@idos-network/issuer 1.5.0 → 2.2.0

package/README.md

@@ -22,11 +22,10 @@ pnpm add @idos-network/issuer
 ```typescript
 import { idOSIssuer as idOSIssuerClass } from "@idos-network/issuer";
 
-// Initialize with your signing and encryption keys
+// Initialize with your signing keypair
 const idOSIssuer = await idOSIssuerClass.init({
   nodeUrl: "https://nodes.idos.network",
   signingKeyPair, // Your signing keypair
-  encryptionSecretKey, // Your encryption secret key
 });
 
 // Create a user profile
@@ -35,8 +34,12 @@ await idOSIssuer.createUser(user, wallet);
 // Build and issue a W3C Verifiable Credential
 const credential = await idOSIssuer.buildCredential(credentialFields, credentialSubject, issuer);
 
-// Write credential using delegated write grant
-await idOSIssuer.createCredentialByDelegatedWriteGrant(credentialPayload, delegatedWriteGrant);
+// Write blob-backed credential using delegated write grant
+await idOSIssuer.createCredentialByDelegatedWriteGrant(
+  credentialPayload,
+  delegatedWriteGrant,
+  consumerEncryptionPublicKey,
+);
 ```
 
 ## Documentation

package/dist/index.d.mts

@@ -1,36 +1,16 @@
-import { Credential, FaceIdCredential } from "@idos-network/credentials/builder";
 import "@idos-network/kwil-infra";
-import { EditPublicNotesAsIssuerInput, idOSDelegatedWriteGrant, idOSGrant, idOSUser, idOSUser as idOSUser$1, idOSUserAttribute, idOSWallet, idOSWallet as idOSWallet$1 } from "@idos-network/kwil-infra/actions";
-import nacl, { SignKeyPair } from "tweetnacl";
-import { AvailableIssuerType, CredentialFields, CredentialSubject, CredentialSubjectFaceId, idOSCredential } from "@idos-network/credentials/types";
+import { BuildPreliminaryIDOSCredentialArgs } from "@idos-network/credentials/utils";
+import { AddWalletMessageInput, DelegatedWriteGrantBaseParams, EditPublicNotesAsIssuerInput, idOSDelegatedWriteGrant, idOSGrant, idOSUser, idOSUser as idOSUser$1, idOSUserAttribute, idOSWallet, idOSWallet as idOSWallet$1, toDelegatedWriteGrantBaseParams } from "@idos-network/kwil-infra/actions";
+import { AvailableIssuerType, idOSCredential, idOSCredentialRecord } from "@idos-network/credentials/types";
+import { SignKeyPair } from "tweetnacl";
+import "@idos-network/utils/blob-gateway";
 //#region src/services/credential.service.d.ts
-type BaseCredentialParams = {
-  id?: string;
-  userId: string;
-  publicNotes: string;
-  plaintextContent: Uint8Array;
-  recipientEncryptionPublicKey: Uint8Array;
-};
-type DelegatedWriteGrantBaseParams = Omit<BaseCredentialParams, "userId">;
-type DelegatedWriteGrantParams = {
-  id: string;
-  ownerWalletIdentifier: string;
-  consumerWalletIdentifier: string;
-  issuerPublicKey: string;
-  accessGrantTimelock: string;
-  notUsableBefore: string;
-  notUsableAfter: string;
+type DelegatedWriteGrantParams = DelegatedWriteGrantBaseParams & {
   signature: string;
 };
-//#endregion
-//#region src/services/grant.service.d.ts
-type CreateAccessGrantFromDAGParams = {
-  dag_data_id: string;
-  dag_owner_wallet_identifier: string;
-  dag_grantee_wallet_identifier: string;
-  dag_signature: string;
-  dag_locked_until: number;
-  dag_content_hash: string;
+type CredentialByDelegatedWriteGrantBaseParams = Omit<BuildPreliminaryIDOSCredentialArgs, "issuerSigningSecretKey" | "contentUri"> & {
+  originalContentUri?: string;
+  copyContentUri?: string;
 };
 //#endregion
 //#region src/services/user.service.d.ts
@@ -48,31 +28,28 @@ type CreateWalletReqParams = Omit<UpsertWalletReqParams, "user_id"> & {
 type CreateIssuerParams = {
   chainId?: string;
   nodeUrl: string;
+  blobGatewayUrl?: string;
   signingKeyPair: SignKeyPair;
-  encryptionSecretKey: Uint8Array;
 };
-declare class idOSIssuer {
+export declare class idOSIssuer {
   #private;
   static init(params: CreateIssuerParams): Promise<idOSIssuer>;
   private constructor();
   hasProfile(userAddress: string): Promise<boolean>;
   createUserProfile(params: CreateProfileReqParams): Promise<idOSUser>;
   upsertWalletAsInserter(params: UpsertWalletReqParams): Promise<idOSWallet>;
+  addWalletMessage(params: AddWalletMessageInput): Promise<string>;
   createUser(user: CreateProfileReqParams, wallet: CreateWalletReqParams): Promise<[idOSUser, idOSWallet]>;
   getUser(id: string): Promise<idOSUser>;
   requestDelegatedWriteGrantMessage(params: idOSDelegatedWriteGrant): Promise<string>;
-  createCredentialByDelegatedWriteGrant(credentialParams: DelegatedWriteGrantBaseParams, delegatedWriteGrant: DelegatedWriteGrantParams, consumerEncryptionPublicKey?: Uint8Array): Promise<{
+  createCredentialByDelegatedWriteGrant(credentialParams: CredentialByDelegatedWriteGrantBaseParams, delegatedWriteGrant: DelegatedWriteGrantParams, consumerEncryptionPublicKey: Uint8Array): Promise<{
     originalCredential: Omit<idOSCredential, "user_id">;
     copyCredential: Omit<idOSCredential, "user_id">;
   }>;
   editCredentialAsIssuer(publicNotesId: string, publicNotes: string): Promise<EditPublicNotesAsIssuerInput | null>;
   getCredentialIdByContentHash(contentHash: string): Promise<string | null>;
-  getCredentialShared(id: string): Promise<idOSCredential | null>;
-  createAccessGrantFromDAG(params: CreateAccessGrantFromDAGParams): Promise<CreateAccessGrantFromDAGParams | null>;
-  buildCredential(fields: CredentialFields, subject: CredentialSubject, issuer: AvailableIssuerType, validate?: boolean): Promise<Credential>;
-  deriveCredentialLevel(subject: CredentialSubject): string;
-  buildFaceIdCredential(fields: CredentialFields, subject: CredentialSubjectFaceId, issuer: AvailableIssuerType, validate?: boolean): Promise<FaceIdCredential>;
+  getCredentialShared(id: string): Promise<idOSCredentialRecord | null>;
 }
 //#endregion
-export { type AvailableIssuerType, type Credential, type CredentialFields, type CredentialSubject, type CredentialSubjectFaceId, type FaceIdCredential, type idOSCredential, type idOSDelegatedWriteGrant, type idOSGrant, idOSIssuer, type idOSUser, type idOSUserAttribute, type idOSWallet };
+export { type AvailableIssuerType, type CredentialByDelegatedWriteGrantBaseParams, type DelegatedWriteGrantBaseParams, type DelegatedWriteGrantParams, type idOSCredential, type idOSDelegatedWriteGrant, type idOSGrant, type idOSUser, type idOSUserAttribute, type idOSWallet, toDelegatedWriteGrantBaseParams };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/services/credential.service.ts","../src/services/grant.service.ts","../src/services/user.service.ts","../src/index.ts"],"mappings":";;;;;;KAsCY;EACV;EACA;EACA;EACA,kBAAkB;EAClB,8BAA8B;;KAGpB,gCAAgC,KAAK;KAErC;EACV;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;;;KChDU;EACV;EACA;EACA;EACA;EACA;EACA;;;;KCFU,yBAAyB,KAAK;EACxC;;KAGU,wBAAwB,KAAK;EACvC;;KAGU,wBAAwB,KAAK;EACvC;;;;KCkBG;EACH;EACA;EACA,gBAAgB;EAChB,qBAAqB;;cAGV;;SAKE,KAAK,QAAQ,qBAAqB,QAAQ;UAqB/C;EAWR,WAAiB,sBAAsB;EAIvC,kBAAwB,QAAQ,yBAAyB,QAAQ;EAIjE,uBAA6B,QAAQ,wBAAwB,QAAQ;EAIrE,WACE,MAAM,wBACN,QAAQ,wBACP,SAAS,UAAU;EAItB,QAAc,aAAa,QAAQ;EAInC,kCAAwC,QAAQ,0BAA0B;EAI1E,sCACE,kBAAkB,+BAClB,qBAAqB,2BACrB,8BAA8B,aAC7B;IACD,oBAAoB,KAAK;IACzB,gBAAgB,KAAK;;EASvB,uBACE,uBACA,sBACC,QAAQ;EAIX,6BAAmC,sBAAsB;EAIzD,oBAA0B,aAAa,QAAQ;EAI/C,yBACE,QAAQ,iCACP,QAAQ;EAQX,gBACE,QAAQ,kBACR,SAAS,mBACT,QAAQ,qBACR,qBACC,QAAQ;EAIX,sBAAsB,SAAS;EAI/B,sBACE,QAAQ,kBACR,SAAS,yBACT,QAAQ,qBACR,qBACC,QAAQ"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/services/credential.service.ts","../src/services/user.service.ts","../src/index.ts"],"mappings":";;;;;;;KA2BY,4BAA4B;EACtC;;KAGU,4CAA4C,KACtD;EAGA;EACA;;;;KCtBU,yBAAyB,KAAK;EACxC;;KAGU,wBAAwB,KAAK;EACvC;;KAGU,wBAAwB,KAAK;EACvC;;;;KCYG;EACH;EACA;EACA;EACA,gBAAgB;;qBAGL;;SAIE,KAAK,QAAQ,qBAAqB,QAAQ;UAqB/C;EAMR,WAAiB,sBAAsB;EAIvC,kBAAwB,QAAQ,yBAAyB,QAAQ;EAIjE,uBAA6B,QAAQ,wBAAwB,QAAQ;EAIrE,iBAAuB,QAAQ,wBAAwB;EAIvD,WACE,MAAM,wBACN,QAAQ,wBACP,SAAS,UAAU;EAItB,QAAc,aAAa,QAAQ;EAInC,kCAAwC,QAAQ,0BAA0B;EAI1E,sCACE,kBAAkB,2CAClB,qBAAqB,2BACrB,6BAA6B,aAC5B;IACD,oBAAoB,KAAK;IACzB,gBAAgB,KAAK;;EASvB,uBACE,uBACA,sBACC,QAAQ;EAIX,6BAAmC,sBAAsB;EAIzD,oBAA0B,aAAa,QAAQ"}

