@docknetwork/wallet-sdk-wasm 1.7.7-alpha.0 → 1.9.0

package/src/services/credential/sd-jwt.ts

@@ -3,12 +3,40 @@ import {digest, generateSalt} from '@sd-jwt/crypto-nodejs';
 import base64url from 'base64url';
 
 /**
- * Checks if a JWT string is an SD-JWT credential
+ * Checks if a value is a decoded SD-JWT payload object — i.e. an SD-JWT VC
+ * payload returned as JSON rather than the compact `header.payload.sig~...` form.
  */
-export function isSDJWTCredential(jwt) {
-  const jwtHeader = jwt.split('.')[0];
-  const decodedHeader = JSON.parse(base64url.decode(jwtHeader));
-  return decodedHeader.typ === 'dc+sd-jwt' || decodedHeader.typ === 'vc+sd-jwt';
+export function isDecodedSDJWTPayload(value): boolean {
+  return (
+    !!value &&
+    typeof value === 'object' &&
+    !Array.isArray(value) &&
+    Array.isArray((value as any)._sd) &&
+    typeof (value as any)._sd_alg === 'string'
+  );
+}
+
+/**
+ * Checks if a credential is an SD-JWT credential.
+ * Accepts either the compact SD-JWT string or a decoded SD-JWT VC payload object.
+ */
+export function isSDJWTCredential(credential) {
+  if (isDecodedSDJWTPayload(credential)) {
+    return true;
+  }
+
+  if (typeof credential !== 'string' || !credential.includes('.')) {
+    return false;
+  }
+
+  try {
+    const decodedHeader = JSON.parse(base64url.decode(credential.split('.')[0]));
+    return (
+      decodedHeader?.typ === 'dc+sd-jwt' || decodedHeader?.typ === 'vc+sd-jwt'
+    );
+  } catch {
+    return false;
+  }
 }
 
 export async function createSDJWTPresentation({
@@ -200,6 +228,11 @@ export async function decodeSDJWTToW3C(sdJwtString) {
  * @returns {Promise<Object>} W3C Verifiable Credential format
  */
 export async function credentialToW3C(credential) {
+  // Decoded SD-JWT VC payload (no compact serialization available)
+  if (isDecodedSDJWTPayload(credential)) {
+    return sdJwtToW3C({jwt: {header: {}, payload: credential}, disclosures: []});
+  }
+
   // If it's already an object with a type field, assume it's already W3C format
   if (typeof credential === 'object' && credential.type) {
     return credential;
@@ -210,6 +243,9 @@ export async function credentialToW3C(credential) {
     // First try to parse as JSON
     try {
       const parsed = JSON.parse(credential);
+      if (isDecodedSDJWTPayload(parsed)) {
+        return sdJwtToW3C({jwt: {header: {}, payload: parsed}, disclosures: []});
+      }
       if (parsed.type) {
         return parsed;
       }

package/src/services/credential/service-rpc.js

@@ -44,4 +44,10 @@ export class CredentialServiceRPC extends RpcService {
   async acquireOIDCredential(params) {
     return this.call('acquireOIDCredential', params);
   }
+  async generatePresentationFromPex(params) {
+    return this.call('generatePresentationFromPex', params);
+  }
+  async prefetchWitnessCache(params) {
+    return this.call('prefetchWitnessCache', params);
+  }
 }

package/src/services/credential/service.ts

@@ -18,10 +18,10 @@ import {OpenID4VCIClientV1_0_13} from '@sphereon/oid4vci-client';
 import {Alg} from '@sphereon/oid4vci-common';
 import {getKeypairFromDoc} from '@docknetwork/universal-wallet/methods/keypairs';
 import {hexToU8a} from '@docknetwork/credential-sdk/utils';
+import * as credentialSdkVc from '@docknetwork/credential-sdk/vc';
 import {
   VerifiablePresentation,
   Presentation,
-  verifyCredential,
   verifyPresentation,
   VerifiableCredential,
   getSuiteFromKeyDoc,
@@ -33,20 +33,100 @@ import {
   applyEnforceBounds,
   hasProvingKey,
   fetchProvingKey,
+  isBase64OrDataUrl,
+  blobFromBase64,
+  fetchBlobFromUrl,
 } from './bound-check';
+import {
+  generatePresentationFromPexRequest,
+  GeneratePresentationStatus,
+} from '@docknetwork/credential-sdk/pex';
+import {LegoProvingKey} from '@docknetwork/crypto-wasm-ts/lib/legosnark';
 import assert from 'assert';
 import axios from 'axios';
-import {getIsRevoked, getWitnessDetails} from './bbs-revocation';
-import {getPexRequiredAttributes, shouldSkipAttribute} from './pex-helpers';
+import {getIsRevoked, getWitnessDetails, prefetchWitnessCache} from './bbs-revocation';
+import {getPexRequiredAttributes, shouldSkipAttribute, findMatchingDescriptor} from './pex-helpers';
 import {didService} from '../dids/service';
 import {isSDJWTCredential as checkIsSDJWT, credentialToW3C as convertCredentialToW3C, verifySDJWT, createSDJWTPresentation} from './sd-jwt';
+import {resolveOfferedCredentialConfig, resolveFormatAndType} from './oid4vci';
+
 
