@credo-ts/core 0.6.1-pr-2091-20241119140918 → 0.6.2-alpha-20251210145840

package/build/modules/mdoc/MdocDeviceResponse.d.mts

@@ -0,0 +1,135 @@
+import { ClaimFormat } from "../vc/models/ClaimFormat.mjs";
+import { MdocDeviceResponseOptions, MdocDeviceResponsePresentationDefinitionOptions, MdocDeviceResponseVerifyOptions } from "./MdocOptions.mjs";
+import { DifPresentationExchangeDefinition } from "../dif-presentation-exchange/models/index.mjs";
+import "../dif-presentation-exchange/index.mjs";
+import "../vc/index.mjs";
+import { Mdoc } from "./Mdoc.mjs";
+import { AgentContext } from "../../agent/context/AgentContext.mjs";
+import "../../agent/index.mjs";
+import * as _sphereon_pex_models0 from "@sphereon/pex-models";
+import { InputDescriptorV2 } from "@sphereon/pex-models";
+
+//#region src/modules/mdoc/MdocDeviceResponse.d.ts
+declare class MdocDeviceResponse {
+  base64Url: string;
+  documents: Mdoc[];
+  private constructor();
+  /**
+   * claim format is convenience method added to all credential instances
+   */
+  get claimFormat(): ClaimFormat.MsoMdoc;
+  /**
+   * Encoded is convenience method added to all credential instances
+   */
+  get encoded(): string;
+  /**
+   * To support a single DeviceResponse with multiple documents in OpenID4VP
+   */
+  splitIntoSingleDocumentResponses(): MdocDeviceResponse[];
+  private static fromDeviceResponse;
+  static fromBase64Url(base64Url: string): MdocDeviceResponse;
+  private static assertMdocInputDescriptor;
+  static partitionPresentationDefinition: (pd: DifPresentationExchangeDefinition) => {
+    mdocPresentationDefinition: {
+      format: {
+        mso_mdoc: _sphereon_pex_models0.MsoMdocObject | undefined;
+      };
+      input_descriptors: {
+        format: {
+          mso_mdoc: _sphereon_pex_models0.MsoMdocObject;
+        };
+        constraints: {
+          limit_disclosure: string;
+          fields: {
+            intent_to_retain: boolean;
+            id?: string;
+            path: Array<string>;
+            purpose?: string;
+            filter?: _sphereon_pex_models0.FilterV2;
+            predicate?: _sphereon_pex_models0.Optionality;
+            name?: string;
+            optional?: boolean;
+          }[];
+          statuses?: _sphereon_pex_models0.Statuses;
+          subject_is_issuer?: _sphereon_pex_models0.Optionality;
+          is_holder?: Array<_sphereon_pex_models0.HolderSubject>;
+          same_subject?: Array<_sphereon_pex_models0.HolderSubject>;
+        };
+        id: string;
+        name?: string;
+        purpose?: string;
+        group?: Array<string>;
+        issuance?: Array<_sphereon_pex_models0.Issuance>;
+      }[];
+      id: string;
+      name?: string;
+      purpose?: string;
+      submission_requirements?: Array<_sphereon_pex_models0.SubmissionRequirement>;
+    } | {
+      format: {
+        mso_mdoc: _sphereon_pex_models0.MsoMdocObject | undefined;
+      };
+      input_descriptors: {
+        format: {
+          mso_mdoc: _sphereon_pex_models0.MsoMdocObject;
+        };
+        constraints: {
+          limit_disclosure: string;
+          fields: {
+            intent_to_retain: boolean;
+            id?: string;
+            path: Array<string>;
+            purpose?: string;
+            filter?: _sphereon_pex_models0.FilterV2;
+            predicate?: _sphereon_pex_models0.Optionality;
+            name?: string;
+            optional?: boolean;
+          }[];
+          statuses?: _sphereon_pex_models0.Statuses;
+          subject_is_issuer?: _sphereon_pex_models0.Optionality;
+          is_holder?: Array<_sphereon_pex_models0.HolderSubject>;
+          same_subject?: Array<_sphereon_pex_models0.HolderSubject>;
+        };
+        id: string;
+        name?: string;
+        purpose?: string;
+        group?: Array<string>;
+        issuance?: Array<_sphereon_pex_models0.Issuance>;
+      }[];
+      id: string;
+      name?: string;
+      purpose?: string;
+      submission_requirements?: Array<_sphereon_pex_models0.SubmissionRequirement>;
+      frame?: object;
+    };
+    nonMdocPresentationDefinition: DifPresentationExchangeDefinition;
+  };
+  private static createPresentationSubmission;
+  static limitDisclosureToInputDescriptor(options: {
+    inputDescriptor: InputDescriptorV2;
+    mdoc: Mdoc;
+  }): {
+    [k: string]: {
+      [k: string]: unknown;
+    };
+  };
+  static createPresentationDefinitionDeviceResponse(agentContext: AgentContext, options: MdocDeviceResponsePresentationDefinitionOptions): Promise<{
+    deviceResponseBase64Url: string;
+    presentationSubmission: {
+      id: string;
+      definition_id: string;
+      descriptor_map: {
+        id: string;
+        format: string;
+        path: string;
+      }[];
+    };
+  }>;
+  static createDeviceResponse(agentContext: AgentContext, options: MdocDeviceResponseOptions): Promise<Uint8Array<ArrayBufferLike>>;
+  verify(agentContext: AgentContext, options: Omit<MdocDeviceResponseVerifyOptions, 'deviceResponse'>): Promise<Mdoc[]>;
+  private static getSessionTranscriptBytesForOptions;
+  private static getAlgForDeviceKeyJwk;
+}
+//#endregion
+export { MdocDeviceResponse };
+//# sourceMappingURL=MdocDeviceResponse.d.mts.map

package/build/modules/mdoc/MdocDeviceResponse.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MdocDeviceResponse.d.mts","names":[],"sources":["../../../src/modules/mdoc/MdocDeviceResponse.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;cAkCa,kBAAA;;aAGS;;;;;qBAME,WAAA,CAAA;EATX;;;EAuBgC,IAAA,OAAA,CAAA,CAAA,EAAA,MAAA;EAmCE;;;sCAnCF;;2CAmCE;;+CA8CQ;;;kBAAiC,qBAAA,CAAA,aAAA;;;;;;;;;;;;;;;;;;;;;;;;;QA2CX,OAAA,CAAA,EAAA,MAAA;QAAyB,KAAA,CAAA,OAAA,CAAA,MAAA,CAAA;QAoBpF,QAAA,CAAA,OAAA,gCAAA;MACL,CAAA,EAAA;MAA+C,EAAA,EAAA,MAAA;MA0DH,IAAA,CAAA,EAAA,MAAA;MAAuB,OAAA,CAAA,EAAA,MAAA;MAAyB,uBAAA,CAAA,OAAA,6CAAA;IAAA,CAAA,GAAA;MAAA,MAAA,EAAA;QA8CrE,QAAA,wCAAA,SAAA;MAA4B,CAAA;MAAL,iBAAA,EAAA;QAAuD,MAAA,EAAA;UAAA,QAAA,qCAAA;QAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA7HrC;UAAyB;;;;;;kEAoBpF,uBACL,kDAA+C;;;;;;;;;;;;4CA0DH,uBAAuB,4BAAyB,QAAA,WAAA;uBA8CrE,uBAAuB,KAAK,qDAAkD,QAAA"}

