Verified Agent Identity

prompt.json
promptfooconfig.yaml
.github/

name: Evaluate Skill

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]
  workflow_dispatch:

jobs:
  evaluate:
    runs-on: ubuntu-latest

    env:
      GOOGLE_API_KEY: ${{ secrets.GEMINI_API_KEY }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '20'

      - name: Install promptfoo
        run: npm install -g promptfoo

      - name: Run promptfoo eval
        run: promptfoo eval --no-cache --output results.json

      - name: Upload eval results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: promptfoo-results
          path: results.json

      - name: Write job summary
        if: always()
        run: |
          echo "### Promptfoo Skill Evaluation" >> "$GITHUB_STEP_SUMMARY"
          if [ -f results.json ]; then
            PASS=$(jq '[.results.results[] | select(.success == true)] | length' results.json)
            FAIL=$(jq '[.results.results[] | select(.success == false)] | length' results.json)
            TOTAL=$((PASS + FAIL))
            echo "- Passed: $PASS" >> "$GITHUB_STEP_SUMMARY"
            echo "- Failed: $FAIL" >> "$GITHUB_STEP_SUMMARY"
            echo "- Total:  $TOTAL" >> "$GITHUB_STEP_SUMMARY"
            if [ "$TOTAL" -gt 0 ]; then
              # Use awk for floating-point: success rate as integer percentage
              RATE=$(awk "BEGIN { printf \"%d\", ($PASS / $TOTAL) * 100 }")
              echo "- Success rate: ${RATE}%" >> "$GITHUB_STEP_SUMMARY"
              if [ "$RATE" -lt 95 ]; then
                echo "::error::Success rate ${RATE}% is below the 95% threshold (${PASS}/${TOTAL} passed)"
                exit 1
              fi
            else
              echo "- No tests found in results.json" >> "$GITHUB_STEP_SUMMARY"
              exit 1
            fi
          else
            echo "- results.json not found" >> "$GITHUB_STEP_SUMMARY"
            exit 1
          fi

name: Publish to OpenClaw Hub

on:
  release:
    types: [published]

jobs:
  publish:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install clawhub CLI
        run: npm install -g clawhub

      - name: Login to OpenClaw Hub
        run: clawhub login --token ${{ secrets.CLAWHUB_TOKEN }}

      - name: Publish skill
        run: |
          VERSION="${{ github.event.release.tag_name }}"
          VERSION="${VERSION#v}"
          clawhub skill publish . --version "$VERSION" --slug identity --owner "@billionsnetwork" --name "Verified Agent Identity"

scripts/node_modules
.vscode
.DS_Store
*.zip
upload.sh
.env

[
  {
    "role": "system",
    "content": {{ system_message | dump }}
  },
  {% for completion in _conversation %}
  {
    "role": "user",
    "content": {{ completion.input | dump }}
  },
  {
    "role": "assistant",
    "content": {{ completion.output | dump }}
  },
  {% endfor %}
  {
    "role": "user",
    "content": {{ message | dump }}
  }
]

# yaml-language-server: $schema=https://promptfoo.dev/config-schema.json

# Learn more about building a configuration: https://promptfoo.dev/docs/configuration/guide

description: "verified-agent-identity skill eval"

defaultTest:
  vars:
    system_message: "file://SKILL.md"

prompts:
  - file://prompt.json

providers:
  - id: google:gemini-flash-lite-latest
    config:
      showThinking: false # Exclude thinking content from output

tests:
  - description: "[Chat flow] Step 1: List identities"
    vars:
      message: "List my agent identities"
    metadata:
      conversationId: pairing-flow
    assert:
      - type: icontains
        value: "getIdentities"

  - description: "[Chat flow] Step 2: Create a new identity"
    vars:
      message: "Create a new identity"
    metadata:
      conversationId: pairing-flow
    assert:
      - type: icontains
        value: "createNewEthereumIdentity"

  - description: "[Chat flow] Step 3: Generate pairing link (agent checks identity first)"
    vars:
      message: "Generate a pairing link for my agent"
    metadata:
      conversationId: pairing-flow
    assert:
      - type: contains-any
        value: ["getIdentities", "createNewEthereumIdentity", "linkHumanToAgent"]

  - description: "[Chat flow] Step 4: Feed identity result, assert pairing link created"
    vars:
      message: |
        Tool output: [{"did":"did:iden3:readonly:test:abc123","isDefault":true}]
    metadata:
      conversationId: pairing-flow
    assert:
      - type: icontains
        value: "linkHumanToAgent"

const fs = require("fs");
const os = require("os");
const path = require("path");
const yargs = require("yargs/yargs");
const { hideBin } = require("yargs/helpers");
const {
  hashstr,
  outputSuccess,
  outputError,
  outputInputRequired,
  getUserWallet,
  createAuthRequestMessage,
  getRequiredDidEntry,
} = require("./shared/utils");
const { getInitializedRuntime } = require("./shared/bootstrap");
const { x402Client } = require("@x402/core/client");
const { ExactEvmScheme } = require("@x402/evm/exact/client");
const {
  createHumanProofExtension,
  MissingAttestationsError,
  checkAttestation,
  isMaxUseExceededError,
} = require("@billionsnetwork/x402-human-proof-client");
const { toClientEvmSigner } = require("@x402/evm");
const {
  schemaId,
  transactionSender,
  requiredAttestationsMessage,
} = require("./shared/constants");
const { createPOUScope, createAuthScope } = require("./shared/scopes");
const { signChallenge } = require("./signChallenge");
const { v4: uuidv4 } = require("uuid");

function getPaymentHash(payment) {
  return hashstr(JSON.stringify(payment));
}

function getPaymentRequiredHash(paymentRequired) {
  return hashstr(JSON.stringify(paymentRequired));
}

function parsePaymentRequiredHeader(headerValue) {
  const trimmed = headerValue.trim();
  return trimmed.startsWith("{")
    ? JSON.parse(trimmed)
    : JSON.parse(atob(trimmed));
}

async function fetchPaymentRequired(url) {
  let response;
  try {
    response = await fetch(url);
  } catch (e) {
    outputError(`Failed to reach resource: ${e.message || e}`, true);
    return;
  }
  if (response.status !== 402) {
    outputError(`Expected 402 from ${url}, got ${response.status}`, true);
    return;
  }
  const headerValue = response.headers.get("payment-required");
  if (!headerValue) {
    outputError(
      "Resource returned 402 but no PAYMENT-REQUIRED header",
      true,
    );
    return;
  }
  try {
    return parsePaymentRequiredHeader(headerValue);
  } catch (e) {
    outputError(
      `PAYMENT-REQUIRED header is not valid JSON or Base64 JSON: ${e.message || e}`,
      true,
    );
  }
}

