@sphereon/did-provider-oyd 0.28.1-feature.jose.vcdm.28 → 0.28.1-feature.jose.vcdm.51

package/README.md

@@ -1,4 +1,75 @@
-# OwnYourData did:oyd provider
+# `did:oyd` Provider
 
-This package contains an implementation of `AbstractIdentifierProvider` for the `did:oyd` method.
-This enables creation and control of `did:oyd` entities.
+This package contains an implementation of the `AbstractIdentifierProvider` for the `did:oyd` method. Enabling creating and resolving of `did:oyd` entities, conforming to the [spec for OYDID](https://ownyourdata.github.io/oydid/)
+
+## Available functions
+
+- createIdentifier
+- resolveDidOyd
+
+## Usage
+
+### Creating an identifier
+
+The most simple version of creating a did:oyd is without any input parameters:
+
+```typescript
+const identifier: IIdentifier = await agent.didManagerCreate()
+```
+
+Use the following options to create a did:oyd using Client-Managed-Secret-Mode:
+
+```typescript
+const DID_METHOD = 'did:oyd'
+const oydDIDProvider = new OydDIDProvider({
+  defaultKms: 'mem',
+  clientManagedSecretMode: {
+    publicKeyCallback: some_function, // callback to provide public Key
+    signCallback: some_function, // callback for signing payload
+  },
+})
+
+const agent = createAgent<IKeyManager, DIDManager>({
+  plugins: [
+    new SphereonKeyManager({
+      store: new MemoryKeyStore(),
+      kms: {
+        mem: new SphereonKeyManagementSystem(new MemoryPrivateKeyStore()),
+      },
+    }),
+    new DIDManager({
+      providers: {
+        [DID_METHOD]: oydDIDProvider,
+      },
+      defaultProvider: DID_METHOD,
+      store: new MemoryDIDStore(),
+    }),
+  ],
+})
+
+const identifier: IIdentifier = await agent.didManagerCreate()
+```
+
+### Resolving a DID
+
+The example below resolves a did:oyd to DIDResolutionResult.
+
+```typescript
+const didResolutionResult: DIDResolutionResult = await agent.resolveDid({ didUrl: 'did:oyd:zQm...' })
+```
+
+## Installation
+
+```shell
+yarn add @sphereon/ssi-sdk-ext.did-provider-oyd
+```
+
+## Build
+
+```shell
+yarn build
+```
+
+## REST API Endpoints for `did:oyd`
+
+For managing did:oyd DIDs (create, update, delete), refer to the following page, which provides detailed information on the available REST API endpoints: https://github.com/OwnYourData/oydid/tree/main/uni-registrar-driver-did-oyd

package/dist/index.cjs

@@ -32,33 +32,61 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var index_exports = {};
 __export(index_exports, {
   OydDIDProvider: () => OydDIDProvider,
-  SupportedKeyTypes: () => SupportedKeyTypes,
   getDidOydResolver: () => getDidOydResolver
 });
 module.exports = __toCommonJS(index_exports);
 
 // src/oyd-did-provider.ts
+var import_ssi_sdk_ext = require("@sphereon/ssi-sdk-ext.key-utils");
 var import_did_manager = require("@veramo/did-manager");
 var import_cross_fetch = __toESM(require("cross-fetch"), 1);
+var import_multibase = __toESM(require("multibase"), 1);
+var import_multicodec = __toESM(require("multicodec"), 1);
+var u8a = __toESM(require("uint8arrays"), 1);
 var import_debug = __toESM(require("debug"), 1);
 var debug = (0, import_debug.default)("veramo:oyd-did:identifier-provider");
+var OYDID_REGISTRAR_URL = "https://oydid-registrar.data-container.net/1.0/createIdentifier";
 var OydDIDProvider = class extends import_did_manager.AbstractIdentifierProvider {
   static {
     __name(this, "OydDIDProvider");
   }
   defaultKms;
+  cmsmCallbackOpts;
   constructor(options) {
     super();
-    this.defaultKms = options.defaultKms;
+    this.defaultKms = options?.defaultKms;
+    this.cmsmCallbackOpts = options?.clientManagedSecretMode;
   }
-  async createIdentifier({ kms, options }, context) {
+  async assertedKms(...kms) {
+    if (!kms || kms.length === 0) {
+      return Promise.reject(Error("KMS must be provided either as a parameter or via defaultKms."));
+    }
+    const result = kms.find((k) => !!k);
+    if (!result) {
+      return Promise.reject(Error("KMS must be provided either as a parameter or via defaultKms."));
+    }
+    return result;
+  }
+  async createIdentifier({ kms, alias, options }, context) {
+    const resolvedKms = await this.assertedKms(kms, this.defaultKms);
+    if (this.cmsmCallbackOpts && !options.cmsm || options.cmsm && options.cmsm.enabled !== false) {
+      if (!this.cmsmCallbackOpts) {
+        return Promise.reject(Error("did:oyd: no cmsm options defined on oyd did provider, but cmsm was enabled on the call!"));
+      }
+      return await this.createIdentifierWithCMSM({
+        kms: resolvedKms,
+        options
+      }, context);
+    }
     const body = {
-      options
+      options: {
+        cmsm: false,
+        key_type: options.type ?? "Secp256r1"
+      }
     };
-    const url = "https://oydid-registrar.data-container.net/1.0/createIdentifier";
     let didDoc;
     try {
-      const response = await (0, import_cross_fetch.default)(url, {
+      const response = await (0, import_cross_fetch.default)(OYDID_REGISTRAR_URL, {
         method: "POST",
         headers: {
           "Content-Type": "application/json"
@@ -66,21 +94,25 @@ var OydDIDProvider = class extends import_did_manager.AbstractIdentifierProvider
         body: JSON.stringify(body)
       });
       if (!response.ok) {
-        throw new Error("Network response was not ok: " + response.statusText);
+        debug("Error response from OydDID Registrar: ", response);
+        return Promise.reject(Error("Network response was not ok: " + response.statusText));
       }
       didDoc = await response.json();
     } catch (error) {
-      throw new Error("There has been a problem with the fetch operation: " + error.toString());
+      debug("Unexpected error from OydDID Registrar: ", error);
+      return Promise.reject(Error("There has been a problem with the fetch operation: " + error.toString()));
     }
-    const keyType = options?.keyType || "Ed25519";
-    const key = await this.holdKeys({
-      // @ts-ignore
-      kms: kms || this.defaultKms,
+    const keyType = options?.type ?? "Secp256r1";
+    const key = await (0, import_ssi_sdk_ext.importProvidedOrGeneratedKey)({
+      kms: resolvedKms,
+      alias: alias ?? options.alias ?? options.kid ?? `${didDoc.did}#key-doc`,
       options: {
-        keyType,
-        kid: didDoc.did + "#key-doc",
-        publicKeyHex: didDoc.keys[0].publicKeyHex,
-        privateKeyHex: didDoc.keys[0].privateKeyHex
+        key: {
+          kid: `${didDoc.did}#key-doc`,
+          type: keyType,
+          publicKeyHex: didDoc.keys[0].publicKeyHex,
+          privateKeyHex: didDoc.keys[0].privateKeyHex
+        }
       }
     }, context);
     const identifier = {
@@ -94,6 +126,96 @@ var OydDIDProvider = class extends import_did_manager.AbstractIdentifierProvider
     debug("Created", identifier.did);
     return identifier;
   }
+  async createIdentifierWithCMSM({ kms, options }, context) {
+    const cmsmCallbackOpts = this.cmsmCallbackOpts;
+    if (!cmsmCallbackOpts) {
+      return Promise.reject(Error("did:oyd: no cmsm options defined!"));
+    }
+    const assertedKms = await this.assertedKms(kms, this.defaultKms);
+    const pubKey = options.key ?? await cmsmCallbackOpts.publicKeyCallback(options.kid ?? "default", assertedKms, options.cmsm?.create !== false, options.type);
+    const kid = pubKey.kid;
+    const keyType = pubKey.type;
+    const key = base58btc({
+      publicKeyHex: pubKey.publicKeyHex,
+      keyType
+    });
+    console.log(`Bae58 pubkey key: ${key}`);
+    let signValue;
+    try {
+      const body_create = {
+        // specify the Identifier options for the registrar
+        key,
+        options: {
+          cmsm: true,
+          key_type: keyType
+        }
+      };
+      console.log(`Create request:
+${JSON.stringify(body_create, null, 2)}
+`);
+      const response = await (0, import_cross_fetch.default)(OYDID_REGISTRAR_URL, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(body_create)
+      });
+      if (!response.ok) {
+        debug("Error response from OydDID Registrar: ", body_create, response);
+        return Promise.reject(Error("Network response was not ok: " + response.statusText));
+      }
+      signValue = await response.json();
+      console.log(`Create response:
+${JSON.stringify(signValue, null, 2)}
+`);
+    } catch (error) {
+      console.log("Unexpected error from OydDID Registrar: ", error);
+      return Promise.reject(Error("There has been a problem with the fetch operation: " + error.toString()));
+    }
+    const { sign } = signValue;
+    const signature = await cmsmCallbackOpts.signCallback(kid, sign);
+    console.log(`Signature: ${signature}`);
+    const body_signed = {
+      key,
+      options: {
+        cmsm: true,
+        key_type: keyType,
+        sig: signature
+      }
+    };
+    console.log(`Signed request:
+${JSON.stringify(body_signed, null, 2)}
+`);
+    let didDoc;
+    try {
+      const response = await (0, import_cross_fetch.default)(OYDID_REGISTRAR_URL, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(body_signed)
+      });
+      if (!response.ok) {
+        console.log(`Error response from OydDID Registrar: ${JSON.stringify(response.text)}${response.statusText}`, response);
+        debug("Error response from OydDID Registrar: ", response);
+        return Promise.reject(Error("Network response was not ok: " + response.statusText));
+      }
+      didDoc = await response.json();
+    } catch (error) {
+      debug("Unexpected error from OydDID Registrar: ", error);
+      return Promise.reject(Error("There has been a problem with the fetch operation: " + error.toString()));
+    }
+    const identifier = {
+      did: didDoc.did,
+      controllerKeyId: pubKey.kid,
+      keys: [
+        pubKey
+      ],
+      services: []
+    };
+    debug("Created", identifier.did);
+    return identifier;
+  }
   async updateIdentifier(args, context) {
     throw new Error("OydDIDProvider updateIdentifier not supported yet.");
   }
@@ -125,33 +247,20 @@ var OydDIDProvider = class extends import_did_manager.AbstractIdentifierProvider
       success: true
     };
   }
-  async holdKeys(args, context) {
-    if (args.options.privateKeyHex) {
-      return context.agent.keyManagerImport({
-        // @ts-ignore
-        kms: args.kms || this.defaultKms,
-        type: args.options.keyType,
-        kid: args.options.kid,
-        privateKeyHex: args.options.privateKeyHex,
-        meta: {
-          algorithms: [
-            "Ed25519"
-          ]
-        }
-      });
-    }
-    return context.agent.keyManagerCreate({
-      type: args.options.keyType,
-      // @ts-ignore
-      kms: args.kms || this.defaultKms,
-      meta: {
-        algorithms: [
-          "Ed25519"
-        ]
-      }
-    });
-  }
 };
+var keyCodecs = {
+  RSA: "rsa-pub",
+  Ed25519: "ed25519-pub",
+  X25519: "x25519-pub",
+  Secp256k1: "secp256k1-pub",
+  Secp256r1: "p256-pub",
+  Bls12381G1: "bls12_381-g1-pub",
+  Bls12381G2: "bls12_381-g2-pub"
+};
+var base58btc = /* @__PURE__ */ __name(({ publicKeyHex, keyType = "Secp256r1" }) => {
+  const codecName = keyCodecs[keyType];
+  return u8a.toString(import_multibase.default.encode("base58btc", import_multicodec.default.addPrefix(codecName, u8a.fromString(publicKeyHex, "hex")))).toString();
+}, "base58btc");
 