package/dist/index.mjs

@@ -1,236 +1,2 @@
-import { buildCredential, buildFaceIdCredential } from "@idos-network/credentials/builder";
-import { deriveLevel } from "@idos-network/credentials/utils";
-import { createNodeKwilClient, createServerKwilSigner } from "@idos-network/kwil-infra";
-import { addUserAsInserter, createAgByDagForCopy, createCredentialsByDwg, dwgMessage, editPublicNotesAsIssuer, getCredentialShared, getSiblingCredentialId, getUserAsInserter, hasProfile, upsertWalletAsInserter } from "@idos-network/kwil-infra/actions";
-import { base64Decode, base64Encode, hexEncode, hexEncodeSha256Hash, utf8Encode } from "@idos-network/utils/codecs";
-import { NoncedBox, encryptContent } from "@idos-network/utils/cryptography";
-import nacl from "tweetnacl";
-//#region ../../node_modules/.pnpm/tiny-invariant@1.3.3/node_modules/tiny-invariant/dist/esm/tiny-invariant.js
-var isProduction = process.env.NODE_ENV === "production";
-var prefix = "Invariant failed";
-function invariant(condition, message) {
-	if (condition) return;
-	if (isProduction) throw new Error(prefix);
-	var provided = typeof message === "function" ? message() : message;
-	var value = provided ? "".concat(prefix, ": ").concat(provided) : prefix;
-	throw new Error(value);
-}
-//#endregion
-//#region src/services/credential.service.ts
-var CredentialService = class {
-	#kwilClient;
-	#signingKeyPair;
-	#encryptionSecretKey;
-	constructor(kwilClient, signingKeyPair, encryptionSecretKey) {
-		this.#kwilClient = kwilClient;
-		this.#signingKeyPair = signingKeyPair;
-		this.#encryptionSecretKey = encryptionSecretKey;
-	}
-	#buildInsertableIDOSCredential({ userId, publicNotes, plaintextContent, recipientEncryptionPublicKey }) {
-		const ephemeralKeyPair = nacl.box.keyPair();
-		const content = encryptContent(plaintextContent, recipientEncryptionPublicKey, ephemeralKeyPair.secretKey);
-		const public_notes_signature = base64Encode(nacl.sign.detached(utf8Encode(publicNotes), this.#signingKeyPair.secretKey));
-		return {
-			user_id: userId,
-			content: base64Encode(content),
-			public_notes: publicNotes,
-			public_notes_signature,
-			broader_signature: base64Encode(nacl.sign.detached(Uint8Array.from([...base64Decode(public_notes_signature), ...content]), this.#signingKeyPair.secretKey)),
-			issuer_auth_public_key: hexEncode(this.#signingKeyPair.publicKey, true),
-			encryptor_public_key: base64Encode(ephemeralKeyPair.publicKey)
-		};
-	}
-	#ensureEntityId(entity) {
-		if (!entity.id) entity.id = crypto.randomUUID();
-		return entity;
-	}
-	async requestDelegatedWriteGrantMessage(params) {
-		return dwgMessage(this.#kwilClient, params).then((res) => res.message);
-	}
-	async createCredentialByDelegatedWriteGrant(credentialParams, delegatedWriteGrant, consumerEncryptionPublicKey) {
-		let recipientPublicKey = consumerEncryptionPublicKey;
-		if (!recipientPublicKey) recipientPublicKey = nacl.box.keyPair.fromSecretKey(this.#encryptionSecretKey).publicKey;
-		const originalCredential = this.#ensureEntityId(this.#buildInsertableIDOSCredential(credentialParams));
-		const contentHash = hexEncodeSha256Hash(credentialParams.plaintextContent);
-		const copyCredential = this.#ensureEntityId(this.#buildInsertableIDOSCredential({
-			publicNotes: "",
-			plaintextContent: credentialParams.plaintextContent,
-			recipientEncryptionPublicKey: recipientPublicKey
-		}));
-		const payload = {
-			issuer_auth_public_key: originalCredential.issuer_auth_public_key,
-			original_encryptor_public_key: originalCredential.encryptor_public_key,
-			original_credential_id: originalCredential.id,
-			original_content: originalCredential.content,
-			original_public_notes: originalCredential.public_notes,
-			original_public_notes_signature: originalCredential.public_notes_signature,
-			original_broader_signature: originalCredential.broader_signature,
-			copy_encryptor_public_key: copyCredential.encryptor_public_key,
-			copy_credential_id: copyCredential.id,
-			copy_content: copyCredential.content,
-			copy_public_notes_signature: copyCredential.public_notes_signature,
-			copy_broader_signature: copyCredential.broader_signature,
-			content_hash: contentHash,
-			dwg_owner: delegatedWriteGrant.ownerWalletIdentifier,
-			dwg_grantee: delegatedWriteGrant.consumerWalletIdentifier,
-			dwg_issuer_public_key: delegatedWriteGrant.issuerPublicKey,
-			dwg_id: delegatedWriteGrant.id,
-			dwg_access_grant_timelock: delegatedWriteGrant.accessGrantTimelock,
-			dwg_not_before: delegatedWriteGrant.notUsableBefore,
-			dwg_not_after: delegatedWriteGrant.notUsableAfter,
-			dwg_signature: delegatedWriteGrant.signature
-		};
-		await createCredentialsByDwg(this.#kwilClient, payload);
-		return {
-			originalCredential,
-			copyCredential
-		};
-	}
-	async editCredentialAsIssuer(publicNotesId, publicNotes) {
-		const payload = {
-			public_notes_id: publicNotesId,
-			public_notes: publicNotes
-		};
-		await editPublicNotesAsIssuer(this.#kwilClient, payload);
-		return payload;
-	}
-	async getCredentialIdByContentHash(contentHash) {
-		const id = await getSiblingCredentialId(this.#kwilClient, { content_hash: contentHash }).then((res) => res.id);
-		invariant(id, "Required `idOSCredential` id not found");
-		return id;
-	}
-	async getCredentialShared(id) {
-		return await getCredentialShared(this.#kwilClient, { id }).then((res) => res[0]) ?? null;
-	}
-};
-//#endregion
-//#region src/services/grant.service.ts
-var GrantService = class {
-	#kwilClient;
-	#encryptionSecretKey;
-	constructor(kwilClient, encryptionSecretKey) {
-		this.#kwilClient = kwilClient;
-		this.#encryptionSecretKey = encryptionSecretKey;
-	}
-	async createAccessGrantFromDAG(params, getCredentialIdByContentHash, getCredentialShared) {
-		const credentialId = await getCredentialIdByContentHash(params.dag_content_hash);
-		invariant(credentialId, "Missing `idOSCredential` id");
-		const credential = await getCredentialShared(credentialId);
-		invariant(credential, "`idOSCredential` with id `{credentialId}` not found");
-		if (hexEncodeSha256Hash(utf8Encode(await NoncedBox.nonceFromBase64SecretKey(base64Encode(this.#encryptionSecretKey)).decrypt(credential.content, credential.encryptor_public_key))) !== params.dag_content_hash) throw new Error("Hash mismatch between `DAG` and `idOSCredential` content");
-		return await createAgByDagForCopy(this.#kwilClient, params) ?? null;
-	}
-};
-//#endregion
-//#region src/services/user.service.ts
-var UserService = class {
-	#kwilClient;
-	constructor(kwilClient) {
-		this.#kwilClient = kwilClient;
-	}
-	#ensureEntityId(entity) {
-		if (!entity.id) entity.id = crypto.randomUUID();
-		return entity;
-	}
-	async hasProfile(address) {
-		return hasProfile(this.#kwilClient, { address }).then((res) => res.has_profile);
-	}
-	async createUserProfile(params) {
-		const payload = this.#ensureEntityId(params);
-		await addUserAsInserter(this.#kwilClient, payload);
-		return payload;
-	}
-	async upsertWalletAsInserter(params) {
-		const payload = this.#ensureEntityId(params);
-		await upsertWalletAsInserter(this.#kwilClient, payload);
-		return payload;
-	}
-	async getUser(params) {
-		return getUserAsInserter(this.#kwilClient, this.#ensureEntityId(params));
-	}
-	async createUser(user, wallet) {
-		const user_id = user.id ?? crypto.randomUUID();
-		const wallet_id = wallet.id ?? crypto.randomUUID();
-		const userReqParams = {
-			...user,
-			id: user_id
-		};
-		const userResponse = await this.createUserProfile(userReqParams);
-		const walletReqParams = {
-			...wallet,
-			user_id,
-			id: wallet_id
-		};
-		return [userResponse, await this.upsertWalletAsInserter(walletReqParams)];
-	}
-};
-//#endregion
-//#region src/index.ts
-var idOSIssuer = class idOSIssuer {
-	#credentialService;
-	#grantService;
-	#userService;
-	static async init(params) {
-		const kwilClient = await createNodeKwilClient({
-			nodeUrl: params.nodeUrl,
-			chainId: params.chainId
-		});
-		const [signer] = await createServerKwilSigner(params.signingKeyPair);
-		kwilClient.setSigner(signer);
-		const credentialService = new CredentialService(kwilClient, params.signingKeyPair, params.encryptionSecretKey);
-		const grantService = new GrantService(kwilClient, params.encryptionSecretKey);
-		const userService = new UserService(kwilClient);
-		return new idOSIssuer(credentialService, grantService, userService);
-	}
-	constructor(credentialService, grantService, userService) {
-		this.#credentialService = credentialService;
-		this.#grantService = grantService;
-		this.#userService = userService;
-	}
-	async hasProfile(userAddress) {
-		return this.#userService.hasProfile(userAddress);
-	}
-	async createUserProfile(params) {
-		return this.#userService.createUserProfile(params);
-	}
-	async upsertWalletAsInserter(params) {
-		return this.#userService.upsertWalletAsInserter(params);
-	}
-	async createUser(user, wallet) {
-		return this.#userService.createUser(user, wallet);
-	}
-	async getUser(id) {
-		return this.#userService.getUser({ id });
-	}
-	async requestDelegatedWriteGrantMessage(params) {
-		return this.#credentialService.requestDelegatedWriteGrantMessage(params);
-	}
-	async createCredentialByDelegatedWriteGrant(credentialParams, delegatedWriteGrant, consumerEncryptionPublicKey) {
-		return this.#credentialService.createCredentialByDelegatedWriteGrant(credentialParams, delegatedWriteGrant, consumerEncryptionPublicKey);
-	}
-	async editCredentialAsIssuer(publicNotesId, publicNotes) {
-		return this.#credentialService.editCredentialAsIssuer(publicNotesId, publicNotes);
-	}
-	async getCredentialIdByContentHash(contentHash) {
-		return this.#credentialService.getCredentialIdByContentHash(contentHash);
-	}
-	async getCredentialShared(id) {
-		return this.#credentialService.getCredentialShared(id);
-	}
-	async createAccessGrantFromDAG(params) {
-		return this.#grantService.createAccessGrantFromDAG(params, (contentHash) => this.getCredentialIdByContentHash(contentHash), (id) => this.getCredentialShared(id));
-	}
-	async buildCredential(fields, subject, issuer, validate = true) {
-		return buildCredential(fields, subject, issuer, validate);
-	}
-	deriveCredentialLevel(subject) {
-		return deriveLevel(subject);
-	}
-	async buildFaceIdCredential(fields, subject, issuer, validate = true) {
-		return buildFaceIdCredential(fields, subject, issuer, validate);
-	}
-};
-//#endregion
-export { idOSIssuer };
-
