ceramicnetwork · PaulLeCam · Feb 24, 2023 · Feb 24, 2023
diff --git a/package.json b/package.json
@@ -11,23 +11,23 @@
     "prepare": "pnpm build"
   },
   "devDependencies": {
-    "@jest/globals": "^28.1.3",
+    "@jest/globals": "^29.4.3",
     "@skypack/package-check": "^0.2.2",
-    "@swc/cli": "^0.1.57",
-    "@swc/core": "^1.2.209",
-    "@swc/jest": "^0.2.20",
-    "@types/jest": "^28.1.6",
-    "@typescript-eslint/eslint-plugin": "^5.30.5",
-    "@typescript-eslint/parser": "^5.30.5",
+    "@swc/cli": "^0.1.62",
+    "@swc/core": "^1.3.36",
+    "@swc/jest": "^0.2.24",
+    "@types/jest": "^29.4.0",
+    "@typescript-eslint/eslint-plugin": "^5.53.0",
+    "@typescript-eslint/parser": "^5.53.0",
     "del-cli": "^5.0.0",
-    "eslint": "^8.19.0",
+    "eslint": "^8.34.0",
     "eslint-config-3box": "^0.4.0",
-    "eslint-plugin-jest": "^26.5.3",
-    "jest": "^28.1.3",
-    "prettier": "^2.7.1",
-    "turbo": "^1.3.1",
-    "typedoc": "0.23.10",
-    "typedoc-plugin-markdown": "^3.12.1",
-    "typescript": "^4.7.4"
+    "eslint-plugin-jest": "^27.2.1",
+    "jest": "^29.4.3",
+    "prettier": "^2.8.4",
+    "turbo": "^1.8.2",
+    "typedoc": "0.23.25",
+    "typedoc-plugin-markdown": "^3.14.0",
+    "typescript": "^4.9.5"
   }
 }
diff --git a/packages/cacao/package.json b/packages/cacao/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@didtools/cacao",
-  "version": "1.2.0",
+  "version": "2.0.0",
   "description": "Typescript library for Ceramic OCAP",
   "author": "Haardik <hhaardik@uwaterloo.ca>",
   "license": "(Apache-2.0 OR MIT)",
@@ -43,15 +43,15 @@
   },
   "homepage": "https://github.com/ceramicnetwork/js-did#readme",
   "dependencies": {
-    "@ipld/dag-cbor": "^7.0.1",
-    "apg-js": "^4.1.1",
+    "@ipld/dag-cbor": "^9.0.0",
+    "apg-js": "^4.1.3",
     "caip": "^1.1.0",
-    "multiformats": "^9.5.1",
-    "uint8arrays": "^4.0.2"
+    "multiformats": "^11.0.1",
+    "uint8arrays": "^4.0.3"
   },
   "devDependencies": {
-    "@types/luxon": "^3.0.0",
-    "@types/node": "^18.11.7",
-    "luxon": "^3.0.1"
+    "@types/luxon": "^3.2.0",
+    "@types/node": "^18.14.1",
+    "luxon": "^3.2.1"
   }
 }
diff --git a/packages/did-session/package.json b/packages/did-session/package.json
@@ -1,6 +1,6 @@
 {
   "name": "did-session",
-  "version": "1.0.0",
+  "version": "2.0.0",
   "description": "Manage user DIDs in a web environment",
   "author": "3Box Labs",
   "license": "(Apache-2.0 OR MIT)",
@@ -40,29 +40,29 @@
     "prepublishOnly": "package-check"
   },
   "dependencies": {
-    "@ceramicnetwork/stream-tile": "^2.4.4",
+    "@ceramicnetwork/stream-tile": "^2.16.0",
     "@stablelib/random": "^1.0.1",
-    "dids": "workspace:^3.2.0",
-    "key-did-provider-ed25519": "workspace:^2.0.1",
-    "key-did-resolver": "workspace:^2.1.2",
-    "uint8arrays": "^3.0.0"
+    "dids": "workspace:^4.0.0",
+    "key-did-provider-ed25519": "workspace:^3.0.0",
+    "key-did-resolver": "workspace:^3.0.0",
+    "uint8arrays": "^4.0.3"
   },
   "devDependencies": {
-    "@ceramicnetwork/common": "^2.7.0",
-    "@ceramicnetwork/stream-model": "^0.6.0",
-    "@ceramicnetwork/stream-model-instance": "^0.4.2",
-    "@ceramicnetwork/streamid": "^2.3.4",
+    "@ceramicnetwork/common": "^2.20.0",
+    "@ceramicnetwork/stream-model": "^1.2.0",
+    "@ceramicnetwork/stream-model-instance": "^1.2.0",
+    "@ceramicnetwork/streamid": "^2.12.0",
+    "@didtools/cacao": "workspace:^2.0.0",
+    "@didtools/pkh-ethereum": "workspace:^0.1.0",
+    "@didtools/pkh-solana": "workspace:^0.1.0",
     "@ethersproject/wallet": "^5.6.2",
-    "@jest/globals": "^28.1.3",
+    "@jest/globals": "^29.4.3",
+    "@stablelib/ed25519": "^1.0.3",
     "@types/create-hash": "^1.2.2",
     "@types/secp256k1": "^4.0.3",
     "ajv-formats": "^2.1.1",
-    "@didtools/cacao": "workspace:^1.2.0",
     "caip": "^1.1.0",
-    "@didtools/pkh-ethereum": "workspace:^0.0.3",
-    "@didtools/pkh-solana": "workspace:^0.0.4",
-    "@stablelib/ed25519": "^1.0.3",
-    "jest-environment-ceramic": "workspace:^0.16.0"
+    "jest-environment-ceramic": "workspace:^0.17.0"
   },
   "jest": {
     "extensionsToTreatAsEsm": [
@@ -80,4 +80,4 @@
       ]
     }
   }
-}
+}
diff --git a/packages/did-session/test/lib.test.ts b/packages/did-session/test/lib.test.ts
@@ -21,6 +21,7 @@ import { DID } from 'dids'
 import { getResolver } from 'key-did-resolver'
 
