@verana-labs/vs-agent-sdk 2.0.0-dev.7 → 2.0.0-dev.70

package/build/utils/didReadiness.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.waitUntilOwnDidIsPubliclyResolvable = waitUntilOwnDidIsPubliclyResolvable;
+// On a fresh deployment, the ingress route to this agent's own public endpoint
+// can lag a few seconds behind the process becoming ready (e.g. a k8s Service
+// has not finished propagating the new pod IP yet). A peer resolves our DID as
+// part of processing any message we send it, so we wait for our own DID
+// document to be publicly fetchable before reaching out to one.
+const OWN_DID_READY_TIMEOUT_MS = 60000;
+const OWN_DID_READY_POLL_INTERVAL_MS = 2000;
+/**
+ * Waits until this agent's own DID document is fetchable at its public endpoint, so a peer
+ * can resolve it as soon as we reach out. Checks the same file a peer's resolver would fetch:
+ * did.jsonl for did:webvh, did.json for did:web. Logs and returns if the deadline passes,
+ * rather than blocking the caller forever on a misconfigured deployment.
+ */
+async function waitUntilOwnDidIsPubliclyResolvable(agent, logger) {
+    const did = agent.did;
+    if (!did || !agent.publicApiBaseUrl)
+        return;
+    const documentFile = did.startsWith('did:web:') ? 'did.json' : 'did.jsonl';
+    const baseUrl = agent.publicApiBaseUrl.replace(/\/+$/, '');
+    // A path-based DID location serves its document at <base>/did.json(l), not under /.well-known
+    const hasPath = new URL(baseUrl).pathname !== '/';
+    const url = hasPath ? `${baseUrl}/${documentFile}` : `${baseUrl}/.well-known/${documentFile}`;
+    const deadline = Date.now() + OWN_DID_READY_TIMEOUT_MS;
+    let lastStatus = 'unreachable';
+    while (Date.now() < deadline) {
+        try {
+            const response = await fetch(url);
+            if (response.ok)
+                return;
+            lastStatus = response.status;
+        }
+        catch (error) {
+            lastStatus = error.message;
+        }
+        await new Promise(resolve => setTimeout(resolve, OWN_DID_READY_POLL_INTERVAL_MS));
+    }
+    logger.warn(`[DidReadiness] own DID document at ${url} was not publicly resolvable after ${OWN_DID_READY_TIMEOUT_MS}ms (last: ${lastStatus}); proceeding anyway`);
+}
+//# sourceMappingURL=didReadiness.js.map

package/build/utils/didReadiness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"didReadiness.js","sourceRoot":"","sources":["../../src/utils/didReadiness.ts"],"names":[],"mappings":";;AAkBA,kFAyBC;AAvCD,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,wEAAwE;AACxE,gEAAgE;AAChE,MAAM,wBAAwB,GAAG,KAAM,CAAA;AACvC,MAAM,8BAA8B,GAAG,IAAK,CAAA;AAE5C;;;;;GAKG;AACI,KAAK,UAAU,mCAAmC,CAAC,KAAc,EAAE,MAAc;IACtF,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;IACrB,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB;QAAE,OAAM;IAE3C,MAAM,YAAY,GAAG,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAA;IAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAC1D,8FAA8F;IAC9F,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAA;IACjD,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,gBAAgB,YAAY,EAAE,CAAA;IAE7F,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,wBAAwB,CAAA;IACtD,IAAI,UAAU,GAAoB,aAAa,CAAA;IAC/C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;YACjC,IAAI,QAAQ,CAAC,EAAE;gBAAE,OAAM;YACvB,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAA;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,UAAU,GAAI,KAAe,CAAC,OAAO,CAAA;QACvC,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC,CAAA;IACnF,CAAC;IACD,MAAM,CAAC,IAAI,CACT,sCAAsC,GAAG,sCAAsC,wBAAwB,aAAa,UAAU,sBAAsB,CACrJ,CAAA;AACH,CAAC"}

package/build/utils/ecsClaims.d.ts

@@ -0,0 +1,47 @@
+import type { Logger } from '@credo-ts/core';
+export interface EcsClaims {
+    localResources?: Record<string, string>;
+    org?: Record<string, string | undefined>;
+    persona?: Record<string, string | undefined>;
+    service?: Record<string, string | undefined>;
+}
+export declare const ECS_CLAIMS_VARIABLES: {
+    readonly org: {
+        readonly name: "ECS_CLAIMS_ORG_NAME";
+        readonly logoUri: "ECS_CLAIMS_ORG_LOGO_URI";
+        readonly registryId: "ECS_CLAIMS_ORG_REGISTRY_ID";
+        readonly registryUri: "ECS_CLAIMS_ORG_REGISTRY_URI";
+        readonly address: "ECS_CLAIMS_ORG_ADDRESS";
+        readonly countryCode: "ECS_CLAIMS_ORG_COUNTRY_CODE";
+        readonly legalJurisdiction: "ECS_CLAIMS_ORG_LEGAL_JURISDICTION";
+        readonly organizationKind: "ECS_CLAIMS_ORG_ORGANIZATION_KIND";
+        readonly lei: "ECS_CLAIMS_ORG_LEI";
+    };
+    readonly persona: {
+        readonly name: "ECS_CLAIMS_PERSONA_NAME";
+        readonly description: "ECS_CLAIMS_PERSONA_DESCRIPTION";
+        readonly descriptionFormat: "ECS_CLAIMS_PERSONA_DESCRIPTION_FORMAT";
+        readonly avatarUri: "ECS_CLAIMS_PERSONA_AVATAR_URI";
+        readonly controllerCountryCode: "ECS_CLAIMS_PERSONA_CONTROLLER_COUNTRY_CODE";
+        readonly controllerJurisdiction: "ECS_CLAIMS_PERSONA_CONTROLLER_JURISDICTION";
+    };
+    readonly service: {
+        readonly name: "ECS_CLAIMS_SERVICE_NAME";
+        readonly type: "ECS_CLAIMS_SERVICE_TYPE";
+        readonly description: "ECS_CLAIMS_SERVICE_DESCRIPTION";
+        readonly descriptionFormat: "ECS_CLAIMS_SERVICE_DESCRIPTION_FORMAT";
+        readonly logoUri: "ECS_CLAIMS_SERVICE_LOGO_URI";
+        readonly minimumAgeRequired: "ECS_CLAIMS_SERVICE_MINIMUM_AGE_REQUIRED";
+        readonly termsAndConditionsUri: "ECS_CLAIMS_SERVICE_TERMS_AND_CONDITIONS_URI";
+        readonly privacyPolicyUri: "ECS_CLAIMS_SERVICE_PRIVACY_POLICY_URI";
+    };
+};
+export declare function readEcsClaimsFromEnv(): Required<Pick<EcsClaims, 'org' | 'persona' | 'service'>>;
+export declare function digestOf(content: string): string;
+export declare function digestOfUri(uri: string, variable: string, logger?: Logger): Promise<string>;
+/**
+ * Compose the claims of one ECS credential from the configured variables, deriving `id` and
+ * every paired `*DigestSri`. Returns undefined when the operator configured no claim, so the
+ * caller can omit the `claims` field entirely.
+ */
+export declare function composeEcsClaims(claims: EcsClaims, schemaKey: string, logger?: Logger): Promise<Record<string, unknown> | undefined>;