+import{createKgwAuthenticatedBlobGateway as e,createNodeKwilClient as t,createServerKwilSigner as n}from"@idos-network/kwil-infra";import{buildPreliminaryIDOSCredential as r,mapPreliminaryToIDOSCredential as i}from"@idos-network/credentials/utils";import{addUserAsInserter as a,addWalletMessage as o,createPreliminaryCredentialsByDwg as s,dwgMessage as c,editPublicNotesAsIssuer as l,getCredentialShared as u,getSiblingCredentialId as d,getUserAsInserter as f,hasProfile as p,toDelegatedWriteGrantBaseParams as m,upsertWalletAsInserter as h}from"@idos-network/kwil-infra/actions";import{hexEncodeSha256Hash as g}from"@idos-network/utils/codecs";var _=process.env.NODE_ENV===`production`,v=`Invariant failed`;function y(e,t){if(!e){if(_)throw Error(v);var n=typeof t==`function`?t():t,r=n?`${v}: ${n}`:v;throw Error(r)}}var b=class{#e;#t;#n;constructor(e,t,n){this.#e=e,this.#t=t,this.#n=n}async requestDelegatedWriteGrantMessage(e){return c(this.#e,e).then(e=>e.message)}async createCredentialByDelegatedWriteGrant(e,t,n){let{originalContentUri:a,copyContentUri:o,...c}=e,l={...await r({...c,contentUri:a,issuerSigningSecretKey:this.#t.secretKey}),id:crypto.randomUUID()},u=g(e.plaintextContent),d={...await r({...c,contentUri:o,publicNotes:``,recipientEncryptionPublicKey:n,issuerSigningSecretKey:this.#t.secretKey}),id:crypto.randomUUID()};y(l.contentUri!==d.contentUri,`Original and copy credentials must use distinct content URIs`);let f=crypto.randomUUID(),p={request_id:f,issuer_auth_public_key:l.issuerAuthPublicKey,original_encryptor_public_key:l.encryptorPublicKey,original_id:l.id,original_content_uri:l.contentUri,original_content_size:l.contentSize,original_public_notes:l.publicNotes,original_public_notes_signature:l.publicNotesSignature,original_broader_signature:l.broaderSignature,copy_encryptor_public_key:d.encryptorPublicKey,copy_id:d.id,copy_content_uri:d.contentUri,copy_content_size:d.contentSize,copy_public_notes_signature:d.publicNotesSignature,copy_broader_signature:d.broaderSignature,content_hash:u,dwg_owner:t.ownerWalletIdentifier,dwg_grantee:t.consumerWalletIdentifier,dwg_issuer_public_key:t.issuerPublicKey,dwg_id:t.id,dwg_access_grant_timelock:t.accessGrantTimelock,dwg_not_before:t.notUsableBefore,dwg_not_after:t.notUsableAfter,dwg_signature:t.signature};return await s(this.#e,p),await this.#n.uploadCredentialBlobs({requestId:f,original:l.encryptedContent,copy:d.encryptedContent}),{originalCredential:i(l),copyCredential:i(d)}}async editCredentialAsIssuer(e,t){let n={public_notes_id:e,public_notes:t};return await l(this.#e,n),n}async getCredentialIdByContentHash(e){let t=await d(this.#e,{content_hash:e}).then(e=>e.id);return y(t,"Required `idOSCredential` id not found"),t}async getCredentialShared(e){return await u(this.#e,{id:e}).then(e=>e[0])??null}},x=class{#e;constructor(e){this.#e=e}#t(e){return e.id||=crypto.randomUUID(),e}async hasProfile(e){return p(this.#e,{address:e}).then(e=>e.has_profile)}async createUserProfile(e){let t=this.#t(e);return await a(this.#e,t),t}async upsertWalletAsInserter(e){let t=this.#t(e);return await h(this.#e,t),t}async addWalletMessage(e){return(await o(this.#e,e)).message}async getUser(e){return f(this.#e,this.#t(e))}async createUser(e,t){let n=e.id??crypto.randomUUID(),r=t.id??crypto.randomUUID(),i={...e,id:n},a=await this.createUserProfile(i),o={...t,user_id:n,id:r};return[a,await this.upsertWalletAsInserter(o)]}},S=class r{#e;#t;static async init(i){let a=await t({nodeUrl:i.nodeUrl,chainId:i.chainId}),[o]=await n(i.signingKeyPair);a.setSigner(o);let s=e({url:i.blobGatewayUrl??i.nodeUrl,kwilClient:a,signer:o}),c=new b(a,i.signingKeyPair,s),l=new x(a);return new r(c,l)}constructor(e,t){this.#e=e,this.#t=t}async hasProfile(e){return this.#t.hasProfile(e)}async createUserProfile(e){return this.#t.createUserProfile(e)}async upsertWalletAsInserter(e){return this.#t.upsertWalletAsInserter(e)}async addWalletMessage(e){return this.#t.addWalletMessage(e)}async createUser(e,t){return this.#t.createUser(e,t)}async getUser(e){return this.#t.getUser({id:e})}async requestDelegatedWriteGrantMessage(e){return this.#e.requestDelegatedWriteGrantMessage(e)}async createCredentialByDelegatedWriteGrant(e,t,n){return this.#e.createCredentialByDelegatedWriteGrant(e,t,n)}async editCredentialAsIssuer(e,t){return this.#e.editCredentialAsIssuer(e,t)}async getCredentialIdByContentHash(e){return this.#e.getCredentialIdByContentHash(e)}async getCredentialShared(e){return this.#e.getCredentialShared(e)}};export{S as idOSIssuer,m as toDelegatedWriteGrantBaseParams};
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":["#kwilClient","#signingKeyPair","#encryptionSecretKey","#ensureEntityId","#buildInsertableIDOSCredential","#kwilClient","#encryptionSecretKey","_createAgByDagForCopy","#kwilClient","_hasProfile","#ensureEntityId","_upsertWalletAsInserter","#credentialService","#grantService","#userService"],"sources":["../../../node_modules/.pnpm/tiny-invariant@1.3.3/node_modules/tiny-invariant/dist/esm/tiny-invariant.js","../src/services/credential.service.ts","../src/services/grant.service.ts","../src/services/user.service.ts","../src/index.ts"],"sourcesContent":["var isProduction = process.env.NODE_ENV === 'production';\nvar prefix = 'Invariant failed';\nfunction invariant(condition, message) {\n    if (condition) {\n        return;\n    }\n    if (isProduction) {\n        throw new Error(prefix);\n    }\n    var provided = typeof message === 'function' ? message() : message;\n    var value = provided ? \"\".concat(prefix, \": \").concat(provided) : prefix;\n    throw new Error(value);\n}\n\nexport { invariant as default };\n","import type { idOSCredential } from \"@idos-network/credentials/types\";\nimport type { KwilActionClient } from \"@idos-network/kwil-infra\";\n\nimport {\n  type CreateCredentialsByDwgInput,\n  createCredentialsByDwg,\n  dwgMessage,\n  type EditPublicNotesAsIssuerInput,\n  editPublicNotesAsIssuer,\n  getCredentialShared,\n  getSiblingCredentialId,\n  type idOSDelegatedWriteGrant,\n} from \"@idos-network/kwil-infra/actions\";\nimport {\n  base64Decode,\n  base64Encode,\n  hexEncode,\n  hexEncodeSha256Hash,\n  utf8Encode,\n} from \"@idos-network/utils/codecs\";\nimport { encryptContent } from \"@idos-network/utils/cryptography\";\nimport invariant from \"tiny-invariant\";\nimport nacl from \"tweetnacl\";\n\ntype InsertableIDOSCredential = Omit<idOSCredential, \"id\" | \"original_id\"> & {\n  id?: idOSCredential[\"id\"];\n  content_hash?: string;\n  public_notes_signature: string;\n  broader_signature: string;\n};\n\ntype BuildInsertableIDOSCredentialArgs = {\n  userId: string;\n  publicNotes: string;\n  plaintextContent: Uint8Array;\n  recipientEncryptionPublicKey: Uint8Array;\n};\n\nexport type BaseCredentialParams = {\n  id?: string;\n  userId: string;\n  publicNotes: string;\n  plaintextContent: Uint8Array;\n  recipientEncryptionPublicKey: Uint8Array;\n};\n\nexport type DelegatedWriteGrantBaseParams = Omit<BaseCredentialParams, \"userId\">;\n\nexport type DelegatedWriteGrantParams = {\n  id: string;\n  ownerWalletIdentifier: string;\n  consumerWalletIdentifier: string;\n  issuerPublicKey: string;\n  accessGrantTimelock: string;\n  notUsableBefore: string;\n  notUsableAfter: string;\n  signature: string;\n};\n\nexport class CredentialService {\n  readonly #kwilClient: KwilActionClient;\n  readonly #signingKeyPair: nacl.SignKeyPair;\n  readonly #encryptionSecretKey: Uint8Array;\n\n  constructor(\n    kwilClient: KwilActionClient,\n    signingKeyPair: nacl.SignKeyPair,\n    encryptionSecretKey: Uint8Array,\n  ) {\n    this.#kwilClient = kwilClient;\n    this.#signingKeyPair = signingKeyPair;\n    this.#encryptionSecretKey = encryptionSecretKey;\n  }\n\n  #buildInsertableIDOSCredential({\n    userId,\n    publicNotes,\n    plaintextContent,\n    recipientEncryptionPublicKey,\n  }: Omit<BuildInsertableIDOSCredentialArgs, \"userId\"> & { userId?: string }):\n    | InsertableIDOSCredential\n    | Omit<InsertableIDOSCredential, \"user_id\"> {\n    const ephemeralKeyPair = nacl.box.keyPair();\n    const content = encryptContent(\n      plaintextContent,\n      recipientEncryptionPublicKey,\n      ephemeralKeyPair.secretKey,\n    );\n\n    const public_notes_signature = base64Encode(\n      nacl.sign.detached(utf8Encode(publicNotes), this.#signingKeyPair.secretKey),\n    );\n\n    return {\n      user_id: userId,\n      content: base64Encode(content),\n      public_notes: publicNotes,\n      public_notes_signature,\n\n      broader_signature: base64Encode(\n        nacl.sign.detached(\n          Uint8Array.from([...base64Decode(public_notes_signature), ...content]),\n          this.#signingKeyPair.secretKey,\n        ),\n      ),\n\n      issuer_auth_public_key: hexEncode(this.#signingKeyPair.publicKey, true),\n      encryptor_public_key: base64Encode(ephemeralKeyPair.publicKey),\n    };\n  }\n\n  #ensureEntityId<T extends { id?: string }>(entity: T): T & { id: string } {\n    if (!entity.id) {\n      (entity as T & { id: string }).id = crypto.randomUUID();\n    }\n    return entity as T & { id: string };\n  }\n\n  async requestDelegatedWriteGrantMessage(params: idOSDelegatedWriteGrant): Promise<string> {\n    return dwgMessage(this.#kwilClient, params).then((res) => res.message);\n  }\n\n  async createCredentialByDelegatedWriteGrant(\n    credentialParams: DelegatedWriteGrantBaseParams,\n    delegatedWriteGrant: DelegatedWriteGrantParams,\n    consumerEncryptionPublicKey?: Uint8Array,\n  ): Promise<{\n    originalCredential: Omit<idOSCredential, \"user_id\">;\n    copyCredential: Omit<idOSCredential, \"user_id\">;\n  }> {\n    let recipientPublicKey = consumerEncryptionPublicKey;\n    if (!recipientPublicKey) {\n      // If we're not explicitly given a consumer enc pub key, we're assuming that the issuer is creating a copy\n      // for themselves. So, we derive the recipient encryption public key from the issuer's encryption secret key.\n      recipientPublicKey = nacl.box.keyPair.fromSecretKey(this.#encryptionSecretKey).publicKey;\n    }\n\n    const originalCredential = this.#ensureEntityId(\n      this.#buildInsertableIDOSCredential(credentialParams),\n    );\n\n    const contentHash = hexEncodeSha256Hash(credentialParams.plaintextContent);\n\n    const copyCredential = this.#ensureEntityId(\n      this.#buildInsertableIDOSCredential({\n        publicNotes: \"\",\n        plaintextContent: credentialParams.plaintextContent,\n        recipientEncryptionPublicKey: recipientPublicKey,\n      }),\n    );\n\n    const payload: CreateCredentialsByDwgInput = {\n      issuer_auth_public_key: originalCredential.issuer_auth_public_key,\n      original_encryptor_public_key: originalCredential.encryptor_public_key,\n      original_credential_id: originalCredential.id,\n      original_content: originalCredential.content,\n      original_public_notes: originalCredential.public_notes,\n      original_public_notes_signature: originalCredential.public_notes_signature,\n      original_broader_signature: originalCredential.broader_signature,\n      copy_encryptor_public_key: copyCredential.encryptor_public_key,\n      copy_credential_id: copyCredential.id,\n      copy_content: copyCredential.content,\n      copy_public_notes_signature: copyCredential.public_notes_signature,\n      copy_broader_signature: copyCredential.broader_signature,\n      content_hash: contentHash,\n      dwg_owner: delegatedWriteGrant.ownerWalletIdentifier,\n      dwg_grantee: delegatedWriteGrant.consumerWalletIdentifier,\n      dwg_issuer_public_key: delegatedWriteGrant.issuerPublicKey,\n      dwg_id: delegatedWriteGrant.id,\n      dwg_access_grant_timelock: delegatedWriteGrant.accessGrantTimelock,\n      dwg_not_before: delegatedWriteGrant.notUsableBefore,\n      dwg_not_after: delegatedWriteGrant.notUsableAfter,\n      dwg_signature: delegatedWriteGrant.signature,\n    };\n\n    await createCredentialsByDwg(this.#kwilClient, payload);\n\n    return { originalCredential, copyCredential };\n  }\n\n  async editCredentialAsIssuer(\n    publicNotesId: string,\n    publicNotes: string,\n  ): Promise<EditPublicNotesAsIssuerInput | null> {\n    const payload = {\n      public_notes_id: publicNotesId,\n      public_notes: publicNotes,\n    };\n\n    await editPublicNotesAsIssuer(this.#kwilClient, payload);\n\n    return payload;\n  }\n\n  async getCredentialIdByContentHash(contentHash: string): Promise<string | null> {\n    const id = await getSiblingCredentialId(this.#kwilClient, { content_hash: contentHash }).then(\n      (res) => res.id,\n    );\n\n    invariant(id, \"Required `idOSCredential` id not found\");\n\n    return id;\n  }\n\n  async getCredentialShared(id: string): Promise<idOSCredential | null> {\n    const result = await getCredentialShared(this.