@twin.org/identity-connector-entity-storage 0.0.3-next.9 → 0.9.0

package/README.md

@@ -1,6 +1,6 @@
-# TWIN Identity Connector Entity Storage
+# TWIN Identity
 
-Identity connector implementation using entity storage.
+The identity-connector-entity-storage package provides an entity storage backed connector for identity workflows, enabling reliable persistence and retrieval of identity records. It supports implementations that need consistent storage semantics while staying aligned with shared contracts across the ecosystem.
 
 ## Installation
 

package/dist/es/entityStorageIdentityConnector.js

@@ -1,10 +1,10 @@
 // Copyright 2024 IOTA Stiftung.
 // SPDX-License-Identifier: Apache-2.0.
-import { BaseError, BitString, Coerce, Compression, CompressionType, Converter, GeneralError, Guards, Is, JsonHelper, NotFoundError, ObjectHelper, RandomHelper } from "@twin.org/core";
-import { JsonLdProcessor } from "@twin.org/data-json-ld";
+import { ArrayHelper, BaseError, BitString, Coerce, Compression, CompressionType, Converter, GeneralError, Guards, Is, JsonHelper, NotFoundError, ObjectHelper, RandomHelper, Url, Urn } from "@twin.org/core";
+import { JsonLdHelper, JsonLdProcessor } from "@twin.org/data-json-ld";
 import { EntityStorageConnectorFactory } from "@twin.org/entity-storage-models";
 import { DocumentHelper } from "@twin.org/identity-models";
-import { DidContexts, DidTypes, DidVerificationMethodType, ProofHelper, ProofTypes } from "@twin.org/standards-w3c-did";
+import { DidContexts, DidTypes, DidVerificationMethodType, JwsAlgorithms, ProofHelper, ProofTypes } from "@twin.org/standards-w3c-did";
 import { VaultConnectorFactory, VaultConnectorHelper, VaultKeyType } from "@twin.org/vault-models";
 import { Jwk, Jwt } from "@twin.org/web";
 /**
@@ -45,6 +45,7 @@ export class EntityStorageIdentityConnector {
     /**
      * Build the key name to access the specified key in the vault.
      * @param identity The identity of the user to access the vault keys.
+     * @param key The key to access in the vault.
      * @returns The vault key.
      * @internal
      */
@@ -54,6 +55,9 @@ export class EntityStorageIdentityConnector {
     /**
      * Verify the document in storage.
      * @param didDocument The did document that was stored.
+     * @param vaultConnector The vault connector to use for verification.
+     * @returns A promise that resolves when verification is complete.
+     * @throws GeneralError if the document signature is invalid.
      * @internal
      */
     static async verifyDocument(didDocument, vaultConnector) {
@@ -84,7 +88,7 @@ export class EntityStorageIdentityConnector {
             const bitString = new BitString(EntityStorageIdentityConnector._REVOCATION_BITS_SIZE);
             const compressed = await Compression.compress(bitString.getBits(), CompressionType.Gzip);
             const didDocument = {
-                "@context": DidContexts.Namespace,
+                "@context": DidContexts.Context,
                 id: did,
                 service: [
                     {
@@ -105,7 +109,7 @@ export class EntityStorageIdentityConnector {
      * Remove a document.
      * @param controller The controller of the identity who can make changes.
      * @param documentId The id of the document to remove.
-     * @returns Nothing.
+     * @returns A promise that resolves when the document has been removed.
      */
     async removeDocument(controller, documentId) {
         Guards.stringValue(EntityStorageIdentityConnector.CLASS_NAME, "controller", controller);
@@ -148,7 +152,7 @@ export class EntityStorageIdentityConnector {
                 // If there is a verification method id, we will try to get the key from the vault.
                 try {
                     // If there is an existing key, we will use it.