function persistPaymentRequired(paymentRequired) {
  const hash = getPaymentRequiredHash(paymentRequired);
  const filePath = path.join(os.tmpdir(), `${hash}.json`);
  const tempPath = `${filePath}.tmp`;
  fs.writeFileSync(tempPath, JSON.stringify(paymentRequired, null, 2), "utf-8");
  fs.renameSync(tempPath, filePath);
  return { hash, filePath };
}

function loadPaymentRequiredFile(filePath) {
  let raw;
  try {
    raw = fs.readFileSync(filePath, "utf-8");
  } catch (e) {
    outputError(
      `Failed to read --paymentRequiredFilePath ${filePath}: ${e.message || e}`,
      true,
    );
    return;
  }
  try {
    return JSON.parse(raw);
  } catch (e) {
    outputError(
      `--paymentRequiredFilePath ${filePath} is not valid JSON: ${e.message || e}`,
      true,
    );
  }
}

function getRequiredAttestations(payment) {
  return (payment.extra && payment.extra.requiredAttestations) || [];
}

async function getMissingAttestations(did, payment) {
  const requiredAttestations = getRequiredAttestations(payment);
  const results = await Promise.all(
    requiredAttestations.map(async (id) => ({
      id,
      exists: await checkAttestation(did, id),
    })),
  );
  return results.filter((r) => !r.exists).map((r) => r.id);
}

async function createAttestationLinks(
  attestationSchemaIds,
  transactionSenderAddr,
  did,
  entry,
  kms,
) {
  return await Promise.all(
    attestationSchemaIds.map(async (attestationSchemaId) => {
      if (attestationSchemaId !== schemaId) {
        throw new Error(
          `Unknown attestation requirement with schema ${attestationSchemaId}`,
        );
      }
      const scope = [
        createPOUScope(transactionSenderAddr),
        createAuthScope(did),
      ];
      const signedChallenge = await signChallenge(
        { name: uuidv4(), description: uuidv4() },
        entry,
        kms,
      );
      return await createAuthRequestMessage(signedChallenge, scope);
    }),
  );
}

async function handleMissingAttestations(error, entry, kms) {
  const attestationLinks = await createAttestationLinks(
    error.attestationRequirements,
    transactionSender,
    entry.did,
    entry,
    kms,
  );
  outputInputRequired(
    {
      attestationsRequired: true,
      message: requiredAttestationsMessage,
      attestationLinks,
    },
    true,
  );
}

async function buildPaymentInfo(payment, entry, kms) {
  const requiredAttestations = getRequiredAttestations(payment);
  const missingAttestations = await getMissingAttestations(entry.did, payment);

  let attestationLinks = [];
  if (missingAttestations.length > 0) {
    attestationLinks = await createAttestationLinks(
      missingAttestations,
      transactionSender,
      entry.did,
      entry,
      kms,
    );
  }

  return {
    hash: getPaymentHash(payment),
    amount: payment.amount,
    asset: (payment.extra && payment.extra.name) || payment.asset,
    network: payment.network,
    requiredAttestations,
    hasAllAttestations: missingAttestations.length === 0,
    attestationLinks,
  };
}

function parseCliArgs() {
  return yargs(hideBin(process.argv))
    .scriptName("buildX402Payment")
    .usage(
      "$0 [options]\n\n" +
        "Execute the x402 payment flow in two phases.\n\n" +
        "Phase 1 — Discover (--resource only):\n" +
        "  Fetches the 402 challenge from the resource, caches the\n" +
        "  PAYMENT-REQUIRED payload to a temp file named by its hash, and\n" +
        "  returns { paymentRequiredFilePath, paymentOptions }. Never signs a\n" +
        "  payment. Pass --paymentHash here is an error.\n\n" +
        "Phase 2 — Execute (--paymentRequiredFilePath + --paymentHash):\n" +
        "  Reads the cached payment-required file, looks up the chosen option\n" +
        "  by --paymentHash, and signs/sends the payment. Cannot be combined\n" +
        "  with --resource.",
    )
    .option("resource", {
      type: "string",
      describe:
        "Phase 1 only. URL of the resource that returns 402 with a " +
        "PAYMENT-REQUIRED header. Mutually exclusive with " +
        "--paymentRequiredFilePath and --paymentHash.",
    })
    .option("paymentRequiredFilePath", {
      type: "string",
      describe:
        "Phase 2 only. Path to the cached payment-required JSON file " +
        "returned by phase 1. Must be combined with --paymentHash. " +
        "Mutually exclusive with --resource.",
    })
    .option("paymentHash", {
      type: "string",
      describe:
        "Phase 2 only. Hash of the payment option to execute (from phase 1's " +
        "paymentOptions[].hash). Must be combined with --paymentRequiredFilePath.",
    })
    .option("did", {
      type: "string",
      describe:
        "Optional. DID to use for signing. Defaults to the default DID in local storage.",
    })
    .example(
      "$0 --resource https://api.example.com/paid",
      "Phase 1: discover payment options and cache the challenge",
    )
    .example(
      "$0 --paymentRequiredFilePath /tmp/<hash>.json --paymentHash <hash>",
      "Phase 2: execute the selected payment from the cached challenge",
    )
    .example(
      "$0 --resource https://api.example.com/paid --did did:iden3:...",
      "Phase 1 with an explicit DID instead of the default",
    )
    .check((argv) => {
      const hasResource = Boolean(argv.resource);
      const hasFilePath = Boolean(argv.paymentRequiredFilePath);
      const hasHash = Boolean(argv.paymentHash);

      if (!hasResource && !hasFilePath) {
        throw new Error(
          "Provide --resource (phase 1) or --paymentRequiredFilePath + --paymentHash (phase 2).",
        );
      }
      if (hasResource && hasFilePath) {
        throw new Error(
          "--resource and --paymentRequiredFilePath are mutually exclusive. " +
            "Use --resource alone for phase 1, or " +
            "--paymentRequiredFilePath + --paymentHash for phase 2.",
        );
      }
      if (hasResource && hasHash) {
        throw new Error(
          "--paymentHash is not allowed with --resource. Run phase 1 with " +
            "--resource alone, then pass the returned paymentRequiredFilePath " +
            "together with --paymentHash in phase 2.",
        );
      }
      if (hasFilePath && !hasHash) {
        throw new Error(
          "--paymentHash is required with --paymentRequiredFilePath (phase 2).",
        );
      }
      return true;
    })
    .strict()
    .help("help")
    .alias("help", "h")
    .wrap(Math.min(120, yargs().terminalWidth()))
    .fail((msg, err, y) => {
      console.error(y.help());
      console.error(`\nError: ${msg || (err && err.message) || "invalid arguments"}`);
      process.exit(1);
    })
    .parse();
}

