@credo-ts/core 0.6.1-pr-2091-20241119140918 → 0.6.1

package/build/modules/sd-jwt-vc/SdJwtVcModule.mjs

@@ -0,0 +1,27 @@
+
+
+import { SdJwtVcRepository } from "./repository/SdJwtVcRepository.mjs";
+import "./repository/index.mjs";
+import { SdJwtVcService } from "./SdJwtVcService.mjs";
+import { SdJwtVcApi } from "./SdJwtVcApi.mjs";
+
+//#region src/modules/sd-jwt-vc/SdJwtVcModule.ts
+/**
+* @public
+*/
+var SdJwtVcModule = class {
+	constructor() {
+		this.api = SdJwtVcApi;
+	}
+	/**
+	* Registers the dependencies of the sd-jwt-vc module on the dependency manager.
+	*/
+	register(dependencyManager) {
+		dependencyManager.registerSingleton(SdJwtVcService);
+		dependencyManager.registerSingleton(SdJwtVcRepository);
+	}
+};
+
+//#endregion
+export { SdJwtVcModule };
+//# sourceMappingURL=SdJwtVcModule.mjs.map

package/build/modules/sd-jwt-vc/SdJwtVcModule.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"SdJwtVcModule.mjs","names":[],"sources":["../../../src/modules/sd-jwt-vc/SdJwtVcModule.ts"],"sourcesContent":["import type { DependencyManager, Module } from '../../plugins'\nimport { SdJwtVcRepository } from './repository'\nimport { SdJwtVcApi } from './SdJwtVcApi'\nimport { SdJwtVcService } from './SdJwtVcService'\n\n/**\n * @public\n */\nexport class SdJwtVcModule implements Module {\n  public readonly api = SdJwtVcApi\n\n  /**\n   * Registers the dependencies of the sd-jwt-vc module on the dependency manager.\n   */\n  public register(dependencyManager: DependencyManager) {\n    // Services\n    dependencyManager.registerSingleton(SdJwtVcService)\n\n    // Repositories\n    dependencyManager.registerSingleton(SdJwtVcRepository)\n  }\n}\n"],"mappings":";;;;;;;;;;;AAQA,IAAa,gBAAb,MAA6C;;OAC3B,MAAM;;;;;CAKtB,AAAO,SAAS,mBAAsC;AAEpD,oBAAkB,kBAAkB,eAAe;AAGnD,oBAAkB,kBAAkB,kBAAkB"}

package/build/modules/sd-jwt-vc/SdJwtVcOptions.d.mts

@@ -0,0 +1,147 @@
+import { HashName } from "../../crypto/hashes/Hasher.mjs";
+import { EncodedX509Certificate } from "../x509/X509ServiceOptions.mjs";
+import { X509Certificate } from "../x509/X509Certificate.mjs";
+import { SdJwtVc } from "./SdJwtVcService.mjs";
+import { SdJwtVcRecord } from "./repository/SdJwtVcRecord.mjs";
+import "./repository/index.mjs";
+import "../x509/index.mjs";
+import "../../crypto/index.mjs";
+import { PublicJwk } from "../kms/jwk/PublicJwk.mjs";
+import "../kms/index.mjs";
+
+//#region src/modules/sd-jwt-vc/SdJwtVcOptions.d.ts
+interface SdJwtVcStoreOptions {
+  record: SdJwtVcRecord;
+}
+type SdJwtVcPayload = Record<string, unknown>;
+type SdJwtVcHeader = Record<string, unknown>;
+interface IDisclosureFrame {
+  _sd?: string[];
+  _sd_decoy?: number;
+  [x: string]: string[] | number | IDisclosureFrame | undefined;
+}
+interface IPresentationFrame {
+  [x: string]: boolean | IPresentationFrame;
+}
+interface SdJwtVcHolderDidBinding {
+  method: 'did';
+  didUrl: string;
+}
+interface SdJwtVcHolderJwkBinding {
+  method: 'jwk';
+  jwk: PublicJwk;
+}
+interface SdJwtVcIssuerDid {
+  method: 'did';
+  didUrl: string;
+}
+interface SdJwtVcIssuerX5c {
+  method: 'x5c';
+  /**
+   *
+   * Array of X509 certificates.
+   *
+   * The certificate containing the public key corresponding to the key used to digitally sign the JWS MUST be the first certificate.
+   */
+  x5c: X509Certificate[];
+  /**
+   * The issuer of the SD-JWT VC.
+   *
+   * NOTE: in the latest draft of SD-JWT VC the issuer field is optional when using an X509 certificates
+   * to sign the SD-JWT VC.
+   *
+   * Since it's not clear what the iss value should be Credo will likely require
+   * the value to be undefined in a future version, but for now if the issuer value
+   * is defined it MUST match an SAN URI or DNS entry in the leaf certificate, mimicking
+   * previous behavior.