-                    const existingKey = await this._vaultConnector.getKey(EntityStorageIdentityConnector.buildVaultKey(didDocument.id, verificationMethodId));
+                    const existingKey = await this._vaultConnector.getKey(EntityStorageIdentityConnector.buildVaultKey(didDocument.id, verificationMethodId), "public");
                     methodKeyPublic = existingKey.publicKey;
                 }
                 catch { }
@@ -187,7 +191,7 @@ export class EntityStorageIdentityConnector {
             const didVerificationMethod = {
                 id: methodId,
                 controller: documentId,
-                type: "JsonWebKey",
+                type: "JsonWebKey2020",
                 publicKeyJwk: {
                     ...jwkParams,
                     kid
@@ -215,7 +219,7 @@ export class EntityStorageIdentityConnector {
      * Remove a verification method from the document.
      * @param controller The controller of the identity who can make changes.
      * @param verificationMethodId The id of the verification method.
-     * @returns Nothing.
+     * @returns A promise that resolves when the verification method has been removed.
      * @throws NotFoundError if the id can not be resolved.
      * @throws NotSupportedError if the platform does not support multiple revocable keys.
      */
@@ -316,7 +320,7 @@ export class EntityStorageIdentityConnector {
      * Remove a service from the document.
      * @param controller The controller of the identity who can make changes.
      * @param serviceId The id of the service.
-     * @returns Nothing.
+     * @returns A promise that resolves when the service has been removed.
      * @throws NotFoundError if the id can not be resolved.
      */
     async removeService(controller, serviceId) {
@@ -341,6 +345,9 @@ export class EntityStorageIdentityConnector {
                         delete didDocument.service;
                     }
                 }
+                else {
+                    throw new NotFoundError(EntityStorageIdentityConnector.CLASS_NAME, "serviceNotFound", serviceId);
+                }
             }
             else {
                 throw new NotFoundError(EntityStorageIdentityConnector.CLASS_NAME, "serviceNotFound", serviceId);
@@ -351,6 +358,81 @@ export class EntityStorageIdentityConnector {
             throw new GeneralError(EntityStorageIdentityConnector.CLASS_NAME, "removeServiceFailed", undefined, error);
         }
     }
+    /**
+     * Add an alias to the alsoKnownAs property on the document.
+     * If the alias is already present the operation is a no-op.
+     * @param controller The controller of the identity who can make changes.
+     * @param documentId The id of the document to update.
+     * @param alias The alias to add. Must be a Url or Urn (typically another DID).
+     * @returns A promise that resolves when the alias has been added.
+     * @throws GeneralError if the alias is not a Url or Urn.
+     * @throws NotFoundError if the id can not be resolved.
+     */
+    async addAlsoKnownAs(controller, documentId, alias) {
+        Guards.stringValue(EntityStorageIdentityConnector.CLASS_NAME, "controller", controller);
+        Guards.stringValue(EntityStorageIdentityConnector.CLASS_NAME, "documentId", documentId);
+        Guards.stringValue(EntityStorageIdentityConnector.CLASS_NAME, "alias", alias);
+        if (!Url.tryParseExact(alias) && !Urn.tryParseExact(alias)) {
+            throw new GeneralError(EntityStorageIdentityConnector.CLASS_NAME, "invalidAlias", { alias });
+        }
+        try {
+            const didIdentityDocument = await this._didDocumentEntityStorage.get(documentId);
+            if (Is.undefined(didIdentityDocument)) {
+                throw new NotFoundError(EntityStorageIdentityConnector.CLASS_NAME, "documentNotFound", documentId);
+            }
+            await EntityStorageIdentityConnector.verifyDocument(didIdentityDocument, this._vaultConnector);
+            const didDocument = didIdentityDocument.document;
+            const existing = Is.array(didDocument.alsoKnownAs) ? didDocument.alsoKnownAs : [];
+            if (existing.includes(alias)) {
+                return;
+            }
+            didDocument.alsoKnownAs = [...existing, alias];
+            await this.updateDocument(controller, didDocument);
+        }
+        catch (error) {
+            throw new GeneralError(EntityStorageIdentityConnector.CLASS_NAME, "addAlsoKnownAsFailed", undefined, error);
+        }
+    }
+    /**
+     * Remove an alias from the alsoKnownAs property on the document.
+     * If the alias is not present the operation is a no-op.
+     * @param controller The controller of the identity who can make changes.
