@learncard/create-http-bridge 1.1.247 → 1.1.249

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @learncard/create-http-bridge
 
+## 1.1.249
+
+### Patch Changes
+
+-   [#1444](https://github.com/learningeconomy/LearnCard/pull/1444) [`5489866631ce3b19709a3685c56ff68e2d817af4`](https://github.com/learningeconomy/LearnCard/commit/5489866631ce3b19709a3685c56ff68e2d817af4) Thanks [@TaylorBeeston](https://github.com/TaylorBeeston)! - [LC-1958] Fix W3C EdDSA Data Integrity interoperability and ship rebuilt native and WASM DIDKit artifacts.
+
+-   Updated dependencies [[`5489866631ce3b19709a3685c56ff68e2d817af4`](https://github.com/learningeconomy/LearnCard/commit/5489866631ce3b19709a3685c56ff68e2d817af4)]:
+    -   @learncard/types@5.18.1
+    -   @learncard/init@2.4.10
+
+## 1.1.248
+
+### Patch Changes
+
+-   Updated dependencies [[`660778e73161c9c185e1f6592a5ac90dd9309a0a`](https://github.com/learningeconomy/LearnCard/commit/660778e73161c9c185e1f6592a5ac90dd9309a0a), [`acf13250d6ffd39798b44f0c5b9331b3769ebd24`](https://github.com/learningeconomy/LearnCard/commit/acf13250d6ffd39798b44f0c5b9331b3769ebd24), [`f504c57823d2a978f9cec569a00c9478ea8b3158`](https://github.com/learningeconomy/LearnCard/commit/f504c57823d2a978f9cec569a00c9478ea8b3158)]:
+    -   @learncard/types@5.18.0
+    -   @learncard/init@2.4.9
+
 ## 1.1.247
 
 ### Patch Changes

package/README.md

@@ -20,6 +20,64 @@ https://docs.learncard.com
 -   Add a .env file exporting a wallet seed (e.g. `WALLET_SEED=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa`)
 -   Run `bun run serverless-deploy`
 
+## Local VC-API conformance testing
+
+The bridge uses a source-controlled DIDKit WASM copied from the current plugin build. Every
+build and start command verifies the canonical plugin artifact's SHA-256 before refreshing the
+bridge copy, so local, CLI, and serverless execution cannot silently use different binaries.
+
+```bash
+cd lib/didkit/lib/web
+wasm-pack build --target=web && cd pkg && wasm-opt -Oz -o tmp.wasm didkit_wasm_bg.wasm && mv tmp.wasm didkit_wasm_bg.wasm && cp didkit* ../../../../../packages/plugins/didkit/src/didkit/pkg/ && cd ..
+bun --cwd ../../../../packages/plugins/didkit run build
+```
+
+Stop and restart any running bridge after rebuilding; it loads the DIDKit WASM during
+initialization.
+When intentionally rebuilding DIDKit, review the new binary and update
+`EXPECTED_DIDKIT_SHA256` in `scripts/sync-didkit.ts`. To test an unreviewed local artifact
+without changing that pin, set `LOCAL_DIDKIT_PATH` as described below.
+
+Start the LearnCard HTTP bridge in the first terminal:
+
+```bash
+cd packages/learn-card-bridge-http
+WALLET_SEED=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa \
+bun run start:local
+```
+
+Set `LOCAL_DIDKIT_PATH=/absolute/path/to/didkit_wasm_bg.wasm` only to override the
+package-provided WASM. The test seed must match the issuer DID in `w3c-localConfig.cjs`.
+
+Run the current W3C EdDSA Data Integrity suite in a second terminal:
+
+```bash
+git clone --depth 1 https://github.com/w3c/vc-di-eddsa-test-suite.git
+cd vc-di-eddsa-test-suite
+npm install
+cp "$LEARN_CARD_REPO/packages/learn-card-bridge-http/w3c-localConfig.cjs" localConfig.cjs
+npx mocha tests/05-di-rdfc-create.js --timeout 30000
+npx mocha tests/15-di-rdfc-verify.js --timeout 30000
+```
+
+Set `LEARN_CARD_REPO` to the absolute path of this monorepo. Set `BASE_URL` when the
+bridge is not listening at `http://127.0.0.1:3100`.
+
+## URL issuer verification policy
+
+When a credential names an HTTPS issuer but its proof uses a DID verification method, a
+successful `proof` check establishes signature integrity only. DIDKit cannot establish that the
+named URL issuer authorized that DID key because there is no issuer DID document to supply the
+assertion-method relationship. The raw verification result therefore includes this
+security-relevant warning:
+
+```text
+Issuer authorization was not checked because the credential issuer is not a DID
+```
+
+Consumers must surface or enforce this warning according to their trust policy; they must not
+interpret `checks: ["proof"]` by itself as issuer authorization.
+
 ## Contributing
 
 Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.

package/dist/index.js

@@ -416,14 +416,16 @@ const App = ({ name = "LearnCardHTTPBridge" }) => {
 };
 
 var name = "@learncard/create-http-bridge";
-var version = "1.1.247";
+var version = "1.1.249";
 var description = "Instantly create and deploy a Learn Card Bridge HTTP API via AWS Lambda!";
 var main = "dist/index.js";
 var bin = "dist/index.js";
 var scripts = {
-	"serverless-deploy": "shx cp ../learn-card-core/src/didkit/pkg/didkit_wasm_bg.wasm src/didkit_wasm_bg.wasm && serverless deploy",
-	start: "rollup -c && node dist/index.js",
-	build: "rollup -c"
+	"sync-didkit": "bun scripts/sync-didkit.ts",
+	"serverless-deploy": "bun run sync-didkit && serverless deploy",
+	start: "bun run sync-didkit && rollup -c && node dist/index.js",
+	"start:local": "bun run sync-didkit && bun src/server.ts",
+	build: "bun run sync-didkit && rollup -c"
 };
 var author = "Learning Economy Foundation (www.learningeconomy.io)";
 var license = "MIT";
@@ -451,7 +453,8 @@ var dependencies = {
 	"serverless-http": "^3.0.1",
 	"serverless-plugin-warmup": "^8.1.0",
 	"simple-git": "^3.36.0",
-	"use-immer": "^0.7.0"
+	"use-immer": "^0.7.0",
+	zod: "4.1.13"
 };
 var devDependencies = {
 	"@types/aws-lambda": "^8.10.106",
@@ -464,7 +467,6 @@ var devDependencies = {
 	"@types/react": "^17.0.2",
 	nodemon: "^2.0.16",
 	"serverless-plugin-typescript": "^2.1.0",
-	shx: "^0.3.4",
 	"ts-node": "^10.8.1"
 };
 var repository = {

package/package.json

@@ -1,19 +1,21 @@
 {
     "name": "@learncard/create-http-bridge",
-    "version": "1.1.247",
+    "version": "1.1.249",
     "description": "Instantly create and deploy a Learn Card Bridge HTTP API via AWS Lambda!",
     "main": "dist/index.js",
     "bin": "dist/index.js",
     "scripts": {
-        "serverless-deploy": "shx cp ../learn-card-core/src/didkit/pkg/didkit_wasm_bg.wasm src/didkit_wasm_bg.wasm && serverless deploy",
-        "start": "rollup -c && node dist/index.js",
-        "build": "rollup -c"
+        "sync-didkit": "bun scripts/sync-didkit.ts",
+        "serverless-deploy": "bun run sync-didkit && serverless deploy",
+        "start": "bun run sync-didkit && rollup -c && node dist/index.js",
+        "start:local": "bun run sync-didkit && bun src/server.ts",
+        "build": "bun run sync-didkit && rollup -c"
     },
     "author": "Learning Economy Foundation (www.learningeconomy.io)",
     "license": "MIT",
     "dependencies": {
-        "@learncard/init": "2.4.8",
-        "@learncard/types": "5.17.6",
+        "@learncard/init": "2.4.10",
+        "@learncard/types": "5.18.1",
         "@rollup/plugin-json": "^4.1.0",
         "commander": "^9.3.0",
         "cors": "^2.8.5",
@@ -35,7 +37,8 @@
         "serverless-http": "^3.0.1",
         "serverless-plugin-warmup": "^8.1.0",
         "simple-git": "^3.36.0",
-        "use-immer": "^0.7.0"
+        "use-immer": "^0.7.0",
+        "zod": "4.1.13"
     },
     "devDependencies": {
         "@types/aws-lambda": "^8.10.106",
@@ -48,7 +51,6 @@
         "@types/react": "^17.0.2",
         "nodemon": "^2.0.16",
         "serverless-plugin-typescript": "^2.1.0",
-        "shx": "^0.3.4",
         "ts-node": "^10.8.1"
     },
     "repository": {

package/project.json

@@ -7,7 +7,11 @@
     "tags": [],
     "implicitDependencies": ["types", "init"],
     "namedInputs": {
-        "source": ["{projectRoot}/src/**/*"],
+        "source": [
+            "{projectRoot}/src/**/*",
+            "{projectRoot}/scripts/sync-didkit.ts",
+            "{workspaceRoot}/packages/plugins/didkit/src/didkit/pkg/didkit_wasm_bg.wasm"
+        ],
         "dist": ["{projectRoot}/dist/**/*"]
     },
     "targets": {

