@verana-labs/vs-agent-sdk 2.0.0-dev.8 → 2.0.0-dev.80

package/build/utils/setupSelfTr.d.ts

@@ -1,75 +1,42 @@
-import { W3cCredential, W3cPresentation, W3cCredentialSchema, W3cCredentialSubject, W3cJsonLdVerifiableCredential, W3cJsonLdVerifiablePresentation, W3cCredentialOptions, DidRecord, W3cPresentationOptions, Logger } from '@credo-ts/core';
+import { DidRecord, Logger, W3cCredentialSchema, W3cCredentialSubject, W3cV2Credential, W3cV2CredentialOptions, W3cV2DataIntegrityVerifiableCredential, W3cV2DataIntegrityVerifiablePresentation, W3cV2Presentation, W3cV2PresentationOptions } from '@credo-ts/core';
 import { AnySchemaObject } from 'ajv/dist/2020';
-import { VsAgent } from '../agent/VsAgent';
-export interface SelfTrDefaults {
-    agentLabel: string;
-    serviceLogoUri: string;
-    serviceLogoDigestSri?: string;
-    serviceType: string;
-    serviceDescription: string;
-    serviceMinimumAgeRequired: number;
-    serviceTermsAndConditions: string;
-    serviceTermsAndConditionsDigestSri?: string;
-    servicePrivacyPolicy: string;
-    servicePrivacyPolicyDigestSri?: string;
-    orgRegistryId: string;
-    orgRegistryUri: string;
-    orgAddress: string;
-    orgOrganizationKind: string;
-    orgCountryCode: string;
-}
-export declare const presentations: {
-    name: string;
-    schemaUrl: string;
-}[];
-export declare const credentials: {
-    name: string;
-    credUrl: string;
-    schemaUrl: string;
-}[];
+import type { VsAgent } from '../agent/VsAgent';
+import { EcsClaims } from './ecsClaims';
 export declare const createJsonSchema: W3cCredentialSchema;
 export declare const createJsonSubjectRef: (id: string) => W3cCredentialSubject;
+export declare const linkedVpSchemaId: (schemaKey: string) => string;
 export declare const linkedVpFragment: (schemaKey: string) => string;
-export declare const mapToSelfTr: (url: string, publicApiBaseUrl: string) => string;
-export declare const setupSelfTr: ({ agent, publicApiBaseUrl, defaults, }: {
-    agent: VsAgent;
-    publicApiBaseUrl: string;
-    defaults: SelfTrDefaults;
-}) => Promise<void>;
-export declare function createCredential(options: Partial<W3cCredentialOptions>): W3cCredential;
+export declare const sortKeysDeep: (value: unknown) => unknown;
+/**
+ * Builds an unsigned credential: a VC Data Model 2.0 credential, as
+ * [VT-CRED-W3C] and [VT-JSON-SCHEMA-CRED-W3C] require the `https://www.w3.org/ns/credentials/v2`
+ * context, valid from now for ten years unless told otherwise.
+ */
+export declare function createCredential(options: Partial<W3cV2CredentialOptions>): W3cV2Credential;
+/**
+ * The Data Integrity cryptosuite this agent is configured with, read from the registered
+ * `VtFlowModuleConfig` so the self issued credentials are secured and linked VPs with the
+ * same suite `VtFlowApi.issueCredentialForSession` applies to the credentials it issues. Falls back
+ * to the module default when the vt-flow module is not registered on the agent.
+ */
+export declare function getDataIntegrityCryptosuite(agent: Pick<VsAgent, 'context'>): string;
 /**
- * Signs a W3C Verifiable Credential or Presentation using the provided agent and verification method.
+ * Secures a W3C credential or presentation with a Data Integrity proof under the cryptosuite the
+ * agent is configured with, using the provided verification method.
  *
- * The function determines whether the input object is a `W3cCredential` or a `W3cPresentation`,
- * and applies the appropriate signing operation using Linked Data Proofs (`Ed25519Signature2020`).
+ * A credential is secured for `assertionMethod` and a presentation for `authentication`, the proof
+ * purposes VC Data Integrity defines for each; the presentation is published from the DID Document
+ * rather than presented to a verifier, so it carries no challenge.
  *
  * @param agent - The agent instance.
  * @param obj - The credential or presentation object to be signed.
  * @param verificationMethod - The DID verification method used to generate the proof.
- * @returns A signed W3C Verifiable Credential or Presentation in JSON-LD format.
+ * @returns The secured credential or presentation, wrapping the JSON that gets published.
