burnledger 0.8.1 → 0.9.0

package/src/web-verifier.ts

@@ -27,11 +27,12 @@ import { CERTIFICATE_REVOKED, UNSUPPORTED_FORMAT_VERSION } from "./errors.js";
 import {
   verifyCertificate as _verifyCertificate,
   verifyCertificateWithStatus as _verifyCertificateWithStatus,
+  verifyStatusStatement as _verifyStatusStatement,
   verifyTransparency as _verifyTransparency,
   publicKeyFromHex as _publicKeyFromHex,
   KNOWN_FORMAT_VERSIONS,
 } from "./verify.js";
-import type { PublicKeyInfo, PublicKeyOptions } from "./verify.js";
+import type { PublicKeyInfo, PublicKeyOptions, VerifyOptions } from "./verify.js";
 import { parseKeyListDocument, verifyKeyList as _verifyKeyList } from "./keys.js";
 import type { KeyListDocument, KeyListEvidence } from "./keys.js";
 import type { VerificationResult, TransparencyResult } from "./models.js";
@@ -42,8 +43,9 @@ type Cert = Record<string, unknown>;
 export function verifyCertificate(
   certificate: Cert,
   publicKeys: Map<string, PublicKeyInfo>,
+  options?: VerifyOptions,
 ): Promise<VerificationResult> {
-  return _verifyCertificate(browserCrypto, certificate, publicKeys);
+  return _verifyCertificate(browserCrypto, certificate, publicKeys, options);
 }
 
 /**
@@ -57,8 +59,9 @@ export function verifyCertificateWithStatus(
   publicKeys: Map<string, PublicKeyInfo>,
   status?: Record<string, unknown> | null,
   now?: Date,
+  options?: VerifyOptions,
 ): Promise<string> {
-  return _verifyCertificateWithStatus(browserCrypto, certificate, publicKeys, status, now);
+  return _verifyCertificateWithStatus(browserCrypto, certificate, publicKeys, status, now, options);
 }
 
 /**
@@ -88,6 +91,29 @@ export function checkStatementAnchor(
 
 export { ANCHOR_CONFIRMED, ANCHOR_INCONSISTENT, ANCHOR_UNVERIFIED };
 
+/**
+ * The CLIs' reading of a fetched status reply: throws unless it is a statement
+ * at all. The status button uses it so a reply that is not one reads as
+ * silence, as `burnledger check --online` reads it, rather than as a statement
+ * that failed.
+ */
+export { unwrapStatusStatement } from "./status-document.js";
+
+/**
+ * Authenticate a status statement about one record id, with no record in hand:
+ * the status button's checks, less the record's own. The QR lookup uses it, so
+ * it shows what a signed, fresh statement says and never what the endpoint
+ * claims.
+ */
+export function verifyStatusStatement(
+  statement: Record<string, unknown>,
+  publicKeys: Map<string, PublicKeyInfo>,
+  certificateId: string,
+  now?: Date,
+): Promise<string> {
+  return _verifyStatusStatement(browserCrypto, statement, publicKeys, certificateId, now);
+}
+
 /**
  * Every record format this bundle can read, oldest first.
  *
@@ -101,6 +127,13 @@ export { ANCHOR_CONFIRMED, ANCHOR_INCONSISTENT, ANCHOR_UNVERIFIED };
  */
 export { KNOWN_FORMAT_VERSIONS };
 
+/**
+ * What the registration row says `certified` is evidence of, in the CLIs'
+ * words: the image a record names decides it. Exported so the page states it
+ * from the SDK's closed list of protocol-11 images rather than from a copy.
+ */
+export { issuingImage, registrationQualifier } from "./verify.js";
+
 /** Verify the transparency proof embedded in a certificate. */
 export function verifyTransparency(
   certificate: Cert,