@twin.org/identity-connector-entity-storage 0.0.1-next.3

package/dist/esm/index.mjs

@@ -0,0 +1,1219 @@
+import { property, entity, ComparisonOperator, EntitySchemaFactory, EntitySchemaHelper } from '@twin.org/entity';
+import { Guards, Converter, RandomHelper, BitString, Compression, CompressionType, GeneralError, Is, NotFoundError, ObjectHelper, Coerce, JsonHelper, AlreadyExistsError, BaseError } from '@twin.org/core';
+import { Sha256 } from '@twin.org/crypto';
+import { EntityStorageConnectorFactory } from '@twin.org/entity-storage-models';
+import { DocumentHelper } from '@twin.org/identity-models';
+import { DidVerificationMethodType } from '@twin.org/standards-w3c-did';
+import { VaultConnectorFactory, VaultKeyType } from '@twin.org/vault-models';
+import { Jwt } from '@twin.org/web';
+
+// Copyright 2024 IOTA Stiftung.
+// SPDX-License-Identifier: Apache-2.0.
+/**
+ * Class describing the identity document.
+ */
+let IdentityDocument = class IdentityDocument {
+    /**
+     * The identity of the document.
+     */
+    id;
+    /**
+     * The DID document.
+     */
+    document;
+    /**
+     * The signature of the document.
+     */
+    signature;
+    /**
+     * The controller of the document.
+     */
+    controller;
+};
+__decorate([
+    property({ type: "string", isPrimary: true }),
+    __metadata("design:type", String)
+], IdentityDocument.prototype, "id", void 0);
+__decorate([
+    property({ type: "object" }),
+    __metadata("design:type", Object)
+], IdentityDocument.prototype, "document", void 0);
+__decorate([
+    property({ type: "string" }),
+    __metadata("design:type", String)
+], IdentityDocument.prototype, "signature", void 0);
+__decorate([
+    property({ type: "string" }),
+    __metadata("design:type", String)
+], IdentityDocument.prototype, "controller", void 0);
+IdentityDocument = __decorate([
+    entity()
+], IdentityDocument);
+
+// Copyright 2024 IOTA Stiftung.
+// SPDX-License-Identifier: Apache-2.0.
+/**
+ * Class representing profile details for the identity.
+ */
+let IdentityProfile = class IdentityProfile {
+    /**
+     * The id for the identity.
+     */
+    identity;
+    /**
+     * The public profile data.
+     */
+    publicProfile;
+    /**
+     * The private profile data.
+     */
+    privateProfile;
+};
+__decorate([
+    property({ type: "string", isPrimary: true }),
+    __metadata("design:type", String)
+], IdentityProfile.prototype, "identity", void 0);
+__decorate([
+    property({ type: "object" }),
+    __metadata("design:type", Object)
+], IdentityProfile.prototype, "publicProfile", void 0);
+__decorate([
+    property({ type: "object" }),
+    __metadata("design:type", Object)
+], IdentityProfile.prototype, "privateProfile", void 0);
+IdentityProfile = __decorate([
+    entity()
+], IdentityProfile);
+
+// Copyright 2024 IOTA Stiftung.
+// SPDX-License-Identifier: Apache-2.0.
+/**
+ * Class for performing identity operations using entity storage.
+ */
+class EntityStorageIdentityConnector {
+    /**
+     * The namespace supported by the identity connector.
+     */
+    static NAMESPACE = "entity-storage";
+    /**
+     * The size of the revocation bitmap in bits (16Kb).
+     * @internal
+     */
+    static _REVOCATION_BITS_SIZE = 131072;
+    /**
+     * Runtime name for the class.
+     */
+    CLASS_NAME = "EntityStorageIdentityConnector";
+    /**
+     * The entity storage for identities.
+     * @internal
+     */
+    _didDocumentEntityStorage;
+    /**
+     * The vault for the keys.
+     * @internal
+     */
+    _vaultConnector;
+    /**
+     * Create a new instance of EntityStorageIdentityConnector.
+     * @param options The dependencies for the identity connector.
+     * @param options.didDocumentEntityStorageType The entity storage for the did documents, defaults to "identity-document".
+     * @param options.vaultConnectorType The vault for the private keys, defaults to "vault".
+     */
+    constructor(options) {
+        this._didDocumentEntityStorage = EntityStorageConnectorFactory.get(options?.didDocumentEntityStorageType ?? "identity-document");
+        this._vaultConnector = VaultConnectorFactory.get(options?.vaultConnectorType ?? "vault");
+    }
+    /**
+     * Create a new document.
+     * @param controller The controller of the identity who can make changes.
+     * @returns The created document.
+     */
+    async createDocument(controller) {
+        Guards.stringValue(this.CLASS_NAME, "controller", controller);
+        try {
+            const did = `did:${EntityStorageIdentityConnector.NAMESPACE}:${Converter.bytesToHex(RandomHelper.generate(32), true)}`;
+            await this._vaultConnector.createKey(this.buildVaultKey(did, did), VaultKeyType.Ed25519);
+            const bitString = new BitString(EntityStorageIdentityConnector._REVOCATION_BITS_SIZE);
+            const compressed = await Compression.compress(bitString.getBits(), CompressionType.Gzip);
+            const didDocument = {
+                id: did,
+                service: [
+                    {
+                        id: `${did}#revocation`,
+                        type: "BitstringStatusList",
+                        serviceEndpoint: `data:application/octet-stream;base64,${Converter.bytesToBase64Url(compressed)}`
+                    }
+                ]
+            };
+            await this.updateDocument(controller, didDocument);
+            return didDocument;
+        }
+        catch (error) {
+            throw new GeneralError(this.CLASS_NAME, "createDocumentFailed", undefined, error);
+        }
+    }
+    /**
+     * Resolve a document from its id.
+     * @param documentId The id of the document to resolve.
+     * @returns The resolved document.
+     * @throws NotFoundError if the id can not be resolved.
+     */
+    async resolveDocument(documentId) {
+        Guards.stringValue(this.CLASS_NAME, "documentId", documentId);
+        try {
+            const didIdentityDocument = await this._didDocumentEntityStorage.get(documentId);
+            if (Is.undefined(didIdentityDocument)) {
+                throw new NotFoundError(this.CLASS_NAME, "documentNotFound", documentId);
+            }
+            await this.verifyDocument(didIdentityDocument);
+            return didIdentityDocument.document;
+        }
+        catch (error) {
+            throw new GeneralError(this.CLASS_NAME, "resolveDocumentFailed", undefined, error);
+        }
+    }
+    /**
+     * Add a verification method to the document in JSON Web key Format.
+     * @param controller The controller of the identity who can make changes.
