@originals/sdk 1.1.0

package/src/utils/validation.ts

@@ -0,0 +1,119 @@
+import { DIDDocument, VerifiableCredential } from '../types';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { bytesToHex } from '@noble/hashes/utils.js';
+
+export function validateDID(did: string): boolean {
+  // Validate DID format according to W3C DID spec
+  const didRegex = /^did:([a-z0-9]+):(.*)/;
+  
+  if (!didRegex.test(did)) {
+    return false;
+  }
+
+  const match = did.match(didRegex);
+  if (!match) {
+    return false;
+  }
+  const method = match[1];
+  
+  // Validate supported methods
+  const supportedMethods = ['peer', 'webvh', 'btco'];
+  if (!supportedMethods.includes(method)) {
+    return false;
+  }
+
+  return true;
+}
+
+export function validateCredential(vc: VerifiableCredential): boolean {
+  // Validate VC structure according to W3C VC spec
+  if (!vc['@context'] || !Array.isArray(vc['@context'])) {
+    return false;
+  }
+
+  // Require VC v1 context presence
+  const contextValues = vc['@context'];
+  const hasVcV1 = contextValues.includes('https://www.w3.org/2018/credentials/v1');
+  if (!hasVcV1) {
+    return false;
+  }
+
+  if (!vc.type || !Array.isArray(vc.type)) {
+    return false;
+  }
+
+  if (!vc.type.includes('VerifiableCredential')) {
+    return false;
+  }
+
+  if (!vc.issuer || (!vc.issuanceDate)) {
+    return false;
+  }
+
+  // issuer must be a DID string or an object with DID id
+  const issuerIsValidDid = (iss: any): boolean => {
+    if (typeof iss === 'string') return validateDID(iss);
+    if (iss && typeof iss.id === 'string') return validateDID(iss.id);
+    return false;
+  };
+  if (!issuerIsValidDid(vc.issuer as any)) {
+    return false;
+  }
+
+  // issuanceDate should be a valid ISO timestamp
+  if (typeof vc.issuanceDate !== 'string' || Number.isNaN(Date.parse(vc.issuanceDate))) {
+    return false;
+  }
+
+  if (!vc.credentialSubject) {
+    return false;
+  }
+
+  return true;
+}
+
+export function validateDIDDocument(didDoc: DIDDocument): boolean {
+  // Validate DID Document structure
+  if (!didDoc['@context'] || !Array.isArray(didDoc['@context'])) {
+    return false;
+  }
+
+  if (!didDoc.id || !validateDID(didDoc.id)) {
+    return false;
+  }
+
+  // Validate verification methods
+  if (didDoc.verificationMethod) {
+    for (const vm of didDoc.verificationMethod) {
+      if (!vm.id || !vm.type || !vm.controller || !vm.publicKeyMultibase) {
+        return false;
+      }
+      // controller should be a valid DID
+      if (typeof vm.controller !== 'string' || !validateDID(vm.controller)) {
+        return false;
+      }
+      // multibase key presence: require base58-btc multibase indicator 'z'
+      if (typeof vm.publicKeyMultibase !== 'string' || !vm.publicKeyMultibase.startsWith('z')) {
+        return false;
+      }
+    }
+  }
+
+  // If controller array present on the DID Document, validate entries are DIDs
+  if (Array.isArray((didDoc as any).controller)) {
+    const ctrls = (didDoc as any).controller as string[];
+    if (!ctrls.every((c) => typeof c === 'string' && validateDID(c))) {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+export function hashResource(content: Uint8Array): string {
+  // Generate SHA-256 hash
+  const hash = sha256(content);
+  return bytesToHex(hash);
+}
+
+

package/src/vc/CredentialManager.ts

@@ -0,0 +1,273 @@
+import { 
+  VerifiableCredential, 
+  VerifiablePresentation, 
+  CredentialSubject, 
+  OriginalsConfig,
+  Proof,
+  ExternalSigner
+} from '../types';
+import { canonicalizeDocument } from '../utils/serialization';
+import { encodeBase64UrlMultibase, decodeBase64UrlMultibase } from '../utils/encoding';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { Signer, ES256KSigner, Ed25519Signer, ES256Signer } from '../crypto/Signer';
+import { DIDManager } from '../did/DIDManager';
