@credo-ts/core 0.7.3 → 0.7.4-alpha-20261028231852

package/build/modules/vc/jwt-vc/W3cV2JwtCredentialService.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"W3cV2JwtCredentialService.mjs","names":[],"sources":["../../../../src/modules/vc/jwt-vc/W3cV2JwtCredentialService.ts"],"sourcesContent":["import type { AgentContext } from '../../../agent/context'\nimport { TrustedIssuerContext } from '../../../agent/TrustedIssuerContext'\nimport { JwsService, JwtPayload } from '../../../crypto'\nimport type { VerifyJwsResult } from '../../../crypto/JwsService'\nimport { CredoError } from '../../../error'\nimport { injectable } from '../../../plugins'\nimport { asArray, JsonTransformer, MessageValidator, nowInSeconds } from '../../../utils'\nimport { getPublicJwkFromVerificationMethod } from '../../dids/domain/key-type/keyDidMapping'\nimport { extractKeyFromHolderBinding } from '../../sd-jwt-vc/utils'\nimport type { W3cV2VerifyCredentialResult, W3cV2VerifyPresentationResult } from '../models'\nimport {\n  extractHolderFromPresentationCredentials,\n  getVerificationMethodForJwt,\n  validateAndResolveVerificationMethod,\n} from '../v2-jwt-utils'\nimport {\n  validateVc2ContextBaseline,\n  validateVc2CredentialStatus,\n  validateVc2CredentialValidityPeriod,\n} from '../validators'\nimport type {\n  W3cV2JwtSignCredentialOptions,\n  W3cV2JwtSignPresentationOptions,\n  W3cV2JwtVerifyCredentialOptions,\n  W3cV2JwtVerifyPresentationOptions,\n} from '../W3cV2CredentialServiceOptions'\nimport { W3cV2JwtVerifiableCredential } from './W3cV2JwtVerifiableCredential'\nimport { W3cV2JwtVerifiablePresentation } from './W3cV2JwtVerifiablePresentation'\n\n/**\n * Supports signing and verifying W3C Verifiable Credentials and Presentations\n * secured with JSON Web Tokens (JWT).\n *\n * @see https://www.w3.org/TR/vc-data-model/\n * @see https://www.w3.org/TR/vc-jose-cose/#with-jose\n */\n@injectable()\nexport class W3cV2JwtCredentialService {\n  private jwsService: JwsService\n\n  public constructor(jwsService: JwsService) {\n    this.jwsService = jwsService\n  }\n\n  /**\n   * Signs a credential\n   */\n  public async signCredential(\n    agentContext: AgentContext,\n    options: W3cV2JwtSignCredentialOptions\n  ): Promise<W3cV2JwtVerifiableCredential> {\n    // Validate the instance\n    MessageValidator.validateSync(options.credential)\n\n    // The JWT payload is simply the credential\n    const jwtPayload = new JwtPayload({\n      additionalClaims: JsonTransformer.toJSON(options.credential),\n    })\n\n    // Add iat and cnf to the payload\n    jwtPayload.iat = nowInSeconds()\n    jwtPayload.additionalClaims.cnf = options.holder\n      ? (await extractKeyFromHolderBinding(agentContext, options.holder)).cnf\n      : undefined\n\n    // Validate and resolve the verification method\n    const publicJwk = await validateAndResolveVerificationMethod(agentContext, options.verificationMethod, [\n      'assertionMethod',\n    ])\n\n    // Sign the JWT\n    const jwt = await this.jwsService.createJwsCompact(agentContext, {\n      payload: jwtPayload,\n      keyId: publicJwk.keyId,\n      protectedHeaderOptions: {\n        typ: 'vc+jwt',\n        alg: options.alg,\n        kid: options.verificationMethod,\n      },\n    })\n\n    return W3cV2JwtVerifiableCredential.fromCompact(jwt)\n  }\n\n  /**\n   * Verifies the signature(s) of a credential\n   *\n   * @param credential the credential to be verified\n   * @returns the verification result\n   */\n  public async verifyCredential(\n    agentContext: AgentContext,\n    options: W3cV2JwtVerifyCredentialOptions\n  ): Promise<W3cV2VerifyCredentialResult> {\n    const validationResults: W3cV2VerifyCredentialResult = {\n      isValid: false,\n      validations: {},\n    }\n\n    try {\n      let credential: W3cV2JwtVerifiableCredential\n      try {\n        // If instance is provided as input, we want to validate the credential.