+     * @param documentId The id of the document to add the verification method to.
+     * @param verificationMethodType The type of the verification method to add.
+     * @param verificationMethodId The id of the verification method, if undefined uses the kid of the generated JWK.
+     * @returns The verification method.
+     * @throws NotFoundError if the id can not be resolved.
+     * @throws NotSupportedError if the platform does not support multiple keys.
+     */
+    async addVerificationMethod(controller, documentId, verificationMethodType, verificationMethodId) {
+        Guards.stringValue(this.CLASS_NAME, "controller", controller);
+        Guards.stringValue(this.CLASS_NAME, "documentId", documentId);
+        Guards.arrayOneOf(this.CLASS_NAME, "verificationMethodType", verificationMethodType, Object.values(DidVerificationMethodType));
+        try {
+            const didIdentityDocument = await this._didDocumentEntityStorage.get(documentId);
+            if (Is.undefined(didIdentityDocument)) {
+                throw new NotFoundError(this.CLASS_NAME, "documentNotFound", documentId);
+            }
+            await this.verifyDocument(didIdentityDocument);
+            const didDocument = didIdentityDocument.document;
+            const tempKeyId = `temp-${Converter.bytesToBase64Url(RandomHelper.generate(32))}`;
+            const verificationPublicKey = await this._vaultConnector.createKey(this.buildVaultKey(didDocument.id, tempKeyId), VaultKeyType.Ed25519);
+            const jwkParams = {
+                alg: "EdDSA",
+                kty: "OKP",
+                crv: "Ed25519",
+                x: Converter.bytesToBase64Url(verificationPublicKey)
+            };
+            const kid = Converter.bytesToBase64Url(Sha256.sum256(Converter.utf8ToBytes(JSON.stringify(jwkParams))));
+            const methodId = `${documentId}#${verificationMethodId ?? kid}`;
+            await this._vaultConnector.renameKey(this.buildVaultKey(didDocument.id, tempKeyId), this.buildVaultKey(didDocument.id, methodId));
+            const methods = this.getAllMethods(didDocument);
+            const existingMethodIndex = methods.findIndex(m => {
+                if (Is.string(m.method)) {
+                    return m.method === methodId;
+                }
+                return m.method.id === methodId;
+            });
+            if (existingMethodIndex >= 0) {
+                const methodArray = didDocument[methods[existingMethodIndex].arrayKey];
+                if (Is.array(methodArray)) {
+                    methodArray.splice(existingMethodIndex, 1);
+                }
+            }
+            const didVerificationMethod = {
+                id: methodId,
+                controller: documentId,
+                type: "JsonWebKey",
+                publicKeyJwk: {
+                    ...jwkParams,
+                    kid
+                }
+            };
+            didDocument[verificationMethodType] ??= [];
+            didDocument[verificationMethodType]?.push(didVerificationMethod);
+            await this.updateDocument(controller, didDocument);
+            return didVerificationMethod;
+        }
+        catch (error) {
+            throw new GeneralError(this.CLASS_NAME, "addVerificationMethodFailed", undefined, error);
+        }
+    }
+    /**
+     * Remove a verification method from the document.
+     * @param controller The controller of the identity who can make changes.
+     * @param verificationMethodId The id of the verification method.
+     * @returns Nothing.
+     * @throws NotFoundError if the id can not be resolved.
+     * @throws NotSupportedError if the platform does not support multiple revocable keys.
+     */
+    async removeVerificationMethod(controller, verificationMethodId) {
+        Guards.stringValue(this.CLASS_NAME, "controller", controller);
+        Guards.stringValue(this.CLASS_NAME, "verificationMethodId", verificationMethodId);
+        try {
+            const idParts = DocumentHelper.parse(verificationMethodId);
+            if (Is.empty(idParts.hash)) {
+                throw new NotFoundError(this.CLASS_NAME, "missingDid", verificationMethodId);
+            }
+            const didIdentityDocument = await this._didDocumentEntityStorage.get(idParts.id);
+            if (Is.undefined(didIdentityDocument)) {
+                throw new NotFoundError(this.CLASS_NAME, "documentNotFound", idParts.id);
+            }
+            await this.verifyDocument(didIdentityDocument);
+            const didDocument = didIdentityDocument.document;
+            const methods = this.getAllMethods(didDocument);
+            const existingMethodIndex = methods.findIndex(m => {
+                if (Is.string(m.method)) {
+                    return m.method === verificationMethodId;
+                }
+                return m.method.id === verificationMethodId;
+            });
+            if (existingMethodIndex >= 0) {
+                const methodArray = didDocument[methods[existingMethodIndex].arrayKey];
+                if (Is.array(methodArray)) {
+                    methodArray.splice(existingMethodIndex, 1);
+                    if (methodArray.length === 0) {
+                        delete didDocument[methods[existingMethodIndex].arrayKey];
+                    }
+                }
+            }
+            else {
+                throw new NotFoundError(this.CLASS_NAME, "verificationMethodNotFound", verificationMethodId);
+            }
+            await this.updateDocument(controller, didDocument);
+        }
+        catch (error) {
+            throw new GeneralError(this.CLASS_NAME, "removeVerificationMethodFailed", undefined, error);
+        }
+    }
+    /**
+     * Add a service to the document.
+     * @param controller The controller of the identity who can make changes.
+     * @param documentId The id of the document to add the service to.
+     * @param serviceId The id of the service.
+     * @param serviceType The type of the service.
+     * @param serviceEndpoint The endpoint for the service.
+     * @returns The service.
+     * @throws NotFoundError if the id can not be resolved.
+     */
+    async addService(controller, documentId, serviceId, serviceType, serviceEndpoint) {
+        Guards.stringValue(this.CLASS_NAME, "controller", controller);
+        Guards.stringValue(this.CLASS_NAME, "documentId", documentId);
+        Guards.stringValue(this.CLASS_NAME, "serviceId", serviceId);
+        Guards.stringValue(this.CLASS_NAME, "serviceType", serviceType);
+        Guards.stringValue(this.CLASS_NAME, "serviceEndpoint", serviceEndpoint);
+        try {
+            const didIdentityDocument = await this._didDocumentEntityStorage.get(documentId);
+            if (Is.undefined(didIdentityDocument)) {
+                throw new NotFoundError(this.CLASS_NAME, "documentNotFound", documentId);
+            }
+            await this.verifyDocument(didIdentityDocument);
+            const didDocument = didIdentityDocument.document;
+            const fullServiceId = serviceId.includes("#") ? serviceId : `${documentId}#${serviceId}`;
+            if (Is.array(didDocument.service)) {
+                const existingServiceIndex = didDocument.service.findIndex(s => s.id === fullServiceId);
+                if (existingServiceIndex >= 0) {
+                    didDocument.service?.splice(existingServiceIndex, 1);
+                }
+            }
+            const didService = {
+                id: fullServiceId,
+                type: serviceType,
+                serviceEndpoint
+            };
+            didDocument.service ??= [];
+            didDocument.service.push(didService);
+            await this.updateDocument(controller, didDocument);
+            return didService;
+        }
+        catch (error) {
+            throw new GeneralError(this.CLASS_NAME, "addServiceFailed", undefined, error);
+        }
+    }
+    /**
+     * Remove a service from the document.
