@ajna-inc/openbadges 0.1.0

package/build/services/IssuerService.js

@@ -0,0 +1,225 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IssuerService = void 0;
+const core_1 = require("@credo-ts/core");
+const OpenBadgeCredentialRepository_1 = require("../repository/OpenBadgeCredentialRepository");
+const OpenBadgeCredentialRecord_1 = require("../repository/OpenBadgeCredentialRecord");
+const validate_1 = require("../utils/validate");
+const ClrCredential_1 = require("../models/ClrCredential");
+const uuid_1 = require("uuid");
+const ProofService_1 = require("./ProofService");
+const constants_1 = require("../constants");
+const OpenBadgesModuleConfig_1 = require("../OpenBadgesModuleConfig");
+const KeyService_1 = require("./KeyService");
+let IssuerService = class IssuerService {
+    constructor(repository, proofs, keys, config) {
+        this.repository = repository;
+        this.proofs = proofs;
+        this.keys = keys;
+        this.config = config;
+    }
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    async issueCredential(agentContext, input) {
+        console.log('[OB] IssuerService.issueCredential() start');
+        // Ensure required contexts are present
+        const base = Array.isArray(input?.['@context']) ? input['@context'] : input?.['@context'] ? [input['@context']] : [];
+        const withCtx = { ...input, '@context': Array.from(new Set([constants_1.VC_V2_CONTEXT, constants_1.OBV3_CONTEXT, ...base])) };
+        // Never pass an existing proof into the signer; suites will create the proof
+        const toSign = { ...withCtx };
+        try {
+            delete toSign.proof;
+        }
+        catch { }
+        // Validate the envelope
+        const issues = (0, validate_1.validateObEnvelope)(withCtx);
+        if (issues.length) {
+            console.error('[OB] Invalid OBv3 envelope issues:', issues);
+            throw new Error(`Invalid OBv3 envelope: ${issues.map((i) => i.code).join(', ')}`);
+        }
+        // Resolve / ensure key binding for verificationMethod
+        const verificationMethod = input?.proof?.verificationMethod;
+        console.log('[OB] VM provided:', verificationMethod);
+        if (!verificationMethod) {
+            console.error('[OB] missing_verification_method_key');
+            throw new Error('missing_verification_method_key');
+        }
+        const controller = verificationMethod.split('#')[0];
+        try {
+            await this.keys.ensureBinding(agentContext, { controller, vmId: verificationMethod });
+        }
+        catch (e) {
+            console.warn('[OB] ensureBinding failed:', e?.message || e);
+        }
+        const signed = await this.proofs.sign(agentContext, toSign, { id: verificationMethod, controller });
+        const record = new OpenBadgeCredentialRecord_1.OpenBadgeCredentialRecord({
+            credential: signed,
+            derived: undefined,
+            status: 'unknown',
+        });
+        try {
+            await this.repository.save(agentContext, record);
+            console.log('[OB] Saved OpenBadgeCredentialRecord id:', record.id);
+        }
+        catch (e) {
+            console.error('[OB] repository.save failed:', e?.message || e);
+            throw e;
+        }
+        return record;
+    }
+    /**
+     * Issues an EndorsementCredential - a third-party validation credential
+     *
+     * EndorsementCredentials allow external organizations or individuals to
+     * endorse achievements, profiles, or other credentials.
+     *
+     * @param agentContext - The agent context
+     * @param input - The endorsement credential input
+     * @returns The saved credential record
+     */
+    async issueEndorsement(agentContext, input) {
+        console.log('[OB] IssuerService.issueEndorsement() start');
+        // Build the endorsement credential structure
+        const credentialId = input.id || `urn:uuid:${(0, uuid_1.v4)()}`;
+        const validFrom = input.validFrom || new Date().toISOString();
+        const endorsementCredential = {
+            '@context': [constants_1.VC_V2_CONTEXT, constants_1.OBV3_CONTEXT],
+            type: ['VerifiableCredential', 'EndorsementCredential'],
+            id: credentialId,
+            issuer: input.issuerProfile,
+            validFrom,
+            ...(input.validUntil && { validUntil: input.validUntil }),
+            credentialSubject: {
+                id: input.endorsedEntity,
+                type: 'EndorsementSubject',
+                ...(input.endorsementComment && { endorsementComment: input.endorsementComment }),
+            },
+        };
+        // Validate the envelope
+        const issues = (0, validate_1.validateEndorsementEnvelope)(endorsementCredential);
+        if (issues.length) {
+            console.error('[OB] Invalid EndorsementCredential envelope issues:', issues);
+            throw new Error(`Invalid EndorsementCredential envelope: ${issues.map((i) => i.code).join(', ')}`);
+        }
+        // Resolve / ensure key binding for verificationMethod
+        const verificationMethod = input.verificationMethod;
+        console.log('[OB] Endorsement VM provided:', verificationMethod);
+        if (!verificationMethod) {
+            console.error('[OB] missing_verification_method_key');
+            throw new Error('missing_verification_method_key');
+        }
+        const controller = verificationMethod.split('#')[0];
+        try {
+            await this.keys.ensureBinding(agentContext, { controller, vmId: verificationMethod });
+        }
+        catch (e) {
+            console.warn('[OB] ensureBinding failed:', e?.message || e);
+        }
+        const signed = await this.proofs.sign(agentContext, endorsementCredential, { id: verificationMethod, controller });
+        const record = new OpenBadgeCredentialRecord_1.OpenBadgeCredentialRecord({
+            credential: signed,
+            derived: undefined,
+            status: 'unknown',
+        });
+        try {
+            await this.repository.save(agentContext, record);
+            console.log('[OB] Saved EndorsementCredential record id:', record.id);
+        }
+        catch (e) {
+            console.error('[OB] repository.save failed:', e?.message || e);
+            throw e;
+        }
+        return record;
+    }
+    /**
+     * Issues a ClrCredential - a Comprehensive Learner Record bundling multiple credentials
+     *
+     * CLR credentials allow bundling multiple OpenBadgeCredentials into a single
+     * verifiable credential representing a learner's complete achievement record.
