antifraud-sdk-core-ts 0.1.2 → 0.1.3

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## Unreleased
 
+## 0.1.3 - 2026-10-18
+
+- Consume `antifraud-data-utils-ts@0.1.4` and orchestrate Schema.org
+  confidential-document delivery through canonical inline or protected-link
+  DIDComm attachments.
+- Preserve trusted sender and recipient bindings, idempotent operation replay,
+  exact byte-count agreement and separate delivery, read and signature states.
+
 ## 0.1.2 - 2026-10-18
 
 - Replace binary qualification-issuer lookup with explicit

package/README.md

@@ -76,6 +76,16 @@ fails before evidence recording. See [Qualification evidence confirmation protot
 for attachment, issuer notification, ledger recovery and credential-rendering
 boundaries.
 
+## Schema.org document delivery
+
+Antifraud documents are Schema.org `DigitalDocument` resources with concrete
+`MediaObject` encodings. They are never FHIR `DocumentReference` resources.
+`createDocumentDeliveryController` consumes the canonical data-utils contract
+and carries governed bytes through DIDComm `attachments[]`, inline or by
+protected reference. Trusted sender, recipient and service bindings remain
+server-owned; replay is operation-idempotent; receipt storage contains no raw
+bytes. Delivery, read and signature remain distinct states.
+
 ## Dependency direction
 
 ```text

package/dist/document-delivery-controller.d.ts

@@ -0,0 +1,62 @@
+import { buildSchemaOrgConfidentialDocumentGraph, type DidCommBinaryAttachment, type SchemaOrgDigitalDocumentDescriptor, type SchemaOrgEvidenceMediaAttachment } from 'antifraud-data-utils-ts';
+export type TrustedDocumentDeliveryContext = Readonly<{
+    senderReference: string;
+    recipientReference: string;
+    serviceReference: string;
+}>;
+export type DocumentDeliveryAttachmentInput = Readonly<{
+    kind: 'inline';
+    mediaObject: SchemaOrgEvidenceMediaAttachment;
+    bytes: Uint8Array;
+}> | Readonly<{
+    kind: 'linked';
+    mediaObject: SchemaOrgEvidenceMediaAttachment;
+}>;
+export type DocumentDeliveryRequest = Readonly<{
+    operationId: string;
+    messageId: string;
+    trustedContext: TrustedDocumentDeliveryContext;
+    manifest: SchemaOrgDigitalDocumentDescriptor;
+    document: SchemaOrgDigitalDocumentDescriptor;
+    attachment: DocumentDeliveryAttachmentInput;
+}>;
+export type PreparedDocumentDelivery = Readonly<{
+    operationId: string;
+    messageId: string;
+    trustedContext: TrustedDocumentDeliveryContext;
+    documentGraph: ReturnType<typeof buildSchemaOrgConfidentialDocumentGraph>;
+    attachments: readonly [DidCommBinaryAttachment];
+}>;
+export type DocumentDeliveryReceipt = Readonly<{
+    operationId: string;
+    messageId: string;
+    deliveryReference: string;
+    deliveredAt: string;
+    deliveryStatus: 'delivered';
+    readStatus: 'unread';
+    signatureStatus: 'unsigned';
+}>;
+type DocumentDeliveryContinuity = Readonly<{
+    messageId: string;
+    senderReference: string;
+    recipientReference: string;
+    contentId: string;
+    receipt: DocumentDeliveryReceipt;
+}>;
+export type DocumentDeliveryControllerPorts = Readonly<{
+    transport: Readonly<{
+        send(delivery: PreparedDocumentDelivery): Promise<Readonly<{
+            deliveryReference: string;
+            deliveredAt: string;
+        }>>;
+    }>;
+    receipts: Readonly<{
+        get(operationId: string): Promise<DocumentDeliveryContinuity | undefined>;
+        put(operationId: string, record: DocumentDeliveryContinuity): Promise<void>;
+    }>;
+}>;
+export declare function createDocumentDeliveryController(ports: DocumentDeliveryControllerPorts): Readonly<{
+    deliver(request: DocumentDeliveryRequest): Promise<DocumentDeliveryReceipt>;