package/scripts/sync-didkit.ts

@@ -0,0 +1,22 @@
+import { createHash } from 'crypto';
+import { readFile, writeFile } from 'fs/promises';
+
+const EXPECTED_DIDKIT_SHA256 = '60efb6027699fda135db0d817f7a541bbd660ae88bec9cbec9796feeb3740b96';
+const sourceUrl = new URL(
+    '../../plugins/didkit/src/didkit/pkg/didkit_wasm_bg.wasm',
+    import.meta.url
+);
+const destinationUrl = new URL('../src/didkit_wasm_bg.wasm', import.meta.url);
+if (!process.env.LOCAL_DIDKIT_PATH) {
+    const didkit = await readFile(sourceUrl);
+    const actualHash = createHash('sha256').update(didkit).digest('hex');
+
+    if (actualHash !== EXPECTED_DIDKIT_SHA256) {
+        throw new Error(
+            `DIDKit WASM hash changed: expected ${EXPECTED_DIDKIT_SHA256}, received ${actualHash}. ` +
+                'Review the rebuilt artifact and update EXPECTED_DIDKIT_SHA256 intentionally.'
+        );
+    }
+
+    await writeFile(destinationUrl, didkit);
+}

package/serverless.yml

@@ -11,7 +11,6 @@ plugins:
 custom:
     esbuild:
         packager: bun
-        plugins: esbuildWasmPlugin.cjs
     warmup:
         default:
             enabled: true
@@ -27,6 +26,10 @@ provider:
     environment:
         WALLET_SEED: ${env:WALLET_SEED}
 
+package:
+    patterns:
+        - src/didkit_wasm_bg.wasm
+
 functions:
     api:
         handler: lambda.handler

package/src/app.ts

@@ -1,6 +1,6 @@
 import express from 'express';
 import cors from 'cors';
-import { VP, VPValidator } from '@learncard/types';
+import { VCValidator, VPValidator, type UnsignedVC, type VP } from '@learncard/types';
 
 import { TypedRequest } from './types.helpers';
 import {
@@ -19,6 +19,9 @@ const router = express.Router();
 
 const app = express();
 
+const W3C_V1_CREDENTIALS_CONTEXT = 'https://www.w3.org/2018/credentials/v1';
+const W3C_ALT_V1_CREDENTIALS_CONTEXT = 'https://w3.org/2018/credentials/v1';
+
 app.use(cors());
 app.use(express.json());
 
@@ -48,11 +51,6 @@ app.delete('/credentials/:id', async (_req: TypedRequest<{}>, res) => {
 
 app.post('/credentials/issue', async (req: TypedRequest<IssueEndpoint>, res) => {
     try {
-        // If incoming credential doesn't have an issuanceDate, default it to right now
-        if (req.body?.credential && !('issuanceDate' in (req.body?.credential ?? {}))) {
-            req.body.credential.issuanceDate = new Date().toISOString();
-        }
-
         const validationResult = await IssueEndpointValidator.spa(req.body);
 
         if (!validationResult.success) {
@@ -67,13 +65,28 @@ app.post('/credentials/issue', async (req: TypedRequest<IssueEndpoint>, res) =>
         }
 
         const validatedBody = validationResult.data;
+        const credential = validatedBody.credential as UnsignedVC | undefined;
+
+        if (!credential) {
+            return res.status(400).json('Invalid input: credential is required');
+        }
+
+        const context = credential['@context'];
+        const isV1Credential = Array.isArray(context)
+            ? context.some(
+                  contextEntry =>
+                      contextEntry === W3C_V1_CREDENTIALS_CONTEXT ||
+                      contextEntry === W3C_ALT_V1_CREDENTIALS_CONTEXT
+              )
+            : context === W3C_V1_CREDENTIALS_CONTEXT || context === W3C_ALT_V1_CREDENTIALS_CONTEXT;
+        const credentialToIssue =
+            isV1Credential && !('issuanceDate' in credential)
+                ? { ...credential, issuanceDate: new Date().toISOString() }
+                : credential;
         const learnCard = await getLearnCard();
         const { credentialStatus, ...options } = validatedBody.options ?? {};
 
