@learncard/open-badge-v2-plugin 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Learning Economy Foundation <sdk@learningeconomy.io>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,141 @@
+# @learncard/open-badge-v2-plugin
+
+Wrap legacy Open Badges v2.0 (OBv2) assertions into self‑issued W3C Verifiable Credentials (VCs) so they can be stored, indexed, and used within the LearnCard ecosystem.
+
+- Name: `OpenBadgeV2`
+- Method: `wrapOpenBadgeV2(obv2Assertion: object | string): Promise<VC>`
+- Context added: `https://ctx.learncard.com/wrappers/obv2/1.0.0.json`
+- VC type produced: `LegacyOpenBadgeCredential`
+
+## Why this plugin?
+
+Many issuers still publish Open Badges v2.0 assertions (JSON), not VCs. This plugin provides a backwards‑compatibility bridge by wrapping the raw OBv2 assertion inside a signed VC you control, preserving the original badge payload under `legacyAssertion`.
+
+This enables:
+- Use of legacy badges anywhere a VC is expected (storage, indexing, sharing).
+- A stable LearnCard vocabulary for the wrapper (`LegacyOpenBadgeCredential`).
+- Consistent DID‑based signing and verification workflows.
+
+## What it produces
+
+A signed VC with these characteristics:
+- `@context`: `["https://www.w3.org/ns/credentials/v2", "https://ctx.learncard.com/wrappers/obv2/1.0.0.json"]`
+- `type`: `["VerifiableCredential", "LegacyOpenBadgeCredential"]`
+- `issuer`: your LearnCard DID
+- `validFrom`: `new Date().toISOString()`
+- `credentialSubject.id`: your LearnCard DID
+- `legacyAssertion`: the original OBv2 assertion JSON
+
+Notes:
+- The wrapper signs the fact that “you attest to this legacy assertion,” not that you were the original OBv2 issuer.
+- Minimal OBv2 validation is performed: `id` (string), `type` includes `"Assertion"`, `issuedOn` (string).
+
+## Requirements
+
+- A LearnCard instance with the VC plugin installed (used to sign the VC).
+- Fetch available for remote inputs (Node 18+ or a polyfill like `undici`).
+
+## Installation
+
+This package is part of the monorepo. In external usage, install from npm (when published) and ensure peer packages are available.
+
+```bash
+# inside the monorepo
+pnpm nx run open-badge-v2-plugin:build
+```
+
+## Usage
+
+Below examples assume you already have a `learnCard` instance and you add both the VC plugin and this plugin.
+
+```ts
+import { getVCPlugin } from '@learncard/vc-plugin';
+import { openBadgeV2Plugin } from '@learncard/open-badge-v2-plugin';
+
+// Ensure VC plugin is installed first (required for signing)
+await learnCard.addPlugin(getVCPlugin(learnCard));
+
+// Install the OpenBadge v2 wrapper plugin
+await learnCard.addPlugin(openBadgeV2Plugin(learnCard));
+```
+
+### 1) Wrap from a remote HTTP(S) URL
+
+```ts
+const url = 'https://example.org/badges/assertions/123.json';
+const vc = await learnCard.invoke.wrapOpenBadgeV2(url);
+
+// Optional: verify the signed VC
+const verification = await learnCard.invoke.verifyCredential(vc);
+```
+
+### 2) Wrap from IPFS
+
+```ts
+const ipfsUrl = 'ipfs://bafybeigdyr...';
+const vc = await learnCard.invoke.wrapOpenBadgeV2(ipfsUrl);
+```
+
+### 3) Wrap from a raw OBv2 object
+
+```ts
+const obv2 = {
+  '@context': 'https://w3id.org/openbadges/v2',
+  type: 'Assertion',
+  id: 'https://issuer.example.org/assertions/abc',
+  issuedOn: '2024-05-02T12:34:56Z',
+  recipient: { type: 'email', identity: 'user@example.org', hashed: false },
+  badge: 'https://issuer.example.org/badges/my-badge'
+  // ... any other OBv2 fields ...
+};
+
+const vc = await learnCard.invoke.wrapOpenBadgeV2(obv2);
+```
+
+### 4) Wrap from a JSON string
+
+```ts
+const obv2String = JSON.stringify(obv2);
+const vc = await learnCard.invoke.wrapOpenBadgeV2(obv2String);
+```
+
+## API
+
+```ts
+wrapOpenBadgeV2(obv2Assertion: object | string): Promise<VC>
+```
+
+- `obv2Assertion` may be:
+  - A raw OBv2 assertion object
+  - A URL string (http(s)://, ipfs://, ipns://) pointing to the assertion JSON
+  - A JSON string containing the assertion
+
+Validation rules enforced:
+- `assertion.id` must be a non‑empty string
+- `assertion.type` must include `"Assertion"`
+- `assertion.issuedOn` must be a string
+
+## JSON‑LD Context
+
+The wrapper vocabulary is published at:
+
+- `https://ctx.learncard.com/wrappers/obv2/1.0.0.json`
+
+It defines:
+- `LegacyOpenBadgeCredential`
+- `legacyAssertion` as `@type: @json` for embedding raw OBv2 JSON
+
+## Development
+
+- Build: `pnpm nx run open-badge-v2-plugin:build`
+- Source: `packages/plugins/open-badge-v2/src/`
+- Context file: `packages/learn-card-contexts/wrappers/obv2/1.0.0.json`
+
+## Caveats
+
+- Wrapping does not retroactively convert OBv2 into a first‑party VC issued by the original badge issuer; it produces a VC signed by your DID that embeds the legacy assertion.
+- Always fetch and wrap assertions from trusted sources.
+
+## License
+
+MIT

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { openBadgeV2Plugin } from './plugin';
+export * from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,cAAc,SAAS,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+'use strict';
+
+if (process.env.NODE_ENV === 'production') {
+    module.exports = require('./open-badge-v2-plugin.cjs.production.min.js');
+} else {
+    module.exports = require('./open-badge-v2-plugin.cjs.development.js');
+}

package/dist/open-badge-v2-plugin.cjs.development.js

@@ -0,0 +1,142 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  OBV2_WRAPPER_CONTEXT_URL: () => OBV2_WRAPPER_CONTEXT_URL,
+  openBadgeV2Plugin: () => openBadgeV2Plugin
+});
+module.exports = __toCommonJS(src_exports);
+
+// src/types.ts
+var OBV2_WRAPPER_CONTEXT_URL = "https://ctx.learncard.com/wrappers/obv2/1.0.0.json";
+
+// src/plugin.ts
+var VC_V2_CONTEXT = "https://www.w3.org/ns/credentials/v2";
+var isUrl = /* @__PURE__ */ __name((value) => /^(https?:)?\/\//i.test(value) || value.startsWith("ipfs://") || value.startsWith("ipns://"), "isUrl");
+var isValidAndSafeUrl = /* @__PURE__ */ __name((url) => {
+  try {
+    const parsedUrl = new URL(url);
+    const allowedProtocols = ["https:", "http:", "ipfs:", "ipns:"];
+    if (!allowedProtocols.includes(parsedUrl.protocol)) {
+      throw new Error(
+        `wrapOpenBadgeV2: Protocol '${parsedUrl.protocol}' is not allowed. Only HTTP(S), IPFS, and IPNS are supported`
+      );
+    }
+    if (parsedUrl.protocol === "ipfs:" || parsedUrl.protocol === "ipns:") {
+      return;
+    }
+    const hostname = parsedUrl.hostname.toLowerCase();