+   */
+  issuer?: string;
+}
+type SdJwtVcHolderBinding = SdJwtVcHolderDidBinding | SdJwtVcHolderJwkBinding;
+type SdJwtVcIssuer = SdJwtVcIssuerDid | SdJwtVcIssuerX5c;
+interface SdJwtVcSignOptions<Payload extends SdJwtVcPayload = SdJwtVcPayload> {
+  payload: Payload;
+  /**
+   * If holder is not provided, we don't bind the SD-JWT VC to a key (so bearer VC)
+   */
+  holder?: SdJwtVcHolderBinding;
+  issuer: SdJwtVcIssuer;
+  disclosureFrame?: IDisclosureFrame;
+  /**
+   * Default of sha-256 will be used if not provided
+   */
+  hashingAlgorithm?: HashName;
+  /**
+   * The header 'typ' to use for the SD-JWT VC. vc+sd-jwt is supported
+   * for backwards compatibility but implementations should update to
+   * dc+sd-jwt
+   *
+   * @default 'dc+sd-jwt'
+   */
+  headerType?: 'dc+sd-jwt' | 'vc+sd-jwt';
+}
+type SdJwtVcPresentOptions<_Payload extends SdJwtVcPayload = SdJwtVcPayload> = {
+  sdJwtVc: string | SdJwtVc;
+  /**
+   * Use true to disclose everything
+   */
+  presentationFrame?: IPresentationFrame;
+  /**
+   * This information is received out-of-band from the verifier.
+   * The claims will be used to create a normal JWT, used for key binding.
+   *
+   * If not defined, a KB-JWT will not be created
+   */
+  verifierMetadata?: {
+    audience: string;
+    nonce: string;
+    issuedAt: number;
+  };
+  /**
+   * Additional payload to include in the KB JWT
+   */
+  additionalPayload?: Record<string, unknown>;
+};
+type SdJwtVcVerifyOptions = {
+  compactSdJwtVc: string;
+  /**
+   * If the key binding object is present, the sd-jwt is required to have a key binding jwt attached
+   * and will be validated against the provided key binding options.
+   */
+  keyBinding?: {
+    /**
+     * The expected `aud` value in the payload of the KB-JWT. The value of this is dependant on the
+     * exchange protocol used.
+     */
+    audience: string;
+    /**
+     * The expected `nonce` value in the payload of the KB-JWT. The value of this is dependant on the
+     * exchange protocol used.
+     */
+    nonce: string;
+  };
+  requiredClaimKeys?: Array<string>;
+  /**
+   * Whether to fetch the `vct` type metadata if the `vct` is an https URL.
+   *
+   * It will will not influence the verification result if fetching of type metadata fails
+   *
+   * @default false
+   */
+  fetchTypeMetadata?: boolean;
+  /**
+   * Whether to verify the status of the credential. If set to false and the credential
+   * has a status, it will not be fetched and verified.
+   *
+   * @default true
+   */
+  verifyCredentialStatus?: boolean;
+  trustedCertificates?: EncodedX509Certificate[];
+  /**
+   * Date that should be used as the current time. If not provided, current time will be used.
+   */
+  now?: Date;
+};
+//#endregion
+export { IDisclosureFrame, IPresentationFrame, SdJwtVcHeader, SdJwtVcHolderBinding, SdJwtVcHolderDidBinding, SdJwtVcHolderJwkBinding, SdJwtVcIssuer, SdJwtVcIssuerDid, SdJwtVcIssuerX5c, SdJwtVcPayload, SdJwtVcPresentOptions, SdJwtVcSignOptions, SdJwtVcStoreOptions, SdJwtVcVerifyOptions };
+//# sourceMappingURL=SdJwtVcOptions.d.mts.map

package/build/modules/sd-jwt-vc/SdJwtVcOptions.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SdJwtVcOptions.d.mts","names":[],"sources":["../../../src/modules/sd-jwt-vc/SdJwtVcOptions.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;UAMiB,mBAAA;UACP;;KAIE,cAAA,GAAiB;KACjB,aAAA,GAAgB;UAEX,gBAAA;;;mCAGkB;AAXnC;AAKY,UASK,kBAAA,CATY;EACjB,CAAA,CAAA,EAAA,MAAA,CAAA,EAAA,OAAa,GASA,kBATS;AAElC;AAMiB,UAIA,uBAAA,CAHQ;EAGR,MAAA,EAAA,KAAA;EAKA,MAAA,EAAA,MAAA;AAKjB;AAOiB,UAZA,uBAAA,CAqBV;EAiBK,MAAA,EAAA,KAAA;EAIA,GAAA,EAxCL,SAwCK;AAEZ;AAAoD,UAvCnC,gBAAA,CAuCmC;EAAiB,MAAA,EAAA,KAAA;EAC1D,MAAA,EAAA,MAAA;;AAMD,UAvCO,gBAAA,CAuCP;EACU,MAAA,EAAA,KAAA;EAKC;;AAarB;;;;EAMsB,GAAA,EAvDf,eAuDe,EAAA;EAiBA;;AAGtB;;;;;;;;;;;KA1DY,oBAAA,GAAuB,0BAA0B;KAIjD,aAAA,GAAgB,mBAAmB;UAE9B,mCAAmC,iBAAiB;WAC1D;;;;WAKA;UACD;oBACU;;;;qBAKC;;;;;;;;;;KAaT,uCAAuC,iBAAiB;oBAChD;;;;sBAKE;;;;;;;;;;;;;;;sBAiBA;;KAGV,oBAAA;;;;;;;;;;;;;;;;;;sBAsBU;;;;;;;;;;;;;;;;wBAmBE;;;;QAKhB"}