  */
-export declare function signerW3c(agent: VsAgent, obj: W3cCredential, verificationMethod: string): Promise<W3cJsonLdVerifiableCredential>;
-export declare function signerW3c(agent: VsAgent, obj: W3cPresentation, verificationMethod: string): Promise<W3cJsonLdVerifiablePresentation>;
-/**
- * Generates and signs a verifiable presentation containing a verifiable credential.
- * Stores the signed presentation and its integrity metadata in the DID record.
- *
- * - Retrieves and validates claims for the agent's DID.
- * - Computes an integrity digest for the claims.
- * - If a presentation with the same integrity already exists in the DID metadata, it is returned.
- * - Otherwise, a new presentation is created, signed, and stored in the DID metadata.
- *
- * @param agent - The VsAgent instance used for signing and DID management.
- * @param logger - Logger instance for logging operations.
- * @param ecsSchemas - Map of ECS schemas for validation.
- * @param schemaKey - Unique identifier for the presentation type and metadata key.
- * @param type - Array of credential types to include.
- * @param credentialSchema - Schema definition for the credential.
- * @param beforePublish - Step that must succeed before a linked presentation counts as published.
- * @returns The signed verifiable presentation, with integrity metadata.
- */
-export declare function generateVerifiablePresentation(agent: VsAgent, id: string, ecsSchemas: Record<string, string>, schemaKey: string, type: string[], credentialSchema: W3cCredentialSchema, defaults: SelfTrDefaults, beforePublish?: (verifiablePresentation: any) => Promise<void>): Promise<any>;
-export declare function createPresentation(options: Partial<W3cPresentationOptions>): W3cPresentation;
+export declare function signerW3c(agent: VsAgent, obj: W3cV2Credential, verificationMethod: string): Promise<W3cV2DataIntegrityVerifiableCredential>;
+export declare function signerW3c(agent: VsAgent, obj: W3cV2Presentation, verificationMethod: string): Promise<W3cV2DataIntegrityVerifiablePresentation>;
+/** Builds an unsigned VC Data Model 2.0 presentation; the class supplies the v2 context. */
+export declare function createPresentation(options: Partial<W3cV2PresentationOptions>): W3cV2Presentation;
 /**
  * Retrieves and validates claims for a credential subject.
  * If claims are not found, builds default claims based on the schemaKey.
@@ -81,7 +48,12 @@ export declare function createPresentation(options: Partial<W3cPresentationOptio
  * @returns The validated claims object.
  * @throws If claims are invalid or schema is missing.
  */
-export declare function getClaims(logger: Logger, ecsSchemas: Record<string, string>, { id, claims }: W3cCredentialSubject, schemaKey: string, defaults: SelfTrDefaults): Promise<Record<string, unknown>>;
+export declare function getClaims(logger: Logger, ecsSchemas: Record<string, string>, { id }: W3cCredentialSubject, schemaKey: string, ecsClaims: EcsClaims): Promise<Record<string, unknown>>;
+export interface SchemaViolation {
+    path: string;
+    message: string;
+}
+export declare function schemaViolations(ecsSchema: AnySchemaObject, credentialSubject: Record<string, any>): SchemaViolation[];
 /**
  * Validate a validateSchema object against the corresponding AJV schema.
  * Throws an Error if the schema is missing or validation fails.
@@ -101,16 +73,5 @@ export declare function validateSchema(ecsSchema: AnySchemaObject, credentialSub
 export declare function addDigestSRI<T extends object>(id?: string, data?: T, ecsSchemas?: Record<string, string>): Promise<T & {
     digestSRI: string;
 }>;
-/**
- * Generates a SRI digest string for the given content using the specified algorithm.
- * @param content - The content to hash.
- * @param algorithm - The hash algorithm to use (default: sha256).
- * @returns The SRI digest string.
- */
-export declare function generateDigestSRI(content: string, algorithm?: string): string;
-/**
- * Digest of the resource a credential references. Throws rather than attest content it could
- * not read: a wrong digestSRI is a false integrity claim in a signed credential.
