@sphereon/ssi-sdk.data-store 0.29.1-next.105 → 0.29.1-next.122

package/src/digitalCredential/DigitalCredentialStore.ts

@@ -1,14 +1,15 @@
 import { AbstractDigitalCredentialStore } from './AbstractDigitalCredentialStore'
 import {
   AddCredentialArgs,
+  CredentialRole,
+  CredentialStateType,
+  DigitalCredential,
   GetCredentialArgs,
   GetCredentialsArgs,
   GetCredentialsResponse,
+  NonPersistedDigitalCredential,
   RemoveCredentialArgs,
   UpdateCredentialStateArgs,
-  CredentialStateType,
-  DigitalCredential,
-  NonPersistedDigitalCredential,
 } from '../types'
 import { OrPromise } from '@sphereon/ssi-types'
 import { DataSource, FindOptionsOrder, Repository } from 'typeorm'
@@ -26,6 +27,7 @@ const debug: Debug.Debugger = Debug('sphereon:ssi-sdk:credential-store')
 
 export class DigitalCredentialStore extends AbstractDigitalCredentialStore {
   private readonly dbConnection: OrPromise<DataSource>
+  private dcRepo: Repository<DigitalCredentialEntity> | undefined
 
   constructor(dbConnection: OrPromise<DataSource>) {
     super()
@@ -34,14 +36,19 @@ export class DigitalCredentialStore extends AbstractDigitalCredentialStore {
 
   addCredential = async (args: AddCredentialArgs): Promise<DigitalCredential> => {
     debug('Adding credential', args)
-    const digitalCredentialEntityRepository: Repository<DigitalCredentialEntity> = (await this.dbConnection).getRepository(DigitalCredentialEntity)
     const credentialEntity: NonPersistedDigitalCredential = nonPersistedDigitalCredentialEntityFromAddArgs(args)
-    const createdResult: DigitalCredentialEntity = await digitalCredentialEntityRepository.save(credentialEntity)
+    const validationError = this.assertValidDigitalCredential(credentialEntity)
+    if (validationError) {
+      return Promise.reject(validationError)
+    }
+    const dcRepo = await this.getRepository()
+    const createdResult: DigitalCredentialEntity = await dcRepo.save(credentialEntity)
     return Promise.resolve(digitalCredentialFrom(createdResult))
   }
 
   getCredential = async (args: GetCredentialArgs): Promise<DigitalCredential> => {
-    const result: DigitalCredentialEntity | null = await (await this.dbConnection).getRepository(DigitalCredentialEntity).findOne({
+    const dcRepo = await this.getRepository()
+    const result: DigitalCredentialEntity | null = await dcRepo.findOne({
       where: args,
     })
 
@@ -57,7 +64,8 @@ export class DigitalCredentialStore extends AbstractDigitalCredentialStore {
       order && typeof order === 'string'
         ? parseAndValidateOrderOptions<DigitalCredentialEntity>(order)
         : <FindOptionsOrder<DigitalCredentialEntity>>order
-    const [result, total] = await (await this.dbConnection).getRepository(DigitalCredentialEntity).findAndCount({
+    const dcRepo = await this.getRepository()
+    const [result, total] = await dcRepo.findAndCount({
       where: filter,
       skip: offset,
       take: limit,
@@ -84,15 +92,42 @@ export class DigitalCredentialStore extends AbstractDigitalCredentialStore {
       return false
     }
     try {
-      const connection = await this.dbConnection
-      const result = await connection.getRepository(DigitalCredentialEntity).delete(query)
-      return result.affected === 1
+      const dcRepo = await this.getRepository()
+      // TODO create a flag whether we want to delete recursively or return an error when there are child credentials?
+      const affected = await this.deleteTree(dcRepo, query)
+      return affected > 0
     } catch (error) {
       console.error('Error removing digital credential:', error)
       return false
     }
   }
 