 // src/resolver.ts
 var import_cross_fetch2 = __toESM(require("cross-fetch"), 1);
@@ -181,13 +290,4 @@ function getDidOydResolver() {
   };
 }
 __name(getDidOydResolver, "getDidOydResolver");
-
-// src/types/oyd-provider-types.ts
-var SupportedKeyTypes = /* @__PURE__ */ function(SupportedKeyTypes2) {
-  SupportedKeyTypes2["Secp256r1"] = "Secp256r1";
-  SupportedKeyTypes2["Secp256k1"] = "Secp256k1";
-  SupportedKeyTypes2["Ed25519"] = "Ed25519";
-  SupportedKeyTypes2["X25519"] = "X25519";
-  return SupportedKeyTypes2;
-}({});
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/oyd-did-provider.ts","../src/resolver.ts","../src/types/oyd-provider-types.ts"],"sourcesContent":["/**\n * Provides `did:oyd` {@link @ownyourdata/did-provider-oyd#OydDIDProvider | identifier provider } for the\n * {@link @veramo/did-manager#DIDManager}\n *\n * @packageDocumentation\n */\nexport { OydDIDProvider } from './oyd-did-provider.js'\nexport { getDidOydResolver } from './resolver.js'\nexport * from './types/oyd-provider-types.js'\n","import { IIdentifier, IKey, IService, IAgentContext, IKeyManager } from '@veramo/core'\nimport { AbstractIdentifierProvider } from '@veramo/did-manager'\nimport type { OydCreateIdentifierOptions, OydDidHoldKeysArgs, OydDidSupportedKeyTypes } from './types/oyd-provider-types.js'\nimport fetch from 'cross-fetch'\n\nimport Debug from 'debug'\nconst debug = Debug('veramo:oyd-did:identifier-provider')\n\ntype IContext = IAgentContext<IKeyManager>\n\n/**\n * {@link @veramo/did-manager#DIDManager} identifier provider for `did:oyd` identifiers\n * @public\n */\nexport class OydDIDProvider extends AbstractIdentifierProvider {\n  private defaultKms?: string\n\n  constructor(options: { defaultKms?: string }) {\n    super()\n    this.defaultKms = options.defaultKms\n  }\n\n  async createIdentifier(\n    { kms, options }: { kms?: string; options: OydCreateIdentifierOptions },\n    context: IContext\n  ): Promise<Omit<IIdentifier, 'provider'>> {\n    const body = { options }\n    const url = 'https://oydid-registrar.data-container.net/1.0/createIdentifier'\n\n    let didDoc: any | undefined\n    try {\n      const response = await fetch(url, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n        },\n        body: JSON.stringify(body),\n      })\n      if (!response.ok) {\n        throw new Error('Network response was not ok: ' + response.statusText)\n      }\n      didDoc = await response.json()\n    } catch (error) {\n      // @ts-ignore\n      throw new Error('There has been a problem with the fetch operation: ' + error.toString())\n    }\n\n    const keyType: OydDidSupportedKeyTypes = options?.keyType || 'Ed25519'\n    const key = await this.holdKeys(\n      {\n        // @ts-ignore\n        kms: kms || this.defaultKms,\n        options: {\n          keyType,\n          kid: didDoc.did + '#key-doc',\n          publicKeyHex: didDoc.keys[0].publicKeyHex,\n          privateKeyHex: didDoc.keys[0].privateKeyHex,\n        },\n      },\n      context\n    )\n\n    const identifier: Omit<IIdentifier, 'provider'> = {\n      did: didDoc.did,\n      controllerKeyId: key.kid,\n      keys: [key],\n      services: [],\n    }\n    debug('Created', identifier.did)\n    return identifier\n  }\n\n  async updateIdentifier(\n    args: { did: string; kms?: string | undefined; alias?: string | undefined; options?: any },\n    context: IAgentContext<IKeyManager>\n  ): Promise<IIdentifier> {\n    throw new Error('OydDIDProvider updateIdentifier not supported yet.')\n  }\n\n  async deleteIdentifier(identifier: IIdentifier, context: IContext): Promise<boolean> {\n    for (const { kid } of identifier.keys) {\n      await context.agent.keyManagerDelete({ kid })\n    }\n    return true\n  }\n\n  async addKey({ identifier, key, options }: { identifier: IIdentifier; key: IKey; options?: any }, context: IContext): Promise<any> {\n    return { success: true }\n  }\n\n  async addService({ identifier, service, options }: { identifier: IIdentifier; service: IService; options?: any }, context: IContext): Promise<any> {\n    return { success: true }\n  }\n\n  async removeKey(args: { identifier: IIdentifier; kid: string; options?: any }, context: IContext): Promise<any> {\n    return { success: true }\n  }\n\n  async removeService(args: { identifier: IIdentifier; id: string; options?: any }, context: IContext): Promise<any> {\n    return { success: true }\n  }\n\n  private async holdKeys(args: OydDidHoldKeysArgs, context: IContext): Promise<IKey> {\n    if (args.options.privateKeyHex) {\n      return context.agent.keyManagerImport({\n        // @ts-ignore\n        kms: args.kms || this.defaultKms,\n        type: args.options.keyType,\n        kid: args.options.kid,\n        privateKeyHex: args.options.privateKeyHex,\n        meta: {\n          algorithms: ['Ed25519'],\n        },\n      })\n    }\n    return context.agent.keyManagerCreate({\n      type: args.options.keyType,\n      // @ts-ignore\n      kms: args.kms || this.defaultKms,\n      meta: {\n        algorithms: ['Ed25519'],\n      },\n    })\n  }\n}\n","import { DIDResolutionOptions, DIDResolutionResult, DIDResolver, ParsedDID, Resolvable } from 'did-resolver'\nimport fetch from 'cross-fetch'\n\nconst resolveDidOyd: DIDResolver = async (\n  didUrl: string,\n  _parsed: ParsedDID,\n  _resolver: Resolvable,\n  options: DIDResolutionOptions\n): Promise<DIDResolutionResult> => {\n  try {\n    const baseUrl: string = 'https://oydid-resolver.data-container.net'\n    // const didDoc = await axios.get(`${baseUrl}/1.0/identifiers/${didUrl}`);\n    const response = await fetch(`${baseUrl}/1.0/identifiers/${didUrl}`)\n    if (!response.ok) {\n      throw new Error('Network response was not ok: ' + response.statusText)\n    }\n    const didDoc = await response.json()\n    return didDoc as DIDResolutionResult\n  } catch (err: any) {\n    return {\n      didDocumentMetadata: {},\n      didResolutionMetadata: { error: 'invalidDid', message: err.toString() },\n      didDocument: null,\n    }\n  }\n}\n\n/**\n * Provides a mapping to a did:oyd resolver, usable by {@link did-resolver#Resolver}.\n *\n * @public\n */\nexport function getDidOydResolver() {\n  return { oyd: resolveDidOyd }\n}\n","export type OydCreateIdentifierOptions = {\n  keyType?: OydDidSupportedKeyTypes\n  privateKeyHex?: string\n  keyUse?: KeyUse\n}\n\nexport type OydDidHoldKeysArgs = {\n  kms: string\n  options: HoldKeysOpts\n}\n\ntype HoldKeysOpts = {\n  keyType: OydDidSupportedKeyTypes\n  kid: string\n  publicKeyHex?: string\n  privateKeyHex?: string\n}\n\nexport enum SupportedKeyTypes {\n  Secp256r1 = 'Secp256r1',\n  Secp256k1 = 'Secp256k1',\n  Ed25519 = 'Ed25519',\n  X25519 = 'X25519',\n}\n\nexport type OydDidSupportedKeyTypes = keyof typeof SupportedKeyTypes\n\nexport type KeyUse = 'sig' | 'enc'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;ACCA,yBAA2C;AAE3C,yBAAkB;AAElB,mBAAkB;AAClB,IAAMA,YAAQC,aAAAA,SAAM,oCAAA;AAQb,IAAMC,iBAAN,cAA6BC,8CAAAA;EAbpC,OAaoCA;;;EAC1BC;EAERC,YAAYC,SAAkC;AAC5C,UAAK;AACL,SAAKF,aAAaE,QAAQF;EAC5B;EAEA,MAAMG,iBACJ,EAAEC,KAAKF,QAAO,GACdG,SACwC;AACxC,UAAMC,OAAO;MAAEJ;IAAQ;AACvB,UAAMK,MAAM;AAEZ,QAAIC;AACJ,QAAI;AACF,YAAMC,WAAW,UAAMC,mBAAAA,SAAMH,KAAK;QAChCI,QAAQ;QACRC,SAAS;UACP,gBAAgB;QAClB;QACAN,MAAMO,KAAKC,UAAUR,IAAAA;MACvB,CAAA;AACA,UAAI,CAACG,SAASM,IAAI;AAChB,cAAM,IAAIC,MAAM,kCAAkCP,SAASQ,UAAU;MACvE;AACAT,eAAS,MAAMC,SAASS,KAAI;IAC9B,SAASC,OAAO;AAEd,YAAM,IAAIH,MAAM,wDAAwDG,MAAMC,SAAQ,CAAA;IACxF;AAEA,UAAMC,UAAmCnB,SAASmB,WAAW;AAC7D,UAAMC,MAAM,MAAM,KAAKC,SACrB;;MAEEnB,KAAKA,OAAO,KAAKJ;MACjBE,SAAS;QACPmB;QACAG,KAAKhB,OAAOiB,MAAM;QAClBC,cAAclB,OAAOmB,KAAK,CAAA,EAAGD;QAC7BE,eAAepB,OAAOmB,KAAK,CAAA,EAAGC;MAChC;IACF,GACAvB,OAAAA;AAGF,UAAMwB,aAA4C;MAChDJ,KAAKjB,OAAOiB;MACZK,iBAAiBR,IAAIE;MACrBG,MAAM;QAACL;;MACPS,UAAU,CAAA;IACZ;AACAnC,UAAM,WAAWiC,WAAWJ,GAAG;AAC/B,WAAOI;EACT;EAEA,MAAMG,iBACJC,MACA5B,SACsB;AACtB,UAAM,IAAIW,MAAM,oDAAA;EAClB;EAEA,MAAMkB,iBAAiBL,YAAyBxB,SAAqC;AACnF,eAAW,EAAEmB,IAAG,KAAMK,WAAWF,MAAM;AACrC,YAAMtB,QAAQ8B,MAAMC,iBAAiB;QAAEZ;MAAI,CAAA;IAC7C;AACA,WAAO;EACT;EAEA,MAAMa,OAAO,EAAER,YAAYP,KAAKpB,QAAO,GAA2DG,SAAiC;AACjI,WAAO;MAAEiC,SAAS;IAAK;EACzB;EAEA,MAAMC,WAAW,EAAEV,YAAYW,SAAStC,QAAO,GAAmEG,SAAiC;AACjJ,WAAO;MAAEiC,SAAS;IAAK;EACzB;EAEA,MAAMG,UAAUR,MAA+D5B,SAAiC;AAC9G,WAAO;MAAEiC,SAAS;IAAK;EACzB;EAEA,MAAMI,cAAcT,MAA8D5B,SAAiC;AACjH,WAAO;MAAEiC,SAAS;IAAK;EACzB;EAEA,MAAcf,SAASU,MAA0B5B,SAAkC;AACjF,QAAI4B,KAAK/B,QAAQ0B,eAAe;AAC9B,aAAOvB,QAAQ8B,MAAMQ,iBAAiB;;QAEpCvC,KAAK6B,KAAK7B,OAAO,KAAKJ;QACtB4C,MAAMX,KAAK/B,QAAQmB;QACnBG,KAAKS,KAAK/B,QAAQsB;QAClBI,eAAeK,KAAK/B,QAAQ0B;QAC5BiB,MAAM;UACJC,YAAY;YAAC;;QACf;MACF,CAAA;IACF;AACA,WAAOzC,QAAQ8B,MAAMY,iBAAiB;MACpCH,MAAMX,KAAK/B,QAAQmB;;MAEnBjB,KAAK6B,KAAK7B,OAAO,KAAKJ;MACtB6C,MAAM;QACJC,YAAY;UAAC;;MACf;IACF,CAAA;EACF;AACF;;;AC3HA,IAAAE,sBAAkB;AAElB,IAAMC,gBAA6B,8BACjCC,QACAC,SACAC,WACAC,YAAAA;AAEA,MAAI;AACF,UAAMC,UAAkB;AAExB,UAAMC,WAAW,UAAMC,oBAAAA,SAAM,GAAGF,OAAAA,oBAA2BJ,MAAAA,EAAQ;AACnE,QAAI,CAACK,SAASE,IAAI;AAChB,YAAM,IAAIC,MAAM,kCAAkCH,SAASI,UAAU;IACvE;AACA,UAAMC,SAAS,MAAML,SAASM,KAAI;AAClC,WAAOD;EACT,SAASE,KAAU;AACjB,WAAO;MACLC,qBAAqB,CAAC;MACtBC,uBAAuB;QAAEC,OAAO;QAAcC,SAASJ,IAAIK,SAAQ;MAAG;MACtEC,aAAa;IACf;EACF;AACF,GAtBmC;AA6B5B,SAASC,oBAAAA;AACd,SAAO;IAAEC,KAAKrB;EAAc;AAC9B;AAFgBoB;;;ACdT,IAAKE,oBAAAA,yBAAAA,oBAAAA;;;;;SAAAA;;","names":["debug","Debug","OydDIDProvider","AbstractIdentifierProvider","defaultKms","constructor","options","createIdentifier","kms","context","body","url","didDoc","response","fetch","method","headers","JSON","stringify","ok","Error","statusText","json","error","toString","keyType","key","holdKeys","kid","did","publicKeyHex","keys","privateKeyHex","identifier","controllerKeyId","services","updateIdentifier","args","deleteIdentifier","agent","keyManagerDelete","addKey","success","addService","service","removeKey","removeService","keyManagerImport","type","meta","algorithms","keyManagerCreate","import_cross_fetch","resolveDidOyd","didUrl","_parsed","_resolver","options","baseUrl","response","fetch","ok","Error","statusText","didDoc","json","err","didDocumentMetadata","didResolutionMetadata","error","message","toString","didDocument","getDidOydResolver","oyd","SupportedKeyTypes"]}
+{"version":3,"sources":["../src/index.ts","../src/oyd-did-provider.ts","../src/resolver.ts"],"sourcesContent":["/**\n * Provides `did:oyd` {@link @ownyourdata/did-provider-oyd#OydDIDProvider | identifier provider } for the\n * {@link @veramo/did-manager#DIDManager}\n *\n * @packageDocumentation\n */\nexport { OydDIDProvider } from './oyd-did-provider'\nexport { getDidOydResolver } from './resolver'\nexport type * from './types/oyd-provider-types'\n","import { importProvidedOrGeneratedKey } from '@sphereon/ssi-sdk-ext.key-utils'\nimport { IAgentContext, IIdentifier, IKey, IKeyManager, IService, TKeyType } from '@veramo/core'\nimport { AbstractIdentifierProvider } from '@veramo/did-manager'\nimport { KeyManager } from '@veramo/key-manager'\nimport fetch from 'cross-fetch'\nimport Multibase from 'multibase'\nimport Multicodec from 'multicodec'\n\n// @ts-ignore\nimport * as u8a from 'uint8arrays'\n\nimport Debug from 'debug'\nimport type {\n  CMSMCallbackOpts,\n  OydConstructorOptions,\n  OydCreateIdentifierOptions,\n  // OydDidHoldKeysArgs,\n  OydDidSupportedKeyTypes,\n} from './types/oyd-provider-types'\n\nconst debug = Debug('veramo:oyd-did:identifier-provider')\nconst OYDID_REGISTRAR_URL = 'https://oydid-registrar.data-container.net/1.0/createIdentifier'\n\ntype IContext = IAgentContext<IKeyManager>\n\n/**\n * {@link @veramo/did-manager#DIDManager} identifier provider for `did:oyd` identifiers\n * @public\n */\nexport class OydDIDProvider extends AbstractIdentifierProvider {\n  private readonly defaultKms?: string\n  private readonly cmsmCallbackOpts?: CMSMCallbackOpts\n\n  constructor(options?: OydConstructorOptions) {\n    super()\n    this.defaultKms = options?.defaultKms\n    this.cmsmCallbackOpts = options?.clientManagedSecretMode\n  }\n\n  private async assertedKms(...kms: (string | undefined)[]): Promise<string> {\n    if (!kms || kms.length === 0) {\n      return Promise.reject(Error('KMS must be provided either as a parameter or via defaultKms.'))\n    }\n    const result = kms.find((k) => !!k)\n    if (!result) {\n      return Promise.reject(Error('KMS must be provided either as a parameter or via defaultKms.'))\n    }\n    return result\n  }\n\n  async createIdentifier(\n    { kms, alias, options }: { kms?: string; alias?: string; options: OydCreateIdentifierOptions },\n    context: IContext\n  ): Promise<Omit<IIdentifier, 'provider'>> {\n    const resolvedKms = await this.assertedKms(kms, this.defaultKms)\n\n    if ((this.cmsmCallbackOpts && !options.cmsm) || (options.cmsm && options.cmsm.enabled !== false)) {\n      if (!this.cmsmCallbackOpts) {\n        return Promise.reject(Error('did:oyd: no cmsm options defined on oyd did provider, but cmsm was enabled on the call!'))\n      }\n      return await this.createIdentifierWithCMSM({ kms: resolvedKms, options }, context)\n    }\n\n    const body = {\n      options: {\n        cmsm: false,\n        key_type: options.type ?? 'Secp256r1',\n      },\n    }\n    let didDoc: any | undefined\n    try {\n      const response = await fetch(OYDID_REGISTRAR_URL, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n        },\n        body: JSON.stringify(body),\n      })\n      if (!response.ok) {\n        debug('Error response from OydDID Registrar: ', response)\n        return Promise.reject(Error('Network response was not ok: ' + response.statusText))\n      }\n      didDoc = await response.json()\n    } catch (error: any) {\n      debug('Unexpected error from OydDID Registrar: ', error)\n      return Promise.reject(Error('There has been a problem with the fetch operation: ' + error.toString()))\n    }\n\n    const keyType: OydDidSupportedKeyTypes = options?.type ?? 'Secp256r1'\n    const key = await importProvidedOrGeneratedKey(\n      {\n        kms: resolvedKms,\n        alias: alias ?? options.alias ?? options.kid ?? `${didDoc.did}#key-doc`,\n        options: {\n          key: {\n            kid: `${didDoc.did}#key-doc`,\n            type: keyType,\n            publicKeyHex: didDoc.keys[0].publicKeyHex,\n            privateKeyHex: didDoc.keys[0].privateKeyHex,\n          },\n        },\n      },\n      context\n    )\n\n    const identifier: Omit<IIdentifier, 'provider'> = {\n      did: didDoc.did,\n      controllerKeyId: key.kid,\n      keys: [key],\n      services: [],\n    }\n    debug('Created', identifier.did)\n    return identifier\n  }\n\n  async createIdentifierWithCMSM(\n    { kms, options }: { kms?: string; options: OydCreateIdentifierOptions },\n    context: IContext\n  ): Promise<Omit<IIdentifier, 'provider'>> {\n    const cmsmCallbackOpts = this.cmsmCallbackOpts\n    if (!cmsmCallbackOpts) {\n      return Promise.reject(Error('did:oyd: no cmsm options defined!'))