#kwilClient, { id }).then((res) => res[0]);\n\n    return result ?? null;\n  }\n}\n","import type { idOSCredential } from \"@idos-network/credentials/types\";\nimport type { KwilActionClient } from \"@idos-network/kwil-infra\";\n\nimport { createAgByDagForCopy as _createAgByDagForCopy } from \"@idos-network/kwil-infra/actions\";\nimport { base64Encode, hexEncodeSha256Hash, utf8Encode } from \"@idos-network/utils/codecs\";\nimport { NoncedBox } from \"@idos-network/utils/cryptography\";\nimport invariant from \"tiny-invariant\";\n\nexport type CreateAccessGrantFromDAGParams = {\n  dag_data_id: string;\n  dag_owner_wallet_identifier: string;\n  dag_grantee_wallet_identifier: string;\n  dag_signature: string;\n  dag_locked_until: number;\n  dag_content_hash: string;\n};\n\nexport class GrantService {\n  readonly #kwilClient: KwilActionClient;\n  readonly #encryptionSecretKey: Uint8Array;\n\n  constructor(kwilClient: KwilActionClient, encryptionSecretKey: Uint8Array) {\n    this.#kwilClient = kwilClient;\n    this.#encryptionSecretKey = encryptionSecretKey;\n  }\n\n  async createAccessGrantFromDAG(\n    params: CreateAccessGrantFromDAGParams,\n    getCredentialIdByContentHash: (contentHash: string) => Promise<string | null>,\n    getCredentialShared: (id: string) => Promise<idOSCredential | null>,\n  ): Promise<CreateAccessGrantFromDAGParams | null> {\n    const credentialId = await getCredentialIdByContentHash(params.dag_content_hash);\n\n    invariant(credentialId, \"Missing `idOSCredential` id\");\n\n    const credential = await getCredentialShared(credentialId);\n\n    invariant(credential, \"`idOSCredential` with id `{credentialId}` not found\");\n\n    const plaintextContent = await NoncedBox.nonceFromBase64SecretKey(\n      base64Encode(this.#encryptionSecretKey),\n    ).decrypt(credential.content, credential.encryptor_public_key);\n\n    // Get the content hash from the plaintext content\n    const contentHash = hexEncodeSha256Hash(utf8Encode(plaintextContent));\n\n    // Check if the content hash matches the content hash in the credential\n    if (contentHash !== params.dag_content_hash) {\n      throw new Error(\"Hash mismatch between `DAG` and `idOSCredential` content\");\n    }\n\n    const result = await _createAgByDagForCopy(this.#kwilClient, params);\n\n    return result ?? null;\n  }\n}\n","import type { KwilActionClient } from \"@idos-network/kwil-infra\";\n\nimport {\n  hasProfile as _hasProfile,\n  upsertWalletAsInserter as _upsertWalletAsInserter,\n  addUserAsInserter,\n  type GetUserAsInserterInput,\n  getUserAsInserter,\n  type idOSUser,\n  type idOSWallet,\n} from \"@idos-network/kwil-infra/actions\";\n\nexport type CreateProfileReqParams = Omit<idOSUser, \"id\"> & {\n  id?: string;\n};\n\nexport type UpsertWalletReqParams = Omit<idOSWallet, \"id\"> & {\n  id?: string;\n};\n\nexport type CreateWalletReqParams = Omit<UpsertWalletReqParams, \"user_id\"> & {\n  id?: string;\n};\n\nexport class UserService {\n  readonly #kwilClient: KwilActionClient;\n\n  constructor(kwilClient: KwilActionClient) {\n    this.#kwilClient = kwilClient;\n  }\n\n  #ensureEntityId<T extends { id?: string }>(entity: T): T & { id: string } {\n    if (!entity.id) {\n      (entity as T & { id: string }).id = crypto.randomUUID();\n    }\n    return entity as T & { id: string };\n  }\n\n  async hasProfile(address: string): Promise<boolean> {\n    return _hasProfile(this.#kwilClient, { address }).then((res) => res.has_profile);\n  }\n\n  async createUserProfile(params: CreateProfileReqParams): Promise<idOSUser> {\n    const payload = this.#ensureEntityId(params);\n    await addUserAsInserter(this.#kwilClient, payload);\n    return payload;\n  }\n\n  async upsertWalletAsInserter(params: UpsertWalletReqParams): Promise<idOSWallet> {\n    const payload = this.#ensureEntityId(params);\n    await _upsertWalletAsInserter(this.#kwilClient, payload);\n    return payload;\n  }\n\n  /// Useful to understand if a user id already exists.\n  async getUser(params: GetUserAsInserterInput): Promise<idOSUser> {\n    return getUserAsInserter(this.#kwilClient, this.#ensureEntityId(params));\n  }\n\n  async createUser(\n    user: CreateProfileReqParams,\n    wallet: CreateWalletReqParams,\n  ): Promise<[idOSUser, idOSWallet]> {\n    const user_id = user.id ?? crypto.randomUUID();\n    const wallet_id = wallet.id ?? crypto.randomUUID();\n\n    const userReqParams = {\n      ...user,\n      id: user_id,\n    };\n\n    const userResponse = await this.createUserProfile(userReqParams);\n\n    const walletReqParams = {\n      ...wallet,\n      user_id,\n      id: wallet_id,\n    };\n\n    const walletResponse = await this.upsertWalletAsInserter(walletReqParams);\n\n    return [userResponse, walletResponse];\n  }\n}\n","import type {\n  AvailableIssuerType,\n  CredentialFields,\n  CredentialSubject,\n  CredentialSubjectFaceId,\n  idOSCredential,\n} from \"@idos-network/credentials/types\";\nimport type {\n  EditPublicNotesAsIssuerInput,\n  idOSDelegatedWriteGrant,\n  idOSGrant,\n  idOSUser,\n  idOSUserAttribute,\n  idOSWallet,\n} from \"@idos-network/kwil-infra/actions\";\nimport type { SignKeyPair } from \"tweetnacl\";\n\nimport {\n  buildCredential,\n  buildFaceIdCredential,\n  type Credential,\n  type FaceIdCredential,\n} from \"@idos-network/credentials/builder\";\nimport { deriveLevel } from \"@idos-network/credentials/utils\";\nimport { createNodeKwilClient, createServerKwilSigner } from \"@idos-network/kwil-infra\";\n\nimport {\n  CredentialService,\n  type DelegatedWriteGrantBaseParams,\n  type DelegatedWriteGrantParams,\n} from \"./services/credential.service\";\nimport { type CreateAccessGrantFromDAGParams, GrantService } from \"./services/grant.service\";\nimport {\n  type CreateProfileReqParams,\n  type CreateWalletReqParams,\n  type UpsertWalletReqParams,\n  UserService,\n} from \"./services/user.service\";\n\ntype CreateIssuerParams = {\n  chainId?: string;\n  nodeUrl: string;\n  signingKeyPair: SignKeyPair;\n  encryptionSecretKey: Uint8Array;\n};\n\nexport class idOSIssuer {\n  readonly #credentialService: CredentialService;\n  readonly #grantService: GrantService;\n  readonly #userService: UserService;\n\n  static async init(params: CreateIssuerParams): Promise<idOSIssuer> {\n    const kwilClient = await createNodeKwilClient({\n      nodeUrl: params.nodeUrl,\n      chainId: params.chainId,\n    });\n\n    const [signer] = await createServerKwilSigner(params.signingKeyPair);\n    kwilClient.setSigner(signer);\n\n    const credentialService = new CredentialService(\n      kwilClient,\n      params.signingKeyPair,\n      params.encryptionSecretKey,\n    );\n\n    const grantService = new GrantService(kwilClient, params.encryptionSecretKey);\n    const userService = new UserService(kwilClient);\n\n    return new idOSIssuer(credentialService, grantService, userService);\n  }\n\n  private constructor(\n    credentialService: CredentialService,\n    grantService: GrantService,\n    userService: UserService,\n  ) {\n    this.#credentialService = credentialService;\n    this.#grantService = grantService;\n    this.#userService = userService;\n  }\n\n  // User Service facade methods\n  async hasProfile(userAddress: string): Promise<boolean> {\n    return this.#userService.hasProfile(userAddress);\n  }\n\n  async createUserProfile(params: CreateProfileReqParams): Promise<idOSUser> {\n    return this.#userService.createUserProfile(params);\n  }\n\n  async upsertWalletAsInserter(params: UpsertWalletReqParams): Promise<idOSWallet> {\n    return this.#userService.upsertWalletAsInserter(params);\n  }\n\n  async createUser(\n    user: CreateProfileReqParams,\n    wallet: CreateWalletReqParams,\n  ): Promise<[idOSUser, idOSWallet]> {\n    return this.#userService.createUser(user, wallet);\n  }\n\n  async getUser(id: string): Promise<idOSUser> {\n    return this.#userService.getUser({ id });\n  }\n\n  async requestDelegatedWriteGrantMessage(params: idOSDelegatedWriteGrant): Promise<string> {\n    return this.#credentialService.requestDelegatedWriteGrantMessage(params);\n  }\n\n  async createCredentialByDelegatedWriteGrant(\n    credentialParams: DelegatedWriteGrantBaseParams,\n    delegatedWriteGrant: DelegatedWriteGrantParams,\n    consumerEncryptionPublicKey?: Uint8Array,\n  ): Promise<{\n    originalCredential: Omit<idOSCredential, \"user_id\">;\n    copyCredential: Omit<idOSCredential, \"user_id\">;\n  }> {\n    return this.#credentialService.createCredentialByDelegatedWriteGrant(\n      credentialParams,\n      delegatedWriteGrant,\n      consumerEncryptionPublicKey,\n    );\n  }\n\n  async editCredentialAsIssuer(\n    publicNotesId: string,\n    publicNotes: string,\n  ): Promise<EditPublicNotesAsIssuerInput | null> {\n    return this.#credentialService.editCredentialAsIssuer(publicNotesId, publicNotes);\n  }\n\n  async getCredentialIdByContentHash(contentHash: string): Promise<string | null> {\n    return this.#credentialService.getCredentialIdByContentHash(contentHash);\n  }\n\n  async getCredentialShared(id: string): Promise<idOSCredential | null> {\n    return this.#credentialService.getCredentialShared(id);\n  }\n\n  async createAccessGrantFromDAG(\n    params: CreateAccessGrantFromDAGParams,\n  ): Promise<CreateAccessGrantFromDAGParams | null> {\n    return this.#grantService.createAccessGrantFromDAG(\n      params,\n      (contentHash: string) => this.getCredentialIdByContentHash(contentHash),\n      (id: string) => this.getCredentialShared(id),\n    );\n  }\n\n  async buildCredential(\n    fields: CredentialFields,\n    subject: CredentialSubject,\n    issuer: AvailableIssuerType,\n    validate = true,\n  ): Promise<Credential> {\n    return buildCredential(fields, subject, issuer, validate);\n  }\n\n  deriveCredentialLevel(subject: CredentialSubject): string {\n    return deriveLevel(subject);\n  }\n\n  async buildFaceIdCredential(\n    fields: CredentialFields,\n    subject: CredentialSubjectFaceId,\n    issuer: AvailableIssuerType,\n    validate = true,\n  ): Promise<FaceIdCredential> {\n    return buildFaceIdCredential(fields, subject, issuer, validate);\n  }\n}\n\nexport type {\n  idOSCredential,\n  idOSGrant,\n  idOSUser,\n  idOSUserAttribute,\n  idOSDelegatedWriteGrant,\n  idOSWallet,\n  CredentialFields,\n  CredentialSubject,\n  AvailableIssuerType,\n  Credential,\n  CredentialSubjectFaceId,\n  