Upgrade Phases 3+5: bifold 3.0.16 + credo-ts 0.6.3 + React 19 + DTG/VC 2.0

.github/actions/setup-node/action.yaml

@@ -12,10 +12,12 @@ runs:
   using: composite
   steps:
     - name: Setup node v${{ inputs.node-version }}
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         node-version: ${{ inputs.node-version }}
         registry-url: 'https://registry.npmjs.org/'
+        always-auth: true
+        scope: '@bifold'
 
     - name: Enable corepack and setup Yarn 4.9.2
       shell: bash

.github/workflows/main.yaml

@@ -1,22 +1,12 @@
+# Native iOS/Android sample-app builds are disabled below (no CI credentials in this repo).
+# Code quality CI runs in quality.yaml. KeyRing native builds run in keyring-wallet staging.yaml.
 name: Native Build
 
 env:
   cacheId: '11' # increment to expire the cache
 
 on:
-  pull_request:
-    branches: [main]
-    paths:
-      - '.github/workflows/main.yaml'
-      - '.github/workflows/publish.yaml'
-      - '.github/actions/setup-node/action.yaml'
-      - 'packages/**'
-      - 'samples/**'
-      - 'package.json'
-      - 'yarn.lock'
-    types: [opened, synchronize, reopened, labeled]
-  push:
-    branches: [main]
+  workflow_dispatch:
 
 jobs:
   # build-ios: # DISABLED - needs correct context and credentials

.github/workflows/maintenance.yaml

@@ -15,7 +15,7 @@ jobs:
     name: Issue and PR
     steps:
       - name: Prune stale issues
-        uses: actions/stale@v9
+        uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: 375 # 1 year

.github/workflows/publish.yaml

@@ -1,5 +1,6 @@
 name: Update Release PR or Publish
 on:
+  workflow_dispatch:
   push:
     branches:
       - main
@@ -10,20 +11,22 @@ on:
       - 'packages/**'
       - 'package.json'
       - 'yarn.lock'
+      - '.changeset/**'
 
 permissions:
   pull-requests: write
   contents: write
+  id-token: write
 
 jobs:
   release:
     name: Release
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout bifold-wallet
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.11'
 
@@ -34,29 +37,28 @@ jobs:
         run: |
           yarn install --immutable
 
-      - name: Disable husky hooks
+      - name: Upgrade npm for Trusted Publishers support
         run: |
-          yarn husky uninstall
+          npm install -g npm@^11
 
       - name: Update release PR or publish to npm
         id: changesets
-        uses: changesets/action@v1
+        uses: changesets/action@e0145edc7d9d8679003495b11f87bd8ef63c0cba # v1.5.3
         with:
           title: 'chore(release): new version'
           commit: 'chore(release): new version'
           publish: yarn release
           version: yarn changeset-version
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_PUBLISH }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH }}
+          NPM_CONFIG_PROVENANCE: true
 
       - name: Get current package version
         id: get_version
-        run: echo "CURRENT_PACKAGE_VERSION=$(node -p "require('./packages/core/package.json').version")" >> $GITHUB_ENV
+        run: echo "version=$(node -p "require('./packages/core/package.json').version")" >> $GITHUB_OUTPUT
 
       - name: Create GitHub release
         if: "startsWith(github.event.head_commit.message, 'chore(release): new version')"
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631 # v2.2.2
         with:
-          tag_name: v${{ env.CURRENT_PACKAGE_VERSION }}
+          tag_name: v${{ steps.get_version.outputs.version }}

.github/workflows/quality.yaml

@@ -13,9 +13,9 @@ jobs:
     name: Linting and formatter
     steps:
       - name: Checkout aries-mobile-agent-react-native
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.11'
 
@@ -54,9 +54,9 @@ jobs:
     name: Testing
     steps:
       - name: Checkout aries-mobile-agent-react-native
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.11'
 
@@ -75,7 +75,7 @@ jobs:
         run: |
           yarn coverage
 
-      - uses: codecov/codecov-action@v5
+      - uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
         if: always()