+  private async deleteTree(dcRepo: Repository<DigitalCredentialEntity>, query: FindOptionsWhere<DigitalCredentialEntity>): Promise<number> {
+    let affected: number = 0
+    const findResult = await dcRepo.findBy(query)
+    for (const dc of findResult) {
+      if (dc.parentId !== null && dc.parentId !== undefined) {
+        affected += await this.deleteTree(dcRepo, { id: dc.parentId })
+      }
+      const result = await dcRepo.delete(dc.id)
+      if (result.affected) {
+        affected += result.affected
+      }
+    }
+    return affected
+  }
+
+  private async getRepository(): Promise<Repository<DigitalCredentialEntity>> {
+    if (this.dcRepo !== undefined) {
+      return Promise.resolve(this.dcRepo)
+    }
+    this.dcRepo = (await this.dbConnection).getRepository(DigitalCredentialEntity)
+    if (this.dcRepo === undefined) {
+      return Promise.reject(Error('Could not get DigitalCredentialEntity repository'))
+    }
+    return this.dcRepo
+  }
+
   updateCredentialState = async (args: UpdateCredentialStateArgs): Promise<DigitalCredential> => {
     const credentialRepository: Repository<DigitalCredentialEntity> = (await this.dbConnection).getRepository(DigitalCredentialEntity)
     const whereClause: Record<string, any> = {}
@@ -123,6 +158,7 @@ export class DigitalCredentialStore extends AbstractDigitalCredentialStore {
       ...credential,
       ...(args.verifiedState !== CredentialStateType.REVOKED && { verifiedAt: args.verifiedAt }),
       ...(args.verifiedState === CredentialStateType.REVOKED && { revokedAt: args.revokedAt }),
+      identifierMethod: credential.identifierMethod,
       lastUpdatedAt: new Date(),
       verifiedState: args.verifiedState,
     }
@@ -130,4 +166,24 @@ export class DigitalCredentialStore extends AbstractDigitalCredentialStore {
     const updatedResult: DigitalCredentialEntity = await credentialRepository.save(updatedCredential, { transaction: true })
     return digitalCredentialFrom(updatedResult)
   }
+
+  private assertValidDigitalCredential(credentialEntity: NonPersistedDigitalCredential): Error | undefined {
+    const { kmsKeyRef, identifierMethod, credentialRole, isIssuerSigned } = credentialEntity
+
+    const isRoleInvalid = credentialRole === CredentialRole.ISSUER || (credentialRole === CredentialRole.HOLDER && !isIssuerSigned)
+
+    if (isRoleInvalid && (!kmsKeyRef || !identifierMethod)) {
+      const missingFields = []
+
+      if (!kmsKeyRef) missingFields.push('kmsKeyRef')
+      if (!identifierMethod) missingFields.push('identifierMethod')
+
+      const fields = missingFields.join(' and ')
+      return new Error(
+        `DigitalCredential field(s) ${fields} is/are required for credential role ${credentialRole} with isIssuerSigned=${isIssuerSigned}.`,
+      )
+    }
+
+    return undefined
+  }
 }

package/src/entities/digitalCredential/DigitalCredentialEntity.ts

@@ -6,6 +6,7 @@ import {
   CredentialStateType,
   DigitalCredential,
   DocumentType,
+  RegulationType,
 } from '../../types'
 import { typeormDate, typeOrmDateTime } from '@sphereon/ssi-sdk.agent-config'
 
@@ -14,9 +15,15 @@ export class DigitalCredentialEntity extends BaseEntity implements DigitalCreden
   @PrimaryGeneratedColumn('uuid')
   id!: string
 
+  @Column('text', { name: 'parent_id', nullable: true })
+  parentId?: string
+
   @Column('simple-enum', { name: 'document_type', enum: DocumentType, nullable: false })
   documentType!: DocumentType
 
+  @Column('simple-enum', { name: 'regulation_type', enum: RegulationType, nullable: false })
+  regulationType!: RegulationType
+
   @Column('simple-enum', { name: 'document_format', enum: CredentialDocumentFormat, nullable: false })
   documentFormat!: CredentialDocumentFormat
 
@@ -35,18 +42,33 @@ export class DigitalCredentialEntity extends BaseEntity implements DigitalCreden
   @Column('text', { name: 'hash', nullable: false, unique: true })
   hash!: string
 