FaceIdCredential,\n};\n"],"x_google_ignoreList":[0],"mappings":";;;;;;;;AAAA,IAAI,eAAe,QAAQ,IAAI,aAAa;AAC5C,IAAI,SAAS;AACb,SAAS,UAAU,WAAW,SAAS;CACnC,IAAI,WACA;CAEJ,IAAI,cACA,MAAM,IAAI,MAAM,MAAM;CAE1B,IAAI,WAAW,OAAO,YAAY,aAAa,QAAQ,IAAI;CAC3D,IAAI,QAAQ,WAAW,GAAG,OAAO,QAAQ,IAAI,CAAC,CAAC,OAAO,QAAQ,IAAI;CAClE,MAAM,IAAI,MAAM,KAAK;AACzB;;;AC+CA,IAAa,oBAAb,MAA+B;CAC7B;CACA;CACA;CAEA,YACE,YACA,gBACA,qBACA;EACA,KAAKA,cAAc;EACnB,KAAKC,kBAAkB;EACvB,KAAKC,uBAAuB;CAC9B;CAEA,+BAA+B,EAC7B,QACA,aACA,kBACA,gCAG4C;EAC5C,MAAM,mBAAmB,KAAK,IAAI,QAAQ;EAC1C,MAAM,UAAU,eACd,kBACA,8BACA,iBAAiB,SACnB;EAEA,MAAM,yBAAyB,aAC7B,KAAK,KAAK,SAAS,WAAW,WAAW,GAAG,KAAKD,gBAAgB,SAAS,CAC5E;EAEA,OAAO;GACL,SAAS;GACT,SAAS,aAAa,OAAO;GAC7B,cAAc;GACd;GAEA,mBAAmB,aACjB,KAAK,KAAK,SACR,WAAW,KAAK,CAAC,GAAG,aAAa,sBAAsB,GAAG,GAAG,OAAO,CAAC,GACrE,KAAKA,gBAAgB,SACvB,CACF;GAEA,wBAAwB,UAAU,KAAKA,gBAAgB,WAAW,IAAI;GACtE,sBAAsB,aAAa,iBAAiB,SAAS;EAC/D;CACF;CAEA,gBAA2C,QAA+B;EACxE,IAAI,CAAC,OAAO,IACV,OAA+B,KAAK,OAAO,WAAW;EAExD,OAAO;CACT;CAEA,MAAM,kCAAkC,QAAkD;EACxF,OAAO,WAAW,KAAKD,aAAa,MAAM,CAAC,CAAC,MAAM,QAAQ,IAAI,OAAO;CACvE;CAEA,MAAM,sCACJ,kBACA,qBACA,6BAIC;EACD,IAAI,qBAAqB;EACzB,IAAI,CAAC,oBAGH,qBAAqB,KAAK,IAAI,QAAQ,cAAc,KAAKE,oBAAoB,CAAC,CAAC;EAGjF,MAAM,qBAAqB,KAAKC,gBAC9B,KAAKC,+BAA+B,gBAAgB,CACtD;EAEA,MAAM,cAAc,oBAAoB,iBAAiB,gBAAgB;EAEzE,MAAM,iBAAiB,KAAKD,gBAC1B,KAAKC,+BAA+B;GAClC,aAAa;GACb,kBAAkB,iBAAiB;GACnC,8BAA8B;EAChC,CAAC,CACH;EAEA,MAAM,UAAuC;GAC3C,wBAAwB,mBAAmB;GAC3C,+BAA+B,mBAAmB;GAClD,wBAAwB,mBAAmB;GAC3C,kBAAkB,mBAAmB;GACrC,uBAAuB,mBAAmB;GAC1C,iCAAiC,mBAAmB;GACpD,4BAA4B,mBAAmB;GAC/C,2BAA2B,eAAe;GAC1C,oBAAoB,eAAe;GACnC,cAAc,eAAe;GAC7B,6BAA6B,eAAe;GAC5C,wBAAwB,eAAe;GACvC,cAAc;GACd,WAAW,oBAAoB;GAC/B,aAAa,oBAAoB;GACjC,uBAAuB,oBAAoB;GAC3C,QAAQ,oBAAoB;GAC5B,2BAA2B,oBAAoB;GAC/C,gBAAgB,oBAAoB;GACpC,eAAe,oBAAoB;GACnC,eAAe,oBAAoB;EACrC;EAEA,MAAM,uBAAuB,KAAKJ,aAAa,OAAO;EAEtD,OAAO;GAAE;GAAoB;EAAe;CAC9C;CAEA,MAAM,uBACJ,eACA,aAC8C;EAC9C,MAAM,UAAU;GACd,iBAAiB;GACjB,cAAc;EAChB;EAEA,MAAM,wBAAwB,KAAKA,aAAa,OAAO;EAEvD,OAAO;CACT;CAEA,MAAM,6BAA6B,aAA6C;EAC9E,MAAM,KAAK,MAAM,uBAAuB,KAAKA,aAAa,EAAE,cAAc,YAAY,CAAC,CAAC,CAAC,MACtF,QAAQ,IAAI,EACf;EAEA,UAAU,IAAI,wCAAwC;EAEtD,OAAO;CACT;CAEA,MAAM,oBAAoB,IAA4C;EAGpE,OAAO,MAFc,oBAAoB,KAAKA,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,QAAQ,IAAI,EAAE,KAEtE;CACnB;AACF;;;AChMA,IAAa,eAAb,MAA0B;CACxB;CACA;CAEA,YAAY,YAA8B,qBAAiC;EACzE,KAAKK,cAAc;EACnB,KAAKC,uBAAuB;CAC9B;CAEA,MAAM,yBACJ,QACA,8BACA,qBACgD;EAChD,MAAM,eAAe,MAAM,6BAA6B,OAAO,gBAAgB;EAE/E,UAAU,cAAc,6BAA6B;EAErD,MAAM,aAAa,MAAM,oBAAoB,YAAY;EAEzD,UAAU,YAAY,qDAAqD;EAU3E,IAHoB,oBAAoB,WAAW,MALpB,UAAU,yBACvC,aAAa,KAAKA,oBAAoB,CACxC,CAAC,CAAC,QAAQ,WAAW,SAAS,WAAW,oBAAoB,CAGM,CAGrD,MAAM,OAAO,kBACzB,MAAM,IAAI,MAAM,0DAA0D;EAK5E,OAAO,MAFcC,qBAAsB,KAAKF,aAAa,MAAM,KAElD;CACnB;AACF;;;AC/BA,IAAa,cAAb,MAAyB;CACvB;CAEA,YAAY,YAA8B;EACxC,KAAKG,cAAc;CACrB;CAEA,gBAA2C,QAA+B;EACxE,IAAI,CAAC,OAAO,IACV,OAA+B,KAAK,OAAO,WAAW;EAExD,OAAO;CACT;CAEA,MAAM,WAAW,SAAmC;EAClD,OAAOC,WAAY,KAAKD,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,QAAQ,IAAI,WAAW;CACjF;CAEA,MAAM,kBAAkB,QAAmD;EACzE,MAAM,UAAU,KAAKE,gBAAgB,MAAM;EAC3C,MAAM,kBAAkB,KAAKF,aAAa,OAAO;EACjD,OAAO;CACT;CAEA,MAAM,uBAAuB,QAAoD;EAC/E,MAAM,UAAU,KAAKE,gBAAgB,MAAM;EAC3C,MAAMC,uBAAwB,KAAKH,aAAa,OAAO;EACvD,OAAO;CACT;CAGA,MAAM,QAAQ,QAAmD;EAC/D,OAAO,kBAAkB,KAAKA,aAAa,KAAKE,gBAAgB,MAAM,CAAC;CACzE;CAEA,MAAM,WACJ,MACA,QACiC;EACjC,MAAM,UAAU,KAAK,MAAM,OAAO,WAAW;EAC7C,MAAM,YAAY,OAAO,MAAM,OAAO,WAAW;EAEjD,MAAM,gBAAgB;GACpB,GAAG;GACH,IAAI;EACN;EAEA,MAAM,eAAe,MAAM,KAAK,kBAAkB,aAAa;EAE/D,MAAM,kBAAkB;GACtB,GAAG;GACH;GACA,IAAI;EACN;EAIA,OAAO,CAAC,cAAc,MAFO,KAAK,uBAAuB,eAAe,CAEpC;CACtC;AACF;;;ACrCA,IAAa,aAAb,MAAa,WAAW;CACtB;CACA;CACA;CAEA,aAAa,KAAK,QAAiD;EACjE,MAAM,aAAa,MAAM,qBAAqB;GAC5C,SAAS,OAAO;GAChB,SAAS,OAAO;EAClB,CAAC;EAED,MAAM,CAAC,UAAU,MAAM,uBAAuB,OAAO,cAAc;EACnE,WAAW,UAAU,MAAM;EAE3B,MAAM,oBAAoB,IAAI,kBAC5B,YACA,OAAO,gBACP,OAAO,mBACT;EAEA,MAAM,eAAe,IAAI,aAAa,YAAY,OAAO,mBAAmB;EAC5E,MAAM,cAAc,IAAI,YAAY,UAAU;EAE9C,OAAO,IAAI,WAAW,mBAAmB,cAAc,WAAW;CACpE;CAEA,YACE,mBACA,cACA,aACA;EACA,KAAKE,qBAAqB;EAC1B,KAAKC,gBAAgB;EACrB,KAAKC,eAAe;CACtB;CAGA,MAAM,WAAW,aAAuC;EACtD,OAAO,KAAKA,aAAa,WAAW,WAAW;CACjD;CAEA,MAAM,kBAAkB,QAAmD;EACzE,OAAO,KAAKA,aAAa,kBAAkB,MAAM;CACnD;CAEA,MAAM,uBAAuB,QAAoD;EAC/E,OAAO,KAAKA,aAAa,uBAAuB,MAAM;CACxD;CAEA,MAAM,WACJ,MACA,QACiC;EACjC,OAAO,KAAKA,aAAa,WAAW,MAAM,MAAM;CAClD;CAEA,MAAM,QAAQ,IAA+B;EAC3C,OAAO,KAAKA,aAAa,QAAQ,EAAE,GAAG,CAAC;CACzC;CAEA,MAAM,kCAAkC,QAAkD;EACxF,OAAO,KAAKF,mBAAmB,kCAAkC,MAAM;CACzE;CAEA,MAAM,sCACJ,kBACA,qBACA,6BAIC;EACD,OAAO,KAAKA,mBAAmB,sCAC7B,kBACA,qBACA,2BACF;CACF;CAEA,MAAM,uBACJ,eACA,aAC8C;EAC9C,OAAO,KAAKA,mBAAmB,uBAAuB,eAAe,WAAW;CAClF;CAEA,MAAM,6BAA6B,aAA6C;EAC9E,OAAO,KAAKA,mBAAmB,6BAA6B,WAAW;CACzE;CAEA,MAAM,oBAAoB,IAA4C;EACpE,OAAO,KAAKA,mBAAmB,oBAAoB,EAAE;CACvD;CAEA,MAAM,yBACJ,QACgD;EAChD,OAAO,KAAKC,cAAc,yBACxB,SACC,gBAAwB,KAAK,6BAA6B,WAAW,IACrE,OAAe,KAAK,oBAAoB,EAAE,CAC7C;CACF;CAEA,MAAM,gBACJ,QACA,SACA,QACA,WAAW,MACU;EACrB,OAAO,gBAAgB,QAAQ,SAAS,QAAQ,QAAQ;CAC1D;CAEA,sBAAsB,SAAoC;EACxD,OAAO,YAAY,OAAO;CAC5B;CAEA,MAAM,sBACJ,QACA,SACA,QACA,WAAW,MACgB;EAC3B,OAAO,sBAAsB,QAAQ,SAAS,QAAQ,QAAQ;CAChE;AACF"}
+{"version":3,"file":"index.mjs","names":["_hasProfile","_upsertWalletAsInserter","_addWalletMessage"],"sources":["../../../node_modules/.pnpm/tiny-invariant@1.3.3/node_modules/tiny-invariant/dist/esm/tiny-invariant.js","../src/services/credential.service.ts","../src/services/user.service.ts","../src/index.ts"],"sourcesContent":["var isProduction = process.env.NODE_ENV === 'production';\nvar prefix = 'Invariant failed';\nfunction invariant(condition, message) {\n    if (condition) {\n        return;\n    }\n    if (isProduction) {\n        throw new Error(prefix);\n    }\n    var provided = typeof message === 'function' ? message() : message;\n    var value = provided ? \"\".concat(prefix, \": \").concat(provided) : prefix;\n    throw new Error(value);\n}\n\nexport { invariant as default };\n","import type { idOSCredential, idOSCredentialRecord } from \"@idos-network/credentials/types\";\nimport type { KwilActionClient } from \"@idos-network/kwil-infra\";\n\nimport {\n  buildPreliminaryIDOSCredential,\n  BuildPreliminaryIDOSCredentialArgs,\n  mapPreliminaryToIDOSCredential,\n  PreliminaryIDOSCredential,\n} from \"@idos-network/credentials/utils\";\nimport {\n  type CreatePreliminaryCredentialsByDwgInput,\n  createPreliminaryCredentialsByDwg,\n  dwgMessage,\n  type EditPublicNotesAsIssuerInput,\n  editPublicNotesAsIssuer,\n  getCredentialShared,\n  getSiblingCredentialId,\n  type idOSDelegatedWriteGrant,\n  type DelegatedWriteGrantBaseParams,\n} from \"@idos-network/kwil-infra/actions\";\nimport { BlobGateway } from \"@idos-network/utils/blob-gateway\";\nimport { hexEncodeSha256Hash } from \"@idos-network/utils/codecs\";\nimport invariant from \"tiny-invariant\";\nimport nacl from \"tweetnacl\";\n\nexport type { DelegatedWriteGrantBaseParams };\n\nexport type DelegatedWriteGrantParams = DelegatedWriteGrantBaseParams & {\n  signature: string;\n};\n\nexport type CredentialByDelegatedWriteGrantBaseParams = Omit<\n  BuildPreliminaryIDOSCredentialArgs,\n  \"issuerSigningSecretKey\" | \"contentUri\"\n> & {\n  originalContentUri?: string;\n  copyContentUri?: string;\n};\n\nexport class CredentialService {\n  readonly #kwilClient: KwilActionClient;\n  readonly #signingKeyPair: nacl.SignKeyPair;\n  readonly #blobGateway: BlobGateway;\n\n  constructor(\n    kwilClient: KwilActionClient,\n    signingKeyPair: nacl.SignKeyPair,\n    blobGateway: BlobGateway,\n  ) {\n    this.#kwilClient = kwilClient;\n    this.#signingKeyPair = signingKeyPair;\n    this.#blobGateway = blobGateway;\n  }\n\n  async requestDelegatedWriteGrantMessage(params: idOSDelegatedWriteGrant): Promise<string> {\n    return dwgMessage(this.#kwilClient, params).then((res) => res.message);\n  }\n\n  async createCredentialByDelegatedWriteGrant(\n    credentialParams: CredentialByDelegatedWriteGrantBaseParams,\n    delegatedWriteGrant: DelegatedWriteGrantParams,\n    consumerEncryptionPublicKey: Uint8Array,\n  ): Promise<{\n    originalCredential: Omit<idOSCredential, \"user_id\">;\n    copyCredential: Omit<idOSCredential, \"user_id\">;\n  }> {\n    const { originalContentUri, copyContentUri, ...sharedCredentialParams } = credentialParams;\n    const originalCredential: PreliminaryIDOSCredential = {\n      ...(await buildPreliminaryIDOSCredential({\n        ...sharedCredentialParams,\n        contentUri: originalContentUri,\n        issuerSigningSecretKey: this.#signingKeyPair.secretKey,\n      })),\n      id: crypto.randomUUID(),\n    };\n\n    const contentHash = hexEncodeSha256Hash(credentialParams.plaintextContent);\n\n    const copyCredential: PreliminaryIDOSCredential = {\n      ...(await buildPreliminaryIDOSCredential({\n        ...sharedCredentialParams,\n        contentUri: copyContentUri,\n        publicNotes: \"\",\n        recipientEncryptionPublicKey: consumerEncryptionPublicKey,\n        issuerSigningSecretKey: this.#signingKeyPair.secretKey,\n      })),\n      id: crypto.randomUUID(),\n    };\n\n    invariant(\n      originalCredential.contentUri !== copyCredential.contentUri,\n      \"Original and copy credentials must use distinct content URIs\",\n    );\n\n    const requestId = crypto.randomUUID();\n    const payload: CreatePreliminaryCredentialsByDwgInput = {\n      request_id: requestId,\n      issuer_auth_public_key: originalCredential.issuerAuthPublicKey,\n      original_encryptor_public_key: originalCredential.encryptorPublicKey,\n      original_id: originalCredential.id,\n      original_content_uri: originalCredential.contentUri,\n      original_content_size: originalCredential.contentSize,\n      original_public_notes: originalCredential.publicNotes,\n      original_public_notes_signature: originalCredential.publicNotesSignature,\n      original_broader_signature: originalCredential.broaderSignature,\n      copy_encryptor_public_key: copyCredential.encryptorPublicKey,\n      copy_id: copyCredential.id,\n      copy_content_uri: copyCredential.contentUri,\n      copy_content_size: copyCredential.contentSize,\n      copy_public_notes_signature: copyCredential.publicNotesSignature,\n      copy_broader_signature: copyCredential.broaderSignature,\n      content_hash: contentHash,\n      dwg_owner: delegatedWriteGrant.ownerWalletIdentifier,\n      dwg_grantee: delegatedWriteGrant.consumerWalletIdentifier,\n      dwg_issuer_public_key: delegatedWriteGrant.issuerPublicKey,\n      dwg_id: delegatedWriteGrant.id,\n      dwg_access_grant_timelock: delegatedWriteGrant.accessGrantTimelock,\n      dwg_not_before: delegatedWriteGrant.notUsableBefore,\n      dwg_not_after: delegatedWriteGrant.notUsableAfter,\n      dwg_signature: delegatedWriteGrant.signature,\n    };\n\n    await createPreliminaryCredentialsByDwg(this.#kwilClient, payload);\n\n    await this.#blobGateway.uploadCredentialBlobs({\n      requestId,\n      original: originalCredential.encryptedContent,\n      copy: copyCredential.encryptedContent,\n    });\n\n    return {\n      originalCredential: mapPreliminaryToIDOSCredential(originalCredential),\n      copyCredential: mapPreliminaryToIDOSCredential(copyCredential),\n    };\n  }\n\n  async editCredentialAsIssuer(\n    publicNotesId: string,\n    publicNotes: string,\n  ): Promise<EditPublicNotesAsIssuerInput | null> {\n    const payload = {\n      public_notes_id: publicNotesId,\n      public_notes: publicNotes,\n    };\n\n    await editPublicNotesAsIssuer(this.#kwilClient, payload);\n\n    return payload;\n  }\n\n  async getCredentialIdByContentHash(contentHash: string): Promise<string | null> {\n    const id = await getSiblingCredentialId(this.#kwilClient, { content_hash: contentHash }).then(\n      (res) => res.id,\n    );\n\n    invariant(id, \"Required `idOSCredential` id not found\");\n\n    return id;\n  }\n\n  async getCredentialShared(id: string): Promise<idOSCredentialRecord | null> {\n    const result = await getCredentialShared(this.#kwilClient, { id }).then((res) => res[0]);\n\n    return result ?? null;\n  }\n}\n","import type { KwilActionClient } from \"@idos-network/kwil-infra\";\n\nimport {\n  hasProfile as _hasProfile,\n  upsertWalletAsInserter as _upsertWalletAsInserter,\n  addUserAsInserter,\n  addWalletMessage as _addWalletMessage,\n  type AddWalletMessageInput,\n  type GetUserAsInserterInput,\n  getUserAsInserter,\n  type idOSUser,\n  type idOSWallet,\n} from \"@idos-network/kwil-infra/actions\";\n\nexport type CreateProfileReqParams = Omit<idOSUser, \"id\"> & {\n  id?: string;\n};\n\nexport type UpsertWalletReqParams = Omit<idOSWallet, \"id\"> & {\n  id?: string;\n};\n\nexport type CreateWalletReqParams = Omit<UpsertWalletReqParams, \"user_id\"> & {\n  id?: string;\n};\n\nexport class UserService {\n  readonly #kwilClient: KwilActionClient;\n\n  constructor(kwilClient: KwilActionClient) {\n    this.