function requirePaymentResourceUrl(paymentRequired) {
  const paymentResource = paymentRequired.resource;
  if (!paymentResource || !paymentResource.url) {
    outputError("paymentRequired.resource.url is required", true);
    return null;
  }
  return paymentResource;
}

async function runDiscovery(args, entry, kms) {
  const paymentRequired = await fetchPaymentRequired(args.resource);
  const paymentResource = requirePaymentResourceUrl(paymentRequired);
  if (!paymentResource) return;

  const { filePath } = persistPaymentRequired(paymentRequired);
  const paymentOptions = await Promise.all(
    paymentRequired.accepts.map((p) => buildPaymentInfo(p, entry, kms)),
  );

  outputInputRequired(
    {
      resource: {
        url: paymentResource.url,
        description: paymentResource.description,
      },
      paymentOptions,
      paymentRequiredFilePath: filePath,
    },
    true,
  );
}

async function main() {
  try {
    const args = parseCliArgs();

    const { kms, memoryKeyStore, didsStorage } = await getInitializedRuntime();
    const entry = await getRequiredDidEntry(didsStorage, args.did);

    // Phase 1: --resource only. Fetch, cache, return options.
    if (args.resource) {
      await runDiscovery(args, entry, kms);
      return;
    }

    // Phase 2: --paymentRequiredFilePath + --paymentHash. Load file, find hash, execute.
    const paymentRequired = loadPaymentRequiredFile(args.paymentRequiredFilePath);
    const paymentResource = requirePaymentResourceUrl(paymentRequired);
    if (!paymentResource) return;

    const matched = paymentRequired.accepts.find(
      (p) => getPaymentHash(p) === args.paymentHash,
    );
    if (!matched) {
      outputError("No payment matching the provided --paymentHash", true);
      return;
    }
    paymentRequired.accepts = [matched];

    // Phase 2: Single payment - check attestations before proceeding
    const selectedPayment = paymentRequired.accepts[0];
    const missingAttestations = await getMissingAttestations(
      entry.did,
      selectedPayment,
    );

    if (missingAttestations.length > 0) {
      const attestationLinks = await createAttestationLinks(
        missingAttestations,
        transactionSender,
        entry.did,
        entry,
        kms,
      );
      outputInputRequired(
        {
          attestationsRequired: true,
          message: requiredAttestationsMessage,
          attestationLinks,
        },
        true,
      );
      return;
    }

    // Phase 4: Execute payment and fetch the resource
    const { wallet } = await getUserWallet(entry, memoryKeyStore);
    const signer = toClientEvmSigner(wallet);

    const x402 = new x402Client();
    x402.register("eip155:*", new ExactEvmScheme(signer));
    x402.registerExtension(
      createHumanProofExtension({
        address: wallet.address,
        pubKey: wallet.publicKey,
        signMessage: (msg) => wallet.signMessage({ message: msg }),
      }),
    );
    x402.onPaymentCreationFailure(async ({ error }) => {
      if (error instanceof MissingAttestationsError) {
        await handleMissingAttestations(error, entry, kms);
      }
    });

    let paymentPayload;
    try {
      paymentPayload = await x402.createPaymentPayload(paymentRequired);
    } catch (error) {
      if (error instanceof MissingAttestationsError) {
        return;
      } else {
        throw error;
      }
    }

    // Phase 5: Fetch the resource with the payment signature
    const paymentSignature = btoa(JSON.stringify(paymentPayload));
    const url = paymentResource.url;
    let response;
    response = await fetch(url, {
      headers: { "PAYMENT-SIGNATURE": paymentSignature },
    });

    if (response.status === 402) {
      console.log(response);
      if (isMaxUseExceededError({ response })) {
        outputInputRequired(
          {
            maxUseExceeded: true,
            message:
              "Payment has exceeded its maximum allowed uses. Choose a different payment or contact the resource provider.",
          },
          true,
        );
      }
      // if not max use exceeded, check for new payment required
      const newPaymentRequired = response.headers.get("payment-required");
      if (newPaymentRequired) {
        outputInputRequired({ newPaymentRequired: newPaymentRequired }, true);
        return;
      }
      outputError("Received 402 but no PAYMENT-REQUIRED header found", true);
      return;
    }

    const responseText = await response.text();
    let responseBody;
    try {
      responseBody = JSON.parse(responseText);
    } catch {
      responseBody = responseText;
    }

    if (response.ok) {
      outputSuccess(responseBody, true);
    } else {
      outputError(
        `HTTP ${response.status}: ${typeof responseBody === "string" ? responseBody : JSON.stringify(responseBody)}`,
        true,
      );
    }
  } catch (error) {
    outputError(error, true);
  }
}

main();

const { hexToBytes } = require("@0xpolygonid/js-sdk");
const { DidMethod, Blockchain, NetworkId } = require("@iden3/js-iden3-core");
const { SigningKey, Wallet, JsonRpcProvider } = require("ethers");
const { getInitializedRuntime } = require("./shared/bootstrap");
const {
  parseArgs,
  outputError,
  outputSuccess,
  addHexPrefix,
} = require("./shared/utils");

async function main() {
  try {
    const args = parseArgs();
    const {
      identityWallet,
      didsStorage,
      billionsMainnetConfig,
      revocationOpts,
    } = await getInitializedRuntime();

    // Use provided key or generate a new one
    let privateKeyHex = args.key;
    if (!privateKeyHex) {
      privateKeyHex = new SigningKey(Wallet.createRandom().privateKey)
        .privateKey;
    }

    // Create signer from private key
    const signer = new SigningKey(addHexPrefix(privateKeyHex));

    // Create wallet with Billions Network provider
    const wallet = new Wallet(
      signer,
      new JsonRpcProvider(billionsMainnetConfig.url),
    );

    // Create Ethereum-based identity
    let did;
    try {
      const result = await identityWallet.createEthereumBasedIdentity({
        method: DidMethod.Iden3,
        blockchain: Blockchain.Billions,
        networkId: NetworkId.Main,
        seed: hexToBytes(privateKeyHex),
        revocationOpts: revocationOpts,
        ethSigner: wallet,
        createBjjCredential: false,
      });
      did = result.did;
    } catch (err) {
      throw new Error(
        `Failed to create Ethereum-based identity: ${err.message}`,
      );
    }

