@spec get_credential(Layr8.REST.t(), String.t()) ::
  {:ok, stored_credential()} | {:error, term()}

Retrieves a stored credential by ID.

Returns {:ok, stored_credential()} or {:error, reason}.

@spec list_credentials(
  Layr8.REST.t(),
  keyword()
) :: {:ok, [stored_credential()]} | {:error, term()}

Lists stored credentials for a holder.

Options

• :holder_did — holder DID (default: agent DID)

Returns {:ok, [stored_credential()]} or {:error, reason}.

@spec sign_credential(Layr8.REST.t(), credential(), keyword()) ::
  {:ok, String.t()} | {:error, term()}

Signs a W3C Verifiable Credential using the issuer's assertion key.

Options

• :issuer_did — issuer DID whose assertion key signs the credential. Layr8.Client.sign_credential/3 defaults it to the agent DID; called directly, this function has no agent and sends "", which the node rejects.
• :format — output format: "compact_jwt" (default), "json", "jwt", "enveloped"

id and issuer may be omitted

The node refuses a credential without an id or an issuer key, and its reply (422 Invalid credential: missing required fields) does not say which one is missing. So before sending, this function fills them in on a copy of credential:

• id absent, nil or "" → "urn:uuid:<random UUID v4>".
• issuer absent, nil or "" → the :issuer_did option, when that is a non-empty string. When it is not, issuer is left as given: there is no DID to put there, and the node rejects the call for the empty issuer_did before it reads the credential.

A value the caller gave is never replaced. Either key form counts as given — "id" or :id, "issuer" or :issuer — and a filled key takes the form of the blank one it replaces, or :atom form when every key of the map is an atom, "string" form otherwise. The SDK never adds a second form of a key the map already has. An issuer that differs from :issuer_did is sent as given; this function does not compare the two.

Returns {:ok, signed_jwt} or {:error, reason}.

@spec store_credential(Layr8.REST.t(), String.t(), keyword()) ::
  {:ok, stored_credential()} | {:error, term()}

Stores a signed credential JWT for a holder in the cloud-node credential store.

Options

• :holder_did — holder DID (default: agent DID)
• :issuer_did — issuer DID metadata (optional)
• :valid_until — ISO 8601 expiration string (optional)

Returns {:ok, stored_credential} or {:error, reason}.

@spec verify_credential(Layr8.REST.t(), String.t(), keyword()) ::
  {:ok, map()} | {:error, term()}

Verifies a signed credential using the verifier DID's assertion key.

Options

• :verifier_did — verifier DID (default: agent DID)

Returns {:ok, verified} or {:error, reason}.