.github/workflows/repolinter.yaml

@@ -12,12 +12,12 @@ jobs:
     container: ghcr.io/todogroup/repolinter:v0.10.1
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - name: Lint Repo
         continue-on-error: true
         run: bundle exec /app/bin/repolinter.js --rulesetUrl https://raw.githubusercontent.com/hyperledger-labs/hyperledger-community-management-tools/master/repo_structure/repolint.json --format markdown | tee /repolinter-report.md
       - name: Save repolinter-report file
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: repolinter-report
           path: /repolinter-report.md

.prettierrc

@@ -1,5 +1,6 @@
 {
   "printWidth": 120,
   "semi": false,
-  "singleQuote": true
+  "singleQuote": true,
+  "trailingComma": "es5"
 }

.tool-versions

@@ -1,4 +1,5 @@
 nodejs 20.19.2
 python 3.11.2
 java zulu-17.56.15
-yarn 4.9.2
+yarn 4.9.2
+ruby 3.3.6

.yarn/patches/@animo-id-expo-secure-environment-npm-0.1.5-3c2a8f1b94.patch

@@ -0,0 +1,18 @@
+diff --git a/android/build.gradle b/android/build.gradle
+index cde6a970a43cc930546e59a80e8716a0980bc503..f7dc11cd461beedda314f3700dc42623d82a4029 100644
+--- a/android/build.gradle
++++ b/android/build.gradle
+@@ -40,6 +40,13 @@
+     lintOptions {
+         abortOnError false
+     }
++    compileOptions {
++        sourceCompatibility JavaVersion.VERSION_17
++        targetCompatibility JavaVersion.VERSION_17
++    }
++    kotlinOptions {
++        jvmTarget = "17"
++    }
+ }
+
+ dependencies {

.yarn/patches/@credo-ts-core-npm-0.5.17-c528a69dd8.patch → .yarn/patches/@credo-ts-core-npm-0.5.19-0177059ca8.patch

@@ -1,8 +1,8 @@
 diff --git a/build/modules/dif-presentation-exchange/DifPresentationExchangeService.js b/build/modules/dif-presentation-exchange/DifPresentationExchangeService.js
-index f1723e774dc337b8ceae11cf5765d222fd07ea24..556fcef6877b0248134182551e6b46ebe9a758e4 100644
+index 12df3a49c3e7b1774fa18ef1a4e45ebb600d2da4..ba41b17660c2a4a5a53a1428c27bc304d662ed95 100644
 --- a/build/modules/dif-presentation-exchange/DifPresentationExchangeService.js
 +++ b/build/modules/dif-presentation-exchange/DifPresentationExchangeService.js
-@@ -177,7 +177,18 @@ let DifPresentationExchangeService = class DifPresentationExchangeService {
+@@ -178,7 +178,18 @@ let DifPresentationExchangeService = class DifPresentationExchangeService {
              presentationSubmission.descriptor_map.push(...descriptorMap);
          });
          return {