+export const credentialUtils = {...credentialSdkVc};
+export const pexUtils = {
+  generatePresentationFromPexRequest,
+  GeneratePresentationStatus,
+};
 /**
  * PEX (Presentation Exchange) instance for credential filtering
  * @private
  */
 const pex: PEX = new PEX();
 
+/**
+ * Resolves the accumulator module class for a credential based on its status ID.
+ */
+function getAccumulatorModuleClass(credential) {
+  const statusId = credential?.credentialStatus?.id;
+  if (!statusId) {
+    throw new Error('Credential is missing credentialStatus.id required for witness resolution');
+  }
+  const chainModule =
+    statusId.indexOf('dock:accumulator') === 0
+      ? blockchainService.modules.accumulator.modules[0]
+      : blockchainService.modules.accumulator.modules[
+          blockchainService.modules.accumulator.modules.length - 1
+        ];
+  return chainModule.constructor;
+}
+
+/**
+ * Resolves the witness for a single credential into the format expected by credential-sdk.
+ * Returns undefined if the credential has no witness.
+ */
+async function resolveWitnessForCredential(credential, witness) {
+  if (!witness) {
+    return undefined;
+  }
+
+  try {
+    const details = await getWitnessDetails(credential, witness);
+    const accumulatorModuleClass = getAccumulatorModuleClass(credential);
+    return {
+      membershipWitness: details.membershipWitness,
+      accumulated: accumulatorModuleClass.accumulatedFromHex(
+        details.accumulator.accumulated,
+        AccumulatorType.VBPos,
+      ),
+      pk: details.pk,
+      params: details.params,
+    };
+  } catch (err) {
+    throw new Error(
+      `Failed to resolve witness for credential ${credential?.id || 'unknown'}: ${err.message}`,
+    );
+  }
+}
+
+/**
+ * Creates a loadProvingKey callback for bound check proofs.
+ * Returns undefined if no boundCheckSnarkKey is provided.
+ */
+function createProvingKeyLoader(boundCheckSnarkKey) {
+  if (!boundCheckSnarkKey) {
+    return undefined;
+  }
+
+  return async () => {
+    const blob = (await isBase64OrDataUrl(boundCheckSnarkKey))
+      ? blobFromBase64(boundCheckSnarkKey)
+      : await fetchBlobFromUrl(boundCheckSnarkKey);
+    return {
+      provingKey: new LegoProvingKey(blob),
+      provingKeyId: 'key0',
+    };
+  };
+}
+
 /**
  * Checks if a credential uses BBS+ signature
  * @param {Object} credential - The credential to check
@@ -122,8 +202,15 @@ class CredentialService {
     CredentialService.prototype.credentialToW3C,
     CredentialService.prototype.createSDJWTPresentation,
     CredentialService.prototype.acquireOIDCredential,
+    CredentialService.prototype.generatePresentationFromPex,
+    CredentialService.prototype.prefetchWitnessCache,
   ];
 
+  async prefetchWitnessCache(params) {
+    const {credential, membershipWitness} = params;
+    return prefetchWitnessCache(credential, membershipWitness);
+  }
+
 
   createSDJWTPresentation(params) {
     const {attributesToReveal, credential} = params;
@@ -285,7 +372,7 @@ class CredentialService {
       return verifySDJWT(credential);
     }
 
-    const result = await verifyCredential(credential, {
+    const result = await credentialUtils.verifyCredential(credential, {
       resolver: blockchainService.resolver,
       revocationApi: {dock: blockchainService.dock},
     });
@@ -454,10 +541,8 @@ class CredentialService {
       },
     });
 
-    const format = 'ldp_vc';
-    const { scope }  = client.getCredentialsSupported()[0];
-    const scopeSplit = scope.split(':');
-    const credentialTypes = scopeSplit[scopeSplit.length - 1];
+    const config = resolveOfferedCredentialConfig(client);
+    const {format, credentialTypes} = resolveFormatAndType(config);
 
     let code;
 
@@ -526,7 +611,7 @@ class CredentialService {
     validation.createBBSPresentation(params);
     const {credentials} = params;
 