package/build/utils/ecsClaims.js

@@ -0,0 +1,120 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ECS_CLAIMS_VARIABLES = void 0;
+exports.readEcsClaimsFromEnv = readEcsClaimsFromEnv;
+exports.digestOf = digestOf;
+exports.digestOfUri = digestOfUri;
+exports.composeEcsClaims = composeEcsClaims;
+const crypto_1 = require("crypto");
+const axios_1 = __importDefault(require("axios"));
+// the URI claim each derived digest claim is computed from
+const DIGEST_OF = {
+    logoDigestSri: 'logoUri',
+    avatarDigestSri: 'avatarUri',
+    termsAndConditionsDigestSri: 'termsAndConditionsUri',
+    privacyPolicyDigestSri: 'privacyPolicyUri',
+};
+// [VSA-VTI-CFG-ENV-ECS] variable of each claim the agent reads
+exports.ECS_CLAIMS_VARIABLES = {
+    org: {
+        name: 'ECS_CLAIMS_ORG_NAME',
+        logoUri: 'ECS_CLAIMS_ORG_LOGO_URI',
+        registryId: 'ECS_CLAIMS_ORG_REGISTRY_ID',
+        registryUri: 'ECS_CLAIMS_ORG_REGISTRY_URI',
+        address: 'ECS_CLAIMS_ORG_ADDRESS',
+        countryCode: 'ECS_CLAIMS_ORG_COUNTRY_CODE',
+        legalJurisdiction: 'ECS_CLAIMS_ORG_LEGAL_JURISDICTION',
+        organizationKind: 'ECS_CLAIMS_ORG_ORGANIZATION_KIND',
+        lei: 'ECS_CLAIMS_ORG_LEI',
+    },
+    persona: {
+        name: 'ECS_CLAIMS_PERSONA_NAME',
+        description: 'ECS_CLAIMS_PERSONA_DESCRIPTION',
+        descriptionFormat: 'ECS_CLAIMS_PERSONA_DESCRIPTION_FORMAT',
+        avatarUri: 'ECS_CLAIMS_PERSONA_AVATAR_URI',
+        controllerCountryCode: 'ECS_CLAIMS_PERSONA_CONTROLLER_COUNTRY_CODE',
+        controllerJurisdiction: 'ECS_CLAIMS_PERSONA_CONTROLLER_JURISDICTION',
+    },
+    service: {
+        name: 'ECS_CLAIMS_SERVICE_NAME',
+        type: 'ECS_CLAIMS_SERVICE_TYPE',
+        description: 'ECS_CLAIMS_SERVICE_DESCRIPTION',
+        descriptionFormat: 'ECS_CLAIMS_SERVICE_DESCRIPTION_FORMAT',
+        logoUri: 'ECS_CLAIMS_SERVICE_LOGO_URI',
+        minimumAgeRequired: 'ECS_CLAIMS_SERVICE_MINIMUM_AGE_REQUIRED',
+        termsAndConditionsUri: 'ECS_CLAIMS_SERVICE_TERMS_AND_CONDITIONS_URI',
+        privacyPolicyUri: 'ECS_CLAIMS_SERVICE_PRIVACY_POLICY_URI',
+    },
+};
+function readEcsClaimsFromEnv() {
+    const read = (variables) => Object.fromEntries(Object.entries(variables).map(([claim, name]) => { var _a; return [claim, ((_a = process.env[name]) === null || _a === void 0 ? void 0 : _a.trim()) || undefined]; }));
+    return {
+        org: read(exports.ECS_CLAIMS_VARIABLES.org),
+        persona: read(exports.ECS_CLAIMS_VARIABLES.persona),
+        service: read(exports.ECS_CLAIMS_VARIABLES.service),
+    };
+}
+const DIGEST_TIMEOUT_MS = 5000;
+const DIGEST_ATTEMPTS = 4;
+const DIGEST_BASE_DELAY_MS = 500;
+const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
+// Generate a SHA-384 digest for the given content
+function digestOf(content) {
+    return `sha384-${(0, crypto_1.createHash)('sha384').update(content).digest('base64')}`;
+}
+async function digestOfUri(uri, variable, logger) {
+    let lastError;
+    for (let attempt = 1; attempt <= DIGEST_ATTEMPTS; attempt++) {
+        try {
+            const response = await axios_1.default.get(uri, { responseType: 'arraybuffer', timeout: DIGEST_TIMEOUT_MS });
+            return `sha384-${(0, crypto_1.createHash)('sha384').update(Buffer.from(response.data)).digest('base64')}`;
+        }
+        catch (error) {
+            lastError = error;
+            if (attempt < DIGEST_ATTEMPTS)
+                await sleep(DIGEST_BASE_DELAY_MS * 2 ** (attempt - 1));
+        }
+    }
+    const message = `cannot compute the digest of ${variable} (${uri}): ${lastError === null || lastError === void 0 ? void 0 : lastError.message}`;
+    logger === null || logger === void 0 ? void 0 : logger.error(`[ecs-claims] ${message}`);
+    throw new Error(message);
+}
+const GROUP_OF = {
+    'ecs-service': 'service',
+    'ecs-persona': 'persona',
+    'ecs-org': 'org',
+};
+const groupOf = (claims, schemaKey) => {
+    const group = GROUP_OF[schemaKey];
+    return group ? claims[group] : undefined;
+};
+/**
+ * Compose the claims of one ECS credential from the configured variables, deriving `id` and
+ * every paired `*DigestSri`. Returns undefined when the operator configured no claim, so the
+ * caller can omit the `claims` field entirely.
+ */
+async function composeEcsClaims(claims, schemaKey, logger) {
+    var _a;
+    const configured = groupOf(claims, schemaKey);
+    const set = Object.entries(configured !== null && configured !== void 0 ? configured : {}).filter(([, v]) => v !== undefined && v !== '');
+    if (set.length === 0)
+        return undefined;
+    const composed = {};
+    for (const [claim, value] of set) {
+        composed[claim] = claim === 'minimumAgeRequired' ? Number(value) : value;
+    }
+    for (const [digestClaim, uriClaim] of Object.entries(DIGEST_OF)) {
+        const uri = composed[uriClaim];
+        if (typeof uri !== 'string')
+            continue;
+        const group = GROUP_OF[schemaKey];
+        const variable = (group && exports.ECS_CLAIMS_VARIABLES[group][uriClaim]) || uriClaim;
+        const local = (_a = claims.localResources) === null || _a === void 0 ? void 0 : _a[uri];
+        composed[digestClaim] = local ? digestOf(local) : await digestOfUri(uri, variable, logger);
+    }
+    return composed;
+}
+//# sourceMappingURL=ecsClaims.js.map