+import { Issuer, VerificationMethodLike } from './Issuer';
+import { createDocumentLoader } from './documentLoader';
+import { Verifier } from './Verifier';
+
+export class CredentialManager {
+  constructor(private config: OriginalsConfig, private didManager?: DIDManager) {}
+
+  async createResourceCredential(
+    type: 'ResourceCreated' | 'ResourceUpdated' | 'ResourceMigrated',
+    subject: CredentialSubject,
+    issuer: string
+  ): Promise<VerifiableCredential> {
+    return {
+      '@context': ['https://www.w3.org/2018/credentials/v1'],
+      type: ['VerifiableCredential', type],
+      issuer,
+      issuanceDate: new Date().toISOString(),
+      credentialSubject: subject
+    };
+  }
+
+  async signCredential(
+    credential: VerifiableCredential,
+    privateKeyMultibase: string,
+    verificationMethod: string
+  ): Promise<VerifiableCredential> {
+    if (this.didManager && typeof verificationMethod === 'string' && verificationMethod.startsWith('did:')) {
+      try {
+        const loader = createDocumentLoader(this.didManager);
+        const { document } = await loader(verificationMethod);
+        if (document && document.publicKeyMultibase) {
+          const vm: VerificationMethodLike = {
+            id: verificationMethod,
+            controller: typeof credential.issuer === 'string' ? credential.issuer : (credential.issuer as any)?.id,
+            publicKeyMultibase: document.publicKeyMultibase,
+            secretKeyMultibase: privateKeyMultibase,
+            type: document.type || 'Multikey'
+          } as any;
+          const issuer = new Issuer(this.didManager, vm);
+          const unsigned: any = { ...credential };
+          delete unsigned['@context'];
+          delete unsigned.proof;
+          return issuer.issueCredential(unsigned, { proofPurpose: 'assertionMethod' });
+        }
+      } catch {
+        // fall through to legacy signing
+      }
+    }
+
+    // fallback to legacy local signer
+    const proofBase: Proof = {
+      type: 'DataIntegrityProof',
+      created: new Date().toISOString(),
+      verificationMethod,
+      proofPurpose: 'assertionMethod',
+      proofValue: ''
+    };
+    const proofValue = await this.generateProofValue(credential, privateKeyMultibase, proofBase);
+    const proof: Proof = { ...proofBase, proofValue };
+    return { ...credential, proof };
+  }
+
+  /**
+   * Sign a credential using an external signer (e.g., hardware wallet, Privy)
+   * @param credential - The unsigned credential
+   * @param signer - External signer implementation
+   * @returns Signed verifiable credential
+   */
+  async signCredentialWithExternalSigner(
+    credential: VerifiableCredential,
+    signer: ExternalSigner
+  ): Promise<VerifiableCredential> {
+    const verificationMethodId = await signer.getVerificationMethodId();
+    
+    // Create proof structure
+    const proofBase = {
+      type: 'DataIntegrityProof',
+      cryptosuite: 'eddsa-rdfc-2022', // Or derive from signer type
+      created: new Date().toISOString(),
+      verificationMethod: verificationMethodId,
+      proofPurpose: 'assertionMethod'
+    };
+
+    // Prepare unsigned credential
+    const unsignedCredential: any = { ...credential };
+    delete unsignedCredential.proof;
+
+    // Use external signer to sign
+    const { proofValue } = await signer.sign({
+      document: unsignedCredential,
+      proof: proofBase
+    });
+
+    // Return signed credential
+    return {
+      ...credential,
+      proof: {
+        ...proofBase,
+        proofValue
+      }
+    };
+  }
+
+  async verifyCredential(credential: VerifiableCredential): Promise<boolean> {
+    if (this.didManager) {
+      const proofAny: any = (credential as any).proof;
+      if (proofAny && (proofAny.cryptosuite || (Array.isArray(proofAny) && proofAny[0]?.cryptosuite))) {
+        const verifier = new Verifier(this.didManager);