+     *
+     * @param agentContext - The agent context
+     * @param input - The CLR credential input
+     * @returns The saved credential record
+     */
+    async issueClr(agentContext, input) {
+        console.log('[OB] IssuerService.issueClr() start');
+        // Build the CLR credential structure
+        const credentialId = input.id || `urn:uuid:${(0, uuid_1.v4)()}`;
+        const validFrom = input.validFrom || new Date().toISOString();
+        const clrCredential = {
+            '@context': (0, ClrCredential_1.buildClrContexts)(),
+            type: ['VerifiableCredential', 'ClrCredential'],
+            id: credentialId,
+            issuer: input.issuerProfile,
+            validFrom,
+            ...(input.validUntil && { validUntil: input.validUntil }),
+            ...(input.name && { name: input.name }),
+            ...(input.description && { description: input.description }),
+            credentialSubject: {
+                id: input.learnerId,
+                type: 'ClrSubject',
+                verifiableCredential: input.verifiableCredentials,
+                ...(input.associations && input.associations.length > 0 && { association: input.associations }),
+            },
+        };
+        // Validate the CLR structure
+        const issues = (0, ClrCredential_1.validateClrCredential)(clrCredential);
+        if (issues.length) {
+            console.error('[OB] Invalid ClrCredential envelope issues:', issues);
+            throw new Error(`Invalid ClrCredential envelope: ${issues.join(', ')}`);
+        }
+        // Resolve / ensure key binding for verificationMethod
+        const verificationMethod = input.verificationMethod;
+        console.log('[OB] CLR VM provided:', verificationMethod);
+        if (!verificationMethod) {
+            console.error('[OB] missing_verification_method_key');
+            throw new Error('missing_verification_method_key');
+        }
+        const controller = verificationMethod.split('#')[0];
+        try {
+            await this.keys.ensureBinding(agentContext, { controller, vmId: verificationMethod });
+        }
+        catch (e) {
+            console.warn('[OB] ensureBinding failed:', e?.message || e);
+        }
+        const signed = await this.proofs.sign(agentContext, clrCredential, { id: verificationMethod, controller });
+        const record = new OpenBadgeCredentialRecord_1.OpenBadgeCredentialRecord({
+            credential: signed,
+            derived: undefined,
+            status: 'unknown',
+        });
+        try {
+            await this.repository.save(agentContext, record);
+            console.log('[OB] Saved ClrCredential record id:', record.id);
+        }
+        catch (e) {
+            console.error('[OB] repository.save failed:', e?.message || e);
+            throw e;
+        }
+        return record;
+    }
+};
+exports.IssuerService = IssuerService;
+exports.IssuerService = IssuerService = __decorate([
+    (0, core_1.injectable)(),
+    __param(0, (0, core_1.inject)(OpenBadgeCredentialRepository_1.OpenBadgeCredentialRepository)),
+    __param(1, (0, core_1.inject)(ProofService_1.ProofService)),
+    __param(2, (0, core_1.inject)(KeyService_1.KeyService)),
+    __param(3, (0, core_1.inject)(OpenBadgesModuleConfig_1.OpenBadgesModuleConfig)),
+    __metadata("design:paramtypes", [OpenBadgeCredentialRepository_1.OpenBadgeCredentialRepository,
+        ProofService_1.ProofService,
+        KeyService_1.KeyService,
+        OpenBadgesModuleConfig_1.OpenBadgesModuleConfig])
+], IssuerService);
+//# sourceMappingURL=IssuerService.js.map