.yarn/patches/@credo-ts-core-npm-0.6.3-28b59086b0.patch

@@ -0,0 +1,69 @@
+diff --git a/build/modules/vc/models/credential/W3cCredential.d.mts b/build/modules/vc/models/credential/W3cCredential.d.mts
+index 6ecceb006c81a8f7dba8500b18e217c3d6b8c192..6df40bc454dec759ac878f20cb4eec9e74b742d0 100644
+--- a/build/modules/vc/models/credential/W3cCredential.d.mts
++++ b/build/modules/vc/models/credential/W3cCredential.d.mts
+@@ -10,7 +10,7 @@ interface W3cCredentialOptions {
+   id?: string;
+   type: Array<string>;
+   issuer: string | W3cIssuerOptions;
+-  issuanceDate: string;
++  issuanceDate?: string;
+   expirationDate?: string;
+   credentialSubject: SingleOrArray<W3cCredentialSubjectOptions>;
+   credentialStatus?: W3cCredentialStatus;
+@@ -22,7 +22,7 @@ declare class W3cCredential {
+   id?: string;
+   type: Array<string>;
+   issuer: string | W3cIssuer;
+-  issuanceDate: string;
++  issuanceDate?: string;
+   expirationDate?: string;
+   credentialSubject: SingleOrArray<W3cCredentialSubject>;
+   credentialSchema?: SingleOrArray<W3cCredentialSchema>;
+diff --git a/build/modules/vc/models/credential/W3cCredential.mjs b/build/modules/vc/models/credential/W3cCredential.mjs
+index f3ad42c21d31e28b0f297416f17d7e560454082d..783cae8b47016777ac82d96f599319e8cfd63b3d 100644
+--- a/build/modules/vc/models/credential/W3cCredential.mjs
++++ b/build/modules/vc/models/credential/W3cCredential.mjs
+@@ -66,7 +66,13 @@ __decorate([
+ 	IsW3cIssuer(),
+ 	__decorateMetadata("design:type", Object)
+ ], W3cCredential.prototype, "issuer", void 0);
+-__decorate([IsRFC3339(), __decorateMetadata("design:type", String)], W3cCredential.prototype, "issuanceDate", void 0);
++// KEYRING PATCH (VCDM 2.0): issuanceDate is v1.1-only; VCDM 2.0 credentials
++// use validFrom instead, so the property must be optional to accept them.
++__decorate([
++	IsRFC3339(),
++	IsOptional(),
++	__decorateMetadata("design:type", String)
++], W3cCredential.prototype, "issuanceDate", void 0);
+ __decorate([
+ 	IsRFC3339(),
+ 	IsOptional(),
+diff --git a/build/modules/vc/validators.mjs b/build/modules/vc/validators.mjs
+index 1dc281ee34c7ee80285bf99008d2fa2bd85ef0e2..4fe87ad71253a0af11cae2f52be8f8eb8a041b8c 100644
+--- a/build/modules/vc/validators.mjs
++++ b/build/modules/vc/validators.mjs
+@@ -5,15 +5,21 @@ import { CREDENTIALS_CONTEXT_V1_URL, VERIFIABLE_CREDENTIAL_TYPE, VERIFIABLE_PRES
+ import { ValidateBy, buildMessage, isString, isURL } from "class-validator";
+
+ //#region src/modules/vc/validators.ts
++// KEYRING PATCH (VCDM 2.0 over DIDComm JSON-LD): also accept the VCDM 2.0
++// context URL as the first @context entry, so v2-context credentials can be
++// parsed/validated by the v1 W3cCredential model used by the DIDComm jsonld
++// credential format. See https://www.w3.org/TR/vc-data-model-2.0/
++const CREDENTIALS_CONTEXT_V2_URL_PATCH = "https://www.w3.org/ns/credentials/v2";
+ function IsCredentialJsonLdContext(validationOptions) {
+ 	const allowString = validationOptions?.allowString ?? false;
+ 	const credentialContext = validationOptions?.credentialContext ?? CREDENTIALS_CONTEXT_V1_URL;
++	const acceptedContexts = credentialContext === CREDENTIALS_CONTEXT_V1_URL ? [CREDENTIALS_CONTEXT_V1_URL, CREDENTIALS_CONTEXT_V2_URL_PATCH] : [credentialContext];
+ 	return ValidateBy({
+ 		name: "IsCredentialJsonLdContext",
+ 		validator: {
+ 			validate: (value) => {
+-				if (!Array.isArray(value)) return allowString && isString(value) && value === credentialContext;
+-				if (value[0] !== credentialContext) return false;
++				if (!Array.isArray(value)) return allowString && isString(value) && acceptedContexts.includes(value);
++				if (!acceptedContexts.includes(value[0])) return false;
+ 				return value.every((v) => isString(v) && isURL(v) || isJsonObject(v));
+ 			},
+ 			defaultMessage: buildMessage((eachPrefix) => `${eachPrefix}$property must be an array of strings or objects, where the first item is the verifiable credential context URL.`, validationOptions)