package/build/modules/sd-jwt-vc/SdJwtVcOptions.mjs

@@ -0,0 +1,4 @@
+
+
+import "../kms/index.mjs";
+import "./repository/index.mjs";

package/build/modules/sd-jwt-vc/SdJwtVcService.d.mts

@@ -0,0 +1,95 @@
+import { Query, QueryOptions } from "../../storage/StorageService.mjs";
+import { JsonObject } from "../../types.mjs";
+import { ClaimFormat } from "../vc/models/ClaimFormat.mjs";
+import { SdJwtVcHeader, SdJwtVcPayload, SdJwtVcPresentOptions, SdJwtVcSignOptions, SdJwtVcStoreOptions, SdJwtVcVerifyOptions } from "./SdJwtVcOptions.mjs";
+import { SdJwtVcTypeMetadata } from "./typeMetadata.mjs";
+import { SdJwtVcRecord } from "./repository/SdJwtVcRecord.mjs";
+import { SdJwtVcRepository } from "./repository/SdJwtVcRepository.mjs";
+import "./repository/index.mjs";
+import "../vc/index.mjs";
+import { AgentContext } from "../../agent/context/AgentContext.mjs";
+import "../../agent/index.mjs";
+
+//#region src/modules/sd-jwt-vc/SdJwtVcService.d.ts
+interface SdJwtVc<Header extends SdJwtVcHeader = SdJwtVcHeader, Payload extends SdJwtVcPayload = SdJwtVcPayload> {
+  /**
+   * claim format is convenience method added to all credential instances
+   */
+  claimFormat: ClaimFormat.SdJwtDc;
+  /**
+   * encoded is convenience method added to all credential instances
+   */
+  encoded: string;
+  compact: string;
+  header: Header;
+  payload: Payload;
+  prettyClaims: Payload;
+  kbJwt?: {
+    header: Record<string, unknown>;
+    payload: Record<string, unknown>;
+  };
+  /**
+   * The key id in the KMS bound to this SD-JWT VC, used for presentations.
+   *
+   * This will only be set on the holder side if defined on the SdJwtVcRecord
+   */
+  kmsKeyId?: string;
+  typeMetadata?: SdJwtVcTypeMetadata;
+}
+interface VerificationResult {
+  isValid: boolean;
+  isValidJwtPayload?: boolean;
+  isSignatureValid?: boolean;
+  isStatusValid?: boolean;
+  isNotBeforeValid?: boolean;
+  isExpiryTimeValid?: boolean;
+  areRequiredClaimsIncluded?: boolean;
+  isKeyBindingValid?: boolean;
+  containsExpectedKeyBinding?: boolean;
+  containsRequiredVcProperties?: boolean;
+}
+/**
+ * @internal
+ */
+declare class SdJwtVcService {
+  private sdJwtVcRepository;
+  constructor(sdJwtVcRepository: SdJwtVcRepository);
+  sign<Payload extends SdJwtVcPayload>(agentContext: AgentContext, options: SdJwtVcSignOptions<Payload>): Promise<SdJwtVc>;
+  fromCompact<Header extends SdJwtVcHeader = SdJwtVcHeader, Payload extends SdJwtVcPayload = SdJwtVcPayload>(compactSdJwtVc: string, typeMetadata?: SdJwtVcTypeMetadata): SdJwtVc<Header, Payload>;
+  applyDisclosuresForPayload(compactSdJwtVc: string, requestedPayload: JsonObject): SdJwtVc;
+  present<Payload extends SdJwtVcPayload = SdJwtVcPayload>(agentContext: AgentContext, {
+    sdJwtVc,
+    presentationFrame,
+    verifierMetadata,
+    additionalPayload
+  }: SdJwtVcPresentOptions<Payload>): Promise<string>;
+  private assertValidX5cJwtIssuer;
+  verify<Header extends SdJwtVcHeader = SdJwtVcHeader, Payload extends SdJwtVcPayload = SdJwtVcPayload>(agentContext: AgentContext, {
+    compactSdJwtVc,
+    keyBinding,
+    requiredClaimKeys,
+    fetchTypeMetadata,
+    trustedCertificates,
+    now
+  }: SdJwtVcVerifyOptions): Promise<{
+    isValid: true;
+    sdJwtVc: SdJwtVc<Header, Payload>;
+  } | {
+    isValid: false;
+    sdJwtVc?: SdJwtVc<Header, Payload>;
+    error: Error;
+  }>;
+  store(agentContext: AgentContext, options: SdJwtVcStoreOptions): Promise<SdJwtVcRecord>;
+  getById(agentContext: AgentContext, id: string): Promise<SdJwtVcRecord>;
+  getAll(agentContext: AgentContext): Promise<Array<SdJwtVcRecord>>;
+  findByQuery(agentContext: AgentContext, query: Query<SdJwtVcRecord>, queryOptions?: QueryOptions): Promise<Array<SdJwtVcRecord>>;