+     * @param controller The controller of the identity who can make changes.
+     * @param serviceId The id of the service.
+     * @returns Nothing.
+     * @throws NotFoundError if the id can not be resolved.
+     */
+    async removeService(controller, serviceId) {
+        Guards.stringValue(this.CLASS_NAME, "controller", controller);
+        Guards.stringValue(this.CLASS_NAME, "serviceId", serviceId);
+        try {
+            const idParts = DocumentHelper.parse(serviceId);
+            if (Is.empty(idParts.hash)) {
+                throw new NotFoundError(this.CLASS_NAME, "missingDid", serviceId);
+            }
+            const didIdentityDocument = await this._didDocumentEntityStorage.get(idParts.id);
+            if (Is.undefined(didIdentityDocument)) {
+                throw new NotFoundError(this.CLASS_NAME, "documentNotFound", idParts.id);
+            }
+            await this.verifyDocument(didIdentityDocument);
+            const didDocument = didIdentityDocument.document;
+            if (Is.array(didDocument.service)) {
+                const existingServiceIndex = didDocument.service.findIndex(s => s.id === serviceId);
+                if (existingServiceIndex >= 0) {
+                    didDocument.service?.splice(existingServiceIndex, 1);
+                    if (didDocument.service?.length === 0) {
+                        delete didDocument.service;
+                    }
+                }
+            }
+            else {
+                throw new NotFoundError(this.CLASS_NAME, "serviceNotFound", serviceId);
+            }
+            await this.updateDocument(controller, didDocument);
+        }
+        catch (error) {
+            throw new GeneralError(this.CLASS_NAME, "removeServiceFailed", undefined, error);
+        }
+    }
+    /**
+     * Create a verifiable credential for a verification method.
+     * @param controller The controller of the identity who can make changes.
+     * @param verificationMethodId The verification method id to use.
+     * @param credentialId The id of the credential.
+     * @param types The type for the data stored in the verifiable credential.
+     * @param subject The subject data to store for the credential.
+     * @param contexts Additional contexts to include in the credential.
+     * @param revocationIndex The bitmap revocation index of the credential, if undefined will not have revocation status.
+     * @returns The created verifiable credential and its token.
+     * @throws NotFoundError if the id can not be resolved.
+     */
+    async createVerifiableCredential(controller, verificationMethodId, credentialId, types, subject, contexts, revocationIndex) {
+        Guards.stringValue(this.CLASS_NAME, "controller", controller);
+        Guards.stringValue(this.CLASS_NAME, "verificationMethodId", verificationMethodId);
+        if (!Is.undefined(credentialId)) {
+            Guards.stringValue(this.CLASS_NAME, "credentialId", credentialId);
+        }
+        if (Is.array(types)) {
+            Guards.array(this.CLASS_NAME, "types", types);
+        }
+        else if (!Is.undefined(types)) {
+            Guards.stringValue(this.CLASS_NAME, "types", types);
+        }
+        if (Is.array(subject)) {
+            Guards.arrayValue(this.CLASS_NAME, "subject", subject);
+        }
+        else {
+            Guards.object(this.CLASS_NAME, "subject", subject);
+        }
+        if (Is.array(contexts)) {
+            Guards.array(this.CLASS_NAME, "contexts", contexts);
+        }
+        else if (!Is.undefined(contexts)) {
+            Guards.stringValue(this.CLASS_NAME, "contexts", contexts);
+        }
+        if (!Is.undefined(revocationIndex)) {
+            Guards.number(this.CLASS_NAME, "revocationIndex", revocationIndex);
+        }
+        try {
+            const idParts = DocumentHelper.parse(verificationMethodId);
+            if (Is.empty(idParts.hash)) {
+                throw new NotFoundError(this.CLASS_NAME, "missingDid", verificationMethodId);
+            }
+            const issuerIdentityDocument = await this._didDocumentEntityStorage.get(idParts.id);
+            if (Is.undefined(issuerIdentityDocument)) {
+                throw new NotFoundError(this.CLASS_NAME, "documentNotFound", idParts.id);
+            }
+            await this.verifyDocument(issuerIdentityDocument);
+            const issuerDidDocument = issuerIdentityDocument.document;
+            const methods = this.getAllMethods(issuerDidDocument);
+            const methodAndArray = methods.find(m => {
+                if (Is.string(m.method)) {
+                    return m.method === verificationMethodId;
+                }
+                return m.method.id === verificationMethodId;
+            });
+            if (!methodAndArray) {
+                throw new GeneralError(this.CLASS_NAME, "methodMissing");
+            }
+            const verificationDidMethod = methodAndArray.method;
+            if (!Is.stringValue(verificationDidMethod.publicKeyJwk?.x)) {
+                throw new GeneralError(this.CLASS_NAME, "publicKeyJwkMissing");
+            }
+            const revocationService = issuerDidDocument.service?.find(s => s.id.endsWith("#revocation"));
+            const finalTypes = ["VerifiableCredential"];
+            if (Is.array(types)) {
+                finalTypes.push(...types);
+            }
+            else if (Is.stringValue(types)) {
+                finalTypes.push(types);
+            }
+            const finalContexts = ["https://www.w3.org/2018/credentials/v1"];
+            if (Is.array(contexts)) {
+                finalContexts.push(...contexts);
+            }
+            else if (Is.stringValue(contexts)) {
+                finalContexts.push(contexts);
+            }
+            const verifiableCredential = {
+                "@context": finalContexts,
+                id: credentialId,
+                type: finalTypes,
+                credentialSubject: subject,
+                issuer: issuerDidDocument.id,
+                issuanceDate: new Date().toISOString(),
+                credentialStatus: revocationService && !Is.undefined(revocationIndex)
+                    ? {
+                        id: revocationService.id,
+                        type: Is.array(revocationService.type)
+                            ? revocationService.type[0]
+                            : revocationService.type,
+                        revocationBitmapIndex: revocationIndex.toString()
+                    }
+                    : undefined
+            };
+            const jwtHeader = {
+                kid: verificationDidMethod.id,
+                typ: "JWT",
+                alg: "EdDSA"
+            };
+            const jwtVc = ObjectHelper.pick(ObjectHelper.clone(verifiableCredential), [
+                "@context",
+                "type",
+                "credentialSubject",
+                "credentialStatus"
+            ]);
+            if (Is.array(jwtVc.credentialSubject)) {
+                jwtVc.credentialSubject = jwtVc.credentialSubject.map(c => {
+                    ObjectHelper.propertyDelete(c, "id");
+                    return c;
+                });
+            }
+            else {
+                ObjectHelper.propertyDelete(jwtVc.credentialSubject, "id");
+            }
+            const jwtPayload = {
+                iss: idParts.id,
+                nbf: Math.floor(Date.now() / 1000),
+                jti: verifiableCredential.id,
+                sub: Is.array(subject)
+                    ? ObjectHelper.propertyGet(subject[0], "id")
+                    : ObjectHelper.propertyGet(subject, "id"),
+                vc: jwtVc
+            };
+            const signature = await Jwt.encodeWithSigner(jwtHeader, jwtPayload, async (alg, key, payload) => {
+                const sig = await this._vaultConnector.sign(this.buildVaultKey(idParts.id, verificationMethodId), payload);
+                return sig;
+            });
+            return {
+                verifiableCredential,
+                jwt: signature
+            };
+        }
+        catch (error) {
+            throw new GeneralError(this.CLASS_NAME, "createVerifiableCredentialFailed", undefined, error);
+        }
+    }
+    /**
+     * Check a verifiable credential is valid.