+  @Column('text', { name: 'kms_key_ref', nullable: true })
+  kmsKeyRef!: string
+
+  @Column('text', { name: 'identifier_method', nullable: true })
+  identifierMethod!: string
+
   @Column('simple-enum', { name: 'issuer_correlation_type', enum: CredentialCorrelationType, nullable: false })
   issuerCorrelationType!: CredentialCorrelationType
 
   @Column('simple-enum', { name: 'subject_correlation_type', enum: CredentialCorrelationType, nullable: true })
   subjectCorrelationType?: CredentialCorrelationType
 
+  @Column('simple-enum', { name: 'rp_correlation_type', enum: CredentialCorrelationType, nullable: true })
+  rpCorrelationType?: CredentialCorrelationType
+
+  @Column('boolean', { name: 'issuer_signed', nullable: true })
+  isIssuerSigned?: boolean
+
   @Column('text', { name: 'issuer_correlation_id', nullable: false })
   issuerCorrelationId!: string
 
   @Column('text', { name: 'subject_correlation_id', nullable: true })
   subjectCorrelationId?: string
 
+  @Column('text', { name: 'rp_correlation_id', nullable: true })
+  rpCorrelationId?: string
+
   @Column('simple-enum', { name: 'verified_state', enum: CredentialStateType, nullable: true })
   verifiedState?: CredentialStateType
 
@@ -56,6 +78,9 @@ export class DigitalCredentialEntity extends BaseEntity implements DigitalCreden
   @CreateDateColumn({ name: 'created_at', nullable: false, type: typeOrmDateTime() })
   createdAt!: Date
 
+  @Column({ name: 'presented_at', nullable: true, type: typeormDate() })
+  presentedAt?: Date
+
   @UpdateDateColumn({ name: 'last_updated_at', nullable: false, type: typeOrmDateTime() })
   lastUpdatedAt!: Date
 

package/src/index.ts

@@ -156,3 +156,5 @@ export {
   isPresentationDefinitionEqual,
   ContactMetadataItemEntity,
 }
+
+export * from './utils/hasher'

package/src/migrations/postgres/1708525189001-CreateDigitalCredential.ts

@@ -5,34 +5,46 @@ export class CreateDigitalCredential1708525189001 implements MigrationInterface
 
   public async up(queryRunner: QueryRunner): Promise<void> {
     await queryRunner.query(`CREATE TYPE "digital_document_type" AS ENUM('VC', 'VP', 'C', 'P')`)
-    await queryRunner.query(`CREATE TYPE "digital_credential_document_format" AS ENUM('JSON_LD', 'JWT', 'SD_JWT', 'MDOC')`)
+    await queryRunner.query(`CREATE TYPE "digital_regulation_type" AS ENUM('PID', 'QEAA', 'EAA', 'NON_REGULATED')`)
+    await queryRunner.query(`CREATE TYPE "digital_credential_document_format" AS ENUM('JSON_LD', 'JWT', 'SD_JWT', 'MSO_MDOC')`)
     await queryRunner.query(`CREATE TYPE "digital_credential_credential_role" AS ENUM('ISSUER', 'VERIFIER', 'HOLDER')`)
-    await queryRunner.query(`CREATE TYPE "digital_credential_correlation_type" AS ENUM('DID', 'URL', 'X509_CN')`)
+    await queryRunner.query(`CREATE TYPE "digital_credential_correlation_type" AS ENUM('DID', 'KID', 'URL', 'X509_SAN')`)
     await queryRunner.query(`CREATE TYPE "digital_credential_state_type" AS ENUM('REVOKED', 'VERIFIED', 'EXPIRED')`)
 