+  deleteById(agentContext: AgentContext, id: string): Promise<void>;
+  update(agentContext: AgentContext, sdJwtVcRecord: SdJwtVcRecord): Promise<void>;
+  private extractKeyFromIssuer;
+  private parseIssuerFromCredential;
+  private getBaseSdJwtConfig;
+  private getStatusListFetcher;
+}
+//#endregion
+export { SdJwtVc, SdJwtVcService, VerificationResult };
+//# sourceMappingURL=SdJwtVcService.d.mts.map

package/build/modules/sd-jwt-vc/SdJwtVcService.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SdJwtVcService.d.mts","names":[],"sources":["../../../src/modules/sd-jwt-vc/SdJwtVcService.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;;UA4CiB,uBACA,gBAAgB,+BACf,iBAAiB;;;;eAKpB,WAAA,CAAY;;;;EAPV,OAAA,EAAA,MAAO;EACP,OAAA,EAAA,MAAA;EAAgB,MAAA,EAYvB,MAZuB;EACf,OAAA,EAcP,OAdO;EAAiB,YAAA,EAenB,OAfmB;EAKpB,KAAA,CAAA,EAAA;IAML,MAAA,EAOE,MAPF,CAAA,MAAA,EAAA,OAAA,CAAA;IAGC,OAAA,EAKE,MALF,CAAA,MAAA,EAAA,OAAA,CAAA;EACK,CAAA;EAGJ;;;;AAcZ;EAiBa,QAAA,CAAA,EAAA,MAAc;EAGa,YAAA,CAAA,EAvBvB,mBAuBuB;;AAKtB,UAzBD,kBAAA,CAyBC;EACc,OAAA,EAAA,OAAA;EAAnB,iBAAA,CAAA,EAAA,OAAA;EACA,gBAAA,CAAA,EAAA,OAAA;EAAR,aAAA,CAAA,EAAA,OAAA;EA4D+B,gBAAA,CAAA,EAAA,OAAA;EAAgB,iBAAA,CAAA,EAAA,OAAA;EAA+B,yBAAA,CAAA,EAAA,OAAA;EAAiB,iBAAA,CAAA,EAAA,OAAA;EAEjF,0BAAA,CAAA,EAAA,OAAA;EACN,4BAAA,CAAA,EAAA,OAAA;;;;;AAgC0B,cAzG1B,cAAA,CAyG0B;EAAiB,QAAA,iBAAA;EACtC,WAAA,CAAA,iBAAA,EAvGsB,iBAuGtB;EACZ,IAAA,CAAA,gBApG8B,cAoG9B,CAAA,CAAA,YAAA,EAnGY,YAmGZ,EAAA,OAAA,EAlGO,kBAkGP,CAlG0B,OAkG1B,CAAA,CAAA,EAjGD,OAiGC,CAjGO,OAiGP,CAAA;EAAS,WAAA,CAAA,eArCqB,aAqCrB,GArCqC,aAqCrC,EAAA,gBArCoE,cAqCpE,GArCqF,cAqCrF,CAAA,CAAA,cAAA,EAAA,MAAA,EAAA,YAAA,CAAA,EAnCI,mBAmCJ,CAAA,EAlCV,OAkCU,CAlCF,MAkCE,EAlCM,OAkCN,CAAA;EAAmB,0BAAA,CAAA,cAAA,EAAA,MAAA,EAAA,gBAAA,EA9B4C,UA8B5C,CAAA,EA9ByD,OA8BzD;EAAkB,OAAA,CAAA,gBAFb,cAEa,GAFI,cAEJ,CAAA,CAAA,YAAA,EADlC,YACkC,EAAA;IAAA,OAAA;IAAA,iBAAA;IAAA,gBAAA;IAAA;EAAA,CAAA,EAAqB,qBAArB,CAA2C,OAA3C,CAAA,CAAA,EAC/C,OAD+C,CAAA,MAAA,CAAA;EAA2C,QAAA,uBAAA;EAAtB,MAAA,CAAA,eA0DpC,aA1DoC,GA0DpB,aA1DoB,EAAA,gBA0DW,cA1DX,GA0D4B,cA1D5B,CAAA,CAAA,YAAA,EA2DvD,YA3DuD,EAAA;IAAA,cAAA;IAAA,UAAA;IAAA,iBAAA;IAAA,iBAAA;IAAA,mBAAA;IAAA;EAAA,CAAA,EA4D2B,oBA5D3B,CAAA,EA6DpE,OA7DoE,CAAA;IACpE,OAAA,EAAA,IAAA;IAyDgC,OAAA,EAIL,OAJK,CAIG,MAJH,EAIW,OAJX,CAAA;EAAgB,CAAA,GAAA;IAA+B,OAAA,EAAA,KAAA;IAAiB,OAAA,CAAA,EAKnE,OALmE,CAK3D,MAL2D,EAKnD,OALmD,CAAA;IACnF,KAAA,EAIiD,KAJjD;EACZ,CAAA,CAAA;EAAgB,KAAA,CAAA,YAAA,EAmJa,YAnJb,EAAA,OAAA,EAmJoC,mBAnJpC,CAAA,EAmJuD,OAnJvD,CAmJuD,aAnJvD,CAAA;EAAY,OAAA,CAAA,YAAA,EAwJG,YAxJH,EAAA,EAAA,EAAA,MAAA,CAAA,EAwJ8B,OAxJ9B,CAwJsC,aAxJtC,CAAA;EAAmB,MAAA,CAAA,YAAA,EA4JjB,YA5JiB,CAAA,EA4JF,OA5JE,CA4JM,KA5JN,CA4JY,aA5JZ,CAAA,CAAA;EAAmB,WAAA,CAAA,YAAA,EAiKtD,YAjKsD,EAAA,KAAA,EAkK7D,KAlK6D,CAkKvD,aAlKuD,CAAA,EAAA,YAAA,CAAA,EAmKrD,YAnKqD,CAAA,EAoKnE,OApKmE,CAoK3D,KApK2D,CAoKrD,aApKqD,CAAA,CAAA;EAAqB,UAAA,CAAA,YAAA,EAwKrD,YAxKqD,EAAA,EAAA,EAAA,MAAA,CAAA,EAwK7B,OAxK6B,CAAA,IAAA,CAAA;EAAO,MAAA,CAAA,YAAA,EA4KhE,YA5KgE,EAAA,aAAA,EA4KnC,aA5KmC,CAAA,EA4KtB,OA5KsB,CAAA,IAAA,CAAA;EAE5D,QAAA,oBAAA;EAAQ,QAAA,yBAAA;EAAhB,QAAA,kBAAA;EACU,QAAA,oBAAA"}

package/build/modules/sd-jwt-vc/SdJwtVcService.mjs

@@ -0,0 +1,347 @@
+
+
+import { CredoError } from "../../error/CredoError.mjs";
+import "../../error/index.mjs";
+import { __decorateMetadata } from "../../_virtual/_@oxc-project_runtime@0.99.0/helpers/decorateMetadata.mjs";
+import { __decorate } from "../../_virtual/_@oxc-project_runtime@0.99.0/helpers/decorate.mjs";
+import "../../agent/index.mjs";
+import { TypedArrayEncoder } from "../../utils/TypedArrayEncoder.mjs";
+import { Hasher } from "../../crypto/hashes/Hasher.mjs";
+import { dateToSeconds, nowInSeconds } from "../../utils/timestamp.mjs";
+import "../../utils/index.mjs";
+import { KeyManagementApi } from "../kms/KeyManagementApi.mjs";
+import "../kms/index.mjs";