 const getModelDef = (name: string): ModelDefinition => ({
+  version: Model.VERSION,
   name: name,
   accountRelation: { type: 'list' },
   schema: {

diff --git a/packages/dids/package.json b/packages/dids/package.json
@@ -1,6 +1,6 @@
 {
   "name": "dids",
-  "version": "3.3.1",
+  "version": "4.0.0",
   "description": "Typescript library for interacting with DIDs",
   "author": "Joel Thorstensson <oed@3box.io>",
   "license": "(Apache-2.0 OR MIT)",
@@ -43,15 +43,15 @@
   },
   "homepage": "https://github.com/ceramicnetwork/js-did#readme",
   "dependencies": {
+    "@didtools/cacao": "workspace:^2.0.0",
+    "@didtools/pkh-ethereum": "workspace:^0.1.0",
     "@stablelib/random": "^1.0.1",
-    "@didtools/cacao": "workspace:^1.2.0",
-    "dag-jose-utils": "^2.0.0",
-    "did-jwt": "^6.0.0",
-    "did-resolver": "^3.1.5",
-    "@didtools/pkh-ethereum": "workspace:^0.0.3",
-    "multiformats": "^9.4.10",
+    "dag-jose-utils": "^3.0.0",
+    "did-jwt": "^6.11.1",
+    "did-resolver": "^4.0.1",
+    "multiformats": "^11.0.1",
     "rpc-utils": "^0.6.1",
-    "uint8arrays": "^3.0.0"
+    "uint8arrays": "^4.0.3"
   },
   "devDependencies": {
     "@stablelib/x25519": "^1.0.2",

