\n`\nconst messageParameters = {\n message: 'Welcome to Affinity, your OTP: {{CODE}}'\n subject?: 'Your verification Code'\n htmlMessage?\n}\n\n{{CODE}} - will be replaced at the message by OTP\n```\n\nIf htmlMessage not provided, meesage parameter will be used\n\n`To finish registration:`\n\nNOTE: email/SMS with verification code (OTP) will be sent to the provided\nemail/phoneNumber, unless username is an arbitrary username.\n\n```ts\nconst wallet = await AffinidiWallet.completeSignUp(options, token, confirmationCode)\n```\n\n`token` - token from the previous step (value returned from the `initiateSignUp`).\n\n`confirmationCode` - OTP sent by AWS Cognito/SES. Parameter is required if\nemail/phoneNumber was given as a username, and is ignored in case when\nusername is an arbitrary username.\n\nTo re-send sign up confirmation code (in case when username is email/phoneNumber):\n\n```ts\nawait AffinidiWallet.resendSignUpConfirmationCode(options, token, messageParameters)\n```\n\n`token` - token returned by `initiateSignUp`.\n\n`messageParameters` - (optional) used to specify message, htmlMessage, subject, see signup method.\n\n##### Sign up with email/phoneNumber (example)\n\n```ts\nconst email = 'great_user@email.com'\nconst password = 'Password123'\nconst options = { env: 'dev' }\n\nconst token = await AffinidiWallet.initiateSignUpByEmail(options, email, password)\n\n// OTP is sent out by Cognito\nconst confirmationCode = '123456' // OTP from email/SMS\n\nconst wallet = await AffinidiWallet.completeSignUp(options, token, confirmationCode)\n```\n\nNow user can login\n\n- [with username and pasword](#initiate-instance-of-sdk-with-login-and-pasword) or\n\n- [make passwordless login](#passwordless-login)\n\n##### Sign up with arbitrary username (example)\n\n```ts\nconst username = 'great_user'\nconst password = 'Password123'\nconst options = { env: 'dev' }\n\nconst wallet = await AffinidiWallet.signUpWithUsername(options, username, password)\n```\n\nNow user can login with [username and pasword](#initiate-instance-of-sdk-with-login-and-pasword)\n\n#### Sign up to Affinity Wallet with already created DID/keys. (Create User at Affinity Wallet and store there user keys)\n\nUser already have created keys in advance, e.g.\n\n```ts\nconst { did, encryptedSeed } = await AffinidiWallet.createWallet(options, password)\n```\n\nSign up with already created keys:\n\n```ts\nconst keyParams = { encryptedSeed, password }\nconst email = 'example@affinity-project.org'\nconst userPassword = 'Password123'\nconst options = { env: 'dev' }\nconst messageParameters = { message: 'Welcome to Affinity, here is your OTP: {{CODE}}' } // (optional)\n\nconst token = await AffinidiWallet.initiateSignUpByEmail(options, email, userPassword, messageParameters)\nconst confirmationCode = '123456'\nconst wallet = await AffinidiWallet.completeSignUp(options, token, confirmationCode, keyParams)\n```\n\nOr, alternatively, if an arbitrary username is used\n\n```ts\nconst wallet = await AffinidiWallet.signUpWithUsername(options, username, password, keyParams)\n```\n\n#### Update Did Document (supported only for jolo method):\n\ninit SDK\n```ts\nconst wallet = await AffinidiWallet.openWalletByEncryptedSeed(options, encryptedSeed, password)\n// OR\nconst wallet = await AffinidiWallet.logInWithPassword(options, userName, userPassword)\n```\n\nThen\n```ts\nawait wallet.updateDidDocument(didDocument)\n```\n\nwhere didDocument - its valid signed didDocument\n\n#### Initiate instance of SDK with login and pasword\n\nTo initiate instance of wallet using just login and password (when user already signed up at Affinity,\nand if stored his keys at Affinity Guardian Wallet).