A strong foundation.
Trust decisions need tighter contracts.

251:         )
252: 
253:         val bound = nonceOk && audOk
254:         return HolderBindingOutcome(
255:             bound = bound,
256:             checks = checks,
257:             error = if (bound) null else "Holder proof not bound to expected nonce/audience",
258:         )
259:     }
260: 
261:     /** Parse + verify a raw credential string (VC-LD JSON or compact SD-JWT VC) and map to the API shape. */

131:             var allValid = true
132:             val errors = mutableListOf<String>()
133:             credentials.forEachIndexed { index, credJson ->
134:                 val label = "Credential #${index + 1}"
135:                 val result = verifyCredential(credJson, policy)
136:                 result.fold(
137:                     onSuccess = { vr ->
138:                         val response = toResponse(vr, trustEvaluated = policy.checkIssuerTrust)
139:                         response.checks.forEach { c ->
140:                             checks += VerificationCheck("$label — ${c.name}", c.passed, c.detail)
141:                         }

214:         val verificationMethod = (proof["verificationMethod"] as? JsonPrimitive)?.content
215:         val holderField = (presentationJson["holder"] as? JsonPrimitive)?.content
216:         val holderDid = listOfNotNull(verificationMethod?.substringBefore('#'), holderField)
217:             .firstOrNull { it.startsWith("did:key:z") }
218:         if (holderDid == null) {
219:             checks += VerificationCheck("Resolve holder DID", false, "No holder did:key in proof.verificationMethod / holder")
220:             return HolderBindingOutcome(false, checks, "No holder did:key in presentation")
221:         }
222:         checks += VerificationCheck("Resolve holder DID", true, holderDid)
223: 
224:         val claims = runCatching {

188: 
189:         val result = runBlocking {
190:             verifier.verifyPresentation(
191:                 presentationJson = presentation,
192:                 expectedNonce = session.nonce,
193:                 expectedAudience = session.audience,
194:                 policy = policyResolver.forTrustSpace(session.trustSpaceId),
195:             )
196:         }
197: 
198:         val holderDid = presentation["holder"]?.toString()?.trim('"')

56:         @PathVariable sessionId: String,
57:         @RequestParam("vp_token") vpToken: String,
58:         @RequestParam("presentation_submission", required = false) presentationSubmission: String?,
59:         request: HttpServletRequest,
60:     ): ResponseEntity<Any> {
61:         rateLimiter.check("oid4vp-response:" + clientIp(request), maxRequests = 20, windowSeconds = 60)
62: 
63:         val session = requests.submitPresentation(sessionId, vpToken)
64:             ?: return ResponseEntity.notFound().build()
65: 
66:         return when (session.status) {

167:     @Transactional
168:     fun submitPresentation(sessionId: String, vpToken: String): VerificationSession? {
169:         val session = sessions.findById(sessionId).orElse(null) ?: return null
170: 
171:         if (session.status != VerificationSessionStatus.PENDING) {
172:             // Single-use: a second presentation against a completed session is refused rather than
173:             // silently overwriting the first verdict.
174:             return session
175:         }
176:         if (session.expiresAt.isBefore(Instant.now())) {
177:             return sessions.save(

105: 
106: @Repository
107: interface VerificationSessionRepository : JpaRepository<VerificationSession, String> {
108:     fun findByTrustSpaceIdOrderByCreatedAtDesc(trustSpaceId: Long): List<VerificationSession>
109: }

279:     }.getOrDefault(false)
280: 
281:     fun get(sessionId: String): VerificationSession? = sessions.findById(sessionId).orElse(null)
282: 
283:     fun listFor(trustSpaceId: Long): List<VerificationSession> =
284:         sessions.findByTrustSpaceIdOrderByCreatedAtDesc(trustSpaceId)
285: 
286:     private fun rejected(session: VerificationSession, reason: String) = session.copy(
287:         status = VerificationSessionStatus.REJECTED,
288:         resultJson = errorJson(reason),
289:         completedAt = Instant.now(),