+}>;
+export {};
+//# sourceMappingURL=document-delivery-controller.d.ts.map

package/dist/document-delivery-controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-delivery-controller.d.ts","sourceRoot":"","sources":["../src/document-delivery-controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,uCAAuC,EACvC,KAAK,uBAAuB,EAC5B,KAAK,kCAAkC,EACvC,KAAK,gCAAgC,EACtC,MAAM,yBAAyB,CAAA;AAEhC,MAAM,MAAM,8BAA8B,GAAG,QAAQ,CAAC;IACpD,eAAe,EAAE,MAAM,CAAA;IACvB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,gBAAgB,EAAE,MAAM,CAAA;CACzB,CAAC,CAAA;AAEF,MAAM,MAAM,+BAA+B,GACvC,QAAQ,CAAC;IACP,IAAI,EAAE,QAAQ,CAAA;IACd,WAAW,EAAE,gCAAgC,CAAA;IAC7C,KAAK,EAAE,UAAU,CAAA;CAClB,CAAC,GACF,QAAQ,CAAC;IACP,IAAI,EAAE,QAAQ,CAAA;IACd,WAAW,EAAE,gCAAgC,CAAA;CAC9C,CAAC,CAAA;AAEN,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAC7C,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,8BAA8B,CAAA;IAC9C,QAAQ,EAAE,kCAAkC,CAAA;IAC5C,QAAQ,EAAE,kCAAkC,CAAA;IAC5C,UAAU,EAAE,+BAA+B,CAAA;CAC5C,CAAC,CAAA;AAEF,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC;IAC9C,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,8BAA8B,CAAA;IAC9C,aAAa,EAAE,UAAU,CAAC,OAAO,uCAAuC,CAAC,CAAA;IACzE,WAAW,EAAE,SAAS,CAAC,uBAAuB,CAAC,CAAA;CAChD,CAAC,CAAA;AAEF,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAC7C,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,iBAAiB,EAAE,MAAM,CAAA;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,WAAW,CAAA;IAC3B,UAAU,EAAE,QAAQ,CAAA;IACpB,eAAe,EAAE,UAAU,CAAA;CAC5B,CAAC,CAAA;AAEF,KAAK,0BAA0B,GAAG,QAAQ,CAAC;IACzC,SAAS,EAAE,MAAM,CAAA;IACjB,eAAe,EAAE,MAAM,CAAA;IACvB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,uBAAuB,CAAA;CACjC,CAAC,CAAA;AAEF,MAAM,MAAM,+BAA+B,GAAG,QAAQ,CAAC;IACrD,SAAS,EAAE,QAAQ,CAAC;QAClB,IAAI,CAAC,QAAQ,EAAE,wBAAwB,GAAG,OAAO,CAAC,QAAQ,CAAC;YACzD,iBAAiB,EAAE,MAAM,CAAA;YACzB,WAAW,EAAE,MAAM,CAAA;SACpB,CAAC,CAAC,CAAA;KACJ,CAAC,CAAA;IACF,QAAQ,EAAE,QAAQ,CAAC;QACjB,GAAG,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAAA;QACzE,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAC5E,CAAC,CAAA;CACH,CAAC,CAAA;AAqDF,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,+BAA+B;qBAE5D,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC;GA+BpF"}

package/dist/document-delivery-controller.js

@@ -0,0 +1,77 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { buildDidCommInlineBinaryAttachment, buildDidCommLinkedBinaryAttachment, buildSchemaOrgConfidentialDocumentGraph, } from 'antifraud-data-utils-ts';
+function requireNonEmpty(value, path) {
+    const normalized = value.trim();
+    if (!normalized)
+        throw new TypeError(`${path} must not be empty`);
+    return normalized;
+}
+function prepareDocumentDelivery(request) {
+    const operationId = requireNonEmpty(request.operationId, 'operationId');
+    const messageId = requireNonEmpty(request.messageId, 'messageId');
+    const trustedContext = Object.freeze({
+        senderReference: requireNonEmpty(request.trustedContext.senderReference, 'senderReference'),
+        recipientReference: requireNonEmpty(request.trustedContext.recipientReference, 'recipientReference'),
+        serviceReference: requireNonEmpty(request.trustedContext.serviceReference, 'serviceReference'),
+    });
+    const documentGraph = buildSchemaOrgConfidentialDocumentGraph({
+        manifest: request.manifest,
+        documents: [{ ...request.document, attachment: request.attachment.mediaObject }],
+    });
+    const attachment = request.attachment.kind === 'inline'
+        ? buildDidCommInlineBinaryAttachment({
+            id: request.attachment.mediaObject.id,
+            mediaType: request.attachment.mediaObject.mediaType,
+            bytes: request.attachment.bytes,
+        })