+    if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "0.0.0.0" || hostname === "::1") {
+      throw new Error("wrapOpenBadgeV2: Access to localhost is not allowed");
+    }
+    if (hostname.startsWith("10.") || hostname.startsWith("192.168.") || hostname.startsWith("172.") && /^172\.(1[6-9]|2[0-9]|3[0-1])\./.test(hostname)) {
+      throw new Error("wrapOpenBadgeV2: Access to private IP ranges is not allowed");
+    }
+    if (hostname.startsWith("169.254.")) {
+      throw new Error("wrapOpenBadgeV2: Access to link-local addresses is not allowed");
+    }
+  } catch (error) {
+    if (error instanceof TypeError) {
+      throw new Error("wrapOpenBadgeV2: Invalid URL format");
+    }
+    throw error;
+  }
+}, "isValidAndSafeUrl");
+async function getObv2Assertion(input) {
+  if (typeof input === "string") {
+    const trimmed = input.trim();
+    if (!isUrl(trimmed) && (trimmed.startsWith("{") || trimmed.startsWith("["))) {
+      try {
+        return JSON.parse(trimmed);
+      } catch (e) {
+        throw new Error("wrapOpenBadgeV2: Provided string is not a valid URL or JSON");
+      }
+    }
+    isValidAndSafeUrl(trimmed);
+    try {
+      const controller = new AbortController();
+      const timeoutId = setTimeout(() => controller.abort(), 1e4);
+      const res = await fetch(trimmed, {
+        signal: controller.signal
+      });
+      clearTimeout(timeoutId);
+      if (!res.ok)
+        throw new Error(`wrapOpenBadgeV2: Failed to fetch OBv2 assertion: ${res.status}`);
+      return await res.json();
+    } catch (error) {
+      if (error instanceof TypeError) {
+        throw new Error(
+          `wrapOpenBadgeV2: Network error while fetching OBv2 assertion: ${error.message}`
+        );
+      }
+      if (error?.name === "AbortError") {
+        throw new Error("wrapOpenBadgeV2: Request timed out after 10 seconds");
+      }
+      throw error;
+    }
+  }
+  if (typeof input !== "object" || input === null) {
+    throw new Error("wrapOpenBadgeV2: Input must be a valid object");
+  }
+  return input;
+}
+__name(getObv2Assertion, "getObv2Assertion");
+function validateObv2(obv2) {
+  if (!obv2 || typeof obv2 !== "object")
+    throw new Error("wrapOpenBadgeV2: Missing assertion");
+  const id = obv2.id;
+  if (typeof id !== "string" || !id.length)
+    throw new Error("wrapOpenBadgeV2: assertion.id is required");
+  const t = obv2.type;
+  const hasAssertionType = typeof t === "string" && t === "Assertion" || Array.isArray(t) && t.includes("Assertion");
+  if (!hasAssertionType)
+    throw new Error("wrapOpenBadgeV2: assertion.type must include 'Assertion'");
+  if (!obv2.issuedOn || typeof obv2.issuedOn !== "string") {
+    throw new Error("wrapOpenBadgeV2: assertion.issuedOn (string) is required");
+  }
+}
+__name(validateObv2, "validateObv2");
+var openBadgeV2Plugin = /* @__PURE__ */ __name((learnCard) => ({
+  name: "OpenBadgeV2",
+  displayName: "OpenBadge v2 Wrapper",
+  description: "Wrap legacy OpenBadge v2.0 assertions into self-issued Verifiable Credentials",
+  methods: {
+    wrapOpenBadgeV2: async (_learnCard, obv2Assertion) => {
+      const issuerDid = learnCard.id.did();
+      const obv2 = await getObv2Assertion(obv2Assertion);
+      validateObv2(obv2);
+      const unsigned = {
+        "@context": [VC_V2_CONTEXT, OBV2_WRAPPER_CONTEXT_URL],
+        id: `urn:uuid:${_learnCard.invoke.crypto().randomUUID()}`,
+        type: ["VerifiableCredential", "LegacyOpenBadgeCredential"],
+        issuer: issuerDid,
+        validFrom: new Date().toISOString(),
+        credentialSubject: {
+          id: issuerDid
+        },
+        legacyAssertion: obv2
+      };
+      return learnCard.invoke.issueCredential(unsigned, { proofPurpose: "assertionMethod" });
+    }
+  }
+}), "openBadgeV2Plugin");
+//# sourceMappingURL=open-badge-v2-plugin.cjs.development.js.map

package/dist/open-badge-v2-plugin.cjs.development.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/index.ts", "../src/types.ts", "../src/plugin.ts"],
+  "sourcesContent": ["export { openBadgeV2Plugin } from './plugin';\nexport * from './types';\n", "import { Plugin } from '@learncard/core';\nimport { VC } from '@learncard/types';\nimport { VCPluginMethods } from '@learncard/vc-plugin';\nimport { CryptoPluginMethods } from '@learncard/crypto-plugin';\n\nexport type OpenBadgeV2PluginDependentMethods = VCPluginMethods & CryptoPluginMethods;\n\nexport type OpenBadgeV2PluginMethods = {\n    /**\n     * Wrap a legacy OpenBadge v2.0 assertion (object or URL) into a self-issued VC\n     */\n    wrapOpenBadgeV2: (obv2Assertion: object | string) => Promise<VC>;\n};\n\nexport type OpenBadgeV2Plugin = Plugin<\n    'OpenBadgeV2',\n    any,\n    OpenBadgeV2PluginMethods,\n    'id',\n    OpenBadgeV2PluginDependentMethods\n>;\n\nexport const OBV2_WRAPPER_CONTEXT_URL = 'https://ctx.learncard.com/wrappers/obv2/1.0.0.json';\n", "import { LearnCard } from '@learncard/core';\nimport { UnsignedVC, VC } from '@learncard/types';\n\nimport {\n    OpenBadgeV2Plugin,\n    OBV2_WRAPPER_CONTEXT_URL,\n    OpenBadgeV2PluginDependentMethods,\n} from './types';\n\nconst VC_V2_CONTEXT = 'https://www.w3.org/ns/credentials/v2';\n\nconst isUrl = (value: string): boolean =>\n    /^(https?:)?\\/\\//i.test(value) || value.startsWith('ipfs://') || value.startsWith('ipns://');\n\nconst isValidAndSafeUrl = (url: string): void => {\n    try {\n        const parsedUrl = new URL(url);\n\n        // Only allow http, https, ipfs, ipns protocols\n        const allowedProtocols = ['https:', 'http:', 'ipfs:', 'ipns:'];\n        if (!allowedProtocols.includes(parsedUrl.protocol)) {\n            throw new Error(\n                `wrapOpenBadgeV2: Protocol '${parsedUrl.protocol}' is not allowed. Only HTTP(S), IPFS, and IPNS are supported`\n            );\n        }\n\n        // Skip internal network checks for IPFS/IPNS as they don't use traditional IP addresses\n        if (parsedUrl.protocol === 'ipfs:' || parsedUrl.protocol === 'ipns:') {\n            return;\n        }\n\n        // Block localhost and internal networks for HTTP(S)\n        const hostname = parsedUrl.hostname.toLowerCase();\n\n        // Block localhost variations\n        if (\n            hostname === 'localhost' ||\n            hostname === '127.0.0.1' ||\n            hostname === '0.0.0.0' ||\n            hostname === '::1'\n        ) {\n            throw new Error('wrapOpenBadgeV2: Access to localhost is not allowed');\n        }\n\n        // Block private IP ranges (RFC 1918)\n        if (\n            hostname.startsWith('10.') ||\n            hostname.startsWith('192.168.') ||\n            (hostname.startsWith('172.') && /^172\\.