@verana-labs/vs-agent-plugin-openid4vc 2.0.0-dev.82 → 2.0.0-dev.84

package/build/trust/trustDecision.js

@@ -0,0 +1,204 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decidePresentationTrust = decidePresentationTrust;
+const core_1 = require("@credo-ts/core");
+const vs_agent_sdk_1 = require("@verana-labs/vs-agent-sdk");
+const config_1 = require("../config");
+const CertificateService_1 = require("../services/CertificateService");
+const isRecord_1 = require("../utils/isRecord");
+const keyBinding_1 = require("./keyBinding");
+/** The Verifiable Trust resolution reads the DID Document, its linked VPs and the VPR; 5 s is too tight. */
+const TRUST_RESOLUTION_TIMEOUT_MS = 15000;
+// verre answers these codes for a read that failed, not for a rule the DID broke.
+const UNAVAILABLE_RESOLUTION_CODES = [
+    vs_agent_sdk_1.TrustErrorCode.INVALID,
+    vs_agent_sdk_1.TrustErrorCode.INVALID_REQUEST,
+];
+/**
+ * [VSA-VTI-FLOW-VERIFY-OID] steps 2 to 8 on a credential that passed step 1: credo verified the
+ * response, the holder binding, the disclosures, the signature, the validity period and the `status`
+ * claim (step 6) before the session reached `ResponseVerified`. Every step fails closed. A step the
+ * agent cannot complete answers `RESOLVER_UNAVAILABLE`, which the caller never stores, so the next
+ * read retries it.
+ */
+async function decidePresentationTrust(credential, request, dependencies) {
+    const evidence = {
+        did: null,
+        trustStatus: null,
+        jsonSchemaCredentialId: request.jsonSchemaCredentialId,
+        credentialSchemaId: request.credentialSchemaId,
+        authorized: null,
+        queries: [],
+    };
+    const verdict = await runSteps(credential, request, dependencies, evidence);
+    return {
+        cryptographicVerified: true,
+        accepted: verdict === 'TRUSTED_AUTHORIZED',
+        trust: { verdict, evidence },
+        credential: presentedCredential(credential),
+    };
+}
+class StepFailure extends Error {
+    constructor(verdict, note) {
+        super(note);
+        this.verdict = verdict;
+        this.name = 'StepFailure';
+    }
+}
+async function runSteps(credential, request, dependencies, evidence) {
+    try {
+        const did = issuerDidOf(credential);
+        evidence.did = did;
+        await assertIssuerKeyBound(credential, did, dependencies, evidence);
+        await assertTypeMetadataBound(credential, request.jsonSchemaCredentialId, dependencies, evidence);
+        await assertIssuerTrusted(did, dependencies, evidence);
+        await assertIssuerAuthorized(did, request.credentialSchemaId, dependencies, evidence);
+        return 'TRUSTED_AUTHORIZED';
+    }
+    catch (error) {
+        if (!(error instanceof StepFailure))
+            throw error;
+        evidence.note = error.message;
+        return error.verdict;
+    }
+}
+// Step 2, [VT-CRED-SDJWT-6]: `iss` when it is a DID, else the URI SAN of the leaf of `x5c`.
+function issuerDidOf(credential) {
+    var _a, _b, _c;
+    const issuer = credential.issuer;
+    if (issuer.method === 'did')
+        return (_b = (_a = (0, core_1.tryParseDid)(issuer.didUrl)) === null || _a === void 0 ? void 0 : _a.did) !== null && _b !== void 0 ? _b : fail('UNTRUSTED', 'the issuer DID URL is no DID');
+    const fromIss = typeof credential.payload.iss === 'string' ? (_c = (0, core_1.tryParseDid)(credential.payload.iss)) === null || _c === void 0 ? void 0 : _c.did : undefined;
+    if (fromIss)
+        return fromIss;
+    try {
+        return (0, CertificateService_1.didFromValidatedCertificate)(issuer.x5c[0]);
+    }
+    catch (_d) {
+        return fail('UNTRUSTED', 'the credential carries no DID in iss nor in the URI SAN of its leaf certificate');
+    }
+}
+// Steps 3 and 4: a well-formed did:web or did:webvh, resolved under the network boundary, whose
+// DID Document authorizes the issuer key under assertionMethod.
+async function assertIssuerKeyBound(credential, did, dependencies, evidence) {
+    if (!isDidWeb(did))
+        fail('UNTRUSTED', `the issuer DID "${did}" is no did:web nor did:webvh`);
+    evidence.queries.push(`resolve ${did}`);
+    const didDocument = await (0, keyBinding_1.resolveDidDocument)(dependencies.agent, did);
+    if (didDocument === 'unresolvable') {
+        fail('RESOLVER_UNAVAILABLE', `the issuer DID "${did}" could not be resolved`);
+    }
+    if (didDocument === 'other-id') {
+        fail('UNTRUSTED', `the DID Document of the issuer DID "${did}" carries another id`);
+    }
+    const issuer = credential.issuer;
+    let issuerKey;
+    if (issuer.method === 'x5c') {
+        issuerKey = issuer.x5c[0].publicJwk;
+    }
+    else {
+        try {
+            issuerKey = (0, core_1.getPublicJwkFromVerificationMethod)(didDocument.dereferenceVerificationMethod(issuer.didUrl));