package/build/utils/ecsClaims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecsClaims.js","sourceRoot":"","sources":["../../src/utils/ecsClaims.ts"],"names":[],"mappings":";;;;;;AAyDA,oDAUC;AASD,4BAEC;AAED,kCAcC;AAkBD,4CAsBC;AApID,mCAAmC;AAEnC,kDAAyB;AAYzB,2DAA2D;AAC3D,MAAM,SAAS,GAA2B;IACxC,aAAa,EAAE,SAAS;IACxB,eAAe,EAAE,WAAW;IAC5B,2BAA2B,EAAE,uBAAuB;IACpD,sBAAsB,EAAE,kBAAkB;CAC3C,CAAA;AAED,+DAA+D;AAClD,QAAA,oBAAoB,GAAG;IAClC,GAAG,EAAE;QACH,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,yBAAyB;QAClC,UAAU,EAAE,4BAA4B;QACxC,WAAW,EAAE,6BAA6B;QAC1C,OAAO,EAAE,wBAAwB;QACjC,WAAW,EAAE,6BAA6B;QAC1C,iBAAiB,EAAE,mCAAmC;QACtD,gBAAgB,EAAE,kCAAkC;QACpD,GAAG,EAAE,oBAAoB;KAC1B;IACD,OAAO,EAAE;QACP,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EAAE,gCAAgC;QAC7C,iBAAiB,EAAE,uCAAuC;QAC1D,SAAS,EAAE,+BAA+B;QAC1C,qBAAqB,EAAE,4CAA4C;QACnE,sBAAsB,EAAE,4CAA4C;KACrE;IACD,OAAO,EAAE;QACP,IAAI,EAAE,yBAAyB;QAC/B,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EAAE,gCAAgC;QAC7C,iBAAiB,EAAE,uCAAuC;QAC1D,OAAO,EAAE,6BAA6B;QACtC,kBAAkB,EAAE,yCAAyC;QAC7D,qBAAqB,EAAE,6CAA6C;QACpE,gBAAgB,EAAE,uCAAuC;KAC1D;CACO,CAAA;AAEV,SAAgB,oBAAoB;IAClC,MAAM,IAAI,GAAG,CAAC,SAAiC,EAAsC,EAAE,CACrF,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,WAAC,OAAA,CAAC,KAAK,EAAE,CAAA,MAAA,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,0CAAE,IAAI,EAAE,KAAI,SAAS,CAAC,CAAA,EAAA,CAAC,CAClG,CAAA;IACH,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,4BAAoB,CAAC,GAAG,CAAC;QACnC,OAAO,EAAE,IAAI,CAAC,4BAAoB,CAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,IAAI,CAAC,4BAAoB,CAAC,OAAO,CAAC;KAC5C,CAAA;AACH,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,CAAA;AAC9B,MAAM,eAAe,GAAG,CAAC,CAAA;AACzB,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEhC,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;AAE7E,kDAAkD;AAClD,SAAgB,QAAQ,CAAC,OAAe;IACtC,OAAO,UAAU,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAA;AAC1E,CAAC;AAEM,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,QAAgB,EAAE,MAAe;IAC9E,IAAI,SAA4B,CAAA;IAChC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,eAAe,EAAE,OAAO,EAAE,EAAE,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,eAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAA;YAClG,OAAO,UAAU,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAA;QAC7F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAc,CAAA;YAC1B,IAAI,OAAO,GAAG,eAAe;gBAAE,MAAM,KAAK,CAAC,oBAAoB,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAA;QACvF,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,gCAAgC,QAAQ,KAAK,GAAG,MAAM,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,OAAO,EAAE,CAAA;IAC1F,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,KAAK,CAAC,gBAAgB,OAAO,EAAE,CAAC,CAAA;IACxC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,QAAQ,GAAkD;IAC9D,aAAa,EAAE,SAAS;IACxB,aAAa,EAAE,SAAS;IACxB,SAAS,EAAE,KAAK;CACjB,CAAA;AAED,MAAM,OAAO,GAAG,CAAC,MAAiB,EAAE,SAAiB,EAAE,EAAE;IACvD,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAA;IACjC,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAC1C,CAAC,CAAA;AAED;;;;GAIG;AACI,KAAK,UAAU,gBAAgB,CACpC,MAAiB,EACjB,SAAiB,EACjB,MAAe;;IAEf,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,aAAV,UAAU,cAAV,UAAU,GAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;IAC3F,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAEtC,MAAM,QAAQ,GAA4B,EAAE,CAAA;IAC5C,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC;QACjC,QAAQ,CAAC,KAAK,CAAC,GAAG,KAAK,KAAK,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC1E,CAAC;IACD,KAAK,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAQ;QACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAA;QACjC,MAAM,QAAQ,GAAG,CAAC,KAAK,IAAK,4BAAoB,CAAC,KAAK,CAA4B,CAAC,QAAQ,CAAC,CAAC,IAAI,QAAQ,CAAA;QACzG,MAAM,KAAK,GAAG,MAAA,MAAM,CAAC,cAAc,0CAAG,GAAG,CAAC,CAAA;QAC1C,QAAQ,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC5F,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/build/utils/ecsService.d.ts