+    // TODO FK for parent
+
     await queryRunner.query(`
       CREATE TABLE "DigitalCredential" (
         "id" uuid NOT NULL DEFAULT uuid_generate_v4(),
+        "parent_id" text,
         "document_type" "digital_document_type" NOT NULL,
+        "regulation_type" "digital_regulation_type" NOT NULL DEFAULT 'NON_REGULATED'::"digital_regulation_type",
         "document_format" "digital_credential_document_format" NOT NULL,
         "credential_role" "digital_credential_credential_role" NOT NULL,
         "raw_document" text NOT NULL,
         "uniform_document" text NOT NULL,
         "credential_id" text,
-        "hash" text NOT NULL UNIQUE,
+        "hash" text NOT NULL,
+        "kms_key_ref" text,
+        "identifier_method" text,
         "issuer_correlation_type" "digital_credential_correlation_type" NOT NULL,
         "subject_correlation_type" "digital_credential_correlation_type",
         "issuer_correlation_id" text NOT NULL,
         "subject_correlation_id" text,
         "verified_state" "digital_credential_state_type",
+        "issuer_signed" boolean,
+        "rp_correlation_id" text,
+        "rp_correlation_type" "digital_credential_correlation_type",
         "tenant_id" text,
         "created_at" TIMESTAMP NOT NULL DEFAULT now(),
         "last_updated_at" TIMESTAMP NOT NULL DEFAULT now(),
+        "presented_at" DATE,
         "valid_from" DATE,
         "valid_until" DATE,
         "verified_at" DATE,
         "revoked_at" DATE,
-        PRIMARY KEY ("id")
+        PRIMARY KEY ("id"),
+        UNIQUE ("hash", "credential_role")
       )
     `)
   }
@@ -43,6 +55,7 @@ export class CreateDigitalCredential1708525189001 implements MigrationInterface
     await queryRunner.query(`DROP TYPE "digital_credential_correlation_type"`)
     await queryRunner.query(`DROP TYPE "digital_credential_document_format"`)
     await queryRunner.query(`DROP TYPE "digital_credential_credential_role"`)
+    await queryRunner.query(`DROP TYPE "digital_regulation_type"`)
     await queryRunner.query(`DROP TYPE "digital_document_type"`)
   }
 }

package/src/migrations/sqlite/1708525189002-CreateDigitalCredential.ts

@@ -4,28 +4,38 @@ export class CreateDigitalCredential1708525189002 implements MigrationInterface
   name = 'CreateDigitalCredential1708525189002'
 
   public async up(queryRunner: QueryRunner): Promise<void> {
+    // TODO FK for parent
     await queryRunner.query(`
             CREATE TABLE "DigitalCredential" (
                 "id" varchar PRIMARY KEY NOT NULL,
+                "parent_id" text, 
                 "document_type" varchar CHECK( "document_type" IN ('VC', 'VP', 'C', 'P') ) NOT NULL,
-                "document_format" varchar CHECK( "document_format" IN ('JSON_LD', 'JWT', 'SD_JWT', 'MDOC') ) NOT NULL,
+                "regulation_type" varchar CHECK( "regulation_type" IN ('PID', 'QEAA', 'EAA', 'NON_REGULATED') ) NOT NULL DEFAULT 'NON_REGULATED',
+                "document_format" varchar CHECK( "document_format" IN ('JSON_LD', 'JWT', 'SD_JWT', 'MSO_MDOC') ) NOT NULL,
                 "credential_role" varchar CHECK( "credential_role" IN ('ISSUER', 'VERIFIER', 'HOLDER') ) NOT NULL,
                 "raw_document" text NOT NULL,
                 "uniform_document" text NOT NULL,
                 "credential_id" text,
-                "hash" text NOT NULL UNIQUE,
-                "issuer_correlation_type" varchar CHECK( "issuer_correlation_type" IN ('DID', 'URL', 'X509_CN') ) NOT NULL,
-                "subject_correlation_type" varchar CHECK( "subject_correlation_type" IN ('DID', 'URL', 'X509_CN') ),
+                "hash" text NOT NULL,
+                "kms_key_ref" text,
+                "identifier_method" text,
+                "issuer_correlation_type" varchar CHECK( "issuer_correlation_type" IN ('DID', 'KID', 'URL', 'X509_SAN') ) NOT NULL,
+                "subject_correlation_type" varchar CHECK( "subject_correlation_type" IN ('DID', 'KID', 'URL', 'X509_SAN') ),
                 "issuer_correlation_id" text NOT NULL,
                 "subject_correlation_id" text,
+                "issuer_signed" boolean,
+                "rp_correlation_id" text,
+                "rp_correlation_type" varchar CHECK( "issuer_correlation_type" IN ('DID', 'KID', 'URL', 'X509_SAN') ),
                 "verified_state" varchar CHECK( "verified_state" IN ('REVOKED', 'VERIFIED', 'EXPIRED') ),
                 "tenant_id" text,
                 "created_at" datetime NOT NULL DEFAULT (datetime('now')),
                 "last_updated_at" datetime NOT NULL DEFAULT (datetime('now')),
+                "presented_at" datetime,
                 "valid_from" datetime,
                 "valid_until" datetime,
                 "verified_at" datetime,
-                "revoked_at" datetime
+                "revoked_at" datetime,
+                UNIQUE ("hash", "credential_role")
             )
         `)
   }