+import { X509Certificate } from "../x509/X509Certificate.mjs";
+import { X509ModuleConfig } from "../x509/X509ModuleConfig.mjs";
+import { X509Service } from "../x509/X509Service.mjs";
+import "../x509/index.mjs";
+import { JwtPayload } from "../../crypto/jose/jwt/JwtPayload.mjs";
+import { parseDid } from "../dids/domain/parse.mjs";
+import { getPublicJwkFromVerificationMethod } from "../dids/domain/key-type/keyDidMapping.mjs";
+import "../dids/index.mjs";
+import { ClaimFormat } from "../vc/models/ClaimFormat.mjs";
+import "../../crypto/index.mjs";
+import { extractKeyFromHolderBinding, getSdJwtSigner, getSdJwtVerifier, parseHolderBindingFromCredential, resolveDidUrl, resolveSigningPublicJwkFromDidUrl } from "./utils.mjs";
+import "../vc/index.mjs";
+import { decodeSdJwtVc, sdJwtVcHasher } from "./decodeSdJwtVc.mjs";
+import { SdJwtVcRepository } from "./repository/SdJwtVcRepository.mjs";
+import "./repository/index.mjs";
+import { getDomainFromUrl } from "../../utils/domain.mjs";
+import { fetchWithTimeout } from "../../utils/fetch.mjs";
+import { buildDisclosureFrameForPayload } from "./disclosureFrame.mjs";
+import { SdJwtVcError } from "./SdJwtVcError.mjs";
+import { injectable } from "tsyringe";
+import { decodeSdJwtSync } from "@sd-jwt/decode";
+import { selectDisclosures } from "@sd-jwt/present";
+import { SDJwtVcInstance } from "@sd-jwt/sd-jwt-vc";
+
+//#region src/modules/sd-jwt-vc/SdJwtVcService.ts
+var _ref;
+let SdJwtVcService = class SdJwtVcService$1 {
+	constructor(sdJwtVcRepository) {
+		this.sdJwtVcRepository = sdJwtVcRepository;
+	}
+	async sign(agentContext, options) {
+		const { payload, disclosureFrame, hashingAlgorithm } = options;
+		if (hashingAlgorithm && hashingAlgorithm !== "sha-256") throw new SdJwtVcError(`Unsupported hashing algorithm used: ${hashingAlgorithm}`);
+		const issuer = await this.extractKeyFromIssuer(agentContext, options.issuer, true);
+		const holderBinding = options.holder ? await extractKeyFromHolderBinding(agentContext, options.holder) : void 0;
+		const header = {
+			alg: issuer.alg,
+			typ: options.headerType ?? "dc+sd-jwt",
+			kid: issuer.kid,
+			x5c: issuer.x5c?.map((cert) => cert.toString("base64"))
+		};
+		const sdjwt = new SDJwtVcInstance({
+			...this.getBaseSdJwtConfig(agentContext),
+			signer: getSdJwtSigner(agentContext, issuer.publicJwk),
+			hashAlg: "sha-256",
+			signAlg: issuer.alg
+		});
+		if (!payload.vct || typeof payload.vct !== "string") throw new SdJwtVcError("Missing required parameter 'vct'");
+		const compact = await sdjwt.issue({
+			...payload,
+			cnf: holderBinding?.cnf,
+			iss: issuer.iss,
+			iat: nowInSeconds(),
+			vct: payload.vct
+		}, disclosureFrame, { header });
+		const prettyClaims = await sdjwt.getClaims(compact);
+		const sdjwtPayload = (await sdjwt.decode(compact)).jwt?.payload;
+		if (!sdjwtPayload) throw new SdJwtVcError("Invalid sd-jwt-vc state.");
+		return {
+			compact,
+			prettyClaims,
+			header,
+			payload: sdjwtPayload,
+			claimFormat: ClaimFormat.SdJwtDc,
+			encoded: compact
+		};
+	}
+	fromCompact(compactSdJwtVc, typeMetadata) {
+		return decodeSdJwtVc(compactSdJwtVc, typeMetadata);
+	}
+	applyDisclosuresForPayload(compactSdJwtVc, requestedPayload) {
+		const decoded = decodeSdJwtSync(compactSdJwtVc, Hasher.hash);
+		const presentationFrame = buildDisclosureFrameForPayload(requestedPayload) ?? {};
+		if (decoded.kbJwt) throw new SdJwtVcError("Cannot apply limit disclosure on an sd-jwt with key binding jwt");
+		const requiredDisclosures = selectDisclosures(decoded.jwt.payload, decoded.disclosures.map((d) => ({
+			digest: d.digestSync({
+				alg: "sha-256",
+				hasher: Hasher.hash
+			}),
+			encoded: d.encode(),
+			key: d.key,
+			salt: d.salt,
+			value: d.value
+		})), presentationFrame);
+		const [jwt] = compactSdJwtVc.split("~");