@@ -0,0 +1,8 @@
+import type { VsAgent } from '../agent/VsAgent';
+export interface EcsServiceClaims {
+    name?: string;
+    description?: string;
+    logoUri?: string;
+}
+export declare function ecsServiceClaims(agent: VsAgent): Promise<EcsServiceClaims | undefined>;
+export declare function agentDisplayName(agent: VsAgent): Promise<string>;

package/build/utils/ecsService.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ecsServiceClaims = ecsServiceClaims;
+exports.agentDisplayName = agentDisplayName;
+const vs_agent_model_1 = require("@verana-labs/vs-agent-model");
+const setupSelfTr_1 = require("./setupSelfTr");
+// Read at call time, not at startup: the credential is published asynchronously after boot
+async function ecsServiceClaims(agent) {
+    var _a, _b;
+    if (!agent.did)
+        return undefined;
+    const [didRecord] = await agent.dids.getCreatedDids({ did: agent.did });
+    const metadata = didRecord === null || didRecord === void 0 ? void 0 : didRecord.metadata.get('_vt/vtc');
+    if (!metadata)
+        return undefined;
+    const serviceId = `${agent.did}#${(0, setupSelfTr_1.linkedVpFragment)(vs_agent_model_1.ECS.SERVICE)}`;
+    return (_b = (_a = Object.values(metadata).find(entry => entry.didDocumentServiceId === serviceId)) === null || _a === void 0 ? void 0 : _a.credential) === null || _b === void 0 ? void 0 : _b.credentialSubject;
+}
+async function agentDisplayName(agent) {
+    var _a, _b;
+    return (_b = (_a = (await ecsServiceClaims(agent))) === null || _a === void 0 ? void 0 : _a.name) !== null && _b !== void 0 ? _b : new URL(agent.publicApiBaseUrl).host;
+}
+//# sourceMappingURL=ecsService.js.map

package/build/utils/ecsService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecsService.js","sourceRoot":"","sources":["../../src/utils/ecsService.ts"],"names":[],"mappings":";;AAkBA,4CAUC;AAED,4CAEC;AA9BD,gEAAiD;AAEjD,+CAAgD;AAahD,2FAA2F;AACpF,KAAK,UAAU,gBAAgB,CAAC,KAAc;;IACnD,IAAI,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,SAAS,CAAA;IAEhC,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;IACvE,MAAM,QAAQ,GAAG,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAyC,CAAA;IAC3F,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAA;IAE/B,MAAM,SAAS,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAA,8BAAgB,EAAC,oBAAG,CAAC,OAAO,CAAC,EAAE,CAAA;IACjE,OAAO,MAAA,MAAA,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,oBAAoB,KAAK,SAAS,CAAC,0CAAE,UAAU,0CAC9F,iBAAiD,CAAA;AACvD,CAAC;AAEM,KAAK,UAAU,gBAAgB,CAAC,KAAc;;IACnD,OAAO,MAAA,MAAA,CAAC,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC,0CAAE,IAAI,mCAAI,IAAI,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAA;AACtF,CAAC"}

package/build/utils/index.d.ts

@@ -1,5 +1,9 @@
 export * from './agent';
 export * from './data';
+export * from './ecsClaims';
+export * from './ecsService';
 export * from './setupSelfTr';
 export * from './trustCredentialStore';
 export * from './util';
+export * from './vcdm2';
+export * from './vtjscResolver';

package/build/utils/index.js

@@ -16,7 +16,11 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./agent"), exports);
 __exportStar(require("./data"), exports);
+__exportStar(require("./ecsClaims"), exports);
+__exportStar(require("./ecsService"), exports);
 __exportStar(require("./setupSelfTr"), exports);
 __exportStar(require("./trustCredentialStore"), exports);
 __exportStar(require("./util"), exports);
+__exportStar(require("./vcdm2"), exports);
+__exportStar(require("./vtjscResolver"), exports);
 //# sourceMappingURL=index.js.map

package/build/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAuB;AACvB,yCAAsB;AACtB,gDAA6B;AAC7B,yDAAsC;AACtC,yCAAsB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAuB;AACvB,yCAAsB;AACtB,8CAA2B;AAC3B,+CAA4B;AAC5B,gDAA6B;AAC7B,yDAAsC;AACtC,yCAAsB;AACtB,0CAAuB;AACvB,kDAA+B"}

package/build/utils/selfIssuedEcsCredential.d.ts

@@ -0,0 +1,8 @@
+import { W3cCredentialSchema } from '@credo-ts/core';
+import { VsAgent } from '../agent/VsAgent';
+import { EcsClaims } from './ecsClaims';
+/** The linked presentation as published: VC Data Model 2.0 JSON secured with Data Integrity proofs */
+export type SelfIssuedEcsPresentation = Record<string, unknown> & {
+    verifiableCredential: Record<string, unknown>[];
+};
+export declare function publishSelfIssuedEcsPresentation(agent: VsAgent, id: string, ecsSchemas: Record<string, string>, schemaKey: string, type: string[], credentialSchema: W3cCredentialSchema, ecsClaims: EcsClaims, beforePublish?: (verifiablePresentation: SelfIssuedEcsPresentation) => Promise<void>): Promise<SelfIssuedEcsPresentation>;