\n    }\n\n    const assertedKms = await this.assertedKms(kms, this.defaultKms)\n    const pubKey =\n      options.key ?? (await cmsmCallbackOpts.publicKeyCallback(options.kid ?? 'default', assertedKms, options.cmsm?.create !== false, options.type)) // \"default\" is probably not right, TODO!!\n    const kid = pubKey.kid\n    const keyType = pubKey.type\n    const key = base58btc({ publicKeyHex: pubKey.publicKeyHex, keyType })\n\n    console.log(`Bae58 pubkey key: ${key}`)\n    let signValue: any | undefined // do the request\n    try {\n      const body_create = {\n        // specify the Identifier options for the registrar\n        key: key,\n        options: {\n          cmsm: true,\n          key_type: keyType,\n        },\n      }\n      console.log(`Create request:\\n${JSON.stringify(body_create, null, 2)}\\n`)\n      const response = await fetch(OYDID_REGISTRAR_URL, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n        },\n        body: JSON.stringify(body_create),\n      })\n      if (!response.ok) {\n        debug('Error response from OydDID Registrar: ', body_create, response)\n        return Promise.reject(Error('Network response was not ok: ' + response.statusText))\n      }\n      signValue = await response.json()\n      console.log(`Create response:\\n${JSON.stringify(signValue, null, 2)}\\n`)\n    } catch (error: any) {\n      console.log('Unexpected error from OydDID Registrar: ', error)\n      return Promise.reject(Error('There has been a problem with the fetch operation: ' + error.toString()))\n    }\n\n    // we received our value to sign, now we sign it!\n    const { sign } = signValue\n    const signature = await cmsmCallbackOpts.signCallback(kid, sign)\n\n    console.log(`Signature: ${signature}`)\n\n    const body_signed = {\n      key,\n      options: {\n        cmsm: true,\n        key_type: keyType,\n        sig: signature,\n      },\n    }\n    console.log(`Signed request:\\n${JSON.stringify(body_signed, null, 2)}\\n`)\n\n    // Object.assign(body_signed.options, options)\n\n    let didDoc: any | undefined // do the request\n    try {\n      const response = await fetch(OYDID_REGISTRAR_URL, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n        },\n        body: JSON.stringify(body_signed),\n      })\n      if (!response.ok) {\n        console.log(`Error response from OydDID Registrar: ${JSON.stringify(response.text)}${response.statusText}`, response)\n        debug('Error response from OydDID Registrar: ', response)\n        return Promise.reject(Error('Network response was not ok: ' + response.statusText))\n      }\n      didDoc = await response.json()\n    } catch (error: any) {\n      debug('Unexpected error from OydDID Registrar: ', error)\n      return Promise.reject(Error('There has been a problem with the fetch operation: ' + error.toString()))\n    }\n\n    const identifier: Omit<IIdentifier, 'provider'> = {\n      did: didDoc.did,\n      controllerKeyId: pubKey.kid,\n      keys: [pubKey],\n      services: [],\n    }\n    debug('Created', identifier.did)\n    return identifier\n  }\n\n  async updateIdentifier(\n    args: { did: string; kms?: string | undefined; alias?: string | undefined; options?: any },\n    context: IAgentContext<IKeyManager>\n  ): Promise<IIdentifier> {\n    throw new Error('OydDIDProvider updateIdentifier not supported yet.')\n  }\n\n  async deleteIdentifier(identifier: IIdentifier, context: IContext): Promise<boolean> {\n    for (const { kid } of identifier.keys) {\n      await context.agent.keyManagerDelete({ kid })\n    }\n    return true\n  }\n\n  async addKey({ identifier, key, options }: { identifier: IIdentifier; key: IKey; options?: any }, context: IContext): Promise<any> {\n    return { success: true }\n  }\n\n  async addService({ identifier, service, options }: { identifier: IIdentifier; service: IService; options?: any }, context: IContext): Promise<any> {\n    return { success: true }\n  }\n\n  async removeKey(args: { identifier: IIdentifier; kid: string; options?: any }, context: IContext): Promise<any> {\n    return { success: true }\n  }\n\n  async removeService(args: { identifier: IIdentifier; id: string; options?: any }, context: IContext): Promise<any> {\n    return { success: true }\n  }\n}\n\nconst keyCodecs = {\n  RSA: 'rsa-pub',\n  Ed25519: 'ed25519-pub',\n  X25519: 'x25519-pub',\n  Secp256k1: 'secp256k1-pub',\n  Secp256r1: 'p256-pub',\n  Bls12381G1: 'bls12_381-g1-pub',\n  Bls12381G2: 'bls12_381-g2-pub',\n} as const\n\nconst base58btc = ({ publicKeyHex, keyType = 'Secp256r1' }: { publicKeyHex: string; keyType?: TKeyType }): string => {\n  const codecName = keyCodecs[keyType]\n\n  // methodSpecificId  = bytesToMultibase({bytes: u8a.fromString(key.publicKeyHex, 'hex'), codecName})\n  return u8a\n    .toString(Multibase.encode('base58btc', Multicodec.addPrefix(codecName as Multicodec.CodecName, u8a.fromString(publicKeyHex, 'hex'))))\n    .toString()\n}\n\nexport function defaultOydCmsmPublicKeyCallback(\n  keyManager: KeyManager\n): (kid: string, kms?: string, create?: boolean, createKeyType?: TKeyType) => Promise<IKey> {\n  return async (kid: string, kms?: string, create?: boolean, createKeyType?: TKeyType): Promise<IKey> => {\n    try {\n      const existing = await keyManager.keyManagerGet({ kid })\n      if (existing) {\n        return existing\n      }\n    } catch (error: any) {}\n    if (create) {\n      if (!kms) {\n        return Promise.reject(Error('No KMS provided, whilst creating a new key!'))\n      }\n      const alias = kid ?? `oyd-${new Date().toISOString()}`\n\n      const agent = keyManager\n      const key = await importProvidedOrGeneratedKey(\n        {\n          kms,\n          alias,\n          options: {\n            key: {\n              type: createKeyType ?? 'Secp256r1',\n            },\n          },\n        },\n        {\n          //@ts-ignore\n          agent,\n        }\n      )\n      return key\n\n      // return await keyManager.keyManagerCreate({ kms, type: createKeyType ?? 'Secp256r1' })\n    }\n    return Promise.reject(Error('No existing key found, and create is false!'))\n  }\n}\n\nexport function defaultOydCmsmSignCallback(keyManager: KeyManager): (kid: string, data: string) => Promise<string> {\n  return async (kid: string, data: string): Promise<string> => {\n    return keyManager.keyManagerSign({ keyRef: kid, data, encoding: 'utf-8' })\n  }\n}\n\nexport class DefaultOydCmsmCallbacks implements CMSMCallbackOpts {\n  private readonly keyManager: KeyManager\n\n  constructor(keyManager: KeyManager) {\n    this.keyManager = keyManager\n  }\n\n  publicKeyCallback(kid: string, kms?: string, create?: boolean, createKeyType?: TKeyType): Promise<IKey> {\n    return defaultOydCmsmPublicKeyCallback(this.keyManager)(kid, kms, create, createKeyType)\n  }\n\n  signCallback(kid: string, value: string): Promise<string> {\n    return defaultOydCmsmSignCallback(this.keyManager)(kid, value)\n  }\n}\n","import { DIDResolutionOptions, DIDResolutionResult, DIDResolver, ParsedDID, Resolvable } from 'did-resolver'\nimport fetch from 'cross-fetch'\n\nconst resolveDidOyd: DIDResolver = async (\n  didUrl: string,\n  _parsed: ParsedDID,\n  _resolver: Resolvable,\n  options: DIDResolutionOptions\n): Promise<DIDResolutionResult> => {\n  try {\n    const baseUrl: string = 'https://oydid-resolver.data-container.net'\n    // const didDoc = await axios.get(`${baseUrl}/1.0/identifiers/${didUrl}`);\n    const response = await fetch(`${baseUrl}/1.0/identifiers/${didUrl}`)\n    if (!response.ok) {\n      throw new Error('Network response was not ok: ' + response.statusText)\n    }\n    const didDoc = await response.json()\n    return didDoc as DIDResolutionResult\n  } catch (err: any) {\n    return {\n      didDocumentMetadata: {},\n      didResolutionMetadata: { error: 'invalidDid', message: err.toString() },\n      didDocument: null,\n    }\n  }\n}\n\n/**\n * Provides a mapping to a did:oyd resolver, usable by {@link did-resolver#Resolver}.\n *\n * @public\n */\nexport function getDidOydResolver() {\n  return { oyd: resolveDidOyd }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;ACAA,yBAA6C;AAE7C,yBAA2C;AAE3C,yBAAkB;AAClB,uBAAsB;AACtB,wBAAuB;AAGvB,UAAqB;AAErB,mBAAkB;AASlB,IAAMA,YAAQC,aAAAA,SAAM,oCAAA;AACpB,IAAMC,sBAAsB;AAQrB,IAAMC,iBAAN,cAA6BC,8CAAAA;EA7BpC,OA6BoCA;;;EACjBC;EACAC;EAEjBC,YAAYC,SAAiC;AAC3C,UAAK;AACL,SAAKH,aAAaG,SAASH;AAC3B,SAAKC,mBAAmBE,SAASC;EACnC;EAEA,MAAcC,eAAeC,KAA8C;AACzE,QAAI,CAACA,OAAOA,IAAIC,WAAW,GAAG;AAC5B,aAAOC,QAAQC,OAAOC,MAAM,+DAAA,CAAA;IAC9B;AACA,UAAMC,SAASL,IAAIM,KAAK,CAACC,MAAM,CAAC,CAACA,CAAAA;AACjC,QAAI,CAACF,QAAQ;AACX,aAAOH,QAAQC,OAAOC,MAAM,+DAAA,CAAA;IAC9B;AACA,WAAOC;EACT;EAEA,MAAMG,iBACJ,EAAER,KAAKS,OAAOZ,QAAO,GACrBa,SACwC;AACxC,UAAMC,cAAc,MAAM,KAAKZ,YAAYC,KAAK,KAAKN,UAAU;AAE/D,QAAK,KAAKC,oBAAoB,CAACE,QAAQe,QAAUf,QAAQe,QAAQf,QAAQe,KAAKC,YAAY,OAAQ;AAChG,UAAI,CAAC,KAAKlB,kBAAkB;AAC1B,eAAOO,QAAQC,OAAOC,MAAM,yFAAA,CAAA;MAC9B;AACA,aAAO,MAAM,KAAKU,yBAAyB;QAAEd,KAAKW;QAAad;MAAQ,GAAGa,OAAAA;IAC5E;AAEA,UAAMK,OAAO;MACXlB,SAAS;QACPe,MAAM;QACNI,UAAUnB,QAAQoB,QAAQ;MAC5B;IACF;AACA,QAAIC;AACJ,QAAI;AACF,YAAMC,WAAW,UAAMC,mBAAAA,SAAM7B,qBAAqB;QAChD8B,QAAQ;QACRC,SAAS;UACP,gBAAgB;QAClB;QACAP,MAAMQ,KAAKC,UAAUT,IAAAA;MACvB,CAAA;AACA,UAAI,CAACI,SAASM,IAAI;AAChBpC,cAAM,0CAA0C8B,QAAAA;AAChD,eAAOjB,QAAQC,OAAOC,MAAM,kCAAkCe,SAASO,UAAU,CAAA;MACnF;AACAR,eAAS,MAAMC,SAASQ,KAAI;IAC9B,SAASC,OAAY;AACnBvC,YAAM,4CAA4CuC,KAAAA;AAClD,aAAO1B,QAAQC,OAAOC,MAAM,wDAAwDwB,MAAMC,SAAQ,CAAA,CAAA;IACpG;AAEA,UAAMC,UAAmCjC,SAASoB,QAAQ;AAC1D,UAAMc,MAAM,UAAMC,iDAChB;MACEhC,KAAKW;MACLF,OAAOA,SAASZ,QAAQY,SAASZ,QAAQoC,OAAO,GAAGf,OAAOgB,GAAG;MAC7DrC,SAAS;QACPkC,KAAK;UACHE,KAAK,GAAGf,OAAOgB,GAAG;UAClBjB,MAAMa;UACNK,cAAcjB,OAAOkB,KAAK,CAAA,EAAGD;UAC7BE,eAAenB,OAAOkB,KAAK,CAAA,EAAGC;QAChC;MACF;IACF,GACA3B,OAAAA;AAGF,UAAM4B,aAA4C;MAChDJ,KAAKhB,OAAOgB;MACZK,iBAAiBR,IAAIE;MACrBG,MAAM;QAACL;;MACPS,UAAU,CAAA;IACZ;AACAnD,UAAM,WAAWiD,WAAWJ,GAAG;AAC/B,WAAOI;EACT;EAEA,MAAMxB,yBACJ,EAAEd,KAAKH,QAAO,GACda,SACwC;AACxC,UAAMf,mBAAmB,KAAKA;AAC9B,QAAI,CAACA,kBAAkB;AACrB,aAAOO,QAAQC,OAAOC,MAAM,mCAAA,CAAA;IAC9B;AAEA,UAAML,cAAc,MAAM,KAAKA,YAAYC,KAAK,KAAKN,UAAU;AAC/D,UAAM+C,SACJ5C,QAAQkC,OAAQ,MAAMpC,iBAAiB+C,kBAAkB7C,QAAQoC,OAAO,WAAWlC,aAAaF,QAAQe,MAAM+B,WAAW,OAAO9C,QAAQoB,IAAI;AAC9I,UAAMgB,MAAMQ,OAAOR;AACnB,UAAMH,UAAUW,OAAOxB;AACvB,UAAMc,MAAMa,UAAU;MAAET,cAAcM,OAAON;MAAcL;IAAQ,CAAA;AAEnEe,YAAQC,IAAI,qBAAqBf,GAAAA,EAAK;AACtC,QAAIgB;AACJ,QAAI;AACF,YAAMC,cAAc;;QAElBjB;QACAlC,SAAS;UACPe,MAAM;UACNI,UAAUc;QACZ;MACF;AACAe,cAAQC,IAAI;EAAoBvB,KAAKC,UAAUwB,aAAa,MAAM,CAAA,CAAA;CAAM;AACxE,YAAM7B,WAAW,UAAMC,mBAAAA,SAAM7B,qBAAqB;QAChD8B,QAAQ;QACRC,SAAS;UACP,gBAAgB;QAClB;QACAP,MAAMQ,KAAKC,UAAUwB,WAAAA;MACvB,CAAA;AACA,UAAI,CAAC7B,SAASM,IAAI;AAChBpC,cAAM,0CAA0C2D,aAAa7B,QAAAA;AAC7D,eAAOjB,QAAQC,OAAOC,MAAM,kCAAkCe,SAASO,UAAU,CAAA;MACnF;AACAqB,kBAAY,MAAM5B,SAASQ,KAAI;AAC/BkB,cAAQC,IAAI;EAAqBvB,KAAKC,UAAUuB,WAAW,MAAM,CAAA,CAAA;CAAM;IACzE,SAASnB,OAAY;AACnBiB,cAAQC,IAAI,4CAA4ClB,KAAAA;AACxD,aAAO1B,QAAQC,OAAOC,MAAM,wDAAwDwB,MAAMC,SAAQ,CAAA,CAAA;IACpG;AAGA,UAAM,EAAEoB,KAAI,IAAKF;AACjB,UAAMG,YAAY,MAAMvD,iBAAiBwD,aAAalB,KAAKgB,IAAAA;AAE3DJ,YAAQC,IAAI,cAAcI,SAAAA,EAAW;AAErC,UAAME,cAAc;MAClBrB;MACAlC,SAAS;QACPe,MAAM;QACNI,UAAUc;QACVuB,KAAKH;MACP;IACF;AACAL,YAAQC,IAAI;EAAoBvB,KAAKC,UAAU4B,aAAa,MAAM,CAAA,CAAA;CAAM;AAIxE,QAAIlC;AACJ,QAAI;AACF,YAAMC,WAAW,UAAMC,mBAAAA,SAAM7B,qBAAqB;QAChD8B,QAAQ;QACRC,SAAS;UACP,gBAAgB;QAClB;QACAP,MAAMQ,KAAKC,UAAU4B,WAAAA;MACvB,CAAA;AACA,UAAI,CAACjC,SAASM,IAAI;AAChBoB,gBAAQC,IAAI,yCAAyCvB,KAAKC,UAAUL,SAASmC,IAAI,CAAA,GAAInC,SAASO,UAAU,IAAIP,QAAAA;AAC5G9B,cAAM,0CAA0C8B,QAAAA;AAChD,eAAOjB,QAAQC,OAAOC,MAAM,kCAAkCe,SAASO,UAAU,CAAA;MACnF;AACAR,eAAS,MAAMC,SAASQ,KAAI;IAC9B,SAASC,OAAY;AACnBvC,YAAM,4CAA4CuC,KAAAA;AAClD,aAAO1B,QAAQC,OAAOC,MAAM,wDAAwDwB,MAAMC,SAAQ,CAAA,CAAA;IACpG;AAEA,UAAMS,aAA4C;MAChDJ,KAAKhB,OAAOgB;MACZK,iBAAiBE,OAAOR;MACxBG,MAAM;QAACK;;MACPD,UAAU,CAAA;IACZ;AACAnD,UAAM,WAAWiD,WAAWJ,GAAG;AAC/B,WAAOI;EACT;EAEA,MAAMiB,iBACJC,MACA9C,SACsB;AACtB,UAAM,IAAIN,MAAM,oDAAA;EAClB;EAEA,MAAMqD,iBAAiBnB,YAAyB5B,SAAqC;AACnF,eAAW,EAAEuB,IAAG,KAAMK,WAAWF,MAAM;AACrC,YAAM1B,QAAQgD,MAAMC,iBAAiB;QAAE1B;MAAI,CAAA;IAC7C;AACA,WAAO;EACT;EAEA,MAAM2B,OAAO,EAAEtB,YAAYP,KAAKlC,QAAO,GAA2Da,SAAiC;AACjI,WAAO;MAAEmD,SAAS;IAAK;EACzB;EAEA,MAAMC,WAAW,EAAExB,YAAYyB,SAASlE,QAAO,GAAmEa,SAAiC;AACjJ,WAAO;MAAEmD,SAAS;IAAK;EACzB;EAEA,MAAMG,UAAUR,MAA+D9C,SAAiC;AAC9G,WAAO;MAAEmD,SAAS;IAAK;EACzB;EAEA,MAAMI,cAAcT,MAA8D9C,SAAiC;AACjH,WAAO;MAAEmD,SAAS;IAAK;EACzB;AACF;AAEA,IAAMK,YAAY;EAChBC,KAAK;EACLC,SAAS;EACTC,QAAQ;EACRC,WAAW;EACXC,WAAW;EACXC,YAAY;EACZC,YAAY;AACd;AAEA,IAAM7B,YAAY,wBAAC,EAAET,cAAcL,UAAU,YAAW,MAAgD;AACtG,QAAM4C,YAAYR,UAAUpC,OAAAA;AAG5B,SACGD,aAAS8C,iBAAAA,QAAUC,OAAO,aAAaC,kBAAAA,QAAWC,UAAUJ,WAAuCK,eAAW5C,cAAc,KAAA,CAAA,CAAA,CAAA,EAC5HN,SAAQ;AACb,GAPkB;;;ACzPlB,IAAAmD,sBAAkB;AAElB,IAAMC,gBAA6B,8BACjCC,QACAC,SACAC,WACAC,YAAAA;AAEA,MAAI;AACF,UAAMC,UAAkB;AAExB,UAAMC,WAAW,UAAMC,oBAAAA,SAAM,GAAGF,OAAAA,oBAA2BJ,MAAAA,EAAQ;AACnE,QAAI,CAACK,SAASE,IAAI;AAChB,YAAM,IAAIC,MAAM,kCAAkCH,SAASI,UAAU;IACvE;AACA,UAAMC,SAAS,MAAML,SAASM,KAAI;AAClC,WAAOD;EACT,SAASE,KAAU;AACjB,WAAO;MACLC,qBAAqB,CAAC;MACtBC,uBAAuB;QAAEC,OAAO;QAAcC,SAASJ,IAAIK,SAAQ;MAAG;MACtEC,aAAa;IACf;EACF;AACF,GAtBmC;AA6B5B,SAASC,oBAAAA;AACd,SAAO;IAAEC,KAAKrB;EAAc;AAC9B;AAFgBoB;","names":["debug","Debug","OYDID_REGISTRAR_URL","OydDIDProvider","AbstractIdentifierProvider","defaultKms","cmsmCallbackOpts","constructor","options","clientManagedSecretMode","assertedKms","kms","length","Promise","reject","Error","result","find","k","createIdentifier","alias","context","resolvedKms","cmsm","enabled","createIdentifierWithCMSM","body","key_type","type","didDoc","response","fetch","method","headers","JSON","stringify","ok","statusText","json","error","toString","keyType","key","importProvidedOrGeneratedKey","kid","did","publicKeyHex","keys","privateKeyHex","identifier","controllerKeyId","services","pubKey","publicKeyCallback","create","base58btc","console","log","signValue","body_create","sign","signature","signCallback","body_signed","sig","text","updateIdentifier","args","deleteIdentifier","agent","keyManagerDelete","addKey","success","addService","service","removeKey","removeService","keyCodecs","RSA","Ed25519","X25519","Secp256k1","Secp256r1","Bls12381G1","Bls12381G2","codecName","Multibase","encode","Multicodec","addPrefix","fromString","import_cross_fetch","resolveDidOyd","didUrl","_parsed","_resolver","options","baseUrl","response","fetch","ok","Error","statusText","didDoc","json","err","didDocumentMetadata","didResolutionMetadata","error","message","toString","didDocument","getDidOydResolver","oyd"]}