package/src/types/contact/contact.ts

@@ -1,4 +1,4 @@
-import { ManagedIdentifierOpts } from '@sphereon/ssi-sdk-ext.identifier-resolution/dist/types'
+import { ManagedIdentifierOptsOrResult } from '@sphereon/ssi-sdk-ext.identifier-resolution'
 import { IIdentifier } from '@veramo/core'
 import { ILocaleBranding } from '../issuanceBranding/issuanceBranding'
 import { CredentialRole } from '../digitalCredential/digitalCredential'
@@ -149,7 +149,7 @@ export type PartialOpenIdConfig = Partial<OpenIdConfig>
 
 export type DidAuthConfig = {
   id: string
-  idOpts: ManagedIdentifierOpts
+  idOpts: ManagedIdentifierOptsOrResult
   stateId: string
   ownerId?: string
   tenantId?: string

package/src/types/digitalCredential/IAbstractDigitalCredentialStore.ts

@@ -1,4 +1,4 @@
-import { CredentialCorrelationType, CredentialRole, CredentialStateType, DigitalCredential } from './digitalCredential'
+import { CredentialCorrelationType, CredentialRole, CredentialStateType, DigitalCredential, RegulationType } from './digitalCredential'
 import { Hasher } from '@sphereon/ssi-types'
 import { FindOptionsOrder } from 'typeorm'
 import { DigitalCredentialEntity } from '../../entities/digitalCredential/DigitalCredentialEntity'
@@ -21,6 +21,10 @@ export type GetCredentialsResponse = {
 
 export type AddCredentialArgs = {
   rawDocument: string
+  kmsKeyRef?: string
+  identifierMethod?: string
+  regulationType?: RegulationType
+  parentId?: string
   issuerCorrelationType: CredentialCorrelationType
   subjectCorrelationType?: CredentialCorrelationType
   issuerCorrelationId: string

package/src/types/digitalCredential/digitalCredential.ts

@@ -1,21 +1,29 @@
-export type NonPersistedDigitalCredential = Omit<DigitalCredential, 'id'>
+export type NonPersistedDigitalCredential = Omit<DigitalCredential, 'id' | 'regulationType'> & { regulationType?: RegulationType }
 
 export type DigitalCredential = {
   id: string
+  parentId?: string
   documentType: DocumentType
   documentFormat: CredentialDocumentFormat
   credentialRole: CredentialRole
+  regulationType: RegulationType
   rawDocument: string
   uniformDocument: string
   credentialId?: string
   hash: string
+  kmsKeyRef?: string
+  identifierMethod?: string
   issuerCorrelationType: CredentialCorrelationType
   subjectCorrelationType?: CredentialCorrelationType
+  rpCorrelationType?: CredentialCorrelationType
+  isIssuerSigned?: boolean
   issuerCorrelationId: string
   subjectCorrelationId?: string
+  rpCorrelationId?: string
   verifiedState?: CredentialStateType
   tenantId?: string
   createdAt: Date
+  presentedAt?: Date
   lastUpdatedAt: Date
   validUntil?: Date
   validFrom?: Date
@@ -30,11 +38,18 @@ export enum DocumentType {
   C = 'C',
 }
 