34:         rateLimiter.check("oid4vp-request:" + clientIp(request), maxRequests = 30, windowSeconds = 60)
35:         val session = requests.get(sessionId) ?: return ResponseEntity.notFound().build()
36:         if (session.status != VerificationSessionStatus.PENDING) {
37:             return ResponseEntity.status(HttpStatus.GONE)
38:                 .body(mapOf("error" to "This verification request has already been used."))
39:         }
40:         return ResponseEntity.ok(requests.requestObject(session))
41:     }
42: 
43:     /**
44:      * Where the wallet posts the presentation.

76:     queryKey: ['verification-session', spaceIdNum, session?.id],
77:     queryFn: () => verificationRequestsApi.get(spaceIdNum, session!.id),
78:     enabled: !!session && session.status === 'PENDING',
79:     refetchInterval: POLL_MS,
80:   })
81: 
82:   const current = polled ?? session
83:   const result = current?.result
84: 
85:   const toggleType = (vcType: string) => {
86:     // The claims on offer belong to a specific type, so a change of type invalidates them.

73: 
74:     private fun clientIp(request: HttpServletRequest): String {
75:         val forwarded = request.getHeader("X-Forwarded-For")
76:         return if (!forwarded.isNullOrBlank()) forwarded.substringBefore(",").trim()
77:         else request.remoteAddr ?: "unknown"
78:     }
79: }
80: 
81: /**
82:  * The verifier's own API: create a request, watch for a result.
83:  *

22:     private data class Window(val windowStartEpochSec: Long, val count: Int)
23: 
24:     private val windows = ConcurrentHashMap<String, AtomicReference<Window>>()
25: 
26:     /**
27:      * Records one request against [key]. Throws [TooManyRequestsException] when more than
28:      * [maxRequests] requests are seen for [key] within any [windowSeconds] window.
29:      */
30:     fun check(key: String, maxRequests: Int, windowSeconds: Long) {
31:         val nowSec = System.currentTimeMillis() / 1000L
32:         var rejected = false

32:         var rejected = false
33: 
34:         val ref = windows.computeIfAbsent(key) { AtomicReference(Window(nowSec, 0)) }
35:         ref.updateAndGet { current ->
36:             if (nowSec - current.windowStartEpochSec >= windowSeconds) {
37:                 // Window elapsed: start a fresh window counting this request.
38:                 Window(nowSec, 1)
39:             } else if (current.count >= maxRequests) {
40:                 // Over the limit within the current window: reject, do not increment.
41:                 rejected = true
42:                 current

167:     // reads from different sources depending on the version. The Gradle test worker does not inherit
168:     // the shell environment, so both must be set explicitly here.
169:     val dockerHost = System.getenv("DOCKER_HOST") ?: "npipe:////./pipe/dockerDesktopLinuxEngine"
170:     environment("DOCKER_HOST", dockerHost)
171:     systemProperty("DOCKER_HOST", dockerHost)
172:     testLogging {
173:         events("passed", "skipped", "failed")
174:     }
175:     finalizedBy(tasks.jacocoTestReport)
176: }
177: 

30:   frontend:
31:     name: Frontend
32:     runs-on: ubuntu-latest
33:     defaults:
34:       run:
35:         working-directory: frontend
36:     steps:
37:       - uses: actions/checkout@v4
38: 
39:       - uses: actions/setup-node@v4
40:         with:

42: 
43:     const onKey = (e: KeyboardEvent) => {
44:       if (e.key === 'Escape' && dismissable) { e.stopPropagation(); onClose(); return }
45: 
46:       if (e.key === 'Tab' && dialogRef.current) {
47:         const focusable = Array.from(dialogRef.current.querySelectorAll<HTMLElement>(FOCUSABLE))
48:         if (focusable.length === 0) { e.preventDefault(); return }
49:         const first = focusable[0]
50:         const last = focusable[focusable.length - 1]
51:         if (e.shiftKey) {
52:           if (document.activeElement === first || document.activeElement === dialogRef.current) {