package/dist/index.d.cts

@@ -1,14 +1,26 @@
-import { IAgentContext, IKeyManager, IIdentifier, IKey, IService } from '@veramo/core';
+import { TKeyType, IKey, IAgentContext, IKeyManager, IIdentifier, IService } from '@veramo/core';
 import { AbstractIdentifierProvider } from '@veramo/did-manager';
 import { DIDResolver } from 'did-resolver';
 
+type OydConstructorOptions = {
+    defaultKms?: string;
+    clientManagedSecretMode?: CMSMCallbackOpts;
+};
 type OydCreateIdentifierOptions = {
-    keyType?: OydDidSupportedKeyTypes;
+    type?: OydDidSupportedKeyTypes;
     privateKeyHex?: string;
+    kid?: string;
+    alias?: string;
     keyUse?: KeyUse;
+    cmsm?: CmsmOptions;
+    key?: IKey;
+};
+type CmsmOptions = {
+    enabled: boolean;
+    create?: boolean;
 };
 type OydDidHoldKeysArgs = {
-    kms: string;
+    kms?: string;
     options: HoldKeysOpts;
 };
 type HoldKeysOpts = {
@@ -17,6 +29,10 @@ type HoldKeysOpts = {
     publicKeyHex?: string;
     privateKeyHex?: string;
 };
+type CMSMCallbackOpts = {
+    publicKeyCallback: (kid: string, kms?: string, create?: boolean, createKeyType?: TKeyType) => Promise<IKey>;
+    signCallback: (kid: string, value: string) => Promise<string>;
+};
 declare enum SupportedKeyTypes {
     Secp256r1 = "Secp256r1",
     Secp256k1 = "Secp256k1",
@@ -32,11 +48,16 @@ type IContext = IAgentContext<IKeyManager>;
  * @public
  */
 declare class OydDIDProvider extends AbstractIdentifierProvider {
-    private defaultKms?;
-    constructor(options: {
-        defaultKms?: string;
-    });
-    createIdentifier({ kms, options }: {
+    private readonly defaultKms?;
+    private readonly cmsmCallbackOpts?;
+    constructor(options?: OydConstructorOptions);
+    private assertedKms;
+    createIdentifier({ kms, alias, options }: {
+        kms?: string;
+        alias?: string;
+        options: OydCreateIdentifierOptions;
+    }, context: IContext): Promise<Omit<IIdentifier, 'provider'>>;
+    createIdentifierWithCMSM({ kms, options }: {
         kms?: string;
         options: OydCreateIdentifierOptions;
     }, context: IContext): Promise<Omit<IIdentifier, 'provider'>>;
@@ -67,7 +88,6 @@ declare class OydDIDProvider extends AbstractIdentifierProvider {
         id: string;
         options?: any;
     }, context: IContext): Promise<any>;
-    private holdKeys;
 }
 
 /**
@@ -79,4 +99,4 @@ declare function getDidOydResolver(): {
     oyd: DIDResolver;
 };
 
-export { type KeyUse, type OydCreateIdentifierOptions, OydDIDProvider, type OydDidHoldKeysArgs, type OydDidSupportedKeyTypes, SupportedKeyTypes, getDidOydResolver };
+export { type CMSMCallbackOpts, type CmsmOptions, type KeyUse, type OydConstructorOptions, type OydCreateIdentifierOptions, OydDIDProvider, type OydDidHoldKeysArgs, type OydDidSupportedKeyTypes, getDidOydResolver };

package/dist/index.d.ts

@@ -1,14 +1,26 @@
-import { IAgentContext, IKeyManager, IIdentifier, IKey, IService } from '@veramo/core';
+import { TKeyType, IKey, IAgentContext, IKeyManager, IIdentifier, IService } from '@veramo/core';
 import { AbstractIdentifierProvider } from '@veramo/did-manager';
 import { DIDResolver } from 'did-resolver';
 
+type OydConstructorOptions = {
+    defaultKms?: string;
+    clientManagedSecretMode?: CMSMCallbackOpts;
+};
 type OydCreateIdentifierOptions = {
-    keyType?: OydDidSupportedKeyTypes;
+    type?: OydDidSupportedKeyTypes;
     privateKeyHex?: string;
+    kid?: string;
+    alias?: string;
     keyUse?: KeyUse;
+    cmsm?: CmsmOptions;
+    key?: IKey;
+};
+type CmsmOptions = {
+    enabled: boolean;
+    create?: boolean;
 };
 type OydDidHoldKeysArgs = {
-    kms: string;
+    kms?: string;
     options: HoldKeysOpts;
 };
 type HoldKeysOpts = {
@@ -17,6 +29,10 @@ type HoldKeysOpts = {
     publicKeyHex?: string;
     privateKeyHex?: string;
 };
+type CMSMCallbackOpts = {
+    publicKeyCallback: (kid: string, kms?: string, create?: boolean, createKeyType?: TKeyType) => Promise<IKey>;
+    signCallback: (kid: string, value: string) => Promise<string>;
+};
 declare enum SupportedKeyTypes {
     Secp256r1 = "Secp256r1",
     Secp256k1 = "Secp256k1",
@@ -32,11 +48,16 @@ type IContext = IAgentContext<IKeyManager>;
  * @public
  */
 declare class OydDIDProvider extends AbstractIdentifierProvider {
-    private defaultKms?;
-    constructor(options: {
-        defaultKms?: string;
-    });
-    createIdentifier({ kms, options }: {
+    private readonly defaultKms?;
+    private readonly cmsmCallbackOpts?;
+    constructor(options?: OydConstructorOptions);
+    private assertedKms;
+    createIdentifier({ kms, alias, options }: {
+        kms?: string;
+        alias?: string;
+        options: OydCreateIdentifierOptions;
+    }, context: IContext): Promise<Omit<IIdentifier, 'provider'>>;
+    createIdentifierWithCMSM({ kms, options }: {
         kms?: string;
         options: OydCreateIdentifierOptions;
     }, context: IContext): Promise<Omit<IIdentifier, 'provider'>>;
@@ -67,7 +88,6 @@ declare class OydDIDProvider extends AbstractIdentifierProvider {
         id: string;
         options?: any;
     }, context: IContext): Promise<any>;
-    private holdKeys;
 }
 
 /**
@@ -79,4 +99,4 @@ declare function getDidOydResolver(): {
     oyd: DIDResolver;
 };
 
-export { type KeyUse, type OydCreateIdentifierOptions, OydDIDProvider, type OydDidHoldKeysArgs, type OydDidSupportedKeyTypes, SupportedKeyTypes, getDidOydResolver };
+export { type CMSMCallbackOpts, type CmsmOptions, type KeyUse, type OydConstructorOptions, type OydCreateIdentifierOptions, OydDIDProvider, type OydDidHoldKeysArgs, type OydDidSupportedKeyTypes, getDidOydResolver };