+        const res = await verifier.verifyCredential(credential);
+        return res.verified;
+      }
+    }
+
+    const proof = credential.proof as Proof | undefined;
+    if (!proof) {
+      return false;
+    }
+
+    const { proofValue, verificationMethod } = proof;
+    if (!proofValue || !verificationMethod) return false;
+
+    const signature = this.decodeMultibase(proofValue);
+    if (!signature) return false;
+
+    const proofSansValue = { ...proof } as any;
+    delete proofSansValue.proofValue;
+    const proofInput: any = { ...proofSansValue };
+    const credentialContext = (credential as any)['@context'];
+    if (credentialContext && !proofInput['@context']) {
+      proofInput['@context'] = credentialContext;
+    }
+    const unsignedCredential: any = { ...credential };
+    delete unsignedCredential.proof;
+
+    const c14nProof = await canonicalizeDocument(proofInput);
+    const c14nCred = await canonicalizeDocument(unsignedCredential);
+    const hProof = Buffer.from(sha256(Buffer.from(c14nProof, 'utf8')));
+    const hCred = Buffer.from(sha256(Buffer.from(c14nCred, 'utf8')));
+    const digest = Buffer.concat([hProof, hCred]);
+    const signer = this.getSigner();
+    try {
+      const resolvedKey = (proof as any).publicKeyMultibase
+        || await this.resolveVerificationMethodMultibase(verificationMethod);
+      if (!resolvedKey) {
+        return false;
+      }
+      return await signer.verify(Buffer.from(digest), Buffer.from(signature), resolvedKey);
+    } catch {
+      return false;
+    }
+  }
+
+  async createPresentation(
+    credentials: VerifiableCredential[],
+    holder: string
+  ): Promise<VerifiablePresentation> {
+    return {
+      '@context': ['https://www.w3.org/2018/credentials/v1'],
+      type: ['VerifiablePresentation'],
+      holder,
+      verifiableCredential: credentials
+    } as any;
+  }
+
+  private async generateProofValue(
+    credential: VerifiableCredential, 
+    privateKeyMultibase: string,
+    proofBase: Proof
+  ): Promise<string> {
+    // Construct canonical digest including provided proof sans proofValue
+    const proofSansValue = { ...proofBase } as any;
+    delete proofSansValue.proofValue;
+    const proofInput: any = { ...proofSansValue };
+    const credentialContext = (credential as any)['@context'];
+    if (credentialContext && !proofInput['@context']) {
+      proofInput['@context'] = credentialContext;
+    }
+    const unsignedCredential: any = { ...credential };
+    delete unsignedCredential.proof;
+
+    const c14nProof = await canonicalizeDocument(proofInput);
+    const c14nCred = await canonicalizeDocument(unsignedCredential);
+    const hProof = Buffer.from(sha256(Buffer.from(c14nProof, 'utf8')));
+    const hCred = Buffer.from(sha256(Buffer.from(c14nCred, 'utf8')));
+    const digest = Buffer.concat([hProof, hCred]);
+    const signer = this.getSigner();
+    const sig = await signer.sign(Buffer.from(digest), privateKeyMultibase);
+    return encodeBase64UrlMultibase(sig);
+  }
+
+  private getSigner(): Signer {
+    switch (this.config.defaultKeyType) {
+      case 'ES256K':
+        return new ES256KSigner();
+      case 'Ed25519':
+        return new Ed25519Signer();
+      case 'ES256':
+        return new ES256Signer();
+      default:
+        return new ES256KSigner();
+    }
+  }
+
+  private async resolveVerificationMethodMultibase(
+    verificationMethod: string
+  ): Promise<string | null> {
+    if (typeof verificationMethod === 'string' && verificationMethod.startsWith('z')) {
+      return verificationMethod;
+    }
+
+    if (!this.didManager || typeof verificationMethod !== 'string' || !verificationMethod.startsWith('did:')) {
+      return null;
+    }
+
+    const loader = createDocumentLoader(this.didManager);
+    try {
+      const { document } = await loader(verificationMethod);