+     * @param documentId The id of the document to update.
+     * @param alias The alias to remove. Must be a Url or Urn.
+     * @returns A promise that resolves when the alias has been removed.
+     * @throws GeneralError if the alias is not a Url or Urn.
+     * @throws NotFoundError if the id can not be resolved.
+     */
+    async removeAlsoKnownAs(controller, documentId, alias) {
+        Guards.stringValue(EntityStorageIdentityConnector.CLASS_NAME, "controller", controller);
+        Guards.stringValue(EntityStorageIdentityConnector.CLASS_NAME, "documentId", documentId);
+        Guards.stringValue(EntityStorageIdentityConnector.CLASS_NAME, "alias", alias);
+        if (!Url.tryParseExact(alias) && !Urn.tryParseExact(alias)) {
+            throw new GeneralError(EntityStorageIdentityConnector.CLASS_NAME, "invalidAlias", { alias });
+        }
+        try {
+            const didIdentityDocument = await this._didDocumentEntityStorage.get(documentId);
+            if (Is.undefined(didIdentityDocument)) {
+                throw new NotFoundError(EntityStorageIdentityConnector.CLASS_NAME, "documentNotFound", documentId);
+            }
+            await EntityStorageIdentityConnector.verifyDocument(didIdentityDocument, this._vaultConnector);
+            const didDocument = didIdentityDocument.document;
+            if (!Is.array(didDocument.alsoKnownAs) || !didDocument.alsoKnownAs.includes(alias)) {
+                return;
+            }
+            const filtered = didDocument.alsoKnownAs.filter(a => a !== alias);
+            if (filtered.length === 0) {
+                delete didDocument.alsoKnownAs;
+            }
+            else {
+                didDocument.alsoKnownAs = filtered;
+            }
+            await this.updateDocument(controller, didDocument);
+        }
+        catch (error) {
+            throw new GeneralError(EntityStorageIdentityConnector.CLASS_NAME, "removeAlsoKnownAsFailed", undefined, error);
+        }
+    }
     /**
      * Create a verifiable credential for a verification method.
      * @param controller The controller of the identity who can make changes.
@@ -360,6 +442,8 @@ export class EntityStorageIdentityConnector {
      * @param options Additional options for creating the verifiable credential.
      * @param options.revocationIndex The bitmap revocation index of the credential, if undefined will not have revocation status.
      * @param options.expirationDate The date the verifiable credential is valid until.
+     * @param options.jwtHeaderFields Additional fields to add to the JWT header.
+     * @param options.jwtPayloadFields Additional fields to add to the JWT payload.
      * @returns The created verifiable credential and its token.
      * @throws NotFoundError if the id can not be resolved.
      */
@@ -370,6 +454,9 @@ export class EntityStorageIdentityConnector {
         if (!Is.undefined(options?.revocationIndex)) {
             Guards.number(EntityStorageIdentityConnector.CLASS_NAME, "options.revocationIndex", options.revocationIndex);
         }
+        if (!Is.undefined(options?.expirationDate)) {
+            Guards.date(EntityStorageIdentityConnector.CLASS_NAME, "options.expirationDate", options.expirationDate);
+        }
         try {
             const idParts = DocumentHelper.parseId(verificationMethodId);
             if (Is.empty(idParts.fragment)) {
@@ -401,19 +488,15 @@ export class EntityStorageIdentityConnector {
             }
             const revocationService = issuerDidDocument.service?.find(s => s.id.endsWith("#revocation"));
             const subjectClone = ObjectHelper.clone(subject);
-            const finalTypes = [DidTypes.VerifiableCredential];
             const credContext = ObjectHelper.extractProperty(subjectClone, [
                 "@context"
             ]);
             const credId = ObjectHelper.extractProperty(subjectClone, ["@id", "id"], false);
-            const credType = ObjectHelper.extractProperty(subjectClone, ["@type", "type"]);
-            if (Is.stringValue(credType)) {
-                finalTypes.push(credType);
-            }
             const verifiableCredential = {
-                "@context": JsonLdProcessor.combineContexts(DidContexts.NamespaceVCv1, credContext),
+                "@context": (JsonLdProcessor.combineContexts(DidContexts.ContextVCv1, credContext) ??