#kwilClient = kwilClient;\n  }\n\n  #ensureEntityId<T extends { id?: string }>(entity: T): T & { id: string } {\n    if (!entity.id) {\n      (entity as T & { id: string }).id = crypto.randomUUID();\n    }\n    return entity as T & { id: string };\n  }\n\n  async hasProfile(address: string): Promise<boolean> {\n    return _hasProfile(this.#kwilClient, { address }).then((res) => res.has_profile);\n  }\n\n  async createUserProfile(params: CreateProfileReqParams): Promise<idOSUser> {\n    const payload = this.#ensureEntityId(params);\n    await addUserAsInserter(this.#kwilClient, payload);\n    return payload;\n  }\n\n  async upsertWalletAsInserter(params: UpsertWalletReqParams): Promise<idOSWallet> {\n    const payload = this.#ensureEntityId(params);\n    await _upsertWalletAsInserter(this.#kwilClient, payload);\n    return payload;\n  }\n\n  async addWalletMessage(params: AddWalletMessageInput): Promise<string> {\n    const result = await _addWalletMessage(this.#kwilClient, params);\n    return result.message;\n  }\n\n  /// Useful to understand if a user id already exists.\n  async getUser(params: GetUserAsInserterInput): Promise<idOSUser> {\n    return getUserAsInserter(this.#kwilClient, this.#ensureEntityId(params));\n  }\n\n  async createUser(\n    user: CreateProfileReqParams,\n    wallet: CreateWalletReqParams,\n  ): Promise<[idOSUser, idOSWallet]> {\n    const user_id = user.id ?? crypto.randomUUID();\n    const wallet_id = wallet.id ?? crypto.randomUUID();\n\n    const userReqParams = {\n      ...user,\n      id: user_id,\n    };\n\n    const userResponse = await this.createUserProfile(userReqParams);\n\n    const walletReqParams = {\n      ...wallet,\n      user_id,\n      id: wallet_id,\n    };\n\n    const walletResponse = await this.upsertWalletAsInserter(walletReqParams);\n\n    return [userResponse, walletResponse];\n  }\n}\n","import type {\n  AvailableIssuerType,\n  idOSCredential,\n  idOSCredentialRecord,\n} from \"@idos-network/credentials/types\";\nimport type {\n  AddWalletMessageInput,\n  EditPublicNotesAsIssuerInput,\n  idOSDelegatedWriteGrant,\n  idOSGrant,\n  idOSUser,\n  idOSUserAttribute,\n  idOSWallet,\n} from \"@idos-network/kwil-infra/actions\";\nimport type { SignKeyPair } from \"tweetnacl\";\n\nimport {\n  createKgwAuthenticatedBlobGateway,\n  createNodeKwilClient,\n  createServerKwilSigner,\n} from \"@idos-network/kwil-infra\";\n\nimport {\n  CredentialService,\n  type CredentialByDelegatedWriteGrantBaseParams,\n  type DelegatedWriteGrantBaseParams,\n  type DelegatedWriteGrantParams,\n} from \"./services/credential.service\";\nimport {\n  type CreateProfileReqParams,\n  type CreateWalletReqParams,\n  type UpsertWalletReqParams,\n  UserService,\n} from \"./services/user.service\";\n\ntype CreateIssuerParams = {\n  chainId?: string;\n  nodeUrl: string;\n  blobGatewayUrl?: string;\n  signingKeyPair: SignKeyPair;\n};\n\nexport class idOSIssuer {\n  readonly #credentialService: CredentialService;\n  readonly #userService: UserService;\n\n  static async init(params: CreateIssuerParams): Promise<idOSIssuer> {\n    const kwilClient = await createNodeKwilClient({\n      nodeUrl: params.nodeUrl,\n      chainId: params.chainId,\n    });\n\n    const [signer] = await createServerKwilSigner(params.signingKeyPair);\n    kwilClient.setSigner(signer);\n\n    const blobGateway = createKgwAuthenticatedBlobGateway({\n      url: params.blobGatewayUrl ?? params.nodeUrl,\n      kwilClient,\n      signer,\n    });\n\n    const credentialService = new CredentialService(kwilClient, params.signingKeyPair, blobGateway);\n    const userService = new UserService(kwilClient);\n\n    return new idOSIssuer(credentialService, userService);\n  }\n\n  private constructor(credentialService: CredentialService, userService: UserService) {\n    this.#credentialService = credentialService;\n    this.#userService = userService;\n  }\n\n  // User Service facade methods\n  async hasProfile(userAddress: string): Promise<boolean> {\n    return this.#userService.hasProfile(userAddress);\n  }\n\n  async createUserProfile(params: CreateProfileReqParams): Promise<idOSUser> {\n    return this.#userService.createUserProfile(params);\n  }\n\n  async upsertWalletAsInserter(params: UpsertWalletReqParams): Promise<idOSWallet> {\n    return this.#userService.upsertWalletAsInserter(params);\n  }\n\n  async addWalletMessage(params: AddWalletMessageInput): Promise<string> {\n    return this.#userService.addWalletMessage(params);\n  }\n\n  async createUser(\n    user: CreateProfileReqParams,\n    wallet: CreateWalletReqParams,\n  ): Promise<[idOSUser, idOSWallet]> {\n    return this.#userService.createUser(user, wallet);\n  }\n\n  async getUser(id: string): Promise<idOSUser> {\n    return this.#userService.getUser({ id });\n  }\n\n  async requestDelegatedWriteGrantMessage(params: idOSDelegatedWriteGrant): Promise<string> {\n    return this.#credentialService.requestDelegatedWriteGrantMessage(params);\n  }\n\n  async createCredentialByDelegatedWriteGrant(\n    credentialParams: CredentialByDelegatedWriteGrantBaseParams,\n    delegatedWriteGrant: DelegatedWriteGrantParams,\n    consumerEncryptionPublicKey: Uint8Array,\n  ): Promise<{\n    originalCredential: Omit<idOSCredential, \"user_id\">;\n    copyCredential: Omit<idOSCredential, \"user_id\">;\n  }> {\n    return this.#credentialService.createCredentialByDelegatedWriteGrant(\n      credentialParams,\n      delegatedWriteGrant,\n      consumerEncryptionPublicKey,\n    );\n  }\n\n  async editCredentialAsIssuer(\n    publicNotesId: string,\n    publicNotes: string,\n  ): Promise<EditPublicNotesAsIssuerInput | null> {\n    return this.#credentialService.editCredentialAsIssuer(publicNotesId, publicNotes);\n  }\n\n  async getCredentialIdByContentHash(contentHash: string): Promise<string | null> {\n    return this.#credentialService.getCredentialIdByContentHash(contentHash);\n  }\n\n  async getCredentialShared(id: string): Promise<idOSCredentialRecord | null> {\n    return this.#credentialService.getCredentialShared(id);\n  }\n}\n\nexport type {\n  idOSCredential,\n  idOSGrant,\n  idOSUser,\n  idOSUserAttribute,\n  idOSDelegatedWriteGrant,\n  idOSWallet,\n  AvailableIssuerType,\n  CredentialByDelegatedWriteGrantBaseParams,\n  DelegatedWriteGrantBaseParams,\n  DelegatedWriteGrantParams,\n};\n\nexport { toDelegatedWriteGrantBaseParams } from \"@idos-network/kwil-infra/actions\";\n"],"x_google_ignoreList":[0],"mappings":"qoBAAA,IAAI,EAAe,QAAQ,IAAI,WAAa,aACxC,EAAS,mBACb,SAAS,EAAU,EAAW,EAAS,CAC/B,MAGJ,IAAI,EACA,MAAU,MAAM,CAAM,EAE1B,IAAI,EAAW,OAAO,GAAY,WAAa,EAAQ,EAAI,EACvD,EAAQ,EAAW,GAAU,MAAqB,IAAY,EAClE,MAAU,MAAM,CAAK,CAJK,CAK9B,CC2BA,IAAa,EAAb,KAA+B,CAC7B,GACA,GACA,GAEA,YACE,EACA,EACA,EACA,CACA,KAAK,GAAc,EACnB,KAAK,GAAkB,EACvB,KAAK,GAAe,CACtB,CAEA,MAAM,kCAAkC,EAAkD,CACxF,OAAO,EAAW,KAAK,GAAa,CAAM,CAAC,CAAC,KAAM,GAAQ,EAAI,OAAO,CACvE,CAEA,MAAM,sCACJ,EACA,EACA,EAIC,CACD,GAAM,CAAE,qBAAoB,iBAAgB,GAAG,GAA2B,EACpE,EAAgD,CACpD,GAAI,MAAM,EAA+B,CACvC,GAAG,EACH,WAAY,EACZ,uBAAwB,KAAK,GAAgB,SAC/C,CAAC,EACD,GAAI,OAAO,WAAW,CACxB,EAEM,EAAc,EAAoB,EAAiB,gBAAgB,EAEnE,EAA4C,CAChD,GAAI,MAAM,EAA+B,CACvC,GAAG,EACH,WAAY,EACZ,YAAa,GACb,6BAA8B,EAC9B,uBAAwB,KAAK,GAAgB,SAC/C,CAAC,EACD,GAAI,OAAO,WAAW,CACxB,EAEA,EACE,EAAmB,aAAe,EAAe,WACjD,8DACF,EAEA,IAAM,EAAY,OAAO,WAAW,EAC9B,EAAkD,CACtD,WAAY,EACZ,uBAAwB,EAAmB,oBAC3C,8BAA+B,EAAmB,mBAClD,YAAa,EAAmB,GAChC,qBAAsB,EAAmB,WACzC,sBAAuB,EAAmB,YAC1C,sBAAuB,EAAmB,YAC1C,gCAAiC,EAAmB,qBACpD,2BAA4B,EAAmB,iBAC/C,0BAA2B,EAAe,mBAC1C,QAAS,EAAe,GACxB,iBAAkB,EAAe,WACjC,kBAAmB,EAAe,YAClC,4BAA6B,EAAe,qBAC5C,uBAAwB,EAAe,iBACvC,aAAc,EACd,UAAW,EAAoB,sBAC/B,YAAa,EAAoB,yBACjC,sBAAuB,EAAoB,gBAC3C,OAAQ,EAAoB,GAC5B,0BAA2B,EAAoB,oBAC/C,eAAgB,EAAoB,gBACpC,cAAe,EAAoB,eACnC,cAAe,EAAoB,SACrC,EAUA,OARA,MAAM,EAAkC,KAAK,GAAa,CAAO,EAEjE,MAAM,KAAK,GAAa,sBAAsB,CAC5C,YACA,SAAU,EAAmB,iBAC7B,KAAM,EAAe,gBACvB,CAAC,EAEM,CACL,mBAAoB,EAA+B,CAAkB,EACrE,eAAgB,EAA+B,CAAc,CAC/D,CACF,CAEA,MAAM,uBACJ,EACA,EAC8C,CAC9C,IAAM,EAAU,CACd,gBAAiB,EACjB,aAAc,CAChB,EAIA,OAFA,MAAM,EAAwB,KAAK,GAAa,CAAO,EAEhD,CACT,CAEA,MAAM,6BAA6B,EAA6C,CAC9E,IAAM,EAAK,MAAM,EAAuB,KAAK,GAAa,CAAE,aAAc,CAAY,CAAC,CAAC,CAAC,KACtF,GAAQ,EAAI,EACf,EAIA,OAFA,EAAU,EAAI,wCAAwC,EAE/C,CACT,CAEA,MAAM,oBAAoB,EAAkD,CAG1E,OAAO,MAFc,EAAoB,KAAK,GAAa,CAAE,IAAG,CAAC,CAAC,CAAC,KAAM,GAAQ,EAAI,EAAE,GAEtE,IACnB,CACF,EC3Ia,EAAb,KAAyB,CACvB,GAEA,YAAY,EAA8B,CACxC,KAAK,GAAc,CACrB,CAEA,GAA2C,EAA+B,CAIxE,MAHA,CACE,EAA+B,KAAK,OAAO,WAAW,EAEjD,CACT,CAEA,MAAM,WAAW,EAAmC,CAClD,OAAOA,EAAY,KAAK,GAAa,CAAE,SAAQ,CAAC,CAAC,CAAC,KAAM,GAAQ,EAAI,WAAW,CACjF,CAEA,MAAM,kBAAkB,EAAmD,CACzE,IAAM,EAAU,KAAK,GAAgB,CAAM,EAE3C,OADA,MAAM,EAAkB,KAAK,GAAa,CAAO,EAC1C,CACT,CAEA,MAAM,uBAAuB,EAAoD,CAC/E,IAAM,EAAU,KAAK,GAAgB,CAAM,EAE3C,OADA,MAAMC,EAAwB,KAAK,GAAa,CAAO,EAChD,CACT,CAEA,MAAM,iBAAiB,EAAgD,CAErE,OAAO,MADcC,EAAkB,KAAK,GAAa,CAAM,EAAA,CACjD,OAChB,CAGA,MAAM,QAAQ,EAAmD,CAC/D,OAAO,EAAkB,KAAK,GAAa,KAAK,GAAgB,CAAM,CAAC,CACzE,CAEA,MAAM,WACJ,EACA,EACiC,CACjC,IAAM,EAAU,EAAK,IAAM,OAAO,WAAW,EACvC,EAAY,EAAO,IAAM,OAAO,WAAW,EAE3C,EAAgB,CACpB,GAAG,EACH,GAAI,CACN,EAEM,EAAe,MAAM,KAAK,kBAAkB,CAAa,EAEzD,EAAkB,CACtB,GAAG,EACH,UACA,GAAI,CACN,EAIA,MAAO,CAAC,EAAc,MAFO,KAAK,uBAAuB,CAAe,CAEpC,CACtC,CACF,EChDa,EAAb,MAAa,CAAW,CACtB,GACA,GAEA,aAAa,KAAK,EAAiD,CACjE,IAAM,EAAa,MAAM,EAAqB,CAC5C,QAAS,EAAO,QAChB,QAAS,EAAO,OAClB,CAAC,EAEK,CAAC,GAAU,MAAM,EAAuB,EAAO,cAAc,EACnE,EAAW,UAAU,CAAM,EAE3B,IAAM,EAAc,EAAkC,CACpD,IAAK,EAAO,gBAAkB,EAAO,QACrC,aACA,QACF,CAAC,EAEK,EAAoB,IAAI,EAAkB,EAAY,EAAO,eAAgB,CAAW,EACxF,EAAc,IAAI,EAAY,CAAU,EAE9C,OAAO,IAAI,EAAW,EAAmB,CAAW,CACtD,CAEA,YAAoB,EAAsC,EAA0B,CAClF,KAAK,GAAqB,EAC1B,KAAK,GAAe,CACtB,CAGA,MAAM,WAAW,EAAuC,CACtD,OAAO,KAAK,GAAa,WAAW,CAAW,CACjD,CAEA,MAAM,kBAAkB,EAAmD,CACzE,OAAO,KAAK,GAAa,kBAAkB,CAAM,CACnD,CAEA,MAAM,uBAAuB,EAAoD,CAC/E,OAAO,KAAK,GAAa,uBAAuB,CAAM,CACxD,CAEA,MAAM,iBAAiB,EAAgD,CACrE,OAAO,KAAK,GAAa,iBAAiB,CAAM,CAClD,CAEA,MAAM,WACJ,EACA,EACiC,CACjC,OAAO,KAAK,GAAa,WAAW,EAAM,CAAM,CAClD,CAEA,MAAM,QAAQ,EAA+B,CAC3C,OAAO,KAAK,GAAa,QAAQ,CAAE,IAAG,CAAC,CACzC,CAEA,MAAM,kCAAkC,EAAkD,CACxF,OAAO,KAAK,GAAmB,kCAAkC,CAAM,CACzE,CAEA,MAAM,sCACJ,EACA,EACA,EAIC,CACD,OAAO,KAAK,GAAmB,sCAC7B,EACA,EACA,CACF,CACF,CAEA,MAAM,uBACJ,EACA,EAC8C,CAC9C,OAAO,KAAK,GAAmB,uBAAuB,EAAe,CAAW,CAClF,CAEA,MAAM,6BAA6B,EAA6C,CAC9E,OAAO,KAAK,GAAmB,6BAA6B,CAAW,CACzE,CAEA,MAAM,oBAAoB,EAAkD,CAC1E,OAAO,KAAK,GAAmB,oBAAoB,CAAE,CACvD,CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@idos-network/issuer",
-  "version": "1.5.0",
+  "version": "2.2.0",
   "description": "idOS Issuer JavaScript SDK for server environments",
   "homepage": "https://idos.network",
   "license": "MIT",
@@ -27,15 +27,16 @@
     "access": "public"
   },
   "dependencies": {
-    "@idos-network/kwil-js": "0.1.5",
-    "tweetnacl": "^1.0.3",
-    "@idos-network/credentials": "1.5.0",
-    "@idos-network/kwil-infra": "1.5.0",
-    "@idos-network/utils": "1.5.0"
+    "@idos-network/credentials": "2.2.0",
+    "@idos-network/kwil-infra": "2.2.0",
+    "@idos-network/kwil-js": "0.2.0",
+    "@idos-network/utils": "2.2.0",
+    "tweetnacl": "^1.0.3"
   },
   "devDependencies": {
     "tiny-invariant": "^1.3.3",
-    "tsdown": "^0.22.14"
+    "tsdown": "^0.23.0",
+    "vitest": "4.1.11"
   },
   "peerDependencies": {
     "typescript": "^5.9.3"
@@ -47,6 +48,7 @@
     "build": "tsdown",
     "dev": "tsdown  --watch",
     "publint": "pnpx publint --strict",
+    "test": "vitest",
     "typecheck": "tsc --noEmit"
   }
 }