+        }
+        catch (_a) {
+            return fail('UNTRUSTED', `the issuer DID Document names no key at "${issuer.didUrl}"`);
+        }
+    }
+    if (!(0, keyBinding_1.boundVerificationMethod)(didDocument, issuerKey, ['assertionMethod'])) {
+        fail('UNTRUSTED', `the issuer DID Document does not authorize the signing key under assertionMethod`);
+    }
+}
+// Step 5, [VT-CRED-SDJWT-3] and [VT-CRED-SDJWT-4]: the Type Metadata document at `vct` hashes to
+// `vct#integrity` and names the VTJSC of the request.
+async function assertTypeMetadataBound(credential, jsonSchemaCredentialId, dependencies, evidence) {
+    const { vct, 'vct#integrity': integrity } = credential.payload;
+    if (typeof vct !== 'string')
+        fail('UNTRUSTED', 'the credential carries no vct');
+    if (typeof integrity !== 'string')
+        fail('UNTRUSTED', 'the credential carries no vct#integrity');
+    evidence.queries.push(`GET ${vct}`);
+    let document;
+    try {
+        document = await dependencies.readTypeMetadata(vct);
+    }
+    catch (error) {
+        return fail('RESOLVER_UNAVAILABLE', `the Type Metadata at "${vct}" could not be read: ${messageOf(error)}`);
+    }
+    if ((0, vs_agent_sdk_1.digestOfBytes)(document) !== integrity) {
+        fail('UNTRUSTED', `the Type Metadata at "${vct}" does not hash to the vct#integrity of the credential`);
+    }
+    const related = relatedJsonSchemaCredentialIdOf(document);
+    if (related !== jsonSchemaCredentialId) {
+        fail('UNTRUSTED', `the Type Metadata at "${vct}" names the VTJSC "${related}", not "${jsonSchemaCredentialId}"`);
+    }
+}
+// Step 7, first half: the Verifiable Trust resolution answers TRUSTED for the issuer DID.
+async function assertIssuerTrusted(did, dependencies, evidence) {
+    var _a;
+    evidence.queries.push(`resolveDID ${did}`);
+    let resolution;
+    try {
+        resolution = await (0, keyBinding_1.withTimeout)(dependencies.resolveDidTrust(did), TRUST_RESOLUTION_TIMEOUT_MS, 'the trust resolution timed out');
+    }
+    catch (error) {
+        return fail('RESOLVER_UNAVAILABLE', `the trust resolution of "${did}" failed: ${messageOf(error)}`);
+    }
+    if (resolution.trusted) {
+        evidence.trustStatus = 'TRUSTED';
+        return;
+    }
+    // verre does not throw when a registry or an endpoint does not answer: the outcome is INVALID
+    // with a code of a failed read, and the next read of the session retries it
+    if (resolution.errorCode && UNAVAILABLE_RESOLUTION_CODES.includes(resolution.errorCode)) {
+        fail('RESOLVER_UNAVAILABLE', `the trust resolution of "${did}" could not complete: ${(_a = resolution.errorMessage) !== null && _a !== void 0 ? _a : resolution.errorCode}`);
+    }
+    evidence.trustStatus = 'UNTRUSTED';
+    fail('UNTRUSTED', `the trust resolution of "${did}" answered UNTRUSTED${resolution.errorMessage ? `: ${resolution.errorMessage}` : ''}`);
+}
+// Step 7, second half: an active ISSUER Participant of the issuer DID for the CredentialSchema.
+async function assertIssuerAuthorized(did, credentialSchemaId, dependencies, evidence) {
+    evidence.queries.push(`listParticipants did=${did} role=ISSUER schema_id=${credentialSchemaId}`);
+    try {
+        await dependencies.assertAuthorized({ did, role: vs_agent_sdk_1.ParticipantRole.Issuer, credentialSchemaId });
+    }
+    catch (error) {
+        if (!(error instanceof vs_agent_sdk_1.AnonCredsTrustError))
+            throw error;
+        if (error.reason === vs_agent_sdk_1.AnonCredsTrustErrorReason.NotAuthorized) {
+            evidence.authorized = false;
+            fail('TRUSTED_NOT_AUTHORIZED', error.message);
+        }
+        fail('RESOLVER_UNAVAILABLE', error.message);
+    }
+    evidence.authorized = true;
+}
+function presentedCredential(credential) {
+    const disclosedClaims = Object.fromEntries(Object.entries(credential.prettyClaims).filter(([name]) => !(0, config_1.isReservedClaimName)(name)));
+    return { vct: String(credential.payload.vct), disclosedClaims };
+}
+function isDidWeb(did) {
+    try {
+        return (0, vs_agent_sdk_1.getDidWebHttpsBaseUrl)(did) !== undefined;
+    }
+    catch (_a) {
+        return false;
+    }
+}
+function relatedJsonSchemaCredentialIdOf(document) {
+    try {
+        const parsed = JSON.parse(Buffer.from(document).toString('utf8'));
+        return (0, isRecord_1.isRecord)(parsed) && typeof parsed.relatedJsonSchemaCredentialId === 'string'
+            ? parsed.relatedJsonSchemaCredentialId
+            : undefined;
+    }
+    catch (_a) {
+        return undefined;
+    }
+}
+function messageOf(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function fail(verdict, note) {
+    throw new StepFailure(verdict, note);
+}
+//# sourceMappingURL=trustDecision.js.map