package/build/modules/mdoc/MdocDeviceResponse.mjs

@@ -0,0 +1,250 @@
+
+
+import { TypedArrayEncoder } from "../../utils/TypedArrayEncoder.mjs";
+import "../../utils/index.mjs";
+import "../kms/index.mjs";
+import { uuid } from "../../utils/uuid.mjs";
+import { ClaimFormat } from "../vc/models/ClaimFormat.mjs";
+import "../vc/index.mjs";
+import { getMdocContext } from "./MdocContext.mjs";
+import { MdocError } from "./MdocError.mjs";
+import { isMdocSupportedSignatureAlgorithm, mdocSupporteSignatureAlgorithms } from "./mdocSupportedAlgs.mjs";
+import { Mdoc } from "./Mdoc.mjs";
+import { nameSpacesRecordToMap } from "./mdocUtil.mjs";
+import { DataItem, DeviceRequest, DeviceResponse, DeviceSignedDocument, MDoc, MDocStatus, Verifier, cborEncode, defaultCallback, limitDisclosureToInputDescriptor, parseDeviceResponse, parseIssuerSigned } from "@animo-id/mdoc";
+
+//#region src/modules/mdoc/MdocDeviceResponse.ts
+var _MdocDeviceResponse;
+var MdocDeviceResponse = class MdocDeviceResponse {
+	constructor(base64Url, documents) {
+		this.base64Url = base64Url;
+		this.documents = documents;
+	}
+	/**
+	* claim format is convenience method added to all credential instances
+	*/
+	get claimFormat() {
+		return ClaimFormat.MsoMdoc;
+	}
+	/**
+	* Encoded is convenience method added to all credential instances
+	*/
+	get encoded() {
+		return this.base64Url;
+	}
+	/**
+	* To support a single DeviceResponse with multiple documents in OpenID4VP
+	*/
+	splitIntoSingleDocumentResponses() {
+		const deviceResponses = [];
+		if (this.documents.length === 0) throw new MdocError("mdoc device response does not contain any mdocs");
+		for (const document of this.documents) {
+			const deviceResponse = new MDoc();
+			deviceResponse.addDocument(document.issuerSignedDocument);
+			deviceResponses.push(MdocDeviceResponse.fromDeviceResponse(deviceResponse));
+		}
+		return deviceResponses;
+	}
+	static fromDeviceResponse(mdoc) {
+		const documents = mdoc.documents.map((doc) => {
+			const prepared = doc.prepare();
+			const docType = prepared.get("docType");
+			const issuerSigned = cborEncode(prepared.get("issuerSigned"));
+			const deviceSigned = cborEncode(prepared.get("deviceSigned"));
+			return Mdoc.fromDeviceSignedDocument(TypedArrayEncoder.toBase64URL(issuerSigned), TypedArrayEncoder.toBase64URL(deviceSigned), docType);
+		});
+		return new MdocDeviceResponse(TypedArrayEncoder.toBase64URL(mdoc.encode()), documents);
+	}
+	static fromBase64Url(base64Url) {
+		const parsed = parseDeviceResponse(TypedArrayEncoder.fromBase64(base64Url));
+		if (parsed.status !== MDocStatus.OK) throw new MdocError("Parsing Mdoc Device Response failed.");
+		return MdocDeviceResponse.fromDeviceResponse(parsed);
+	}
+	static assertMdocInputDescriptor(inputDescriptor) {
+		if (!inputDescriptor.format || !inputDescriptor.format.mso_mdoc) throw new MdocError(`Input descriptor must contain 'mso_mdoc' format property`);
+		if (!inputDescriptor.format.mso_mdoc.alg) throw new MdocError(`Input descriptor mso_mdoc must contain 'alg' property`);
+		if (!inputDescriptor.constraints?.limit_disclosure || inputDescriptor.constraints.limit_disclosure !== "required") throw new MdocError(`Input descriptor must contain 'limit_disclosure' constraints property which is set to required`);
+		if (!inputDescriptor.constraints?.fields?.every((field) => field.intent_to_retain !== void 0)) throw new MdocError(`Input descriptor must contain 'intent_to_retain' constraints property`);
+		return {
+			...inputDescriptor,
+			format: { mso_mdoc: inputDescriptor.format.mso_mdoc },
+			constraints: {
+				...inputDescriptor.constraints,
+				limit_disclosure: "required",
+				fields: (inputDescriptor.constraints.fields ?? []).map((field) => {
+					return {
+						...field,
+						intent_to_retain: field.intent_to_retain ?? false
+					};
+				})
+			}
+		};
+	}
+	static createPresentationSubmission(input) {
+		const { id, presentationDefinition } = input;
+		if (presentationDefinition.input_descriptors.length !== 1) throw new MdocError("Currently Mdoc Presentation Submissions can only be created for a sigle input descriptor");
+		return {
+			id,
+			definition_id: presentationDefinition.id,
+			descriptor_map: [{
+				id: presentationDefinition.input_descriptors[0].id,
+				format: "mso_mdoc",
+				path: "$"
+			}]
+		};
+	}
+	static limitDisclosureToInputDescriptor(options) {
+		const { mdoc } = options;
+		const inputDescriptor = MdocDeviceResponse.assertMdocInputDescriptor(options.inputDescriptor);
+		const disclosure = limitDisclosureToInputDescriptor(parseIssuerSigned(TypedArrayEncoder.fromBase64(mdoc.base64Url), mdoc.docType), inputDescriptor);
+		return Object.fromEntries(Array.from(disclosure.entries()).map(([namespace, issuerSignedItem]) => {
+			return [namespace, Object.fromEntries(issuerSignedItem.map((item) => [item.elementIdentifier, item.elementValue]))];
+		}));
+	}
+	static async createPresentationDefinitionDeviceResponse(agentContext, options) {
+		const presentationDefinition = MdocDeviceResponse.partitionPresentationDefinition(options.presentationDefinition).mdocPresentationDefinition;
+		const docTypes = options.mdocs.map((i) => i.docType);
+		const combinedDeviceResponseMdoc = new MDoc();
+		for (const document of options.mdocs) {
+			const deviceKeyJwk = document.deviceKey;
+			if (!deviceKeyJwk) throw new MdocError(`Device key is missing in mdoc with doctype ${document.docType}`);
+			if (!deviceKeyJwk.hasKeyId) deviceKeyJwk.keyId = deviceKeyJwk.legacyKeyId;
+			const alg = MdocDeviceResponse.getAlgForDeviceKeyJwk(deviceKeyJwk);
+			const presentationDefinitionForDocument = {
+				...presentationDefinition,
+				input_descriptors: presentationDefinition.input_descriptors.filter((inputDescriptor) => inputDescriptor.id === document.docType)
+			};
+			const mdocContext = getMdocContext(agentContext);
+			const issuerSignedDocument = parseIssuerSigned(TypedArrayEncoder.fromBase64(document.base64Url), document.docType);
+			const deviceResponseBuilder = DeviceResponse.from(new MDoc([issuerSignedDocument])).usingPresentationDefinition(presentationDefinitionForDocument).authenticateWithSignature(deviceKeyJwk.toJson(), alg).usingSessionTranscriptBytes(await MdocDeviceResponse.getSessionTranscriptBytesForOptions(mdocContext, options.sessionTranscriptOptions));
+			for (const [nameSpace, nameSpaceValue] of Object.entries(options.deviceNameSpaces ?? {})) deviceResponseBuilder.addDeviceNameSpace(nameSpace, nameSpaceValue);
+			const deviceResponseMdoc = await deviceResponseBuilder.sign(mdocContext);
+			combinedDeviceResponseMdoc.addDocument(deviceResponseMdoc.documents[0]);
+		}
+		return {
+			deviceResponseBase64Url: TypedArrayEncoder.toBase64URL(combinedDeviceResponseMdoc.encode()),
+			presentationSubmission: MdocDeviceResponse.createPresentationSubmission({
+				id: `MdocPresentationSubmission ${uuid()}`,
+				presentationDefinition: {
+					...presentationDefinition,
+					input_descriptors: presentationDefinition.input_descriptors.filter((i) => docTypes.includes(i.id))
+				}
+			})
+		};
+	}
+	static async createDeviceResponse(agentContext, options) {
+		const combinedDeviceResponseMdoc = new MDoc();
+		for (const document of options.mdocs) {
+			const deviceKeyJwk = document.deviceKey;
+			if (!deviceKeyJwk) throw new MdocError(`Device key is missing in mdoc with doctype ${document.docType}`);
+			const alg = MdocDeviceResponse.getAlgForDeviceKeyJwk(deviceKeyJwk);
+			if (!deviceKeyJwk.hasKeyId) deviceKeyJwk.keyId = deviceKeyJwk.legacyKeyId;
+			const issuerSignedDocument = parseIssuerSigned(TypedArrayEncoder.fromBase64(document.base64Url), document.docType);
+			const deviceRequestForDocument = DeviceRequest.from("1.0", options.documentRequests.filter((request) => request.docType === issuerSignedDocument.docType).map((request) => ({ itemsRequestData: {
+				docType: request.docType,
+				nameSpaces: nameSpacesRecordToMap(request.nameSpaces)
+			} })));
+			const mdocContext = getMdocContext(agentContext);
+			const deviceResponseBuilder = DeviceResponse.from(new MDoc([issuerSignedDocument])).authenticateWithSignature(deviceKeyJwk.toJson(), alg).usingDeviceRequest(deviceRequestForDocument).usingSessionTranscriptBytes(await MdocDeviceResponse.getSessionTranscriptBytesForOptions(mdocContext, options.sessionTranscriptOptions));
+			for (const [nameSpace, nameSpaceValue] of Object.entries(options.deviceNameSpaces ?? {})) deviceResponseBuilder.addDeviceNameSpace(nameSpace, nameSpaceValue);
+			const deviceResponseMdoc = await deviceResponseBuilder.sign(mdocContext);
+			combinedDeviceResponseMdoc.addDocument(deviceResponseMdoc.documents[0]);
+		}
+		return combinedDeviceResponseMdoc.encode();
+	}
+	async verify(agentContext, options) {
+		const verifier = new Verifier();
+		const mdocContext = getMdocContext(agentContext);
+		defaultCallback({
+			status: this.documents.length > 0 ? "PASSED" : "FAILED",
+			check: "Device Response must include at least one document.",
+			category: "DOCUMENT_FORMAT"
+		});
+		const deviceResponse = parseDeviceResponse(TypedArrayEncoder.fromBase64(this.base64Url));
+		for (const documentIndex of this.documents.keys()) {
+			const rawDocument = deviceResponse.documents[documentIndex];
+			const document = this.documents[documentIndex];
+			const verificationResult = await document.verify(agentContext, {
+				now: options.now,
+				trustedCertificates: options.trustedCertificates
+			});
+			if (!verificationResult.isValid) throw new MdocError(`Mdoc at index ${documentIndex} is not valid. ${verificationResult.error}`);
+			if (!(rawDocument instanceof DeviceSignedDocument)) {
+				defaultCallback({
+					status: "FAILED",
+					category: "DEVICE_AUTH",
+					check: `The document is not signed by the device. ${document.docType}`
+				});
+				continue;
+			}
+			await verifier.verifyDeviceSignature({
+				sessionTranscriptBytes: await MdocDeviceResponse.getSessionTranscriptBytesForOptions(mdocContext, options.sessionTranscriptOptions),
+				deviceSigned: rawDocument
+			}, mdocContext);
+		}
+		if (deviceResponse.documentErrors.length > 1) throw new MdocError("Device response verification failed.");
+		if (deviceResponse.status !== MDocStatus.OK) throw new MdocError("Device response verification failed. An unknown error occurred.");
+		return this.documents;
+	}
+	static async getSessionTranscriptBytesForOptions(context, options) {
+		if (options.type === "sesionTranscriptBytes") return options.sessionTranscriptBytes;
+		if (options.type === "openId4Vp") return cborEncode(DataItem.fromData([
+			null,
+			null,
+			["OpenID4VPHandover", await context.crypto.digest({
+				digestAlgorithm: "SHA-256",
+				bytes: cborEncode([
+					options.clientId,
+					options.verifierGeneratedNonce,
+					options.encryptionJwk?.getJwkThumbprint("sha-256") ?? null,
+					options.responseUri
+				])
+			})]
+		]));
+		if (options.type === "openId4VpDraft18") return await DeviceResponse.calculateSessionTranscriptBytesForOID4VP({
+			...options,
+			context
+		});
+		if (options.type === "openId4VpDcApi") return cborEncode(DataItem.fromData([
+			null,
+			null,
+			["OpenID4VPDCAPIHandover", await context.crypto.digest({
+				digestAlgorithm: "SHA-256",
+				bytes: cborEncode([
+					options.origin,
+					options.verifierGeneratedNonce,
+					options.encryptionJwk?.getJwkThumbprint("sha-256") ?? null
+				])
+			})]
+		]));
+		if (options.type === "openId4VpDcApiDraft24") return await DeviceResponse.calculateSessionTranscriptBytesForOID4VPDCApi({
+			...options,
+			context
+		});
+		throw new MdocError("Unsupported session transcript option");
+	}
+	static getAlgForDeviceKeyJwk(jwk) {
+		const signatureAlgorithm = jwk.supportedSignatureAlgorithms.find(isMdocSupportedSignatureAlgorithm);
+		if (!signatureAlgorithm) throw new MdocError(`Unable to create mdoc device response. No supported signature algorithm found to sign device response for jwk  ${jwk.jwkTypeHumanDescription}. Key supports algs ${jwk.supportedSignatureAlgorithms.join(", ")}. mdoc supports algs ${mdocSupporteSignatureAlgorithms.join(", ")}`);
+		return signatureAlgorithm;
+	}
+};
+_MdocDeviceResponse = MdocDeviceResponse;
+MdocDeviceResponse.partitionPresentationDefinition = (pd) => {
+	const nonMdocPresentationDefinition = {
+		...pd,
+		input_descriptors: pd.input_descriptors.filter((id) => !Object.keys(id.format ?? {}).includes("mso_mdoc"))
+	};
+	return {
+		mdocPresentationDefinition: {
+			...pd,
+			format: { mso_mdoc: pd.format?.mso_mdoc },
+			input_descriptors: pd.input_descriptors.filter((id) => Object.keys(id.format ?? {}).includes("mso_mdoc")).map(_MdocDeviceResponse.assertMdocInputDescriptor)
+		},
+		nonMdocPresentationDefinition
+	};
+};
+
+//#endregion
+export { MdocDeviceResponse };
+//# sourceMappingURL=MdocDeviceResponse.mjs.map