+export enum RegulationType {
+  PID = 'PID',
+  QEAA = 'QEAA',
+  EAA = 'EAA',
+  NON_REGULATED = 'NON_REGULATED',
+}
+
 export enum CredentialDocumentFormat {
   JSON_LD = 'JSON_LD',
   JWT = 'JWT',
   SD_JWT = 'SD_JWT',
-  MDOC = 'MDOC',
+  MSO_MDOC = 'MSO_MDOC',
 }
 
 export namespace CredentialDocumentFormat {
@@ -45,7 +60,7 @@ export namespace CredentialDocumentFormat {
     } else if (format.includes('ldp')) {
       return CredentialDocumentFormat.JSON_LD
     } else if (format.includes('mso') || credentialFormat.includes('mdoc')) {
-      return CredentialDocumentFormat.MDOC
+      return CredentialDocumentFormat.MSO_MDOC
     } else if (format.includes('jwt_')) {
       return CredentialDocumentFormat.JWT
     } else {
@@ -57,7 +72,7 @@ export namespace CredentialDocumentFormat {
     switch (documentFormat) {
       case CredentialDocumentFormat.SD_JWT:
         return 'vc+sd-jwt'
-      case CredentialDocumentFormat.MDOC:
+      case CredentialDocumentFormat.MSO_MDOC:
         return 'mso_mdoc'
       case CredentialDocumentFormat.JSON_LD:
         return documentType === DocumentType.C || documentType === DocumentType.VC ? 'ldp_vc' : 'ldp_vp'
@@ -69,7 +84,8 @@ export namespace CredentialDocumentFormat {
 
 export enum CredentialCorrelationType {
   DID = 'DID',
-  X509_CN = 'X509_CN',
+  X509_SAN = 'X509_SAN',
+  KID = 'KID',
   URL = 'URL',
 }
 

package/src/utils/digitalCredential/MappingUtils.ts

@@ -3,13 +3,21 @@ import {
   DocumentFormat,
   IVerifiableCredential,
   IVerifiablePresentation,
+  ObjectUtils,
   OriginalVerifiableCredential,
   OriginalVerifiablePresentation,
   SdJwtDecodedVerifiableCredentialPayload,
 } from '@sphereon/ssi-types'
 import { computeEntryHash } from '@veramo/utils'
 import { DigitalCredentialEntity } from '../../entities/digitalCredential/DigitalCredentialEntity'
-import { AddCredentialArgs, CredentialDocumentFormat, DigitalCredential, DocumentType, NonPersistedDigitalCredential } from '../../types'
+import {
+  AddCredentialArgs,
+  CredentialDocumentFormat,
+  DigitalCredential,
+  DocumentType,
+  NonPersistedDigitalCredential,
+  RegulationType,
+} from '../../types'
 
 function determineDocumentType(raw: string): DocumentType {
   const rawDocument = parseRawDocument(raw)
@@ -18,19 +26,26 @@ function determineDocumentType(raw: string): DocumentType {
   }
 
   const hasProof = CredentialMapper.hasProof(rawDocument)
-  const isCredential = CredentialMapper.isCredential(rawDocument)
+  const isCredential = isHex(raw) || ObjectUtils.isBase64(raw) || CredentialMapper.isCredential(rawDocument)
   const isPresentation = CredentialMapper.isPresentation(rawDocument)
 
   if (isCredential) {
-    return hasProof ? DocumentType.VC : DocumentType.C
+    return hasProof || isHex(raw) || ObjectUtils.isBase64(raw) ? DocumentType.VC : DocumentType.C
   } else if (isPresentation) {
     return hasProof ? DocumentType.VP : DocumentType.P
   }
   throw new Error(`Couldn't determine the type of the credential: ${raw}`)
 }
 
-function parseRawDocument(raw: string): OriginalVerifiableCredential | OriginalVerifiablePresentation {
-  if (CredentialMapper.isJwtEncoded(raw) || CredentialMapper.isSdJwtEncoded(raw)) {
+export function isHex(input: string) {
+  return input.match(/^([0-9A-Fa-f])+$/g) !== null
+}
+
+export function parseRawDocument(raw: string): OriginalVerifiableCredential | OriginalVerifiablePresentation {
+  if (isHex(raw) || ObjectUtils.isBase64(raw)) {
+    // mso_mdoc
+    return raw
+  } else if (CredentialMapper.isJwtEncoded(raw) || CredentialMapper.isSdJwtEncoded(raw)) {
     return raw
   }
   try {
@@ -40,6 +55,24 @@ function parseRawDocument(raw: string): OriginalVerifiableCredential | OriginalV
   }
 }
 