package/src/index.test.ts

@@ -0,0 +1,226 @@
+import nacl from "tweetnacl";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { idOSIssuer, toDelegatedWriteGrantBaseParams } from "./index.js";
+
+const mocks = vi.hoisted(() => ({
+  blobGateway: { fetchBlob: vi.fn(), uploadCredentialBlobs: vi.fn() },
+  createPreliminaryCredentialsByDwg: vi.fn(),
+  addWalletMessage: vi.fn(async () => ({ message: "add-wallet-message" })),
+  dwgMessage: vi.fn(async () => ({ message: "dwg-message-string" })),
+  kwilClient: {
+    setSigner: vi.fn(),
+  },
+  signer: { publicKey: "signer" },
+}));
+
+vi.mock("@idos-network/kwil-infra", () => ({
+  createKgwAuthenticatedBlobGateway: vi.fn(() => mocks.blobGateway),
+  createNodeKwilClient: vi.fn(async () => mocks.kwilClient),
+  createServerKwilSigner: vi.fn(async () => [mocks.signer]),
+}));
+
+vi.mock("@idos-network/kwil-infra/actions", async (importOriginal) => ({
+  ...((await importOriginal()) as object),
+  addWalletMessage: mocks.addWalletMessage,
+  createPreliminaryCredentialsByDwg: mocks.createPreliminaryCredentialsByDwg,
+  dwgMessage: mocks.dwgMessage,
+}));
+
+describe("idOSIssuer", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("creates one KGW authenticated blob gateway for issuer services", async () => {
+    const { createKgwAuthenticatedBlobGateway } = await import("@idos-network/kwil-infra");
+    const signingKeyPair = nacl.sign.keyPair();
+
+    await idOSIssuer.init({
+      nodeUrl: "https://nodes.example",
+      blobGatewayUrl: "https://blob.example",
+      signingKeyPair,
+    });
+
+    expect(createKgwAuthenticatedBlobGateway).toHaveBeenCalledWith({
+      url: "https://blob.example",
+      kwilClient: mocks.kwilClient,
+      signer: mocks.signer,
+    });
+  });
+
+  it("creates delegated write grant credentials through the blob-backed flow", async () => {
+    const { createPreliminaryCredentialsByDwg } = await import("@idos-network/kwil-infra/actions");
+    const issuer = await idOSIssuer.init({
+      nodeUrl: "https://nodes.example",
+      blobGatewayUrl: "https://blob.example",
+      signingKeyPair: nacl.sign.keyPair(),
+    });
+    const userEncryptionKeyPair = nacl.box.keyPair();
+    const copyEncryptionKeyPair = nacl.box.keyPair();
+
+    const result = await issuer.createCredentialByDelegatedWriteGrant(
+      {
+        publicNotes: "{}",
+        plaintextContent: new Uint8Array([1, 2, 3]),
+        recipientEncryptionPublicKey: userEncryptionKeyPair.publicKey,
+      },
+      {
+        id: crypto.randomUUID(),
+        ownerWalletIdentifier: "owner",
+        consumerWalletIdentifier: "consumer",
+        issuerPublicKey: "issuer",
+        accessGrantTimelock: "2026-01-01T00:00:00Z",
+        notUsableBefore: "2026-01-01T00:00:00Z",
+        notUsableAfter: "2026-01-02T00:00:00Z",
+        signature: "signature",
+      },
+      copyEncryptionKeyPair.publicKey,
+    );
+
+    expect(createPreliminaryCredentialsByDwg).toHaveBeenCalledOnce();
+    expect(mocks.blobGateway.uploadCredentialBlobs).toHaveBeenCalledOnce();
+
+    const payload = mocks.createPreliminaryCredentialsByDwg.mock.calls[0]?.[1];
+    expect(payload.original_content_uri).toMatch(/^ipfs:\/\//);
+    expect(payload.copy_content_uri).toMatch(/^ipfs:\/\//);
+    expect(payload.original_content_size).toBeGreaterThan(0);
+    expect(payload.copy_content_size).toBeGreaterThan(0);
+    expect(mocks.blobGateway.uploadCredentialBlobs).toHaveBeenCalledWith({
+      requestId: payload.request_id,
+      original: expect.any(Uint8Array),
+      copy: expect.any(Uint8Array),
+    });
+    expect(result.originalCredential).toMatchObject({
+      id: payload.original_id,
+      content_uri: payload.original_content_uri,
+      content_size: payload.original_content_size,
+    });
+    expect(result.copyCredential).toMatchObject({
+      id: payload.copy_id,
+      content_uri: payload.copy_content_uri,
+      content_size: payload.copy_content_size,
+    });
+    expect(mocks.createPreliminaryCredentialsByDwg.mock.invocationCallOrder[0]).toBeLessThan(
+      mocks.blobGateway.uploadCredentialBlobs.mock.invocationCallOrder[0],
+    );
+  });
+
+  it("uses and enforces distinct custom content URIs for delegated write grants", async () => {
+    const issuer = await idOSIssuer.init({
+      nodeUrl: "https://nodes.example",
+      blobGatewayUrl: "https://blob.example",
+      signingKeyPair: nacl.sign.keyPair(),
+    });
+    const originalContentUri = "ukyc://storage-abc/blobs/original";
+    const copyContentUri = "ukyc://storage-abc/blobs/copy";
+    const credentialParams = {
+      publicNotes: "{}",
+      plaintextContent: new Uint8Array([1, 2, 3]),
+      recipientEncryptionPublicKey: nacl.box.keyPair().publicKey,
+      originalContentUri,
+      copyContentUri,
+    };
+    const delegatedWriteGrant = {
+      id: crypto.randomUUID(),
+      ownerWalletIdentifier: "owner",
+      consumerWalletIdentifier: "consumer",
+      issuerPublicKey: "issuer",
+      accessGrantTimelock: "2026-01-01T00:00:00Z",
+      notUsableBefore: "2026-01-01T00:00:00Z",
+      notUsableAfter: "2026-01-02T00:00:00Z",
+      signature: "signature",
+    };
+    const consumerEncryptionPublicKey = nacl.box.keyPair().publicKey;
+
+    const result = await issuer.createCredentialByDelegatedWriteGrant(
+      credentialParams,
+      delegatedWriteGrant,
+      consumerEncryptionPublicKey,
+    );
+
+    const payload = mocks.createPreliminaryCredentialsByDwg.mock.calls[0]?.[1];
+    expect(payload.original_content_uri).toBe(originalContentUri);
+    expect(payload.copy_content_uri).toBe(copyContentUri);
+    expect(result.originalCredential.content_uri).toBe(originalContentUri);
+    expect(result.copyCredential.content_uri).toBe(copyContentUri);
+
+    await expect(
+      issuer.createCredentialByDelegatedWriteGrant(
+        { ...credentialParams, copyContentUri: originalContentUri },
+        delegatedWriteGrant,
+        consumerEncryptionPublicKey,
+      ),
+    ).rejects.toThrow("Original and copy credentials must use distinct content URIs");
+    expect(mocks.createPreliminaryCredentialsByDwg).toHaveBeenCalledOnce();
+  });
+
+  it("maps request params for createCredentialByDelegatedWriteGrant via toDelegatedWriteGrantBaseParams", async () => {
+    const issuer = await idOSIssuer.init({
+      nodeUrl: "https://nodes.example",
+      blobGatewayUrl: "https://blob.example",
+      signingKeyPair: nacl.sign.keyPair(),
+    });
+
+    const dwgInput = {
+      id: crypto.randomUUID(),
+      owner_wallet_identifier: "0x311CEe6648df431EbbeA38dfB680C28661c893Ea",
+      grantee_wallet_identifier: "0x1111111111111111111111111111111111111111",
+      issuer_public_key: "issuer-key",
+      access_grant_timelock: "2026-01-01T00:00:00Z",
+      not_usable_before: "2026-01-01T00:00:00Z",
+      not_usable_after: "2026-01-02T00:00:00Z",
+    };
+
+    const walletMessage = await issuer.addWalletMessage({
+      address: "0x311CEe6648df431EbbeA38dfB680C28661c893Ea",
+      wallet_type: "EVM",
+      user_id: crypto.randomUUID(),
+      not_before: "2026-01-01T00:00:00Z",
+      not_after: "2026-01-01T00:15:00Z",
+    });
+    expect(walletMessage).toBe("add-wallet-message");
+    expect(mocks.addWalletMessage).toHaveBeenCalledOnce();
+
+    const message = await issuer.requestDelegatedWriteGrantMessage(dwgInput);
+    const params = toDelegatedWriteGrantBaseParams(dwgInput);
+
+    expect(message).toBe("dwg-message-string");
+    expect(params).toEqual({
+      id: dwgInput.id,
+      ownerWalletIdentifier: dwgInput.owner_wallet_identifier,
+      consumerWalletIdentifier: dwgInput.grantee_wallet_identifier,
+      issuerPublicKey: dwgInput.issuer_public_key,
+      accessGrantTimelock: dwgInput.access_grant_timelock,
+      notUsableBefore: dwgInput.not_usable_before,
+      notUsableAfter: dwgInput.not_usable_after,
+    });
+
+    const userEncryptionKeyPair = nacl.box.keyPair();
+    const copyEncryptionKeyPair = nacl.box.keyPair();
+
+    await issuer.createCredentialByDelegatedWriteGrant(
+      {
+        publicNotes: "{}",
+        plaintextContent: new Uint8Array([1, 2, 3]),
+        recipientEncryptionPublicKey: userEncryptionKeyPair.publicKey,
+      },
+      {
+        ...params,
+        signature: "0xsignature",
+      },
+      copyEncryptionKeyPair.publicKey,
+    );
+
+    expect(mocks.createPreliminaryCredentialsByDwg).toHaveBeenCalled();
+    const payload = mocks.createPreliminaryCredentialsByDwg.mock.calls.at(-1)?.[1];
+    expect(payload.dwg_id).toBe(params.id);
+    expect(payload.dwg_owner).toBe(params.ownerWalletIdentifier);
+    expect(payload.dwg_grantee).toBe(params.consumerWalletIdentifier);
+    expect(payload.dwg_issuer_public_key).toBe(params.issuerPublicKey);
+    expect(payload.dwg_access_grant_timelock).toBe(params.accessGrantTimelock);
+    expect(payload.dwg_not_before).toBe(params.notUsableBefore);
+    expect(payload.dwg_not_after).toBe(params.notUsableAfter);
+    expect(payload.dwg_signature).toBe("0xsignature");
+  });
+});

package/src/index.ts

@@ -1,11 +1,10 @@
 import type {
   AvailableIssuerType,
-  CredentialFields,
-  CredentialSubject,
-  CredentialSubjectFaceId,
   idOSCredential,
+  idOSCredentialRecord,
 } from "@idos-network/credentials/types";
 import type {
+  AddWalletMessageInput,
   EditPublicNotesAsIssuerInput,
   idOSDelegatedWriteGrant,
   idOSGrant,
@@ -16,20 +15,17 @@ import type {
 import type { SignKeyPair } from "tweetnacl";
 
 import {
-  buildCredential,
-  buildFaceIdCredential,
-  type Credential,
-  type FaceIdCredential,
-} from "@idos-network/credentials/builder";
-import { deriveLevel } from "@idos-network/credentials/utils";
-import { createNodeKwilClient, createServerKwilSigner } from "@idos-network/kwil-infra";
+  createKgwAuthenticatedBlobGateway,
+  createNodeKwilClient,
+  createServerKwilSigner,
+} from "@idos-network/kwil-infra";
 
 import {
   CredentialService,
+  type CredentialByDelegatedWriteGrantBaseParams,
   type DelegatedWriteGrantBaseParams,
   type DelegatedWriteGrantParams,
 } from "./services/credential.service";
-import { type CreateAccessGrantFromDAGParams, GrantService } from "./services/grant.service";
 import {
   type CreateProfileReqParams,
   type CreateWalletReqParams,
@@ -40,13 +36,12 @@ import {
 type CreateIssuerParams = {
   chainId?: string;
   nodeUrl: string;
+  blobGatewayUrl?: string;
   signingKeyPair: SignKeyPair;
-  encryptionSecretKey: Uint8Array;
 };
 
 export class idOSIssuer {
   readonly #credentialService: CredentialService;
-  readonly #grantService: GrantService;
   readonly #userService: UserService;
 
   static async init(params: CreateIssuerParams): Promise<idOSIssuer> {
@@ -58,25 +53,20 @@ export class idOSIssuer {
     const [signer] = await createServerKwilSigner(params.signingKeyPair);
     kwilClient.setSigner(signer);
 
-    const credentialService = new CredentialService(
+    const blobGateway = createKgwAuthenticatedBlobGateway({
+      url: params.blobGatewayUrl ?? params.nodeUrl,
       kwilClient,
-      params.signingKeyPair,
-      params.encryptionSecretKey,
-    );
+      signer,
+    });
 
-    const grantService = new GrantService(kwilClient, params.encryptionSecretKey);
+    const credentialService = new CredentialService(kwilClient, params.signingKeyPair, blobGateway);
     const userService = new UserService(kwilClient);
 
-    return new idOSIssuer(credentialService, grantService, userService);
+    return new idOSIssuer(credentialService, userService);
   }
 
-  private constructor(
-    credentialService: CredentialService,
-    grantService: GrantService,
-    userService: UserService,
-  ) {
+  private constructor(credentialService: CredentialService, userService: UserService) {
     this.#credentialService = credentialService;
-    this.#grantService = grantService;
     this.#userService = userService;
   }
 
@@ -93,6 +83,10 @@ export class idOSIssuer {
     return this.#userService.upsertWalletAsInserter(params);
   }
 
+  async addWalletMessage(params: AddWalletMessageInput): Promise<string> {
+    return this.#userService.addWalletMessage(params);
+  }
+
   async createUser(
     user: CreateProfileReqParams,
     wallet: CreateWalletReqParams,
@@ -109,9 +103,9 @@ export class idOSIssuer {
   }
 
   async createCredentialByDelegatedWriteGrant(
-    credentialParams: DelegatedWriteGrantBaseParams,
+    credentialParams: CredentialByDelegatedWriteGrantBaseParams,
     delegatedWriteGrant: DelegatedWriteGrantParams,
-    consumerEncryptionPublicKey?: Uint8Array,
+    consumerEncryptionPublicKey: Uint8Array,
   ): Promise<{
     originalCredential: Omit<idOSCredential, "user_id">;
     copyCredential: Omit<idOSCredential, "user_id">;
@@ -134,41 +128,9 @@ export class idOSIssuer {
     return this.#credentialService.getCredentialIdByContentHash(contentHash);
   }
 