package/dist/index.js

@@ -2,27 +2,56 @@ var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 
 // src/oyd-did-provider.ts
+import { importProvidedOrGeneratedKey } from "@sphereon/ssi-sdk-ext.key-utils";
 import { AbstractIdentifierProvider } from "@veramo/did-manager";
 import fetch from "cross-fetch";
+import Multibase from "multibase";
+import Multicodec from "multicodec";
+import * as u8a from "uint8arrays";
 import Debug from "debug";
 var debug = Debug("veramo:oyd-did:identifier-provider");
+var OYDID_REGISTRAR_URL = "https://oydid-registrar.data-container.net/1.0/createIdentifier";
 var OydDIDProvider = class extends AbstractIdentifierProvider {
   static {
     __name(this, "OydDIDProvider");
   }
   defaultKms;
+  cmsmCallbackOpts;
   constructor(options) {
     super();
-    this.defaultKms = options.defaultKms;
+    this.defaultKms = options?.defaultKms;
+    this.cmsmCallbackOpts = options?.clientManagedSecretMode;
   }
-  async createIdentifier({ kms, options }, context) {
+  async assertedKms(...kms) {
+    if (!kms || kms.length === 0) {
+      return Promise.reject(Error("KMS must be provided either as a parameter or via defaultKms."));
+    }
+    const result = kms.find((k) => !!k);
+    if (!result) {
+      return Promise.reject(Error("KMS must be provided either as a parameter or via defaultKms."));
+    }
+    return result;
+  }
+  async createIdentifier({ kms, alias, options }, context) {
+    const resolvedKms = await this.assertedKms(kms, this.defaultKms);
+    if (this.cmsmCallbackOpts && !options.cmsm || options.cmsm && options.cmsm.enabled !== false) {
+      if (!this.cmsmCallbackOpts) {
+        return Promise.reject(Error("did:oyd: no cmsm options defined on oyd did provider, but cmsm was enabled on the call!"));
+      }
+      return await this.createIdentifierWithCMSM({
+        kms: resolvedKms,
+        options
+      }, context);
+    }
     const body = {
-      options
+      options: {
+        cmsm: false,
+        key_type: options.type ?? "Secp256r1"
+      }
     };
-    const url = "https://oydid-registrar.data-container.net/1.0/createIdentifier";
     let didDoc;
     try {
-      const response = await fetch(url, {
+      const response = await fetch(OYDID_REGISTRAR_URL, {
         method: "POST",
         headers: {
           "Content-Type": "application/json"
@@ -30,21 +59,25 @@ var OydDIDProvider = class extends AbstractIdentifierProvider {
         body: JSON.stringify(body)
       });
       if (!response.ok) {
-        throw new Error("Network response was not ok: " + response.statusText);
+        debug("Error response from OydDID Registrar: ", response);
+        return Promise.reject(Error("Network response was not ok: " + response.statusText));
       }
       didDoc = await response.json();
     } catch (error) {
-      throw new Error("There has been a problem with the fetch operation: " + error.toString());
+      debug("Unexpected error from OydDID Registrar: ", error);
+      return Promise.reject(Error("There has been a problem with the fetch operation: " + error.toString()));
     }
-    const keyType = options?.keyType || "Ed25519";
-    const key = await this.holdKeys({
-      // @ts-ignore
-      kms: kms || this.defaultKms,
+    const keyType = options?.type ?? "Secp256r1";
+    const key = await importProvidedOrGeneratedKey({
+      kms: resolvedKms,
+      alias: alias ?? options.alias ?? options.kid ?? `${didDoc.did}#key-doc`,
       options: {
-        keyType,
-        kid: didDoc.did + "#key-doc",
-        publicKeyHex: didDoc.keys[0].publicKeyHex,
-        privateKeyHex: didDoc.keys[0].privateKeyHex
+        key: {
+          kid: `${didDoc.did}#key-doc`,
+          type: keyType,
+          publicKeyHex: didDoc.keys[0].publicKeyHex,
+          privateKeyHex: didDoc.keys[0].privateKeyHex
+        }
       }
     }, context);
     const identifier = {
@@ -58,6 +91,96 @@ var OydDIDProvider = class extends AbstractIdentifierProvider {
     debug("Created", identifier.did);
     return identifier;
   }
+  async createIdentifierWithCMSM({ kms, options }, context) {
+    const cmsmCallbackOpts = this.cmsmCallbackOpts;
+    if (!cmsmCallbackOpts) {
+      return Promise.reject(Error("did:oyd: no cmsm options defined!"));
+    }
+    const assertedKms = await this.assertedKms(kms, this.defaultKms);
+    const pubKey = options.key ?? await cmsmCallbackOpts.publicKeyCallback(options.kid ?? "default", assertedKms, options.cmsm?.create !== false, options.type);
+    const kid = pubKey.kid;
+    const keyType = pubKey.type;
+    const key = base58btc({
+      publicKeyHex: pubKey.publicKeyHex,
+      keyType
+    });
+    console.log(`Bae58 pubkey key: ${key}`);
+    let signValue;
+    try {
+      const body_create = {
+        // specify the Identifier options for the registrar
+        key,
+        options: {
+          cmsm: true,
+          key_type: keyType
+        }
+      };
+      console.log(`Create request:
+${JSON.stringify(body_create, null, 2)}
+`);
+      const response = await fetch(OYDID_REGISTRAR_URL, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(body_create)
+      });
+      if (!response.ok) {
+        debug("Error response from OydDID Registrar: ", body_create, response);
+        return Promise.reject(Error("Network response was not ok: " + response.statusText));
+      }
+      signValue = await response.json();
+      console.log(`Create response:
+${JSON.stringify(signValue, null, 2)}
+`);
+    } catch (error) {
+      console.log("Unexpected error from OydDID Registrar: ", error);
+      return Promise.reject(Error("There has been a problem with the fetch operation: " + error.toString()));
+    }
+    const { sign } = signValue;
+    const signature = await cmsmCallbackOpts.signCallback(kid, sign);
+    console.log(`Signature: ${signature}`);
+    const body_signed = {
+      key,
+      options: {
+        cmsm: true,
+        key_type: keyType,
+        sig: signature
+      }
+    };
+    console.log(`Signed request:
+${JSON.stringify(body_signed, null, 2)}
+`);
+    let didDoc;
+    try {
+      const response = await fetch(OYDID_REGISTRAR_URL, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(body_signed)
+      });
+      if (!response.ok) {
+        console.log(`Error response from OydDID Registrar: ${JSON.stringify(response.text)}${response.statusText}`, response);
+        debug("Error response from OydDID Registrar: ", response);
+        return Promise.reject(Error("Network response was not ok: " + response.statusText));
+      }
+      didDoc = await response.json();
+    } catch (error) {
+      debug("Unexpected error from OydDID Registrar: ", error);
+      return Promise.reject(Error("There has been a problem with the fetch operation: " + error.toString()));
+    }
+    const identifier = {
+      did: didDoc.did,
+      controllerKeyId: pubKey.kid,
+      keys: [
+        pubKey
+      ],
+      services: []
+    };
+    debug("Created", identifier.did);
+    return identifier;
+  }
   async updateIdentifier(args, context) {
     throw new Error("OydDIDProvider updateIdentifier not supported yet.");
   }
@@ -89,33 +212,20 @@ var OydDIDProvider = class extends AbstractIdentifierProvider {
       success: true
     };
   }
-  async holdKeys(args, context) {
-    if (args.options.privateKeyHex) {
-      return context.agent.keyManagerImport({
-        // @ts-ignore
-        kms: args.kms || this.defaultKms,
-        type: args.options.keyType,
-        kid: args.options.kid,
-        privateKeyHex: args.options.privateKeyHex,
-        meta: {
-          algorithms: [
-            "Ed25519"
-          ]
-        }
-      });
-    }
-    return context.agent.keyManagerCreate({
-      type: args.options.keyType,
-      // @ts-ignore
-      kms: args.kms || this.defaultKms,
-      meta: {
-        algorithms: [
-          "Ed25519"
-        ]
-      }
-    });
-  }
 };
+var keyCodecs = {
+  RSA: "rsa-pub",
+  Ed25519: "ed25519-pub",
+  X25519: "x25519-pub",
+  Secp256k1: "secp256k1-pub",
+  Secp256r1: "p256-pub",
+  Bls12381G1: "bls12_381-g1-pub",
+  Bls12381G2: "bls12_381-g2-pub"
+};
+var base58btc = /* @__PURE__ */ __name(({ publicKeyHex, keyType = "Secp256r1" }) => {
+  const codecName = keyCodecs[keyType];
+  return u8a.toString(Multibase.encode("base58btc", Multicodec.addPrefix(codecName, u8a.fromString(publicKeyHex, "hex")))).toString();
+}, "base58btc");
 