\n\n```ts\nconst wallet = await AffinidiWallet.logInWithPassword(options, username, password)\n```\n\n`options` - (optional) used to specify environment stack (dev | staging | prod).\n\n#### Initiate instance of SDK with refreshToken\n\nTo initiate instance of wallet using refreshToken. \nTo get refreshToken use wallet.serializeSession() (for wallets with cognito, when logged in)\n\n> Take care about refresh token to save it in right place, its lifetime is 30 days. \n> To invalidate tokens please use wallet.logOut() method. \n> The best way to use only access token and re-login user each hour (lifetime of accessToken)\n\n```ts\nconst wallet = await AffinidiWallet.logInWithRefreshToken(options, refreshToken)\n```\n\n`options` - (optional) used to specify environment stack (dev | staging | prod).\n\n#### Passwordless login\n\nLogin to the network by username, registered in AWS Cognito.\n\n```ts\nconst token = await AffinidiWallet.initiateLogInPasswordless(options, login, messageParameters: MessageParameters )\n```\n\n`login` - email or phone number, at which confirmation code will be sent.\n\n`messageParameters` - (optional) used to specify message, htmlMessage, subject, see signup method.\n\nComplete login challenge and initiate instance of SDK:\n\n```ts\nconst wallet = await AffinidiWallet.completeLoginPasswordless(options, token, confirmationCode)\n```\n\n`token` - token from the previous step.\n\n`confirmationCode` - 6 digits code, generated and sent by AWS Cognito/SES.\n\n`completeLoginPasswordless` could return next errors: \n\n- `COR-5` Invalid confirmation OTP code was uses.\nAs part of error payload new session token is passed that should be used for continuation of completing a session with old OTP\n\n```ts\nimport retry from \"async-retry\";\n\nlet newToken;\ntry {\n const wallet = await AffinidiWallet.completeLoginPasswordless(options, token, invalidConfirmationCode)\n} catch (sdkError) {\n if (sdkError.code === 'COR-5') {\n newToken = sdkError.context.newToken\n }\n}\nconst wallet = await AffinidiWallet.completeLoginPasswordless(options, newToken, confirmationCode)\n\n```\n**CAUTION** for serverside SDK usage you should always use a token returned with error to continue process\n\nUp to 3 retries are possible. After 3 times new session should be used\n\n- `COR-13` Invalid confirmation OTP code was used 3 times or more. Use a `initiateLogInPasswordless` call to initiate a new session.\n- `COR-17` Confirmation code is expired. Lifetime of confirmation code is around 3 minutes. Use a `initiateLogInPasswordless` call to initiate a new session\n\n#### Password recovery\n\nNOTE: Password recovery is not possible with arbitrary username.\n\n```ts\nconst token = await AffinidiWallet.initiateForgotPassword(options, login, messageParameters)\n```\n\n`username` - email or phone number, at which confirmation code will be sent.\n\n`messageParameters` - (optional) used to specify message, htmlMessage, subject, see signup method.\n\nComplete change password challenge:\n\n```ts\nconst wallet = await AffinidiWallet.completeForgotPassword(options, token, confirmationCode)\n```\n\n`token` - token returned by `initiatePassword`\n\n`confirmationCode` - 6 digits code, generated and sent by AWS Cognito/SES.\n\n`newPassword` - new password for Cognito user.\n\n#### Change password\n\nUser have to be logged in to change password. Otherwise use [password recovery](#password-recovery).\n\n```ts\nawait wallet.changePassword(oldPassword, newPassword)\n```\n\n`oldPassword` - old password.\n\n`newPassword` - new password.