386:     </Modal>
387: 
388:     {scanHolderOpen && (
389:       <HolderDidScannerModal
390:         onClose={() => setScanHolderOpen(false)}
391:         onScan={(did) => setSubjectDid(did)}
392:       />
393:     )}
394:     </>
395:   )
396: }

56:       title={title}
57:       size="md"
58:       z={60}
59:       onClose={close}
60:       footer={
61:         <button type="button" onClick={close} className="btn btn-secondary btn-sm">
62:           Cancel
63:         </button>
64:       }
65:     >
66:       {hint && <p className="text-sm text-surface-500 mb-4">{hint}</p>}

7: import { Login } from './components/Login'
8: import Layout from './components/Layout'
9: import Dashboard from './pages/Dashboard'
10: import TrustSpaces from './pages/TrustSpaces'
11: import Issuers from './pages/Issuers'
12: import CheckCredential from './pages/CheckCredential'
13: import CredentialTypes from './pages/CredentialTypes'
14: import StarterKits from './pages/StarterKits'
15: import AuditLogs from './pages/AuditLogs'
16: import Credentials, { DocumentsRedirect } from './pages/Credentials'
17: import PeopleAndAgents from './pages/PeopleAndAgents'

72:           repository: geoknoesis/trustweave
73:           # Defaults to main; workflow_dispatch can point at a branch carrying an unmerged fix.
74:           ref: ${{ inputs.trustweave_ref || 'main' }}
75:           path: trustweave-lib
76:           token: ${{ secrets.TRUSTWEAVE_REPO_TOKEN || github.token }}
77: 
78:       - name: Place the library where the composite build expects it
79:         run: mv trustweave-lib ../trustweave
80: 
81:       - uses: actions/setup-java@v4
82:         with:

172:     private fun extractCredentials(presentationJson: JsonObject): List<JsonObject> {
173:         return when (val node = presentationJson["verifiableCredential"]) {
174:             is JsonArray -> node.mapNotNull { it as? JsonObject }
175:             is JsonObject -> listOf(node)
176:             else -> emptyList()
177:         }
178:     }
179: 
180:     private data class HolderBindingOutcome(
181:         val bound: Boolean,
182:         val checks: List<VerificationCheck>,

308:         }
309:         if (filter.revoked != null) {
310:             val isRevoked = credential.credentialStatus != null
311:             if (isRevoked != filter.revoked) return false
312:         }
313:         return true
314:     }
315: 
316:     /**
317:      * Get wallet statistics.
318:      */

335:                 } ?: false
336:             },
337:             revokedCredentials = allCredentials.count { it.credentialStatus != null },
338:             collectionsCount = 0, // Would require collection implementation
339:             tagsCount = 0, // Would require tag implementation
340:             archivedCount = 0 // Would require archive implementation
341:         )
342:     }
343: 
344:     /**
345:      * Encrypt data using AES/GCM/NoPadding with a fresh random 12-byte IV.

1044:             // filter.revoked=true  → returns only credentials that have a status entry
1045:             // filter.revoked=false → returns only credentials that have no status entry
1046:             val hasStatusEntry = credential.credentialStatus != null
1047:             if (hasStatusEntry != filter.revoked) return false
1048:         }
1049:         return true
1050:     }
1051: 
1052:     /**
1053:      * Get wallet statistics.
1054:      */

346:                     SELECT credential_data FROM credentials
347:                     WHERE wallet_id = ? AND archived = FALSE
348:                     LIMIT 1000
349:                 """).use { stmt ->
350:                     stmt.setString(1, walletId)
351:                     stmt.executeQuery().use { rs ->
352:                         while (rs.next()) {
353:                             val credentialJson = rs.getString("credential_data")
354:                             rawResults.add(json.decodeFromString(VerifiableCredential.serializer(), credentialJson))
355:                         }
356:                     }