 // src/resolver.ts
 import fetch2 from "cross-fetch";
@@ -145,18 +255,8 @@ function getDidOydResolver() {
   };
 }
 __name(getDidOydResolver, "getDidOydResolver");
-
-// src/types/oyd-provider-types.ts
-var SupportedKeyTypes = /* @__PURE__ */ function(SupportedKeyTypes2) {
-  SupportedKeyTypes2["Secp256r1"] = "Secp256r1";
-  SupportedKeyTypes2["Secp256k1"] = "Secp256k1";
-  SupportedKeyTypes2["Ed25519"] = "Ed25519";
-  SupportedKeyTypes2["X25519"] = "X25519";
-  return SupportedKeyTypes2;
-}({});
 export {
   OydDIDProvider,
-  SupportedKeyTypes,
   getDidOydResolver
 };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/oyd-did-provider.ts","../src/resolver.ts","../src/types/oyd-provider-types.ts"],"sourcesContent":["import { IIdentifier, IKey, IService, IAgentContext, IKeyManager } from '@veramo/core'\nimport { AbstractIdentifierProvider } from '@veramo/did-manager'\nimport type { OydCreateIdentifierOptions, OydDidHoldKeysArgs, OydDidSupportedKeyTypes } from './types/oyd-provider-types.js'\nimport fetch from 'cross-fetch'\n\nimport Debug from 'debug'\nconst debug = Debug('veramo:oyd-did:identifier-provider')\n\ntype IContext = IAgentContext<IKeyManager>\n\n/**\n * {@link @veramo/did-manager#DIDManager} identifier provider for `did:oyd` identifiers\n * @public\n */\nexport class OydDIDProvider extends AbstractIdentifierProvider {\n  private defaultKms?: string\n\n  constructor(options: { defaultKms?: string }) {\n    super()\n    this.defaultKms = options.defaultKms\n  }\n\n  async createIdentifier(\n    { kms, options }: { kms?: string; options: OydCreateIdentifierOptions },\n    context: IContext\n  ): Promise<Omit<IIdentifier, 'provider'>> {\n    const body = { options }\n    const url = 'https://oydid-registrar.data-container.net/1.0/createIdentifier'\n\n    let didDoc: any | undefined\n    try {\n      const response = await fetch(url, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n        },\n        body: JSON.stringify(body),\n      })\n      if (!response.ok) {\n        throw new Error('Network response was not ok: ' + response.statusText)\n      }\n      didDoc = await response.json()\n    } catch (error) {\n      // @ts-ignore\n      throw new Error('There has been a problem with the fetch operation: ' + error.toString())\n    }\n\n    const keyType: OydDidSupportedKeyTypes = options?.keyType || 'Ed25519'\n    const key = await this.holdKeys(\n      {\n        // @ts-ignore\n        kms: kms || this.defaultKms,\n        options: {\n          keyType,\n          kid: didDoc.did + '#key-doc',\n          publicKeyHex: didDoc.keys[0].publicKeyHex,\n          privateKeyHex: didDoc.keys[0].privateKeyHex,\n        },\n      },\n      context\n    )\n\n    const identifier: Omit<IIdentifier, 'provider'> = {\n      did: didDoc.did,\n      controllerKeyId: key.kid,\n      keys: [key],\n      services: [],\n    }\n    debug('Created', identifier.did)\n    return identifier\n  }\n\n  async updateIdentifier(\n    args: { did: string; kms?: string | undefined; alias?: string | undefined; options?: any },\n    context: IAgentContext<IKeyManager>\n  ): Promise<IIdentifier> {\n    throw new Error('OydDIDProvider updateIdentifier not supported yet.')\n  }\n\n  async deleteIdentifier(identifier: IIdentifier, context: IContext): Promise<boolean> {\n    for (const { kid } of identifier.keys) {\n      await context.agent.keyManagerDelete({ kid })\n    }\n    return true\n  }\n\n  async addKey({ identifier, key, options }: { identifier: IIdentifier; key: IKey; options?: any }, context: IContext): Promise<any> {\n    return { success: true }\n  }\n\n  async addService({ identifier, service, options }: { identifier: IIdentifier; service: IService; options?: any }, context: IContext): Promise<any> {\n    return { success: true }\n  }\n\n  async removeKey(args: { identifier: IIdentifier; kid: string; options?: any }, context: IContext): Promise<any> {\n    return { success: true }\n  }\n\n  async removeService(args: { identifier: IIdentifier; id: string; options?: any }, context: IContext): Promise<any> {\n    return { success: true }\n  }\n\n  private async holdKeys(args: OydDidHoldKeysArgs, context: IContext): Promise<IKey> {\n    if (args.options.privateKeyHex) {\n      return context.agent.keyManagerImport({\n        // @ts-ignore\n        kms: args.kms || this.defaultKms,\n        type: args.options.keyType,\n        kid: args.options.kid,\n        privateKeyHex: args.options.privateKeyHex,\n        meta: {\n          algorithms: ['Ed25519'],\n        },\n      })\n    }\n    return context.agent.keyManagerCreate({\n      type: args.options.keyType,\n      // @ts-ignore\n      kms: args.kms || this.defaultKms,\n      meta: {\n        algorithms: ['Ed25519'],\n      },\n    })\n  }\n}\n","import { DIDResolutionOptions, DIDResolutionResult, DIDResolver, ParsedDID, Resolvable } from 'did-resolver'\nimport fetch from 'cross-fetch'\n\nconst resolveDidOyd: DIDResolver = async (\n  didUrl: string,\n  _parsed: ParsedDID,\n  _resolver: Resolvable,\n  options: DIDResolutionOptions\n): Promise<DIDResolutionResult> => {\n  try {\n    const baseUrl: string = 'https://oydid-resolver.data-container.net'\n    // const didDoc = await axios.get(`${baseUrl}/1.0/identifiers/${didUrl}`);\n    const response = await fetch(`${baseUrl}/1.0/identifiers/${didUrl}`)\n    if (!response.ok) {\n      throw new Error('Network response was not ok: ' + response.statusText)\n    }\n    const didDoc = await response.json()\n    return didDoc as DIDResolutionResult\n  } catch (err: any) {\n    return {\n      didDocumentMetadata: {},\n      didResolutionMetadata: { error: 'invalidDid', message: err.toString() },\n      didDocument: null,\n    }\n  }\n}\n\n/**\n * Provides a mapping to a did:oyd resolver, usable by {@link did-resolver#Resolver}.\n *\n * @public\n */\nexport function getDidOydResolver() {\n  return { oyd: resolveDidOyd }\n}\n","export type OydCreateIdentifierOptions = {\n  keyType?: OydDidSupportedKeyTypes\n  privateKeyHex?: string\n  keyUse?: KeyUse\n}\n\nexport type OydDidHoldKeysArgs = {\n  kms: string\n  options: HoldKeysOpts\n}\n\ntype HoldKeysOpts = {\n  keyType: OydDidSupportedKeyTypes\n  kid: string\n  publicKeyHex?: string\n  privateKeyHex?: string\n}\n\nexport enum SupportedKeyTypes {\n  Secp256r1 = 'Secp256r1',\n  Secp256k1 = 'Secp256k1',\n  Ed25519 = 'Ed25519',\n  X25519 = 'X25519',\n}\n\nexport type OydDidSupportedKeyTypes = keyof typeof SupportedKeyTypes\n\nexport type KeyUse = 'sig' | 'enc'\n"],"mappings":";;;;AACA,SAASA,kCAAkC;AAE3C,OAAOC,WAAW;AAElB,OAAOC,WAAW;AAClB,IAAMC,QAAQC,MAAM,oCAAA;AAQb,IAAMC,iBAAN,cAA6BC,2BAAAA;EAbpC,OAaoCA;;;EAC1BC;EAERC,YAAYC,SAAkC;AAC5C,UAAK;AACL,SAAKF,aAAaE,QAAQF;EAC5B;EAEA,MAAMG,iBACJ,EAAEC,KAAKF,QAAO,GACdG,SACwC;AACxC,UAAMC,OAAO;MAAEJ;IAAQ;AACvB,UAAMK,MAAM;AAEZ,QAAIC;AACJ,QAAI;AACF,YAAMC,WAAW,MAAMC,MAAMH,KAAK;QAChCI,QAAQ;QACRC,SAAS;UACP,gBAAgB;QAClB;QACAN,MAAMO,KAAKC,UAAUR,IAAAA;MACvB,CAAA;AACA,UAAI,CAACG,SAASM,IAAI;AAChB,cAAM,IAAIC,MAAM,kCAAkCP,SAASQ,UAAU;MACvE;AACAT,eAAS,MAAMC,SAASS,KAAI;IAC9B,SAASC,OAAO;AAEd,YAAM,IAAIH,MAAM,wDAAwDG,MAAMC,SAAQ,CAAA;IACxF;AAEA,UAAMC,UAAmCnB,SAASmB,WAAW;AAC7D,UAAMC,MAAM,MAAM,KAAKC,SACrB;;MAEEnB,KAAKA,OAAO,KAAKJ;MACjBE,SAAS;QACPmB;QACAG,KAAKhB,OAAOiB,MAAM;QAClBC,cAAclB,OAAOmB,KAAK,CAAA,EAAGD;QAC7BE,eAAepB,OAAOmB,KAAK,CAAA,EAAGC;MAChC;IACF,GACAvB,OAAAA;AAGF,UAAMwB,aAA4C;MAChDJ,KAAKjB,OAAOiB;MACZK,iBAAiBR,IAAIE;MACrBG,MAAM;QAACL;;MACPS,UAAU,CAAA;IACZ;AACAnC,UAAM,WAAWiC,WAAWJ,GAAG;AAC/B,WAAOI;EACT;EAEA,MAAMG,iBACJC,MACA5B,SACsB;AACtB,UAAM,IAAIW,MAAM,oDAAA;EAClB;EAEA,MAAMkB,iBAAiBL,YAAyBxB,SAAqC;AACnF,eAAW,EAAEmB,IAAG,KAAMK,WAAWF,MAAM;AACrC,YAAMtB,QAAQ8B,MAAMC,iBAAiB;QAAEZ;MAAI,CAAA;IAC7C;AACA,WAAO;EACT;EAEA,MAAMa,OAAO,EAAER,YAAYP,KAAKpB,QAAO,GAA2DG,SAAiC;AACjI,WAAO;MAAEiC,SAAS;IAAK;EACzB;EAEA,MAAMC,WAAW,EAAEV,YAAYW,SAAStC,QAAO,GAAmEG,SAAiC;AACjJ,WAAO;MAAEiC,SAAS;IAAK;EACzB;EAEA,MAAMG,UAAUR,MAA+D5B,SAAiC;AAC9G,WAAO;MAAEiC,SAAS;IAAK;EACzB;EAEA,MAAMI,cAAcT,MAA8D5B,SAAiC;AACjH,WAAO;MAAEiC,SAAS;IAAK;EACzB;EAEA,MAAcf,SAASU,MAA0B5B,SAAkC;AACjF,QAAI4B,KAAK/B,QAAQ0B,eAAe;AAC9B,aAAOvB,QAAQ8B,MAAMQ,iBAAiB;;QAEpCvC,KAAK6B,KAAK7B,OAAO,KAAKJ;QACtB4C,MAAMX,KAAK/B,QAAQmB;QACnBG,KAAKS,KAAK/B,QAAQsB;QAClBI,eAAeK,KAAK/B,QAAQ0B;QAC5BiB,MAAM;UACJC,YAAY;YAAC;;QACf;MACF,CAAA;IACF;AACA,WAAOzC,QAAQ8B,MAAMY,iBAAiB;MACpCH,MAAMX,KAAK/B,QAAQmB;;MAEnBjB,KAAK6B,KAAK7B,OAAO,KAAKJ;MACtB6C,MAAM;QACJC,YAAY;UAAC;;MACf;IACF,CAAA;EACF;AACF;;;AC3HA,OAAOE,YAAW;AAElB,IAAMC,gBAA6B,8BACjCC,QACAC,SACAC,WACAC,YAAAA;AAEA,MAAI;AACF,UAAMC,UAAkB;AAExB,UAAMC,WAAW,MAAMC,OAAM,GAAGF,OAAAA,oBAA2BJ,MAAAA,EAAQ;AACnE,QAAI,CAACK,SAASE,IAAI;AAChB,YAAM,IAAIC,MAAM,kCAAkCH,SAASI,UAAU;IACvE;AACA,UAAMC,SAAS,MAAML,SAASM,KAAI;AAClC,WAAOD;EACT,SAASE,KAAU;AACjB,WAAO;MACLC,qBAAqB,CAAC;MACtBC,uBAAuB;QAAEC,OAAO;QAAcC,SAASJ,IAAIK,SAAQ;MAAG;MACtEC,aAAa;IACf;EACF;AACF,GAtBmC;AA6B5B,SAASC,oBAAAA;AACd,SAAO;IAAEC,KAAKrB;EAAc;AAC9B;AAFgBoB;;;ACdT,IAAKE,oBAAAA,yBAAAA,oBAAAA;;;;;SAAAA;;","names":["AbstractIdentifierProvider","fetch","Debug","debug","Debug","OydDIDProvider","AbstractIdentifierProvider","defaultKms","constructor","options","createIdentifier","kms","context","body","url","didDoc","response","fetch","method","headers","JSON","stringify","ok","Error","statusText","json","error","toString","keyType","key","holdKeys","kid","did","publicKeyHex","keys","privateKeyHex","identifier","controllerKeyId","services","updateIdentifier","args","deleteIdentifier","agent","keyManagerDelete","addKey","success","addService","service","removeKey","removeService","keyManagerImport","type","meta","algorithms","keyManagerCreate","fetch","resolveDidOyd","didUrl","_parsed","_resolver","options","baseUrl","response","fetch","ok","Error","statusText","didDoc","json","err","didDocumentMetadata","didResolutionMetadata","error","message","toString","didDocument","getDidOydResolver","oyd","SupportedKeyTypes"]}
+{"version":3,"sources":["../src/oyd-did-provider.ts","../src/resolver.ts"],"sourcesContent":["import { importProvidedOrGeneratedKey } from '@sphereon/ssi-sdk-ext.key-utils'\nimport { IAgentContext, IIdentifier, IKey, IKeyManager, IService, TKeyType } from '@veramo/core'\nimport { AbstractIdentifierProvider } from '@veramo/did-manager'\nimport { KeyManager } from '@veramo/key-manager'\nimport fetch from 'cross-fetch'\nimport Multibase from 'multibase'\nimport Multicodec from 'multicodec'\n\n// @ts-ignore\nimport * as u8a from 'uint8arrays'\n\nimport Debug from 'debug'\nimport type {\n  CMSMCallbackOpts,\n  OydConstructorOptions,\n  OydCreateIdentifierOptions,\n  // OydDidHoldKeysArgs,\n  OydDidSupportedKeyTypes,\n} from './types/oyd-provider-types'\n\nconst debug = Debug('veramo:oyd-did:identifier-provider')\nconst OYDID_REGISTRAR_URL = 'https://oydid-registrar.data-container.net/1.0/createIdentifier'\n\ntype IContext = IAgentContext<IKeyManager>\n\n/**\n * {@link @veramo/did-manager#DIDManager} identifier provider for `did:oyd` identifiers\n * @public\n */\nexport class OydDIDProvider extends AbstractIdentifierProvider {\n  private readonly defaultKms?: string\n  private readonly cmsmCallbackOpts?: CMSMCallbackOpts\n\n  constructor(options?: OydConstructorOptions) {\n    super()\n    this.defaultKms = options?.defaultKms\n    this.cmsmCallbackOpts = options?.clientManagedSecretMode\n  }\n\n  private async assertedKms(...kms: (string | undefined)[]): Promise<string> {\n    if (!kms || kms.length === 0) {\n      return Promise.reject(Error('KMS must be provided either as a parameter or via defaultKms.'))\n    }\n    const result = kms.find((k) => !!k)\n    if (!result) {\n      return Promise.reject(Error('KMS must be provided either as a parameter or via defaultKms.'))\n    }\n    return result\n  }\n\n  async createIdentifier(\n    { kms, alias, options }: { kms?: string; alias?: string; options: OydCreateIdentifierOptions },\n    context: IContext\n  ): Promise<Omit<IIdentifier, 'provider'>> {\n    const resolvedKms = await this.assertedKms(kms, this.defaultKms)\n\n    if ((this.cmsmCallbackOpts && !options.cmsm) || (options.cmsm && options.cmsm.enabled !== false)) {\n      if (!this.cmsmCallbackOpts) {\n        return Promise.reject(Error('did:oyd: no cmsm options defined on oyd did provider, but cmsm was enabled on the call!'))\n      }\n      return await this.createIdentifierWithCMSM({ kms: resolvedKms, options }, context)\n    }\n\n    const body = {\n      options: {\n        cmsm: false,\n        key_type: options.type ?? 'Secp256r1',\n      },\n    }\n    let didDoc: any | undefined\n    try {\n      const response = await fetch(OYDID_REGISTRAR_URL, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n        },\n        body: JSON.stringify(body),\n      })\n      if (!response.ok) {\n        debug('Error response from OydDID Registrar: ', response)\n        return Promise.reject(Error('Network response was not ok: ' + response.statusText))\n      }\n      didDoc = await response.json()\n    } catch (error: any) {\n      debug('Unexpected error from OydDID Registrar: ', error)\n      return Promise.reject(Error('There has been a problem with the fetch operation: ' + error.toString()))\n    }\n\n    const keyType: OydDidSupportedKeyTypes = options?.type ?? 'Secp256r1'\n    const key = await importProvidedOrGeneratedKey(\n      {\n        kms: resolvedKms,\n        alias: alias ?? options.alias ?? options.kid ?? `${didDoc.did}#key-doc`,\n        options: {\n          key: {\n            kid: `${didDoc.did}#key-doc`,\n            type: keyType,\n            publicKeyHex: didDoc.keys[0].publicKeyHex,\n            privateKeyHex: didDoc.keys[0].privateKeyHex,\n          },\n        },\n      },\n      context\n    )\n\n    const identifier: Omit<IIdentifier, 'provider'> = {\n      did: didDoc.did,\n      controllerKeyId: key.kid,\n      keys: [key],\n      services: [],\n    }\n    debug('Created', identifier.did)\n    return identifier\n  }\n\n  async createIdentifierWithCMSM(\n    { kms, options }: { kms?: string; options: OydCreateIdentifierOptions },\n    context: IContext\n  ): Promise<Omit<IIdentifier, 'provider'>> {\n    const cmsmCallbackOpts = this.cmsmCallbackOpts\n    if (!cmsmCallbackOpts) {\n      return Promise.reject(Error('did:oyd: no cmsm options defined!'))\n    }\n\n    const assertedKms = await this.assertedKms(kms, this.defaultKms)\n    const pubKey =\n      options.key ?? (await cmsmCallbackOpts.publicKeyCallback(options.kid ?? 'default', assertedKms, options.cmsm?.create !== false, options.type)) // \"default\" is probably not right, TODO!!\n    const kid = pubKey.kid\n    const keyType = pubKey.type\n    const key = base58btc({ publicKeyHex: pubKey.publicKeyHex, keyType })\n\n    console.log(`Bae58 pubkey key: ${key}`)\n    let signValue: any | undefined // do the request\n    try {\n      const body_create = {\n        // specify the Identifier options for the registrar\n        key: key,\n        options: {\n          cmsm: true,\n          key_type: keyType,\n        },\n      }\n      console.log(`Create request:\\n${JSON.stringify(body_create, null, 2)}\\n`)\n      const response = await fetch(OYDID_REGISTRAR_URL, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n        },\n        body: JSON.stringify(body_create),\n      })\n      if (!response.ok) {\n        debug('Error response from OydDID Registrar: ', body_create, response)\n        return Promise.reject(Error('Network response was not ok: ' + response.statusText))\n      }\n      signValue = await response.json()\n      console.log(`Create response:\\n${JSON.stringify(signValue, null, 2)}\\n`)\n    } catch (error: any) {\n      console.log('Unexpected error from OydDID Registrar: ', error)\n      return Promise.reject(Error('There has been a problem with the fetch operation: ' + error.toString()))\n    }\n\n    // we received our value to sign, now we sign it!