(1[6-9]|2[0-9]|3[0-1])\\./.test(hostname))\n        ) {\n            throw new Error('wrapOpenBadgeV2: Access to private IP ranges is not allowed');\n        }\n\n        // Block link-local addresses\n        if (hostname.startsWith('169.254.')) {\n            throw new Error('wrapOpenBadgeV2: Access to link-local addresses is not allowed');\n        }\n    } catch (error) {\n        if (error instanceof TypeError) {\n            throw new Error('wrapOpenBadgeV2: Invalid URL format');\n        }\n        throw error;\n    }\n};\n\nasync function getObv2Assertion(input: object | string): Promise<Record<string, any>> {\n    if (typeof input === 'string') {\n        // Treat string as URL. If it looks like raw JSON, try to parse for developer ergonomics\n        const trimmed = input.trim();\n        if (!isUrl(trimmed) && (trimmed.startsWith('{') || trimmed.startsWith('['))) {\n            try {\n                return JSON.parse(trimmed);\n            } catch (e) {\n                throw new Error('wrapOpenBadgeV2: Provided string is not a valid URL or JSON');\n            }\n        }\n\n        // Validate URL for security\n        isValidAndSafeUrl(trimmed);\n\n        try {\n            // Add timeout to prevent hanging requests (10 seconds)\n            const controller = new AbortController();\n            const timeoutId = setTimeout(() => controller.abort(), 10000);\n\n            const res = await fetch(trimmed, {\n                signal: controller.signal,\n            });\n\n            clearTimeout(timeoutId);\n\n            if (!res.ok)\n                throw new Error(`wrapOpenBadgeV2: Failed to fetch OBv2 assertion: ${res.status}`);\n\n            return await res.json();\n        } catch (error: any) {\n            if (error instanceof TypeError) {\n                throw new Error(\n                    `wrapOpenBadgeV2: Network error while fetching OBv2 assertion: ${error.message}`\n                );\n            }\n            if (error?.name === 'AbortError') {\n                throw new Error('wrapOpenBadgeV2: Request timed out after 10 seconds');\n            }\n            throw error;\n        }\n    }\n\n    // Add basic type validation before assertion\n    if (typeof input !== 'object' || input === null) {\n        throw new Error('wrapOpenBadgeV2: Input must be a valid object');\n    }\n\n    return input as Record<string, any>;\n}\n\nfunction validateObv2(obv2: Record<string, any>): void {\n    if (!obv2 || typeof obv2 !== 'object') throw new Error('wrapOpenBadgeV2: Missing assertion');\n\n    const id = obv2.id;\n    if (typeof id !== 'string' || !id.length)\n        throw new Error('wrapOpenBadgeV2: assertion.id is required');\n\n    const t = obv2.type;\n    const hasAssertionType =\n        (typeof t === 'string' && t === 'Assertion') ||\n        (Array.isArray(t) && t.includes('Assertion'));\n    if (!hasAssertionType)\n        throw new Error(\"wrapOpenBadgeV2: assertion.type must include 'Assertion'\");\n\n    if (!obv2.issuedOn || typeof obv2.issuedOn !== 'string') {\n        throw new Error('wrapOpenBadgeV2: assertion.issuedOn (string) is required');\n    }\n}\n\nexport const openBadgeV2Plugin = (\n    learnCard: LearnCard<any, 'id', OpenBadgeV2PluginDependentMethods>\n): OpenBadgeV2Plugin => ({\n    name: 'OpenBadgeV2',\n    displayName: 'OpenBadge v2 Wrapper',\n    description: 'Wrap legacy OpenBadge v2.0 assertions into self-issued Verifiable Credentials',\n    methods: {\n        wrapOpenBadgeV2: async (_learnCard, obv2Assertion: object | string): Promise<VC> => {\n            const issuerDid = learnCard.id.did();\n\n            const obv2 = await getObv2Assertion(obv2Assertion);\n            validateObv2(obv2);\n\n            const unsigned: UnsignedVC = {\n                '@context': [VC_V2_CONTEXT, OBV2_WRAPPER_CONTEXT_URL],\n                id: `urn:uuid:${_learnCard.invoke.crypto().randomUUID()}`,\n                type: ['VerifiableCredential', 'LegacyOpenBadgeCredential'],\n                issuer: issuerDid,\n                validFrom: new Date().toISOString(),\n                credentialSubject: {\n                    id: issuerDid,\n                },\n                legacyAssertion: obv2,\n            };\n\n            return learnCard.invoke.issueCredential(unsigned, { proofPurpose: 'assertionMethod' });\n        },\n    },\n});\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACsBO,IAAM,2BAA2B;;;ACbxC,IAAM,gBAAgB;AAEtB,IAAM,QAAQ,wBAAC,UACX,mBAAmB,KAAK,KAAK,KAAK,MAAM,WAAW,SAAS,KAAK,MAAM,WAAW,SAAS,GADjF;AAGd,IAAM,oBAAoB,wBAAC,QAAsB;AAC7C,MAAI;AACA,UAAM,YAAY,IAAI,IAAI,GAAG;AAG7B,UAAM,mBAAmB,CAAC,UAAU,SAAS,SAAS,OAAO;AAC7D,QAAI,CAAC,iBAAiB,SAAS,UAAU,QAAQ,GAAG;AAChD,YAAM,IAAI;AAAA,QACN,8BAA8B,UAAU;AAAA,MAC5C;AAAA,IACJ;AAGA,QAAI,UAAU,aAAa,WAAW,UAAU,aAAa,SAAS;AAClE;AAAA,IACJ;AAGA,UAAM,WAAW,UAAU,SAAS,YAAY;AAGhD,QACI,aAAa,eACb,aAAa,eACb,aAAa,aACb,aAAa,OACf;AACE,YAAM,IAAI,MAAM,qDAAqD;AAAA,IACzE;AAGA,QACI,SAAS,WAAW,KAAK,KACzB,SAAS,WAAW,UAAU,KAC7B,SAAS,WAAW,MAAM,KAAK,iCAAiC,KAAK,QAAQ,GAChF;AACE,YAAM,IAAI,MAAM,6DAA6D;AAAA,IACjF;AAGA,QAAI,SAAS,WAAW,UAAU,GAAG;AACjC,YAAM,IAAI,MAAM,gEAAgE;AAAA,IACpF;AAAA,EACJ,SAAS,OAAP;AACE,QAAI,iBAAiB,WAAW;AAC5B,YAAM,IAAI,MAAM,qCAAqC;AAAA,IACzD;AACA,UAAM;AAAA,EACV;AACJ,GAjD0B;AAmD1B,eAAe,iBAAiB,OAAsD;AAClF,MAAI,OAAO,UAAU,UAAU;AAE3B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,MAAM,OAAO,MAAM,QAAQ,WAAW,GAAG,KAAK,QAAQ,WAAW,GAAG,IAAI;AACzE,UAAI;AACA,eAAO,KAAK,MAAM,OAAO;AAAA,MAC7B,SAAS,GAAP;AACE,cAAM,IAAI,MAAM,6DAA6D;AAAA,MACjF;AAAA,IACJ;AAGA,sBAAkB,OAAO;AAEzB,QAAI;AAEA,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,YAAY,WAAW,MAAM,WAAW,MAAM,GAAG,GAAK;AAE5D,YAAM,MAAM,MAAM,MAAM,SAAS;AAAA,QAC7B,QAAQ,WAAW;AAAA,MACvB,CAAC;AAED,mBAAa,SAAS;AAEtB,UAAI,CAAC,IAAI;AACL,cAAM,IAAI,MAAM,oDAAoD,IAAI,QAAQ;AAEpF,aAAO,MAAM,IAAI,KAAK;AAAA,IAC1B,SAAS,OAAP;AACE,UAAI,iBAAiB,WAAW;AAC5B,cAAM,IAAI;AAAA,UACN,iEAAiE,MAAM;AAAA,QAC3E;AAAA,MACJ;AACA,UAAI,OAAO,SAAS,cAAc;AAC9B,cAAM,IAAI,MAAM,qDAAqD;AAAA,MACzE;AACA,YAAM;AAAA,IACV;AAAA,EACJ;AAGA,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC7C,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACnE;AAEA,SAAO;AACX;AAjDe;AAmDf,SAAS,aAAa,MAAiC;AACnD,MAAI,CAAC,QAAQ,OAAO,SAAS;AAAU,UAAM,IAAI,MAAM,oCAAoC;AAE3F,QAAM,KAAK,KAAK;AAChB,MAAI,OAAO,OAAO,YAAY,CAAC,GAAG;AAC9B,UAAM,IAAI,MAAM,2CAA2C;AAE/D,QAAM,IAAI,KAAK;AACf,QAAM,mBACD,OAAO,MAAM,YAAY,MAAM,eAC/B,MAAM,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW;AAC/C,MAAI,CAAC;AACD,UAAM,IAAI,MAAM,0DAA0D;AAE9E,MAAI,CAAC,KAAK,YAAY,OAAO,KAAK,aAAa,UAAU;AACrD,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC9E;AACJ;AAjBS;AAmBF,IAAM,oBAAoB,wBAC7B,eACqB;AAAA,EACrB,MAAM;AAAA,EACN,aAAa;AAAA,EACb,aAAa;AAAA,EACb,SAAS;AAAA,IACL,iBAAiB,OAAO,YAAY,kBAAgD;AAChF,YAAM,YAAY,UAAU,GAAG,IAAI;AAEnC,YAAM,OAAO,MAAM,iBAAiB,aAAa;AACjD,mBAAa,IAAI;AAEjB,YAAM,WAAuB;AAAA,QACzB,YAAY,CAAC,eAAe,wBAAwB;AAAA,QACpD,IAAI,YAAY,WAAW,OAAO,OAAO,EAAE,WAAW;AAAA,QACtD,MAAM,CAAC,wBAAwB,2BAA2B;AAAA,QAC1D,QAAQ;AAAA,QACR,WAAW,IAAI,KAAK,EAAE,YAAY;AAAA,QAClC,mBAAmB;AAAA,UACf,IAAI;AAAA,QACR;AAAA,QACA,iBAAiB;AAAA,MACrB;AAEA,aAAO,UAAU,OAAO,gBAAgB,UAAU,EAAE,cAAc,kBAAkB,CAAC;AAAA,IACzF;AAAA,EACJ;AACJ,IA5BiC;",