- */
-export declare function urlDigestSri(url: string): Promise<string>;
+export declare function generateDigestSRI(content: string): string;
 export declare function getVerificationMethodId(logger: Logger, didRecord: DidRecord): string;

package/build/utils/setupSelfTr.js

@@ -3,55 +3,28 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.setupSelfTr = exports.mapToSelfTr = exports.linkedVpFragment = exports.createJsonSubjectRef = exports.createJsonSchema = exports.credentials = exports.presentations = void 0;
+exports.sortKeysDeep = exports.linkedVpFragment = exports.linkedVpSchemaId = exports.createJsonSubjectRef = exports.createJsonSchema = void 0;
 exports.createCredential = createCredential;
+exports.getDataIntegrityCryptosuite = getDataIntegrityCryptosuite;
 exports.signerW3c = signerW3c;
-exports.generateVerifiablePresentation = generateVerifiablePresentation;
 exports.createPresentation = createPresentation;
 exports.getClaims = getClaims;
+exports.schemaViolations = schemaViolations;
 exports.validateSchema = validateSchema;
 exports.addDigestSRI = addDigestSRI;
 exports.generateDigestSRI = generateDigestSRI;
-exports.urlDigestSri = urlDigestSri;
 exports.getVerificationMethodId = getVerificationMethodId;
 const core_1 = require("@credo-ts/core");
-// No type definitions available for this library
-// eslint-disable-next-line @typescript-eslint/ban-ts-comment
-//@ts-expect-error
-const jsonld_signatures_1 = require("@digitalcredentials/jsonld-signatures");
+const credo_ts_didcomm_vt_flow_1 = require("@verana-labs/credo-ts-didcomm-vt-flow");
 const vs_agent_model_1 = require("@verana-labs/vs-agent-model");
 const _2020_1 = __importDefault(require("ajv/dist/2020"));
 const ajv_formats_1 = __importDefault(require("ajv-formats"));
-const axios_1 = __importDefault(require("axios"));
-const crypto_1 = require("crypto");
-const data_1 = require("./data");
-const ajv = new _2020_1.default({ strict: false });
+const boundedFetch_1 = require("./boundedFetch");
+const ecsClaims_1 = require("./ecsClaims");
+const vcdm2_1 = require("./vcdm2");
+const TEN_YEARS_MS = 10 * 365 * 24 * 60 * 60 * 1000;
+const ajv = new _2020_1.default({ strict: false, allErrors: true });
 (0, ajv_formats_1.default)(ajv);
-const DIGEST_FETCH_TIMEOUT_MS = 5000;
-// Helpers
-exports.presentations = [
-    {
-        name: 'ecs-service',
-        schemaUrl: `ecosystem/schemas-example-service-jsc.json`,
-    },
-    {
-        name: 'ecs-org',
-        schemaUrl: `ecosystem/schemas-example-org-jsc.json`,
-    },
-];
-exports.credentials = [
-    {
-        name: 'example-service',
-        credUrl: `ecosystem/cs/v1/js/ecs-service`,
-        schemaUrl: `ecosystem/schemas-example-service-jsc.json`,
-    },
-    {
-        name: 'example-org',
-        credUrl: `ecosystem/cs/v1/js/ecs-org`,
-        schemaUrl: `ecosystem/schemas-example-org-jsc.json`,
-    },
-];
-// Default JSON Schema objects
 exports.createJsonSchema = {
     id: 'https://www.w3.org/ns/credentials/json-schema/v2.json',
     type: 'JsonSchema',
@@ -67,233 +40,72 @@ const createJsonSubjectRef = (id) => ({
 });
 exports.createJsonSubjectRef = createJsonSubjectRef;
 // fragment format per [VT-CRED-W3C-LINKED-VP]
-const linkedVpFragment = (schemaKey) => `vpr-schemas-${schemaKey.replace(/^ecs-/, '')}-vtc-vp`;
+const linkedVpSchemaId = (schemaKey) => schemaKey.replace(/^ecs-/, '');
+exports.linkedVpSchemaId = linkedVpSchemaId;
+const linkedVpFragment = (schemaKey) => `vpr-schemas-${(0, exports.linkedVpSchemaId)(schemaKey)}-vtc-vp`;
 exports.linkedVpFragment = linkedVpFragment;
-const mapToSelfTr = (url, publicApiBaseUrl) => url.replace('ecosystem', `${publicApiBaseUrl}/vt`);
-exports.mapToSelfTr = mapToSelfTr;
-const buildIntegrityData = (data) => {
-    return generateDigestSRI(JSON.stringify(data, Object.keys(data).sort()));
-};
-const setupSelfTr = async ({ agent, publicApiBaseUrl, defaults, }) => {
-    const ecsSchemas = (0, data_1.getEcsSchemas)(publicApiBaseUrl);
-    const logger = agent.config.logger;
-    for (const { name, schemaUrl } of exports.presentations) {
-        try {
-            await generateVerifiablePresentation(agent, `${publicApiBaseUrl}/vt/${name}-vtc-vp.json`, ecsSchemas, name, ['VerifiableCredential', 'VerifiableTrustCredential'], {
-                id: (0, exports.mapToSelfTr)(schemaUrl, publicApiBaseUrl),
-                type: 'JsonSchemaCredential',
-            }, defaults);
-        }
-        catch (error) {
-            logger.warn(`Skipping self-issued ${name}: ${error instanceof Error ? error.message : error}`);
-        }
-    }
-    for (const { name, credUrl, schemaUrl } of exports.credentials) {
-        const id = (0, exports.mapToSelfTr)(schemaUrl, publicApiBaseUrl);
-        const ref = (0, exports.mapToSelfTr)(credUrl, publicApiBaseUrl);
-        try {
-            await generateVerifiableCredential(agent, id, ecsSchemas, name, ['VerifiableCredential', 'JsonSchemaCredential'], (0, exports.createJsonSubjectRef)(ref), exports.createJsonSchema, defaults);
-        }
-        catch (error) {
-            logger.warn(`Skipping self-issued ${name}: ${error instanceof Error ? error.message : error}`);
-        }
-    }
+// A plain array replacer only allowlists property names, applied at every
+// nesting level — nested objects like `claims` and `credentialSchema` would
+// serialize to `{}` since none of their own keys appear in a top-level
+// key list. Sort keys recursively instead, so the hash actually reflects
+// nested content and changes to claims invalidate the cache correctly.