package/build/utils/selfIssuedEcsCredential.js

@@ -0,0 +1,151 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.publishSelfIssuedEcsPresentation = publishSelfIssuedEcsPresentation;
+const core_1 = require("@credo-ts/core");
+const setupSelfTr_1 = require("./setupSelfTr");
+const vcdm2_1 = require("./vcdm2");
+const buildIntegrityData = (data) => {
+    return (0, setupSelfTr_1.generateDigestSRI)(JSON.stringify((0, setupSelfTr_1.sortKeysDeep)(data)));
+};
+function storedCredentialIsCurrent(credential, credentialSchemaId, did, didRecord) {
+    var _a, _b, _c;
+    if (!credential)
+        return false;
+    // a credential published by an older agent as data model 1.1 is rebuilt on upgrade
+    if (!(0, vcdm2_1.isDataIntegrityVcdm2Credential)(credential))
+        return false;
+    const issuer = typeof credential.issuer === 'string' ? credential.issuer : (_a = credential.issuer) === null || _a === void 0 ? void 0 : _a.id;
+    if (issuer !== did)
+        return false;
+    const schema = Array.isArray(credential.credentialSchema)
+        ? credential.credentialSchema[0]
+        : credential.credentialSchema;
+    if ((schema === null || schema === void 0 ? void 0 : schema.id) !== credentialSchemaId)
+        return false;
+    const proofs = !credential.proof
+        ? []
+        : Array.isArray(credential.proof)
+            ? credential.proof
+            : [credential.proof];
+    if (proofs.length === 0)
+        return false;
+    const assertionMethods = new Set(((_c = (_b = didRecord.didDocument) === null || _b === void 0 ? void 0 : _b.assertionMethod) !== null && _c !== void 0 ? _c : []).map(entry => typeof entry === 'string' ? entry : entry.id));
+    return proofs.every(proof => !!proof.verificationMethod && assertionMethods.has(proof.verificationMethod));
+}
+/**
+ * Issues the ECS credential to the agent itself and wraps it in the linked presentation, both
+ * secured with a DataIntegrityProof by the DID Document assertion key.
+ */
+async function signSelfIssuedEcsCredential(agent, didRecord, presentationId, type, claims, credentialSchema) {
+    const unsignedCredential = (0, setupSelfTr_1.createCredential)({
+        id: agent.did,
+        type,
+        issuer: agent.did,
+        credentialSubject: Object.assign(Object.assign({}, claims), { id: agent.did }),
+        credentialSchema: { id: credentialSchema.id, type: credentialSchema.type },
+    });
+    const verificationMethodId = (0, setupSelfTr_1.getVerificationMethodId)(agent.config.logger, didRecord);
+    const signedCredential = await (0, setupSelfTr_1.signerW3c)(agent, unsignedCredential, verificationMethodId);
+    const presentation = (0, setupSelfTr_1.createPresentation)({
+        id: presentationId,
+        holder: agent.did,
+        verifiableCredential: [signedCredential],
+    });
+    const signedPresentation = await (0, setupSelfTr_1.signerW3c)(agent, presentation, verificationMethodId);
+    return signedPresentation.securedPresentation;
+}
+async function publishSelfIssuedEcsPresentation(agent, id, ecsSchemas, schemaKey, type, credentialSchema, ecsClaims, beforePublish) {
+    var _a, _b, _c, _d, _e, _f, _g;
+    if (!agent.did)
+        throw Error('The DID must be set up');
+    const [didRecord] = await agent.dids.getCreatedDids({ did: agent.did });
+    const didDocument = didRecord.didDocument;
+    if (!didDocument)
+        throw Error('The DID Document must be set up');
+    const claims = await (0, setupSelfTr_1.getClaims)(agent.config.logger, ecsSchemas, { id: agent.did }, schemaKey, ecsClaims);
+    const didDocumentServiceId = `${agent.did}#${(0, setupSelfTr_1.linkedVpFragment)(schemaKey)}`;
+    const integrityData = buildIntegrityData({ id, type, credentialSchema, claims });
+    const record = (_a = didRecord.metadata.get('_vt/vtc')) !== null && _a !== void 0 ? _a : {};
+    const metadata = record[credentialSchema.id];
+    const superseded = Object.entries(record).some(([storedSchemaId, entry]) => {
+        var _a;
+        return storedSchemaId !== credentialSchema.id &&
+            ((_a = entry === null || entry === void 0 ? void 0 : entry.verifiablePresentation) === null || _a === void 0 ? void 0 : _a.id) === id &&
+            (entry === null || entry === void 0 ? void 0 : entry.attached) !== false;
+    });
+    const attached = ((_b = metadata === null || metadata === void 0 ? void 0 : metadata.attached) !== null && _b !== void 0 ? _b : true) && !superseded;
+    if ((metadata === null || metadata === void 0 ? void 0 : metadata.integrityData) === integrityData &&
+        storedCredentialIsCurrent(metadata === null || metadata === void 0 ? void 0 : metadata.credential, credentialSchema.id, agent.did, didRecord)) {
+        // the presentation is already public, so a failed beforePublish step still needs a retry here
+        if (attached)
+            await (beforePublish === null || beforePublish === void 0 ? void 0 : beforePublish(metadata.verifiablePresentation));
+        return metadata.verifiablePresentation;
+    }
+    const verifiablePresentation = await signSelfIssuedEcsCredential(agent, didRecord, id, type, claims, credentialSchema);
+    // nothing is persisted yet, so a failure here leaves no public presentation behind
+    if (attached)
+        await (beforePublish === null || beforePublish === void 0 ? void 0 : beforePublish(verifiablePresentation));
+    // Update linked VP when the presentation has changed. Match by fragment or by the file the
+    // endpoint ends with: a `contains` test also matches the host, so an agent at a host such as
+    // ecs-org-issuer.example rewrote its DIDComm endpoint and every other ECS linked VP onto this one.
+    const linkedVpFile = `/${schemaKey}-vtc-vp.json`;
+    if (attached)
+        didDocument.service = (_c = didDocument.service) === null || _c === void 0 ? void 0 : _c.map(s => {
+            if (typeof s.serviceEndpoint !== 'string')
+                return s;
+            if (s.type !== 'LinkedVerifiablePresentation' || s.id === `${agent.did}#whois`)
+                return s;
+            if (s.id !== didDocumentServiceId && !s.serviceEndpoint.endsWith(linkedVpFile))
+                return s;
+            s.id = didDocumentServiceId;
+            s.serviceEndpoint = id;
+            return s;
+        });
+    // Resolvers only discover the credential through the [VT-CRED-W3C-LINKED-VP] fragment, and
+    // #whois does not match it. The rename above only covers documents that already carry the
+    // service, so publish it here when nothing declared it yet.
+    let didDocumentChanged = false;
+    if (attached && !((_d = didDocument.service) === null || _d === void 0 ? void 0 : _d.some(s => s.id === didDocumentServiceId))) {
+        didDocument.service = [
+            ...((_e = didDocument.service) !== null && _e !== void 0 ? _e : []),
+            new core_1.DidDocumentService({
+                id: didDocumentServiceId,
+                serviceEndpoint: id,
+                type: 'LinkedVerifiablePresentation',
+            }),
+        ];
+        didDocumentChanged = true;
+    }
+    const whoisId = `${agent.did}#whois`;
+    if (attached && schemaKey === 'ecs-service') {
+        const whois = (_f = didDocument.service) === null || _f === void 0 ? void 0 : _f.find(s => s.id === whoisId);
+        if (whois) {
+            if (whois.serviceEndpoint !== id) {
+                whois.serviceEndpoint = id;
+                didDocumentChanged = true;
+            }
+        }
+        else {
+            didDocument.service = [
+                ...((_g = didDocument.service) !== null && _g !== void 0 ? _g : []),
+                new core_1.DidDocumentService({ id: whoisId, serviceEndpoint: id, type: 'LinkedVerifiablePresentation' }),
+            ];
+            didDocumentChanged = true;
+        }
+    }
+    const [credential] = verifiablePresentation.verifiableCredential;
+    record[credentialSchema.id] = {
+        credential,
+        verifiablePresentation,
+        didDocumentServiceId,
+        integrityData,
+        attached,
+    };
+    didRecord.metadata.set('_vt/vtc', record);
+    await agent.context.dependencyManager.resolve(core_1.DidRepository).update(agent.context, didRecord);
+    if (didDocumentChanged) {
+        await agent.dids.update({ did: didRecord.did, didDocument });
+    }
+    return verifiablePresentation;
+}
+//# sourceMappingURL=selfIssuedEcsCredential.js.map