\n    const { sign } = signValue\n    const signature = await cmsmCallbackOpts.signCallback(kid, sign)\n\n    console.log(`Signature: ${signature}`)\n\n    const body_signed = {\n      key,\n      options: {\n        cmsm: true,\n        key_type: keyType,\n        sig: signature,\n      },\n    }\n    console.log(`Signed request:\\n${JSON.stringify(body_signed, null, 2)}\\n`)\n\n    // Object.assign(body_signed.options, options)\n\n    let didDoc: any | undefined // do the request\n    try {\n      const response = await fetch(OYDID_REGISTRAR_URL, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n        },\n        body: JSON.stringify(body_signed),\n      })\n      if (!response.ok) {\n        console.log(`Error response from OydDID Registrar: ${JSON.stringify(response.text)}${response.statusText}`, response)\n        debug('Error response from OydDID Registrar: ', response)\n        return Promise.reject(Error('Network response was not ok: ' + response.statusText))\n      }\n      didDoc = await response.json()\n    } catch (error: any) {\n      debug('Unexpected error from OydDID Registrar: ', error)\n      return Promise.reject(Error('There has been a problem with the fetch operation: ' + error.toString()))\n    }\n\n    const identifier: Omit<IIdentifier, 'provider'> = {\n      did: didDoc.did,\n      controllerKeyId: pubKey.kid,\n      keys: [pubKey],\n      services: [],\n    }\n    debug('Created', identifier.did)\n    return identifier\n  }\n\n  async updateIdentifier(\n    args: { did: string; kms?: string | undefined; alias?: string | undefined; options?: any },\n    context: IAgentContext<IKeyManager>\n  ): Promise<IIdentifier> {\n    throw new Error('OydDIDProvider updateIdentifier not supported yet.')\n  }\n\n  async deleteIdentifier(identifier: IIdentifier, context: IContext): Promise<boolean> {\n    for (const { kid } of identifier.keys) {\n      await context.agent.keyManagerDelete({ kid })\n    }\n    return true\n  }\n\n  async addKey({ identifier, key, options }: { identifier: IIdentifier; key: IKey; options?: any }, context: IContext): Promise<any> {\n    return { success: true }\n  }\n\n  async addService({ identifier, service, options }: { identifier: IIdentifier; service: IService; options?: any }, context: IContext): Promise<any> {\n    return { success: true }\n  }\n\n  async removeKey(args: { identifier: IIdentifier; kid: string; options?: any }, context: IContext): Promise<any> {\n    return { success: true }\n  }\n\n  async removeService(args: { identifier: IIdentifier; id: string; options?: any }, context: IContext): Promise<any> {\n    return { success: true }\n  }\n}\n\nconst keyCodecs = {\n  RSA: 'rsa-pub',\n  Ed25519: 'ed25519-pub',\n  X25519: 'x25519-pub',\n  Secp256k1: 'secp256k1-pub',\n  Secp256r1: 'p256-pub',\n  Bls12381G1: 'bls12_381-g1-pub',\n  Bls12381G2: 'bls12_381-g2-pub',\n} as const\n\nconst base58btc = ({ publicKeyHex, keyType = 'Secp256r1' }: { publicKeyHex: string; keyType?: TKeyType }): string => {\n  const codecName = keyCodecs[keyType]\n\n  // methodSpecificId  = bytesToMultibase({bytes: u8a.fromString(key.publicKeyHex, 'hex'), codecName})\n  return u8a\n    .toString(Multibase.encode('base58btc', Multicodec.addPrefix(codecName as Multicodec.CodecName, u8a.fromString(publicKeyHex, 'hex'))))\n    .toString()\n}\n\nexport function defaultOydCmsmPublicKeyCallback(\n  keyManager: KeyManager\n): (kid: string, kms?: string, create?: boolean, createKeyType?: TKeyType) => Promise<IKey> {\n  return async (kid: string, kms?: string, create?: boolean, createKeyType?: TKeyType): Promise<IKey> => {\n    try {\n      const existing = await keyManager.keyManagerGet({ kid })\n      if (existing) {\n        return existing\n      }\n    } catch (error: any) {}\n    if (create) {\n      if (!kms) {\n        return Promise.reject(Error('No KMS provided, whilst creating a new key!'))\n      }\n      const alias = kid ?? `oyd-${new Date().toISOString()}`\n\n      const agent = keyManager\n      const key = await importProvidedOrGeneratedKey(\n        {\n          kms,\n          alias,\n          options: {\n            key: {\n              type: createKeyType ?? 'Secp256r1',\n            },\n          },\n        },\n        {\n          //@ts-ignore\n          agent,\n        }\n      )\n      return key\n\n      // return await keyManager.keyManagerCreate({ kms, type: createKeyType ?? 'Secp256r1' })\n    }\n    return Promise.reject(Error('No existing key found, and create is false!'))\n  }\n}\n\nexport function defaultOydCmsmSignCallback(keyManager: KeyManager): (kid: string, data: string) => Promise<string> {\n  return async (kid: string, data: string): Promise<string> => {\n    return keyManager.keyManagerSign({ keyRef: kid, data, encoding: 'utf-8' })\n  }\n}\n\nexport class DefaultOydCmsmCallbacks implements CMSMCallbackOpts {\n  private readonly keyManager: KeyManager\n\n  constructor(keyManager: KeyManager) {\n    this.keyManager = keyManager\n  }\n\n  publicKeyCallback(kid: string, kms?: string, create?: boolean, createKeyType?: TKeyType): Promise<IKey> {\n    return defaultOydCmsmPublicKeyCallback(this.keyManager)(kid, kms, create, createKeyType)\n  }\n\n  signCallback(kid: string, value: string): Promise<string> {\n    return defaultOydCmsmSignCallback(this.keyManager)(kid, value)\n  }\n}\n","import { DIDResolutionOptions, DIDResolutionResult, DIDResolver, ParsedDID, Resolvable } from 'did-resolver'\nimport fetch from 'cross-fetch'\n\nconst resolveDidOyd: DIDResolver = async (\n  didUrl: string,\n  _parsed: ParsedDID,\n  _resolver: Resolvable,\n  options: DIDResolutionOptions\n): Promise<DIDResolutionResult> => {\n  try {\n    const baseUrl: string = 'https://oydid-resolver.data-container.net'\n    // const didDoc = await axios.get(`${baseUrl}/1.0/identifiers/${didUrl}`);\n    const response = await fetch(`${baseUrl}/1.0/identifiers/${didUrl}`)\n    if (!response.ok) {\n      throw new Error('Network response was not ok: ' + response.statusText)\n    }\n    const didDoc = await response.json()\n    return didDoc as DIDResolutionResult\n  } catch (err: any) {\n    return {\n      didDocumentMetadata: {},\n      didResolutionMetadata: { error: 'invalidDid', message: err.toString() },\n      didDocument: null,\n    }\n  }\n}\n\n/**\n * Provides a mapping to a did:oyd resolver, usable by {@link did-resolver#Resolver}.\n *\n * @public\n */\nexport function getDidOydResolver() {\n  return { oyd: resolveDidOyd }\n}\n"],"mappings":";;;;AAAA,SAASA,oCAAoC;AAE7C,SAASC,kCAAkC;AAE3C,OAAOC,WAAW;AAClB,OAAOC,eAAe;AACtB,OAAOC,gBAAgB;AAGvB,YAAYC,SAAS;AAErB,OAAOC,WAAW;AASlB,IAAMC,QAAQC,MAAM,oCAAA;AACpB,IAAMC,sBAAsB;AAQrB,IAAMC,iBAAN,cAA6BC,2BAAAA;EA7BpC,OA6BoCA;;;EACjBC;EACAC;EAEjBC,YAAYC,SAAiC;AAC3C,UAAK;AACL,SAAKH,aAAaG,SAASH;AAC3B,SAAKC,mBAAmBE,SAASC;EACnC;EAEA,MAAcC,eAAeC,KAA8C;AACzE,QAAI,CAACA,OAAOA,IAAIC,WAAW,GAAG;AAC5B,aAAOC,QAAQC,OAAOC,MAAM,+DAAA,CAAA;IAC9B;AACA,UAAMC,SAASL,IAAIM,KAAK,CAACC,MAAM,CAAC,CAACA,CAAAA;AACjC,QAAI,CAACF,QAAQ;AACX,aAAOH,QAAQC,OAAOC,MAAM,+DAAA,CAAA;IAC9B;AACA,WAAOC;EACT;EAEA,MAAMG,iBACJ,EAAER,KAAKS,OAAOZ,QAAO,GACrBa,SACwC;AACxC,UAAMC,cAAc,MAAM,KAAKZ,YAAYC,KAAK,KAAKN,UAAU;AAE/D,QAAK,KAAKC,oBAAoB,CAACE,QAAQe,QAAUf,QAAQe,QAAQf,QAAQe,KAAKC,YAAY,OAAQ;AAChG,UAAI,CAAC,KAAKlB,kBAAkB;AAC1B,eAAOO,QAAQC,OAAOC,MAAM,yFAAA,CAAA;MAC9B;AACA,aAAO,MAAM,KAAKU,yBAAyB;QAAEd,KAAKW;QAAad;MAAQ,GAAGa,OAAAA;IAC5E;AAEA,UAAMK,OAAO;MACXlB,SAAS;QACPe,MAAM;QACNI,UAAUnB,QAAQoB,QAAQ;MAC5B;IACF;AACA,QAAIC;AACJ,QAAI;AACF,YAAMC,WAAW,MAAMC,MAAM7B,qBAAqB;QAChD8B,QAAQ;QACRC,SAAS;UACP,gBAAgB;QAClB;QACAP,MAAMQ,KAAKC,UAAUT,IAAAA;MACvB,CAAA;AACA,UAAI,CAACI,SAASM,IAAI;AAChBpC,cAAM,0CAA0C8B,QAAAA;AAChD,eAAOjB,QAAQC,OAAOC,MAAM,kCAAkCe,SAASO,UAAU,CAAA;MACnF;AACAR,eAAS,MAAMC,SAASQ,KAAI;IAC9B,SAASC,OAAY;AACnBvC,YAAM,4CAA4CuC,KAAAA;AAClD,aAAO1B,QAAQC,OAAOC,MAAM,wDAAwDwB,MAAMC,SAAQ,CAAA,CAAA;IACpG;AAEA,UAAMC,UAAmCjC,SAASoB,QAAQ;AAC1D,UAAMc,MAAM,MAAMC,6BAChB;MACEhC,KAAKW;MACLF,OAAOA,SAASZ,QAAQY,SAASZ,QAAQoC,OAAO,GAAGf,OAAOgB,GAAG;MAC7DrC,SAAS;QACPkC,KAAK;UACHE,KAAK,GAAGf,OAAOgB,GAAG;UAClBjB,MAAMa;UACNK,cAAcjB,OAAOkB,KAAK,CAAA,EAAGD;UAC7BE,eAAenB,OAAOkB,KAAK,CAAA,EAAGC;QAChC;MACF;IACF,GACA3B,OAAAA;AAGF,UAAM4B,aAA4C;MAChDJ,KAAKhB,OAAOgB;MACZK,iBAAiBR,IAAIE;MACrBG,MAAM;QAACL;;MACPS,UAAU,CAAA;IACZ;AACAnD,UAAM,WAAWiD,WAAWJ,GAAG;AAC/B,WAAOI;EACT;EAEA,MAAMxB,yBACJ,EAAEd,KAAKH,QAAO,GACda,SACwC;AACxC,UAAMf,mBAAmB,KAAKA;AAC9B,QAAI,CAACA,kBAAkB;AACrB,aAAOO,QAAQC,OAAOC,MAAM,mCAAA,CAAA;IAC9B;AAEA,UAAML,cAAc,MAAM,KAAKA,YAAYC,KAAK,KAAKN,UAAU;AAC/D,UAAM+C,SACJ5C,QAAQkC,OAAQ,MAAMpC,iBAAiB+C,kBAAkB7C,QAAQoC,OAAO,WAAWlC,aAAaF,QAAQe,MAAM+B,WAAW,OAAO9C,QAAQoB,IAAI;AAC9I,UAAMgB,MAAMQ,OAAOR;AACnB,UAAMH,UAAUW,OAAOxB;AACvB,UAAMc,MAAMa,UAAU;MAAET,cAAcM,OAAON;MAAcL;IAAQ,CAAA;AAEnEe,YAAQC,IAAI,qBAAqBf,GAAAA,EAAK;AACtC,QAAIgB;AACJ,QAAI;AACF,YAAMC,cAAc;;QAElBjB;QACAlC,SAAS;UACPe,MAAM;UACNI,UAAUc;QACZ;MACF;AACAe,cAAQC,IAAI;EAAoBvB,KAAKC,UAAUwB,aAAa,MAAM,CAAA,CAAA;CAAM;AACxE,YAAM7B,WAAW,MAAMC,MAAM7B,qBAAqB;QAChD8B,QAAQ;QACRC,SAAS;UACP,gBAAgB;QAClB;QACAP,MAAMQ,KAAKC,UAAUwB,WAAAA;MACvB,CAAA;AACA,UAAI,CAAC7B,SAASM,IAAI;AAChBpC,cAAM,0CAA0C2D,aAAa7B,QAAAA;AAC7D,eAAOjB,QAAQC,OAAOC,MAAM,kCAAkCe,SAASO,UAAU,CAAA;MACnF;AACAqB,kBAAY,MAAM5B,SAASQ,KAAI;AAC/BkB,cAAQC,IAAI;EAAqBvB,KAAKC,UAAUuB,WAAW,MAAM,CAAA,CAAA;CAAM;IACzE,SAASnB,OAAY;AACnBiB,cAAQC,IAAI,4CAA4ClB,KAAAA;AACxD,aAAO1B,QAAQC,OAAOC,MAAM,wDAAwDwB,MAAMC,SAAQ,CAAA,CAAA;IACpG;AAGA,UAAM,EAAEoB,KAAI,IAAKF;AACjB,UAAMG,YAAY,MAAMvD,iBAAiBwD,aAAalB,KAAKgB,IAAAA;AAE3DJ,YAAQC,IAAI,cAAcI,SAAAA,EAAW;AAErC,UAAME,cAAc;MAClBrB;MACAlC,SAAS;QACPe,MAAM;QACNI,UAAUc;QACVuB,KAAKH;MACP;IACF;AACAL,YAAQC,IAAI;EAAoBvB,KAAKC,UAAU4B,aAAa,MAAM,CAAA,CAAA;CAAM;AAIxE,QAAIlC;AACJ,QAAI;AACF,YAAMC,WAAW,MAAMC,MAAM7B,qBAAqB;QAChD8B,QAAQ;QACRC,SAAS;UACP,gBAAgB;QAClB;QACAP,MAAMQ,KAAKC,UAAU4B,WAAAA;MACvB,CAAA;AACA,UAAI,CAACjC,SAASM,IAAI;AAChBoB,gBAAQC,IAAI,yCAAyCvB,KAAKC,UAAUL,SAASmC,IAAI,CAAA,GAAInC,SAASO,UAAU,IAAIP,QAAAA;AAC5G9B,cAAM,0CAA0C8B,QAAAA;AAChD,eAAOjB,QAAQC,OAAOC,MAAM,kCAAkCe,SAASO,UAAU,CAAA;MACnF;AACAR,eAAS,MAAMC,SAASQ,KAAI;IAC9B,SAASC,OAAY;AACnBvC,YAAM,4CAA4CuC,KAAAA;AAClD,aAAO1B,QAAQC,OAAOC,MAAM,wDAAwDwB,MAAMC,SAAQ,CAAA,CAAA;IACpG;AAEA,UAAMS,aAA4C;MAChDJ,KAAKhB,OAAOgB;MACZK,iBAAiBE,OAAOR;MACxBG,MAAM;QAACK;;MACPD,UAAU,CAAA;IACZ;AACAnD,UAAM,WAAWiD,WAAWJ,GAAG;AAC/B,WAAOI;EACT;EAEA,MAAMiB,iBACJC,MACA9C,SACsB;AACtB,UAAM,IAAIN,MAAM,oDAAA;EAClB;EAEA,MAAMqD,iBAAiBnB,YAAyB5B,SAAqC;AACnF,eAAW,EAAEuB,IAAG,KAAMK,WAAWF,MAAM;AACrC,YAAM1B,QAAQgD,MAAMC,iBAAiB;QAAE1B;MAAI,CAAA;IAC7C;AACA,WAAO;EACT;EAEA,MAAM2B,OAAO,EAAEtB,YAAYP,KAAKlC,QAAO,GAA2Da,SAAiC;AACjI,WAAO;MAAEmD,SAAS;IAAK;EACzB;EAEA,MAAMC,WAAW,EAAExB,YAAYyB,SAASlE,QAAO,GAAmEa,SAAiC;AACjJ,WAAO;MAAEmD,SAAS;IAAK;EACzB;EAEA,MAAMG,UAAUR,MAA+D9C,SAAiC;AAC9G,WAAO;MAAEmD,SAAS;IAAK;EACzB;EAEA,MAAMI,cAAcT,MAA8D9C,SAAiC;AACjH,WAAO;MAAEmD,SAAS;IAAK;EACzB;AACF;AAEA,IAAMK,YAAY;EAChBC,KAAK;EACLC,SAAS;EACTC,QAAQ;EACRC,WAAW;EACXC,WAAW;EACXC,YAAY;EACZC,YAAY;AACd;AAEA,IAAM7B,YAAY,wBAAC,EAAET,cAAcL,UAAU,YAAW,MAAgD;AACtG,QAAM4C,YAAYR,UAAUpC,OAAAA;AAG5B,SACGD,aAAS8C,UAAUC,OAAO,aAAaC,WAAWC,UAAUJ,WAAuCK,eAAW5C,cAAc,KAAA,CAAA,CAAA,CAAA,EAC5HN,SAAQ;AACb,GAPkB;;;ACzPlB,OAAOmD,YAAW;AAElB,IAAMC,gBAA6B,8BACjCC,QACAC,SACAC,WACAC,YAAAA;AAEA,MAAI;AACF,UAAMC,UAAkB;AAExB,UAAMC,WAAW,MAAMC,OAAM,GAAGF,OAAAA,oBAA2BJ,MAAAA,EAAQ;AACnE,QAAI,CAACK,SAASE,IAAI;AAChB,YAAM,IAAIC,MAAM,kCAAkCH,SAASI,UAAU;IACvE;AACA,UAAMC,SAAS,MAAML,SAASM,KAAI;AAClC,WAAOD;EACT,SAASE,KAAU;AACjB,WAAO;MACLC,qBAAqB,CAAC;MACtBC,uBAAuB;QAAEC,OAAO;QAAcC,SAASJ,IAAIK,SAAQ;MAAG;MACtEC,aAAa;IACf;EACF;AACF,GAtBmC;AA6B5B,SAASC,oBAAAA;AACd,SAAO;IAAEC,KAAKrB;EAAc;AAC9B;AAFgBoB;","names":["importProvidedOrGeneratedKey","AbstractIdentifierProvider","fetch","Multibase","Multicodec","u8a","Debug","debug","Debug","OYDID_REGISTRAR_URL","OydDIDProvider","AbstractIdentifierProvider","defaultKms","cmsmCallbackOpts","constructor","options","clientManagedSecretMode","assertedKms","kms","length","Promise","reject","Error","result","find","k","createIdentifier","alias","context","resolvedKms","cmsm","enabled","createIdentifierWithCMSM","body","key_type","type","didDoc","response","fetch","method","headers","JSON","stringify","ok","statusText","json","error","toString","keyType","key","importProvidedOrGeneratedKey","kid","did","publicKeyHex","keys","privateKeyHex","identifier","controllerKeyId","services","pubKey","publicKeyCallback","create","base58btc","console","log","signValue","body_create","sign","signature","signCallback","body_signed","sig","text","updateIdentifier","args","deleteIdentifier","agent","keyManagerDelete","addKey","success","addService","service","removeKey","removeService","keyCodecs","RSA","Ed25519","X25519","Secp256k1","Secp256r1","Bls12381G1","Bls12381G2","codecName","Multibase","encode","Multicodec","addPrefix","fromString","fetch","resolveDidOyd","didUrl","_parsed","_resolver","options","baseUrl","response","fetch","ok","Error","statusText","didDoc","json","err","didDocumentMetadata","didResolutionMetadata","error","message","toString","didDocument","getDidOydResolver","oyd"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sphereon/did-provider-oyd",
   "description": "OwnYourData plugin that can enable creation and control of did:oyd identifiers.",
-  "version": "0.28.1-feature.jose.vcdm.28+d413275",
+  "version": "0.28.1-feature.jose.vcdm.51+e61d3fd",
   "source": "./src/index.ts",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -23,15 +23,22 @@
     "extract-api": "sphereon dev extract-api"
   },
   "dependencies": {
+    "@sphereon/ssi-sdk-ext.key-utils": "0.28.1-feature.jose.vcdm.51+e61d3fd",
     "@veramo/core": "4.2.0",
     "@veramo/did-manager": "4.2.0",
     "cross-fetch": "^4.0.0",
     "debug": "^4.3.3",
-    "did-resolver": "^4.1.0"
+    "did-resolver": "^4.1.0",
+    "multibase": "^4.0.6",
+    "multicodec": "^3.2.1",
+    "uint8arrays": "^3.1.1"
   },
   "devDependencies": {
-    "@sphereon/ssi-sdk.dev": "0.33.1-feature.jose.vcdm.56",
-    "@types/debug": "4.1.8",
+    "@sphereon/ssi-sdk-ext.key-manager": "0.28.1-feature.jose.vcdm.51+e61d3fd",
+    "@sphereon/ssi-sdk-ext.kms-local": "0.28.1-feature.jose.vcdm.51+e61d3fd",
+    "@sphereon/ssi-sdk.dev": "0.33.0",
+    "@types/debug": "4.1.12",
+    "@veramo/key-manager": "4.2.0",
     "inquirer": "^9.1.4",
     "inquirer-autocomplete-prompt": "^3.0.0",
     "typescript": "5.8.3"
@@ -49,5 +56,5 @@
   "author": "Christoph Fabianek <christoph@ownyourdata.eu>",
   "keywords": [],
   "license": "MIT",
-  "gitHead": "d41327554c8ad92fdd214e3aa6832218384f265f"
+  "gitHead": "e61d3fd20099c2b3fb457a1227a10b63e777a90f"
 }