package/build/trust/trustDecision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustDecision.js","sourceRoot":"","sources":["../../src/trust/trustDecision.ts"],"names":[],"mappings":";;AA0DA,0DAoBC;AAxED,yCAAqF;AACrF,4DAOkC;AAElC,sCAA+C;AAC/C,uEAA4E;AAC5E,gDAA4C;AAE5C,6CAAuF;AAEvF,4GAA4G;AAC5G,MAAM,2BAA2B,GAAG,KAAM,CAAA;AAE1C,kFAAkF;AAClF,MAAM,4BAA4B,GAA8B;IAC9D,6BAAc,CAAC,OAAO;IACtB,6BAAc,CAAC,eAAe;CAC/B,CAAA;AAsBD;;;;;;GAMG;AACI,KAAK,UAAU,uBAAuB,CAC3C,UAAmB,EACnB,OAAiC,EACjC,YAA2C;IAE3C,MAAM,QAAQ,GAAkB;QAC9B,GAAG,EAAE,IAAI;QACT,WAAW,EAAE,IAAI;QACjB,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;QACtD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,EAAE;KACZ,CAAA;IACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAA;IAC3E,OAAO;QACL,qBAAqB,EAAE,IAAI;QAC3B,QAAQ,EAAE,OAAO,KAAK,oBAAoB;QAC1C,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE;QAC5B,UAAU,EAAE,mBAAmB,CAAC,UAAU,CAAC;KAC5C,CAAA;AACH,CAAC;AAED,MAAM,WAAY,SAAQ,KAAK;IAC7B,YACkB,OAAyB,EACzC,IAAY;QAEZ,KAAK,CAAC,IAAI,CAAC,CAAA;QAHK,YAAO,GAAP,OAAO,CAAkB;QAIzC,IAAI,CAAC,IAAI,GAAG,aAAa,CAAA;IAC3B,CAAC;CACF;AAED,KAAK,UAAU,QAAQ,CACrB,UAAmB,EACnB,OAAiC,EACjC,YAA2C,EAC3C,QAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,CAAC,CAAA;QACnC,QAAQ,CAAC,GAAG,GAAG,GAAG,CAAA;QAClB,MAAM,oBAAoB,CAAC,UAAU,EAAE,GAAG,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAA;QACnE,MAAM,uBAAuB,CAAC,UAAU,EAAE,OAAO,CAAC,sBAAsB,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAA;QACjG,MAAM,mBAAmB,CAAC,GAAG,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAA;QACtD,MAAM,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,kBAAkB,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAA;QACrF,OAAO,oBAAoB,CAAA;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,WAAW,CAAC;YAAE,MAAM,KAAK,CAAA;QAChD,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,OAAO,CAAA;QAC7B,OAAO,KAAK,CAAC,OAAO,CAAA;IACtB,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,SAAS,WAAW,CAAC,UAAmB;;IACtC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAA;IAChC,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK;QACzB,OAAO,MAAA,MAAA,IAAA,kBAAW,EAAC,MAAM,CAAC,MAAM,CAAC,0CAAE,GAAG,mCAAI,IAAI,CAAC,WAAW,EAAE,8BAA8B,CAAC,CAAA;IAC7F,MAAM,OAAO,GACX,OAAO,UAAU,CAAC,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAA,IAAA,kBAAW,EAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,0CAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;IACnG,IAAI,OAAO;QAAE,OAAO,OAAO,CAAA;IAC3B,IAAI,CAAC;QACH,OAAO,IAAA,gDAA2B,EAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IACnD,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,IAAI,CACT,WAAW,EACX,iFAAiF,CAClF,CAAA;IACH,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,gEAAgE;AAChE,KAAK,UAAU,oBAAoB,CACjC,UAAmB,EACnB,GAAW,EACX,YAA2C,EAC3C,QAAuB;IAEvB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,WAAW,EAAE,mBAAmB,GAAG,+BAA+B,CAAC,CAAA;IAE5F,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC,CAAA;IACvC,MAAM,WAAW,GAAG,MAAM,IAAA,+BAAkB,EAAC,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACrE,IAAI,WAAW,KAAK,cAAc,EAAE,CAAC;QACnC,IAAI,CAAC,sBAAsB,EAAE,mBAAmB,GAAG,yBAAyB,CAAC,CAAA;IAC/E,CAAC;IACD,IAAI,WAAW,KAAK,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC,WAAW,EAAE,uCAAuC,GAAG,sBAAsB,CAAC,CAAA;IACrF,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAA;IAChC,IAAI,SAAwB,CAAA;IAC5B,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC5B,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACrC,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,SAAS,GAAG,IAAA,yCAAkC,EAAC,WAAW,CAAC,6BAA6B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QAC1G,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,IAAI,CAAC,WAAW,EAAE,4CAA4C,MAAM,CAAC,MAAM,GAAG,CAAC,CAAA;QACxF,