diff --git a/packages/dids/src/index.ts b/packages/dids/src/index.ts
@@ -135,21 +135,21 @@
  * ## Security Considerations
  *
  * ### Usage in anchored event streams or log based data structures
- * 
+ *
  * There is an option to allow keys attached to DIDs to continue making updates to streams after revocation for a certain grace period. This is done to avoid incorrectly rejecting valid signatures as being performed with a revoked key when in fact the key was valid at the time of the signature. This can happen due to the implementation details of how a protocol determines when a DID issues a signature as well as how a protocol determines when an authentication key for a DID is revoked. Since we cannot trust the system clock time on the client's machine when performing a signature or key revocation, periodic "anchor" updates are made on a blockchain to get a timestamp before which we know the write must have happened. Consider the following scenario:
- * 
+ *
  * 1. Commit for an update is made to Node A
  * 2. Node B's key revocation commit is anchored before node A's update
  * 3. Node A later tries to anchor the commit made earlier
- * 
+ *
  * In this case, an external outlook might lead you to believe Node A's commit is invalid because the key had been revoked when it was made, but that's not actually true as in this case the commit was in fact made earlier in real world time, it just wasn't assigned a timestamp by the anchoring system until after. For this reason, a grace period is provided for updates created by revoked keys to still be verified successfully.
- * 
+ *
  * Specifically, the `verifyJWS` function in `dids` uses `options.revocationPhaseOutSecs` as the seconds representing the grace period within which signatures authored by a given key that otherwise appears to be revoked will still be considered valid.
- * 
+ *
  * While this approach helps solve the problem of incorrectly rejecting valid updates, it also implies that an attacker could potentially author signatures from a stolen key and commit updates to streams using that stolen key. Even if the original owner revoked the compromised key, the attacker has a grace period within which they can continue to make new commits. The best practice to mitigate this is to rotate keys associated to DIDs on a regular basis to make it less likely to have a compromised key associated with the DID.
- * 
+ *
  * The `revocationPhaseOutSecs` value, therefore, should be set with this consideration in mind to a reasonable value. It either allows for a better UX for the owner and allows for a small window of attack for an attacker, or it does not allow for an attack window but can potentially mark certain commits as invalid due to latency in commits occuring.
- * 
+ *
  * @module dids
  */
 

diff --git a/packages/dids/test/jws-verification-behavior.test.ts b/packages/dids/test/jws-verification-behavior.test.ts
@@ -292,7 +292,7 @@ describe('issuer', () => {
     const issuer = COMPOSITE_ISSUER_EMPTY.didDocument.id
     const { kid } = await did.verifyJWS(jwsV0, { issuer: issuer })
     expect(kid).toMatchSnapshot()
-    expect(fauxResolve).toBeCalledWith(issuer)
+    expect(fauxResolve).toHaveBeenCalledWith(issuer)
   })
   test('does not include signer as controller', async () => {
     const issuer = COMPOSITE_ISSUER_EMPTY.didDocument.id

diff --git a/packages/dids/test/provider-behavior.test.ts b/packages/dids/test/provider-behavior.test.ts
@@ -381,7 +381,7 @@ describe('`createDagJWS method`', () => {
         capability: cacao,
         atTime: new Date('2021-10-30T16:25:24.000Z'),
       })
-    ).resolves.not.toThrowError()
+    ).resolves.not.toThrow()
 
     // Expired
     await expect(
@@ -390,7 +390,7 @@ describe('`createDagJWS method`', () => {
         capability: cacao,
         atTime: new Date('2023-10-30T16:25:24.000Z'),
       })
-    ).rejects.toThrowError()
+    ).rejects.toThrow()
 
     // Valid: Expiration not checked
     await expect(
@@ -400,7 +400,7 @@ describe('`createDagJWS method`', () => {
         disableTimecheck: true,
         atTime: new Date('2023-10-30T16:25:24.000Z'),
       })
-    ).resolves.not.toThrowError()
+    ).resolves.not.toThrow()
 
     expect(res).toEqual({
       jws: {
@@ -496,8 +496,8 @@ describe('`createDagJWS method`', () => {
       foo: Buffer.from('foo'),
     }
 