\n        // Otherwise, it is done by the fromCompact method below\n        if (options.credential instanceof W3cV2JwtVerifiableCredential) {\n          options.credential.validate()\n        }\n\n        credential =\n          options.credential instanceof W3cV2JwtVerifiableCredential\n            ? options.credential\n            : W3cV2JwtVerifiableCredential.fromCompact(options.credential)\n\n        // Verify the JWT payload (verifies whether it's not expired, etc...)\n        credential.jwt.payload.validate({\n          skewSeconds: agentContext.config.validitySkewSeconds,\n        })\n\n        this.logCredentialShouldWarnings(agentContext, credential)\n\n        validationResults.validations.dataModel = validateVc2ContextBaseline(credential.resolvedCredential.context)\n        if (!validationResults.validations.dataModel.isValid) {\n          return validationResults\n        }\n\n        validationResults.validations.dataModel = {\n          isValid: true,\n        }\n\n        validationResults.validations.validityPeriod = validateVc2CredentialValidityPeriod({\n          validFrom: credential.resolvedCredential.validFrom,\n          validUntil: credential.resolvedCredential.validUntil,\n          skewSeconds: agentContext.config.validitySkewSeconds,\n        })\n\n        validationResults.validations.credentialStatus = validateVc2CredentialStatus({\n          credentialStatus: credential.resolvedCredential.credentialStatus,\n          credentialFormat: 'JWT',\n          verifyCredentialStatus: options.verifyCredentialStatus,\n        })\n      } catch (error) {\n        validationResults.validations.dataModel = {\n          isValid: false,\n          error,\n        }\n\n        return validationResults\n      }\n\n      const issuerVerificationMethod = await getVerificationMethodForJwt(agentContext, credential, ['assertionMethod'])\n      const issuerPublicKey = getPublicJwkFromVerificationMethod(issuerVerificationMethod)\n\n      // Ensure the issuer is trusted according to the (optional) `getTrustedIssuersForVerification`\n      // callback. For did-based issuers this is a no-op when no trusted issuers are configured,\n      // preserving the previous \"trust any valid signature\" behavior. Throws when the issuer is not trusted.\n      await TrustedIssuerContext.ensureTrustedSigner(\n        agentContext,\n        {\n          signer: { method: 'did', didUrl: issuerVerificationMethod.id },\n          verification: { type: 'credential', credential },\n        },\n        options.trustedIssuers\n      )\n\n      let signatureResult: VerifyJwsResult | undefined\n      try {\n        // Verify the JWS signature\n        signatureResult = await this.jwsService.verifyJws(agentContext, {\n          jws: credential.jwt.serializedJwt,\n          // We have pre-fetched the key based on the issuer/signer of the credential\n          jwsSigner: {\n            method: 'did',\n            jwk: issuerPublicKey,\n            didUrl: issuerVerificationMethod.id,\n          },\n        })\n\n        if (!signatureResult.isValid) {\n          validationResults.validations.signature = {\n            isValid: false,\n            error: new CredoError('Invalid JWS signature'),\n          }\n        } else {\n          validationResults.validations.signature = {\n            isValid: true,\n          }\n        }\n      } catch (error) {\n        validationResults.validations.signature = {\n          isValid: false,\n          error,\n        }\n      }\n\n      // Validate whether the credential is signed with the 'issuer' id\n      // NOTE: this uses the verificationMethod.controller. We may want to use the verificationMethod.id?