+      if (document && typeof document.publicKeyMultibase === 'string') {
+        return document.publicKeyMultibase;
+      }
+    } catch (err) {
+      // Document loader failed; will try alternative resolution method
+      if (this.config.enableLogging) {
+        console.warn('Failed to load verification method via document loader:', err);
+      }
+    }
+
+    try {
+      const did = verificationMethod.split('#')[0];
+      if (!did) {
+        return null;
+      }
+      const didDoc = await this.didManager.resolveDID(did);
+      const vms = (didDoc as any)?.verificationMethod;
+      if (Array.isArray(vms)) {
+        const vm = vms.find((m: any) => m?.id === verificationMethod);
+        if (vm && typeof vm.publicKeyMultibase === 'string') {
+          return vm.publicKeyMultibase;
+        }
+      }
+    } catch (err) {
+      // Failed to resolve DID document
+      if (this.config.enableLogging) {
+        console.warn('Failed to resolve DID for verification method:', err);
+      }
+    }
+
+    return null;
+  }
+
+  private decodeMultibase(s: string): Uint8Array | null {
+    try {
+      return decodeBase64UrlMultibase(s);
+    } catch {
+      return null;
+    }
+  }
+}
+
+

package/src/vc/Issuer.ts

@@ -0,0 +1,100 @@
+import { VerifiableCredential, VerifiablePresentation, Proof } from '../types';
+import { multikey, MultikeyType } from '../crypto/Multikey';
+import { DIDManager } from '../did/DIDManager';
+import { createDocumentLoader } from './documentLoader';
+import { DataIntegrityProofManager } from './proofs/data-integrity';
+
+export interface IssueOptions {
+  proofPurpose: 'assertionMethod' | 'authentication';
+  documentLoader?: (iri: string) => Promise<{ document: any; documentUrl: string; contextUrl: string | null }>;
+  challenge?: string;
+  domain?: string;
+}
+
+export type VerificationMethodLike = {
+  id: string;
+  controller: string;
+  publicKeyMultibase: string;
+  secretKeyMultibase?: string;
+  type?: 'Multikey' | string;
+};
+
+export class Issuer {
+  constructor(private didManager: DIDManager, private verificationMethod: VerificationMethodLike) {}
+
+  private inferKeyType(publicKeyMultibase: string): MultikeyType {
+    try {
+      return multikey.decodePublicKey(publicKeyMultibase).type;
+    } catch {
+      return 'Ed25519';
+    }
+  }
+
+  async issueCredential(
+    unsigned: Omit<VerifiableCredential, '@context' | 'proof'>,
+    options: IssueOptions
+  ): Promise<VerifiableCredential> {
+    const documentLoader = options.documentLoader || createDocumentLoader(this.didManager);
+    await documentLoader(this.verificationMethod.id);
+
+    const issuerId = typeof unsigned.issuer === 'string' ? unsigned.issuer : (unsigned.issuer as any)?.id;
+    const credential: VerifiableCredential = {
+      ...unsigned,
+      '@context': ['https://www.w3.org/ns/credentials/v2'],
+      issuer: issuerId || this.verificationMethod.controller,
+      proof: undefined
+    } as any;
+
+    if (!this.verificationMethod.secretKeyMultibase) {
+      throw new Error('Missing secretKeyMultibase for issuance');
+    }
+    const keyType = this.inferKeyType(this.verificationMethod.publicKeyMultibase);
+    if (keyType !== 'Ed25519') {
+      throw new Error('Only Ed25519 supported for eddsa-rdfc-2022');
+    }
+    const proof = await DataIntegrityProofManager.createProof(credential, {
+      verificationMethod: this.verificationMethod.id,
+      proofPurpose: options.proofPurpose,
+      cryptosuite: 'eddsa-rdfc-2022',
+      type: 'DataIntegrityProof',
+      privateKey: this.verificationMethod.secretKeyMultibase,
+      documentLoader
+    });
+    return { ...credential, proof } as any;
+  }
+
+  async issuePresentation(
+    presentation: Omit<VerifiablePresentation, '@context' | 'proof'>,
+    options: IssueOptions
+  ): Promise<VerifiablePresentation> {