    // Save DID to storage
    await didsStorage.save({
      did: did.string(),
      publicKeyHex: signer.publicKey,
      isDefault: true,
    });

    outputSuccess(did.string());
  } catch (error) {
    outputError(error, true);
  }
}

main();

const { randomInt } = require("crypto");
const { getInitializedRuntime } = require("./shared/bootstrap");
const { parseArgs, outputError, outputSuccess } = require("./shared/utils");

async function main() {
  try {
    const args = parseArgs();

    if (!args.did) {
      throw new Error(
        "--did parameter is required. Usage: node scripts/generateChallenge.js --did <did>",
      );
    }

    const { challengeStorage } = await getInitializedRuntime();

    // Generate random challenge
    const challenge = randomInt(0, 10000000000).toString();

    // Save challenge to storage
    await challengeStorage.save(args.did, challenge);

    outputSuccess(challenge);
  } catch (error) {
    outputError(error, true);
  }
}

main();

const { getInitializedRuntime } = require("./shared/bootstrap");
const {
  parseArgs,
  outputError,
  outputSuccess,
  createDidDocument,
  getRequiredDidEntry,
} = require("./shared/utils");

async function main() {
  try {
    const args = parseArgs();
    const { didsStorage } = await getInitializedRuntime();
    const entry = await getRequiredDidEntry(didsStorage, args.did);

    const didDocument = createDidDocument(entry.did, entry.publicKeyHex);

    outputSuccess({
      didDocument,
      did: entry.did,
    });
  } catch (error) {
    outputError(error, true);
  }
}

main();

const { getInitializedRuntime } = require("./shared/bootstrap");
const { outputError, outputSuccess } = require("./shared/utils");

async function main() {
  try {
    const { didsStorage } = await getInitializedRuntime();

    const identities = await didsStorage.list();

    if (identities.length === 0) {
      throw new Error(
        "No identities found. Create one with createNewEthereumIdentity.js",
      );
    }

    outputSuccess(identities);
  } catch (error) {
    outputError(error, true);
  }
}

main();

const {
  parseArgs,
  urlFormatting,
  outputSuccess,
  outputError,
  createAuthRequestMessage,
  getRequiredDidEntry,
} = require("./shared/utils");
const { getInitializedRuntime } = require("./shared/bootstrap");
const { signChallenge } = require("./signChallenge");
const { createPOUScope, createAuthScope } = require("./shared/scopes");
const {
  transactionSender,
  verificationMessage,
} = require("./shared/constants");

/**
 * Creates a pairing URL for linking a human identity to the agent.
 * @param {object} challenge - Challenge object with name and description fields.
 * @param {string} [didOverride] - Optional DID to use instead of the default.
 * @returns {Promise<string>} The wallet URL the human must open to complete verification.
 */
async function createPairing(challenge, didOverride) {
  const { kms, didsStorage } = await getInitializedRuntime();
  const entry = await getRequiredDidEntry(didsStorage, didOverride);

  const recipientDid = entry.did;
  const signedChallenge = await signChallenge(challenge, entry, kms);

  const scope = [
    createPOUScope(transactionSender),
    createAuthScope(recipientDid),
  ];
  return await createAuthRequestMessage(signedChallenge, scope);
}

async function main() {
  try {
    const args = parseArgs();

    if (!args.challenge) {
      throw new Error(
        "Invalid arguments. Usage: node linkHumanToAgent.js --challenge <json> [--did <did>]",
      );
    }

    const challenge = JSON.parse(args.challenge);
    const url = await createPairing(challenge, args.did);

    outputSuccess(urlFormatting(verificationMessage, url));
  } catch (error) {
    outputError(error, true);
  }
}

module.exports = { createPairing };

if (require.main === module) {
  main();
}

const { createPairing } = require("./linkHumanToAgent");
const { parseArgs, outputError } = require("./shared/utils");

async function main() {
  try {
    const args = parseArgs();

    if (!args.challenge) {
      throw new Error(
        'Invalid arguments. Usage: node manualLinkHumanToAgent.js --challenge <json> [--did <did>]\nExample: node manualLinkHumanToAgent.js --challenge \'{"name": "Agent Name", "description": "Short description of the agent"}\'',
      );
    }

    const challenge = JSON.parse(args.challenge);
    const url = await createPairing(challenge, args.did);

    console.log(url);
  } catch (error) {
    outputError(error, true);
  }
}

main();

{
  "name": "verified-agent-identity",
  "version": "1.0.0",
  "description": "Billions OpenClaw verification skill",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [
    "identity",
    "openclaw",
    "zk"
  ],
  "author": "BillionsNetwork",
  "license": "UNLICENSED",
  "dependencies": {
    "@0xpolygonid/js-sdk": "1.42.1",
    "@billionsnetwork/x402-human-proof-client": "^0.1.6",
    "@iden3/js-iden3-auth": "1.14.0",
    "@iden3/js-iden3-core": "1.8.0",
    "@noble/curves": "1.9.2",
    "@x402/core": "2.9.0",
    "@x402/evm": "2.9.0",
    "ethers": "6.13.4",
    "uuid": "11.0.3",
    "viem": "2.47.6",
    "yargs": "^18.0.0"
  }
}

const { ethers } = require("ethers");
const { DID } = require("@iden3/js-iden3-core");
const { schemaId: ATTESTATION_SCHEMA_ID } = require("./constants");

const ATTESTER_DID = ""; // string
const ATTESTER_IDEN3_ID = 0n; // uint256
const ATTESTER_ETH_ADDRESS = "0x0000000000000000000000000000000000000000"; // address

const EXPIRATION_TIME = 0n; // uint256 — 0 means no expiration
const REVOCABLE = false; // bool
const REF_ID =
  "0x0000000000000000000000000000000000000000000000000000000000000000"; // bytes32
const DATA = "0x"; // bytes

function extractIdFromDid(did) {
  return DID.idFromDID(DID.parse(did)).bigInt();
}

function buildJsonAttestation(req) {
  return {
    schemaId: ATTESTATION_SCHEMA_ID,
    attester: {
      did: ATTESTER_DID,
      iden3Id: ATTESTER_IDEN3_ID.toString(),
      ethereumAddress: ATTESTER_ETH_ADDRESS,
    },
    recipient: {
      did: req.recipientDid,
      iden3Id: extractIdFromDid(req.recipientDid).toString(),
      ethereumAddress: req.recipientEthAddress,
    },
    expirationTime: EXPIRATION_TIME.toString(),
    revocable: REVOCABLE,
    refId: REF_ID,
    data: DATA,
  };
}