\n\n#### Change username\n\n```ts\nconst token = await wallet.initiateChangeEmail(newEmail)\n```\nor\n```ts\nconst token = await wallet.initiateChangePhone(newPhone)\n```\n\n`newEmail` or `newPhone` - email address or phone number to be later used to log into cognito\n\nComplete change username challenge:\n\n```ts\nawait wallet.completeChangeEmailOrPhone(options, token, confirmationCode)\n```\n\n`token` - token returned on the previous step.\n\n`confirmationCode` - 6 digits code, generated and sent by AWS Cognito/SES.\n\n#### Sign Out\n\nSigns out current user from all devices. \nIt also invalidates all refresh tokens issued to a user. \nThe user's current access and Id tokens remain valid until their expiry. \nAccess and Id tokens expire one hour after they are issued.\n\n```ts\nawait wallet.logOut()\n```\n\n#### Serialize session\n\nReturns all active cognito tokens as json string \n{ \"accessToken\": \"eyJraWQiOiJHiLCJlxKU...\", \"idToken\": 'eyJraWQiOiJQYTVjZFwvKzVyb...\", \"refreshToken\": 'eyJjdHkiOiJKV1QiLCJ...\", \"expiresIn\": 1655544042964 }\n\n```ts\nawait wallet.serializeSession()\n```\n\n### Issuer\n\n#### Initiate credential offer request\n\n```ts\nconst jwtOptions = { audienceDid, expiresAt, nonce, callbackUrl }\n\nconst credentialOfferToken = await issuerWallet.generateCredentialOfferRequestToken(offeredCredentials, jwtOptions)\n```\n\n`audienceDid` (string) - audience of genreated token.\n\n`expiresAt` (isoString) - expires of genreated token.\n\n`nonce` (string) - nonce/jti of genreated token.\n\n`callbackUrl` (string)\n\n#### Initiate DID auth\n\n```ts\nconst jwtOptions = { audienceDid, expiresAt, nonce, callbackUrl }\n\nconst authDidRequestToken = await issuerWallet.generateDidAuthRequest(jwtOptions)\n```\n\n`audienceDid` (string) - audience of genreated token.\n\n`expiresAt` (isoString) - expires of genreated token.\n\n`nonce` (string) - nonce/jti of genreated token.\n\n`callbackUrl` (string)\n\n```ts\nconst offeredCredentials = [\n {\n type: 'IssuerCustomCredential',\n renderInfo,\n },\n]\n```\n\n`renderInfo` (optional) where issuer can define how that VC can be represented/shown.\n\nExample:\n\n```ts\nconst renderInfo = {\n logo: {\n url: 'https://miro.medium.com/fit/c/240/240/1*jbb5WdcAvaY1uVdCjX1XVg.png',\n },\n background: {\n url: 'https://i.imgur.com/0Mrldei.png',\n },\n text: {\n color: '#05050d',\n },\n}\n```\n\n`credentialOfferToken` can be passed to the wallet side, and let Wallet/Holder option to response\nto this offer if usser want take offered credentials.\n\n#### Validate Holder Response on Offer Request\n\n```ts\nconst { isValid, did, nonce, selectedCredentials } = await issuer.verifyCredentialOfferResponseToken(\n credentialOfferResponseToken,\n credentialOfferRequestToken,\n)\n```\n\n`credentialOfferRequestToken` (optional) - using when need check response against request (nonce, audience).\n\nValidates response token and verify signature, if verification not passed response `{ isValid: false }`\nif response is valid returns also `{ issuer, nonce, selectedCredentials }`.\n\n`did` - it's DID which signed that response.\n\n#### Sign multiple credentials\n\n```ts\nimport { VCV1Unsigned } from '@affinidi/vc-common'\nimport { VCSPhonePersonV1, getVCPhonePersonV1Context } from '@affinidi/vc-data'\nimport { buildVCV1Unsigned, buildVCV1Skeleton } from '@affinidi/vc-common'\n\nconst unsignedCredentials: VCV1Unsigned[] = [\n buildVCV1Unsigned({\n skeleton: buildVCV1Skeleton({\n id: 'urn:urn-5:...',\n credentialSubject: {\n data: {\n '@type': ['Person', 'PersonE', 'PhonePerson'],\n telephone: '+1 555 555 5555',\n },\n },\n holder: { id: 'did:...:...' },\n type: 'PhoneCredentialPersonV1',\n context: getVCPhonePersonV1Context(),\n }),\n issuanceDate: new Date().toISOString(),\n expirationDate: new Date(new Date().getTime() + 10 * 60 * 1000).toISOString(),\n }),\n]\n\nconst credentials = await signCredentials(credentialOfferResponseToken, unsignedCredentials)\n```\n\n`credentialOfferResponseToken` - credential offer response JWT.