package/build/modules/mdoc/MdocDeviceResponse.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"MdocDeviceResponse.mjs","names":["base64Url: string","documents: Mdoc[]","deviceResponses: MdocDeviceResponse[]","mdocLimitDisclosureToInputDescriptor","nonMdocPresentationDefinition: DifPresentationExchangeDefinition","this"],"sources":["../../../src/modules/mdoc/MdocDeviceResponse.ts"],"sourcesContent":["import type { MdocContext, PresentationDefinition } from '@animo-id/mdoc'\nimport {\n  cborEncode,\n  DataItem,\n  DeviceRequest,\n  DeviceResponse,\n  DeviceSignedDocument,\n  MDoc,\n  MDocStatus,\n  limitDisclosureToInputDescriptor as mdocLimitDisclosureToInputDescriptor,\n  defaultCallback as onCheck,\n  parseDeviceResponse,\n  parseIssuerSigned,\n  Verifier,\n} from '@animo-id/mdoc'\nimport type { InputDescriptorV2 } from '@sphereon/pex-models'\nimport type { AgentContext } from '../../agent'\nimport { TypedArrayEncoder } from './../../utils'\nimport { uuid } from '../../utils/uuid'\nimport type { DifPresentationExchangeDefinition } from '../dif-presentation-exchange'\nimport { PublicJwk } from '../kms'\nimport { ClaimFormat } from '../vc'\nimport { Mdoc } from './Mdoc'\nimport { getMdocContext } from './MdocContext'\nimport { MdocError } from './MdocError'\nimport type {\n  MdocDeviceResponseOptions,\n  MdocDeviceResponsePresentationDefinitionOptions,\n  MdocDeviceResponseVerifyOptions,\n  MdocSessionTranscriptOptions,\n} from './MdocOptions'\nimport { isMdocSupportedSignatureAlgorithm, mdocSupporteSignatureAlgorithms } from './mdocSupportedAlgs'\nimport { nameSpacesRecordToMap } from './mdocUtil'\n\nexport class MdocDeviceResponse {\n  private constructor(\n    public base64Url: string,\n    public documents: Mdoc[]\n  ) {}\n\n  /**\n   * claim format is convenience method added to all credential instances\n   */\n  public get claimFormat() {\n    return ClaimFormat.MsoMdoc as const\n  }\n\n  /**\n   * Encoded is convenience method added to all credential instances\n   */\n  public get encoded() {\n    return this.base64Url\n  }\n\n  /**\n   * To support a single DeviceResponse with multiple documents in OpenID4VP\n   */\n  public splitIntoSingleDocumentResponses(): MdocDeviceResponse[] {\n    const deviceResponses: MdocDeviceResponse[] = []\n\n    if (this.documents.length === 0) {\n      throw new MdocError('mdoc device response does not contain any mdocs')\n    }\n\n    for (const document of this.documents) {\n      const deviceResponse = new MDoc()\n\n      deviceResponse.addDocument(document.issuerSignedDocument)\n\n      deviceResponses.push(MdocDeviceResponse.fromDeviceResponse(deviceResponse))\n    }\n\n    return deviceResponses\n  }\n\n  private static fromDeviceResponse(mdoc: MDoc) {\n    const documents = mdoc.documents.map((doc) => {\n      const prepared = doc.prepare()\n      const docType = prepared.get('docType') as string\n      const issuerSigned = cborEncode(prepared.get('issuerSigned'))\n      const deviceSigned = cborEncode(prepared.get('deviceSigned'))\n\n      return Mdoc.fromDeviceSignedDocument(\n        TypedArrayEncoder.toBase64URL(issuerSigned),\n        TypedArrayEncoder.toBase64URL(deviceSigned),\n        docType\n      )\n    })\n\n    return new MdocDeviceResponse(TypedArrayEncoder.toBase64URL(mdoc.encode()), documents)\n  }\n\n  public static fromBase64Url(base64Url: string) {\n    const parsed = parseDeviceResponse(TypedArrayEncoder.fromBase64(base64Url))\n    if (parsed.status !== MDocStatus.OK) {\n      throw new MdocError('Parsing Mdoc Device Response failed.')\n    }\n\n    return MdocDeviceResponse.fromDeviceResponse(parsed)\n  }\n\n  private static assertMdocInputDescriptor(inputDescriptor: InputDescriptorV2) {\n    if (!inputDescriptor.format || !inputDescriptor.format.mso_mdoc) {\n      throw new MdocError(`Input descriptor must contain 'mso_mdoc' format property`)\n    }\n\n    if (!inputDescriptor.format.mso_mdoc.alg) {\n      throw new MdocError(`Input descriptor mso_mdoc must contain 'alg' property`)\n    }\n\n    if (!inputDescriptor.constraints?.limit_disclosure || inputDescriptor.constraints.limit_disclosure !== 'required') {\n      throw new MdocError(\n        `Input descriptor must contain 'limit_disclosure' constraints property which is set to required`\n      )\n    }\n\n    if (!inputDescriptor.constraints?.fields?.every((field) => field.intent_to_retain !== undefined)) {\n      throw new MdocError(`Input descriptor must contain 'intent_to_retain' constraints property`)\n    }\n\n    return {\n      ...inputDescriptor,\n      format: {\n        mso_mdoc: inputDescriptor.format.mso_mdoc,\n      },\n      constraints: {\n        ...inputDescriptor.constraints,\n        limit_disclosure: 'required',\n        fields: (inputDescriptor.constraints.fields ?? []).map((field) => {\n          return {\n            ...field,\n            intent_to_retain: field.intent_to_retain ?? false,\n          }\n        }),\n      },\n    } satisfies PresentationDefinition['input_descriptors'][number]\n  }\n\n  public static partitionPresentationDefinition = (pd: DifPresentationExchangeDefinition) => {\n    const nonMdocPresentationDefinition: DifPresentationExchangeDefinition = {\n      ...pd,\n      input_descriptors: pd.input_descriptors.filter(\n        (id) => !Object.keys((id as InputDescriptorV2).format ?? {}).includes('mso_mdoc')\n      ),\n    } as DifPresentationExchangeDefinition\n\n    const mdocPresentationDefinition = {\n      ...pd,\n      format: { mso_mdoc: pd.format?.mso_mdoc },\n      input_descriptors: (pd.input_descriptors as InputDescriptorV2[])\n        .filter((id) => Object.keys(id.format ?? {}).includes('mso_mdoc'))\n        .map(this.assertMdocInputDescriptor),\n    }\n\n    return { mdocPresentationDefinition, nonMdocPresentationDefinition }\n  }\n\n  private static createPresentationSubmission(input: {\n    id: string\n    presentationDefinition: {\n      id: string\n      input_descriptors: ReturnType<typeof MdocDeviceResponse.assertMdocInputDescriptor>[]\n    }\n  }) {\n    const { id, presentationDefinition } = input\n    if (presentationDefinition.input_descriptors.length !