package/src/index.ts

@@ -4,6 +4,6 @@
  *
  * @packageDocumentation
  */
-export { OydDIDProvider } from './oyd-did-provider.js'
-export { getDidOydResolver } from './resolver.js'
-export * from './types/oyd-provider-types.js'
+export { OydDIDProvider } from './oyd-did-provider'
+export { getDidOydResolver } from './resolver'
+export type * from './types/oyd-provider-types'

package/src/oyd-did-provider.ts

@@ -1,10 +1,25 @@
-import { IIdentifier, IKey, IService, IAgentContext, IKeyManager } from '@veramo/core'
+import { importProvidedOrGeneratedKey } from '@sphereon/ssi-sdk-ext.key-utils'
+import { IAgentContext, IIdentifier, IKey, IKeyManager, IService, TKeyType } from '@veramo/core'
 import { AbstractIdentifierProvider } from '@veramo/did-manager'
-import type { OydCreateIdentifierOptions, OydDidHoldKeysArgs, OydDidSupportedKeyTypes } from './types/oyd-provider-types.js'
+import { KeyManager } from '@veramo/key-manager'
 import fetch from 'cross-fetch'
+import Multibase from 'multibase'
+import Multicodec from 'multicodec'
+
+// @ts-ignore
+import * as u8a from 'uint8arrays'
 
 import Debug from 'debug'
+import type {
+  CMSMCallbackOpts,
+  OydConstructorOptions,
+  OydCreateIdentifierOptions,
+  // OydDidHoldKeysArgs,
+  OydDidSupportedKeyTypes,
+} from './types/oyd-provider-types'
+
 const debug = Debug('veramo:oyd-did:identifier-provider')
+const OYDID_REGISTRAR_URL = 'https://oydid-registrar.data-container.net/1.0/createIdentifier'
 
 type IContext = IAgentContext<IKeyManager>
 
@@ -13,23 +28,48 @@ type IContext = IAgentContext<IKeyManager>
  * @public
  */
 export class OydDIDProvider extends AbstractIdentifierProvider {
-  private defaultKms?: string
+  private readonly defaultKms?: string
+  private readonly cmsmCallbackOpts?: CMSMCallbackOpts
 
-  constructor(options: { defaultKms?: string }) {
+  constructor(options?: OydConstructorOptions) {
     super()
-    this.defaultKms = options.defaultKms
+    this.defaultKms = options?.defaultKms
+    this.cmsmCallbackOpts = options?.clientManagedSecretMode
+  }
+
+  private async assertedKms(...kms: (string | undefined)[]): Promise<string> {
+    if (!kms || kms.length === 0) {
+      return Promise.reject(Error('KMS must be provided either as a parameter or via defaultKms.'))
+    }
+    const result = kms.find((k) => !!k)
+    if (!result) {
+      return Promise.reject(Error('KMS must be provided either as a parameter or via defaultKms.'))
+    }
+    return result
   }
 
   async createIdentifier(
-    { kms, options }: { kms?: string; options: OydCreateIdentifierOptions },
+    { kms, alias, options }: { kms?: string; alias?: string; options: OydCreateIdentifierOptions },
     context: IContext
   ): Promise<Omit<IIdentifier, 'provider'>> {
-    const body = { options }
-    const url = 'https://oydid-registrar.data-container.net/1.0/createIdentifier'
+    const resolvedKms = await this.assertedKms(kms, this.defaultKms)
+
+    if ((this.cmsmCallbackOpts && !options.cmsm) || (options.cmsm && options.cmsm.enabled !== false)) {
+      if (!this.cmsmCallbackOpts) {
+        return Promise.reject(Error('did:oyd: no cmsm options defined on oyd did provider, but cmsm was enabled on the call!'))
+      }
+      return await this.createIdentifierWithCMSM({ kms: resolvedKms, options }, context)
+    }
 
+    const body = {
+      options: {
+        cmsm: false,
+        key_type: options.type ?? 'Secp256r1',
+      },
+    }
     let didDoc: any | undefined
     try {
-      const response = await fetch(url, {
+      const response = await fetch(OYDID_REGISTRAR_URL, {
         method: 'POST',
         headers: {
           'Content-Type': 'application/json',
@@ -37,24 +77,27 @@ export class OydDIDProvider extends AbstractIdentifierProvider {
         body: JSON.stringify(body),
       })
       if (!response.ok) {
-        throw new Error('Network response was not ok: ' + response.statusText)
+        debug('Error response from OydDID Registrar: ', response)
+        return Promise.reject(Error('Network response was not ok: ' + response.statusText))
       }
       didDoc = await response.json()
-    } catch (error) {
-      // @ts-ignore
-      throw new Error('There has been a problem with the fetch operation: ' + error.toString())
+    } catch (error: any) {
+      debug('Unexpected error from OydDID Registrar: ', error)
+      return Promise.reject(Error('There has been a problem with the fetch operation: ' + error.toString()))
     }
 
-    const keyType: OydDidSupportedKeyTypes = options?.keyType || 'Ed25519'
-    const key = await this.holdKeys(
+    const keyType: OydDidSupportedKeyTypes = options?.type ?? 'Secp256r1'
+    const key = await importProvidedOrGeneratedKey(
       {
-        // @ts-ignore
-        kms: kms || this.defaultKms,
+        kms: resolvedKms,
+        alias: alias ?? options.alias ?? options.kid ?? `${didDoc.did}#key-doc`,
         options: {
-          keyType,
-          kid: didDoc.did + '#key-doc',
-          publicKeyHex: didDoc.keys[0].publicKeyHex,
-          privateKeyHex: didDoc.keys[0].privateKeyHex,
+          key: {
+            kid: `${didDoc.did}#key-doc`,
+            type: keyType,
+            publicKeyHex: didDoc.keys[0].publicKeyHex,
+            privateKeyHex: didDoc.keys[0].privateKeyHex,
+          },
         },
       },
       context
@@ -70,6 +113,100 @@ export class OydDIDProvider extends AbstractIdentifierProvider {
     return identifier
   }
 
+  async createIdentifierWithCMSM(
+    { kms, options }: { kms?: string; options: OydCreateIdentifierOptions },
+    context: IContext
+  ): Promise<Omit<IIdentifier, 'provider'>> {
+    const cmsmCallbackOpts = this.cmsmCallbackOpts
+    if (!cmsmCallbackOpts) {
+      return Promise.reject(Error('did:oyd: no cmsm options defined!'))
+    }
+
+    const assertedKms = await this.assertedKms(kms, this.defaultKms)
+    const pubKey =
+      options.key ?? (await cmsmCallbackOpts.publicKeyCallback(options.kid ?? 'default', assertedKms, options.cmsm?.create !== false, options.type)) // "default" is probably not right, TODO!!
+    const kid = pubKey.kid
+    const keyType = pubKey.type
+    const key = base58btc({ publicKeyHex: pubKey.publicKeyHex, keyType })
+
+    console.log(`Bae58 pubkey key: ${key}`)
+    let signValue: any | undefined // do the request
+    try {
+      const body_create = {
+        // specify the Identifier options for the registrar
+        key: key,
+        options: {
+          cmsm: true,
+          key_type: keyType,
+        },
+      }
+      console.log(`Create request:\n${JSON.stringify(body_create, null, 2)}\n`)
+      const response = await fetch(OYDID_REGISTRAR_URL, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify(body_create),
+      })
+      if (!response.ok) {
+        debug('Error response from OydDID Registrar: ', body_create, response)
+        return Promise.reject(Error('Network response was not ok: ' + response.statusText))
+      }
+      signValue = await response.json()
+      console.log(`Create response:\n${JSON.stringify(signValue, null, 2)}\n`)
+    } catch (error: any) {
+      console.log('Unexpected error from OydDID Registrar: ', error)
+      return Promise.reject(Error('There has been a problem with the fetch operation: ' + error.toString()))
+    }
+
+    // we received our value to sign, now we sign it!
+    const { sign } = signValue
+    const signature = await cmsmCallbackOpts.signCallback(kid, sign)
+
+    console.log(`Signature: ${signature}`)
+
+    const body_signed = {
+      key,
+      options: {
+        cmsm: true,
+        key_type: keyType,
+        sig: signature,
+      },
+    }
+    console.log(`Signed request:\n${JSON.stringify(body_signed, null, 2)}\n`)
+
+    // Object.assign(body_signed.options, options)
+
+    let didDoc: any | undefined // do the request
+    try {
+      const response = await fetch(OYDID_REGISTRAR_URL, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify(body_signed),
+      })
+      if (!response.ok) {
+        console.log(`Error response from OydDID Registrar: ${JSON.stringify(response.text)}${response.statusText}`, response)
+        debug('Error response from OydDID Registrar: ', response)
+        return Promise.reject(Error('Network response was not ok: ' + response.statusText))
+      }
+      didDoc = await response.json()
+    } catch (error: any) {
+      debug('Unexpected error from OydDID Registrar: ', error)
+      return Promise.reject(Error('There has been a problem with the fetch operation: ' + error.toString()))
+    }
+
+    const identifier: Omit<IIdentifier, 'provider'> = {
+      did: didDoc.did,
+      controllerKeyId: pubKey.kid,
+      keys: [pubKey],
+      services: [],
+    }
+    debug('Created', identifier.did)
+    return identifier
+  }
+
   async updateIdentifier(
     args: { did: string; kms?: string | undefined; alias?: string | undefined; options?: any },
     context: IAgentContext<IKeyManager>
@@ -99,27 +236,85 @@ export class OydDIDProvider extends AbstractIdentifierProvider {
   async removeService(args: { identifier: IIdentifier; id: string; options?: any }, context: IContext): Promise<any> {
     return { success: true }
   }
+}
+
+const keyCodecs = {
+  RSA: 'rsa-pub',
+  Ed25519: 'ed25519-pub',
+  X25519: 'x25519-pub',
+  Secp256k1: 'secp256k1-pub',
+  Secp256r1: 'p256-pub',
+  Bls12381G1: 'bls12_381-g1-pub',
+  Bls12381G2: 'bls12_381-g2-pub',
+} as const
 
-  private async holdKeys(args: OydDidHoldKeysArgs, context: IContext): Promise<IKey> {
-    if (args.options.privateKeyHex) {
-      return context.agent.keyManagerImport({
-        // @ts-ignore
-        kms: args.kms || this.defaultKms,
-        type: args.options.keyType,
-        kid: args.options.kid,
-        privateKeyHex: args.options.privateKeyHex,
-        meta: {
-          algorithms: ['Ed25519'],
+const base58btc = ({ publicKeyHex, keyType = 'Secp256r1' }: { publicKeyHex: string; keyType?: TKeyType }): string => {
+  const codecName = keyCodecs[keyType]
+
+  // methodSpecificId  = bytesToMultibase({bytes: u8a.fromString(key.publicKeyHex, 'hex'), codecName})
+  return u8a
+    .toString(Multibase.encode('base58btc', Multicodec.addPrefix(codecName as Multicodec.CodecName, u8a.fromString(publicKeyHex, 'hex'))))
+    .toString()
+}
+
+export function defaultOydCmsmPublicKeyCallback(
+  keyManager: KeyManager
+): (kid: string, kms?: string, create?: boolean, createKeyType?: TKeyType) => Promise<IKey> {
+  return async (kid: string, kms?: string, create?: boolean, createKeyType?: TKeyType): Promise<IKey> => {
+    try {
+      const existing = await keyManager.keyManagerGet({ kid })
+      if (existing) {
+        return existing
+      }
+    } catch (error: any) {}
+    if (create) {
+      if (!kms) {
+        return Promise.reject(Error('No KMS provided, whilst creating a new key!'))
+      }
+      const alias = kid ?? `oyd-${new Date().toISOString()}`
+
+      const agent = keyManager
+      const key = await importProvidedOrGeneratedKey(
+        {
+          kms,
+          alias,
+          options: {
+            key: {
+              type: createKeyType ?? 'Secp256r1',
+            },
+          },
         },
-      })
+        {
+          //@ts-ignore
+          agent,
+        }
+      )
+      return key
+
+      // return await keyManager.keyManagerCreate({ kms, type: createKeyType ?? 'Secp256r1' })
     }
-    return context.agent.keyManagerCreate({
-      type: args.options.keyType,
-      // @ts-ignore
-      kms: args.kms || this.defaultKms,
-      meta: {
-        algorithms: ['Ed25519'],
-      },
-    })
+    return Promise.reject(Error('No existing key found, and create is false!'))
+  }
+}
+
+export function defaultOydCmsmSignCallback(keyManager: KeyManager): (kid: string, data: string) => Promise<string> {
+  return async (kid: string, data: string): Promise<string> => {
+    return keyManager.keyManagerSign({ keyRef: kid, data, encoding: 'utf-8' })
+  }
+}
+
+export class DefaultOydCmsmCallbacks implements CMSMCallbackOpts {
+  private readonly keyManager: KeyManager
+
+  constructor(keyManager: KeyManager) {
+    this.keyManager = keyManager
+  }
+
+  publicKeyCallback(kid: string, kms?: string, create?: boolean, createKeyType?: TKeyType): Promise<IKey> {
+    return defaultOydCmsmPublicKeyCallback(this.keyManager)(kid, kms, create, createKeyType)
+  }
+
+  signCallback(kid: string, value: string): Promise<string> {
+    return defaultOydCmsmSignCallback(this.keyManager)(kid, value)
   }
 }

package/src/types/oyd-provider-types.ts

@@ -1,11 +1,27 @@
+import { IKey, TKeyType } from '@veramo/core'
+
+export type OydConstructorOptions = {
+  defaultKms?: string
+  clientManagedSecretMode?: CMSMCallbackOpts
+}
+
 export type OydCreateIdentifierOptions = {
-  keyType?: OydDidSupportedKeyTypes
+  type?: OydDidSupportedKeyTypes
   privateKeyHex?: string
+  kid?: string
+  alias?: string
   keyUse?: KeyUse
+  cmsm?: CmsmOptions
+  key?: IKey // Use the supplied key instead of looking it up in the KMS or creating a new one
+}
+
+export type CmsmOptions = {
+  enabled: boolean
+  create?: boolean
 }
 
 export type OydDidHoldKeysArgs = {
-  kms: string
+  kms?: string
   options: HoldKeysOpts
 }
 
@@ -16,7 +32,12 @@ type HoldKeysOpts = {
   privateKeyHex?: string
 }
 
-export enum SupportedKeyTypes {
+export type CMSMCallbackOpts = {
+  publicKeyCallback: (kid: string, kms?: string, create?: boolean, createKeyType?: TKeyType) => Promise<IKey>
+  signCallback: (kid: string, value: string) => Promise<string>
+}
+
+enum SupportedKeyTypes {
   Secp256r1 = 'Secp256r1',
   Secp256k1 = 'Secp256k1',
   Ed25519 = 'Ed25519',