+                    DidContexts.ContextVCv1),
                 id,
-                type: finalTypes,
+                type: DidTypes.VerifiableCredential,
                 credentialSubject: subjectClone,
                 issuer: issuerDidDocument.id,
                 issuanceDate: new Date(Date.now()).toISOString(),
@@ -431,9 +514,10 @@ export class EntityStorageIdentityConnector {
                     : undefined
             };
             const jwtHeader = {
+                ...options?.jwtHeaderFields,
                 kid: verificationDidMethod.id,
                 typ: "JWT",
-                alg: "EdDSA"
+                alg: JwsAlgorithms.EdDSA
             };
             const jwtVc = ObjectHelper.pick(ObjectHelper.clone(verifiableCredential), [
                 "@context",
@@ -441,6 +525,15 @@ export class EntityStorageIdentityConnector {
                 "credentialSubject",
                 "credentialStatus"
             ]);
+            // Add the proof to the VC after extracting the jwt data
+            // as the jwt does not include the proof
+            verifiableCredential.proof = await this.createProof(controller, verificationMethodId, ProofTypes.DataIntegrityProof, JsonLdHelper.toNodeObject(verifiableCredential));
+            // As we are adding the receipt to the data we update the JSON-LD context
+            const proofContext = verifiableCredential.proof["@context"];
+            if (!Is.empty(proofContext)) {
+                verifiableCredential["@context"] = (JsonLdProcessor.combineContexts(verifiableCredential["@context"], proofContext) ?? verifiableCredential["@context"]);
+                delete verifiableCredential.proof["@context"];
+            }
             if (Is.array(jwtVc.credentialSubject)) {
                 jwtVc.credentialSubject = jwtVc.credentialSubject.map(c => {
                     ObjectHelper.propertyDelete(c, "id");
@@ -451,12 +544,16 @@ export class EntityStorageIdentityConnector {
                 ObjectHelper.propertyDelete(jwtVc.credentialSubject, "id");
             }
             const jwtPayload = {
+                ...options?.jwtPayloadFields,
                 iss: idParts.id,
                 nbf: Math.floor(Date.now() / 1000),
                 jti: verifiableCredential.id,
                 sub: credId,
                 vc: jwtVc
             };
+            if (Is.date(options?.expirationDate)) {
+                jwtPayload.exp = Math.floor(options.expirationDate.getTime() / 1000);
+            }
             const signature = await Jwt.encodeWithSigner(jwtHeader, jwtPayload, async (header, payload) => VaultConnectorHelper.jwtSigner(this._vaultConnector, EntityStorageIdentityConnector.buildVaultKey(idParts.id, idParts.fragment ?? ""), header, payload));
             return {
                 verifiableCredential,
@@ -469,13 +566,23 @@ export class EntityStorageIdentityConnector {
     }
     /**
      * Check a verifiable credential is valid.
-     * @param credentialJwt The credential to verify.
+     * @param credential The credential to verify.
      * @returns The credential stored in the jwt and the revocation status.
      */
-    async checkVerifiableCredential(credentialJwt) {
-        Guards.stringValue(EntityStorageIdentityConnector.CLASS_NAME, "credentialJwt", credentialJwt);
+    async checkVerifiableCredential(credential) {
+        if (Is.object(credential)) {
+            Guards.objectValue(EntityStorageIdentityConnector.CLASS_NAME, "credential", credential);
+            Guards.objectValue(EntityStorageIdentityConnector.CLASS_NAME, "credential.proof", credential.proof);
+            const { proof, ...doc } = credential;
+            await this.verifyProof(JsonLdHelper.toNodeObject(doc), ArrayHelper.fromObjectOrArray(proof)[0]);
+            return {
+                revoked: false,
+                verifiableCredential: doc
+            };
+        }
+        Guards.stringValue(EntityStorageIdentityConnector.CLASS_NAME, "credential", credential);
         try {
-            const jwtDecoded = await Jwt.decode(credentialJwt);
+            const jwtDecoded = await Jwt.decode(credential);
             const jwtHeader = jwtDecoded.header;
             const jwtPayload = jwtDecoded.payload;
             const jwtSignature = jwtDecoded.signature;
@@ -510,7 +617,7 @@ export class EntityStorageIdentityConnector {
                     method: jwtHeader.kid
                 });
             }
-            await Jwt.verifySignature(credentialJwt, await Jwk.toCryptoKey(didMethod.publicKeyJwk));
+            await Jwt.verifySignature(credential, await Jwk.toCryptoKey(didMethod.publicKeyJwk));
             const verifiableCredential = jwtPayload.vc;
             if (Is.object(verifiableCredential)) {
                 if (Is.string(jwtPayload.jti)) {
@@ -557,7 +664,7 @@ export class EntityStorageIdentityConnector {
      * @param controller The controller of the identity who can make changes.