+        : buildDidCommLinkedBinaryAttachment(request.attachment.mediaObject);
+    if (attachment.byte_count !== request.attachment.mediaObject.contentSize) {
+        throw new TypeError('DIDComm attachment byte count does not match the Schema.org MediaObject');
+    }
+    return Object.freeze({
+        operationId,
+        messageId,
+        trustedContext,
+        documentGraph,
+        attachments: Object.freeze([attachment]),
+    });
+}
+function isSameOperation(current, prepared, contentId) {
+    return current.messageId === prepared.messageId
+        && current.senderReference === prepared.trustedContext.senderReference
+        && current.recipientReference === prepared.trustedContext.recipientReference
+        && current.contentId === contentId;
+}
+export function createDocumentDeliveryController(ports) {
+    return Object.freeze({
+        async deliver(request) {
+            const prepared = prepareDocumentDelivery(request);
+            const contentId = request.attachment.mediaObject.contentId;
+            const current = await ports.receipts.get(prepared.operationId);
+            if (current) {
+                if (!isSameOperation(current, prepared, contentId)) {
+                    throw new Error('Document delivery operation replay does not match the original request');
+                }
+                return current.receipt;
+            }
+            const delivered = await ports.transport.send(prepared);
+            const receipt = Object.freeze({
+                operationId: prepared.operationId,
+                messageId: prepared.messageId,
+                deliveryReference: requireNonEmpty(delivered.deliveryReference, 'deliveryReference'),
+                deliveredAt: requireNonEmpty(delivered.deliveredAt, 'deliveredAt'),
+                deliveryStatus: 'delivered',
+                readStatus: 'unread',
+                signatureStatus: 'unsigned',
+            });
+            await ports.receipts.put(prepared.operationId, Object.freeze({
+                messageId: prepared.messageId,
+                senderReference: prepared.trustedContext.senderReference,
+                recipientReference: prepared.trustedContext.recipientReference,
+                contentId,
+                receipt,
+            }));
+            return receipt;
+        },
+    });
+}

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export * from './openid4vp.js';
 export * from './credential-issuance-controller.js';
+export * from './document-delivery-controller.js';
 export * from './presentation-controller.js';
 export * from './presentation-session.js';
 export * from './qualification-evidence-controller.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qCAAqC,CAAA;AACnD,cAAc,8BAA8B,CAAA;AAC5C,cAAc,2BAA2B,CAAA;AACzC,cAAc,wCAAwC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qCAAqC,CAAA;AACnD,cAAc,mCAAmC,CAAA;AACjD,cAAc,8BAA8B,CAAA;AAC5C,cAAc,2BAA2B,CAAA;AACzC,cAAc,wCAAwC,CAAA"}

package/dist/index.js

@@ -1,5 +1,6 @@
 export * from './openid4vp.js';
 export * from './credential-issuance-controller.js';
+export * from './document-delivery-controller.js';
 export * from './presentation-controller.js';
 export * from './presentation-session.js';
 export * from './qualification-evidence-controller.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "antifraud-sdk-core-ts",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Runtime-neutral orchestration for identity verification and provider-issued credentials",
   "type": "module",
   "main": "./dist/index.js",
@@ -34,6 +34,6 @@
     "typescript": "^5.9.3"
   },
   "dependencies": {
-    "antifraud-data-utils-ts": "0.1.3"
+    "antifraud-data-utils-ts": "0.1.4"
   }
 }