+     * @param credentialJwt The credential to verify.
+     * @returns The credential stored in the jwt and the revocation status.
+     */
+    async checkVerifiableCredential(credentialJwt) {
+        Guards.stringValue(this.CLASS_NAME, "credentialJwt", credentialJwt);
+        try {
+            const jwtDecoded = await Jwt.decode(credentialJwt);
+            const jwtHeader = jwtDecoded.header;
+            const jwtPayload = jwtDecoded.payload;
+            const jwtSignature = jwtDecoded.signature;
+            if (Is.undefined(jwtHeader) ||
+                Is.undefined(jwtPayload) ||
+                Is.undefined(jwtPayload.iss) ||
+                Is.undefined(jwtSignature)) {
+                throw new NotFoundError(this.CLASS_NAME, "jwkSignatureFailed");
+            }
+            const issuerDocumentId = jwtPayload.iss;
+            const issuerIdentityDocument = await this._didDocumentEntityStorage.get(issuerDocumentId);
+            if (Is.undefined(issuerIdentityDocument)) {
+                throw new NotFoundError(this.CLASS_NAME, "documentNotFound", issuerDocumentId);
+            }
+            await this.verifyDocument(issuerIdentityDocument);
+            const issuerDidDocument = issuerIdentityDocument.document;
+            const methods = this.getAllMethods(issuerDidDocument);
+            const methodAndArray = methods.find(m => {
+                if (Is.string(m.method)) {
+                    return m.method === jwtHeader.kid;
+                }
+                return m.method.id === jwtHeader.kid;
+            });
+            if (!methodAndArray) {
+                throw new GeneralError(this.CLASS_NAME, "methodMissing");
+            }
+            const didMethod = methodAndArray.method;
+            if (!Is.stringValue(didMethod.publicKeyJwk?.x)) {
+                throw new GeneralError(this.CLASS_NAME, "publicKeyJwkMissing");
+            }
+            const verified = Jwt.verifySignature(jwtHeader, jwtPayload, jwtSignature, Converter.base64UrlToBytes(didMethod.publicKeyJwk.x));
+            if (!verified) {
+                throw new GeneralError(this.CLASS_NAME, "jwkSignatureFailed");
+            }
+            const verifiableCredential = jwtPayload.vc;
+            if (Is.object(verifiableCredential)) {
+                if (Is.string(jwtPayload.jti)) {
+                    verifiableCredential.id = jwtPayload.jti;
+                }
+                verifiableCredential.issuer = issuerDocumentId;
+                if (Is.number(jwtPayload.nbf)) {
+                    verifiableCredential.issuanceDate = new Date(jwtPayload.nbf * 1000).toISOString();
+                }
+                if (Is.array(verifiableCredential.credentialSubject)) {
+                    verifiableCredential.credentialSubject = verifiableCredential.credentialSubject.map(c => {
+                        ObjectHelper.propertySet(c, "id", jwtPayload.sub);
+                        return c;
+                    });
+                }
+                else if (Is.object(verifiableCredential.credentialSubject)) {
+                    ObjectHelper.propertySet(verifiableCredential.credentialSubject, "id", jwtPayload.sub);
+                }
+            }
+            const revoked = await this.checkRevocation(issuerDidDocument, verifiableCredential.credentialStatus?.revocationBitmapIndex);
+            return {
+                revoked,
+                verifiableCredential: revoked ? undefined : verifiableCredential
+            };
+        }
+        catch (error) {
+            throw new GeneralError(this.CLASS_NAME, "checkingVerifiableCredentialFailed", undefined, error);
+        }
+    }
+    /**
+     * Revoke verifiable credential(s).
+     * @param controller The controller of the identity who can make changes.
+     * @param issuerDocumentId The id of the document to update the revocation list for.
+     * @param credentialIndices The revocation bitmap index or indices to revoke.
+     * @returns Nothing.
+     */
+    async revokeVerifiableCredentials(controller, issuerDocumentId, credentialIndices) {
+        Guards.stringValue(this.CLASS_NAME, "controller", controller);
+        Guards.stringValue(this.CLASS_NAME, "issuerDocumentId", issuerDocumentId);
+        Guards.arrayValue(this.CLASS_NAME, "credentialIndices", credentialIndices);
+        try {
+            const issuerIdentityDocument = await this._didDocumentEntityStorage.get(issuerDocumentId);
+            if (Is.undefined(issuerIdentityDocument)) {
+                throw new NotFoundError(this.CLASS_NAME, "documentNotFound", issuerDocumentId);
+            }
+            await this.verifyDocument(issuerIdentityDocument);
+            const issuerDidDocument = issuerIdentityDocument.document;
+            const revocationService = issuerDidDocument.service?.find(s => s.id.endsWith("#revocation"));
+            if (revocationService &&
+                Is.string(revocationService.serviceEndpoint) &&
+                revocationService.type === "BitstringStatusList") {
+                const revocationParts = revocationService.serviceEndpoint.split(",");
+                if (revocationParts.length === 2) {
+                    const compressedRevocationBytes = Converter.base64UrlToBytes(revocationParts[1]);
+                    const decompressed = await Compression.decompress(compressedRevocationBytes, CompressionType.Gzip);
+                    const bitString = BitString.fromBits(decompressed, EntityStorageIdentityConnector._REVOCATION_BITS_SIZE);
+                    for (const credentialIndex of credentialIndices) {
+                        bitString.setBit(credentialIndex, true);
+                    }
+                    const compressed = await Compression.compress(bitString.getBits(), CompressionType.Gzip);
+                    revocationService.serviceEndpoint = `data:application/octet-stream;base64,${Converter.bytesToBase64Url(compressed)}`;
+                }
+            }
+            await this.updateDocument(controller, issuerDidDocument);
+        }
+        catch (error) {
+            throw new GeneralError(this.CLASS_NAME, "revokeVerifiableCredentialsFailed", undefined, error);
+        }
+    }
+    /**
+     * Unrevoke verifiable credential(s).