package/build/utils/selfIssuedEcsCredential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"selfIssuedEcsCredential.js","sourceRoot":"","sources":["../../src/utils/selfIssuedEcsCredential.ts"],"names":[],"mappings":";;AA8FA,4EAuGC;AArMD,yCAAkG;AAIlG,+CASsB;AACtB,mCAAwD;AAExD,MAAM,kBAAkB,GAAG,CAAC,IAA6B,EAAE,EAAE;IAC3D,OAAO,IAAA,+BAAiB,EAAC,IAAI,CAAC,SAAS,CAAC,IAAA,0BAAY,EAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AAC9D,CAAC,CAAA;AAQD,SAAS,yBAAyB,CAChC,UAAkD,EAClD,kBAA0B,EAC1B,GAAW,EACX,SAAoB;;IAEpB,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IAC7B,mFAAmF;IACnF,IAAI,CAAC,IAAA,sCAA8B,EAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAA;IAE7D,MAAM,MAAM,GAAG,OAAO,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,MAAA,UAAU,CAAC,MAAM,0CAAE,EAAE,CAAA;IAChG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAA;IAEhC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC;QACvD,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAChC,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAA;IAC/B,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,EAAE,MAAK,kBAAkB;QAAE,OAAO,KAAK,CAAA;IAEnD,MAAM,MAAM,GAAG,CAAC,UAAU,CAAC,KAAK;QAC9B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;YAC/B,CAAC,CAAC,UAAU,CAAC,KAAK;YAClB,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IACxB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAErC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,CAAC,MAAA,MAAA,SAAS,CAAC,WAAW,0CAAE,eAAe,mCAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CACzD,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAC7C,CACF,CAAA;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAA;AAC5G,CAAC;AAOD;;;GAGG;AACH,KAAK,UAAU,2BAA2B,CACxC,KAAc,EACd,SAAoB,EACpB,cAAsB,EACtB,IAAc,EACd,MAA+B,EAC/B,gBAAqC;IAErC,MAAM,kBAAkB,GAAG,IAAA,8BAAgB,EAAC;QAC1C,EAAE,EAAE,KAAK,CAAC,GAAG;QACb,IAAI;QACJ,MAAM,EAAE,KAAK,CAAC,GAAG;QACjB,iBAAiB,kCAAO,MAAM,KAAE,EAAE,EAAE,KAAK,CAAC,GAAG,GAAE;QAC/C,gBAAgB,EAAE,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,EAAE;KAC3E,CAAC,CAAA;IACF,MAAM,oBAAoB,GAAG,IAAA,qCAAuB,EAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACpF,MAAM,gBAAgB,GAAG,MAAM,IAAA,uBAAS,EAAC,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,CAAC,CAAA;IACzF,MAAM,YAAY,GAAG,IAAA,gCAAkB,EAAC;QACtC,EAAE,EAAE,cAAc;QAClB,MAAM,EAAE,KAAK,CAAC,GAAG;QACjB,oBAAoB,EAAE,CAAC,gBAAgB,CAAC;KACzC,CAAC,CAAA;IACF,MAAM,kBAAkB,GAAG,MAAM,IAAA,uBAAS,EAAC,KAAK,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAA;IACrF,OAAO,kBAAkB,CAAC,mBAA2D,CAAA;AACvF,CAAC;AAEM,KAAK,UAAU,gCAAgC,CACpD,KAAc,EACd,EAAU,EACV,UAAkC,EAClC,SAAiB,EACjB,IAAc,EACd,gBAAqC,EACrC,SAAoB,EACpB,aAAoF;;IAEpF,IAAI,CAAC,KAAK,CAAC,GAAG;QAAE,MAAM,KAAK,CAAC,wBAAwB,CAAC,CAAA;IACrD,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;IACvE,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAA;IACzC,IAAI,CAAC,WAAW;QAAE,MAAM,KAAK,CAAC,iCAAiC,CAAC,CAAA;IAChE,MAAM,MAAM,GAAG,MAAM,IAAA,uBAAS,EAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;IACxG,MAAM,oBAAoB,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAA,8BAAgB,EAAC,SAAS,CAAC,EAAE,CAAA;IAC1E,MAAM,aAAa,GAAG,kBAAkB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAAA;IAChF,MAAM,MAAM,GAAG,MAAA,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,mCAAI,EAAE,CAAA;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAA;IAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAC5C,CAAC,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,EAAE;;QAC1B,OAAA,cAAc,KAAK,gBAAgB,CAAC,EAAE;YACtC,CAAA,MAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,sBAAsB,0CAAE,EAAE,MAAK,EAAE;YACxC,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,QAAQ,MAAK,KAAK,CAAA;KAAA,CAC5B,CAAA;IACD,MAAM,QAAQ,GAAG,CAAC,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,QAAQ,mCAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAA;IAC5D,IACE,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,aAAa,MAAK,aAAa;QACzC,yBAAyB,CAAC,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,UAAU,EAAE,gBAAgB,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,EAC1F,CAAC;QACD,8FAA8F;QAC9F,IAAI,QAAQ;YAAE,MAAM,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAG,QAAQ,CAAC,sBAAsB,CAAC,CAAA,CAAA;QACpE,OAAO,QAAQ,CAAC,sBAAsB,CAAA;IACxC,CAAC;IAED,MAAM,sBAAsB,GAAG,MAAM,2BAA2B,CAC9D,KAAK,EACL,SAAS,EACT,EAAE,EACF,IAAI,EACJ,MAAiC,EACjC,gBAAgB,CACjB,CAAA;IACD,mFAAmF;IACnF,IAAI,QAAQ;QAAE,MAAM,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAG,sBAAsB,CAAC,CAAA,CAAA;IAC3D,2FAA2F;IAC3F,6FAA6F;IAC7F,mGAAmG;IACnG,MAAM,YAAY,GAAG,IAAI,SAAS,cAAc,CAAA;IAChD,IAAI,QAAQ;QACV,WAAW,CAAC,OAAO,GAAG,MAAA,WAAW,CAAC,OAAO,0CAAE,GAAG,CAAC,CAAC,CAAC,EAAE;YACjD,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ;gBAAE,OAAO,CAAC,CAAA;YACnD,IAAI,CAAC,CAAC,IAAI,KAAK,8BAA8B,IAAI,CAAC,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,GAAG,QAAQ;gBAAE,OAAO,CAAC,CAAA;YACxF,IAAI,CAAC,CAAC,EAAE,KAAK,oBAAoB,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAAE,OAAO,CAAC,CAAA;YACxF,CAAC,CAAC,EAAE,GAAG,oBAAoB,CAAA;YAC3B,CAAC,CAAC,eAAe,GAAG,EAAE,CAAA;YACtB,OAAO,CAAC,CAAA;QACV,CAAC,CAAC,CAAA;IACJ,2FAA2F;IAC3F,0FAA0F;IAC1F,4DAA4D;IAC5D,IAAI,kBAAkB,GAAG,KAAK,CAAA;IAC9B,IAAI,QAAQ,IAAI,CAAC,CAAA,MAAA,WAAW,CAAC,OAAO,0CAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,oBAAoB,CAAC,CAAA,EAAE,CAAC;QAC/E,WAAW,CAAC,OAAO,GAAG;YACpB,GAAG,CAAC,MAAA,WAAW,CAAC,OAAO,mCAAI,EAAE,CAAC;YAC9B,IAAI,yBAAkB,CAAC;gBACrB,EAAE,EAAE,oBAAoB;gBACxB,eAAe,EAAE,EAAE;gBACnB,IAAI,EAAE,8BAA8B;aACrC,CAAC;SACH,CAAA;QACD,kBAAkB,GAAG,IAAI,CAAA;IAC3B,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,GAAG,QAAQ,CAAA;IACpC,IAAI,QAAQ,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAA,WAAW,CAAC,OAAO,0CAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAAA;QAC9D,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,KAAK,CAAC,eAAe,KAAK,EAAE,EAAE,CAAC;gBACjC,KAAK,CAAC,eAAe,GAAG,EAAE,CAAA;gBAC1B,kBAAkB,GAAG,IAAI,CAAA;YAC3B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,OAAO,GAAG;gBACpB,GAAG,CAAC,MAAA,WAAW,CAAC,OAAO,mCAAI,EAAE,CAAC;gBAC9B,IAAI,yBAAkB,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC;aACnG,CAAA;YACD,kBAAkB,GAAG,IAAI,CAAA;QAC3B,CAAC;IACH,CAAC;IACD,MAAM,CAAC,UAAU,CAAC,GAAG,sBAAsB,CAAC,oBAAoB,CAAA;IAChE,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,GAAG;QAC5B,UAAU;QACV,sBAAsB;QACtB,oBAAoB;QACpB,aAAa;QACb,QAAQ;KACT,CAAA;IACD,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IACzC,MAAM,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,oBAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IAC7F,IAAI,kBAAkB,EAAE,CAAC;QACvB,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC,CAAA;IAC9D,CAAC;IACD,OAAO,sBAAsB,CAAA;AAC/B,CAAC"}