\n      if (credential.resolvedCredential.issuerId !== issuerVerificationMethod.controller) {\n        validationResults.validations.issuerIsSigner = {\n          isValid: false,\n          error: new CredoError(\n            `Credential is signed using verification method ${issuerVerificationMethod.id}, while the issuer of the credential is '${credential.resolvedCredential.issuerId}'`\n          ),\n        }\n      } else {\n        validationResults.validations.issuerIsSigner = {\n          isValid: true,\n        }\n      }\n\n      // Validate whether the `issuer` of the credential is also the signer\n      const issuerIsSigner = signatureResult?.jwsSigners.some(\n        (jwsSigner) => jwsSigner.jwk.fingerprint === issuerPublicKey.fingerprint\n      )\n      if (!issuerIsSigner) {\n        validationResults.validations.issuerIsSigner = {\n          isValid: false,\n          error: new CredoError('Credential is not signed by the issuer of the credential'),\n        }\n      } else {\n        validationResults.validations.issuerIsSigner = {\n          isValid: true,\n        }\n      }\n\n      validationResults.isValid = Object.values(validationResults.validations).every(\n        (validation) => validation?.isValid === true\n      )\n\n      return validationResults\n    } catch (error) {\n      validationResults.error = error\n      return validationResults\n    }\n  }\n\n  /**\n   * Signs a presentation including the credentials it includes\n   *\n   * @param presentation the presentation to be signed\n   * @returns the signed presentation\n   */\n  public async signPresentation(\n    agentContext: AgentContext,\n    options: W3cV2JwtSignPresentationOptions\n  ): Promise<W3cV2JwtVerifiablePresentation> {\n    // Validate the instance\n    MessageValidator.validateSync(options.presentation)\n\n    // The JWT payload is simply the presentation\n    const jwtPayload = new JwtPayload({\n      additionalClaims: JsonTransformer.toJSON(options.presentation),\n    })\n\n    // Add the nonce and aud to the payload\n    jwtPayload.additionalClaims.nonce = options.challenge\n    jwtPayload.aud = options.domain\n\n    const holder = await extractHolderFromPresentationCredentials(agentContext, options.presentation)\n\n    // Sign JWT\n    const jwt = await this.jwsService.createJwsCompact(agentContext, {\n      payload: jwtPayload,\n      keyId: holder.publicJwk.keyId,\n      protectedHeaderOptions: {\n        typ: 'vp+jwt',\n        alg: holder.alg,\n        kid: holder?.cnf?.kid,\n      },\n    })\n\n    return W3cV2JwtVerifiablePresentation.fromCompact(jwt)\n  }\n\n  /**\n   * Verifies a presentation including the credentials it includes\n   *\n   * @param presentation the presentation to be verified\n   * @returns the verification result\n   */\n  public async verifyPresentation(\n    agentContext: AgentContext,\n    options: W3cV2JwtVerifyPresentationOptions\n  ): Promise<W3cV2VerifyPresentationResult> {\n    const validationResults: W3cV2VerifyPresentationResult = {\n      isValid: false,\n      presentation: {\n        isValid: false,\n        validations: {},\n      },\n      credentialEntries: [],\n    }\n\n    try {\n      let presentation: W3cV2JwtVerifiablePresentation\n      try {\n        // If instance is provided as input, we want to validate the presentation\n        if (options.presentation instanceof W3cV2JwtVerifiablePresentation) {\n          options.presentation.validate()\n        }\n\n        presentation =\n          options.presentation instanceof W3cV2JwtVerifiablePresentation\n            ? options.presentation\n            : W3cV2JwtVerifiablePresentation.fromCompact(options.presentation)\n\n        // Verify the JWT payload (verifies whether it's not expired, etc...)