== 1) {\n      throw new MdocError('Currently Mdoc Presentation Submissions can only be created for a sigle input descriptor')\n    }\n    return {\n      id,\n      definition_id: presentationDefinition.id,\n      descriptor_map: [\n        {\n          id: presentationDefinition.input_descriptors[0].id,\n          format: 'mso_mdoc',\n          path: '$',\n        },\n      ],\n    }\n  }\n\n  public static limitDisclosureToInputDescriptor(options: { inputDescriptor: InputDescriptorV2; mdoc: Mdoc }) {\n    const { mdoc } = options\n\n    const inputDescriptor = MdocDeviceResponse.assertMdocInputDescriptor(options.inputDescriptor)\n    const _mdoc = parseIssuerSigned(TypedArrayEncoder.fromBase64(mdoc.base64Url), mdoc.docType)\n\n    const disclosure = mdocLimitDisclosureToInputDescriptor(_mdoc, inputDescriptor)\n    const disclosedPayloadAsRecord = Object.fromEntries(\n      Array.from(disclosure.entries()).map(([namespace, issuerSignedItem]) => {\n        return [\n          namespace,\n          Object.fromEntries(issuerSignedItem.map((item) => [item.elementIdentifier, item.elementValue])),\n        ]\n      })\n    )\n\n    return disclosedPayloadAsRecord\n  }\n\n  public static async createPresentationDefinitionDeviceResponse(\n    agentContext: AgentContext,\n    options: MdocDeviceResponsePresentationDefinitionOptions\n  ) {\n    const presentationDefinition = MdocDeviceResponse.partitionPresentationDefinition(\n      options.presentationDefinition\n    ).mdocPresentationDefinition\n\n    const docTypes = options.mdocs.map((i) => i.docType)\n\n    const combinedDeviceResponseMdoc = new MDoc()\n\n    for (const document of options.mdocs) {\n      const deviceKeyJwk = document.deviceKey\n      if (!deviceKeyJwk) throw new MdocError(`Device key is missing in mdoc with doctype ${document.docType}`)\n\n      // Set keyId to legacy key id if it doesn't have a key id set\n      if (!deviceKeyJwk.hasKeyId) {\n        deviceKeyJwk.keyId = deviceKeyJwk.legacyKeyId\n      }\n\n      const alg = MdocDeviceResponse.getAlgForDeviceKeyJwk(deviceKeyJwk)\n\n      // We do PEX filtering on a different layer, so we only include the needed input descriptor here\n      const presentationDefinitionForDocument = {\n        ...presentationDefinition,\n        input_descriptors: presentationDefinition.input_descriptors.filter(\n          (inputDescriptor) => inputDescriptor.id === document.docType\n        ),\n      }\n\n      const mdocContext = getMdocContext(agentContext)\n      const issuerSignedDocument = parseIssuerSigned(TypedArrayEncoder.fromBase64(document.base64Url), document.docType)\n      const deviceResponseBuilder = DeviceResponse.from(new MDoc([issuerSignedDocument]))\n        .usingPresentationDefinition(presentationDefinitionForDocument)\n        .authenticateWithSignature(deviceKeyJwk.toJson(), alg)\n        .usingSessionTranscriptBytes(\n          await MdocDeviceResponse.getSessionTranscriptBytesForOptions(mdocContext, options.sessionTranscriptOptions)\n        )\n\n      for (const [nameSpace, nameSpaceValue] of Object.entries(options.deviceNameSpaces ?? {})) {\n        deviceResponseBuilder.addDeviceNameSpace(nameSpace, nameSpaceValue)\n      }\n\n      const deviceResponseMdoc = await deviceResponseBuilder.sign(mdocContext)\n      combinedDeviceResponseMdoc.addDocument(deviceResponseMdoc.documents[0])\n    }\n\n    return {\n      deviceResponseBase64Url: TypedArrayEncoder.toBase64URL(combinedDeviceResponseMdoc.encode()),\n      presentationSubmission: MdocDeviceResponse.createPresentationSubmission({\n        id: `MdocPresentationSubmission ${uuid()}`,\n        presentationDefinition: {\n          ...presentationDefinition,\n          input_descriptors: presentationDefinition.input_descriptors.filter((i) => docTypes.includes(i.id)),\n        },\n      }),\n    }\n  }\n\n  public static async createDeviceResponse(agentContext: AgentContext, options: MdocDeviceResponseOptions) {\n    const combinedDeviceResponseMdoc = new MDoc()\n\n    for (const document of options.mdocs) {\n      const deviceKeyJwk = document.deviceKey\n      if (!deviceKeyJwk) throw new MdocError(`Device key is missing in mdoc with doctype ${document.docType}`)\n      const alg = MdocDeviceResponse.getAlgForDeviceKeyJwk(deviceKeyJwk)\n\n      // Set keyId to legacy key id if it doesn't have a key id set\n      if (!deviceKeyJwk.hasKeyId) {\n        deviceKeyJwk.keyId = deviceKeyJwk.legacyKeyId\n      }\n\n      const issuerSignedDocument = parseIssuerSigned(TypedArrayEncoder.fromBase64(document.base64Url), document.docType)\n\n      const deviceRequestForDocument = DeviceRequest.from(\n        '1.0',\n        options.documentRequests\n          .filter((request) => request.docType === issuerSignedDocument.docType)\n          .map((request) => ({\n            itemsRequestData: {\n              docType: request.docType,\n              nameSpaces: nameSpacesRecordToMap(request.nameSpaces),\n            },\n          }))\n      )\n\n      const mdocContext = getMdocContext(agentContext)\n      const deviceResponseBuilder = DeviceResponse.from(new MDoc([issuerSignedDocument]))\n        .authenticateWithSignature(deviceKeyJwk.toJson(), alg)\n        .usingDeviceRequest(deviceRequestForDocument)\n        .usingSessionTranscriptBytes(\n          await MdocDeviceResponse.getSessionTranscriptBytesForOptions(mdocContext, options.sessionTranscriptOptions)\n        )\n\n      for (const [nameSpace, nameSpaceValue] of Object.entries(options.deviceNameSpaces ?? {})) {\n        deviceResponseBuilder.addDeviceNameSpace(nameSpace, nameSpaceValue)\n      }\n\n      const deviceResponseMdoc = await deviceResponseBuilder.sign(mdocContext)\n      combinedDeviceResponseMdoc.addDocument(deviceResponseMdoc.documents[0])\n    }\n\n    return combinedDeviceResponseMdoc.encode()\n  }\n\n  public async verify(agentContext: AgentContext, options: Omit<MdocDeviceResponseVerifyOptions, 'deviceResponse'>) {\n    const verifier = new Verifier()\n    const mdocContext = getMdocContext(agentContext)\n\n    onCheck({\n      status: this.documents.length > 0 ? 