-    const bbsPlusPresentation = new Presentation();
+    const bbsPlusPresentation = new credentialUtils.Presentation();
     for (const {credential, attributesToReveal} of credentials) {
       const idx = await bbsPlusPresentation.addCredentialToPresent(credential, {
         resolver: blockchainService.resolver,
@@ -658,7 +743,7 @@ class CredentialService {
   async deriveVCFromPresentation(params) {
     validation.deriveVCFromPresentation(params);
     const {credentials, options = {}, proofRequest} = params;
-    const presentation = new Presentation();
+    const presentation = new credentialUtils.Presentation();
     const selectedCredentials = credentials.map(({credential}) => credential);
     let descriptorBounds = [];
 
@@ -668,11 +753,31 @@ class CredentialService {
       });
     }
 
-    if (proofRequest && hasProvingKey(proofRequest)) {
-      const {provingKey, provingKeyId} = await fetchProvingKey(proofRequest);
+    // Filter proof request descriptors to only those matching the provided
+    // credentials. This ensures correct mapping when credentials are provided
+    // in a different order than the proof request's input_descriptors.
+    let filteredProofRequest = proofRequest;
+    if (proofRequest?.request?.input_descriptors?.length > 1) {
+      const matchedDescriptors = selectedCredentials.map(credential =>
+        findMatchingDescriptor(proofRequest.request.input_descriptors, credential),
+      ).filter(Boolean);
+
+      if (matchedDescriptors.length > 0) {
+        filteredProofRequest = {
+          ...proofRequest,
+          request: {
+            ...proofRequest.request,
+            input_descriptors: matchedDescriptors,
+          },
+        };
+      }
+    }
+
+    if (filteredProofRequest && hasProvingKey(filteredProofRequest)) {
+      const {provingKey, provingKeyId} = await fetchProvingKey(filteredProofRequest);
       descriptorBounds = applyEnforceBounds({
         builder: presentation.presBuilder,
-        proofRequest,
+        proofRequest: filteredProofRequest,
         provingKey,
         provingKeyId,
         selectedCredentials,
@@ -680,9 +785,9 @@ class CredentialService {
     }
 
     let pexRequiredAttributes = [];
-    if (proofRequest?.request) {
+    if (filteredProofRequest?.request) {
       pexRequiredAttributes = getPexRequiredAttributes(
-        proofRequest.request,
+        filteredProofRequest.request,
         selectedCredentials,
       );
     }
@@ -692,7 +797,9 @@ class CredentialService {
       const attributesToSkip = descriptorBounds[idx]
         ? descriptorBounds[idx].map(bound => bound.attributeName)
         : [];
-      const filteredAttributes = attributesToReveal.filter(
+      // attributesToReveal may be undefined when using default presentation generation,
+      // in which case only PEX-required attributes will be revealed
+      const filteredAttributes = (attributesToReveal || []).filter(
         attribute => !attributesToSkip.includes(attribute) && !shouldSkipAttribute(attribute),
       );
       const _pexRequiredAttributes = pexRequiredAttributes[idx] || [];
@@ -739,6 +846,54 @@ class CredentialService {
     return credentialsFromPresentation;
   }
 
+  async generatePresentationFromPex(params) {
+    validation.generatePresentationFromPex(params);
+    const {
+      credentials,
+      pexRequest,
+      holderKeyDoc,
+      holderDid,
+      challenge,
+      domain,
+      boundCheckSnarkKey,
+      skipSigning,
+    } = params;
+
+    const resolvedWitnesses = await Promise.all(
+      credentials.map(c => resolveWitnessForCredential(c.credential, c.witness)),
+    );
+
+    let resolvedKeyDoc = holderKeyDoc;
+    if (!skipSigning && holderKeyDoc) {
+      resolvedKeyDoc = getKeypairFromDoc(holderKeyDoc);
+      resolvedKeyDoc.signer = resolvedKeyDoc.signer();
+    }
+
+    const result = await pexUtils.generatePresentationFromPexRequest({
+      credentials: credentials.map(c => c.credential),
+      pexRequest,
+      holderKeyDoc: resolvedKeyDoc,
+      holderDid,
+      challenge,
+      domain,
+      resolver: blockchainService.resolver,
+      skipSigning: skipSigning || false,
+      loadProvingKey: createProvingKeyLoader(boundCheckSnarkKey),
+      selectiveDisclosure: {
+        credentials: credentials.map((c, i) => ({
+          attributes: [...(c.attributesToReveal || []), 'id'],
+          witness: resolvedWitnesses[i],
+        })),
+      },
+    });
+
+    if (result.status !== pexUtils.GeneratePresentationStatus.SUCCESS) {
+      throw result.error || new Error(`Presentation generation failed: ${result.status}`);
+    }
+
+    return result.presentation;
+  }
+
   /**
    * Test method for range proofs
    * @private