package/build/services/IssuerService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IssuerService.js","sourceRoot":"","sources":["../../src/services/IssuerService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AACA,yCAAmD;AACnD,+FAA2F;AAC3F,uFAAmF;AACnF,gDAAmF;AAGnF,2DAAiF;AAEjF,+BAAmC;AACnC,iDAA6C;AAC7C,4CAA0D;AAC1D,sEAAkE;AAClE,6CAAyC;AAGlC,IAAM,aAAa,GAAnB,MAAM,aAAa;IACxB,YAC0D,UAAyC,EAC1D,MAAoB,EACtB,IAAgB,EACJ,MAA8B;QAHvB,eAAU,GAAV,UAAU,CAA+B;QAC1D,WAAM,GAAN,MAAM,CAAc;QACtB,SAAI,GAAJ,IAAI,CAAY;QACJ,WAAM,GAAN,MAAM,CAAwB;IAC9E,CAAC;IAEJ,8DAA8D;IACvD,KAAK,CAAC,eAAe,CAAC,YAA0B,EAAE,KAAU;QACjE,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAA;QACzD,uCAAuC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QACpH,MAAM,OAAO,GAAG,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,yBAAa,EAAE,wBAAY,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;QACrG,6EAA6E;QAC7E,MAAM,MAAM,GAAG,EAAE,GAAG,OAAO,EAAE,CAAA;QAC7B,IAAI,CAAC;YAAC,OAAQ,MAAc,CAAC,KAAK,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QAE7C,wBAAwB;QACxB,MAAM,MAAM,GAAG,IAAA,6BAAkB,EAAC,OAAO,CAAC,CAAA;QAC1C,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,MAAM,CAAC,CAAA;YAC3D,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACnF,CAAC;QAED,sDAAsD;QACtD,MAAM,kBAAkB,GAAuB,KAAK,EAAE,KAAK,EAAE,kBAAkB,CAAA;QAC/E,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,CAAA;QACpD,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAA;YACrD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QACpD,CAAC;QACD,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACnD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAA;QACvF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,4BAA4B,EAAG,CAAS,EAAE,OAAO,IAAI,CAAC,CAAC,CAAA;QACtE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,kBAAkB,EAAE,UAAU,EAAE,CAAC,CAAA;QAEnG,MAAM,MAAM,GAAG,IAAI,qDAAyB,CAAC;YAC3C,UAAU,EAAE,MAAM;YAClB,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,SAAS;SAClB,CAAC,CAAA;QAEF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;YAChD,OAAO,CAAC,GAAG,CAAC,0CAA0C,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QACpE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAG,CAAS,EAAE,OAAO,IAAI,CAAC,CAAC,CAAA;YACvE,MAAM,CAAC,CAAA;QACT,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED;;;;;;;;;OASG;IACI,KAAK,CAAC,gBAAgB,CAAC,YAA0B,EAAE,KAAiC;QACzF,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAA;QAE1D,6CAA6C;QAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,EAAE,IAAI,YAAY,IAAA,SAAM,GAAE,EAAE,CAAA;QACvD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAE7D,MAAM,qBAAqB,GAAG;YAC5B,UAAU,EAAE,CAAC,yBAAa,EAAE,wBAAY,CAAC;YACzC,IAAI,EAAE,CAAC,sBAAsB,EAAE,uBAAuB,CAAU;YAChE,EAAE,EAAE,YAAY;YAChB,MAAM,EAAE,KAAK,CAAC,aAAa;YAC3B,SAAS;YACT,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;YACzD,iBAAiB,EAAE;gBACjB,EAAE,EAAE,KAAK,CAAC,cAAc;gBACxB,IAAI,EAAE,oBAA6B;gBACnC,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC;aAClF;SACF,CAAA;QAED,wBAAwB;QACxB,MAAM,MAAM,GAAG,IAAA,sCAA2B,EAAC,qBAAqB,CAAC,CAAA;QACjE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,qDAAqD,EAAE,MAAM,CAAC,CAAA;YAC5E,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACpG,CAAC;QAED,sDAAsD;QACtD,MAAM,kBAAkB,GAAG,KAAK,CAAC,kBAAkB,CAAA;QACnD,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,kBAAkB,CAAC,CAAA;QAChE,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAA;YACrD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACnD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAA;QACvF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,4BAA4B,EAAG,CAAS,EAAE,OAAO,IAAI,CAAC,CAAC,CAAA;QACtE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,qBAAqB,EAAE,EAAE,EAAE,EAAE,kBAAkB,EAAE,UAAU,EAAE,CAAC,CAAA;QAElH,MAAM,MAAM,GAAG,IAAI,qDAAyB,CAAC;YAC3C,UAAU,EAAE,MAAM;YAClB,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,SAAS;SAClB,CAAC,CAAA;QAEF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;YAChD,OAAO,CAAC,GAAG,CAAC,6CAA6C,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QACvE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAG,CAAS,EAAE,OAAO,IAAI,CAAC,CAAC,CAAA;YACvE,MAAM,CAAC,CAAA;QACT,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAED;;;;;;;;;OASG;IACI,KAAK,CAAC,QAAQ,CAAC,YAA0B,EAAE,KAAyB;QACzE,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAA;QAElD,qCAAqC;QACrC,MAAM,YAAY,GAAG,KAAK,CAAC,EAAE,IAAI,YAAY,IAAA,SAAM,GAAE,EAAE,CAAA;QACvD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAE7D,MAAM,aAAa,GAAG;YACpB,UAAU,EAAE,IAAA,gCAAgB,GAAE;YAC9B,IAAI,EAAE,CAAC,sBAAsB,EAAE,eAAe,CAA8C;YAC5F,EAAE,EAAE,YAAY;YAChB,MAAM,EAAE,KAAK,CAAC,aAAa;YAC3B,SAAS;YACT,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;YACzD,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YACvC,