+  "names": []
+}

package/dist/open-badge-v2-plugin.cjs.production.min.js

@@ -0,0 +1,2 @@
+"use strict";var i=Object.defineProperty;var g=Object.getOwnPropertyDescriptor;var l=Object.getOwnPropertyNames;var c=Object.prototype.hasOwnProperty;var s=(r,e)=>i(r,"name",{value:e,configurable:!0});var w=(r,e)=>{for(var t in e)i(r,t,{get:e[t],enumerable:!0})},h=(r,e,t,o)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of l(e))!c.call(r,n)&&n!==t&&i(r,n,{get:()=>e[n],enumerable:!(o=g(e,n))||o.enumerable});return r};var f=r=>h(i({},"__esModule",{value:!0}),r);var B={};w(B,{OBV2_WRAPPER_CONTEXT_URL:()=>a,openBadgeV2Plugin:()=>d});module.exports=f(B);var a="https://ctx.learncard.com/wrappers/obv2/1.0.0.json";var u="https://www.w3.org/ns/credentials/v2",O=s(r=>/^(https?:)?\/\//i.test(r)||r.startsWith("ipfs://")||r.startsWith("ipns://"),"isUrl"),V=s(r=>{try{let e=new URL(r);if(!["https:","http:","ipfs:","ipns:"].includes(e.protocol))throw new Error(`wrapOpenBadgeV2: Protocol '${e.protocol}' is not allowed. Only HTTP(S), IPFS, and IPNS are supported`);if(e.protocol==="ipfs:"||e.protocol==="ipns:")return;let o=e.hostname.toLowerCase();if(o==="localhost"||o==="127.0.0.1"||o==="0.0.0.0"||o==="::1")throw new Error("wrapOpenBadgeV2: Access to localhost is not allowed");if(o.startsWith("10.")||o.startsWith("192.168.")||o.startsWith("172.")&&/^172\.(1[6-9]|2[0-9]|3[0-1])\./.test(o))throw new Error("wrapOpenBadgeV2: Access to private IP ranges is not allowed");if(o.startsWith("169.254."))throw new Error("wrapOpenBadgeV2: Access to link-local addresses is not allowed")}catch(e){throw e instanceof TypeError?new Error("wrapOpenBadgeV2: Invalid URL format"):e}},"isValidAndSafeUrl");async function m(r){if(typeof r=="string"){let e=r.trim();if(!O(e)&&(e.startsWith("{")||e.startsWith("[")))try{return JSON.parse(e)}catch{throw new Error("wrapOpenBadgeV2: Provided string is not a valid URL or JSON")}V(e);try{let t=new AbortController,o=setTimeout(()=>t.abort(),1e4),n=await fetch(e,{signal:t.signal});if(clearTimeout(o),!n.ok)throw new Error(`wrapOpenBadgeV2: Failed to fetch OBv2 assertion: ${n.status}`);return await n.json()}catch(t){throw t instanceof TypeError?new Error(`wrapOpenBadgeV2: Network error while fetching OBv2 assertion: ${t.message}`):t?.name==="AbortError"?new Error("wrapOpenBadgeV2: Request timed out after 10 seconds"):t}}if(typeof r!="object"||r===null)throw new Error("wrapOpenBadgeV2: Input must be a valid object");return r}s(m,"getObv2Assertion");function y(r){if(!r||typeof r!="object")throw new Error("wrapOpenBadgeV2: Missing assertion");let e=r.id;if(typeof e!="string"||!e.length)throw new Error("wrapOpenBadgeV2: assertion.id is required");let t=r.type;if(!(typeof t=="string"&&t==="Assertion"||Array.isArray(t)&&t.includes("Assertion")))throw new Error("wrapOpenBadgeV2: assertion.type must include 'Assertion'");if(!r.issuedOn||typeof r.issuedOn!="string")throw new Error("wrapOpenBadgeV2: assertion.issuedOn (string) is required")}s(y,"validateObv2");var d=s(r=>({name:"OpenBadgeV2",displayName:"OpenBadge v2 Wrapper",description:"Wrap legacy OpenBadge v2.0 assertions into self-issued Verifiable Credentials",methods:{wrapOpenBadgeV2:async(e,t)=>{let o=r.id.did(),n=await m(t);y(n);let p={"@context":[u,a],id:`urn:uuid:${e.invoke.crypto().randomUUID()}`,type:["VerifiableCredential","LegacyOpenBadgeCredential"],issuer:o,validFrom:new Date().toISOString(),credentialSubject:{id:o},legacyAssertion:n};return r.invoke.issueCredential(p,{proofPurpose:"assertionMethod"})}}}),"openBadgeV2Plugin");
+//# sourceMappingURL=open-badge-v2-plugin.cjs.production.min.js.map

package/dist/open-badge-v2-plugin.cjs.production.min.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/index.ts", "../src/types.ts", "../src/plugin.ts"],
+  "sourcesContent": ["export { openBadgeV2Plugin } from './plugin';\nexport * from './types';\n", "import { Plugin } from '@learncard/core';\nimport { VC } from '@learncard/types';\nimport { VCPluginMethods } from '@learncard/vc-plugin';\nimport { CryptoPluginMethods } from '@learncard/crypto-plugin';\n\nexport type OpenBadgeV2PluginDependentMethods = VCPluginMethods & CryptoPluginMethods;\n\nexport type OpenBadgeV2PluginMethods = {\n    /**\n     * Wrap a legacy OpenBadge v2.0 assertion (object or URL) into a self-issued VC\n     */\n    wrapOpenBadgeV2: (obv2Assertion: object | string) => Promise<VC>;\n};\n\nexport type OpenBadgeV2Plugin = Plugin<\n    'OpenBadgeV2',\n    any,\n    OpenBadgeV2PluginMethods,\n    'id',\n    OpenBadgeV2PluginDependentMethods\n>;\n\nexport const OBV2_WRAPPER_CONTEXT_URL = 'https://ctx.learncard.com/wrappers/obv2/1.0.0.json';\n", "import { LearnCard } from '@learncard/core';\nimport { UnsignedVC, VC } from '@learncard/types';\n\nimport {\n    OpenBadgeV2Plugin,\n    OBV2_WRAPPER_CONTEXT_URL,\n    OpenBadgeV2PluginDependentMethods,\n} from './types';\n\nconst VC_V2_CONTEXT = 'https://www.w3.org/ns/credentials/v2';\n\nconst isUrl = (value: string): boolean =>\n    /^(https?:)?