\n        presentation.jwt.payload.validate({\n          skewSeconds: agentContext.config.validitySkewSeconds,\n        })\n\n        this.logPresentationShouldWarnings(agentContext, presentation)\n\n        // Make sure challenge matches nonce\n        if (options.challenge !== presentation.jwt.payload.additionalClaims.nonce) {\n          throw new CredoError(`JWT payload 'nonce' does not match challenge '${options.challenge}'`)\n        }\n\n        const audArray = asArray(presentation.jwt.payload.aud)\n        if (options.domain && !audArray.includes(options.domain)) {\n          throw new CredoError(`JWT payload 'aud' does not include domain '${options.domain}'`)\n        }\n\n        const contextValidationResult = validateVc2ContextBaseline(presentation.resolvedPresentation.context)\n        if (!contextValidationResult.isValid) {\n          throw contextValidationResult.error\n        }\n\n        validationResults.presentation.validations.dataModel = {\n          isValid: true,\n        }\n      } catch (error) {\n        validationResults.presentation.validations.dataModel = {\n          isValid: false,\n          error,\n        }\n\n        return validationResults\n      }\n\n      const proverVerificationMethod = await getVerificationMethodForJwt(agentContext, presentation, ['authentication'])\n      const proverPublicKey = getPublicJwkFromVerificationMethod(proverVerificationMethod)\n\n      try {\n        // Verify the JWS signature\n        const signatureResult = await this.jwsService.verifyJws(agentContext, {\n          jws: presentation.jwt.serializedJwt,\n          allowedJwsSignerMethods: ['did'],\n          jwsSigner: {\n            method: 'did',\n            didUrl: proverVerificationMethod.id,\n            jwk: proverPublicKey,\n          },\n          trustedCertificates: [],\n        })\n\n        if (!signatureResult.isValid) {\n          validationResults.presentation.validations.presentationSignature = {\n            isValid: false,\n            error: new CredoError('Invalid JWS signature on presentation'),\n          }\n        } else {\n          validationResults.presentation.validations.presentationSignature = {\n            isValid: true,\n          }\n        }\n      } catch (error) {\n        validationResults.presentation.validations.presentationSignature = {\n          isValid: false,\n          error,\n        }\n      }\n\n      // Validate whether the presentation is signed with the 'holder' id\n      // NOTE: this uses the verificationMethod.controller. We may want to use the verificationMethod.id?\n      if (\n        presentation.resolvedPresentation.holderId &&\n        proverVerificationMethod.controller !== presentation.resolvedPresentation.holderId\n      ) {\n        validationResults.presentation.validations.holderIsSigner = {\n          isValid: false,\n          error: new CredoError(\n            `Presentation is signed using verification method ${proverVerificationMethod.id}, while the holder of the presentation is '${presentation.resolvedPresentation.holderId}'`\n          ),\n        }\n      } else {\n        // If no holderId is present, this validation passes by default as there can't be\n        // a mismatch between the 'holder' property and the signer of the presentation.\n        validationResults.presentation.validations.holderIsSigner = {\n          isValid: true,\n        }\n      }\n\n      validationResults.presentation.isValid = Object.values(validationResults.presentation.validations).every(\n        (validation) => validation.isValid\n      )\n\n      // Credential-entry dispatch is orchestrated by W3cV2CredentialService.\n      // This service verifies VP container integrity only.