Major upgrade: RN 0.81 / React 19 / credo-ts 0.6.3, VC 2.0, RCE v3 + eddsa-rdfc-2022 Data Integrity, witnessed exchange

.github/workflows/quality.yml

@@ -34,20 +34,6 @@ jobs:
         working-directory: app
         run: yarn install --immutable
 
-      - name: Cache bcsc-core build output
-        uses: actions/cache@v3
-        with:
-          path: packages/bcsc-core/lib
-          # Cache will be invalidated if any source file changes
-          key: ${{ runner.os }}-bcsc-core-build-${{ hashFiles('packages/bcsc-core/src/**') }}
-          restore-keys: |
-            ${{ runner.os }}-bcsc-core-build-
-
-      # Note: The `bcsc-core` package must be built before type checking.
-      - name: Build bcsc-core
-        working-directory: packages/bcsc-core
-        run: yarn build
-
       - name: Check style
         working-directory: app
         run: |
@@ -58,12 +44,9 @@ jobs:
         working-directory: app
         run: yarn lint
 
-      # TEMPORARILY DISABLED: TypeScript check 
-      # TODO: Re-enable after fixing theme.ts type errors in separate PR
-      # - name: Check types
-      #   working-directory: app
-      #   # Note: To pass the type check, the `bcsc-core` package must be built first.
-      #   run: yarn typecheck
+      - name: Check types
+        working-directory: app
+        run: yarn typecheck
 
   test:
     runs-on: ubuntu-22.04

.gitignore

@@ -70,6 +70,9 @@ aries-oca-bundles/
 credo-ts/
 app/vendor/
 
+# Android native build cache
+app/android/app/.cxx/
+
 # Android keystore
 release.keystore
 *.keystore.old

.yarn/patches/@animo-id-expo-secure-environment-npm-0.1.5-3c2a8f1b94.patch

@@ -0,0 +1,18 @@
+diff --git a/android/build.gradle b/android/build.gradle
+index cde6a970a43cc930546e59a80e8716a0980bc503..f7dc11cd461beedda314f3700dc42623d82a4029 100644
+--- a/android/build.gradle
++++ b/android/build.gradle
+@@ -40,6 +40,13 @@
+     lintOptions {
+         abortOnError false
+     }
++    compileOptions {
++        sourceCompatibility JavaVersion.VERSION_17
++        targetCompatibility JavaVersion.VERSION_17
++    }
++    kotlinOptions {
++        jvmTarget = "17"
++    }
+ }
+
+ dependencies {