\\/\\//i.test(value) || value.startsWith('ipfs://') || value.startsWith('ipns://');\n\nconst isValidAndSafeUrl = (url: string): void => {\n    try {\n        const parsedUrl = new URL(url);\n\n        // Only allow http, https, ipfs, ipns protocols\n        const allowedProtocols = ['https:', 'http:', 'ipfs:', 'ipns:'];\n        if (!allowedProtocols.includes(parsedUrl.protocol)) {\n            throw new Error(\n                `wrapOpenBadgeV2: Protocol '${parsedUrl.protocol}' is not allowed. Only HTTP(S), IPFS, and IPNS are supported`\n            );\n        }\n\n        // Skip internal network checks for IPFS/IPNS as they don't use traditional IP addresses\n        if (parsedUrl.protocol === 'ipfs:' || parsedUrl.protocol === 'ipns:') {\n            return;\n        }\n\n        // Block localhost and internal networks for HTTP(S)\n        const hostname = parsedUrl.hostname.toLowerCase();\n\n        // Block localhost variations\n        if (\n            hostname === 'localhost' ||\n            hostname === '127.0.0.1' ||\n            hostname === '0.0.0.0' ||\n            hostname === '::1'\n        ) {\n            throw new Error('wrapOpenBadgeV2: Access to localhost is not allowed');\n        }\n\n        // Block private IP ranges (RFC 1918)\n        if (\n            hostname.startsWith('10.') ||\n            hostname.startsWith('192.168.') ||\n            (hostname.startsWith('172.') && /^172\\.(1[6-9]|2[0-9]|3[0-1])\\./.test(hostname))\n        ) {\n            throw new Error('wrapOpenBadgeV2: Access to private IP ranges is not allowed');\n        }\n\n        // Block link-local addresses\n        if (hostname.startsWith('169.254.')) {\n            throw new Error('wrapOpenBadgeV2: Access to link-local addresses is not allowed');\n        }\n    } catch (error) {\n        if (error instanceof TypeError) {\n            throw new Error('wrapOpenBadgeV2: Invalid URL format');\n        }\n        throw error;\n    }\n};\n\nasync function getObv2Assertion(input: object | string): Promise<Record<string, any>> {\n    if (typeof input === 'string') {\n        // Treat string as URL. If it looks like raw JSON, try to parse for developer ergonomics\n        const trimmed = input.trim();\n        if (!isUrl(trimmed) && (trimmed.startsWith('{') || trimmed.startsWith('['))) {\n            try {\n                return JSON.parse(trimmed);\n            } catch (e) {\n                throw new Error('wrapOpenBadgeV2: Provided string is not a valid URL or JSON');\n            }\n        }\n\n        // Validate URL for security\n        isValidAndSafeUrl(trimmed);\n\n        try {\n            // Add timeout to prevent hanging requests (10 seconds)\n            const controller = new AbortController();\n            const timeoutId = setTimeout(() => controller.abort(), 10000);\n\n            const res = await fetch(trimmed, {\n                signal: controller.signal,\n            });\n\n            clearTimeout(timeoutId);\n\n            if (!res.ok)\n                throw new Error(`wrapOpenBadgeV2: Failed to fetch OBv2 assertion: ${res.status}`);\n\n            return await res.json();\n        } catch (error: any) {\n            if (error instanceof TypeError) {\n                throw new Error(\n                    `wrapOpenBadgeV2: Network error while fetching OBv2 assertion: ${error.message}`\n                );\n            }\n            if (error?.name === 'AbortError') {\n                throw new Error('wrapOpenBadgeV2: Request timed out after 10 seconds');\n            }\n            throw error;\n        }\n    }\n\n    // Add basic type validation before assertion\n    if (typeof input !== 'object' || input === null) {\n        throw new Error('wrapOpenBadgeV2: Input must be a valid object');\n    }\n\n    return input as Record<string, any>;\n}\n\nfunction validateObv2(obv2: Record<string, any>): void {\n    if (!obv2 || typeof obv2 !== 'object') throw new Error('wrapOpenBadgeV2: Missing assertion');\n\n    const id = obv2.id;\n    if (typeof id !== 'string' || !id.length)\n        throw new Error('wrapOpenBadgeV2: assertion.id is required');\n\n    const t = obv2.type;\n    const hasAssertionType =\n        (typeof t === 'string' && t === 'Assertion') ||\n        (Array.isArray(t) && t.includes('Assertion'));\n    if (!hasAssertionType)\n        throw new Error(\"wrapOpenBadgeV2: assertion.type must include 'Assertion'\");\n\n    if (!obv2.issuedOn || typeof obv2.issuedOn !== 'string') {\n        throw new Error('wrapOpenBadgeV2: assertion.issuedOn (string) is required');\n    }\n}\n\nexport const openBadgeV2Plugin = (\n    learnCard: LearnCard<any, 'id', OpenBadgeV2PluginDependentMethods>\n): OpenBadgeV2Plugin => ({\n    name: 'OpenBadgeV2',\n    displayName: 'OpenBadge v2 Wrapper',\n    description: 'Wrap legacy OpenBadge v2.0 assertions into self-issued Verifiable Credentials',\n    methods: {\n        wrapOpenBadgeV2: async (_learnCard, obv2Assertion: object | string): Promise<VC> => {\n            const issuerDid = learnCard.id.did();\n\n            const obv2 = await getObv2Assertion(obv2Assertion);\n            validateObv2(obv2);\n\n            const unsigned: UnsignedVC = {\n                '@context': [VC_V2_CONTEXT, OBV2_WRAPPER_CONTEXT_URL],\n                id: `urn:uuid:${_learnCard.invoke.crypto().randomUUID()}`,\n                type: ['VerifiableCredential', 'LegacyOpenBadgeCredential'],\n                issuer: issuerDid,\n                validFrom: new Date().toISOString(),\n                credentialSubject: {\n                    id: issuerDid,\n                },\n                legacyAssertion: obv2,\n            };\n\n            return learnCard.invoke.issueCredential(unsigned, { proofPurpose: 'assertionMethod' });\n        },\n    },\n});\n"],
+  "mappings": "4dAAA,IAAAA,EAAA,GAAAC,EAAAD,EAAA,8BAAAE,EAAA,sBAAAC,IAAA,eAAAC,EAAAJ,GCsBO,IAAMK,EAA2B,qDCbxC,IAAMC,EAAgB,uCAEhBC,EAAQC,EAACC,GACX,mBAAmB,KAAKA,CAAK,GAAKA,EAAM,WAAW,SAAS,GAAKA,EAAM,WAAW,SAAS,EADjF,SAGRC,EAAoBF,EAACG,GAAsB,CAC7C,GAAI,CACA,IAAMC,EAAY,IAAI,IAAID,CAAG,EAI7B,GAAI,CADqB,CAAC,SAAU,QAAS,QAAS,OAAO,EACvC,SAASC,EAAU,QAAQ,EAC7C,MAAM,IAAI,MACN,8BAA8BA,EAAU,sEAC5C,EAIJ,GAAIA,EAAU,WAAa,SAAWA,EAAU,WAAa,QACzD,OAIJ,IAAMC,EAAWD,EAAU,SAAS,YAAY,EAGhD,GACIC,IAAa,aACbA,IAAa,aACbA,IAAa,WACbA,IAAa,MAEb,MAAM,IAAI,MAAM,qDAAqD,EAIzE,GACIA,EAAS,WAAW,KAAK,GACzBA,EAAS,WAAW,UAAU,GAC7BA,EAAS,WAAW,MAAM,GAAK,iCAAiC,KAAKA,CAAQ,EAE9E,MAAM,IAAI,MAAM,6DAA6D,EAIjF,GAAIA,EAAS,WAAW,UAAU,EAC9B,MAAM,IAAI,MAAM,gEAAgE,CAExF,OAASC,EAAP,CACE,MAAIA,aAAiB,UACX,IAAI,MAAM,qCAAqC,EAEnDA,CACV,CACJ,EAjD0B,qBAmD1B,eAAeC,EAAiBC,EAAsD,CAClF,GAAI,OAAOA,GAAU,SAAU,CAE3B,IAAMC,EAAUD,EAAM,KAAK,EAC3B,GAAI,CAACT,EAAMU,CAAO,IAAMA,EAAQ,WAAW,GAAG,GAAKA,EAAQ,WAAW,GAAG,GACrE,GAAI,CACA,OAAO,KAAK,MAAMA,CAAO,CAC7B,MAAE,CACE,MAAM,IAAI,MAAM,6DAA6D,CACjF,CAIJP,EAAkBO,CAAO,EAEzB,GAAI,CAEA,IAAMC,EAAa,IAAI,gBACjBC,EAAY,WAAW,IAAMD,EAAW,MAAM,EAAG,GAAK,EAEtDE,EAAM,MAAM,MAAMH,EAAS,CAC7B,OAAQC,EAAW,MACvB,CAAC,EAID,GAFA,aAAaC,CAAS,EAElB,CAACC,EAAI,GACL,MAAM,IAAI,MAAM,oDAAoDA,EAAI,QAAQ,EAEpF,OAAO,MAAMA,EAAI,KAAK,CAC1B,OAASN,EAAP,CACE,MAAIA,aAAiB,