package/src/services/credential/utils.js

@@ -30,11 +30,9 @@ export async function keyDocToKeypair(keyDoc) {
     privateKeyBase58 || (privateKeyMultibase && privateKeyMultibase.substr(1));
   if (!privateKeyEncoded) {
     throw new Error(
-      `No private key in document found, this should not happen. Got: ${JSON.stringify(
-        keyDoc,
-        null,
-        2,
-      )}`,
+      `No private key in document found, this should not happen. keyDoc id: ${
+        keyDoc.id || '<unknown>'
+      }, type: ${type || '<unknown>'}`,
     );
   }
 

package/src/services/delegation/index.android.js

@@ -0,0 +1,3 @@
+import {DelegationServiceRpc} from './service-rpc';
+
+export const delegationService = new DelegationServiceRpc();

package/src/services/delegation/index.ios.js

@@ -0,0 +1,3 @@
+import {DelegationServiceRpc} from './service-rpc';
+
+export const delegationService = new DelegationServiceRpc();

package/src/services/delegation/index.ts

@@ -0,0 +1 @@
+export {delegationService} from './service';

package/src/services/delegation/service-rpc.ts

@@ -0,0 +1,21 @@
+import {RpcService} from '../rpc-service-client';
+/**
+ *
+ */
+export class DelegationServiceRpc extends RpcService {
+  constructor() {
+    super('delegation');
+  }
+
+  async issueCredential(keyPair, credential) {
+    return this.call('issueCredential', keyPair, credential);
+  }
+
+  async computePolicyDigestHex(policyObject) {
+    return this.call('computePolicyDigestHex', policyObject);
+  }
+
+  async fetchDelegationPolicyJson(policyId) {
+    return this.call('fetchDelegationPolicyJson', policyId);
+  }
+}

package/src/services/delegation/service.ts

@@ -0,0 +1,59 @@
+// @ts-nocheck
+
+import {issueCredential, documentLoader} from '@docknetwork/credential-sdk/vc';
+import {
+  computePolicyDigestHex,
+  fetchDelegationPolicyJson,
+} from '@docknetwork/vc-delegation-engine';
+
+import {getKeypairFromDoc} from '@docknetwork/universal-wallet/methods/keypairs';
+import {blockchainService} from '../blockchain/service';
+
+/**
+ * Prepares a key document for signing by creating a proper keypair with signer capability
+ * @param keyDoc - The key document with id, controller, type, and key material
+ * @returns A key document with an active signer
+ */
+function prepareKeyForSigning(keyDoc): any {
+  const kp = getKeypairFromDoc(keyDoc);
+  // Get the signer from the keypair - this returns an object with id and sign method
+  const signer = kp.signer();
+  // Set the id on the signer to match the verification method
+  signer.id = keyDoc.id;
+  return {
+    ...keyDoc,
+    keypair: kp,
+    signer,
+  };
+}
+
+/**
+ * Service class for delegatable credentials operations
+ */
+class DelegationService {
+  name = 'delegation';
+
+  rpcMethods = [
+    DelegationService.prototype.issueCredential,
+    DelegationService.prototype.computePolicyDigestHex,
+    DelegationService.prototype.fetchDelegationPolicyJson,
+  ];
+
+  async issueCredential(keyPair, credential): Promise<Credential> {
+    const preparedKey = prepareKeyForSigning(keyPair);
+    return issueCredential(preparedKey, credential);
+  }
+
+  async computePolicyDigestHex(policyObject): Promise<string> {
+    return computePolicyDigestHex(policyObject);
+  }
+
+  async fetchDelegationPolicyJson(policyId: string): Promise<any> {
+    return fetchDelegationPolicyJson(
+      documentLoader(blockchainService.resolver),
+      policyId,
+    );
+  }
+}
+
+export const delegationService = new DelegationService();

package/src/services/edv/service-rpc.js

@@ -11,12 +11,28 @@ export class EDVServiceRpc extends RpcService {
     return this.call('initialize', params);
   }
 
+  initializeFromMnemonic(params: {
+    mnemonic: string,
+    edvUrl: string,
+    authKey: string,
+  }) {
+    return this.call('initializeFromMnemonic', params);
+  }
+
+  initializeFromMasterKey(params: {
+    masterKey: any,
+    edvUrl: string,
+    authKey: string,
+  }) {
+    return this.call('initializeFromMasterKey', params);
+  }
+
   generateKeys() {
     return this.call('generateKeys');
   }
 
-  deriveKeys() {
-    return this.call('deriveKeys');
+  deriveKeys(masterKey) {
+    return this.call('deriveKeys', masterKey);
   }
 
   getController() {