      * @param issuerDocumentId The id of the document to update the revocation list for.
      * @param credentialIndices The revocation bitmap index or indices to revoke.
-     * @returns Nothing.
+     * @returns A promise that resolves when the credentials have been revoked.
      */
     async revokeVerifiableCredentials(controller, issuerDocumentId, credentialIndices) {
         Guards.stringValue(EntityStorageIdentityConnector.CLASS_NAME, "controller", controller);
@@ -597,7 +704,7 @@ export class EntityStorageIdentityConnector {
      * @param controller The controller of the identity who can make changes.
      * @param issuerDocumentId The id of the document to update the revocation list for.
      * @param credentialIndices The revocation bitmap index or indices to un revoke.
-     * @returns Nothing.
+     * @returns A promise that resolves when the credentials have been unrevoked.
      */
     async unrevokeVerifiableCredentials(controller, issuerDocumentId, credentialIndices) {
         Guards.stringValue(EntityStorageIdentityConnector.CLASS_NAME, "controller", controller);
@@ -640,11 +747,14 @@ export class EntityStorageIdentityConnector {
      * @param contexts The contexts for the data stored in the verifiable credential.
      * @param types The types for the data stored in the verifiable credential.
      * @param verifiableCredentials The credentials to use for creating the presentation in jwt format.
-     * @param expiresInMinutes The time in minutes for the presentation to expire.
+     * @param options Additional options for creating the verifiable presentation.
+     * @param options.expirationDate The date the verifiable presentation is valid until.
+     * @param options.jwtHeaderFields Additional fields to add to the JWT header.
+     * @param options.jwtPayloadFields Additional fields to add to the JWT payload.
      * @returns The created verifiable presentation and its token.
      * @throws NotFoundError if the id can not be resolved.
      */
-    async createVerifiablePresentation(controller, verificationMethodId, presentationId, contexts, types, verifiableCredentials, expiresInMinutes) {
+    async createVerifiablePresentation(controller, verificationMethodId, presentationId, contexts, types, verifiableCredentials, options) {
         Guards.stringValue(EntityStorageIdentityConnector.CLASS_NAME, "controller", controller);
         Guards.stringValue(EntityStorageIdentityConnector.CLASS_NAME, "verificationMethodId", verificationMethodId);
         if (Is.array(types)) {
@@ -654,8 +764,8 @@ export class EntityStorageIdentityConnector {
             Guards.stringValue(EntityStorageIdentityConnector.CLASS_NAME, "types", types);
         }
         Guards.arrayValue(EntityStorageIdentityConnector.CLASS_NAME, "verifiableCredentials", verifiableCredentials);
-        if (!Is.undefined(expiresInMinutes)) {
-            Guards.integer(EntityStorageIdentityConnector.CLASS_NAME, "expiresInMinutes", expiresInMinutes);
+        if (!Is.undefined(options?.expirationDate)) {
+            Guards.date(EntityStorageIdentityConnector.CLASS_NAME, "options.expirationDate", options.expirationDate);
         }
         try {
             const idParts = DocumentHelper.parseId(verificationMethodId);
@@ -693,31 +803,37 @@ export class EntityStorageIdentityConnector {
             else if (Is.stringValue(types)) {
                 finalTypes.push(types);
             }
+            const combinedContext = JsonLdProcessor.combineContexts(DidContexts.ContextVCv1, contexts) ??