'PASSED' : 'FAILED',\n      check: 'Device Response must include at least one document.',\n      category: 'DOCUMENT_FORMAT',\n    })\n\n    const deviceResponse = parseDeviceResponse(TypedArrayEncoder.fromBase64(this.base64Url))\n\n    // NOTE: we do not use the verification from mdoc library, as it checks all documents\n    // based on the same trusted certificates\n    for (const documentIndex of this.documents.keys()) {\n      const rawDocument = deviceResponse.documents[documentIndex]\n      const document = this.documents[documentIndex]\n\n      const verificationResult = await document.verify(agentContext, {\n        now: options.now,\n        trustedCertificates: options.trustedCertificates,\n      })\n\n      if (!verificationResult.isValid) {\n        throw new MdocError(`Mdoc at index ${documentIndex} is not valid. ${verificationResult.error}`)\n      }\n\n      if (!(rawDocument instanceof DeviceSignedDocument)) {\n        onCheck({\n          status: 'FAILED',\n          category: 'DEVICE_AUTH',\n          check: `The document is not signed by the device. ${document.docType}`,\n        })\n        continue\n      }\n\n      await verifier.verifyDeviceSignature(\n        {\n          sessionTranscriptBytes: await MdocDeviceResponse.getSessionTranscriptBytesForOptions(\n            mdocContext,\n            options.sessionTranscriptOptions\n          ),\n          deviceSigned: rawDocument,\n        },\n        mdocContext\n      )\n    }\n\n    if (deviceResponse.documentErrors.length > 1) {\n      throw new MdocError('Device response verification failed.')\n    }\n\n    if (deviceResponse.status !== MDocStatus.OK) {\n      throw new MdocError('Device response verification failed. An unknown error occurred.')\n    }\n\n    return this.documents\n  }\n\n  private static async getSessionTranscriptBytesForOptions(\n    context: MdocContext,\n    options: MdocSessionTranscriptOptions\n  ) {\n    if (options.type === 'sesionTranscriptBytes') {\n      return options.sessionTranscriptBytes\n    }\n\n    // NOTE: temporary until we have updated to the new major version of mdoc\n    // Based on https://github.com/animo/mdoc/blob/main/src/mdoc/models/session-transcript.ts#L84\n    if (options.type === 'openId4Vp') {\n      return cborEncode(\n        DataItem.fromData([\n          null,\n          null,\n          [\n            'OpenID4VPHandover',\n            await context.crypto.digest({\n              digestAlgorithm: 'SHA-256',\n              bytes: cborEncode([\n                options.clientId,\n                options.verifierGeneratedNonce,\n                options.encryptionJwk?.getJwkThumbprint('sha-256') ?? null,\n                options.responseUri,\n              ]),\n            }),\n          ],\n        ])\n      )\n    }\n\n    if (options.type === 'openId4VpDraft18') {\n      return await DeviceResponse.calculateSessionTranscriptBytesForOID4VP({\n        ...options,\n        context,\n      })\n    }\n\n    // NOTE: temporary until we have updated to the new major version of mdoc\n    // Based on https://github.com/animo/mdoc/blob/main/src/mdoc/models/session-transcript.ts#L65\n    if (options.type === 'openId4VpDcApi') {\n      return cborEncode(\n        DataItem.fromData([\n          null,\n          null,\n          [\n            'OpenID4VPDCAPIHandover',\n            await context.crypto.digest({\n              digestAlgorithm: 'SHA-256',\n              bytes: cborEncode([\n                options.origin,\n                options.verifierGeneratedNonce,\n                options.encryptionJwk?.getJwkThumbprint('sha-256') ?? null,\n              ]),\n            }),\n          ],\n        ])\n      )\n    }\n\n    if (options.type === 'openId4VpDcApiDraft24') {\n      return await DeviceResponse.calculateSessionTranscriptBytesForOID4VPDCApi({\n        ...options,\n        context,\n      })\n    }\n\n    throw new MdocError('Unsupported session transcript option')\n  }\n\n  private static getAlgForDeviceKeyJwk(jwk: PublicJwk) {\n    const signatureAlgorithm = jwk.supportedSignatureAlgorithms.find(isMdocSupportedSignatureAlgorithm)\n    if (!signatureAlgorithm) {\n      throw new MdocError(\n        `Unable to create mdoc device response. No supported signature algorithm found to sign device response for jwk  ${\n          jwk.jwkTypeHumanDescription\n        }. Key supports algs ${jwk.supportedSignatureAlgorithms.join(\n          ', '\n        )}. mdoc supports algs ${mdocSupporteSignatureAlgorithms.join(', ')}`\n      )\n    }\n\n    return