367: 
368:             // Apply in-memory filter after the truncation check so the warning fires on raw size.
369:             if (filter == null) rawResults else rawResults.filter { matchesFilter(it, filter) }
370:         } catch (e: Exception) {
371:             if (e is CancellationException) throw e
372:             throw WalletException.StorageError(
373:                 operation = "list",
374:                 reason = "Failed to list credentials: ${e.message}",
375:                 cause = e
376:             )
377:         }

176:         }
177: 
178:         Files.write(credentialFile, content, StandardOpenOption.CREATE, StandardOpenOption.TRUNCATE_EXISTING, StandardOpenOption.WRITE)
179: 
180:         // Initialize metadata if not exists. The sidecar embeds the raw credential id
181:         // (ids can be PII-bearing URNs), so it is protected with the same AES-GCM
182:         // scheme as the credential file whenever an encryption key is configured.
183:         val metadataFile = resolveDataFile(metadataDir, id)
184:         if (!Files.exists(metadataFile)) {
185:             val metadata = buildJsonObject {
186:                 put("credentialId", id)

166:     // CredentialStorage implementation
167:     override suspend fun store(credential: VerifiableCredential): String = withContext(Dispatchers.IO) {
168:         val id = credential.id?.value ?: UUID.randomUUID().toString()
169:         val credentialJson = json.encodeToString(VerifiableCredential.serializer(), credential)
170: 
171:         val credentialFile = resolveDataFile(credentialsDir, id)
172:         val content = if (secretKey != null) {
173:             encrypt(credentialJson)
174:         } else {
175:             credentialJson.toByteArray(Charsets.UTF_8)
176:         }

78:     private val verifier: CredentialService? = didResolver?.let { credentialService(it) }
79: 
80:     private val offers = ConcurrentHashMap<String, Oidc4VciOffer>()
81:     private val requests = ConcurrentHashMap<String, Oidc4VciCredentialRequest>()
82:     private val accessTokens = ConcurrentHashMap<String, String>() // requestId -> accessToken
83:     private val cNonces = ConcurrentHashMap<String, String>()
84: 
85:     // requestId -> c_nonce from token/credential endpoint
86:     @Volatile private var metadata: CredentialIssuerMetadata? = null
87: 
88:     /** Token endpoint resolved from the authorization server's RFC 8414 metadata (cached). */

80:     private val offers = ConcurrentHashMap<String, Oidc4VciOffer>()
81:     private val requests = ConcurrentHashMap<String, Oidc4VciCredentialRequest>()
82:     private val accessTokens = ConcurrentHashMap<String, String>() // requestId -> accessToken
83:     private val cNonces = ConcurrentHashMap<String, String>()
84: 
85:     // requestId -> c_nonce from token/credential endpoint
86:     @Volatile private var metadata: CredentialIssuerMetadata? = null
87: 
88:     /** Token endpoint resolved from the authorization server's RFC 8414 metadata (cached). */
89:     @Volatile private var resolvedTokenEndpoint: String? = null
90: 

442:      * Parses the `credential` member of an issuer response into a [VerifiableCredential].
443:      *
444:      * Only VC-LD (JSON-LD) is supported today. Compact representations (JWT / SD-JWT-VC) have no
445:      * compact-to-model parser in `credential-api`, so they are rejected rather than trusted.
446:      */
447:     private suspend fun parseIssuedCredential(
448:         response: JsonObject,
449:         expectedIssuer: String,
450:     ): VerifiableCredential {
451:         val raw = response["credential"]
452:         if (raw == null || raw is JsonNull) {