function buildEncodedAttestation(req) {
  const encoded = ethers.AbiCoder.defaultAbiCoder().encode(
    [
      "bytes32", // schemaId
      "string", // attester.did
      "uint256", // attester.iden3Id
      "address", // attester.ethereumAddress
      "string", // recipient.did
      "uint256", // recipient.iden3Id
      "address", // recipient.ethereumAddress
      "uint256", // expirationTime
      "bool", // revocable
      "bytes32", // refId
      "bytes", // data
    ],
    [
      ATTESTATION_SCHEMA_ID,
      ATTESTER_DID,
      ATTESTER_IDEN3_ID,
      ATTESTER_ETH_ADDRESS,
      req.recipientDid,
      extractIdFromDid(req.recipientDid),
      req.recipientEthAddress,
      EXPIRATION_TIME,
      REVOCABLE,
      REF_ID,
      DATA,
    ],
  );
  return encoded;
}

function computeAttestationHash(req) {
  const hashHex = ethers.keccak256(buildEncodedAttestation(req));
  return (
    BigInt(hashHex) &
    BigInt("0x0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF")
  ).toString();
}

module.exports = {
  computeAttestationHash,
  buildJsonAttestation,
};

const {
  KMS,
  Sec256k1Provider,
  KmsKeyType,
  IdentityWallet,
  CredentialStatusType,
  EthStateStorage,
  CredentialStorage,
  IdentityStorage,
  InMemoryMerkleTreeStorage,
  CredentialStatusResolverRegistry,
  RHSResolver,
  CredentialWallet,
  defaultEthConnectionConfig,
  BjjProvider,
} = require("@0xpolygonid/js-sdk");

const { KeysFileStorage } = require("./storage/keys");
const { IdentitiesFileStorage } = require("./storage/identities");
const { DidsFileStorage } = require("./storage/did");
const { ChallengeFileStorage } = require("./storage/challenge");
const {
  rpcUrl,
  stateContractAddress,
  chainId,
  rhsUrl,
} = require("./constants");

let cachedRuntime = null;

/**
 * Creates and configures the KMS (Key Management System)
 */
async function newInMemoryKMS() {
  const memoryKeyStore = new KeysFileStorage("kms.json");
  const secpProvider = new Sec256k1Provider(
    KmsKeyType.Secp256k1,
    memoryKeyStore,
  );
  const bjjProvider = new BjjProvider(KmsKeyType.BabyJubJub, memoryKeyStore);
  const kms = new KMS();
  kms.registerKeyProvider(KmsKeyType.Secp256k1, secpProvider);
  kms.registerKeyProvider(KmsKeyType.BabyJubJub, bjjProvider);
  return { kms, memoryKeyStore };
}

/**
 * Creates Ethereum state storage for Billions Network
 */
function newEthStateStorage(billionsMainnetConfig) {
  return new EthStateStorage(billionsMainnetConfig);
}

/**
 * Creates data storage with credential, identity, merkle tree, and state storages
 */
function newDataStorage(ethStateStorage) {
  return {
    credential: new CredentialStorage(
      new IdentitiesFileStorage("credentials.json"),
    ),
    identity: new IdentityStorage(
      new IdentitiesFileStorage("identities.json"),
      new IdentitiesFileStorage("profiles.json"),
    ),
    mt: new InMemoryMerkleTreeStorage(40),
    states: ethStateStorage,
  };
}

/**
 * Creates credential wallet with credential status resolvers
 */
function newCredentialWallet(dataStorage) {
  const resolvers = new CredentialStatusResolverRegistry();
  resolvers.register(
    CredentialStatusType.Iden3ReverseSparseMerkleTreeProof,
    new RHSResolver(dataStorage.states),
  );
  return new CredentialWallet(dataStorage, resolvers);
}

/**
 * Creates identity wallet
 */
function newIdentityWallet(kms, dataStorage, credentialWallet) {
  return new IdentityWallet(kms, dataStorage, credentialWallet);
}

/**
 * Gets Billions Network mainnet configuration
 */
function getBillionsMainnetConfig() {
  return {
    ...defaultEthConnectionConfig,
    url: rpcUrl,
    contractAddress: stateContractAddress,
    chainId: chainId,
  };
}

/**
 * Gets default revocation options
 */
function getRevocationOpts() {
  return {
    type: CredentialStatusType.Iden3ReverseSparseMerkleTreeProof,
    id: rhsUrl,
  };
}

/**
 * Initializes and returns all runtime dependencies.
 * Uses caching to avoid re-initialization.
 *
 * @returns {Promise<Object>} Runtime object containing:
 *   - kms: Key Management System
 *   - identityWallet: Identity wallet instance
 *   - didsStorage: DID storage
 *   - challengeStorage: Challenge storage
 *   - billionsMainnetConfig: Billions Network configuration
 *   - revocationOpts: Revocation options
 */
async function getInitializedRuntime() {
  if (cachedRuntime) {
    return cachedRuntime;
  }

  const billionsMainnetConfig = getBillionsMainnetConfig();
  const revocationOpts = getRevocationOpts();

  const { kms, memoryKeyStore } = await newInMemoryKMS();
  const stateStorage = newEthStateStorage(billionsMainnetConfig);
  const dataStorage = newDataStorage(stateStorage);
  const credentialWallet = newCredentialWallet(dataStorage);
  const identityWallet = newIdentityWallet(kms, dataStorage, credentialWallet);

  const didsStorage = new DidsFileStorage("defaultDid.json");
  const challengeStorage = new ChallengeFileStorage("challenges.json");

  cachedRuntime = {
    kms,
    identityWallet,
    didsStorage,
    challengeStorage,
    billionsMainnetConfig,
    revocationOpts,
    memoryKeyStore,
  };

  return cachedRuntime;
}

module.exports = {
  getInitializedRuntime,
};