+                DidContexts.ContextVCv1;
             const verifiablePresentation = {
-                "@context": JsonLdProcessor.combineContexts(DidContexts.NamespaceVCv1, contexts),
+                "@context": combinedContext,
                 id: presentationId,
                 type: finalTypes,
                 verifiableCredential: verifiableCredentials,
                 holder: idParts.id
             };
             const jwtHeader = {
+                ...options?.jwtHeaderFields,
                 kid: didMethod.id,
                 typ: "JWT",
-                alg: "EdDSA"
+                alg: JwsAlgorithms.EdDSA
             };
             const jwtVp = ObjectHelper.pick(ObjectHelper.clone(verifiablePresentation), [
                 "@context",
                 "type",
                 "verifiableCredential"
             ]);
+            // Add the proof to the VP after extracting the jwt data
+            // as the jwt does not include the proof
+            verifiablePresentation.proof = await this.createProof(controller, verificationMethodId, ProofTypes.DataIntegrityProof, JsonLdHelper.toNodeObject(verifiablePresentation));
             const jwtPayload = {
-                iss: idParts.id,
+                ...options?.jwtPayloadFields,
+                iss: verifiablePresentation.holder,
                 nbf: Math.floor(Date.now() / 1000),
                 vp: jwtVp
             };
-            if (Is.integer(expiresInMinutes)) {
-                const expiresInSeconds = expiresInMinutes * 60;
-                jwtPayload.exp = Math.floor(Date.now() / 1000) + expiresInSeconds;
+            if (Is.date(options?.expirationDate)) {
+                jwtPayload.exp = Math.floor(options.expirationDate.getTime() / 1000);
             }
             const signature = await Jwt.encodeWithSigner(jwtHeader, jwtPayload, async (header, payload) => VaultConnectorHelper.jwtSigner(this._vaultConnector, EntityStorageIdentityConnector.buildVaultKey(idParts.id, idParts.fragment ?? ""), header, payload));
             return {
@@ -731,11 +847,19 @@ export class EntityStorageIdentityConnector {
     }
     /**
      * Check a verifiable presentation is valid.
-     * @param presentationJwt The presentation to verify.
+     * @param presentation The presentation to verify.
      * @returns The presentation stored in the jwt and the revocation status.
      */
-    async checkVerifiablePresentation(presentationJwt) {
-        Guards.stringValue(EntityStorageIdentityConnector.CLASS_NAME, "presentationJwt", presentationJwt);
+    async checkVerifiablePresentation(presentation) {
+        if (Is.object(presentation)) {
+            const { proof, ...doc } = presentation;
+            const proofEntry = ArrayHelper.fromObjectOrArray(proof)[0];
+            Guards.objectValue(EntityStorageIdentityConnector.CLASS_NAME, "proofEntry", proofEntry);
+            await this.verifyProof(JsonLdHelper.toNodeObject(doc), proofEntry);
+            return { revoked: false, verifiablePresentation: doc };
+        }
+        Guards.stringValue(EntityStorageIdentityConnector.CLASS_NAME, "presentation", presentation);
+        const presentationJwt = presentation;
         try {
             const jwtDecoded = await Jwt.decode(presentationJwt);
             const jwtHeader = jwtDecoded.header;
@@ -771,7 +895,7 @@ export class EntityStorageIdentityConnector {
                             }
                             await EntityStorageIdentityConnector.verifyDocument(issuerDidDocument, this._vaultConnector);
                             issuers.push({
-                                "@context": DidContexts.Namespace,
+                                "@context": DidContexts.Context,
                                 ...issuerDidDocument
                             });
                             const vc = jwt.payload.vc;
@@ -779,14 +903,14 @@ export class EntityStorageIdentityConnector {
                                 const credentialStatus = vc.credentialStatus;
                                 if (Is.object(credentialStatus)) {
                                     revoked = await this.checkRevocation({
-                                        "@context": DidContexts.Namespace,
+                                        "@context": DidContexts.Context,
                                         ...issuerDidDocument
                                     }, credentialStatus.revocationBitmapIndex);
                                 }
                                 else if (Is.arrayValue(credentialStatus)) {
                                     for (let i = 0; i < credentialStatus.length; i++) {
                                         revoked = await this.checkRevocation({
-                                            "@context": DidContexts.Namespace,
+                                            "@context": DidContexts.Context,
                                             ...issuerDidDocument
                                         }, credentialStatus[i].revocationBitmapIndex);
                                         if (revoked) {
@@ -820,11 +944,15 @@ export class EntityStorageIdentityConnector {
     }
     /**
      * Create a proof for arbitrary data with the specified verification method.