+const sortKeysDeep = (value) => {
+    if (Array.isArray(value))
+        return value.map(exports.sortKeysDeep);
+    if (value !== null && typeof value === 'object') {
+        return Object.keys(value)
+            .sort()
+            .reduce((acc, key) => {
+            acc[key] = (0, exports.sortKeysDeep)(value[key]);
+            return acc;
+        }, {});
+    }
+    return value;
 };
-exports.setupSelfTr = setupSelfTr;
+exports.sortKeysDeep = sortKeysDeep;
 /**
- * Generates and signs a verifiable credential using the agent's DID.
- * Stores the signed credential and its integrity metadata in the DID record.
- *
- * - If the claims for the subject are not provided, they are retrieved (default claims) and validated against the schema.
- * - The integrity of the claims is tracked using a Subresource Integrity (SRI) digest.
- * - If a credential with the same integrity already exists in the DID metadata, it is returned directly.
- * - Otherwise, a new credential is created, signed, and stored in the DID metadata.
- * - If a presentation is provided, the signed credential is embedded and a signed presentation is returned.
- *
- * @param agent - The VsAgent instance used for signing and DID management.
- * @param logger - Logger instance for logging operations.
- * @param ecsSchemas - Map of ECS schemas for validation.
- * @param schemaKey - Unique identifier for the credential type and metadata key.
- * @param type - Array of credential types (e.g., ['VerifiableCredential']).
- * @param subject - Subject information, including ID and optional claims.
- * @param credentialSchema - Schema definition for the credential.
- * @param presentation - Optional presentation to include the credential.
- * @returns The signed verifiable credential or presentation, with integrity metadata.
+ * Builds an unsigned credential: a VC Data Model 2.0 credential, as
+ * [VT-CRED-W3C] and [VT-JSON-SCHEMA-CRED-W3C] require the `https://www.w3.org/ns/credentials/v2`
+ * context, valid from now for ten years unless told otherwise.
  */
-async function generateVerifiableCredential(agent, id, ecsSchemas, schemaKey, type, subject, credentialSchema, defaults, presentation) {
+function createCredential(options) {
     var _a;
-    const logger = agent.config.logger;
-    const [didRecord] = await agent.dids.getCreatedDids({ did: agent.did });
-    const { id: subjectId } = subject;
-    let claims = subject.claims;
-    if (!claims) {
-        claims = await getClaims(logger, ecsSchemas, { id: subjectId }, schemaKey, defaults);
-    }
-    const integrityData = buildIntegrityData({ id, type, credentialSchema, claims });
-    const record = (_a = didRecord.metadata.get('_vt/jsc')) !== null && _a !== void 0 ? _a : {};
-    const metadata = record[subjectId];
-    if ((metadata === null || metadata === void 0 ? void 0 : metadata.integrityData) === integrityData)
-        return metadata.credential;
-    const unsignedCredential = createCredential({
-        id,
-        type,
-        issuer: agent.did,
-        credentialSubject: {
-            id: subjectId,
-            claims: presentation ? claims : await addDigestSRI(subjectId, claims, ecsSchemas),
-        },
-    });
-    unsignedCredential.credentialSchema = presentation
-        ? credentialSchema
-        : await addDigestSRI(credentialSchema.id, credentialSchema, ecsSchemas);
-    // Note: this is dependant on DIDComm invitation keys. Not sure if it is fine or we should use a dedicated
-    // key for this feature
-    const verificationMethodId = getVerificationMethodId(logger, didRecord);
-    const signedCredential = await signerW3c(agent, unsignedCredential, verificationMethodId);
-    if (presentation) {
-        presentation.verifiableCredential = [signedCredential];
-        return await signerW3c(agent, presentation, verificationMethodId);
-    }
-    else {
-        record[subjectId] = {
-            credential: signedCredential.jsonCredential,