const transactionSender = "0xB3F5d3DD47F6ca17468898291491eBDA69a67797"; // relay sender address
const verifierDid =
  "did:iden3:privado:main:2SZu1G6YDUtk9AAY6TZic24CcCYcZvtdyp1cQv9cig"; // should be the same as dashboard DID
const callbackBase =
  "https://attestation-relay.billions.network/api/v1/callback?attestation=";
const walletAddress = "https://wallet.billions.network";
const verificationMessage =
  "Complete the verification to link your identity to the agent";
const requiredAttestationsMessage =
  "The following attestations are required to complete the payment:";
const pairingReasonMessage = "agent_pairing:v1";
const accept = [
  "iden3comm/v1;env=application/iden3-zkp-json;circuitId=authV2,authV3,authV3-8-32;alg=groth16",
];
const nullifierSessionId = "240416041207230509012302";
const pouScopeId = 1; // keccak256(nullifierSessionId)
const pouAllowedIssuer = [
  "did:iden3:billions:main:2VwqkgA2dNEwsnmojaay7C5jJEb8ZygecqCSU3xVfm",
];
const authScopeId = 2;
const urlShortener = "https://identity-dashboard.billions.network";
const schemaId =
  "0xca354bee6dc5eded165461d15ccb13aceb6f77ebbb1fd3fe45aca686097f2911";
const resolverUrl = "https://resolver.privado.id/1.0/identifiers";
const rpcUrl = "https://rpc-mainnet.billions.network";
const stateContractAddress = "0x3c9acb2205aa72a05f6d77d708b5cf85fca3a896";
const chainId = 45056;
const rhsUrl = "https://rhs-staging.polygonid.me";
const pouCredentialContext =
  "ipfs://QmcUEDa42Er4nfNFmGQVjiNYFaik6kvNQjfTeBrdSx83At";

module.exports = {
  transactionSender,
  verifierDid,
  callbackBase,
  walletAddress,
  verificationMessage,
  requiredAttestationsMessage,
  pairingReasonMessage,
  accept,
  nullifierSessionId,
  pouScopeId,
  pouAllowedIssuer,
  authScopeId,
  urlShortener,
  schemaId,
  resolverUrl,
  rpcUrl,
  stateContractAddress,
  chainId,
  rhsUrl,
  pouCredentialContext,
};

const { CircuitId } = require("@0xpolygonid/js-sdk");
const { computeAttestationHash } = require("./attestation");
const { buildEthereumAddressFromDid } = require("./utils");
const {
  nullifierSessionId,
  pouScopeId,
  pouAllowedIssuer,
  authScopeId,
  pouCredentialContext,
} = require("./constants");

function createPOUScope(transactionSender) {
  return {
    id: pouScopeId,
    circuitId: CircuitId.AtomicQueryV3OnChainStable,
    params: {
      sender: transactionSender,
      nullifierSessionId: nullifierSessionId,
    },
    query: {
      allowedIssuers: pouAllowedIssuer,
      type: "UniquenessCredential",
      context: pouCredentialContext,
    },
  };
}

function createAuthScope(recipientDid) {
  return {
    id: authScopeId,
    circuitId: CircuitId.AuthV3_8_32,
    params: {
      challenge: computeAttestationHash({
        recipientDid: recipientDid,
        recipientEthAddress: buildEthereumAddressFromDid(recipientDid),
      }),
    },
  };
}

module.exports = {
  createPOUScope,
  createAuthScope,
};

const fs = require("fs/promises");
const path = require("path");

class FileStorage {
  constructor(filename, baseDir = `${process.env.HOME}/.openclaw/billions`) {
    this.filePath = path.join(baseDir, filename);
  }

  async ensureDirectory() {
    const dir = path.dirname(this.filePath);
    await fs.mkdir(dir, { recursive: true });
  }

  async readFile() {
    try {
      const data = await fs.readFile(this.filePath, "utf-8");
      return JSON.parse(data);
    } catch (error) {
      if (error.code === "ENOENT") {
        return [];
      }
      throw error;
    }
  }

  async writeFile(data) {
    await this.ensureDirectory();
    const json = JSON.stringify(data, null, 2);
    const tempPath = `${this.filePath}.tmp`;
    await fs.writeFile(tempPath, json, "utf-8");
    await fs.rename(tempPath, this.filePath);
  }
}

module.exports = { FileStorage };

const { FileStorage } = require("./base");

class ChallengeFileStorage extends FileStorage {
  constructor(filename = "challenges.json") {
    super(filename);
  }

  async save(did, challenge) {
    const entries = await this.readFile();
    const created_at = new Date();

    const index = entries.findIndex((entry) => entry.did === did);

    if (index >= 0) {
      // Update existing entry
      entries[index] = { did, challenge, created_at };
    } else {
      // Add new entry
      entries.push({ did, challenge, created_at });
    }

    await this.writeFile(entries);
  }

  async find(did) {
    const entries = await this.readFile();
    return entries.find((entry) => entry.did === did);
  }

  async getChallenge(did) {
    const entry = await this.find(did);
    return entry?.challenge;
  }

  async list() {
    return this.readFile();
  }

  async delete(did) {
    const entries = await this.readFile();
    const initialLength = entries.length;
    const filtered = entries.filter((entry) => entry.did !== did);

    if (filtered.length < initialLength) {
      await this.writeFile(filtered);
      return true;
    }

    return false;
  }
}

module.exports = { ChallengeFileStorage };

"use strict";

const crypto = require("crypto");

const ALGORITHM = "aes-256-gcm";
const IV_BYTES = 12;
const TAG_BYTES = 16;

function getMasterKey() {
  const rawKey = process.env.BILLIONS_NETWORK_MASTER_KMS_KEY;

  if (typeof rawKey !== "string") {
    return null;
  }

  const trimmedKey = rawKey.trim();

  // Reject whitespace-only or too-short keys to avoid weak/blank-looking master keys.
  // Returning null keeps behavior consistent with the "no key configured" case.
  const MIN_MASTER_KEY_LENGTH = 16;
  if (trimmedKey.length < MIN_MASTER_KEY_LENGTH) {
    return null;
  }

  return trimmedKey;
}

function deriveAesKey(masterKeyString) {
  return crypto.createHash("sha256").update(masterKeyString, "utf8").digest();
}

function encryptKey(keyHex, masterKeyString) {
  const aesKey = deriveAesKey(masterKeyString);
  const iv = crypto.randomBytes(IV_BYTES);
  const cipher = crypto.createCipheriv(ALGORITHM, aesKey, iv, {
    authTagLength: TAG_BYTES,
  });

  const encrypted = Buffer.concat([
    cipher.update(keyHex, "utf8"),
    cipher.final(),
  ]);
  const authTag = cipher.getAuthTag();

  return [
    iv.toString("hex"),
    authTag.toString("hex"),
    encrypted.toString("hex"),
  ].join(":");
}

function decryptKey(encryptedPayload, masterKeyString) {
  const parts = encryptedPayload.split(":");
  if (parts.length !== 3) {
    throw new Error("Invalid encrypted key format in kms.json");
  }
  const [ivHex, authTagHex, ciphertextHex] = parts;

  const aesKey = deriveAesKey(masterKeyString);
  const iv = Buffer.from(ivHex, "hex");
  const authTag = Buffer.from(authTagHex, "hex");
  const ciphertext = Buffer.from(ciphertextHex, "hex");

  const decipher = crypto.createDecipheriv(ALGORITHM, aesKey, iv, {
    authTagLength: TAG_BYTES,
  });
  decipher.setAuthTag(authTag);

  try {
    return Buffer.concat([
      decipher.update(ciphertext),
      decipher.final(),
    ]).toString("utf8");
  } catch {
    throw new Error(
      "kms.json decryption failed: wrong BILLIONS_NETWORK_MASTER_KMS_KEY or file has been tampered with",
    );
  }
}

module.exports = { getMasterKey, encryptKey, decryptKey };

const { FileStorage } = require("./base");