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;YAC5D,iBAAiB,EAAE;gBACjB,EAAE,EAAE,KAAK,CAAC,SAAS;gBACnB,IAAI,EAAE,YAAqB;gBAC3B,oBAAoB,EAAE,KAAK,CAAC,qBAAqB;gBACjD,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;aAChG;SACF,CAAA;QAED,6BAA6B;QAC7B,MAAM,MAAM,GAAG,IAAA,qCAAqB,EAAC,aAAa,CAAC,CAAA;QACnD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,MAAM,CAAC,CAAA;YACpE,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACzE,CAAC;QAED,sDAAsD;QACtD,MAAM,kBAAkB,GAAG,KAAK,CAAC,kBAAkB,CAAA;QACnD,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,kBAAkB,CAAC,CAAA;QACxD,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAA;YACrD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACnD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAA;QACvF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,4BAA4B,EAAG,CAAS,EAAE,OAAO,IAAI,CAAC,CAAC,CAAA;QACtE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,kBAAkB,EAAE,UAAU,EAAE,CAAC,CAAA;QAE1G,MAAM,MAAM,GAAG,IAAI,qDAAyB,CAAC;YAC3C,UAAU,EAAE,MAAM;YAClB,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,SAAS;SAClB,CAAC,CAAA;QAEF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;YAChD,OAAO,CAAC,GAAG,CAAC,qCAAqC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QAC/D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAG,CAAS,EAAE,OAAO,IAAI,CAAC,CAAC,CAAA;YACvE,MAAM,CAAC,CAAA;QACT,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AA1MY,sCAAa;wBAAb,aAAa;IADzB,IAAA,iBAAU,GAAE;IAGR,WAAA,IAAA,aAAM,EAAC,6DAA6B,CAAC,CAAA;IACrC,WAAA,IAAA,aAAM,EAAC,2BAAY,CAAC,CAAA;IACpB,WAAA,IAAA,aAAM,EAAC,uBAAU,CAAC,CAAA;IAClB,WAAA,IAAA,aAAM,EAAC,+CAAsB,CAAC,CAAA;qCAHqC,6DAA6B;QAClD,2BAAY;QAChB,uBAAU;QACI,+CAAsB;GALtE,aAAa,CA0MzB"}

package/build/services/JwtService.d.ts

@@ -0,0 +1,19 @@
+import type { AgentContext } from '@credo-ts/core';
+import { KeyService } from './KeyService';
+import { JwsService } from '@credo-ts/core';
+type KeyHint = {
+    id: string;
+    controller: string;
+};
+export declare class JwtService {
+    private readonly keys;
+    private readonly jws;
+    constructor(keys: KeyService, jws: JwsService);
+    signVcJwt(agentContext: AgentContext, document: any, key?: KeyHint): Promise<string>;
+    verifyVcJwt(agentContext: AgentContext, jwt: string): Promise<{
+        verified: boolean;
+        payload?: any;
+        error?: string;
+    }>;
+}
+export {};

package/build/services/JwtService.js

@@ -0,0 +1,229 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtService = void 0;
+const core_1 = require("@credo-ts/core");
+const KeyService_1 = require("./KeyService");
+const core_2 = require("@credo-ts/core");
+/**
+ * Get the DID method from a kid string
+ */
+function getDidMethod(kid) {
+    if (kid?.startsWith('did:web:'))
+        return 'did:web';
+    if (kid?.startsWith('did:key:'))
+        return 'did:key';
+    if (kid?.startsWith('did:jwk:'))
+        return 'did:jwk';
+    return null;
+}
+/**
+ * Derive JWKS URL from did:web kid
+ */
+function jwksUrlFromDidWebKid(kid) {
+    if (!kid || !kid.startsWith('did:web:'))
+        return null;
+    let rest = kid.slice('did:web:'.length);
+    const hashIdx = rest.indexOf('#');
+    if (hashIdx !== -1)
+        rest = rest.slice(0, hashIdx);
+    const segs = rest.split(':');
+    const hostEnc = segs.shift() || '';
+    const host = decodeURIComponent(hostEnc);
+    // For localhost or host with port, default to http, else https
+    const protocol = host.includes('localhost') || host.includes(':') ? 'http' : 'https';
+    return `${protocol}://${host}/.well-known/jwks.json`;
+}
+/**
+ * Get algorithm string for key type
+ */
+function getAlgForKeyType(jwk) {
+    if (jwk?.kty === 'OKP' && jwk?.crv === 'Ed25519')
+        return 'EdDSA';
+    if (jwk?.kty === 'EC' && jwk?.crv === 'P-256')
+        return 'ES256';
+    if (jwk?.kty === 'EC' && jwk?.crv === 'P-384')
+        return 'ES384';
+    return 'EdDSA'; // Default
+}
+let JwtService = class JwtService {
+    constructor(keys, jws) {
+        this.keys = keys;
+        this.jws = jws;
+    }
+    // Signs a VC as a JWT (VC-JWT). For simplicity in dev, embeds public JWK in header when no known key is provided.