-            verifiablePresentation: {},
-            didDocumentServiceId: '',
-            integrityData,
-        };
-        didRecord.metadata.set('_vt/jsc', record);
-        await agent.context.dependencyManager.resolve(core_1.DidRepository).update(agent.context, didRecord);
-        return signedCredential.jsonCredential;
-    }
+    return (0, vcdm2_1.createW3cV2Credential)(Object.assign(Object.assign({}, options), { validUntil: (_a = options.validUntil) !== null && _a !== void 0 ? _a : new Date(Date.now() + TEN_YEARS_MS).toISOString() }));
 }
-function createCredential(options) {
-    var _a, _b, _c;
-    (_a = options.context) !== null && _a !== void 0 ? _a : (options.context = [
-        'https://www.w3.org/2018/credentials/v1',
-        'https://www.w3.org/ns/credentials/examples/v2',
-    ]);
-    (_b = options.issuanceDate) !== null && _b !== void 0 ? _b : (options.issuanceDate = new Date().toISOString());
-    (_c = options.expirationDate) !== null && _c !== void 0 ? _c : (options.expirationDate = new Date(Date.now() + 10 * 365 * 24 * 60 * 60 * 1000).toISOString());
-    return new core_1.W3cCredential(options);
+/**
+ * The Data Integrity cryptosuite this agent is configured with, read from the registered
+ * `VtFlowModuleConfig` so the self issued credentials are secured and linked VPs with the
+ * same suite `VtFlowApi.issueCredentialForSession` applies to the credentials it issues. Falls back
+ * to the module default when the vt-flow module is not registered on the agent.
+ */
+function getDataIntegrityCryptosuite(agent) {
+    const { dependencyManager } = agent.context;
+    return dependencyManager.isRegistered(credo_ts_didcomm_vt_flow_1.VtFlowModuleConfig)
+        ? dependencyManager.resolve(credo_ts_didcomm_vt_flow_1.VtFlowModuleConfig).dataIntegrityCryptosuite
+        : credo_ts_didcomm_vt_flow_1.DEFAULT_DATA_INTEGRITY_CRYPTOSUITE;
 }
 async function signerW3c(agent, obj, verificationMethod) {
-    const proofPurpose = new jsonld_signatures_1.purposes.AssertionProofPurpose();
-    if (obj instanceof core_1.W3cCredential) {
-        return await agent.w3cCredentials.signCredential({
-            format: core_1.ClaimFormat.LdpVc,
+    const cryptosuite = getDataIntegrityCryptosuite(agent);
+    if (obj instanceof core_1.W3cV2Credential) {
+        return await agent.w3cV2Credentials.signCredential({
+            format: core_1.ClaimFormat.DiVc,
             credential: obj,
-            proofType: 'Ed25519Signature2020',
-            verificationMethod,
-            proofPurpose,
-        });
-    }
-    if (obj instanceof core_1.W3cPresentation) {
-        return await agent.w3cCredentials.signPresentation({
-            format: core_1.ClaimFormat.LdpVp,
-            presentation: obj,
-            proofType: 'Ed25519Signature2020',
+            cryptosuite,
             verificationMethod,
-            proofPurpose,
         });
     }
-}
-/**
- * Generates and signs a verifiable presentation containing a verifiable credential.
- * Stores the signed presentation and its integrity metadata in the DID record.
- *
- * - Retrieves and validates claims for the agent's DID.
- * - Computes an integrity digest for the claims.
- * - If a presentation with the same integrity already exists in the DID metadata, it is returned.
- * - Otherwise, a new presentation is created, signed, and stored in the DID metadata.
- *
- * @param agent - The VsAgent instance used for signing and DID management.
- * @param logger - Logger instance for logging operations.
- * @param ecsSchemas - Map of ECS schemas for validation.
- * @param schemaKey - Unique identifier for the presentation type and metadata key.
- * @param type - Array of credential types to include.
- * @param credentialSchema - Schema definition for the credential.
- * @param beforePublish - Step that must succeed before a linked presentation counts as published.
- * @returns The signed verifiable presentation, with integrity metadata.