+     * This method uses async signing to ensure the private key never leaves the vault,
+     * with algorithm validation to ensure key type compatibility.
      * @param controller The controller of the identity who can make changes.
      * @param verificationMethodId The verification method id to use.
      * @param proofType The type of proof to create.
      * @param unsecureDocument The unsecure document to create the proof for.
      * @returns The proof.
+     * @throws NotFoundError if the identity or method is not found.
+     * @throws GeneralError if algorithm doesn't match key type or proof creation fails.
      */
     async createProof(controller, verificationMethodId, proofType, unsecureDocument) {
         Guards.stringValue(EntityStorageIdentityConnector.CLASS_NAME, "controller", controller);
@@ -861,8 +989,14 @@ export class EntityStorageIdentityConnector {
                 });
             }
             const vaultKey = EntityStorageIdentityConnector.buildVaultKey(didDocument.id, idParts.fragment ?? "");
-            const key = await this._vaultConnector.getKey(vaultKey);
-            const signedProof = await ProofHelper.createProof(proofType, unsecureDocument, ProofHelper.createUnsignedProof(proofType, verificationMethodId), await Jwk.fromEd25519Private(key.privateKey));
+            const keyType = await this._vaultConnector.getKeyType(vaultKey);
+            if (Is.undefined(keyType)) {
+                throw new GeneralError(EntityStorageIdentityConnector.CLASS_NAME, "privateKeyMissing", {
+                    keyId: vaultKey
+                });
+            }
+            const unsignedProof = ProofHelper.createUnsignedProof(proofType, verificationMethodId);
+            const signedProof = await ProofHelper.createProofWithSigner(proofType, unsecureDocument, unsignedProof, async (data, algorithm) => this.signWithVault(vaultKey, keyType, data, algorithm));
             return signedProof;
         }
         catch (error) {
@@ -915,6 +1049,27 @@ export class EntityStorageIdentityConnector {
             throw new GeneralError(EntityStorageIdentityConnector.CLASS_NAME, "verifyProofFailed", undefined, error);
         }
     }
+    /**
+     * Signs data using the vault connector with algorithm validation.
+     * @param vaultKey The vault key identifier.
+     * @param keyType The type of the key.
+     * @param data The data to sign.
+     * @param algorithm The signing algorithm.
+     * @returns The signature bytes.
+     * @throws GeneralError if algorithm doesn't match key type.
+     * @internal
+     */
+    async signWithVault(vaultKey, keyType, data, algorithm) {
+        if (algorithm === JwsAlgorithms.EdDSA && keyType !== VaultKeyType.Ed25519) {
+            throw new GeneralError(EntityStorageIdentityConnector.CLASS_NAME, "algorithmKeyTypeMismatch", {
+                algorithm,
+                expectedKeyType: VaultKeyType.Ed25519,
+                actualKeyType: keyType,
+                keyId: vaultKey
+            });
+        }
+        return this._vaultConnector.sign(vaultKey, data);
+    }
     /**
      * Get all the methods from a document.
      * @param document The document to get the methods from.
@@ -966,6 +1121,7 @@ export class EntityStorageIdentityConnector {
      * Update the document in storage.
      * @param controller The controller of the document.
      * @param didDocument The did document to store.
+     * @returns A promise that resolves when the document has been signed and persisted.
      * @internal
      */
     async updateDocument(controller, didDocument) {