signatureAlgorithm\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAkCA,IAAa,qBAAb,MAAa,mBAAmB;CAC9B,AAAQ,YACN,AAAOA,WACP,AAAOC,WACP;EAFO;EACA;;;;;CAMT,IAAW,cAAc;AACvB,SAAO,YAAY;;;;;CAMrB,IAAW,UAAU;AACnB,SAAO,KAAK;;;;;CAMd,AAAO,mCAAyD;EAC9D,MAAMC,kBAAwC,EAAE;AAEhD,MAAI,KAAK,UAAU,WAAW,EAC5B,OAAM,IAAI,UAAU,kDAAkD;AAGxE,OAAK,MAAM,YAAY,KAAK,WAAW;GACrC,MAAM,iBAAiB,IAAI,MAAM;AAEjC,kBAAe,YAAY,SAAS,qBAAqB;AAEzD,mBAAgB,KAAK,mBAAmB,mBAAmB,eAAe,CAAC;;AAG7E,SAAO;;CAGT,OAAe,mBAAmB,MAAY;EAC5C,MAAM,YAAY,KAAK,UAAU,KAAK,QAAQ;GAC5C,MAAM,WAAW,IAAI,SAAS;GAC9B,MAAM,UAAU,SAAS,IAAI,UAAU;GACvC,MAAM,eAAe,WAAW,SAAS,IAAI,eAAe,CAAC;GAC7D,MAAM,eAAe,WAAW,SAAS,IAAI,eAAe,CAAC;AAE7D,UAAO,KAAK,yBACV,kBAAkB,YAAY,aAAa,EAC3C,kBAAkB,YAAY,aAAa,EAC3C,QACD;IACD;AAEF,SAAO,IAAI,mBAAmB,kBAAkB,YAAY,KAAK,QAAQ,CAAC,EAAE,UAAU;;CAGxF,OAAc,cAAc,WAAmB;EAC7C,MAAM,SAAS,oBAAoB,kBAAkB,WAAW,UAAU,CAAC;AAC3E,MAAI,OAAO,WAAW,WAAW,GAC/B,OAAM,IAAI,UAAU,uCAAuC;AAG7D,SAAO,mBAAmB,mBAAmB,OAAO;;CAGtD,OAAe,0BAA0B,iBAAoC;AAC3E,MAAI,CAAC,gBAAgB,UAAU,CAAC,gBAAgB,OAAO,SACrD,OAAM,IAAI,UAAU,2DAA2D;AAGjF,MAAI,CAAC,gBAAgB,OAAO,SAAS,IACnC,OAAM,IAAI,UAAU,wDAAwD;AAG9E,MAAI,CAAC,gBAAgB,aAAa,oBAAoB,gBAAgB,YAAY,qBAAqB,WACrG,OAAM,IAAI,UACR,iGACD;AAGH,MAAI,CAAC,gBAAgB,aAAa,QAAQ,OAAO,UAAU,MAAM,qBAAqB,OAAU,CAC9F,OAAM,IAAI,UAAU,wEAAwE;AAG9F,SAAO;GACL,GAAG;GACH,QAAQ,EACN,UAAU,gBAAgB,OAAO,UAClC;GACD,aAAa;IACX,GAAG,gBAAgB;IACnB,kBAAkB;IAClB,SAAS,gBAAgB,YAAY,UAAU,EAAE,EAAE,KAAK,UAAU;AAChE,YAAO;MACL,GAAG;MACH,kBAAkB,MAAM,oBAAoB;MAC7C;MACD;IACH;GACF;;CAsBH,OAAe,6BAA6B,OAMzC;EACD,MAAM,EAAE,IAAI,2BAA2B;AACvC,MAAI,uBAAuB,kBAAkB,WAAW,EACtD,OAAM,IAAI,UAAU,2FAA2F;AAEjH,SAAO;GACL;GACA,eAAe,uBAAuB;GACtC,gBAAgB,CACd;IACE,IAAI,uBAAuB,kBAAkB,GAAG;IAChD,QAAQ;IACR,MAAM;IACP,CACF;GACF;;CAGH,OAAc,iCAAiC,SAA6D;EAC1G,MAAM,EAAE,SAAS;EAEjB,MAAM,kBAAkB,mBAAmB,0BAA0B,QAAQ,gBAAgB;EAG7F,MAAM,aAAaC,iCAFL,kBAAkB,kBAAkB,WAAW,KAAK,UAAU,EAAE,KAAK,QAAQ,EAE5B,gBAAgB;AAU/E,SATiC,OAAO,YACtC,MAAM,KAAK,WAAW,SAAS,CAAC,CAAC,KAAK,CAAC,WAAW,sBAAsB;AACtE,UAAO,CACL,WACA,OAAO,YAAY,iBAAiB,KAAK,SAAS,CAAC,KAAK,mBAAmB,KAAK,aAAa,CAAC,CAAC,CAChG;IACD,CACH;;CAKH,aAAoB,2CAClB,cACA,SACA;EACA,MAAM,yBAAyB,mBAAmB,gCAChD,QAAQ,uBACT,CAAC;EAEF,MAAM,WAAW,QAAQ,MAAM,KAAK,MAAM,EAAE,QAAQ;EAEpD,MAAM,6BAA6B,IAAI,MAAM;AAE7C,OAAK,MAAM,YAAY,QAAQ,OAAO;GACpC,MAAM,eAAe,SAAS;AAC9B,OAAI,CAAC,aAAc,OAAM,IAAI,UAAU,8CAA8C,SAAS,UAAU;AAGxG,OAAI,CAAC,aAAa,SAChB,cAAa,QAAQ,aAAa;GAGpC,MAAM,MAAM,mBAAmB,sBAAsB,aAAa;GAGlE,MAAM,oCAAoC;IACxC,GAAG;IACH,mBAAmB,uBAAuB,kBAAkB,QACzD,oBAAoB,gBAAgB,OAAO,SAAS,QACtD;IACF;GAED,MAAM,cAAc,eAAe,aAAa;GAChD,MAAM,uBAAuB,kBAAkB,kBAAkB,WAAW,SAAS,UAAU,EAAE,SAAS,QAAQ;GAClH,MAAM,wBAAwB,eAAe,KAAK,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAChF,4BAA4B,kCAAkC,CAC9D,0BAA0B,aAAa,QAAQ,EAAE,IAAI,CACrD,4BACC,MAAM,mBAAmB,oCAAoC,aAAa,QAAQ,yBAAyB,CAC5G;AAEH,QAAK,MAAM,CAAC,WAAW,mBAAmB,OAAO,QAAQ,QAAQ,oBAAoB,EAAE,CAAC,CACtF,uBAAsB,mBAAmB,WAAW,eAAe;GAGrE,MAAM,qBAAqB,MAAM,sBAAsB,KAAK,YAAY;AACxE,8BAA2B,YAAY,mBAAmB,UAAU,GAAG;;AAGzE,SAAO;GACL,yBAAyB,kBAAkB,YAAY,2BAA2B,QAAQ,CAAC;GAC3F,wBAAwB,mBAAmB,6BAA6B;IACtE,IAAI,8BAA8B,MAAM;IACxC,wBAAwB;KACtB,GAAG;KACH,mBAAmB,uBAAuB,kBAAkB,QAAQ,MAAM,SAAS,SAAS,EAAE,GAAG,CAAC;KACnG;IACF,CAAC;GACH;;CAGH,aAAoB,qBAAqB,cAA4B,SAAoC;EACvG,MAAM,6BAA6B,IAAI,MAAM;AAE7C,OAAK,MAAM,YAAY,QAAQ,OAAO;GACpC,MAAM,eAAe,SAAS;AAC9B,OAAI,CAAC,aAAc,OAAM,IAAI,UAAU,8CAA8C,SAAS,UAAU;GACxG,MAAM,MAAM,mBAAmB,sBAAsB,aAAa;AAGlE,OAAI,CAAC,aAAa,SAChB,cAAa,QAAQ,aAAa;GAGpC,MAAM,uBAAuB,kBAAkB,kBAAkB,WAAW,SAAS,UAAU,EAAE,SAAS,QAAQ;GAElH,MAAM,2BAA2B,cAAc,KAC7C,OACA,QAAQ,iBACL,QAAQ,YAAY,QAAQ,YAAY,qBAAqB,QAAQ,CACrE,KAAK,aAAa,EACjB,kBAAkB;IAChB,SAAS,QAAQ;IACjB,YAAY,sBAAsB,QAAQ,WAAW;IACtD,EACF,EAAE,CACN;GAED,MAAM,cAAc,eAAe,aAAa;GAChD,MAAM,wBAAwB,eAAe,KAAK,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAChF,0BAA0B,aAAa,QAAQ,EAAE,IAAI,CACrD,mBAAmB,yBAAyB,CAC5C,4BACC,MAAM,mBAAmB,oCAAoC,aAAa,QAAQ,yBAAyB,CAC5G;AAEH,QAAK,MAAM,CAAC,WAAW,mBAAmB,OAAO,QAAQ,QAAQ,oBAAoB,EAAE,CAAC,CACtF,uBAAsB,mBAAmB,WAAW,eAAe;GAGrE,MAAM,qBAAqB,MAAM,sBAAsB,KAAK,YAAY;AACxE,8BAA2B,YAAY,mBAAmB,UAAU,GAAG;;AAGzE,SAAO,2BAA2B,QAAQ;;CAG5C,MAAa,OAAO,cAA4B,SAAkE;EAChH,MAAM,WAAW,IAAI,UAAU;EAC/B,MAAM,cAAc,eAAe,aAAa;AAEhD,kBAAQ;GACN,QAAQ,KAAK,UAAU,SAAS,IAAI,WAAW;GAC/C,OAAO;GACP,UAAU;GACX,CAAC;EAEF,MAAM,iBAAiB,oBAAoB,kBAAkB,WAAW,KAAK,UAAU,CAAC;AAIxF,OAAK,MAAM,iBAAiB,KAAK,UAAU,MAAM,EAAE;GACjD,MAAM,cAAc,eAAe,UAAU;GAC7C,MAAM,WAAW,KAAK,UAAU;GAEhC,MAAM,qBAAqB,MAAM,SAAS,OAAO,cAAc;IAC7D,KAAK,QAAQ;IACb,qBAAqB,QAAQ;IAC9B,CAAC;AAEF,OAAI,CAAC,mBAAmB,QACtB,OAAM,IAAI,UAAU,iBAAiB,cAAc,iBAAiB,mBAAmB,QAAQ;AAGjG,OAAI,EAAE,uBAAuB,uBAAuB;AAClD,oBAAQ;KACN,QAAQ;KACR,UAAU;KACV,OAAO,6CAA6C,SAAS;KAC9D,CAAC;AACF;;AAGF,SAAM,SAAS,sBACb;IACE,wBAAwB,MAAM,mBAAmB,oCAC/C,aACA,QAAQ,yBACT;IACD,cAAc;IACf,EACD,YACD;;AAGH,MAAI,eAAe,eAAe,SAAS,EACzC,OAAM,IAAI,UAAU,uCAAuC;AAG7D,MAAI,eAAe,WAAW,WAAW,GACvC,OAAM,IAAI,UAAU,kEAAkE;AAGxF,SAAO,KAAK;;CAGd,aAAqB,oCACnB,SACA,SACA;AACA,MAAI,QAAQ,SAAS,wBACnB,QAAO,QAAQ;AAKjB,MAAI,QAAQ,SAAS,YACnB,QAAO,WACL,SAAS,SAAS;GAChB;GACA;GACA,CACE,qBACA,MAAM,QAAQ,OAAO,OAAO;IAC1B,iBAAiB;IACjB,OAAO,WAAW;KAChB,QAAQ;KACR,QAAQ;KACR,QAAQ,eAAe,iBAAiB,UAAU,IAAI;KACtD,QAAQ;KACT,CAAC;IACH,CAAC,CACH;GACF,CAAC,CACH;AAGH,MAAI,QAAQ,SAAS,mBACnB,QAAO,MAAM,eAAe,yCAAyC;GACnE,GAAG;GACH;GACD,CAAC;AAKJ,MAAI,QAAQ,SAAS,iBACnB,QAAO,WACL,SAAS,SAAS;GAChB;GACA;GACA,CACE,0BACA,MAAM,QAAQ,OAAO,OAAO;IAC1B,iBAAiB;IACjB,OAAO,WAAW;KAChB,QAAQ;KACR,QAAQ;KACR,QAAQ,eAAe,iBAAiB,UAAU,IAAI;KACvD,CAAC;IACH,CAAC,CACH;GACF,CAAC,CACH;AAGH,MAAI,QAAQ,SAAS,wBACnB,QAAO,MAAM,eAAe,8CAA8C;GACxE,GAAG;GACH;GACD,CAAC;AAGJ,QAAM,IAAI,UAAU,wCAAwC;;CAG9D,OAAe,sBAAsB,KAAgB;EACnD,MAAM,qBAAqB,IAAI,6BAA6B,KAAK,kCAAkC;AACnG,MAAI,CAAC,mBACH,OAAM,IAAI,UACR,kHACE,IAAI,wBACL,sBAAsB,IAAI,6BAA6B,KACtD,KACD,CAAC,uBAAuB,gCAAgC,KAAK,KAAK,GACpE;AAGH,SAAO;;;;mBArTK,mCAAmC,OAA0C;CACzF,MAAMC,gCAAmE;EACvE,GAAG;EACH,mBAAmB,GAAG,kBAAkB,QACrC,OAAO,CAAC,OAAO,KAAM,GAAyB,UAAU,EAAE,CAAC,CAAC,SAAS,WAAW,CAClF;EACF;AAUD,QAAO;EAAE,4BAR0B;GACjC,GAAG;GACH,QAAQ,EAAE,UAAU,GAAG,QAAQ,UAAU;GACzC,mBAAoB,GAAG,kBACpB,QAAQ,OAAO,OAAO,KAAK,GAAG,UAAU,EAAE,CAAC,CAAC,SAAS,WAAW,CAAC,CACjE,IAAIC,oBAAK,0BAA0B;GACvC;EAEoC;EAA+B"}