- */
-async function generateVerifiablePresentation(agent, id, ecsSchemas, schemaKey, type, credentialSchema, defaults, beforePublish) {
-    var _a, _b, _c, _d, _e;
-    if (!agent.did)
-        throw Error('The DID must be set up');
-    const [didRecord] = await agent.dids.getCreatedDids({ did: agent.did });
-    const didDocument = didRecord.didDocument;
-    if (!didDocument)
-        throw Error('The DID Document be set up');
-    const claims = await getClaims(agent.config.logger, ecsSchemas, { id: agent.did }, schemaKey, defaults);
-    // Use full input for integrityData to ensure update detection
-    const didDocumentServiceId = `${agent.did}#${(0, exports.linkedVpFragment)(schemaKey)}`;
-    const integrityData = buildIntegrityData({ id, type, credentialSchema, claims });
-    const record = (_a = didRecord.metadata.get('_vt/vtc')) !== null && _a !== void 0 ? _a : {};
-    const metadata = record[credentialSchema.id];
-    const attached = (_b = metadata === null || metadata === void 0 ? void 0 : metadata.attached) !== null && _b !== void 0 ? _b : true;
-    if ((metadata === null || metadata === void 0 ? void 0 : metadata.integrityData) === integrityData) {
-        // the presentation is already public, so a failed beforePublish step still needs a retry here
-        if (attached)
-            await (beforePublish === null || beforePublish === void 0 ? void 0 : beforePublish(metadata.verifiablePresentation));
-        return metadata.verifiablePresentation;
-    }
-    const presentation = createPresentation({
-        id,
-        holder: agent.did,
-        verifiableCredential: [],
+    // The options type requires a challenge for every presentation format, while a Data Integrity
+    // proof only carries one when it is given
+    return await agent.w3cV2Credentials.signPresentation({
+        format: core_1.ClaimFormat.DiVp,
+        presentation: obj,
+        cryptosuite,
+        verificationMethod,
     });
-    const verifiablePresentation = await generateVerifiableCredential(agent, agent.did, ecsSchemas, schemaKey, type, { id: agent.did }, credentialSchema, defaults, presentation);
-    // nothing is persisted yet, so a failure here leaves no public presentation behind
-    if (attached)
-        await (beforePublish === null || beforePublish === void 0 ? void 0 : beforePublish(verifiablePresentation));
-    // Update linked VP when the presentation has changed
-    if (attached)
-        didDocument.service = (_c = didDocument.service) === null || _c === void 0 ? void 0 : _c.map(s => {
-            if (typeof s.serviceEndpoint !== 'string')
-                return s;
-            if (s.serviceEndpoint.includes(schemaKey) && s.id !== `${agent.did}#whois`) {
-                s.id = didDocumentServiceId;
-                s.serviceEndpoint = id;
-            }
-            return s;
-        });
-    // Resolvers only discover the credential through the [VT-CRED-W3C-LINKED-VP] fragment, and
-    // #whois does not match it. The rename above only covers documents that already carry the
-    // service, so publish it here when nothing declared it yet.
-    let didDocumentChanged = false;
-    if (attached && !((_d = didDocument.service) === null || _d === void 0 ? void 0 : _d.some(s => s.id === didDocumentServiceId))) {
-        didDocument.service = [
-            ...((_e = didDocument.service) !== null && _e !== void 0 ? _e : []),
-            new core_1.DidDocumentService({
-                id: didDocumentServiceId,
-                serviceEndpoint: id,
-                type: 'LinkedVerifiablePresentation',
-            }),
-        ];
-        didDocumentChanged = true;
-    }
-    const credential = verifiablePresentation.verifiableCredential[0];
-    record[credentialSchema.id] = {
-        credential,
-        verifiablePresentation,
-        didDocumentServiceId,
-        integrityData,
-        attached,
-    };
-    didRecord.metadata.set('_vt/vtc', record);
-    await agent.context.dependencyManager.resolve(core_1.DidRepository).update(agent.context, didRecord);
-    if (didDocumentChanged) {
-        await agent.dids.update({ did: didRecord.did, didDocument });
-    }
-    return verifiablePresentation;
 }
+/** Builds an unsigned VC Data Model 2.0 presentation; the class supplies the v2 context. */
 function createPresentation(options) {
-    var _a, _b;
-    (_a = options.context) !== null && _a !== void 0 ? _a : (options.context = [
-        'https://www.w3.org/2018/credentials/v1',
-        'https://www.w3.org/ns/credentials/examples/v2',
-    ]);
-    (_b = options.type) !== null && _b !== void 0 ? _b : (options.type = ['VerifiablePresentation']);
-    return new core_1.W3cPresentation(options);
+    return new core_1.W3cV2Presentation(Object.assign({ type: ['VerifiablePresentation'] }, options));
 }
 /**
  * Retrieves and validates claims for a credential subject.
@@ -306,60 +118,43 @@ function createPresentation(options) {
  * @returns The validated claims object.
  * @throws If claims are invalid or schema is missing.