+		return decodeSdJwtVc(`${jwt}~${requiredDisclosures.length > 0 ? `${requiredDisclosures.map((d) => d.encoded).join("~")}~` : ""}`);
+	}
+	async present(agentContext, { sdJwtVc, presentationFrame, verifierMetadata, additionalPayload }) {
+		const sdjwt = new SDJwtVcInstance(this.getBaseSdJwtConfig(agentContext));
+		const compactSdJwtVc = typeof sdJwtVc === "string" ? sdJwtVc : sdJwtVc.compact;
+		const holderBinding = parseHolderBindingFromCredential((await sdjwt.decode(compactSdJwtVc)).jwt?.payload);
+		if (!holderBinding && verifierMetadata) throw new SdJwtVcError("Verifier metadata provided, but credential has no 'cnf' claim to create a KB-JWT from");
+		const holder = holderBinding ? await extractKeyFromHolderBinding(agentContext, holderBinding, {
+			forSigning: true,
+			jwkKeyId: typeof sdJwtVc !== "string" ? sdJwtVc.kmsKeyId : void 0
+		}) : void 0;
+		sdjwt.config({
+			kbSigner: holder ? getSdJwtSigner(agentContext, holder.publicJwk) : void 0,
+			kbSignAlg: holder?.alg
+		});
+		return await sdjwt.present(compactSdJwtVc, presentationFrame, { kb: verifierMetadata ? { payload: {
+			iat: verifierMetadata.issuedAt,
+			nonce: verifierMetadata.nonce,
+			aud: verifierMetadata.audience,
+			...additionalPayload
+		} } : void 0 });
+	}
+	assertValidX5cJwtIssuer(agentContext, iss, leafCertificate) {
+		if (!iss) return;
+		if (!iss.startsWith("https://") && !(iss.startsWith("http://") && agentContext.config.allowInsecureHttpUrls)) throw new SdJwtVcError("The X509 certificate issuer must be a HTTPS URI.");
+		if (!leafCertificate.sanUriNames?.includes(iss) && !leafCertificate.sanDnsNames?.includes(getDomainFromUrl(iss))) throw new SdJwtVcError(`The 'iss' claim in the payload does not match a 'SAN-URI' name and the domain extracted from the HTTPS URI does not match a 'SAN-DNS' name in the x5c certificate. Either remove the 'iss' claim or make it match with at least one SAN-URI or DNS-URI entry`);
+	}
+	async verify(agentContext, { compactSdJwtVc, keyBinding, requiredClaimKeys, fetchTypeMetadata, trustedCertificates, now }) {
+		const sdjwt = new SDJwtVcInstance({ ...this.getBaseSdJwtConfig(agentContext) });
+		let sdJwtVc;
+		try {
+			sdJwtVc = await sdjwt.decode(compactSdJwtVc);
+			if (!sdJwtVc.jwt) throw new CredoError("Invalid sd-jwt-vc");
+		} catch (error) {
+			return {
+				isValid: false,
+				error
+			};
+		}
+		const returnSdJwtVc = {
+			payload: sdJwtVc.jwt.payload,
+			header: sdJwtVc.jwt.header,
+			compact: compactSdJwtVc,
+			prettyClaims: await sdJwtVc.getClaims(sdJwtVcHasher),
+			kbJwt: sdJwtVc.kbJwt ? {
+				payload: sdJwtVc.kbJwt.payload,
+				header: sdJwtVc.kbJwt.header
+			} : void 0,
+			claimFormat: ClaimFormat.SdJwtDc,
+			encoded: compactSdJwtVc
+		};
+		try {
+			const credentialIssuer = await this.parseIssuerFromCredential(agentContext, sdJwtVc, returnSdJwtVc, trustedCertificates);
+			const issuer = await this.extractKeyFromIssuer(agentContext, credentialIssuer);
+			const holderBinding = parseHolderBindingFromCredential(sdJwtVc.jwt.payload);
+			const holder = holderBinding ? await extractKeyFromHolderBinding(agentContext, holderBinding) : void 0;
+			sdjwt.config({
+				verifier: getSdJwtVerifier(agentContext, issuer.publicJwk),
+				kbVerifier: holder ? getSdJwtVerifier(agentContext, holder.publicJwk) : void 0
+			});
+			try {
+				await sdjwt.verify(compactSdJwtVc, {
+					requiredClaimKeys: requiredClaimKeys ? [...requiredClaimKeys, "vct"] : ["vct"],
+					keyBindingNonce: keyBinding?.nonce,
+					currentDate: dateToSeconds(now ?? /* @__PURE__ */ new Date()),
+					skewSeconds: 0
+				});
+			} catch (error) {
+				return {
+					error,
+					isValid: false,
+					sdJwtVc: returnSdJwtVc
+				};
+			}
+			if (sdJwtVc.jwt.header?.typ !== "vc+sd-jwt" && sdJwtVc.jwt.header?.typ !== "dc+sd-jwt") return {
+				error: new SdJwtVcError(`SD-JWT VC header 'typ' must be 'dc+sd-jwt' or 'vc+sd-jwt'`),
+				isValid: false,