package/build/modules/mdoc/MdocError.d.mts

@@ -0,0 +1,8 @@
+import { CredoError } from "../../error/CredoError.mjs";
+import "../../error/index.mjs";
+
+//#region src/modules/mdoc/MdocError.d.ts
+declare class MdocError extends CredoError {}
+//#endregion
+export { MdocError };
+//# sourceMappingURL=MdocError.d.mts.map

package/build/modules/mdoc/MdocError.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MdocError.d.mts","names":[],"sources":["../../../src/modules/mdoc/MdocError.ts"],"sourcesContent":[],"mappings":";;;;cAEa,SAAA,SAAkB,UAAA"}

package/build/modules/mdoc/MdocError.mjs

@@ -0,0 +1,11 @@
+
+
+import { CredoError } from "../../error/CredoError.mjs";
+import "../../error/index.mjs";
+
+//#region src/modules/mdoc/MdocError.ts
+var MdocError = class extends CredoError {};
+
+//#endregion
+export { MdocError };
+//# sourceMappingURL=MdocError.mjs.map

package/build/modules/mdoc/MdocError.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"MdocError.mjs","names":[],"sources":["../../../src/modules/mdoc/MdocError.ts"],"sourcesContent":["import { CredoError } from '../../error'\n\nexport class MdocError extends CredoError {}\n"],"mappings":";;;;;;AAEA,IAAa,YAAb,cAA+B,WAAW"}

package/build/modules/mdoc/MdocModule.d.mts

@@ -0,0 +1,19 @@
+import { MdocApi } from "./MdocApi.mjs";
+import { DependencyManager } from "../../plugins/DependencyManager.mjs";
+import { Module } from "../../plugins/Module.mjs";
+import "../../plugins/index.mjs";
+
+//#region src/modules/mdoc/MdocModule.d.ts
+/**
+ * @public
+ */
+declare class MdocModule implements Module {
+  readonly api: typeof MdocApi;
+  /**
+   * Registers the dependencies of the mdoc module on the dependency manager.
+   */
+  register(dependencyManager: DependencyManager): void;
+}
+//#endregion
+export { MdocModule };
+//# sourceMappingURL=MdocModule.d.mts.map

package/build/modules/mdoc/MdocModule.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MdocModule.d.mts","names":[],"sources":["../../../src/modules/mdoc/MdocModule.ts"],"sourcesContent":[],"mappings":";;;;;;;;;cASa,UAAA,YAAsB;uBACd;;AADrB;;EAMqC,QAAA,CAAA,iBAAA,EAAA,iBAAA,CAAA,EAAA,IAAA"}

package/build/modules/mdoc/MdocModule.mjs

@@ -0,0 +1,27 @@
+
+
+import { MdocRepository } from "./repository/MdocRepository.mjs";
+import "./repository/index.mjs";
+import { MdocService } from "./MdocService.mjs";
+import { MdocApi } from "./MdocApi.mjs";
+
+//#region src/modules/mdoc/MdocModule.ts
+/**
+* @public
+*/
+var MdocModule = class {
+	constructor() {
+		this.api = MdocApi;
+	}
+	/**
+	* Registers the dependencies of the mdoc module on the dependency manager.
+	*/
+	register(dependencyManager) {
+		dependencyManager.registerSingleton(MdocService);
+		dependencyManager.registerSingleton(MdocRepository);
+	}
+};
+
+//#endregion
+export { MdocModule };
+//# sourceMappingURL=MdocModule.mjs.map

package/build/modules/mdoc/MdocModule.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"MdocModule.mjs","names":[],"sources":["../../../src/modules/mdoc/MdocModule.ts"],"sourcesContent":["import type { DependencyManager, Module } from '../../plugins'\n\nimport { MdocApi } from './MdocApi'\nimport { MdocService } from './MdocService'\nimport { MdocRepository } from './repository'\n\n/**\n * @public\n */\nexport class MdocModule implements Module {\n  public readonly api = MdocApi\n\n  /**\n   * Registers the dependencies of the mdoc module on the dependency manager.\n   */\n  public register(dependencyManager: DependencyManager) {\n    // Services\n    dependencyManager.registerSingleton(MdocService)\n\n    // Repositories\n    dependencyManager.registerSingleton(MdocRepository)\n  }\n}\n"],"mappings":";;;;;;;;;;;AASA,IAAa,aAAb,MAA0C;;OACxB,MAAM;;;;;CAKtB,AAAO,SAAS,mBAAsC;AAEpD,oBAAkB,kBAAkB,YAAY;AAGhD,oBAAkB,kBAAkB,eAAe"}