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAA,oCAAuB,EAAC,WAAW,EAAE,SAAS,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,WAAW,EAAE,kFAAkF,CAAC,CAAA;IACvG,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,sDAAsD;AACtD,KAAK,UAAU,uBAAuB,CACpC,UAAmB,EACnB,sBAA8B,EAC9B,YAA2C,EAC3C,QAAuB;IAEvB,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,OAAO,CAAA;IAC9D,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,IAAI,CAAC,WAAW,EAAE,+BAA+B,CAAC,CAAA;IAC/E,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,IAAI,CAAC,WAAW,EAAE,yCAAyC,CAAC,CAAA;IAE/F,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC,CAAA;IACnC,IAAI,QAAoB,CAAA;IACxB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,YAAY,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,CACT,sBAAsB,EACtB,yBAAyB,GAAG,wBAAwB,SAAS,CAAC,KAAK,CAAC,EAAE,CACvE,CAAA;IACH,CAAC;IACD,IAAI,IAAA,4BAAa,EAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;QAC1C,IAAI,CAAC,WAAW,EAAE,yBAAyB,GAAG,wDAAwD,CAAC,CAAA;IACzG,CAAC;IAED,MAAM,OAAO,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAA;IACzD,IAAI,OAAO,KAAK,sBAAsB,EAAE,CAAC;QACvC,IAAI,CACF,WAAW,EACX,yBAAyB,GAAG,sBAAsB,OAAO,WAAW,sBAAsB,GAAG,CAC9F,CAAA;IACH,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,mBAAmB,CAChC,GAAW,EACX,YAA2C,EAC3C,QAAuB;;IAEvB,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,GAAG,EAAE,CAAC,CAAA;IAC1C,IAAI,UAAiD,CAAA;IACrD,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,IAAA,wBAAW,EAC5B,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,EACjC,2BAA2B,EAC3B,gCAAgC,CACjC,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,sBAAsB,EAAE,4BAA4B,GAAG,aAAa,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACrG,CAAC;IACD,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACvB,QAAQ,CAAC,WAAW,GAAG,SAAS,CAAA;QAChC,OAAM;IACR,CAAC;IACD,8FAA8F;IAC9F,4EAA4E;IAC5E,IAAI,UAAU,CAAC,SAAS,IAAI,4BAA4B,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACxF,IAAI,CACF,sBAAsB,EACtB,4BAA4B,GAAG,yBAAyB,MAAA,UAAU,CAAC,YAAY,mCAAI,UAAU,CAAC,SAAS,EAAE,CAC1G,CAAA;IACH,CAAC;IACD,QAAQ,CAAC,WAAW,GAAG,WAAW,CAAA;IAClC,IAAI,CACF,WAAW,EACX,4BAA4B,GAAG,uBAAuB,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACtH,CAAA;AACH,CAAC;AAED,gGAAgG;AAChG,KAAK,UAAU,sBAAsB,CACnC,GAAW,EACX,kBAA0B,EAC1B,YAA2C,EAC3C,QAAuB;IAEvB,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,GAAG,0BAA0B,kBAAkB,EAAE,CAAC,CAAA;IAChG,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,8BAAe,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAChG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,kCAAmB,CAAC;YAAE,MAAM,KAAK,CAAA;QACxD,IAAI,KAAK,CAAC,MAAM,KAAK,wCAAyB,CAAC,aAAa,EAAE,CAAC;YAC7D,QAAQ,CAAC,UAAU,GAAG,KAAK,CAAA;YAC3B,IAAI,CAAC,wBAAwB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,CAAC,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IAC7C,CAAC;IACD,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAA;AAC5B,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAmB;IAC9C,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CACxC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,4BAAmB,EAAC,IAAI,CAAC,CAAC,CACvF,CAAA;IACD,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,eAAe,EAAE,CAAA;AACjE,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAC;QACH,OAAO,IAAA,oCAAqB,EAAC,GAAG,CAAC,KAAK,SAAS,CAAA;IACjD,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,SAAS,+BAA+B,CAAC,QAAoB;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QAC1E,OAAO,IAAA,mBAAQ,EAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,6BAA6B,KAAK,QAAQ;YACjF,CAAC,CAAC,MAAM,CAAC,6BAA6B;YACtC,CAAC,CAAC,SAAS,CAAA;IACf,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC/D,CAAC;AAED,SAAS,IAAI,CAAC,OAAyB,EAAE,IAAY;IACnD,MAAM,IAAI,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;AACtC,CAAC"}