+				sdJwtVc: returnSdJwtVc
+			};
+			try {
+				JwtPayload.fromJson(returnSdJwtVc.payload).validate({
+					now: dateToSeconds(now ?? /* @__PURE__ */ new Date()),
+					skewTime: 0
+				});
+			} catch (error) {
+				return {
+					error,
+					isValid: false,
+					sdJwtVc: returnSdJwtVc
+				};
+			}
+			try {
+				if (keyBinding) {
+					if (!sdJwtVc.kbJwt || !sdJwtVc.kbJwt.payload) throw new SdJwtVcError("Keybinding is required for verification of the sd-jwt-vc");
+					if (sdJwtVc.kbJwt.payload.aud !== keyBinding.audience) throw new SdJwtVcError("The key binding JWT does not contain the expected audience");
+					if (sdJwtVc.kbJwt.payload.nonce !== keyBinding.nonce) throw new SdJwtVcError("The key binding JWT does not contain the expected nonce");
+				}
+			} catch (error) {
+				return {
+					error,
+					isValid: false,
+					sdJwtVc: returnSdJwtVc
+				};
+			}
+			try {
+				const vct = returnSdJwtVc.payload?.vct;
+				if (fetchTypeMetadata && typeof vct === "string" && vct.startsWith("https://")) {
+					const vctElements = vct.split("/");
+					vctElements.splice(3, 0, ".well-known/vct");
+					const vctUrl = vctElements.join("/");
+					const response = await agentContext.config.agentDependencies.fetch(vctUrl);
+					if (response.ok) returnSdJwtVc.typeMetadata = await response.json();
+				}
+			} catch (_error) {}
+		} catch (error) {
+			return {
+				isValid: false,
+				error,
+				sdJwtVc: returnSdJwtVc
+			};
+		}
+		return {
+			isValid: true,
+			sdJwtVc: returnSdJwtVc
+		};
+	}
+	async store(agentContext, options) {
+		await this.sdJwtVcRepository.save(agentContext, options.record);
+		return options.record;
+	}
+	async getById(agentContext, id) {
+		return await this.sdJwtVcRepository.getById(agentContext, id);
+	}
+	async getAll(agentContext) {
+		return await this.sdJwtVcRepository.getAll(agentContext);
+	}
+	async findByQuery(agentContext, query, queryOptions) {
+		return await this.sdJwtVcRepository.findByQuery(agentContext, query, queryOptions);
+	}
+	async deleteById(agentContext, id) {
+		await this.sdJwtVcRepository.deleteById(agentContext, id);
+	}
+	async update(agentContext, sdJwtVcRecord) {
+		await this.sdJwtVcRepository.update(agentContext, sdJwtVcRecord);
+	}
+	async extractKeyFromIssuer(agentContext, issuer, forSigning = false) {
+		if (issuer.method === "did") {
+			const parsedDid = parseDid(issuer.didUrl);
+			if (!parsedDid.fragment) throw new SdJwtVcError(`didUrl '${issuer.didUrl}' does not contain a '#'. Unable to derive key from did document`);
+			let publicJwk;
+			if (forSigning) publicJwk = await resolveSigningPublicJwkFromDidUrl(agentContext, issuer.didUrl);
+			else {
+				const { verificationMethod } = await resolveDidUrl(agentContext, issuer.didUrl);
+				publicJwk = getPublicJwkFromVerificationMethod(verificationMethod);
+			}
+			const supportedSignatureAlgorithms = publicJwk.supportedSignatureAlgorithms;
+			if (supportedSignatureAlgorithms.length === 0) throw new SdJwtVcError(`No supported JWA signature algorithms found for key ${publicJwk.jwkTypeHumanDescription}`);
+			return {
+				alg: supportedSignatureAlgorithms[0],
+				publicJwk,
+				iss: parsedDid.did,
+				kid: `#${parsedDid.fragment}`
+			};
+		}
+		if (issuer.method === "x5c") {
+			const leafCertificate = issuer.x5c[0];
+			if (!leafCertificate) throw new SdJwtVcError("Empty 'x5c' array provided");
+			if (forSigning && !leafCertificate.publicJwk.hasKeyId) throw new SdJwtVcError("Expected leaf certificate in 'x5c' array to have a key id configured.");
+			const publicJwk = leafCertificate.publicJwk;
+			const supportedSignatureAlgorithms = publicJwk.supportedSignatureAlgorithms;
+			if (supportedSignatureAlgorithms.length === 0) throw new SdJwtVcError(`No supported JWA signature algorithms found for key ${publicJwk.jwkTypeHumanDescription}`);
+			const alg = supportedSignatureAlgorithms[0];