+     * @param controller The controller of the identity who can make changes.
+     * @param issuerDocumentId The id of the document to update the revocation list for.
+     * @param credentialIndices The revocation bitmap index or indices to un revoke.
+     * @returns Nothing.
+     */
+    async unrevokeVerifiableCredentials(controller, issuerDocumentId, credentialIndices) {
+        Guards.stringValue(this.CLASS_NAME, "controller", controller);
+        Guards.stringValue(this.CLASS_NAME, "issuerDocumentId", issuerDocumentId);
+        Guards.arrayValue(this.CLASS_NAME, "credentialIndices", credentialIndices);
+        try {
+            const issuerIdentityDocument = await this._didDocumentEntityStorage.get(issuerDocumentId);
+            if (Is.undefined(issuerIdentityDocument)) {
+                throw new NotFoundError(this.CLASS_NAME, "documentNotFound", issuerDocumentId);
+            }
+            await this.verifyDocument(issuerIdentityDocument);
+            const issuerDidDocument = issuerIdentityDocument.document;
+            const revocationService = issuerDidDocument.service?.find(s => s.id.endsWith("#revocation"));
+            if (revocationService &&
+                Is.string(revocationService.serviceEndpoint) &&
+                revocationService.type === "BitstringStatusList") {
+                const revocationParts = revocationService.serviceEndpoint.split(",");
+                if (revocationParts.length === 2) {
+                    const compressedRevocationBytes = Converter.base64UrlToBytes(revocationParts[1]);
+                    const decompressed = await Compression.decompress(compressedRevocationBytes, CompressionType.Gzip);
+                    const bitString = BitString.fromBits(decompressed, EntityStorageIdentityConnector._REVOCATION_BITS_SIZE);
+                    for (const credentialIndex of credentialIndices) {
+                        bitString.setBit(credentialIndex, false);
+                    }
+                    const compressed = await Compression.compress(bitString.getBits(), CompressionType.Gzip);
+                    revocationService.serviceEndpoint = `data:application/octet-stream;base64,${Converter.bytesToBase64Url(compressed)}`;
+                }
+            }
+            await this.updateDocument(controller, issuerDidDocument);
+        }
+        catch (error) {
+            throw new GeneralError(this.CLASS_NAME, "unrevokeVerifiableCredentialsFailed", undefined, error);
+        }
+    }
+    /**
+     * Create a verifiable presentation from the supplied verifiable credentials.
+     * @param controller The controller of the identity who can make changes.
+     * @param presentationMethodId The method to associate with the presentation.
+     * @param types The types for the data stored in the verifiable credential.
+     * @param verifiableCredentials The credentials to use for creating the presentation in jwt format.
+     * @param contexts Additional contexts to include in the presentation.
+     * @param expiresInMinutes The time in minutes for the presentation to expire.
+     * @returns The created verifiable presentation and its token.
+     * @throws NotFoundError if the id can not be resolved.
+     */
+    async createVerifiablePresentation(controller, presentationMethodId, types, verifiableCredentials, contexts, expiresInMinutes) {
+        Guards.stringValue(this.CLASS_NAME, "controller", controller);
+        Guards.stringValue(this.CLASS_NAME, "presentationMethodId", presentationMethodId);
+        if (Is.array(types)) {
+            Guards.arrayValue(this.CLASS_NAME, "types", types);
+        }
+        else if (Is.string(types)) {
+            Guards.stringValue(this.CLASS_NAME, "types", types);
+        }
+        Guards.arrayValue(this.CLASS_NAME, "verifiableCredentials", verifiableCredentials);
+        if (Is.array(contexts)) {
+            Guards.arrayValue(this.CLASS_NAME, "contexts", contexts);
+        }
+        else if (Is.string(contexts)) {
+            Guards.stringValue(this.CLASS_NAME, "contexts", contexts);
+        }
+        if (!Is.undefined(expiresInMinutes)) {
+            Guards.integer(this.CLASS_NAME, "expiresInMinutes", expiresInMinutes);
+        }
+        try {
+            const idParts = DocumentHelper.parse(presentationMethodId);
+            if (Is.empty(idParts.hash)) {
+                throw new NotFoundError(this.CLASS_NAME, "missingDid", presentationMethodId);
+            }
+            const holderIdentityDocument = await this._didDocumentEntityStorage.get(idParts.id);
+            if (Is.undefined(holderIdentityDocument)) {
+                throw new NotFoundError(this.CLASS_NAME, "documentNotFound", idParts.id);
+            }
+            await this.verifyDocument(holderIdentityDocument);
+            const holderDidDocument = holderIdentityDocument.document;
+            const methods = this.getAllMethods(holderDidDocument);
+            const methodAndArray = methods.find(m => {
+                if (Is.string(m.method)) {
+                    return m.method === presentationMethodId;
+                }
+                return m.method.id === presentationMethodId;
+            });
+            if (!methodAndArray) {
+                throw new GeneralError(this.CLASS_NAME, "methodMissing");
+            }
+            const didMethod = methodAndArray.method;
+            if (!Is.stringValue(didMethod.publicKeyJwk?.x)) {
+                throw new GeneralError(this.CLASS_NAME, "publicKeyJwkMissing");
+            }
+            const finalTypes = ["VerifiablePresentation"];
+            if (Is.array(types)) {
+                finalTypes.push(...types);
+            }
+            else if (Is.stringValue(types)) {
+                finalTypes.push(types);
+            }
+            const finalContexts = ["https://www.w3.org/2018/credentials/v1"];
+            if (Is.array(contexts)) {
+                finalContexts.push(...contexts);
+            }
+            else if (Is.stringValue(contexts)) {
+                finalContexts.push(contexts);
+            }
+            const verifiablePresentation = {
+                "@context": finalContexts,
+                type: finalTypes,
+                verifiableCredential: verifiableCredentials,
+                holder: idParts.id
+            };
+            const jwtHeader = {
+                kid: didMethod.id,
+                typ: "JWT",
+                alg: "EdDSA"
+            };
+            const jwtVp = ObjectHelper.pick(ObjectHelper.clone(verifiablePresentation), [
+                "@context",
+                "type",
+                "verifiableCredential"
+            ]);
+            const jwtPayload = {
+                iss: idParts.id,
+                nbf: Math.floor(Date.now() / 1000),
+                vp: jwtVp
+            };
+            if (Is.integer(expiresInMinutes)) {
+                const expiresInSeconds = expiresInMinutes * 60;
+                jwtPayload.exp = Math.floor(Date.now() / 1000) + expiresInSeconds;
+            }
+            const signature = await Jwt.encodeWithSigner(jwtHeader, jwtPayload, async (alg, key, payload) => {
+                const sig = await this._vaultConnector.sign(this.buildVaultKey(idParts.id, presentationMethodId), payload);
+                return sig;
+            });
+            return {
+                verifiablePresentation,
+                jwt: signature
+            };
+        }
+        catch (error) {
+            throw new GeneralError(this.CLASS_NAME, "createVerifiablePresentationFailed", undefined, error);
+        }
+    }
+    /**
+     * Check a verifiable presentation is valid.