package/build/trust/types.d.ts

@@ -1,12 +1,14 @@
 export declare const TRUST_VERDICT_NAMES: readonly ["TRUSTED_AUTHORIZED", "TRUSTED_NOT_AUTHORIZED", "UNTRUSTED", "RESOLVER_UNAVAILABLE"];
 export type TrustVerdictName = (typeof TRUST_VERDICT_NAMES)[number];
-export declare const VERANA_TRUST_STATUSES: readonly ["TRUSTED", "PARTIAL", "UNTRUSTED"];
+export declare const VERANA_TRUST_STATUSES: readonly ["TRUSTED", "UNTRUSTED"];
 export type VeranaTrustStatus = (typeof VERANA_TRUST_STATUSES)[number];
 export type KeyBindingResult = 'bound' | 'unbound' | 'unresolvable';
 export interface TrustEvidence {
     did: string | null;
     trustStatus: VeranaTrustStatus | null;
     jsonSchemaCredentialId: string | null;
+    /** The `CredentialSchema` the session stored, which the `authorized` read names. */
+    credentialSchemaId: number | null;
     authorized: boolean | null;
     queries: string[];
     note?: string;

package/build/trust/types.js

@@ -7,5 +7,5 @@ exports.TRUST_VERDICT_NAMES = [
     'UNTRUSTED',
     'RESOLVER_UNAVAILABLE',
 ];
-exports.VERANA_TRUST_STATUSES = ['TRUSTED', 'PARTIAL', 'UNTRUSTED'];
+exports.VERANA_TRUST_STATUSES = ['TRUSTED', 'UNTRUSTED'];
 //# sourceMappingURL=types.js.map