UACX,IAAI,MACN,iEAAiEA,EAAM,SAC3E,EAEAA,GAAO,OAAS,aACV,IAAI,MAAM,qDAAqD,EAEnEA,CACV,CACJ,CAGA,GAAI,OAAOE,GAAU,UAAYA,IAAU,KACvC,MAAM,IAAI,MAAM,+CAA+C,EAGnE,OAAOA,CACX,CAjDeR,EAAAO,EAAA,oBAmDf,SAASM,EAAaC,EAAiC,CACnD,GAAI,CAACA,GAAQ,OAAOA,GAAS,SAAU,MAAM,IAAI,MAAM,oCAAoC,EAE3F,IAAMC,EAAKD,EAAK,GAChB,GAAI,OAAOC,GAAO,UAAY,CAACA,EAAG,OAC9B,MAAM,IAAI,MAAM,2CAA2C,EAE/D,IAAM,EAAID,EAAK,KAIf,GAAI,EAFC,OAAO,GAAM,UAAY,IAAM,aAC/B,MAAM,QAAQ,CAAC,GAAK,EAAE,SAAS,WAAW,GAE3C,MAAM,IAAI,MAAM,0DAA0D,EAE9E,GAAI,CAACA,EAAK,UAAY,OAAOA,EAAK,UAAa,SAC3C,MAAM,IAAI,MAAM,0DAA0D,CAElF,CAjBSd,EAAAa,EAAA,gBAmBF,IAAMG,EAAoBhB,EAC7BiB,IACqB,CACrB,KAAM,cACN,YAAa,uBACb,YAAa,gFACb,QAAS,CACL,gBAAiB,MAAOC,EAAYC,IAAgD,CAChF,IAAMC,EAAYH,EAAU,GAAG,IAAI,EAE7BH,EAAO,MAAMP,EAAiBY,CAAa,EACjDN,EAAaC,CAAI,EAEjB,IAAMO,EAAuB,CACzB,WAAY,CAACvB,EAAewB,CAAwB,EACpD,GAAI,YAAYJ,EAAW,OAAO,OAAO,EAAE,WAAW,IACtD,KAAM,CAAC,uBAAwB,2BAA2B,EAC1D,OAAQE,EACR,UAAW,IAAI,KAAK,EAAE,YAAY,EAClC,kBAAmB,CACf,GAAIA,CACR,EACA,gBAAiBN,CACrB,EAEA,OAAOG,EAAU,OAAO,gBAAgBI,EAAU,CAAE,aAAc,iBAAkB,CAAC,CACzF,CACJ,CACJ,GA5BiC",
+  "names": ["src_exports", "__export", "OBV2_WRAPPER_CONTEXT_URL", "openBadgeV2Plugin", "__toCommonJS", "OBV2_WRAPPER_CONTEXT_URL", "VC_V2_CONTEXT", "isUrl", "__name", "value", "isValidAndSafeUrl", "url", "parsedUrl", "hostname", "error", "getObv2Assertion", "input", "trimmed", "controller", "timeoutId", "res", "validateObv2", "obv2", "id", "openBadgeV2Plugin", "learnCard", "_learnCard", "obv2Assertion", "issuerDid", "unsigned", "OBV2_WRAPPER_CONTEXT_URL"]
+}

package/dist/open-badge-v2-plugin.esm.js

@@ -0,0 +1,121 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+
+// src/types.ts
+var OBV2_WRAPPER_CONTEXT_URL = "https://ctx.learncard.com/wrappers/obv2/1.0.0.json";
+
+// src/plugin.ts
+var VC_V2_CONTEXT = "https://www.w3.org/ns/credentials/v2";
+var isUrl = /* @__PURE__ */ __name((value) => /^(https?:)?\/\//i.test(value) || value.startsWith("ipfs://") || value.startsWith("ipns://"), "isUrl");
+var isValidAndSafeUrl = /* @__PURE__ */ __name((url) => {
+  try {
+    const parsedUrl = new URL(url);
+    const allowedProtocols = ["https:", "http:", "ipfs:", "ipns:"];
+    if (!allowedProtocols.includes(parsedUrl.protocol)) {
+      throw new Error(
+        `wrapOpenBadgeV2: Protocol '${parsedUrl.protocol}' is not allowed. Only HTTP(S), IPFS, and IPNS are supported`
+      );
+    }
+    if (parsedUrl.protocol === "ipfs:" || parsedUrl.protocol === "ipns:") {
+      return;
+    }
+    const hostname = parsedUrl.hostname.toLowerCase();
+    if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "0.0.0.0" || hostname === "::1") {
+      throw new Error("wrapOpenBadgeV2: Access to localhost is not allowed");
+    }
+    if (hostname.startsWith("10.") || hostname.startsWith("192.168.") || hostname.startsWith("172.") && /^172\.(1[6-9]|2[0-9]|3[0-1])\./.test(hostname)) {
+      throw new Error("wrapOpenBadgeV2: Access to private IP ranges is not allowed");
+    }
+    if (hostname.startsWith("169.254.")) {
+      throw new Error("wrapOpenBadgeV2: Access to link-local addresses is not allowed");
+    }
+  } catch (error) {
+    if (error instanceof TypeError) {
+      throw new Error("wrapOpenBadgeV2: Invalid URL format");
+    }
+    throw error;
+  }
+}, "isValidAndSafeUrl");
+async function getObv2Assertion(input) {
+  if (typeof input === "string") {
+    const trimmed = input.trim();
+    if (!isUrl(trimmed) && (trimmed.startsWith("{") || trimmed.startsWith("["))) {
+      try {
+        return JSON.parse(trimmed);
+      } catch (e) {
+        throw new Error("wrapOpenBadgeV2: Provided string is not a valid URL or JSON");
+      }
+    }
+    isValidAndSafeUrl(trimmed);
+    try {
+      const controller = new AbortController();
+      const timeoutId = setTimeout(() => controller.abort(), 1e4);
+      const res = await fetch(trimmed, {
+        signal: controller.signal
+      });
+      clearTimeout(timeoutId);
+      if (!res.ok)
+        throw new Error(`wrapOpenBadgeV2: Failed to fetch OBv2 assertion: ${res.status}`);
+      return await res.json();
+    } catch (error) {
+      if (error instanceof TypeError) {
+        throw new Error(
+          `wrapOpenBadgeV2: Network error while fetching OBv2 assertion: ${error.message}`
+        );
+      }
+      if (error?.name === "AbortError") {
+        throw new Error("wrapOpenBadgeV2: Request timed out after 10 seconds");
+      }
+      throw error;
+    }
+  }
+  if (typeof input !== "object" || input === null) {
+    throw new Error("wrapOpenBadgeV2: Input must be a valid object");
+  }
+  return input;
+}
+__name(getObv2Assertion, "getObv2Assertion");
+function validateObv2(obv2) {
+  if (!obv2 || typeof obv2 !== "object")
+    throw new Error("wrapOpenBadgeV2: Missing assertion");
+  const id = obv2.id;
+  if (typeof id !== "string" || !id.length)
+    throw new Error("wrapOpenBadgeV2: assertion.id is required");
+  const t = obv2.type;
+  const hasAssertionType = typeof t === "string" && t === "Assertion" || Array.isArray(t) && t.includes("Assertion");
+  if (!hasAssertionType)
+    throw new Error("wrapOpenBadgeV2: assertion.type must include 'Assertion'");
+  if (!obv2.issuedOn || typeof obv2.issuedOn !== "string") {
+    throw new Error("wrapOpenBadgeV2: assertion.issuedOn (string) is required");
+  }
+}
+__name(validateObv2, "validateObv2");
+var openBadgeV2Plugin = /* @__PURE__ */ __name((learnCard) => ({
+  name: "OpenBadgeV2",
+  displayName: "OpenBadge v2 Wrapper",
+  description: "Wrap legacy OpenBadge v2.0 assertions into self-issued Verifiable Credentials",
+  methods: {
+    wrapOpenBadgeV2: async (_learnCard, obv2Assertion) => {
+      const issuerDid = learnCard.id.did();
+      const obv2 = await getObv2Assertion(obv2Assertion);
+      validateObv2(obv2);
+      const unsigned = {
+        "@context": [VC_V2_CONTEXT, OBV2_WRAPPER_CONTEXT_URL],
+        id: `urn:uuid:${_learnCard.invoke.crypto().randomUUID()}`,
+        type: ["VerifiableCredential", "LegacyOpenBadgeCredential"],
+        issuer: issuerDid,
+        validFrom: new Date().toISOString(),
+        credentialSubject: {
+          id: issuerDid
+        },
+        legacyAssertion: obv2
+      };
+      return learnCard.invoke.issueCredential(unsigned, { proofPurpose: "assertionMethod" });
+    }
+  }
+}), "openBadgeV2Plugin");
+export {
+  OBV2_WRAPPER_CONTEXT_URL,
+  openBadgeV2Plugin
+};
+//# sourceMappingURL=open-badge-v2-plugin.esm.js.map