+     * @param presentationJwt The presentation to verify.
+     * @returns The presentation stored in the jwt and the revocation status.
+     */
+    async checkVerifiablePresentation(presentationJwt) {
+        Guards.stringValue(this.CLASS_NAME, "presentationJwt", presentationJwt);
+        try {
+            const jwtDecoded = await Jwt.decode(presentationJwt);
+            const jwtHeader = jwtDecoded.header;
+            const jwtPayload = jwtDecoded.payload;
+            const jwtSignature = jwtDecoded.signature;
+            if (Is.undefined(jwtHeader) ||
+                Is.undefined(jwtPayload) ||
+                Is.undefined(jwtPayload.iss) ||
+                Is.undefined(jwtSignature)) {
+                throw new NotFoundError(this.CLASS_NAME, "jwkSignatureFailed");
+            }
+            const holderDocumentId = jwtPayload.iss;
+            const holderIdentityDocument = await this._didDocumentEntityStorage.get(holderDocumentId);
+            if (Is.undefined(holderIdentityDocument)) {
+                throw new NotFoundError(this.CLASS_NAME, "documentNotFound", holderDocumentId);
+            }
+            await this.verifyDocument(holderIdentityDocument);
+            const issuers = [];
+            const tokensRevoked = [];
+            const verifiablePresentation = jwtPayload?.vp;
+            if (Is.object(verifiablePresentation) &&
+                Is.array(verifiablePresentation.verifiableCredential)) {
+                for (const vcJwt of verifiablePresentation.verifiableCredential) {
+                    const jwt = await Jwt.decode(vcJwt);
+                    let revoked = true;
+                    if (Is.string(jwt.payload?.iss)) {
+                        const issuerDocumentId = jwt.payload.iss;
+                        verifiablePresentation.holder = issuerDocumentId;
+                        const issuerDidDocument = await this._didDocumentEntityStorage.get(issuerDocumentId);
+                        if (Is.undefined(issuerDidDocument)) {
+                            throw new NotFoundError(this.CLASS_NAME, "documentNotFound", issuerDocumentId);
+                        }
+                        await this.verifyDocument(issuerDidDocument);
+                        issuers.push(issuerDidDocument);
+                        const vc = jwt.payload.vc;
+                        if (Is.object(vc)) {
+                            revoked = await this.checkRevocation(issuerDidDocument, vc.credentialStatus?.revocationBitmapIndex);
+                        }
+                    }
+                    tokensRevoked.push(revoked);
+                }
+            }
+            return {
+                revoked: tokensRevoked.some(Boolean),
+                verifiablePresentation,
+                issuers
+            };
+        }
+        catch (error) {
+            if (error instanceof Error && error.message.toLowerCase().includes("revoked")) {
+                return {
+                    revoked: true
+                };
+            }
+            throw new GeneralError(this.CLASS_NAME, "checkingVerifiablePresentationFailed", undefined, error);
+        }
+    }
+    /**
+     * Create a proof for arbitrary data with the specified verification method.
+     * @param controller The controller of the identity who can make changes.
+     * @param verificationMethodId The verification method id to use.
+     * @param bytes The data bytes to sign.
+     * @returns The proof signature type and value.
+     */
+    async createProof(controller, verificationMethodId, bytes) {
+        Guards.stringValue(this.CLASS_NAME, "controller", controller);
+        Guards.stringValue(this.CLASS_NAME, "verificationMethodId", verificationMethodId);
+        Guards.uint8Array(this.CLASS_NAME, "bytes", bytes);
+        try {
+            const idParts = DocumentHelper.parse(verificationMethodId);
+            if (Is.empty(idParts.hash)) {
+                throw new NotFoundError(this.CLASS_NAME, "missingDid", verificationMethodId);
+            }
+            const didIdentityDocument = await this._didDocumentEntityStorage.get(idParts.id);
+            if (Is.undefined(didIdentityDocument)) {
+                throw new NotFoundError(this.CLASS_NAME, "documentNotFound", idParts.id);
+            }
+            await this.verifyDocument(didIdentityDocument);
+            const didDocument = didIdentityDocument.document;
+            const methods = this.getAllMethods(didDocument);
+            const methodAndArray = methods.find(m => {
+                if (Is.string(m.method)) {
+                    return m.method === verificationMethodId;
+                }
+                return m.method.id === verificationMethodId;
+            });
+            if (!methodAndArray) {
+                throw new GeneralError(this.CLASS_NAME, "methodMissing");
+            }
+            const didMethod = methodAndArray.method;
+            if (!Is.stringValue(didMethod.publicKeyJwk?.x)) {
+                throw new GeneralError(this.CLASS_NAME, "publicKeyJwkMissing");
+            }
+            const signature = await this._vaultConnector.sign(this.buildVaultKey(didDocument.id, verificationMethodId), bytes);
+            return {
+                type: "Ed25519",
+                value: signature
+            };
+        }
+        catch (error) {
+            throw new GeneralError(this.CLASS_NAME, "createProofFailed", undefined, error);
+        }
+    }
+    /**
+     * Verify proof for arbitrary data with the specified verification method.
+     * @param verificationMethodId The verification method id to use.
+     * @param bytes The data bytes to verify.
+     * @param signatureType The type of the signature for the proof.
+     * @param signatureValue The value of the signature for the proof.
+     * @returns True if the signature is valid.