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    async signVcJwt(agentContext, document, key) {
+        const { SignJWT, generateKeyPair, exportJWK, importJWK, calculateJwkThumbprint } = await Promise.resolve().then(() => __importStar(require('jose')));
+        // Claims
+        const issuer = typeof document?.issuer === 'string' ? document.issuer : document?.issuer?.id;
+        const subject = document?.credentialSubject?.id;
+        const nbf = document?.validFrom ? Math.floor(Date.parse(document.validFrom) / 1000) : undefined;
+        // For production, you’d import your Ed25519 key. For dev simplicity, generate ephemeral if no key provided.
+        let privateKey;
+        let header = { alg: 'EdDSA', typ: 'JWT' };
+        if (key?.id) {
+            // Use KMS-backed key via JwsService; header will contain kid and jku; JwsService signs with KMS key id mapping
+            const vmId = key.id;
+            console.log('[OB][JwtService] sign with vmId:', vmId);
+            // Find binding to get KMS key id
+            const binding = await this.keys.getBindingByVm(agentContext, vmId);
+            if (!binding)
+                throw new Error('vm_not_bound_to_kms_key');
+            const payload = new core_2.JwtPayload({ iss: issuer, sub: subject, nbf, additionalClaims: { vc: document } });
+            const walletKey = await this.keys.getKeyForVm(agentContext, vmId);
+            console.log('[OB][JwtService] walletKey available?', !!walletKey);
+            if (!walletKey)
+                throw new Error('wallet_key_not_found');
+            const jku = jwksUrlFromDidWebKid(vmId) || undefined;
+            const compact = await this.jws.createJwsCompact(agentContext, {
+                payload,
+                key: walletKey,
+                protectedHeaderOptions: { alg: 'EdDSA', kid: vmId, ...(jku ? { jku } : {}) },
+            });
+            // jose SignJWT also can be used, but we leverage KMS-backed signing via JwsService
+            return compact;
+        }
+        else {
+            // Dev mode: ephemeral JWK embedded
+            const { privateKey: pk, publicKey } = await generateKeyPair('EdDSA');
+            privateKey = pk;
+            const jwk = (await exportJWK(publicKey));
+            jwk.kty = 'OKP';
+            jwk.crv = 'Ed25519';
+            const kid = await calculateJwkThumbprint(jwk);
+            header = { ...header, jwk, kid };
+        }
+        const signer = new SignJWT({ vc: document })
+            .setProtectedHeader(header)
+            .setIssuedAt();
+        if (issuer)
+            signer.setIssuer(issuer);
+        if (subject)
+            signer.setSubject(subject);
+        if (nbf != null && !Number.isNaN(nbf))
+            signer.setNotBefore(nbf);
+        return signer.sign(privateKey);
+    }
+    async verifyVcJwt(agentContext, jwt) {
+        try {
+            const { decodeProtectedHeader, importJWK, jwtVerify } = await Promise.resolve().then(() => __importStar(require('jose')));
+            const header = decodeProtectedHeader(jwt);
+            let alg = header.alg || 'EdDSA';
+            // Resolve verification key
+            let keyLike;
+            // 1. Try embedded JWK in header
+            if (header.jwk && typeof header.jwk === 'object') {
+                alg = getAlgForKeyType(header.jwk);
+                keyLike = await importJWK(header.jwk, alg);
+            }
+            // 2. Try to resolve from kid
+            if (!keyLike && typeof header.kid === 'string') {
+                const kid = header.kid;
+                const didMethod = getDidMethod(kid);
+                console.log('[OB][JwtService] verify header.kid:', kid, 'didMethod:', didMethod);
+                // 2a. Try did:key or did:jwk - key material is embedded in the DID
+                if (didMethod === 'did:key' || didMethod === 'did:jwk') {
+                    const did = kid.split('#')[0];
+                    const jwk = this.keys.getJwkForDid(did);
+                    console.log('[OB][JwtService] verify resolved JWK from DID?', !!jwk);
+                    if (jwk) {
+                        alg = getAlgForKeyType(jwk);
+                        keyLike = await importJWK(jwk, alg);
+                    }
+                }
+                // 2b. Try local KeyService by VM id
+                if (!keyLike) {