.yarn/patches/@credo-ts-openid4vc-npm-0.5.19-4d16a6c35e.patch

@@ -0,0 +1,54 @@
+diff --git a/build/openid4vc-holder/OpenId4VcHolderApi.js b/build/openid4vc-holder/OpenId4VcHolderApi.js
+index 424685229a55086d101bc30a4444d473b9902fb9..cdbde442353a9eea5d3fc7385ff8024fbcc389b0 100644
+--- a/build/openid4vc-holder/OpenId4VcHolderApi.js
++++ b/build/openid4vc-holder/OpenId4VcHolderApi.js
+@@ -119,8 +119,8 @@ let OpenId4VcHolderApi = class OpenId4VcHolderApi {
+      * @param options.code The authorization code obtained via the authorization request URI
+      */
+     async requestToken(options) {
+-        const { access_token: accessToken, c_nonce: cNonce, dpop, } = await this.openId4VciHolderService.requestAccessToken(this.agentContext, options);
+-        return { accessToken, cNonce, dpop };
++        const { access_token: accessToken, c_nonce: cNonce, dpop, refresh_token: refreshToken, fullResponse } = await this.openId4VciHolderService.requestAccessToken(this.agentContext, options);
++        return { accessToken, cNonce, dpop, refreshToken: refreshToken, fullResponse };
+     }
+     /**
+      * Request a credential. Can be used with both the pre-authorized code flow and the authorization code flow.
+diff --git a/build/openid4vc-holder/OpenId4VciHolderService.js b/build/openid4vc-holder/OpenId4VciHolderService.js
+index 2d0149b8b4e2bd63ec7f52bd419ec6ac3db689ea..0a1cbc2594827035d11a15191584c4898f1bcca4 100644
+--- a/build/openid4vc-holder/OpenId4VciHolderService.js
++++ b/build/openid4vc-holder/OpenId4VciHolderService.js
+@@ -154,11 +154,11 @@ let OpenId4VciHolderService = class OpenId4VciHolderService {
+     async sendNotification(options) {
+         const { notificationMetadata, notificationEvent } = options;
+         const { notificationId, notificationEndpoint } = notificationMetadata;
+-        const response = await (0, oid4vci_common_1.post)(notificationEndpoint, { notification_id: notificationId, event: notificationEvent }, {
++        const response = await (0, oid4vci_common_1.post)(notificationEndpoint, JSON.stringify({ notification_id: notificationId, event: notificationEvent }), {
+             bearerToken: options.accessToken,
+             contentType: 'application/json',
+         });
+-        if (!response.successBody) {
++        if (response.error) {
+             throw new core_1.CredoError(`Failed to send notification event '${notificationId}' to '${notificationEndpoint}'`);
+         }
+     }
+@@ -229,6 +229,7 @@ let OpenId4VciHolderService = class OpenId4VciHolderService {
+         return {
+             ...accessTokenResponse.successBody,
+             ...(dpopJwk && { dpop: { jwk: dpopJwk, nonce: accessTokenResponse.params?.dpop?.dpopNonce } }),
++            fullResponse: accessTokenResponse,
+         };
+     }
+     async acceptCredentialOffer(agentContext, options) {
+diff --git a/build/openid4vc-holder/OpenId4VciHolderServiceOptions.d.ts b/build/openid4vc-holder/OpenId4VciHolderServiceOptions.d.ts
+index 333489a880b8b85862ab2b2ce281a931e523eaff..0d15690e6c5fb025bf62de8f0687f47694f530b0 100644
+--- a/build/openid4vc-holder/OpenId4VciHolderServiceOptions.d.ts
++++ b/build/openid4vc-holder/OpenId4VciHolderServiceOptions.d.ts
+@@ -18,6 +18,8 @@ export type OpenId4VciNotificationEvent = 'credential_accepted' | 'credential_fa
+ export type OpenId4VciTokenResponse = Pick<AccessTokenResponse, 'access_token' | 'c_nonce'>;
+ export type OpenId4VciRequestTokenResponse = {
+     accessToken: string;
++    refreshToken?: string;
++    fullResponse?: AccessTokenResponse;
+     cNonce?: string;
+     dpop?: {
+         jwk: Jwk;