+     */
+    async verifyProof(verificationMethodId, bytes, signatureType, signatureValue) {
+        Guards.stringValue(this.CLASS_NAME, "verificationMethodId", verificationMethodId);
+        Guards.uint8Array(this.CLASS_NAME, "bytes", bytes);
+        Guards.stringValue(this.CLASS_NAME, "signatureType", signatureType);
+        Guards.uint8Array(this.CLASS_NAME, "signatureValue", signatureValue);
+        try {
+            const idParts = DocumentHelper.parse(verificationMethodId);
+            if (Is.empty(idParts.hash)) {
+                throw new NotFoundError(this.CLASS_NAME, "missingDid", verificationMethodId);
+            }
+            const didIdentityDocument = await this._didDocumentEntityStorage.get(idParts.id);
+            if (Is.undefined(didIdentityDocument)) {
+                throw new NotFoundError(this.CLASS_NAME, "documentNotFound", idParts.id);
+            }
+            await this.verifyDocument(didIdentityDocument);
+            const didDocument = didIdentityDocument.document;
+            const methods = this.getAllMethods(didDocument);
+            const methodAndArray = methods.find(m => {
+                if (Is.string(m.method)) {
+                    return m.method === verificationMethodId;
+                }
+                return m.method.id === verificationMethodId;
+            });
+            if (!methodAndArray) {
+                throw new GeneralError(this.CLASS_NAME, "methodMissing");
+            }
+            const didMethod = methodAndArray.method;
+            if (!Is.stringValue(didMethod.publicKeyJwk?.x)) {
+                throw new GeneralError(this.CLASS_NAME, "publicKeyJwkMissing");
+            }
+            return this._vaultConnector.verify(this.buildVaultKey(didIdentityDocument.id, verificationMethodId), bytes, signatureValue);
+        }
+        catch (error) {
+            throw new GeneralError(this.CLASS_NAME, "verifyProofFailed", undefined, error);
+        }
+    }
+    /**
+     * Get all the methods from a document.
+     * @param document The document to get the methods from.
+     * @returns The methods.
+     * @internal
+     */
+    getAllMethods(document) {
+        const methods = [];
+        const methodTypes = Object.values(DidVerificationMethodType);
+        for (const methodType of methodTypes) {
+            const mt = document[methodType];
+            if (Is.arrayValue(mt)) {
+                methods.push(...mt.map(m => ({
+                    arrayKey: methodType,
+                    method: Is.string(m) ? { id: m } : m
+                })));
+            }
+        }
+        return methods;
+    }
+    /**
+     * Check if a revocation index is revoked.
+     * @param document The document to check.
+     * @param revocationBitmapIndex The revocation index to check.
+     * @returns True if the index is revoked.
+     * @internal
+     */
+    async checkRevocation(document, revocationBitmapIndex) {
+        if (Is.stringValue(revocationBitmapIndex)) {
+            const revocationIndex = Coerce.number(revocationBitmapIndex);
+            if (Is.number(revocationIndex)) {
+                const revocationService = document.service?.find(s => s.id.endsWith("#revocation"));
+                if (revocationService &&
+                    Is.string(revocationService.serviceEndpoint) &&
+                    revocationService.type === "BitstringStatusList") {
+                    const revocationParts = revocationService.serviceEndpoint.split(",");
+                    if (revocationParts.length === 2) {
+                        const compressedRevocationBytes = Converter.base64UrlToBytes(revocationParts[1]);
+                        const decompressed = await Compression.decompress(compressedRevocationBytes, CompressionType.Gzip);
+                        const bitString = BitString.fromBits(decompressed, EntityStorageIdentityConnector._REVOCATION_BITS_SIZE);
+                        return bitString.getBit(revocationIndex);
+                    }
+                }
+            }
+        }
+        return false;
+    }
+    /**
+     * Verify the document in storage.
+     * @param didDocument The did document that was stored.
+     * @internal
+     */
+    async verifyDocument(didDocument) {
+        const stringifiedDocument = JsonHelper.canonicalize(didDocument.document);
+        const docBytes = Converter.utf8ToBytes(stringifiedDocument);
+        const verified = await this._vaultConnector.verify(this.buildVaultKey(didDocument.id, didDocument.id), docBytes, Converter.base64ToBytes(didDocument.signature));
+        if (!verified) {
+            throw new GeneralError(this.CLASS_NAME, "signatureVerificationFailed");
+        }
+    }
+    /**
+     * Update the document in storage.
+     * @param controller The controller of the document.
+     * @param didDocument The did document to store.
+     * @internal
+     */
+    async updateDocument(controller, didDocument) {
+        const stringifiedDocument = JsonHelper.canonicalize(didDocument);
+        const docBytes = Converter.utf8ToBytes(stringifiedDocument);
+        const signature = await this._vaultConnector.sign(this.buildVaultKey(didDocument.id, didDocument.id), docBytes);
+        await this._didDocumentEntityStorage.set({
+            id: didDocument.id,
+            document: didDocument,
+            signature: Converter.bytesToBase64(signature),
+            controller
+        });
+    }
+    /**
+     * Build the key name to access the specified key in the vault.
+     * @param identity The identity of the user to access the vault keys.
+     * @returns The vault key.
+     * @internal
+     */
+    buildVaultKey(identity, key) {
+        return `${identity}/${key}`;
+    }
+}
+
+// Copyright 2024 IOTA Stiftung.
+// SPDX-License-Identifier: Apache-2.0.
+/**
+ * Class which implements the identity profile connector contract.
+ */
+class EntityStorageIdentityProfileConnector {
+    /**
+     * The namespace supported by the identity profile connector.
+     */
+    static NAMESPACE = "entity-storage";
+    /**
+     * Runtime name for the class.
+     */
+    CLASS_NAME = "EntityStorageIdentityProfileConnector";
+    /**
+     * The storage connector for the profiles.
+     * @internal
+     */
+    _profileEntityStorage;
+    /**
+     * Create a new instance of Identity.
+     * @param options The dependencies for the identity service.
+     * @param options.profileEntityStorageType The storage connector for the profiles, default to "identity-profile".
+     */
+    constructor(options) {
+        this._profileEntityStorage = EntityStorageConnectorFactory.get(options?.profileEntityStorageType ?? "identity-profile");
+    }
+    /**
+     * Create the profile properties for an identity.
+     * @param identity The identity of the profile to create.
+     * @param publicProfile The public profile data.
+     * @param privateProfile The private profile data.
+     * @returns Nothing.