.yarn/patches/@credo-ts-core-npm-0.6.3-28b59086b0.patch

@@ -0,0 +1,69 @@
+diff --git a/build/modules/vc/models/credential/W3cCredential.d.mts b/build/modules/vc/models/credential/W3cCredential.d.mts
+index 6ecceb006c81a8f7dba8500b18e217c3d6b8c192..6df40bc454dec759ac878f20cb4eec9e74b742d0 100644
+--- a/build/modules/vc/models/credential/W3cCredential.d.mts
++++ b/build/modules/vc/models/credential/W3cCredential.d.mts
+@@ -10,7 +10,7 @@ interface W3cCredentialOptions {
+   id?: string;
+   type: Array<string>;
+   issuer: string | W3cIssuerOptions;
+-  issuanceDate: string;
++  issuanceDate?: string;
+   expirationDate?: string;
+   credentialSubject: SingleOrArray<W3cCredentialSubjectOptions>;
+   credentialStatus?: W3cCredentialStatus;
+@@ -22,7 +22,7 @@ declare class W3cCredential {
+   id?: string;
+   type: Array<string>;
+   issuer: string | W3cIssuer;
+-  issuanceDate: string;
++  issuanceDate?: string;
+   expirationDate?: string;
+   credentialSubject: SingleOrArray<W3cCredentialSubject>;
+   credentialSchema?: SingleOrArray<W3cCredentialSchema>;
+diff --git a/build/modules/vc/models/credential/W3cCredential.mjs b/build/modules/vc/models/credential/W3cCredential.mjs
+index f3ad42c21d31e28b0f297416f17d7e560454082d..783cae8b47016777ac82d96f599319e8cfd63b3d 100644
+--- a/build/modules/vc/models/credential/W3cCredential.mjs
++++ b/build/modules/vc/models/credential/W3cCredential.mjs
+@@ -66,7 +66,13 @@ __decorate([
+ 	IsW3cIssuer(),
+ 	__decorateMetadata("design:type", Object)
+ ], W3cCredential.prototype, "issuer", void 0);
+-__decorate([IsRFC3339(), __decorateMetadata("design:type", String)], W3cCredential.prototype, "issuanceDate", void 0);
++// KEYRING PATCH (VCDM 2.0): issuanceDate is v1.1-only; VCDM 2.0 credentials
++// use validFrom instead, so the property must be optional to accept them.
++__decorate([
++	IsRFC3339(),
++	IsOptional(),
++	__decorateMetadata("design:type", String)
++], W3cCredential.prototype, "issuanceDate", void 0);
+ __decorate([
+ 	IsRFC3339(),
+ 	IsOptional(),
+diff --git a/build/modules/vc/validators.mjs b/build/modules/vc/validators.mjs
+index 1dc281ee34c7ee80285bf99008d2fa2bd85ef0e2..4fe87ad71253a0af11cae2f52be8f8eb8a041b8c 100644
+--- a/build/modules/vc/validators.mjs
++++ b/build/modules/vc/validators.mjs
+@@ -5,15 +5,21 @@ import { CREDENTIALS_CONTEXT_V1_URL, VERIFIABLE_CREDENTIAL_TYPE, VERIFIABLE_PRES
+ import { ValidateBy, buildMessage, isString, isURL } from "class-validator";
+
+ //#region src/modules/vc/validators.ts
++// KEYRING PATCH (VCDM 2.0 over DIDComm JSON-LD): also accept the VCDM 2.0
++// context URL as the first @context entry, so v2-context credentials can be
++// parsed/validated by the v1 W3cCredential model used by the DIDComm jsonld
++// credential format. See https://www.w3.org/TR/vc-data-model-2.0/
++const CREDENTIALS_CONTEXT_V2_URL_PATCH = "https://www.w3.org/ns/credentials/v2";
+ function IsCredentialJsonLdContext(validationOptions) {
+ 	const allowString = validationOptions?.allowString ?? false;
+ 	const credentialContext = validationOptions?.credentialContext ?? CREDENTIALS_CONTEXT_V1_URL;
++	const acceptedContexts = credentialContext === CREDENTIALS_CONTEXT_V1_URL ? [CREDENTIALS_CONTEXT_V1_URL, CREDENTIALS_CONTEXT_V2_URL_PATCH] : [credentialContext];
+ 	return ValidateBy({
+ 		name: "IsCredentialJsonLdContext",
+ 		validator: {
+ 			validate: (value) => {
+-				if (!Array.isArray(value)) return allowString && isString(value) && value === credentialContext;
+-				if (value[0] !== credentialContext) return false;
++				if (!Array.isArray(value)) return allowString && isString(value) && acceptedContexts.includes(value);
++				if (!acceptedContexts.includes(value[0])) return false;
+ 				return value.every((v) => isString(v) && isURL(v) || isJsonObject(v));
+ 			},
+ 			defaultMessage: buildMessage((eachPrefix) => `${eachPrefix}$property must be an array of strings or objects, where the first item is the verifiable credential context URL.`, validationOptions)