\n\n`credentialParams` - array of params for credentials, where `expiresAt` is optional.\n\n#### Generate signed credential\n\n```ts\nimport { VCSPhonePersonV1, getVCPhonePersonV1Context } from '@affinidi/vc-data'\n\nconst credentialSubject: VCSPhonePersonV1 = {\n data: {\n '@type': ['Person', 'PersonE', 'PhonePerson'],\n telephone: '+1 555 555 5555',\n },\n}\n\nconst credentialMetadata = {\n context: [getVCPhonePersonV1Context()],\n name: 'Phone Number',\n type: ['PhoneCredentialPersonV1'],\n}\n\nconst credential = await issuer.signCredential(\n credentialSubject,\n credentialMetadata,\n { credentialOfferResponseToken, requesterDid },\n expiresAt,\n)\n```\n\n`credentialSubject` - data which should be present in VC according to VC schema, must be a valid `VCV1Subject`.\n\n`credentialMetadata` - schema of credential (should be defined and Issuer and Verifier use the same,\nso verifier will be able to understand what kind of credential was created by Issuer).\n\n### Revocation\nSDK Support Issuing Revocable Credential based on [Revocation List 2020 W3C standard](https://w3c-ccg.github.io/vc-status-rl-2020)\n- [Concepts](https://w3c-ccg.github.io/vc-status-rl-2020/#core-concept)\n- [revocationlist2020credential](https://w3c-ccg.github.io/vc-status-rl-2020/#revocationlist2020credential)\n- [revocationlist2020status](https://w3c-ccg.github.io/vc-status-rl-2020/#revocationlist2020status)\n\n#### Revocation Flow\n\n[Revocation Flow](http://plant-uml.dev.affinity-project.org/png/jLPDRzj64BtpLmpSWoL391Nd9jG1tAG1X0PjO2NjmIMGrUwGt7h5tUw7L3VeV-yiIOkaR1q2j3vHtDcPD--z6TfBhn1kor8sKiWL_FeMBEurPrxg1cQZPoMTX-lbzN8Ew-0SMd1IOCAurnRWOkrSe7TSIMmyBC29XmjWhd-H66QzvD8mEhou6x9kqEubHxY_hxqtRfNd5I5YsuphNSvwM7cfGoFQ2qpb0wQK6KbmZIwAHP-14apFCu7xh4la7rDZzH_8VQPjbTDXAZHtET1JKRHehOFavWPkWw_XvYRfkqdVqC4Ak4Nc4OGKm6A0nJy3Ef_G9OheOrVTcTSFs9pS7rrqHZVKTQpL4jUJlYKjI06gt6YgnBZLZYw-jte7laQePLM3mZqgC6YTeLRa7e47QsETKka3bDAtiGEZXzSyvRpAYDawR3EfyprFdMS-kDIgD6gQVrTXWvRQIvcgjAN87PoAt_OlcmgE8KMH9J1kajhV1gd4eF07khbfQys-nWo2OYLJQn6zbab1JWdRgCaxsRtgVy8_yp49oQqVut6TRLR9gmpMvRVsohN5b4S5Z8UNB5uK83Gw8020VyMtZ-WNG4QN_j916PGYdfL20Ub0oqkPW3MYe-HRGGxPOhBuRc1lL2ho-_PuGC1dQ-z6HCEXbhm6R3WpBYXIs3q36Z6wMWS2kKK8Zjho6dYD_65gp0uZiDAZpU1Zjid8Qd9IRiZZPDLGffZSX2qLgb7Ci-GwWmqZqz96O3i7ix4dncOWPYDQMYaJO3Iaieql9Kr0n1aHFaHubFnr1Z_yDsJthGxeEXD7WjaJ3nsrGyTCY8uwre5gQHio43uaCgAhJtV6zN89zwUr5kFzEzKPlYUaZmG06sZmqCbuOAxVKUBDl9Yka9z_-VJZ2gwkrk-lhjeR8mzyEBdSIZQDEQa-j7nK5cO2InQK9zt_Hj3bCvUHJxwyMiQ_BwIpxft37BPZve8ncfw9lPePWusZ71uR8erHqij7T9Sd-xIlVNS6vQmpuBdZ-KI3Le8eJrp9Tq-EUluDwCmsAl8LujuwJibmGhijxh2f3F0R6O8r48o8dnAbAyax3tD9Qtra_qMhGkzjHlj6nk-4852qVsWHERqxXcU_Dz0EZ9oC_bhq3etQTiFZpwzdCZMQATfRGzzBOsM4UghcWTPVEvHj9oA3pzt3UTFC3ZI1J_5n8McQbXWpFoQpw8EDIwFjaEHhlpR30g6VoNFPxizkmvTcO4DfpuCaXhhC-URTJzr_EF-pwVu5)\n\n#### issuance of Revocable credential\n\n```ts\n const unsignedCredential = buildVCV1Unsigned({\n skeleton: buildVCV1Skeleton({\n id: `credId:${credId}`,\n credentialSubject: {\n data: {\n '@type': ['Person', 'PersonE', 'PhonePerson'],\n telephone: '+1 555 555 5555',\n },\n },\n holder: { id: holderDid },\n type: 'PhoneCredentialPersonV1',\n context: getVCPhonePersonV1Context(),\n }),\n issuanceDate: new Date().toISOString(),\n expirationDate: new Date(new Date().getTime() + 10 * 60 * 1000).toISOString(),\n })\n\n const revokableUnsignedCredential = await wallet.buildRevocationListStatus(\n unsignedCredential,\n accessToken,\n )\n\n```\n`buildRevocationListStatus` will add to **unsigned credential** special `credentialStatus` field with [revocationlist2020status](https://w3c-ccg.github.io/vc-status-rl-2020/#revocationlist2020status) data.