+     */
+    async create(identity, publicProfile, privateProfile) {
+        Guards.stringValue(this.CLASS_NAME, "identity", identity);
+        try {
+            const profile = await this._profileEntityStorage.get(identity);
+            if (!Is.empty(profile)) {
+                throw new AlreadyExistsError(this.CLASS_NAME, "alreadyExists", identity);
+            }
+            await this._profileEntityStorage.set({
+                identity,
+                publicProfile,
+                privateProfile
+            });
+        }
+        catch (error) {
+            if (BaseError.someErrorClass(error, this.CLASS_NAME)) {
+                throw error;
+            }
+            throw new GeneralError(this.CLASS_NAME, "createFailed", { identity }, error);
+        }
+    }
+    /**
+     * Get the profile properties for an identity.
+     * @param identity The identity of the item to get.
+     * @param publicPropertyNames The public properties to get for the profile, defaults to all.
+     * @param privatePropertyNames The private properties to get for the profile, defaults to all.
+     * @returns The items properties.
+     */
+    async get(identity, publicPropertyNames, privatePropertyNames) {
+        try {
+            const profile = await this._profileEntityStorage.get(identity);
+            if (!profile) {
+                throw new NotFoundError(this.CLASS_NAME, "getFailed", identity);
+            }
+            return this.pickProperties(profile, publicPropertyNames, privatePropertyNames);
+        }
+        catch (error) {
+            if (BaseError.someErrorClass(error, this.CLASS_NAME)) {
+                throw error;
+            }
+            throw new GeneralError(this.CLASS_NAME, "getFailed", undefined, error);
+        }
+    }
+    /**
+     * Update the profile properties of an identity.
+     * @param identity The identity to update.
+     * @param publicProfile The public profile data.
+     * @param privateProfile The private profile data.
+     * @returns Nothing.
+     */
+    async update(identity, publicProfile, privateProfile) {
+        Guards.stringValue(this.CLASS_NAME, "identity", identity);
+        try {
+            const profile = await this._profileEntityStorage.get(identity);
+            if (Is.empty(profile)) {
+                throw new NotFoundError(this.CLASS_NAME, "notFound", identity);
+            }
+            profile.publicProfile = publicProfile ?? profile.publicProfile;
+            profile.privateProfile = privateProfile ?? profile.privateProfile;
+            await this._profileEntityStorage.set(profile);
+        }
+        catch (error) {
+            if (BaseError.someErrorClass(error, this.CLASS_NAME)) {
+                throw error;
+            }
+            throw new GeneralError(this.CLASS_NAME, "updateFailed", { identity }, error);
+        }
+    }
+    /**
+     * Delete the profile for an identity.
+     * @param identity The identity to delete.
+     * @returns Nothing.
+     */
+    async remove(identity) {
+        Guards.stringValue(this.CLASS_NAME, "identity", identity);
+        try {
+            const profile = await this._profileEntityStorage.get(identity);
+            if (Is.empty(profile)) {
+                throw new NotFoundError(this.CLASS_NAME, "notFound", identity);
+            }
+            await this._profileEntityStorage.remove(identity);
+        }
+        catch (error) {
+            if (BaseError.someErrorClass(error, this.CLASS_NAME)) {
+                throw error;
+            }
+            throw new GeneralError(this.CLASS_NAME, "removeFailed", { identity }, error);
+        }
+    }
+    /**
+     * Get a list of the requested types.
+     * @param publicFilters The filters to apply to the identities public profiles.
+     * @param privateFilters The filters to apply to the identities private profiles.
+     * @param publicPropertyNames The public properties to get for the profile, defaults to all.
+     * @param privatePropertyNames The private properties to get for the profile, defaults to all.
+     * @param cursor The cursor for paged requests.
+     * @param pageSize The maximum number of items in a page.
+     * @returns The list of items and cursor for paging.
+     */
+    async list(publicFilters, privateFilters, publicPropertyNames, privatePropertyNames, cursor, pageSize) {
+        try {
+            const conditions = [];
+            if (Is.arrayValue(publicFilters)) {
+                for (const filter of publicFilters) {
+                    conditions.push({
+                        property: `publicProfile.${filter.propertyName}`,
+                        value: filter.propertyValue,
+                        comparison: ComparisonOperator.Equals
+                    });
+                }
+            }
+            if (Is.arrayValue(privateFilters)) {
+                for (const filter of privateFilters) {
+                    conditions.push({
+                        property: `privateProfile.${filter.propertyName}`,
+                        value: filter.propertyValue,
+                        comparison: ComparisonOperator.Equals
+                    });
+                }
+            }
+            const result = await this._profileEntityStorage.query(Is.arrayValue(conditions)
+                ? {
+                    conditions
+                }
+                : undefined, undefined, undefined, cursor, pageSize);
+            const items = [];
+            for (const resultEntity of result.entities) {
+                items.push({
+                    identity: resultEntity.identity ?? "",
+                    ...this.pickProperties(resultEntity, publicPropertyNames, privatePropertyNames)
+                });
+            }
+            return {
+                items,
+                cursor: result.cursor
+            };
+        }
+        catch (error) {
+            throw new GeneralError(this.CLASS_NAME, "listFailed", undefined, error);
+        }
+    }
+    /**
+     * Get the profile properties for an identity.
+     * @param profile The profile to pick the properties from.
+     * @param publicPropertyNames The public properties to get for the profile, defaults to all.
+     * @param privatePropertyNames The private properties to get for the profile, defaults to all.
+     * @returns The identity profile, will only return private data if you have correct permissions.
+     * @internal
+     */
+    pickProperties(profile, publicPropertyNames, privatePropertyNames) {
+        return {
+            publicProfile: Is.array(publicPropertyNames)
+                ? ObjectHelper.pick(profile.publicProfile, publicPropertyNames)
+                : profile.publicProfile,
+            privateProfile: Is.array(privatePropertyNames)
+                ? ObjectHelper.pick(profile.privateProfile, privatePropertyNames)
+                : profile.privateProfile
+        };
+    }
+}
+
+// Copyright 2024 IOTA Stiftung.
+// SPDX-License-Identifier: Apache-2.0.
+/**
+ * Initialize the schema for the identity entity storage connector.
+ * @param options Options for which entities to register.
+ * @param options.includeDocument Whether to include the document entity, defaults to true.
+ * @param options.includeProfile Whether to include the profile entity, defaults to true.
+ */
+function initSchema(options) {
+    if (options?.includeDocument ?? true) {
+        EntitySchemaFactory.register("IdentityDocument", () => EntitySchemaHelper.getSchema(IdentityDocument));
+    }
+    if (options?.includeProfile ?? true) {
+        EntitySchemaFactory.register("IdentityProfile", () => EntitySchemaHelper.getSchema(IdentityProfile));
+    }
+}
+
+export { EntityStorageIdentityConnector, EntityStorageIdentityProfileConnector, IdentityDocument, IdentityProfile, initSchema };