-        const issuedCredential = await learnCard.invoke.issueCredential(
-            validatedBody.credential,
-            options
-        );
+        const issuedCredential = await learnCard.invoke.issueCredential(credentialToIssue, options);
 
         return res.status(201).json(issuedCredential);
     } catch (error) {
@@ -119,11 +132,6 @@ app.post('/credentials/verify', async (req: TypedRequest<VerifyCredentialEndpoin
             return res.status(400).json(verificationResult);
         }
 
-        // Pass a test for interop 🙃
-        verificationResult.checks = verificationResult.checks.filter(
-            check => check !== 'expiration'
-        );
-
         return res.status(200).json(verificationResult);
     } catch (error) {
         console.error('[/credentials/verify] Caught error: ', error, '(received: ', req.body);
@@ -265,7 +273,11 @@ app.post('/exchanges/:uri', async (req: TypedRequest<VP, { challenge?: string }>
 
         const subject = validatedBody.holder;
 
-        const credential = await learnCard.read.get(req.params.uri);
+        const credentialResult = VCValidator.safeParse(await learnCard.read.get(req.params.uri));
+
+        if (!credentialResult.success) return res.status(404).json('Credential not found');
+
+        const credential = credentialResult.data;
 
         credential.issuer = {
             ...(typeof credential.issuer === 'string' ? {} : credential.issuer),
@@ -277,9 +289,10 @@ app.post('/exchanges/:uri', async (req: TypedRequest<VP, { challenge?: string }>
             credential.credentialSubject.id = subject;
         }
 
-        delete credential.proof;
+        const { proof, ...unsignedCredential } = credential;
+        void proof;
 
-        const newVc = await learnCard.invoke.issueCredential(credential);
+        const newVc = await learnCard.invoke.issueCredential(unsignedCredential);
 
         return res.status(201).json(newVc);
     } catch (error) {

package/src/learn-card.ts

@@ -1,13 +1,32 @@
 import fs from 'fs/promises';
+import { existsSync } from 'fs';
+import path from 'path';
 import { initLearnCard, LearnCardFromSeed } from '@learncard/init';
-import didkit from './didkit_wasm_bg.wasm';
+
+const getBundledDidkitPath = (): string => {
+    const siblingPath = path.join(__dirname, 'didkit_wasm_bg.wasm');
+
+    if (existsSync(siblingPath)) return siblingPath;
+
+    return path.join(__dirname, 'src', 'didkit_wasm_bg.wasm');
+};
+
+let learnCardPromise: Promise<LearnCardFromSeed['returnValue']> | undefined;
 
 export const getLearnCard = async (): Promise<LearnCardFromSeed['returnValue']> => {
+    if (learnCardPromise) return learnCardPromise;
+
     const seed = process.env.WALLET_SEED;
 
     if (!seed) {
         throw new Error('No seed set! Please make a .env file and set WALLET_SEED to your seed!');
     }
 
-    return initLearnCard({ seed, didkit });
+    const didkit = process.env.LOCAL_DIDKIT_PATH
+        ? fs.readFile(process.env.LOCAL_DIDKIT_PATH)
+        : fs.readFile(getBundledDidkitPath());
+
+    learnCardPromise = initLearnCard({ seed, didkit });
+
+    return learnCardPromise;
 };

package/src/server.ts

@@ -0,0 +1,10 @@
+import app from './app';
+
+const port = Number(process.env.PORT ?? 3100);
+
+const server = app.listen(port, '127.0.0.1', () => {
+    console.log(`LearnCard VC API listening at http://127.0.0.1:${port}`);
+});
+
+process.on('SIGTERM', () => server.close());
+process.on('SIGINT', () => server.close());

package/src/validators.ts

@@ -1,4 +1,4 @@
-import { z } from 'zod';
+import { z } from 'zod/v4';
 import {
     UnsignedVCValidator,
     UnsignedVPValidator,
@@ -6,28 +6,42 @@ import {
     VPValidator,
 } from '@learncard/types';
 
+const ProofOptionsValidator = z
+    .object({
+        type: z.string().optional(),
+        verificationMethod: z.string().optional(),
+        proofPurpose: z.string().optional(),
+        proofFormat: z.string().optional(),
+        created: z.string().optional(),
+        challenge: z.string().optional(),
+        domain: z.string().optional(),
+        cryptosuite: z
+            .enum([
+                'eddsa-rdfc-2022',
+                'eddsa-2022',
+                'json-eddsa-2022',
+                'ecdsa-2019',
+                'jcs-ecdsa-2019',
+            ])
+            .optional(),
+    })
+    .strict();
+
+const VerificationProofOptionsValidator = ProofOptionsValidator.extend({
+    checks: z.enum(['proof', 'JWS', 'credentialStatus', 'credentialSchema']).array().optional(),
+});
+
 export const IssueEndpointValidator = z.object({
     credential: UnsignedVCValidator,
-    options: z
-        .object({
-            created: z.string().optional(),
-            challenge: z.string().optional(),
-            domain: z.string().optional(),
-            credentialStatus: z.object({ type: z.string() }).optional(),
-        })
-        .optional(),
+    options: ProofOptionsValidator.extend({
+        credentialStatus: z.object({ type: z.string() }).optional(),
+    }).optional(),
 });
 export type IssueEndpoint = z.infer<typeof IssueEndpointValidator>;
 