-    await expect(did.createDagJWS(data)).rejects.toThrowError(/Capability is expired/)
-    await expect(did.createJWS(data)).rejects.toThrowError(/Capability is expired/)
+    await expect(did.createDagJWS(data)).rejects.toThrow(/Capability is expired/)
+    await expect(did.createJWS(data)).rejects.toThrow(/Capability is expired/)
   })
 
   test('creates a DagJWS correctly', async () => {

diff --git a/packages/integration/package.json b/packages/integration/package.json
@@ -4,7 +4,7 @@
   "author": "3Box Labs",
   "license": "(Apache-2.0 OR MIT)",
   "type": "module",
-  "main": "dist/index.js", 
+  "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "exports": {
     ".": "./dist/index.js"
@@ -44,17 +44,17 @@
   },
   "homepage": "https://github.com/ceramicnetwork/js-did#readme",
   "devDependencies": {
-    "@didtools/cacao": "workspace:^1.2.0",
-    "@didtools/pkh-ethereum": "workspace:^0.0.3",
-    "@didtools/pkh-solana": "workspace:^0.0.4",
+    "@didtools/cacao": "workspace:^2.0.0",
+    "@didtools/pkh-ethereum": "workspace:^0.1.0",
+    "@didtools/pkh-solana": "workspace:^0.1.0",
     "@ethersproject/wallet": "^5.5.0",
-    "@ipld/dag-cbor": "^7.0.1",
+    "@ipld/dag-cbor": "^9.0.0",
     "@stablelib/ed25519": "^1.0.2",
-    "apg-js": "^4.1.1",
+    "@types/luxon": "^3.2.0",
+    "apg-js": "^4.1.3",
     "caip": "^1.1.0",
-    "multiformats": "^9.5.1",
-    "uint8arrays": "^3.0.0",
-    "@types/luxon": "^3.0.0",
-    "luxon": "^3.0.1"
+    "luxon": "^3.2.1",
+    "multiformats": "^11.0.1",
+    "uint8arrays": "^4.0.3"
   }
 }
diff --git a/packages/integration/test/__snapshots__/cacao-siwe.test.ts.snap b/packages/integration/test/__snapshots__/cacao-siwe.test.ts.snap
@@ -554,64 +554,27 @@ Block {
     57,
     49,
   ],
-  "cid": Object {
-    "code": 113,
-    "hash": Uint8Array [
-      18,
-      32,
-      32,
-      130,
-      251,
-      89,
-      255,
-      170,
-      141,
-      31,
-      230,
-      131,
-      54,
-      64,
-      251,
-      129,
-      9,
-      215,
-      112,
-      221,
-      247,
-      194,
-      177,
-      36,
-      178,
-      7,
-      221,
-      103,
-      239,
-      157,
-      85,
-      31,
-      0,
-      203,
-    ],
-    "version": 1,
+  "cid": {
+    "/": "bafyreibaql5vt75krup6nazwid5yccoxodo7pqvreszapxlh56ovkhyazm",
   },
-  "value": Object {
-    "h": Object {
+  "value": {
+    "h": {
       "t": "eip4361",
     },
-    "p": Object {
+    "p": {
       "aud": "did:key:z6MkrBdNdwUPnXDVD1DCxedzVVBpaGi8aSmoXFAeKNgtAer8",
       "domain": "service.org",
       "iat": "2021-10-14T07:18:41.000Z",
       "iss": "did:pkh:eip155:1:0xBd9D9c7DC389715a89fC8149E4a5Be91336B2796",
       "nonce": "32891757",
-      "resources": Array [
+      "resources": [
         "ipfs://Qme7ss3ARVgxv6rXqVPiikMJ8u2NLgmgszg13pYrDKEoiu",
         "https://example.com/my-web2-claim.json",
       ],
       "statement": "I accept the ServiceOrg Terms of Service: https://service.org/tos",
       "version": "1",
     },
-    "s": Object {
+    "s": {
       "s": "0xed60ce36a2c6205f7a161d452a14519e48fa7329cb6c9dd1fca92f69a474c98a3ec498fe7efb1e4db16bbaca4a0e0f7c9725566af017edc6492996cc94f7ceff1b",
       "t": "eip191",
     },