/**
 * DidsFileStorage manages DID entries with default DID support
 */
class DidsFileStorage extends FileStorage {
  constructor(filename = "defaultDid.json") {
    super(filename);
  }

  async save({ did, publicKeyHex, isDefault = false }) {
    const entries = await this.readFile();

    // If setting this as default, unset all other defaults
    if (isDefault) {
      entries.forEach((entry) => {
        entry.isDefault = false;
      });
    }

    const index = entries.findIndex((entry) => entry.did === did);

    if (index >= 0) {
      entries[index] = { did, publicKeyHex, isDefault };
    } else {
      entries.push({ did, publicKeyHex, isDefault });
    }

    await this.writeFile(entries);
  }

  async find(did) {
    const entries = await this.readFile();
    return entries.find((entry) => entry.did === did);
  }

  async getDefault() {
    const entries = await this.readFile();
    return entries.find((entry) => entry.isDefault);
  }

  async list() {
    return this.readFile();
  }
}

module.exports = { DidsFileStorage };

const { FileStorage } = require("./base");

/**
 * IdentitiesFileStorage implements IDataSource<Type> interface from js-sdk
 */
class IdentitiesFileStorage extends FileStorage {
  async load() {
    return await this.readFile();
  }

  async save(key, value, keyName = "id") {
    const data = await this.readFile();
    const index = data.findIndex((item) => item[keyName] === key);

    if (index >= 0) {
      // Update existing item
      data[index] = value;
    } else {
      // Add new item
      data.push(value);
    }

    await this.writeFile(data);
  }

  async get(key, keyName = "id") {
    const data = await this.readFile();
    return data.find((item) => item[keyName] === key);
  }

  async delete(key, keyName = "id") {
    const data = await this.readFile();
    const filtered = data.filter((item) => item[keyName] !== key);

    if (filtered.length === data.length) {
      // Item not found, throw error to match expected behavior
      throw new Error(`Item with ${keyName}=${key} not found`);
    }

    await this.writeFile(filtered);
  }
}

module.exports = { IdentitiesFileStorage };

const { FileStorage } = require("./base");
const { getMasterKey, encryptKey, decryptKey } = require("./crypto");

/**
 * File-based storage for cryptographic keys.
 * Implements AbstractPrivateKeyStore interface from js-sdk.
 * Stores keys in JSON format as an array of per-entry versioned objects.
 */
class KeysFileStorage extends FileStorage {
  constructor(filename = "kms.json") {
    super(filename);
    // Holds raw on-disk entries that could not be decoded in this session
    // (e.g. encrypted entries when the master key env var is absent).
    // They are round-tripped untouched through writeFile so no data is lost.
    this._opaqueEntries = [];
  }

  _decodeEntry(entry) {
    // Legacy format
    if (Object.prototype.hasOwnProperty.call(entry, "privateKeyHex")) {
      return { alias: entry.alias, privateKeyHex: entry.privateKeyHex };
    }

    if (entry.version === 1) {
      const { alias, key } = entry.data;

      const { createdAt } = entry.data;

      if (entry.provider === "plain") {
        return { alias, privateKeyHex: key, createdAt };
      }

      if (entry.provider === "encrypted") {
        const masterKey = getMasterKey();
        if (!masterKey) {
          return { alias, _opaque: true, _raw: entry };
        }
        return { alias, privateKeyHex: decryptKey(key, masterKey), createdAt };
      }
    }

    throw new Error(
      `Unrecognised kms.json entry format: ${entry.alias || entry.data.alias || "unknown alias"}}`,
    );
  }

  _encodeEntry({ alias, privateKeyHex, createdAt }) {
    const masterKey = getMasterKey();
    if (masterKey) {
      return {
        version: 1,
        provider: "encrypted",
        data: { alias, key: encryptKey(privateKeyHex, masterKey), createdAt },
      };
    }
    return {
      version: 1,
      provider: "plain",
      data: { alias, key: privateKeyHex, createdAt },
    };
  }

  async readFile() {
    const raw = await super.readFile();
    if (!Array.isArray(raw)) {
      throw new Error("kms.json root must be an array");
    }
    const decoded = raw.map((entry) => this._decodeEntry(entry));
    // Stash raw on-disk objects for entries we cannot decode right now so
    // writeFile can round-trip them untouched.
    this._opaqueEntries = decoded.filter((e) => e._opaque).map((e) => e._raw);
    return decoded.filter((e) => !e._opaque);
  }

  async writeFile(keys) {
    const encoded = keys.map((entry) => this._encodeEntry(entry));
    await super.writeFile([...encoded, ...this._opaqueEntries]);
  }

  async importKey(args) {
    const keys = await this.readFile();
    const index = keys.findIndex((entry) => entry.alias === args.alias);

    if (index >= 0) {
      keys[index].privateKeyHex = args.key;
    } else {
      keys.push({
        alias: args.alias,
        privateKeyHex: args.key,
        createdAt: new Date().toISOString(),
      });
    }

    // update key under alias
    this._opaqueEntries = this._opaqueEntries.filter(
      (raw) => raw.data?.alias !== args.alias,
    );

    await this.writeFile(keys);
  }

  async get(args) {
    const keys = await this.readFile();
    const entry = keys.find((entry) => entry.alias === args.alias);
    return entry ? entry.privateKeyHex : "";
  }

  async list() {
    const keys = await this.readFile();
    return keys.map((entry) => ({
      alias: entry.alias,
      key: entry.privateKeyHex,
    }));
  }
}

module.exports = { KeysFileStorage };

const { auth } = require("@iden3/js-iden3-auth");
const { keyPath, KmsKeyType } = require("@0xpolygonid/js-sdk");
const { v7: uuid } = require("uuid");
const { secp256k1 } = require("@noble/curves/secp256k1");
const { privateKeyToAccount } = require("viem/accounts");
const {
  callbackBase,
  pairingReasonMessage,
  verificationMessage,
  verifierDid,
  walletAddress,
  accept,
  urlShortener,
} = require("../constants");