+export function ensureRawDocument(input: string | object): string {
+  if (typeof input === 'string') {
+    if (isHex(input) || ObjectUtils.isBase64(input)) {
+      // mso_mdoc
+      return input
+    } else if (CredentialMapper.isJwtEncoded(input) || CredentialMapper.isSdJwtEncoded(input)) {
+      return input
+    }
+    throw Error('Unknown input to be mapped as rawDocument')
+  }
+
+  try {
+    return JSON.stringify(input)
+  } catch (e) {
+    throw new Error(`Can't stringify to a raw credential: ${input}`)
+  }
+}
+
 function determineCredentialDocumentFormat(documentFormat: DocumentFormat): CredentialDocumentFormat {
   switch (documentFormat) {
     case DocumentFormat.JSONLD:
@@ -48,6 +81,8 @@ function determineCredentialDocumentFormat(documentFormat: DocumentFormat): Cred
       return CredentialDocumentFormat.JWT
     case DocumentFormat.SD_JWT_VC:
       return CredentialDocumentFormat.SD_JWT
+    case DocumentFormat.MSO_MDOC:
+      return CredentialDocumentFormat.MSO_MDOC
     default:
       throw new Error(`Not supported document format: ${documentFormat}`)
   }
@@ -77,6 +112,13 @@ function getValidFrom(uniformDocument: IVerifiableCredential | IVerifiablePresen
   return undefined
 }
 
+const safeStringify = (object: any): string => {
+  if (typeof object === 'string') {
+    return object
+  }
+  return JSON.stringify(object)
+}
+
 export const nonPersistedDigitalCredentialEntityFromAddArgs = (addCredentialArgs: AddCredentialArgs): NonPersistedDigitalCredential => {
   const documentType: DocumentType = determineDocumentType(addCredentialArgs.rawDocument)
   const documentFormat: DocumentFormat = CredentialMapper.detectDocumentType(addCredentialArgs.rawDocument)
@@ -91,14 +133,16 @@ export const nonPersistedDigitalCredentialEntityFromAddArgs = (addCredentialArgs
   const validFrom: Date | undefined = getValidFrom(uniformDocument)
   const validUntil: Date | undefined = getValidUntil(uniformDocument)
   const hash = computeEntryHash(addCredentialArgs.rawDocument)
+  const regulationType = addCredentialArgs.regulationType ?? RegulationType.NON_REGULATED
   return {
     ...addCredentialArgs,
+    regulationType,
     documentType,
     documentFormat: determineCredentialDocumentFormat(documentFormat),
     createdAt: new Date(),
     credentialId: uniformDocument.id ?? hash,
     hash,
-    uniformDocument: JSON.stringify(uniformDocument),
+    uniformDocument: safeStringify(uniformDocument),
     validFrom,
     ...(validUntil && { validUntil }),
     lastUpdatedAt: new Date(),

package/src/utils/hasher.ts

@@ -0,0 +1,19 @@
+import { Hasher } from '@sphereon/ssi-types'
+import sha from 'sha.js'
+
+const supportedAlgorithms = ['sha256', 'sha384', 'sha512'] as const
+type SupportedAlgorithms = (typeof supportedAlgorithms)[number]
+
+// FIXME this is a weird place for this, but it does have good reach in ssi-sdk cunlike the copy in oid4vc-common
+export const defaultHasher: Hasher = (data, algorithm) => {
+  const sanitizedAlgorithm = algorithm.toLowerCase().replace(/[-_]/g, '')
+  if (!supportedAlgorithms.includes(sanitizedAlgorithm as SupportedAlgorithms)) {
+    throw new Error(`Unsupported hashing algorithm ${algorithm}`)
+  }
+
+  return new Uint8Array(
+    sha(sanitizedAlgorithm as SupportedAlgorithms)
+      .update(data)
+      .digest(),
+  )
+}