package/dist/open-badge-v2-plugin.esm.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/types.ts", "../src/plugin.ts"],
+  "sourcesContent": ["import { Plugin } from '@learncard/core';\nimport { VC } from '@learncard/types';\nimport { VCPluginMethods } from '@learncard/vc-plugin';\nimport { CryptoPluginMethods } from '@learncard/crypto-plugin';\n\nexport type OpenBadgeV2PluginDependentMethods = VCPluginMethods & CryptoPluginMethods;\n\nexport type OpenBadgeV2PluginMethods = {\n    /**\n     * Wrap a legacy OpenBadge v2.0 assertion (object or URL) into a self-issued VC\n     */\n    wrapOpenBadgeV2: (obv2Assertion: object | string) => Promise<VC>;\n};\n\nexport type OpenBadgeV2Plugin = Plugin<\n    'OpenBadgeV2',\n    any,\n    OpenBadgeV2PluginMethods,\n    'id',\n    OpenBadgeV2PluginDependentMethods\n>;\n\nexport const OBV2_WRAPPER_CONTEXT_URL = 'https://ctx.learncard.com/wrappers/obv2/1.0.0.json';\n", "import { LearnCard } from '@learncard/core';\nimport { UnsignedVC, VC } from '@learncard/types';\n\nimport {\n    OpenBadgeV2Plugin,\n    OBV2_WRAPPER_CONTEXT_URL,\n    OpenBadgeV2PluginDependentMethods,\n} from './types';\n\nconst VC_V2_CONTEXT = 'https://www.w3.org/ns/credentials/v2';\n\nconst isUrl = (value: string): boolean =>\n    /^(https?:)?\\/\\//i.test(value) || value.startsWith('ipfs://') || value.startsWith('ipns://');\n\nconst isValidAndSafeUrl = (url: string): void => {\n    try {\n        const parsedUrl = new URL(url);\n\n        // Only allow http, https, ipfs, ipns protocols\n        const allowedProtocols = ['https:', 'http:', 'ipfs:', 'ipns:'];\n        if (!allowedProtocols.includes(parsedUrl.protocol)) {\n            throw new Error(\n                `wrapOpenBadgeV2: Protocol '${parsedUrl.protocol}' is not allowed. Only HTTP(S), IPFS, and IPNS are supported`\n            );\n        }\n\n        // Skip internal network checks for IPFS/IPNS as they don't use traditional IP addresses\n        if (parsedUrl.protocol === 'ipfs:' || parsedUrl.protocol === 'ipns:') {\n            return;\n        }\n\n        // Block localhost and internal networks for HTTP(S)\n        const hostname = parsedUrl.hostname.toLowerCase();\n\n        // Block localhost variations\n        if (\n            hostname === 'localhost' ||\n            hostname === '127.0.0.1' ||\n            hostname === '0.0.0.0' ||\n            hostname === '::1'\n        ) {\n            throw new Error('wrapOpenBadgeV2: Access to localhost is not allowed');\n        }\n\n        // Block private IP ranges (RFC 1918)\n        if (\n            hostname.startsWith('10.') ||\n            hostname.startsWith('192.168.') ||\n            (hostname.startsWith('172.') && /^172\\.(1[6-9]|2[0-9]|3[0-1])\\./.test(hostname))\n        ) {\n            throw new Error('wrapOpenBadgeV2: Access to private IP ranges is not allowed');\n        }\n\n        // Block link-local addresses\n        if (hostname.startsWith('169.254.')) {\n            throw new Error('wrapOpenBadgeV2: Access to link-local addresses is not allowed');\n        }\n    } catch (error) {\n        if (error instanceof TypeError) {\n            throw new Error('wrapOpenBadgeV2: Invalid URL format');\n        }\n        throw error;\n    }\n};\n\nasync function getObv2Assertion(input: object | string): Promise<Record<string, any>> {\n    if (typeof input === 'string') {\n        // Treat string as URL. If it looks like raw JSON, try to parse for developer ergonomics\n        const trimmed = input.trim();\n        if (!isUrl(trimmed) && (trimmed.startsWith('{') || trimmed.startsWith('['))) {\n            try {\n                return JSON.parse(trimmed);\n            } catch (e) {\n                throw new Error('wrapOpenBadgeV2: Provided string is not a valid URL or JSON');\n            }\n        }\n\n        // Validate URL for security\n        isValidAndSafeUrl(trimmed);\n\n        try {\n            // Add timeout to prevent hanging requests (10 seconds)\n            const controller = new AbortController();\n            const timeoutId = setTimeout(() => controller.abort(), 10000);\n\n            const res = await fetch(trimmed, {\n                signal: controller.signal,\n            });\n\n            clearTimeout(timeoutId);\n\n            if (!res.ok)\n                throw new Error(`wrapOpenBadgeV2: Failed to fetch OBv2 assertion: ${res.status}`);\n\n            return await res.json();\n        } catch (error: any) {\n            if (error instanceof TypeError) {\n                throw new Error(\n                    `wrapOpenBadgeV2: Network error while fetching OBv2 assertion: ${error.message}`\n                );\n            }\n            if (error?.name === 'AbortError') {\n                throw new Error('wrapOpenBadgeV2: Request timed out after 10 seconds');\n            }\n            throw error;\n        }\n    }\n\n    // Add basic type validation before assertion\n    if (typeof input !== 'object' || input === null) {\n        throw new Error('wrapOpenBadgeV2: Input must be a valid object');\n    }\n\n    return input as Record<string, any>;\n}\n\nfunction validateObv2(obv2: Record<string, any>): void {\n    if (!obv2 || typeof obv2 !== 'object') throw new Error('wrapOpenBadgeV2: Missing assertion');\n\n    const id = obv2.id;\n    if (typeof id !== 'string' || !id.length)\n        throw new Error('wrapOpenBadgeV2: assertion.id is required');\n\n    const t = obv2.type;\n    const hasAssertionType =\n        (typeof t === 'string' && t === 'Assertion') ||\n        (Array.isArray(t) && t.includes('Assertion'));\n    if (!hasAssertionType)\n        throw new Error(\"wrapOpenBadgeV2: assertion.type must include 'Assertion'\");\n\n    if (!obv2.issuedOn || typeof obv2.issuedOn !== 'string') {\n        throw new Error('wrapOpenBadgeV2: assertion.issuedOn (string) is required');\n    }\n}\n\nexport const openBadgeV2Plugin = (\n    learnCard: LearnCard<any, 'id', OpenBadgeV2PluginDependentMethods>\n): OpenBadgeV2Plugin => ({\n    name: 'OpenBadgeV2',\n    displayName: 'OpenBadge v2 Wrapper',\n    description: 'Wrap legacy OpenBadge v2.0 assertions into self-issued Verifiable Credentials',\n    methods: {\n        wrapOpenBadgeV2: async (_learnCard, obv2Assertion: object | string): Promise<VC> => {\n            const issuerDid = learnCard.id.did();\n\n            const obv2 = await getObv2Assertion(obv2Assertion);\n            validateObv2(obv2);\n\n            const unsigned: UnsignedVC = {\n                '@context': [VC_V2_CONTEXT, OBV2_WRAPPER_CONTEXT_URL],\n                id: `urn:uuid:${_learnCard.invoke.crypto().randomUUID()}`,\n                type: ['VerifiableCredential', 'LegacyOpenBadgeCredential'],\n                issuer: issuerDid,\n                validFrom: new Date().toISOString(),\n                credentialSubject: {\n                    id: issuerDid,\n                },\n                legacyAssertion: obv2,\n            };\n\n            return learnCard.invoke.issueCredential(unsigned, { proofPurpose: 'assertionMethod' });\n        },\n    },\n});\n"],