+                    try {
+                        const publicJwk = await this.keys.getPublicJwkByVm(agentContext, kid);
+                        console.log('[OB][JwtService] verify local publicJwk found?', !!publicJwk);
+                        if (publicJwk) {
+                            alg = getAlgForKeyType(publicJwk);
+                            keyLike = await importJWK(publicJwk, alg);
+                        }
+                    }
+                    catch { /* ignore */ }
+                }
+            }
+            // 3. If we still don't have a key, try jku (JWKS URL) if present or derive from did:web kid
+            if (!keyLike && typeof header.kid === 'string') {
+                const derivedJku = jwksUrlFromDidWebKid(header.kid);
+                const jkuHeader = header.jku;
+                const candidateJku = jkuHeader || derivedJku || undefined;
+                console.log('[OB][JwtService] verify candidateJku:', candidateJku);
+                if (candidateJku) {
+                    try {
+                        const res = await fetch(candidateJku);
+                        if (res.ok) {
+                            const jwks = (await res.json());
+                            const kid = header.kid;
+                            const match = Array.isArray(jwks?.keys) ? jwks.keys.find((k) => k.kid === kid) : undefined;
+                            console.log('[OB][JwtService] verify matched jwk from jku?', !!match);
+                            if (match) {
+                                alg = getAlgForKeyType(match);
+                                keyLike = await importJWK(match, alg);
+                            }
+                        }
+                    }
+                    catch { }
+                }
+            }
+            if (!keyLike)
+                return { verified: false, error: 'no_verification_key' };
+            // Determine allowed algorithms based on resolved key
+            const allowedAlgs = ['EdDSA', 'ES256', 'ES384'];
+            const { payload } = await jwtVerify(jwt, keyLike, { algorithms: allowedAlgs, clockTolerance: 60 });
+            return { verified: true, payload };
+        }
+        catch (e) {
+            const msg = e?.message ? String(e.message).split('\n')[0]?.slice(0, 200) : String(e);
+            try {
+                console.warn('[OB][JwtService] jwtVerify failed:', msg);
+            }
+            catch { }
+            return { verified: false, error: msg };
+        }
+    }
+};
+exports.JwtService = JwtService;
+exports.JwtService = JwtService = __decorate([
+    (0, core_1.injectable)(),
+    __param(0, (0, core_1.inject)(KeyService_1.KeyService)),
+    __param(1, (0, core_1.inject)(core_2.JwsService)),
+    __metadata("design:paramtypes", [KeyService_1.KeyService, core_2.JwsService])
+], JwtService);
+//# sourceMappingURL=JwtService.js.map

package/build/services/JwtService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"JwtService.js","sourceRoot":"","sources":["../../src/services/JwtService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,yCAAmD;AAEnD,6CAAyC;AACzC,yCAAuD;AAOvD;;GAEG;AACH,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,GAAG,EAAE,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAA;IACjD,IAAI,GAAG,EAAE,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAA;IACjD,IAAI,GAAG,EAAE,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAA;IACjD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,GAAW;IACvC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IACpD,IAAI,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAA;IAClC,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;IACxC,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;IACpF,OAAO,GAAG,QAAQ,MAAM,IAAI,wBAAwB,CAAA;AACtD,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,GAAQ;IAChC,IAAI,GAAG,EAAE,GAAG,KAAK,KAAK,IAAI,GAAG,EAAE,GAAG,KAAK,SAAS;QAAE,OAAO,OAAO,CAAA;IAChE,IAAI,GAAG,EAAE,GAAG,KAAK,IAAI,IAAI,GAAG,EAAE,GAAG,KAAK,OAAO;QAAE,OAAO,OAAO,CAAA;IAC7D,IAAI,GAAG,EAAE,GAAG,KAAK,IAAI,IAAI,GAAG,EAAE,GAAG,KAAK,OAAO;QAAE,OAAO,OAAO,CAAA;IAC7D,OAAO,OAAO,CAAA,CAAC,UAAU;AAC3B,CAAC;AAGM,IAAM,UAAU,GAAhB,MAAM,UAAU;IACrB,YAAwD,IAAgB,EAAuC,GAAe;QAAtE,SAAI,GAAJ,IAAI,CAAY;QAAuC,QAAG,GAAH,GAAG,CAAY;IAAG,CAAC;IAElI,kHAAkH;IAClH,8DAA8D;IACvD,KAAK,CAAC,SAAS,CAAC,YAA0B,EAAE,QAAa,EAAE,GAAa;QAC7E,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