 export const IssuePresentationEndpointValidator = z.object({
     presentation: UnsignedVPValidator,
-    options: z
-        .object({
-            created: z.string().optional(),
-            challenge: z.string().optional(),
-            domain: z.string().optional(),
-        })
-        .optional(),
+    options: ProofOptionsValidator.optional(),
 });
 export type IssuePresentationEndpoint = z.infer<typeof IssuePresentationEndpointValidator>;
 
@@ -42,18 +56,14 @@ export type UpdateStatusEndpoint = z.infer<typeof UpdateStatusEndpointValidator>
 
 export const VerifyCredentialEndpointValidator = z.object({
     verifiableCredential: VCValidator,
-    options: z
-        .object({ challenge: z.string().optional(), domain: z.string().optional() })
-        .optional(),
+    options: VerificationProofOptionsValidator.optional(),
 });
 export type VerifyCredentialEndpoint = z.infer<typeof VerifyCredentialEndpointValidator>;
 
 export const VerifyPresentationEndpointValidator = z
     .object({
         verifiablePresentation: VPValidator,
-        options: z
-            .object({ challenge: z.string().optional(), domain: z.string().optional() })
-            .optional(),
+        options: VerificationProofOptionsValidator.optional(),
     })
     .or(z.object({ presentation: UnsignedVPValidator }));
 export type VerifyPresentationEndpoint = z.infer<typeof VerifyPresentationEndpointValidator>;

package/w3c-localConfig.cjs

@@ -0,0 +1,35 @@
+const baseUrl = process.env.BASE_URL || 'http://127.0.0.1:3100';
+
+module.exports = {
+    settings: {
+        enableInteropTests: false,
+        testAllImplementations: false,
+    },
+    implementations: [
+        {
+            name: 'Learning Economy Foundation',
+            implementation: 'LearnCard DIDKit',
+            issuers: [
+                {
+                    id: 'did:key:z6Mkv1o2GEgtXjFdEMfLtupcKhGRydM8V7VHzii7Uh4aHoqH',
+                    endpoint: `${baseUrl}/credentials/issue`,
+                    options: {
+                        type: 'DataIntegrityProof',
+                        cryptosuite: 'eddsa-rdfc-2022',
+                    },
+                    supports: {
+                        vc: ['1.1', '2.0'],
+                    },
+                    tags: ['eddsa-rdfc-2022', 'localhost'],
+                },
+            ],
+            verifiers: [
+                {
+                    id: 'did:key:z6Mkv1o2GEgtXjFdEMfLtupcKhGRydM8V7VHzii7Uh4aHoqH',
+                    endpoint: `${baseUrl}/credentials/verify`,
+                    tags: ['eddsa-rdfc-2022', 'localhost'],
+                },
+            ],
+        },
+    ],
+};

package/esbuildWasmPlugin.cjs

@@ -1,31 +0,0 @@
-const wasmPlugin = {
-    name: 'wasm',
-    setup(build) {
-        let path = require('path');
-        let fs = require('fs');
-
-        // Resolve ".wasm" files to a path with a namespace
-        build.onResolve({ filter: /\.wasm$/ }, args => {
-            if (args.resolveDir === '') {
-                return; // Ignore unresolvable paths
-            }
-            return {
-                path: path.isAbsolute(args.path)
-                    ? args.path
-                    : path.join(args.resolveDir, args.path),
-                namespace: 'wasm-binary',
-            };
-        });
-
-        // Virtual modules in the "wasm-binary" namespace contain the
-        // actual bytes of the WebAssembly file. This uses esbuild's
-        // built-in "binary" loader instead of manually embedding the
-        // binary data inside JavaScript code ourselves.
-        build.onLoad({ filter: /.*/, namespace: 'wasm-binary' }, async args => ({
-            contents: await fs.promises.readFile(args.path),
-            loader: 'binary',
-        }));
-    },
-};
-
-module.exports = [wasmPlugin];