-  async getCredentialShared(id: string): Promise<idOSCredential | null> {
+  async getCredentialShared(id: string): Promise<idOSCredentialRecord | null> {
     return this.#credentialService.getCredentialShared(id);
   }
-
-  async createAccessGrantFromDAG(
-    params: CreateAccessGrantFromDAGParams,
-  ): Promise<CreateAccessGrantFromDAGParams | null> {
-    return this.#grantService.createAccessGrantFromDAG(
-      params,
-      (contentHash: string) => this.getCredentialIdByContentHash(contentHash),
-      (id: string) => this.getCredentialShared(id),
-    );
-  }
-
-  async buildCredential(
-    fields: CredentialFields,
-    subject: CredentialSubject,
-    issuer: AvailableIssuerType,
-    validate = true,
-  ): Promise<Credential> {
-    return buildCredential(fields, subject, issuer, validate);
-  }
-
-  deriveCredentialLevel(subject: CredentialSubject): string {
-    return deriveLevel(subject);
-  }
-
-  async buildFaceIdCredential(
-    fields: CredentialFields,
-    subject: CredentialSubjectFaceId,
-    issuer: AvailableIssuerType,
-    validate = true,
-  ): Promise<FaceIdCredential> {
-    return buildFaceIdCredential(fields, subject, issuer, validate);
-  }
 }
 
 export type {
@@ -178,10 +140,10 @@ export type {
   idOSUserAttribute,
   idOSDelegatedWriteGrant,
   idOSWallet,
-  CredentialFields,
-  CredentialSubject,
   AvailableIssuerType,
-  Credential,
-  CredentialSubjectFaceId,
-  FaceIdCredential,
+  CredentialByDelegatedWriteGrantBaseParams,
+  DelegatedWriteGrantBaseParams,
+  DelegatedWriteGrantParams,
 };
+
+export { toDelegatedWriteGrantBaseParams } from "@idos-network/kwil-infra/actions";

package/src/services/credential.service.ts

@@ -1,119 +1,55 @@
-import type { idOSCredential } from "@idos-network/credentials/types";
+import type { idOSCredential, idOSCredentialRecord } from "@idos-network/credentials/types";
 import type { KwilActionClient } from "@idos-network/kwil-infra";
 
 import {
-  type CreateCredentialsByDwgInput,
-  createCredentialsByDwg,
+  buildPreliminaryIDOSCredential,
+  BuildPreliminaryIDOSCredentialArgs,
+  mapPreliminaryToIDOSCredential,
+  PreliminaryIDOSCredential,
+} from "@idos-network/credentials/utils";
+import {
+  type CreatePreliminaryCredentialsByDwgInput,
+  createPreliminaryCredentialsByDwg,
   dwgMessage,
   type EditPublicNotesAsIssuerInput,
   editPublicNotesAsIssuer,
   getCredentialShared,
   getSiblingCredentialId,
   type idOSDelegatedWriteGrant,
+  type DelegatedWriteGrantBaseParams,
 } from "@idos-network/kwil-infra/actions";
-import {
-  base64Decode,
-  base64Encode,
-  hexEncode,
-  hexEncodeSha256Hash,
-  utf8Encode,
-} from "@idos-network/utils/codecs";
-import { encryptContent } from "@idos-network/utils/cryptography";
+import { BlobGateway } from "@idos-network/utils/blob-gateway";
+import { hexEncodeSha256Hash } from "@idos-network/utils/codecs";
 import invariant from "tiny-invariant";
 import nacl from "tweetnacl";
 
-type InsertableIDOSCredential = Omit<idOSCredential, "id" | "original_id"> & {
-  id?: idOSCredential["id"];
-  content_hash?: string;
-  public_notes_signature: string;
-  broader_signature: string;
-};
+export type { DelegatedWriteGrantBaseParams };
 
-type BuildInsertableIDOSCredentialArgs = {
-  userId: string;
-  publicNotes: string;
-  plaintextContent: Uint8Array;
-  recipientEncryptionPublicKey: Uint8Array;
-};
-
-export type BaseCredentialParams = {
-  id?: string;
-  userId: string;
-  publicNotes: string;
-  plaintextContent: Uint8Array;
-  recipientEncryptionPublicKey: Uint8Array;
+export type DelegatedWriteGrantParams = DelegatedWriteGrantBaseParams & {
+  signature: string;
 };
 
-export type DelegatedWriteGrantBaseParams = Omit<BaseCredentialParams, "userId">;
-
-export type DelegatedWriteGrantParams = {
-  id: string;
-  ownerWalletIdentifier: string;
-  consumerWalletIdentifier: string;
-  issuerPublicKey: string;
-  accessGrantTimelock: string;
-  notUsableBefore: string;
-  notUsableAfter: string;
-  signature: string;
+export type CredentialByDelegatedWriteGrantBaseParams = Omit<
+  BuildPreliminaryIDOSCredentialArgs,
+  "issuerSigningSecretKey" | "contentUri"
+> & {
+  originalContentUri?: string;
+  copyContentUri?: string;
 };
 
 export class CredentialService {
   readonly #kwilClient: KwilActionClient;
   readonly #signingKeyPair: nacl.SignKeyPair;
-  readonly #encryptionSecretKey: Uint8Array;
+  readonly #blobGateway: BlobGateway;
 
   constructor(
     kwilClient: KwilActionClient,
     signingKeyPair: nacl.SignKeyPair,
-    encryptionSecretKey: Uint8Array,
+    blobGateway: BlobGateway,
   ) {
     this.#kwilClient = kwilClient;
     this.#signingKeyPair = signingKeyPair;
-    this.#encryptionSecretKey = encryptionSecretKey;
-  }
-
-  #buildInsertableIDOSCredential({
-    userId,
-    publicNotes,
-    plaintextContent,
-    recipientEncryptionPublicKey,
-  }: Omit<BuildInsertableIDOSCredentialArgs, "userId"> & { userId?: string }):
-    | InsertableIDOSCredential
-    | Omit<InsertableIDOSCredential, "user_id"> {
-    const ephemeralKeyPair = nacl.box.keyPair();
-    const content = encryptContent(
-      plaintextContent,
-      recipientEncryptionPublicKey,
-      ephemeralKeyPair.secretKey,
-    );
-
-    const public_notes_signature = base64Encode(
-      nacl.sign.detached(utf8Encode(publicNotes), this.#signingKeyPair.secretKey),
-    );
-
-    return {
-      user_id: userId,
-      content: base64Encode(content),
-      public_notes: publicNotes,
-      public_notes_signature,
-
-      broader_signature: base64Encode(
-        nacl.sign.detached(
-          Uint8Array.from([...base64Decode(public_notes_signature), ...content]),
-          this.#signingKeyPair.secretKey,
-        ),
-      ),
-
-      issuer_auth_public_key: hexEncode(this.#signingKeyPair.publicKey, true),
-      encryptor_public_key: base64Encode(ephemeralKeyPair.publicKey),
-    };
-  }
-
-  #ensureEntityId<T extends { id?: string }>(entity: T): T & { id: string } {
-    if (!entity.id) {
-      (entity as T & { id: string }).id = crypto.randomUUID();
-    }
-    return entity as T & { id: string };
+    this.#blobGateway = blobGateway;
   }
 
   async requestDelegatedWriteGrantMessage(params: idOSDelegatedWriteGrant): Promise<string> {
@@ -121,47 +57,58 @@ export class CredentialService {
   }
 
   async createCredentialByDelegatedWriteGrant(
-    credentialParams: DelegatedWriteGrantBaseParams,
+    credentialParams: CredentialByDelegatedWriteGrantBaseParams,
     delegatedWriteGrant: DelegatedWriteGrantParams,
-    consumerEncryptionPublicKey?: Uint8Array,
+    consumerEncryptionPublicKey: Uint8Array,
   ): Promise<{
     originalCredential: Omit<idOSCredential, "user_id">;
     copyCredential: Omit<idOSCredential, "user_id">;
   }> {
-    let recipientPublicKey = consumerEncryptionPublicKey;
-    if (!recipientPublicKey) {
-      // If we're not explicitly given a consumer enc pub key, we're assuming that the issuer is creating a copy
-      // for themselves. So, we derive the recipient encryption public key from the issuer's encryption secret key.
-      recipientPublicKey = nacl.box.keyPair.fromSecretKey(this.#encryptionSecretKey).publicKey;
-    }
-
-    const originalCredential = this.#ensureEntityId(
-      this.#buildInsertableIDOSCredential(credentialParams),
-    );
+    const { originalContentUri, copyContentUri, ...sharedCredentialParams } = credentialParams;
+    const originalCredential: PreliminaryIDOSCredential = {
+      ...(await buildPreliminaryIDOSCredential({
+        ...sharedCredentialParams,
+        contentUri: originalContentUri,
+        issuerSigningSecretKey: this.#signingKeyPair.secretKey,
+      })),
+      id: crypto.randomUUID(),
+    };
 
     const contentHash = hexEncodeSha256Hash(credentialParams.plaintextContent);
 
-    const copyCredential = this.#ensureEntityId(
-      this.#buildInsertableIDOSCredential({
+    const copyCredential: PreliminaryIDOSCredential = {
+      ...(await buildPreliminaryIDOSCredential({
+        ...sharedCredentialParams,
+        contentUri: copyContentUri,
         publicNotes: "",
-        plaintextContent: credentialParams.plaintextContent,
-        recipientEncryptionPublicKey: recipientPublicKey,
-      }),
+        recipientEncryptionPublicKey: consumerEncryptionPublicKey,
+        issuerSigningSecretKey: this.#signingKeyPair.secretKey,
+      })),
+      id: crypto.randomUUID(),
+    };
+
+    invariant(
+      originalCredential.contentUri !== copyCredential.contentUri,
+      "Original and copy credentials must use distinct content URIs",
     );
 
-    const payload: CreateCredentialsByDwgInput = {
-      issuer_auth_public_key: originalCredential.issuer_auth_public_key,
-      original_encryptor_public_key: originalCredential.encryptor_public_key,
-      original_credential_id: originalCredential.id,
-      original_content: originalCredential.content,
-      original_public_notes: originalCredential.public_notes,
-      original_public_notes_signature: originalCredential.public_notes_signature,
-      original_broader_signature: originalCredential.broader_signature,
-      copy_encryptor_public_key: copyCredential.encryptor_public_key,
-      copy_credential_id: copyCredential.id,
-      copy_content: copyCredential.content,
-      copy_public_notes_signature: copyCredential.public_notes_signature,
-      copy_broader_signature: copyCredential.broader_signature,
+    const requestId = crypto.randomUUID();
+    const payload: CreatePreliminaryCredentialsByDwgInput = {
+      request_id: requestId,
+      issuer_auth_public_key: originalCredential.issuerAuthPublicKey,
+      original_encryptor_public_key: originalCredential.encryptorPublicKey,
+      original_id: originalCredential.id,
+      original_content_uri: originalCredential.contentUri,
+      original_content_size: originalCredential.contentSize,
+      original_public_notes: originalCredential.publicNotes,
+      original_public_notes_signature: originalCredential.publicNotesSignature,
+      original_broader_signature: originalCredential.broaderSignature,
+      copy_encryptor_public_key: copyCredential.encryptorPublicKey,
+      copy_id: copyCredential.id,
+      copy_content_uri: copyCredential.contentUri,
+      copy_content_size: copyCredential.contentSize,
+      copy_public_notes_signature: copyCredential.publicNotesSignature,
+      copy_broader_signature: copyCredential.broaderSignature,
       content_hash: contentHash,
       dwg_owner: delegatedWriteGrant.ownerWalletIdentifier,
       dwg_grantee: delegatedWriteGrant.consumerWalletIdentifier,
@@ -173,9 +120,18 @@ export class CredentialService {
       dwg_signature: delegatedWriteGrant.signature,
     };
 
-    await createCredentialsByDwg(this.#kwilClient, payload);
+    await createPreliminaryCredentialsByDwg(this.#kwilClient, payload);
 
-    return { originalCredential, copyCredential };
+    await this.#blobGateway.uploadCredentialBlobs({
+      requestId,
+      original: originalCredential.encryptedContent,
+      copy: copyCredential.encryptedContent,
+    });
+
+    return {
+      originalCredential: mapPreliminaryToIDOSCredential(originalCredential),
+      copyCredential: mapPreliminaryToIDOSCredential(copyCredential),
+    };
   }
 
   async editCredentialAsIssuer(
@@ -202,7 +158,7 @@ export class CredentialService {
     return id;
   }
 
-  async getCredentialShared(id: string): Promise<idOSCredential | null> {
+  async getCredentialShared(id: string): Promise<idOSCredentialRecord | null> {
     const result = await getCredentialShared(this.#kwilClient, { id }).then((res) => res[0]);
 
     return result ?? null;

package/src/services/user.service.ts

@@ -4,6 +4,8 @@ import {
   hasProfile as _hasProfile,
   upsertWalletAsInserter as _upsertWalletAsInserter,
   addUserAsInserter,
+  addWalletMessage as _addWalletMessage,
+  type AddWalletMessageInput,
   type GetUserAsInserterInput,
   getUserAsInserter,
   type idOSUser,
@@ -52,6 +54,11 @@ export class UserService {
     return payload;
   }
 
+  async addWalletMessage(params: AddWalletMessageInput): Promise<string> {
+    const result = await _addWalletMessage(this.#kwilClient, params);
+    return result.message;
+  }
+
   /// Useful to understand if a user id already exists.
   async getUser(params: GetUserAsInserterInput): Promise<idOSUser> {
     return getUserAsInserter(this.#kwilClient, this.#ensureEntityId(params));

package/src/services/grant.service.ts

@@ -1,56 +0,0 @@
-import type { idOSCredential } from "@idos-network/credentials/types";
-import type { KwilActionClient } from "@idos-network/kwil-infra";
-
-import { createAgByDagForCopy as _createAgByDagForCopy } from "@idos-network/kwil-infra/actions";
-import { base64Encode, hexEncodeSha256Hash, utf8Encode } from "@idos-network/utils/codecs";
-import { NoncedBox } from "@idos-network/utils/cryptography";
-import invariant from "tiny-invariant";
-
-export type CreateAccessGrantFromDAGParams = {
-  dag_data_id: string;
-  dag_owner_wallet_identifier: string;
-  dag_grantee_wallet_identifier: string;
-  dag_signature: string;
-  dag_locked_until: number;
-  dag_content_hash: string;
-};
-
-export class GrantService {
-  readonly #kwilClient: KwilActionClient;
-  readonly #encryptionSecretKey: Uint8Array;
-
-  constructor(kwilClient: KwilActionClient, encryptionSecretKey: Uint8Array) {
-    this.#kwilClient = kwilClient;
-    this.#encryptionSecretKey = encryptionSecretKey;
-  }
-
-  async createAccessGrantFromDAG(
-    params: CreateAccessGrantFromDAGParams,
-    getCredentialIdByContentHash: (contentHash: string) => Promise<string | null>,
-    getCredentialShared: (id: string) => Promise<idOSCredential | null>,
-  ): Promise<CreateAccessGrantFromDAGParams | null> {
-    const credentialId = await getCredentialIdByContentHash(params.dag_content_hash);
-
-    invariant(credentialId, "Missing `idOSCredential` id");
-
-    const credential = await getCredentialShared(credentialId);
-
-    invariant(credential, "`idOSCredential` with id `{credentialId}` not found");
-
-    const plaintextContent = await NoncedBox.nonceFromBase64SecretKey(
-      base64Encode(this.#encryptionSecretKey),
-    ).decrypt(credential.content, credential.encryptor_public_key);
-
-    // Get the content hash from the plaintext content
-    const contentHash = hexEncodeSha256Hash(utf8Encode(plaintextContent));
-
-    // Check if the content hash matches the content hash in the credential
-    if (contentHash !== params.dag_content_hash) {
-      throw new Error("Hash mismatch between `DAG` and `idOSCredential` content");
-    }
-
-    const result = await _createAgByDagForCopy(this.#kwilClient, params);
-
-    return result ?? null;
-  }
-}