package/build/utils/setupSelfTr.d.ts

@@ -1,74 +1,42 @@
-import { W3cCredential, W3cPresentation, W3cCredentialSchema, W3cCredentialSubject, W3cJsonLdVerifiableCredential, W3cJsonLdVerifiablePresentation, W3cCredentialOptions, DidRecord, W3cPresentationOptions, Logger } from '@credo-ts/core';
+import { DidRecord, Logger, W3cCredentialSchema, W3cCredentialSubject, W3cV2Credential, W3cV2CredentialOptions, W3cV2DataIntegrityVerifiableCredential, W3cV2DataIntegrityVerifiablePresentation, W3cV2Presentation, W3cV2PresentationOptions } from '@credo-ts/core';
 import { AnySchemaObject } from 'ajv/dist/2020';
-import { VsAgent } from '../agent/VsAgent';
-export interface SelfTrDefaults {
-    agentLabel: string;
-    serviceLogoUri: string;
-    serviceLogoDigestSri?: string;
-    serviceType: string;
-    serviceDescription: string;
-    serviceMinimumAgeRequired: number;
-    serviceTermsAndConditions: string;
-    serviceTermsAndConditionsDigestSri?: string;
-    servicePrivacyPolicy: string;
-    servicePrivacyPolicyDigestSri?: string;
-    orgRegistryId: string;
-    orgRegistryUri: string;
-    orgAddress: string;
-    orgOrganizationKind: string;
-    orgCountryCode: string;
-}
-export declare const presentations: {
-    name: string;
-    schemaUrl: string;
-}[];
-export declare const credentials: {
-    name: string;
-    credUrl: string;
-    schemaUrl: string;
-}[];
+import type { VsAgent } from '../agent/VsAgent';
+import { EcsClaims } from './ecsClaims';
 export declare const createJsonSchema: W3cCredentialSchema;
 export declare const createJsonSubjectRef: (id: string) => W3cCredentialSubject;
+export declare const linkedVpSchemaId: (schemaKey: string) => string;
 export declare const linkedVpFragment: (schemaKey: string) => string;
-export declare const mapToSelfTr: (url: string, publicApiBaseUrl: string) => string;
-export declare const setupSelfTr: ({ agent, publicApiBaseUrl, defaults, }: {
-    agent: VsAgent;
-    publicApiBaseUrl: string;
-    defaults: SelfTrDefaults;
-}) => Promise<void>;
-export declare function createCredential(options: Partial<W3cCredentialOptions>): W3cCredential;
+export declare const sortKeysDeep: (value: unknown) => unknown;
+/**
+ * Builds an unsigned credential: a VC Data Model 2.0 credential, as
+ * [VT-CRED-W3C] and [VT-JSON-SCHEMA-CRED-W3C] require the `https://www.w3.org/ns/credentials/v2`
+ * context, valid from now for ten years unless told otherwise.
+ */
+export declare function createCredential(options: Partial<W3cV2CredentialOptions>): W3cV2Credential;
 /**
- * Signs a W3C Verifiable Credential or Presentation using the provided agent and verification method.
+ * The Data Integrity cryptosuite this agent is configured with, read from the registered
+ * `VtFlowModuleConfig` so the self issued credentials are secured and linked VPs with the
+ * same suite `VtFlowApi.issueCredentialForSession` applies to the credentials it issues. Falls back
+ * to the module default when the vt-flow module is not registered on the agent.
+ */
+export declare function getDataIntegrityCryptosuite(agent: Pick<VsAgent, 'context'>): string;
+/**
+ * Secures a W3C credential or presentation with a Data Integrity proof under the cryptosuite the
+ * agent is configured with, using the provided verification method.
  *
- * The function determines whether the input object is a `W3cCredential` or a `W3cPresentation`,
- * and applies the appropriate signing operation using Linked Data Proofs (`Ed25519Signature2020`).
+ * A credential is secured for `assertionMethod` and a presentation for `authentication`, the proof
+ * purposes VC Data Integrity defines for each; the presentation is published from the DID Document
+ * rather than presented to a verifier, so it carries no challenge.
  *
  * @param agent - The agent instance.
  * @param obj - The credential or presentation object to be signed.
  * @param verificationMethod - The DID verification method used to generate the proof.
- * @returns A signed W3C Verifiable Credential or Presentation in JSON-LD format.
+ * @returns The secured credential or presentation, wrapping the JSON that gets published.
  */
-export declare function signerW3c(agent: VsAgent, obj: W3cCredential, verificationMethod: string): Promise<W3cJsonLdVerifiableCredential>;
-export declare function signerW3c(agent: VsAgent, obj: W3cPresentation, verificationMethod: string): Promise<W3cJsonLdVerifiablePresentation>;
-/**
- * Generates and signs a verifiable presentation containing a verifiable credential.
- * Stores the signed presentation and its integrity metadata in the DID record.
- *
- * - Retrieves and validates claims for the agent's DID.
- * - Computes an integrity digest for the claims.
- * - If a presentation with the same integrity already exists in the DID metadata, it is returned.
- * - Otherwise, a new presentation is created, signed, and stored in the DID metadata.
- *
- * @param agent - The VsAgent instance used for signing and DID management.
- * @param logger - Logger instance for logging operations.
- * @param ecsSchemas - Map of ECS schemas for validation.
- * @param schemaKey - Unique identifier for the presentation type and metadata key.
- * @param type - Array of credential types to include.
- * @param credentialSchema - Schema definition for the credential.
- * @returns The signed verifiable presentation, with integrity metadata.
- */
-export declare function generateVerifiablePresentation(agent: VsAgent, id: string, ecsSchemas: Record<string, string>, schemaKey: string, type: string[], credentialSchema: W3cCredentialSchema, defaults: SelfTrDefaults): Promise<any>;
-export declare function createPresentation(options: Partial<W3cPresentationOptions>): W3cPresentation;
+export declare function signerW3c(agent: VsAgent, obj: W3cV2Credential, verificationMethod: string): Promise<W3cV2DataIntegrityVerifiableCredential>;
+export declare function signerW3c(agent: VsAgent, obj: W3cV2Presentation, verificationMethod: string): Promise<W3cV2DataIntegrityVerifiablePresentation>;
+/** Builds an unsigned VC Data Model 2.0 presentation; the class supplies the v2 context. */
+export declare function createPresentation(options: Partial<W3cV2PresentationOptions>): W3cV2Presentation;
 /**
  * Retrieves and validates claims for a credential subject.
  * If claims are not found, builds default claims based on the schemaKey.
@@ -80,7 +48,12 @@ export declare function createPresentation(options: Partial<W3cPresentationOptio
  * @returns The validated claims object.
  * @throws If claims are invalid or schema is missing.
  */
-export declare function getClaims(logger: Logger, ecsSchemas: Record<string, string>, { id, claims }: W3cCredentialSubject, schemaKey: string, defaults: SelfTrDefaults): Promise<Record<string, unknown>>;
+export declare function getClaims(logger: Logger, ecsSchemas: Record<string, string>, { id }: W3cCredentialSubject, schemaKey: string, ecsClaims: EcsClaims): Promise<Record<string, unknown>>;
+export interface SchemaViolation {
+    path: string;
+    message: string;
+}
+export declare function schemaViolations(ecsSchema: AnySchemaObject, credentialSubject: Record<string, any>): SchemaViolation[];
 /**
  * Validate a validateSchema object against the corresponding AJV schema.
  * Throws an Error if the schema is missing or validation fails.
@@ -107,9 +80,4 @@ export declare function addDigestSRI<T extends object>(id?: string, data?: T, ec
  * @returns The SRI digest string.
  */
 export declare function generateDigestSRI(content: string, algorithm?: string): string;
-/**
- * Digest of the resource a credential references. Throws rather than attest content it could
- * not read: a wrong digestSRI is a false integrity claim in a signed credential.
- */
-export declare function urlDigestSri(url: string): Promise<string>;
 export declare function getVerificationMethodId(logger: Logger, didRecord: DidRecord): string;