileValidationOptions {
+    readonly now?: Date;
+}
+export declare function validAgentProfileFixture(): AgentProfile;
+export declare function validateAgentProfile(value: unknown, options?: AgentProfileValidationOptions): AgentProfileValidationResult;
+//# sourceMappingURL=profileSchema.d.ts.map