/**
 * Wraps fetch() with an AbortController timeout.
 */
async function fetchWithTimeout(url, options = {}, timeoutMs = 10000) {
  const controller = new AbortController();
  const timer = setTimeout(() => controller.abort(), timeoutMs);
  try {
    return await fetch(url, { ...options, signal: controller.signal });
  } finally {
    clearTimeout(timer);
  }
}

/**
 * Creates an Authorization Response Message for challenge signing
 */
function getAuthResponseMessage(did, challenge) {
  const { PROTOCOL_CONSTANTS } = require("@0xpolygonid/js-sdk");
  return {
    id: uuid(),
    thid: uuid(),
    from: did,
    to: "",
    type: PROTOCOL_CONSTANTS.PROTOCOL_MESSAGE_TYPE
      .AUTHORIZATION_RESPONSE_MESSAGE_TYPE,
    body: {
      message: challenge,
      scope: [],
    },
  };
}

/**
 * Derives the ethers Wallet for a DID entry.
 * No provider needed — message signing is a local operation.
 */
async function getUserWallet(entry, kms) {
  const { normalizeKey, addHexPrefix } = require("./index");

  const compressedPublicKey = secp256k1.Point.fromHex(
    normalizeKey(entry.publicKeyHex),
  ).toHex(true);

  const alias = keyPath(KmsKeyType.Secp256k1, compressedPublicKey);
  const privateKeyHex = await kms.get({ alias });
  if (!privateKeyHex) {
    throw new Error(`No private key found for the DID ${entry.did}`);
  }

  const wallet = privateKeyToAccount(addHexPrefix(privateKeyHex));

  return { wallet };
}

async function createAuthRequestMessage(jws, scope) {
  const callback = callbackBase + jws;

  const message = auth.createAuthorizationRequestWithMessage(
    pairingReasonMessage,
    verificationMessage,
    verifierDid,
    encodeURI(callback),
    {
      scope: scope,
      accept: accept,
    },
  );

  const shortenerResponse = await fetchWithTimeout(
    `${urlShortener}/shortener`,
    {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify(message),
    },
  );

  if (shortenerResponse.status !== 201) {
    throw new Error(
      `URL shortener failed with status ${shortenerResponse.status}`,
    );
  }

  const { url } = await shortenerResponse.json();

  return `${walletAddress}#request_uri=${url}`;
}

module.exports = {
  fetchWithTimeout,
  getAuthResponseMessage,
  getUserWallet,
  createAuthRequestMessage,
};

/**
 * Parses command line arguments into an object
 * Example: --did abc --key 123 => { did: 'abc', key: '123' }
 */
function parseArgs() {
  const args = {};
  for (let i = 2; i < process.argv.length; i++) {
    if (process.argv[i].startsWith("--")) {
      const key = process.argv[i].slice(2);
      const value = process.argv[i + 1];
      args[key] = value;
      i++;
    }
  }
  return args;
}

/**
 * Outputs success message to stdout
 */
function outputSuccess(data, exit = false) {
  console.log(JSON.stringify({ status: "success", data: data }, null, 2));
  if (exit) process.exit(0);
}

/**
 * Outputs error message to stdout and optionally exits the process
 */
function outputError(error, exit = false) {
  const message = error instanceof Error ? error.message : String(error);
  console.log(JSON.stringify({ status: "failed", data: message }, null, 2));
  if (exit) process.exit(1);
}

function outputInputRequired(data, exit = false) {
  console.log(JSON.stringify({ status: "input_required", data }, null, 2));
  if (exit) process.exit(0);
}

function urlFormatting(title, url) {
  return `[${title}](${url})`;
}

module.exports = {
  parseArgs,
  outputSuccess,
  outputError,
  outputInputRequired,
  urlFormatting,
};

const { bytesToHex } = require("@0xpolygonid/js-sdk");
const { DID, Id } = require("@iden3/js-iden3-core");
const { secp256k1 } = require("@noble/curves/secp256k1");

function buildEthereumAddressFromDid(did) {
  const ethereumAddress = Id.ethAddressFromId(DID.idFromDID(DID.parse(did)));
  return `0x${bytesToHex(ethereumAddress)}`;
}

/**
 * Creates a W3C DID document for an Ethereum-based identity
 */
function createDidDocument(did, publicKeyHex) {
  return {
    "@context": [
      "https://www.w3.org/ns/did/v1",
      "https://w3id.org/security/suites/secp256k1recovery-2020/v2",
    ],
    id: did,
    verificationMethod: [
      {
        id: `${did}#ethereum-based-id`,
        controller: did,
        type: "EcdsaSecp256k1RecoveryMethod2020",
        ethereumAddress: buildEthereumAddressFromDid(did),
        publicKeyHex: secp256k1.Point.fromHex(publicKeyHex.slice(2)).toHex(
          true,
        ),
      },
    ],
    authentication: [`${did}#ethereum-based-id`],
  };
}

module.exports = {
  buildEthereumAddressFromDid,
  createDidDocument,
};

const cli = require("./cli");
const did = require("./did");
const auth = require("./auth");
const { createHash } = require("crypto");

/**
 * Removes the "0x" prefix from a hexadecimal string if it exists
 */
function normalizeKey(keyId) {
  return keyId.startsWith("0x") ? keyId.slice(2) : keyId;
}

/**
 * Add hex prefix if missing
 */
function addHexPrefix(keyId) {
  return keyId.startsWith("0x") ? keyId : `0x${keyId}`;
}

/**
 * Retrieves a DID entry from storage, throwing if not found.
 * @param {object} didsStorage - The DID storage instance.
 * @param {string} [didOverride] - Optional specific DID to look up instead of the default.
 * @returns {Promise<object>} The DID entry.
 */
async function getRequiredDidEntry(didsStorage, didOverride) {
  const entry = didOverride
    ? await didsStorage.find(didOverride)
    : await didsStorage.getDefault();

  if (!entry) {
    const errorMsg = didOverride
      ? `No DID ${didOverride} found`
      : "No default DID found";
    throw new Error(errorMsg);
  }

  return entry;
}

function hashstr(str) {
  return createHash("sha256").update(str).digest("hex");
}

module.exports = {
  // Generic helpers
  normalizeKey,
  addHexPrefix,
  getRequiredDidEntry,
  hashstr,
  ...cli,
  ...did,
  ...auth,
};