,sBAAsB,EAAE,GAAG,wDAAa,MAAM,GAAC,CAAA;QAEvG,SAAS;QACT,MAAM,MAAM,GAAG,OAAO,QAAQ,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAA;QAC5F,MAAM,OAAO,GAAG,QAAQ,EAAE,iBAAiB,EAAE,EAAE,CAAA;QAC/C,MAAM,GAAG,GAAG,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAE/F,4GAA4G;QAC5G,IAAI,UAAe,CAAA;QACnB,IAAI,MAAM,GAAwB,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;QAE9D,IAAI,GAAG,EAAE,EAAE,EAAE,CAAC;YACZ,+GAA+G;YAC/G,MAAM,IAAI,GAAG,GAAG,CAAC,EAAE,CAAA;YACnB,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE,IAAI,CAAC,CAAA;YACrD,iCAAiC;YACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,IAAI,CAAC,CAAA;YAClE,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;YACxD,MAAM,OAAO,GAAG,IAAI,iBAAU,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;YACtG,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,YAAmB,EAAE,IAAI,CAAC,CAAA;YACxE,OAAO,CAAC,GAAG,CAAC,uCAAuC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAA;YACjE,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;YACvD,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,SAAS,CAAA;YACnD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,YAAmB,EAAE;gBACnE,OAAO;gBACP,GAAG,EAAE,SAAS;gBACd,sBAAsB,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;aAC7E,CAAC,CAAA;YACF,mFAAmF;YACnF,OAAO,OAAO,CAAA;QAChB,CAAC;aAAM,CAAC;YACN,mCAAmC;YACnC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAA;YACpE,UAAU,GAAG,EAAE,CAAA;YACf,MAAM,GAAG,GAAG,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,CAAQ,CAC9C;YAAC,GAAW,CAAC,GAAG,GAAG,KAAK,CACxB;YAAC,GAAW,CAAC,GAAG,GAAG,SAAS,CAAA;YAC7B,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAA;YAC7C,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;QAClC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;aACzC,kBAAkB,CAAC,MAAM,CAAC;aAC1B,WAAW,EAAE,CAAA;QAEhB,IAAI,MAAM;YAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QACpC,IAAI,OAAO;YAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QACvC,IAAI,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;QAE/D,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAChC,CAAC;IAEM,KAAK,CAAC,WAAW,CAAC,YAA0B,EAAE,GAAW;QAE9D,IAAI,CAAC;YACH,MAAM,EAAE,qBAAqB,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,wDAAa,MAAM,GAAC,CAAA;YAC5E,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAA;YACzC,IAAI,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,OAAO,CAAA;YAE/B,2BAA2B;YAC3B,IAAI,OAAwB,CAAA;YAE5B,gCAAgC;YAChC,IAAI,MAAM,CAAC,GAAG,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACjD,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAClC,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,GAAU,EAAE,GAAG,CAAC,CAAA;YACnD,CAAC;YAED,6BAA6B;YAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;gBACtB,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;gBACnC,OAAO,CAAC,GAAG,CAAC,qCAAqC,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,CAAC,CAAA;gBAEhF,mEAAmE;gBACnE,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;oBACvD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;oBAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;oBACvC,OAAO,CAAC,GAAG,CAAC,gDAAgD,EAAE,CAAC,CAAC,GAAG,CAAC,CAAA;oBACpE,IAAI,GAAG,EAAE,CAAC;wBACR,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;wBAC3B,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;oBACrC,CAAC;gBACH,CAAC;gBAED,oCAAoC;gBACpC,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,IAAI,CAAC;wBACH,MAAM,SAAS,GAAQ,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAA;wBAC1E,OAAO,CAAC,GAAG,CAAC,gDAAgD,EAAE,CAAC,CAAC,SAAS,CAAC,CAAA;wBAC1E,IAAI,SAAS,EAAE,CAAC;4BACd,GAAG,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAA;4BACjC,OAAO,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;wBAC3C,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;YAED,4FAA4F;YAC5F,IAAI,CAAC,OAAO,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC/C,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBACnD,MAAM,SAAS,GAAI,MAAc,CAAC,GAAyB,CAAA;gBAC3D,MAAM,YAAY,GAAG,SAAS,IAAI,UAAU,IAAI,SAAS,CAAA;gBACzD,OAAO,CAAC,GAAG,CAAC,uCAAuC,EAAE,YAAY,CAAC,CAAA;gBAElE,IAAI,YAAY,EAAE,CAAC;oBACjB,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,CAAA;wBACrC,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;4BACX,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA+D,CAAA;4BAC7F,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;4BACtB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