.yarn/patches/@credo-ts-didcomm-npm-0.6.3-b3cbe5f2a8.patch

@@ -0,0 +1,83 @@
+diff --git a/build/modules/credentials/formats/jsonld/DidCommJsonLdCredentialDetailOptions.d.mts b/build/modules/credentials/formats/jsonld/DidCommJsonLdCredentialDetailOptions.d.mts
+index 1175bf65bbd5328b3dc3c08d6bfbba65e460c949..286beea925df63ee4303800f355c4989f9411b44 100644
+--- a/build/modules/credentials/formats/jsonld/DidCommJsonLdCredentialDetailOptions.d.mts
++++ b/build/modules/credentials/formats/jsonld/DidCommJsonLdCredentialDetailOptions.d.mts
+@@ -13,6 +13,7 @@ interface DidCommJsonLdCredentialDetailOptionsOptions {
+   challenge?: string;
+   credentialStatus?: DidCommJsonLdCredentialDetailCredentialStatus;
+   proofType: string;
++  cryptosuite?: string;
+ }
+ declare class DidCommJsonLdCredentialDetailOptions {
+   constructor(options: DidCommJsonLdCredentialDetailOptionsOptions);
+@@ -21,6 +22,7 @@ declare class DidCommJsonLdCredentialDetailOptions {
+   domain?: string;
+   challenge?: string;
+   proofType: string;
++  cryptosuite?: string;
+   credentialStatus?: DidCommJsonLdCredentialDetailCredentialStatus;
+ }
+ //#endregion
+diff --git a/build/modules/credentials/formats/jsonld/DidCommJsonLdCredentialDetailOptions.mjs b/build/modules/credentials/formats/jsonld/DidCommJsonLdCredentialDetailOptions.mjs
+index 16e977f4701e036b2d67b147c6bc4fb921256afa..96a2185d1c41642fc323be053cbc4eedb18439a4 100644
+--- a/build/modules/credentials/formats/jsonld/DidCommJsonLdCredentialDetailOptions.mjs
++++ b/build/modules/credentials/formats/jsonld/DidCommJsonLdCredentialDetailOptions.mjs
+@@ -19,6 +19,10 @@ var DidCommJsonLdCredentialDetailOptions = class {
+ 			this.challenge = options.challenge;
+ 			this.credentialStatus = options.credentialStatus;
+ 			this.proofType = options.proofType;
++			// KEYRING PATCH (Data Integrity): DataIntegrityProof proofs carry the
++			// concrete algorithm in proof.cryptosuite; the request options must be
++			// able to pin it (docs/CRYPTO_SUITE_FOLLOWUP.md, Decision 5 Option B).
++			this.cryptosuite = options.cryptosuite;
+ 		}
+ 	}
+ };
+@@ -39,6 +43,11 @@ __decorate([
+ 	__decorateMetadata("design:type", String)
+ ], DidCommJsonLdCredentialDetailOptions.prototype, "challenge", void 0);
+ __decorate([IsString(), __decorateMetadata("design:type", String)], DidCommJsonLdCredentialDetailOptions.prototype, "proofType", void 0);
++__decorate([
++	IsString(),
++	IsOptional(),
++	__decorateMetadata("design:type", String)
++], DidCommJsonLdCredentialDetailOptions.prototype, "cryptosuite", void 0);
+ __decorate([
+ 	IsOptional(),
+ 	IsObject(),
+diff --git a/build/modules/credentials/formats/jsonld/DidCommJsonLdCredentialFormat.d.mts b/build/modules/credentials/formats/jsonld/DidCommJsonLdCredentialFormat.d.mts
+index f6c655038122a044377ee872e4d5b17a6c1bbd89..0c759a06544dc17151c583e00e1a437add1dd884 100644
+--- a/build/modules/credentials/formats/jsonld/DidCommJsonLdCredentialFormat.d.mts
++++ b/build/modules/credentials/formats/jsonld/DidCommJsonLdCredentialFormat.d.mts
+@@ -20,6 +20,7 @@ interface DidCommJsonLdCredentialDetailFormat {
+   options: {
+     proofPurpose: string;
+     proofType: string;
++    cryptosuite?: string;
+   };
+ }
+ type EmptyObject = Record<string, never>;
+@@ -81,6 +82,7 @@ interface JsonLdFormatDataCredentialDetail {
+ interface JsonLdFormatDataCredentialDetailOptions {
+   proofPurpose: string;
+   proofType: string;
++  cryptosuite?: string;
+   created?: string;
+   domain?: string;
+   challenge?: string;
+diff --git a/build/modules/credentials/formats/jsonld/DidCommJsonLdCredentialFormatService.mjs b/build/modules/credentials/formats/jsonld/DidCommJsonLdCredentialFormatService.mjs
+index ef75c086b244014c31cbaa5ef3ca3d83f0b96507..64af8e41977562d2b64e93acbb733e85a767defc 100644
+--- a/build/modules/credentials/formats/jsonld/DidCommJsonLdCredentialFormatService.mjs
++++ b/build/modules/credentials/formats/jsonld/DidCommJsonLdCredentialFormatService.mjs
+@@ -188,6 +188,11 @@ var DidCommJsonLdCredentialFormatService = class {
+ 		if (credential.proof.domain !== request.options.domain) throw new CredoError("Received credential proof domain does not match domain from credential request");
+ 		if (credential.proof.challenge !== request.options.challenge) throw new CredoError("Received credential proof challenge does not match challenge from credential request");
+ 		if (credential.proof.type !== request.options.proofType) throw new CredoError("Received credential proof type does not match proof type from credential request");
++		// KEYRING PATCH (Data Integrity): when the request pins a cryptosuite
++		// (DataIntegrityProof), the received proof must carry the same one.
++		// Absent option (Ed25519Signature2018 path) keeps type-only matching
++		// (docs/CRYPTO_SUITE_FOLLOWUP.md, Decision 5 Option B).
++		if (request.options.cryptosuite !== void 0 && credential.proof.cryptosuite !== request.options.cryptosuite) throw new CredoError("Received credential proof cryptosuite does not match cryptosuite from credential request");
+ 		if (credential.proof.proofPurpose !== request.options.proofPurpose) throw new CredoError("Received credential proof purpose does not match proof purpose from credential request");
+ 		if (!utils.areObjectsEqual(jsonCredential, request.credential)) throw new CredoError("Received credential does not match credential request");
+ 	}