\n\n#### Revocation of Revocable credential\n\n```\n await wallet.revokeCredential(credentialId, 'Status changed', accessToken)\n```\n\n`credentialId` - id of credential for revoke \n\n`revocation reason` - free text reason of revocation\n\n`accessToken`\n\n### Verifier\n\n#### Initiate Verifiable Presentation request (credential share request)\n\n##### Verifiable Presentation according to w3c spec structure flow:\n```ts\nconst jwtOptions = { audienceDid, expiresAt, nonce, callbackUrl }\n\nconst presentationChallenge = await verifier.generatePresentationChallenge(\n credentialRequirements,\n issuerDid,\n jwtOptions,\n)\n```\n\n`audienceDid` (string) - audience of genreated token.\n\n`expiresAt` (isoString) - expires of genreated token.\n\n`nonce` (number) - nonce/jti of genreated token.\n\n`callbackUrl` (string)\n\nGenerates JWT with info of which VC `credentialRequirements` to be provided from Wallet/Holder.\n\n```ts\nconst credentialRequirements = [{ type: ['Credential', 'ProofOfNameCredential'] }]\n```\n\n`callbackUrl` - (optional) Holder/Wallet will be able send response on this request to this URL.\n\n`issuerDid` - (optional) its contrain, that define required isser of VC.\n\n`credentialShareRequestToken` can be send to Wallet/Holder to anwser on this with response with requested VC inside.\n\n##### Verifiable Presentation as JWT method:\n\n```ts\nconst credentialShareRequestToken = await verifier.generateCredentialShareRequestToken(\n credentialRequirements,\n issuerDid,\n options,\n)\n```\n\nsee parameters description at `Verifiable Presentation according to w3c spec` section\n\n#### Validate Verifiable Presentation (Holder Response on Share Request)\n\n##### Verifiable Presentation according to w3c spec structure flow:\n```ts\nconst { isValid, did, challenge, suppliedPresentation } = await verifier.verifyPresentation(vp)\n```\n\n##### Verifiable Presentation as JWT method:\n```ts\nconst { isValid, did, nonce, suppliedCredentials } = await verifier.verifyCredentialShareResponseToken(\n credentialShareResponseToken,\n credentialShareRequestToken,\n shouldOwn,\n)\n```\n\n`credentialShareResponseToken` - (optional) using when need check response against request (when request have constrains).\n\n`shouldOwn` - (optional) Verify that subject is holder of VC. Default true as per W3C spec.\n\nIts validate response token and verify signature on provided VC inside, if verification not passed response `{ isValid: false }`.\nIf response is valid it returns also `{ did, nonce, suppliedCredentials }`.\n\n#### Validate Holder Response on Did auth Request\n\n```ts\nconst { isValid, did, nonce } = await verifier.verifyDidAuthResponse(authDidResponseToken, authDidRequestToken)\n```\n\nIts validate response token, if verification not passed response `{ isValid: false }`\nif response is valid returns also `{ did, nonce }`\n\n### Wallet\n\n#### Initialize region for storing credentials\n\nYou can specify AWS region where user credentials will be stored using optional\n`storageRegion` parameter (region should be a 3 character string correlating to\nan Alpha-3 country code).\n\n```ts\nconst options = {\n storageRegion: 'SGP'\n}\n```\n\n#### Create Verifiable Presentation (Response on credential share request)\n\n##### Verifiable Presentation according to w3c spec structure flow:\n\n```ts\nconst vp = await wallet.createPresentationFromChallenge(\n presentationChallenge,\n credentials,\n domain,\n)\n```\n\n`credentials` - credentials which Holder providing for Verifier.