package/build/modules/mdoc/MdocOptions.d.mts

@@ -0,0 +1,93 @@
+import { AnyUint8Array } from "../../types.mjs";
+import { EncodedX509Certificate } from "../x509/X509ServiceOptions.mjs";
+import { X509Certificate } from "../x509/X509Certificate.mjs";
+import { MdocRecord } from "./repository/MdocRecord.mjs";
+import "./repository/index.mjs";
+import { DifPresentationExchangeDefinition } from "../dif-presentation-exchange/models/index.mjs";
+import "../dif-presentation-exchange/index.mjs";
+import { Mdoc } from "./Mdoc.mjs";
+import "../x509/index.mjs";
+import { PublicJwk } from "../kms/jwk/PublicJwk.mjs";
+import "../kms/index.mjs";
+import { ValidityInfo } from "@animo-id/mdoc";
+
+//#region src/modules/mdoc/MdocOptions.d.ts
+type MdocNameSpaces = Record<string, Record<string, unknown>>;
+interface MdocStoreOptions {
+  record: MdocRecord;
+}
+type MdocVerifyOptions = {
+  trustedCertificates?: EncodedX509Certificate[];
+  now?: Date;
+};
+type MdocOpenId4VpSessionTranscriptOptions = {
+  type: 'openId4Vp';
+  responseUri: string;
+  clientId: string;
+  verifierGeneratedNonce: string;
+  encryptionJwk?: PublicJwk;
+};
+type MdocOpenId4VpDraft18SessionTranscriptOptions = {
+  type: 'openId4VpDraft18';
+  responseUri: string;
+  clientId: string;
+  verifierGeneratedNonce: string;
+  mdocGeneratedNonce: string;
+};
+type MdocSessionTranscriptByteOptions = {
+  type: 'sesionTranscriptBytes';
+  sessionTranscriptBytes: AnyUint8Array;
+};
+type MdocOpenId4VpDcApiSessionTranscriptOptions = {
+  type: 'openId4VpDcApi';
+  origin: string;
+  verifierGeneratedNonce: string;
+  encryptionJwk?: PublicJwk;
+};
+type MdocOpenId4VpDcApiDraft24SessionTranscriptOptions = {
+  type: 'openId4VpDcApiDraft24';
+  clientId: string;
+  origin: string;
+  verifierGeneratedNonce: string;
+};
+type MdocSessionTranscriptOptions = MdocOpenId4VpSessionTranscriptOptions | MdocOpenId4VpDraft18SessionTranscriptOptions | MdocSessionTranscriptByteOptions | MdocOpenId4VpDcApiSessionTranscriptOptions | MdocOpenId4VpDcApiDraft24SessionTranscriptOptions;
+type MdocDocumentRequest = {
+  docType: string;
+  nameSpaces: Record<string, Record<string, boolean>>;
+};
+type MdocDeviceResponseOptions = {
+  mdocs: [Mdoc, ...Mdoc[]];
+  documentRequests: MdocDocumentRequest[];
+  deviceNameSpaces?: MdocNameSpaces;
+  sessionTranscriptOptions: MdocSessionTranscriptOptions;
+};
+type MdocDeviceResponsePresentationDefinitionOptions = {
+  mdocs: [Mdoc, ...Mdoc[]];
+  presentationDefinition: DifPresentationExchangeDefinition;
+  deviceNameSpaces?: MdocNameSpaces;
+  sessionTranscriptOptions: MdocSessionTranscriptOptions;
+};
+type MdocDeviceResponseVerifyOptions = {
+  trustedCertificates?: EncodedX509Certificate[];
+  sessionTranscriptOptions: MdocSessionTranscriptOptions;
+  /**
+   * The base64Url-encoded device response string.
+   */
+  deviceResponse: string;
+  now?: Date;
+};
+type MdocSignOptions = {
+  docType: 'org.iso.18013.5.1.mDL' | (string & {});
+  validityInfo?: Partial<ValidityInfo>;
+  namespaces: MdocNameSpaces;
+  /**
+   *
+   * The X509 certificate to use for signing the mDOC. The certificate MUST have a
+   * publicJwk with key id configured, enabling signing with the KMS
+   */
+  issuerCertificate: X509Certificate;
+  holderKey: PublicJwk;
+};
+//#endregion
+export { MdocDeviceResponseOptions, MdocDeviceResponsePresentationDefinitionOptions, MdocDeviceResponseVerifyOptions, MdocDocumentRequest, MdocNameSpaces, MdocOpenId4VpDcApiDraft24SessionTranscriptOptions, MdocOpenId4VpDcApiSessionTranscriptOptions, MdocOpenId4VpDraft18SessionTranscriptOptions, MdocOpenId4VpSessionTranscriptOptions, MdocSessionTranscriptByteOptions, MdocSessionTranscriptOptions, MdocSignOptions, MdocStoreOptions, MdocVerifyOptions };
+//# sourceMappingURL=MdocOptions.d.mts.map

package/build/modules/mdoc/MdocOptions.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MdocOptions.d.mts","names":[],"sources":["../../../src/modules/mdoc/MdocOptions.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;;;KAUY,cAAA,GAAiB,eAAe;UAE3B,gBAAA;UACP;;KAGE,iBAAA;wBACY;QAChB;;AARI,KAWA,qCAAA,GAXuB;EAElB,IAAA,EAAA,WAAA;EAIL,WAAA,EAAA,MAAA;EAKA,QAAA,EAAA,MAAA;EAQA,sBAAA,EAAA,MAAA;EAQA,aAAA,CAAA,EAXM,SAWN;AAKZ,CAAA;AAOY,KApBA,4CAAA,GAoBiD;EAOjD,IAAA,EAAA,kBAAA;EACR,WAAA,EAAA,MAAA;EACA,QAAA,EAAA,MAAA;EACA,sBAAA,EAAA,MAAA;EACA,kBAAA,EAAA,MAAA;CACA;AAAiD,KAxBzC,gCAAA,GAwByC;EAEzC,IAAA,EAAA,uBAAmB;EAKnB,sBAAA,EA7Bc,aA6BW;CAC3B;AAAS,KA3BP,0CAAA,GA2BO;EACC,IAAA,EAAA,gBAAA;EACC,MAAA,EAAA,MAAA;EACO,sBAAA,EAAA,MAAA;EAA4B,aAAA,CAAA,EA1BtC,SA0BsC;AAGxD,CAAA;AACU,KA3BE,iDAAA,GA2BF;EAAS,IAAA,EAAA,uBAAA;EACO,QAAA,EAAA,MAAA;EACL,MAAA,EAAA,MAAA;EACO,sBAAA,EAAA,MAAA;CAA4B;AAG5C,KA1BA,4BAAA,GACR,qCAyBuC,GAxBvC,4CAwBuC,GAvBvC,gCAuBuC,GAtBvC,0CAsBuC,GArBvC,iDAqBuC;AACnB,KApBZ,mBAAA,GAoBY;EACI,OAAA,EAAA,MAAA;EAKpB,UAAA,EAxBM,MAwBN,CAAA,MAAA,EAxBqB,MAwBrB,CAAA,MAAA,EAAA,OAAA,CAAA,CAAA;CAAI;AAGA,KAxBA,yBAAA,GAwBe;EAEF,KAAA,EAAA,CAzBf,IAyBe,EAAA,GAzBN,IAyBM,EAAA,CAAA;EAAR,gBAAA,EAxBG,mBAwBH,EAAA;EACH,gBAAA,CAAA,EAxBO,cAwBP;EAOO,wBAAA,EA9BO,4BA8BP;CACR;AAAS,KA5BV,+CAAA,GA4BU;UA3BZ,SAAS;0BACO;qBACL;4BACO;;KAGhB,+BAAA;wBACY;4BACI;;;;;QAKpB;;KAGI,eAAA;;iBAEK,QAAQ;cACX;;;;;;qBAOO;aACR"}

package/build/modules/mdoc/MdocOptions.mjs

@@ -0,0 +1,6 @@
+
+
+import "../kms/index.mjs";
+import "./Mdoc.mjs";
+import "./repository/index.mjs";
+import "@animo-id/mdoc";