  */
-async function getClaims(logger, ecsSchemas, { id, claims }, schemaKey, defaults) {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w;
-    // Default claims fallback
-    const logoUri = (_a = claims === null || claims === void 0 ? void 0 : claims.logoUri) !== null && _a !== void 0 ? _a : defaults.serviceLogoUri;
-    const termsAndConditionsUri = (_b = claims === null || claims === void 0 ? void 0 : claims.termsAndConditionsUri) !== null && _b !== void 0 ? _b : defaults.serviceTermsAndConditions;
-    const privacyPolicyUri = (_c = claims === null || claims === void 0 ? void 0 : claims.privacyPolicyUri) !== null && _c !== void 0 ? _c : defaults.servicePrivacyPolicy;
-    claims =
-        schemaKey === 'ecs-service'
-            ? {
-                name: (_d = claims === null || claims === void 0 ? void 0 : claims.name) !== null && _d !== void 0 ? _d : defaults.agentLabel,
-                type: (_e = claims === null || claims === void 0 ? void 0 : claims.type) !== null && _e !== void 0 ? _e : defaults.serviceType,
-                description: (_f = claims === null || claims === void 0 ? void 0 : claims.description) !== null && _f !== void 0 ? _f : defaults.serviceDescription,
-                logoUri,
-                logoDigestSri: (_h = (_g = claims === null || claims === void 0 ? void 0 : claims.logoDigestSri) !== null && _g !== void 0 ? _g : defaults.serviceLogoDigestSri) !== null && _h !== void 0 ? _h : (await urlDigestSri(logoUri)),
-                minimumAgeRequired: (_j = claims === null || claims === void 0 ? void 0 : claims.minimumAgeRequired) !== null && _j !== void 0 ? _j : defaults.serviceMinimumAgeRequired,
-                termsAndConditionsUri,
-                termsAndConditionsDigestSri: (_l = (_k = claims === null || claims === void 0 ? void 0 : claims.termsAndConditionsDigestSri) !== null && _k !== void 0 ? _k : defaults.serviceTermsAndConditionsDigestSri) !== null && _l !== void 0 ? _l : (await urlDigestSri(termsAndConditionsUri)),
-                privacyPolicyUri,
-                privacyPolicyDigestSri: (_o = (_m = claims === null || claims === void 0 ? void 0 : claims.privacyPolicyDigestSri) !== null && _m !== void 0 ? _m : defaults.servicePrivacyPolicyDigestSri) !== null && _o !== void 0 ? _o : (await urlDigestSri(privacyPolicyUri)),
-            }
-            : {
-                name: (_p = claims === null || claims === void 0 ? void 0 : claims.name) !== null && _p !== void 0 ? _p : defaults.agentLabel,
-                logoUri,
-                logoDigestSri: (_r = (_q = claims === null || claims === void 0 ? void 0 : claims.logoDigestSri) !== null && _q !== void 0 ? _q : defaults.serviceLogoDigestSri) !== null && _r !== void 0 ? _r : (await urlDigestSri(logoUri)),
-                registryId: (_s = claims === null || claims === void 0 ? void 0 : claims.registryId) !== null && _s !== void 0 ? _s : defaults.orgRegistryId,
-                registryUri: (_t = claims === null || claims === void 0 ? void 0 : claims.registryUri) !== null && _t !== void 0 ? _t : defaults.orgRegistryUri,
-                address: (_u = claims === null || claims === void 0 ? void 0 : claims.address) !== null && _u !== void 0 ? _u : defaults.orgAddress,
-                organizationKind: (_v = claims === null || claims === void 0 ? void 0 : claims.organizationKind) !== null && _v !== void 0 ? _v : defaults.orgOrganizationKind,
-                countryCode: (_w = claims === null || claims === void 0 ? void 0 : claims.countryCode) !== null && _w !== void 0 ? _w : defaults.orgCountryCode,
-            };
+async function getClaims(logger, ecsSchemas, { id }, schemaKey, ecsClaims) {
+    const claims = await (0, ecsClaims_1.composeEcsClaims)(ecsClaims, schemaKey, logger);
+    if (!claims)
+        throw new Error(`No ECS_CLAIMS_* variable is set for ${schemaKey}`);
     const ecsSchema = ecsSchemas[schemaKey];
     if (!ecsSchema) {
         throw new Error(`Schema not defined in data schemas for schemaKey: ${schemaKey}`);
     }
-    const credentialSubject = Object.assign({ id }, claims);
-    validateSchema(JSON.parse(ecsSchema), credentialSubject);
+    validateSchema(JSON.parse(ecsSchema), Object.assign({ id }, claims));
     return claims;
 }
+function schemaViolations(ecsSchema, credentialSubject) {
+    var _a, _b;
+    const validate = ajv.compile((_a = ecsSchema.properties) === null || _a === void 0 ? void 0 : _a.credentialSubject);
+    if (validate(credentialSubject))
+        return [];
+    return ((_b = validate.errors) !== null && _b !== void 0 ? _b : []).map(e => { var _a; return ({ path: e.instancePath, message: (_a = e.message) !== null && _a !== void 0 ? _a : e.keyword }); });
+}
 /**
  * Validate a validateSchema object against the corresponding AJV schema.