+			this.assertValidX5cJwtIssuer(agentContext, issuer.issuer, leafCertificate);
+			return {
+				publicJwk,
+				iss: issuer.issuer,
+				x5c: issuer.x5c,
+				alg
+			};
+		}
+		throw new SdJwtVcError("Unsupported credential issuer. Only 'did' and 'x5c' is supported at the moment.");
+	}
+	async parseIssuerFromCredential(agentContext, sdJwtVc, credoSdJwtVc, _trustedCertificates) {
+		const x509Config = agentContext.dependencyManager.resolve(X509ModuleConfig);
+		if (!sdJwtVc.jwt?.payload) throw new SdJwtVcError("Credential not exist");
+		const iss = sdJwtVc.jwt.payload.iss;
+		if (sdJwtVc.jwt.header?.x5c) {
+			if (!Array.isArray(sdJwtVc.jwt.header.x5c)) throw new SdJwtVcError("Invalid x5c header in credential. Not an array.");
+			if (sdJwtVc.jwt.header.x5c.length === 0) throw new SdJwtVcError("Invalid x5c header in credential. Empty array.");
+			if (sdJwtVc.jwt.header.x5c.some((x5c) => typeof x5c !== "string")) throw new SdJwtVcError("Invalid x5c header in credential. Not an array of strings.");
+			let trustedCertificates = _trustedCertificates;
+			const certificateChain = sdJwtVc.jwt.header.x5c.map((cert) => X509Certificate.fromEncodedCertificate(cert));
+			if (!trustedCertificates) trustedCertificates = await x509Config.getTrustedCertificatesForVerification?.(agentContext, {
+				certificateChain,
+				verification: {
+					type: "credential",
+					credential: credoSdJwtVc
+				}
+			}) ?? x509Config.trustedCertificates;
+			if (!trustedCertificates) throw new SdJwtVcError("No trusted certificates configured for X509 certificate chain validation. Issuer cannot be verified.");
+			await X509Service.validateCertificateChain(agentContext, {
+				certificateChain: sdJwtVc.jwt.header.x5c,
+				trustedCertificates
+			});
+			return {
+				method: "x5c",
+				x5c: certificateChain,
+				issuer: iss
+			};
+		}
+		if (iss?.startsWith("did:")) {
+			if (!sdJwtVc.jwt?.header) throw new SdJwtVcError("Credential does not contain a header");
+			if (!sdJwtVc.jwt.header.kid) throw new SdJwtVcError("Credential does not contain a kid in the header");
+			const issuerKid = sdJwtVc.jwt.header.kid;
+			let didUrl;
+			if (issuerKid.startsWith("#")) didUrl = `${iss}${issuerKid}`;
+			else if (issuerKid.startsWith("did:")) {
+				const didFromKid = parseDid(issuerKid);
+				if (didFromKid.did !== iss) throw new SdJwtVcError(`kid in header is an absolute DID URL, but the did (${didFromKid.did}) does not match with the 'iss' did (${iss})`);
+				didUrl = issuerKid;
+			} else throw new SdJwtVcError("Invalid issuer kid for did. Only absolute or relative (starting with #) did urls are supported.");
+			return {
+				method: "did",
+				didUrl
+			};
+		}
+		throw new SdJwtVcError("Unsupported signing method for SD-JWT VC. Only did and x5c are supported at the moment.");
+	}
+	getBaseSdJwtConfig(agentContext) {
+		const kms = agentContext.resolve(KeyManagementApi);
+		return {
+			hasher: sdJwtVcHasher,
+			statusListFetcher: this.getStatusListFetcher(agentContext),
+			saltGenerator: (length) => TypedArrayEncoder.toBase64URL(kms.randomBytes({ length })).slice(0, length)
+		};
+	}
+	getStatusListFetcher(agentContext) {
+		return async (uri) => {
+			const response = await fetchWithTimeout(agentContext.config.agentDependencies.fetch, uri, { headers: { Accept: "application/statuslist+jwt" } });
+			if (!response.ok) throw new CredoError(`Received invalid response with status ${response.status} when fetching status list from ${uri}. ${await response.text()}`);
+			return await response.text();
+		};
+	}
+};
+SdJwtVcService = __decorate([injectable(), __decorateMetadata("design:paramtypes", [typeof (_ref = typeof SdJwtVcRepository !== "undefined" && SdJwtVcRepository) === "function" ? _ref : Object])], SdJwtVcService);
+
+//#endregion
+export { SdJwtVcService };
+//# sourceMappingURL=SdJwtVcService.mjs.map