package/build/trust/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/trust/types.ts"],"names":[],"mappings":";;;AAAa,QAAA,mBAAmB,GAAG;IACjC,oBAAoB;IACpB,wBAAwB;IACxB,WAAW;IACX,sBAAsB;CACd,CAAA;AAIG,QAAA,qBAAqB,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAU,CAAA"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/trust/types.ts"],"names":[],"mappings":";;;AAAa,QAAA,mBAAmB,GAAG;IACjC,oBAAoB;IACpB,wBAAwB;IACxB,WAAW;IACX,sBAAsB;CACd,CAAA;AAIG,QAAA,qBAAqB,GAAG,CAAC,SAAS,EAAE,WAAW,CAAU,CAAA"}

package/build/types.d.ts

@@ -1,7 +1,7 @@
 import type { OpenId4VcIssuerRequestMapper } from './sdk/setupOpenId4Vc';
 import type { Kms, X509Module } from '@credo-ts/core';
 import type { OpenId4VcModule } from '@credo-ts/openid4vc';
-import type { BaseAgentModules, VsAgent } from '@verana-labs/vs-agent-sdk';
+import type { BaseAgentModules, VerifiablePublicRegistries, VsAgent } from '@verana-labs/vs-agent-sdk';
 export type OpenId4VcVsAgentModules = BaseAgentModules & {
     openId4Vc: OpenId4VcModule<null, null>;
     x509: X509Module;
@@ -38,6 +38,7 @@ export interface OpenId4VcConfigurationFile {
 }
 export declare const OPENID4VC_OPTIONS = "OPENID4VC_OPTIONS";
 export declare const OPENID4VC_ISSUER_SINK = "OPENID4VC_ISSUER_SINK";
+export declare const OPENID4VC_DID_TRUST_RESOLVER = "OPENID4VC_DID_TRUST_RESOLVER";
 export interface OpenId4VcIssuerRuntime extends OpenId4VcIssuerRequestMapper {
     refreshCredentialConfigurations(updatedCredentialSchemaId?: number): Promise<void>;
 }
@@ -45,4 +46,6 @@ export type OpenId4VcIssuerSink = (service: OpenId4VcIssuerRuntime) => void;
 export interface OpenId4VcPluginOptions extends OpenId4VcConfigurationFile {
     publicApiBaseUrl: string;
     credentialConfigurations: OpenId4VcCredentialConfiguration[];
+    /** The VPR the verifier resolves a presented issuer against; absent when the agent has no indexer. */
+    verifiablePublicRegistries?: VerifiablePublicRegistries;
 }

package/build/types.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OPENID4VC_ISSUER_SINK = exports.OPENID4VC_OPTIONS = void 0;
+exports.OPENID4VC_DID_TRUST_RESOLVER = exports.OPENID4VC_ISSUER_SINK = exports.OPENID4VC_OPTIONS = void 0;
 exports.OPENID4VC_OPTIONS = 'OPENID4VC_OPTIONS';
 exports.OPENID4VC_ISSUER_SINK = 'OPENID4VC_ISSUER_SINK';
+exports.OPENID4VC_DID_TRUST_RESOLVER = 'OPENID4VC_DID_TRUST_RESOLVER';
 //# sourceMappingURL=types.js.map

package/build/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";;;AA6Ca,QAAA,iBAAiB,GAAG,mBAAmB,CAAA;AACvC,QAAA,qBAAqB,GAAG,uBAAuB,CAAA"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";;;AA6Ca,QAAA,iBAAiB,GAAG,mBAAmB,CAAA;AACvC,QAAA,qBAAqB,GAAG,uBAAuB,CAAA;AAC/C,QAAA,4BAA4B,GAAG,8BAA8B,CAAA"}

package/package.json

@@ -9,7 +9,7 @@
       "default": "./build/index.js"
     }
   },
-  "version": "2.0.0-dev.82",
+  "version": "2.0.0-dev.84",
   "repository": {
     "type": "git",
     "url": "https://github.com/verana-labs/vs-agent"
@@ -30,7 +30,7 @@
     "class-transformer": "0.5.1",
     "class-validator": "0.14.1",
     "express": "^4.18.1",
-    "@verana-labs/vs-agent-sdk": "2.0.0-dev.82"
+    "@verana-labs/vs-agent-sdk": "2.0.0-dev.84"
   },
   "peerDependencies": {
     "@credo-ts/core": "0.7.1-pr-2704-20260909134930"