+  "mappings": ";;;;AAsBO,IAAM,2BAA2B;;;ACbxC,IAAM,gBAAgB;AAEtB,IAAM,QAAQ,wBAAC,UACX,mBAAmB,KAAK,KAAK,KAAK,MAAM,WAAW,SAAS,KAAK,MAAM,WAAW,SAAS,GADjF;AAGd,IAAM,oBAAoB,wBAAC,QAAsB;AAC7C,MAAI;AACA,UAAM,YAAY,IAAI,IAAI,GAAG;AAG7B,UAAM,mBAAmB,CAAC,UAAU,SAAS,SAAS,OAAO;AAC7D,QAAI,CAAC,iBAAiB,SAAS,UAAU,QAAQ,GAAG;AAChD,YAAM,IAAI;AAAA,QACN,8BAA8B,UAAU;AAAA,MAC5C;AAAA,IACJ;AAGA,QAAI,UAAU,aAAa,WAAW,UAAU,aAAa,SAAS;AAClE;AAAA,IACJ;AAGA,UAAM,WAAW,UAAU,SAAS,YAAY;AAGhD,QACI,aAAa,eACb,aAAa,eACb,aAAa,aACb,aAAa,OACf;AACE,YAAM,IAAI,MAAM,qDAAqD;AAAA,IACzE;AAGA,QACI,SAAS,WAAW,KAAK,KACzB,SAAS,WAAW,UAAU,KAC7B,SAAS,WAAW,MAAM,KAAK,iCAAiC,KAAK,QAAQ,GAChF;AACE,YAAM,IAAI,MAAM,6DAA6D;AAAA,IACjF;AAGA,QAAI,SAAS,WAAW,UAAU,GAAG;AACjC,YAAM,IAAI,MAAM,gEAAgE;AAAA,IACpF;AAAA,EACJ,SAAS,OAAP;AACE,QAAI,iBAAiB,WAAW;AAC5B,YAAM,IAAI,MAAM,qCAAqC;AAAA,IACzD;AACA,UAAM;AAAA,EACV;AACJ,GAjD0B;AAmD1B,eAAe,iBAAiB,OAAsD;AAClF,MAAI,OAAO,UAAU,UAAU;AAE3B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,MAAM,OAAO,MAAM,QAAQ,WAAW,GAAG,KAAK,QAAQ,WAAW,GAAG,IAAI;AACzE,UAAI;AACA,eAAO,KAAK,MAAM,OAAO;AAAA,MAC7B,SAAS,GAAP;AACE,cAAM,IAAI,MAAM,6DAA6D;AAAA,MACjF;AAAA,IACJ;AAGA,sBAAkB,OAAO;AAEzB,QAAI;AAEA,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,YAAY,WAAW,MAAM,WAAW,MAAM,GAAG,GAAK;AAE5D,YAAM,MAAM,MAAM,MAAM,SAAS;AAAA,QAC7B,QAAQ,WAAW;AAAA,MACvB,CAAC;AAED,mBAAa,SAAS;AAEtB,UAAI,CAAC,IAAI;AACL,cAAM,IAAI,MAAM,oDAAoD,IAAI,QAAQ;AAEpF,aAAO,MAAM,IAAI,KAAK;AAAA,IAC1B,SAAS,OAAP;AACE,UAAI,iBAAiB,WAAW;AAC5B,cAAM,IAAI;AAAA,UACN,iEAAiE,MAAM;AAAA,QAC3E;AAAA,MACJ;AACA,UAAI,OAAO,SAAS,cAAc;AAC9B,cAAM,IAAI,MAAM,qDAAqD;AAAA,MACzE;AACA,YAAM;AAAA,IACV;AAAA,EACJ;AAGA,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC7C,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACnE;AAEA,SAAO;AACX;AAjDe;AAmDf,SAAS,aAAa,MAAiC;AACnD,MAAI,CAAC,QAAQ,OAAO,SAAS;AAAU,UAAM,IAAI,MAAM,oCAAoC;AAE3F,QAAM,KAAK,KAAK;AAChB,MAAI,OAAO,OAAO,YAAY,CAAC,GAAG;AAC9B,UAAM,IAAI,MAAM,2CAA2C;AAE/D,QAAM,IAAI,KAAK;AACf,QAAM,mBACD,OAAO,MAAM,YAAY,MAAM,eAC/B,MAAM,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW;AAC/C,MAAI,CAAC;AACD,UAAM,IAAI,MAAM,0DAA0D;AAE9E,MAAI,CAAC,KAAK,YAAY,OAAO,KAAK,aAAa,UAAU;AACrD,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC9E;AACJ;AAjBS;AAmBF,IAAM,oBAAoB,wBAC7B,eACqB;AAAA,EACrB,MAAM;AAAA,EACN,aAAa;AAAA,EACb,aAAa;AAAA,EACb,SAAS;AAAA,IACL,iBAAiB,OAAO,YAAY,kBAAgD;AAChF,YAAM,YAAY,UAAU,GAAG,IAAI;AAEnC,YAAM,OAAO,MAAM,iBAAiB,aAAa;AACjD,mBAAa,IAAI;AAEjB,YAAM,WAAuB;AAAA,QACzB,YAAY,CAAC,eAAe,wBAAwB;AAAA,QACpD,IAAI,YAAY,WAAW,OAAO,OAAO,EAAE,WAAW;AAAA,QACtD,MAAM,CAAC,wBAAwB,2BAA2B;AAAA,QAC1D,QAAQ;AAAA,QACR,WAAW,IAAI,KAAK,EAAE,YAAY;AAAA,QAClC,mBAAmB;AAAA,UACf,IAAI;AAAA,QACR;AAAA,QACA,iBAAiB;AAAA,MACrB;AAEA,aAAO,UAAU,OAAO,gBAAgB,UAAU,EAAE,cAAc,kBAAkB,CAAC;AAAA,IACzF;AAAA,EACJ;AACJ,IA5BiC;",
+  "names": []
+}

package/dist/plugin.d.ts

@@ -0,0 +1,4 @@
+import { LearnCard } from '@learncard/core';
+import { OpenBadgeV2Plugin, OpenBadgeV2PluginDependentMethods } from './types';
+export declare const openBadgeV2Plugin: (learnCard: LearnCard<any, "id", OpenBadgeV2PluginDependentMethods>) => OpenBadgeV2Plugin;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAG5C,OAAO,EACH,iBAAiB,EAEjB,iCAAiC,EACpC,MAAM,SAAS,CAAC;AAgIjB,eAAO,MAAM,iBAAiB,cACf,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,iCAAiC,CAAC,KACnE,iBA0BD,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,14 @@
+import { Plugin } from '@learncard/core';
+import { VC } from '@learncard/types';
+import { VCPluginMethods } from '@learncard/vc-plugin';
+import { CryptoPluginMethods } from '@learncard/crypto-plugin';
+export type OpenBadgeV2PluginDependentMethods = VCPluginMethods & CryptoPluginMethods;
+export type OpenBadgeV2PluginMethods = {
+    /**
+     * Wrap a legacy OpenBadge v2.0 assertion (object or URL) into a self-issued VC
+     */
+    wrapOpenBadgeV2: (obv2Assertion: object | string) => Promise<VC>;
+};
+export type OpenBadgeV2Plugin = Plugin<'OpenBadgeV2', any, OpenBadgeV2PluginMethods, 'id', OpenBadgeV2PluginDependentMethods>;
+export declare const OBV2_WRAPPER_CONTEXT_URL = "https://ctx.learncard.com/wrappers/obv2/1.0.0.json";
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,MAAM,MAAM,iCAAiC,GAAG,eAAe,GAAG,mBAAmB,CAAC;AAEtF,MAAM,MAAM,wBAAwB,GAAG;IACnC;;OAEG;IACH,eAAe,EAAE,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC;CACpE,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAClC,aAAa,EACb,GAAG,EACH,wBAAwB,EACxB,IAAI,EACJ,iCAAiC,CACpC,CAAC;AAEF,eAAO,MAAM,wBAAwB,uDAAuD,CAAC"}

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@learncard/open-badge-v2-plugin",
+  "version": "1.0.0",
+  "description": "OpenBadge v2 wrapper plugin for LearnCard. Wraps OBv2 assertions into self-issued VCs.",
+  "main": "./dist/index.js",
+  "module": "./dist/open-badge-v2-plugin.esm.js",
+  "files": [
+    "dist"
+  ],
+  "author": "Learning Economy Foundation (www.learningeconomy.io)",
+  "license": "MIT",
+  "homepage": "https://github.com/WeLibraryOS/LearnCard#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/WeLibraryOS/LearnCard.git"
+  },
+  "bugs": {
+    "url": "https://github.com/WeLibraryOS/LearnCard/issues"
+  },
+  "devDependencies": {
+    "@types/jest": "^29.2.2",
+    "@types/node": "^17.0.31",
+    "aqu": "0.4.3",
+    "esbuild": "^0.14.38",
+    "esbuild-jest": "^0.5.0",
+    "esbuild-plugin-copy": "^1.3.0",
+    "jest": "^29.3.0",
+    "shx": "^0.3.4",
+    "ts-jest": "^29.0.3"
+  },
+  "types": "./dist/index.d.ts",
+  "dependencies": {
+    "@learncard/core": "9.3.35",
+    "@learncard/vc-plugin": "1.1.57",
+    "@learncard/crypto-plugin": "1.0.46",
+    "@learncard/types": "5.8.3"
+  },
+  "scripts": {
+    "build": "node ./scripts/build.mjs && shx cp ./scripts/mixedEntypoint.js ./dist/index.js && tsc --p tsconfig.json",
+    "test": "jest --passWithNoTests",
+    "test:watch": "jest --watch",
+    "test:coverage": "jest --silent --ci --coverage --coverageReporters=\"text\" --coverageReporters=\"text-summary\""
+  }
+}