+    const documentLoader = options.documentLoader || createDocumentLoader(this.didManager);
+    await documentLoader(this.verificationMethod.id);
+
+    if (!this.verificationMethod.secretKeyMultibase) {
+      throw new Error('Missing secretKeyMultibase for issuance');
+    }
+    const keyType = this.inferKeyType(this.verificationMethod.publicKeyMultibase);
+    if (keyType !== 'Ed25519') {
+      throw new Error('Only Ed25519 supported for eddsa-rdfc-2022');
+    }
+    const proof = await DataIntegrityProofManager.createProof(
+      { ...(presentation as any), '@context': ['https://www.w3.org/ns/credentials/v2'] },
+      {
+        verificationMethod: this.verificationMethod.id,
+        proofPurpose: options.proofPurpose,
+        cryptosuite: 'eddsa-rdfc-2022',
+        type: 'DataIntegrityProof',
+        privateKey: this.verificationMethod.secretKeyMultibase,
+        challenge: options.challenge,
+        domain: options.domain,
+        documentLoader
+      }
+    );
+    return {
+      ...(presentation as any),
+      '@context': ['https://www.w3.org/ns/credentials/v2'],
+      proof
+    } as VerifiablePresentation;
+  }
+}
+

package/src/vc/Verifier.ts

@@ -0,0 +1,47 @@
+import { VerifiableCredential, VerifiablePresentation } from '../types';
+import { DIDManager } from '../did/DIDManager';
+import { createDocumentLoader } from './documentLoader';
+import { DataIntegrityProofManager } from './proofs/data-integrity';
+
+export type VerificationResult = { verified: boolean; errors: string[] };
+
+export class Verifier {
+  constructor(private didManager: DIDManager) {}
+
+  async verifyCredential(vc: VerifiableCredential, options: { documentLoader?: (iri: string) => Promise<any> } = {}): Promise<VerificationResult> {
+    try {
+      if (!vc || !vc['@context'] || !vc.type) throw new Error('Invalid credential');
+      if (!vc.proof) throw new Error('Credential has no proof');
+      const loader = options.documentLoader || createDocumentLoader(this.didManager);
+      const ctxs: string[] = Array.isArray(vc['@context']) ? (vc['@context'] as any) : [vc['@context'] as any];
+      for (const c of ctxs) await loader(c);
+      const proof = Array.isArray(vc.proof) ? (vc.proof as any)[0] : (vc.proof as any);
+      const result = await DataIntegrityProofManager.verifyProof(vc, proof, { documentLoader: loader });
+      return result.verified ? { verified: true, errors: [] } : { verified: false, errors: result.errors ?? ['Verification failed'] };
+    } catch (e: any) {
+      return { verified: false, errors: [e?.message ?? 'Unknown error in verifyCredential'] };
+    }
+  }
+
+  async verifyPresentation(vp: VerifiablePresentation, options: { documentLoader?: (iri: string) => Promise<any> } = {}): Promise<VerificationResult> {
+    try {
+      if (!vp || !vp['@context'] || !vp.type) throw new Error('Invalid presentation');
+      if (!vp.proof) throw new Error('Presentation has no proof');
+      const loader = options.documentLoader || createDocumentLoader(this.didManager);
+      const ctxs: string[] = Array.isArray(vp['@context']) ? (vp['@context'] as any) : [vp['@context'] as any];
+      for (const c of ctxs) await loader(c);
+      if (vp.verifiableCredential) {
+        for (const c of vp.verifiableCredential) {
+          const res = await this.verifyCredential(c as any, { documentLoader: loader });
+          if (!res.verified) return res;
+        }
+      }
+      const proof = Array.isArray(vp.proof) ? (vp.proof as any)[0] : (vp.proof as any);
+      const result = await DataIntegrityProofManager.verifyProof(vp, proof, { documentLoader: loader });
+      return result.verified ? { verified: true, errors: [] } : { verified: false, errors: result.errors ?? ['Verification failed'] };
+    } catch (e: any) {
+      return { verified: false, errors: [e?.message ?? 'Unknown error in verifyPresentation'] };
+    }
+  }
+}
+