;4BAC1F,OAAO,CAAC,GAAG,CAAC,+CAA+C,EAAE,CAAC,CAAC,KAAK,CAAC,CAAA;4BACrE,IAAI,KAAK,EAAE,CAAC;gCACV,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;gCAC7B,OAAO,GAAG,MAAM,SAAS,CAAC,KAAY,EAAE,GAAG,CAAC,CAAA;4BAC9C,CAAC;wBACH,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC,CAAA,CAAC;gBACZ,CAAC;YACH,CAAC;YAED,IAAI,CAAC,OAAO;gBAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAA;YAEtE,qDAAqD;YACrD,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;YAC/C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAA;YAClG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;QACpC,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;YACpF,IAAI,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACxE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAA;QACxC,CAAC;IACH,CAAC;CACF,CAAA;AA5IY,gCAAU;qBAAV,UAAU;IADtB,IAAA,iBAAU,GAAE;IAES,WAAA,IAAA,aAAM,EAAC,uBAAU,CAAC,CAAA;IAAqC,WAAA,IAAA,aAAM,EAAC,iBAAU,CAAC,CAAA;qCAA/B,uBAAU,EAA4C,iBAAU;GADnH,UAAU,CA4ItB"}

package/build/services/KeyService.d.ts

@@ -0,0 +1,102 @@
+import type { AgentContext } from '@credo-ts/core';
+import { KeyType, Key } from '@credo-ts/core';
+import { OpenBadgesKeyBindingRepository } from '../repository/OpenBadgesKeyBindingRepository';
+import { OpenBadgesKeyBindingRecord } from '../repository/OpenBadgesKeyBindingRecord';
+import { ContextService } from './ContextService';
+/**
+ * Supported DID methods for key binding
+ */
+export type SupportedDidMethod = 'did:web' | 'did:key' | 'did:jwk';
+/**
+ * Options for ensuring a key binding
+ */
+export interface EnsureBindingOptions {
+    controller: string;
+    vmId: string;
+    keyType?: KeyType;
+    didMethod?: SupportedDidMethod;
+}
+export declare class KeyService {
+    private readonly bindings;
+    private readonly contexts;
+    constructor(bindings: OpenBadgesKeyBindingRepository, contexts: ContextService);
+    private bindingId;
+    /**
+     * Get the multicodec prefix for a key type
+     */
+    private getMulticodecPrefix;
+    /**
+     * Get the verification method type for a key type
+     */
+    private getVerificationMethodType;
+    /**
+     * Generate a did:key DID from public key material
+     */
+    generateDidKey(publicKey: Buffer, keyType: KeyType): {
+        did: string;
+        vmId: string;
+    };
+    /**
+     * Generate a did:jwk DID from public key material
+     */
+    generateDidJwk(publicKey: Buffer, keyType: KeyType): {
+        did: string;
+        vmId: string;
+    };
+    /**
+     * Parse a did:key to extract public key bytes and determine key type
+     */
+    parseDidKey(did: string): {
+        publicKey: Buffer;
+        keyType: KeyType;
+    } | null;
+    /**
+     * Parse a did:jwk to extract the JWK and determine key type
+     */
+    parseDidJwk(did: string): {
+        jwk: any;
+        keyType: KeyType;
+    } | null;
+    /**
+     * Ensure a KMS-backed key exists and is bound to a verificationMethod id
+     * Supports Ed25519, P-256, and P-384 key types
+     * Supports did:web, did:key, and did:jwk DID methods
+     */
+    ensureBinding(agentContext: AgentContext, opts: EnsureBindingOptions): Promise<OpenBadgesKeyBindingRecord>;
+    getBindingByVm(agentContext: AgentContext, vmId: string): Promise<any>;
+    getPublicJwkByVm(agentContext: AgentContext, vmId: string): Promise<{
+        kty: string;
+        crv: string;
+        x: string;
+        y?: undefined;
+    } | {
+        kty: string;
+        crv: string;
+        x: string;
+        y: string;
+    } | null>;
+    getKeyForVm(agentContext: AgentContext, vmId: string): Promise<Key | null>;
+    private seedVerificationMethodDocument;
+    /**
+     * Create a new key binding with a did:key DID
+     * Returns the generated DID and verification method ID
+     */
+    createDidKeyBinding(agentContext: AgentContext, keyType?: KeyType): Promise<{
+        did: string;
+        vmId: string;
+        publicKeyMultibase: string;
+    }>;
+    /**
+     * Create a new key binding with a did:jwk DID
+     * Returns the generated DID and verification method ID
+     */
+    createDidJwkBinding(agentContext: AgentContext, keyType?: KeyType): Promise<{
+        did: string;
+        vmId: string;
+        publicKeyMultibase: string;
+    }>;
+    /**
+     * Get a JWK for a did:key or did:jwk DID
+     */
+    getJwkForDid(did: string): any | null;
+}