  * Throws an Error if the schema is missing or validation fails.
  */
 function validateSchema(ecsSchema, credentialSubject) {
-    var _a, _b;
-    const validate = ajv.compile((_a = ecsSchema.properties) === null || _a === void 0 ? void 0 : _a.credentialSubject);
-    const isValid = validate(credentialSubject);
-    if (!isValid) {
-        const errorDetails = (_b = validate.errors) === null || _b === void 0 ? void 0 : _b.map(e => ({
-            message: e.message,
-            path: e.instancePath,
-            keyword: e.keyword,
-            params: e.params,
-        }));
-        throw new Error(`Invalid claims for ${ecsSchema.$id}: ${JSON.stringify(errorDetails, null, 2)}`);
+    const violations = schemaViolations(ecsSchema, credentialSubject);
+    if (violations.length > 0) {
+        throw new Error(`Invalid claims for ${ecsSchema.$id}: ${JSON.stringify(violations, null, 2)}`);
+    }
+}
+async function fetchSchemaContent(id) {
+    try {
+        const response = await fetch((0, vs_agent_model_1.mapToEcosystem)(id));
+        if (!response.ok)
+            return { error: `${response.status} ${response.statusText}` };
+        return { content: await response.text() };
+    }
+    catch (error) {
+        return { error: error instanceof Error ? error.message : String(error) };
     }
 }
 /**
@@ -374,15 +169,16 @@ function validateSchema(ecsSchema, credentialSubject) {
  * @throws Error if both the fetch and local fallback fail.
  */
 async function addDigestSRI(id, data, ecsSchemas) {
+    var _a;
     if (!id || !data) {
         throw new Error(`id and data has requiered`);
     }
-    const response = await fetch((0, vs_agent_model_1.mapToEcosystem)(id));
+    const fetched = await fetchSchemaContent(id);
     const key = id.split('/').pop();
     const fallbackSchema = key && (ecsSchemas === null || ecsSchemas === void 0 ? void 0 : ecsSchemas[key]);
-    const schemaContent = response.ok ? await response.text() : fallbackSchema;
+    const schemaContent = (_a = fetched.content) !== null && _a !== void 0 ? _a : fallbackSchema;
     if (!schemaContent) {
-        throw new Error(`Failed to fetch schema from ${id}: ${response.status} ${response.statusText}, and no local fallback found.`);
+        throw new Error(`Failed to fetch schema from ${id}: ${fetched.error}, and no local fallback found.`);
     }
     assertValidSchema(schemaContent, id);
     return Object.assign(Object.assign({}, data), { digestSRI: generateDigestSRI(schemaContent) });
@@ -404,23 +200,8 @@ function assertValidSchema(schemaContent, id) {
         throw new Error(`Schema from ${id} is not valid: ${message}`);
     }
 }
-/**
- * Generates a SRI digest string for the given content using the specified algorithm.
- * @param content - The content to hash.
- * @param algorithm - The hash algorithm to use (default: sha256).
- * @returns The SRI digest string.
- */
-function generateDigestSRI(content, algorithm = 'sha384') {
-    const hash = (0, crypto_1.createHash)(algorithm).update(content).digest('base64');
-    return `${algorithm}-${hash}`;
-}
-/**
- * Digest of the resource a credential references. Throws rather than attest content it could
- * not read: a wrong digestSRI is a false integrity claim in a signed credential.
- */
-async function urlDigestSri(url) {
-    const response = await axios_1.default.get(url, { responseType: 'arraybuffer', timeout: DIGEST_FETCH_TIMEOUT_MS });
-    return `sha384-${(0, crypto_1.createHash)('sha384').update(Buffer.from(response.data)).digest('base64')}`;
+function generateDigestSRI(content) {
+    return (0, boundedFetch_1.digestOfBytes)(content);
 }
 function getVerificationMethodId(logger, didRecord) {
     var _a, _b;
@@ -431,7 +212,7 @@ function getVerificationMethodId(logger, didRecord) {
                 method.id === ((_b = (_a = didRecord.didDocument) === null || _a === void 0 ? void 0 : _a.assertionMethod) === null || _b === void 0 ? void 0 : _b[0]);
         });
         if (!verificationMethod) {
-            throw new Error('Cannot find a suitable Ed25519Signature2020 verification method in DID Document');
+            throw new Error('Cannot find a suitable Ed25519 verification method in DID Document');
         }
         return verificationMethod.id;
     }