\n\n`callbackURL` - (optional)\n\n`domain` - (could be empty string)\n\n##### Verifiable Presentation as JWT method:\n```ts\nconst responseToken = await wallet.createCredentialShareResponseToken(\n credentialShareRequestToken,\n suppliedCredentials,\n expiresAt,\n)\n```\n\n`credentialShareRequestToken` (jwt) - previously generated request token.\n\n`suppliedCredentials` - credentials which Holder providing for Verifier.\n\n`expiresAt` (isoString) - (optional) expires of created token.\n\n\n#### Create Response on credential offer request\n\n```ts\nconst responseToken = await wallet.createCredentialOfferResponseToken(credentialOfferRequestToken)\n```\n\nAgree to recieve proposed credentials by the Issuer.\n\n#### Create Response on DID auth request\n\n```ts\nconst authDidResponseToken = await wallet.createDidAuthResponse(authDidRequestToken)\n```\n\n#### Claim Credential from credential offer request\nExchange `credentialOfferResponseToken` to a credentials from a callback url specified in request for offer.\n```ts\nconst credentials = await wallet.claimCredentials(credentialOfferRequestToken)\n```\n\nRequirements to a callback endpoint \n- accept `credentialOfferResponseToken` in a post body\n```json\n{\n \"credentialOfferResponseToken\": \"xxxxx.xxxxx.xxx\"\n}\n```\n- return an array of credentials in a payload\n\n```json\n{\n \"vcs\": []\n}\n```\n\nExpected errors \n- `COR-26` & `COR-19` - `credentialOfferRequestToken` validation errors \n- `COR-27` - failed to invoke callback url \n- `COR-28` - unsuccessful callback invocation. \n- `COR-29` - invalid response format. No credentials \n\n### Encrypted messages\n\n#### Create encrypted message\n\n```ts\nconst encryptedMessage = await wallet.createEncryptedMessage(toDid, object)\n```\n\n`toDid` - DID, string value of document to be resolved.\n\n`object` - value to be encrypted by public key.\n\n#### Read encrypted message\n\n```ts\nconst message = await wallet.readEncryptedMessage(encryptedMessage)\n```\n\n`encryptedMessage` - message to be decrypted.\n\n### Credentials vault\n\n```ts\nconst credentials = [ signedCredential ]\nconst storageRegion = 'SGP'\n\nawait wallet.saveCredentials(credentials, storageRegion)\n```\n\n`credentials` - array of credentials to store in the vault.\n\n`storageRegion` - (optional) AWS region where user's credentials will be stored.\nRegion should be a 3 character string correlating to an Alpha-3 country code.\n\n#### Get all credentials matching the shareRequestToken\n```ts\nconst credentials = await wallet.getCredentials(shareRequestToken)\n```\n\n`shareRequestToken` - optional parameter (if passed - returns VC,\nwhich match the request, if not - then returns all VCs).\n\n#### Get all credentials\n```ts\nconst credentials = await wallet.getCredentials(null)\n```\n\n#### Get a single credential\n```ts\nconst credential = await wallet.getCredentialById(credentialId)\n```\n\n#### Delete credential by ID\n\n```ts\nawait wallet.deleteCredential(credentialId)\n```\n\n## Affinidi Infra dependencies\nThis SDK using next Affinidi services:\n- affinidi registry (to anchor when applicable, resolve and update did/didDocument)\n- affinidi verifier (to build credential request)\n- affinidi issuer (to build credential offer and verify credential offer response)\n- affinidi wallet backend (to store endrypted seed and encrypted VC optioanlly as backup)\n- affinidi user management (using only when backup option for encrypted seed used)\n","readmeFilename":"README.md"}