461:                 is JsonPrimitive -> throw Oidc4VciException.CredentialVerificationFailed(
462:                     reason =
463:                         "compact (JWT / SD-JWT-VC) issued credentials are not yet verified; " +
464:                             "only VC-LD (JSON-LD) is supported",
465:                     credentialIssuer = expectedIssuer,
466:                 )
467:                 else -> throw Oidc4VciException.CredentialVerificationFailed(
468:                     reason = "unsupported 'credential' representation: ${raw::class.simpleName}",
469:                     credentialIssuer = expectedIssuer,
470:                 )
471:             }

21:   did: string
22:   publicKey: string  // base64url
23:   privateKey: string  // base64url
24:   createdAt: string
25: }
26: 
27: export interface StoredCredential {
28:   id: string  // local UUID for the wallet's record
29:   format: 'vc+jwt' | 'vc+sd-jwt'
30:   credential: string  // the credential as-issued (VC-JWT or SD-JWT VC compact form)
31:   receivedAt: string

73:   if (!isBrowser()) throw new Error('saveHolder requires a browser environment')
74:   ensureSchemaVersion()
75:   window.localStorage.setItem(HOLDER_KEY, JSON.stringify(holder))
76: }
77: 
78: export function loadCredentials(): StoredCredential[] {
79:   if (!isBrowser()) return []
80:   ensureSchemaVersion()
81:   const raw = window.localStorage.getItem(CREDENTIALS_KEY)
82:   return raw ? (JSON.parse(raw) as StoredCredential[]) : []
83: }

53:   if (!existing) {
54:     window.localStorage.setItem(VERSION_KEY, String(CURRENT_VERSION))
55:   } else if (Number(existing) !== CURRENT_VERSION) {
56:     // v1 → v2: storage shape changed (added `format`, `credential` replaces `vcJwt`,
57:     // added `selectivelyDisclosable`). No automatic migration — wipe and let the user
58:     // re-receive. Acceptable for a demo wallet; a real wallet would migrate in place.
59:     window.localStorage.removeItem(HOLDER_KEY)
60:     window.localStorage.removeItem(CREDENTIALS_KEY)
61:     window.localStorage.setItem(VERSION_KEY, String(CURRENT_VERSION))
62:   }
63: }

4:   "private": true,
5:   "description": "Walking-skeleton holder wallet demo for the TrustWeave Wallet SDK",
6:   "scripts": {
7:     "dev": "next dev",
8:     "build": "next build",
9:     "start": "next start",
10:     "lint": "next lint",
11:     "typecheck": "tsc --noEmit",
12:     "resize-demo-photos": "python scripts/resize-demo-photos.py",
13:     "generate-subject-portraits": "python scripts/generate-subject-portraits.py"
14:   },

35: 
36:       - name: Build with Gradle
37:         run: ./gradlew build --no-daemon --stacktrace

15: # Module maturity matrix
16: 
17: TrustWeave is a multi-module repository. **Publishing a JAR to Maven Central does not imply the module is complete or recommended for all production use cases.** This matrix states intended support level for integrators.
18: 
19: | Tier | Meaning |
20: |------|--------|
21: | **Supported (GA)** | Intended for production use when configured correctly; breaking API changes follow semver + [Deprecation policy](deprecation-policy.md). |
22: | **Supported with provider** | Core APIs are stable; you must use a mature KMS/DID/anchor **implementation** you trust. |
23: | **Experimental** | APIs may change; may contain `TODO` or stub behavior—verify in your environment before production. |
24: 
25: ## Core platform (typical SDK dependencies)

78:             chainId = chainId,
79:             operation = "submitTransaction",
80:             reason = "The StarkNet anchor client is a stub and is not implemented: " +
81:                 "transaction submission would require a StarkNet SDK and a Cairo storage " +
82:                 "contract, neither of which exists."
83:         )
84:     }
85: 
86:     override protected suspend fun readTransactionFromBlockchain(txHash: String): AnchorResult {
87:         throw BlockchainException.UnsupportedOperation(
88:             chainId = chainId,