\n      validationResults.isValid = validationResults.presentation.isValid\n\n      return validationResults\n    } catch (error) {\n      validationResults.error = error\n      return validationResults\n    }\n  }\n\n  private logCredentialShouldWarnings(agentContext: AgentContext, credential: W3cV2JwtVerifiableCredential) {\n    const payload = credential.jwt.payload\n    const headerIss = credential.jwt.header.iss\n\n    if (typeof headerIss === 'string' && typeof payload.iss === 'string' && headerIss !== payload.iss) {\n      agentContext.config.logger.warn('VC-JOSE-COSE SHOULD warning: JOSE header iss conflicts with payload iss', {\n        format: 'vc+jwt',\n        headerIss,\n        payloadIss: payload.iss,\n      })\n    }\n\n    if (\n      typeof payload.jti === 'string' &&\n      credential.resolvedCredential.id &&\n      credential.resolvedCredential.id !== payload.jti\n    ) {\n      agentContext.config.logger.warn('VC-JOSE-COSE SHOULD warning: jti claim conflicts with credential id', {\n        format: 'vc+jwt',\n        jti: payload.jti,\n        credentialId: credential.resolvedCredential.id,\n      })\n    }\n\n    if (typeof payload.sub === 'string' && !credential.resolvedCredential.credentialSubjectIds.includes(payload.sub)) {\n      agentContext.config.logger.warn(\n        'VC-JOSE-COSE SHOULD warning: sub claim does not match any credentialSubject.id',\n        {\n          format: 'vc+jwt',\n          sub: payload.sub,\n          credentialSubjectIds: credential.resolvedCredential.credentialSubjectIds,\n        }\n      )\n    }\n  }\n\n  private logPresentationShouldWarnings(agentContext: AgentContext, presentation: W3cV2JwtVerifiablePresentation) {\n    const payload = presentation.jwt.payload\n    const headerIss = presentation.jwt.header.iss\n\n    if (typeof headerIss === 'string' && typeof payload.iss === 'string' && headerIss !== payload.iss) {\n      agentContext.config.logger.warn('VC-JOSE-COSE SHOULD warning: JOSE header iss conflicts with payload iss', {\n        format: 'vp+jwt',\n        headerIss,\n        payloadIss: payload.iss,\n      })\n    }\n\n    if (\n      typeof payload.jti === 'string' &&\n      presentation.resolvedPresentation.id &&\n      presentation.resolvedPresentation.id !== payload.jti\n    ) {\n      agentContext.config.logger.warn('VC-JOSE-COSE SHOULD warning: jti claim conflicts with presentation id', {\n        format: 'vp+jwt',\n        jti: payload.jti,\n        presentationId: presentation.resolvedPresentation.id,\n      })\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAqCO,IAAM,4BAAN,MAAM,0BAA0B;CAGrC,YAAmB,YAAwB;EACzC,KAAK,aAAa;CACpB;;;;CAKA,MAAa,eACX,cACA,SACuC;EAEvC,iBAAiB,aAAa,QAAQ,UAAU;EAGhD,MAAM,aAAa,IAAI,WAAW,EAChC,kBAAkB,gBAAgB,OAAO,QAAQ,UAAU,EAC7D,CAAC;EAGD,WAAW,MAAM,aAAa;EAC9B,WAAW,iBAAiB,MAAM,QAAQ,UACrC,MAAM,4BAA4B,cAAc,QAAQ,MAAM,EAAA,CAAG,MAClE,KAAA;EAGJ,MAAM,YAAY,MAAM,qCAAqC,cAAc,QAAQ,oBAAoB,CACrG,iBACF,CAAC;EAGD,MAAM,MAAM,MAAM,KAAK,WAAW,iBAAiB,cAAc;GAC/D,SAAS;GACT,OAAO,UAAU;GACjB,wBAAwB;IACtB,KAAK;IACL,KAAK,QAAQ;IACb,KAAK,QAAQ;GACf;EACF,CAAC;EAED,OAAO,6BAA6B,YAAY,GAAG;CACrD;;;;;;;CAQA,MAAa,iBACX,cACA,SACsC;EACtC,MAAM,oBAAiD;GACrD,SAAS;GACT,aAAa,CAAC;EAChB;EAEA,IAAI;GACF,IAAI;GACJ,IAAI;IAGF,IAAI,QAAQ,sBAAsB,8BAChC,QAAQ,WAAW,SAAS;IAG9B,aACE,QAAQ,sBAAsB,+BAC1B,QAAQ,aACR,6BAA6B,YAAY,QAAQ,UAAU;IAGjE,WAAW,IAAI,QAAQ,SAAS,EAC9B,aAAa,aAAa,OAAO,oBACnC,CAAC;IAED,KAAK,4BAA4B,cAAc,UAAU;IAEzD,kBAAkB,YAAY,YAAY,2BAA2B,WAAW,mBAAmB,OAAO;IAC1G,IAAI,CAAC,kBAAkB,YAAY,UAAU,SAC3C,OAAO;IAGT,kBAAkB,YAAY,YAAY,EACxC,SAAS,KACX;IAEA,kBAAkB,YAAY,iBAAiB,oCAAoC;KACjF,WAAW,WAAW,mBAAmB;KACzC,YAAY,WAAW,mBAAmB;KAC1C,aAAa,aAAa,OAAO;IACnC,CAAC;IAED,kBAAkB,YAAY,mBAAmB,4BAA4B;KAC3E,kBAAkB,WAAW,mBAAmB;KAChD,kBAAkB;KAClB,wBAAwB,QAAQ;IAClC,CAAC;GACH,SAAS,OAAO;IACd,kBAAkB,YAAY,YAAY;KACxC,SAAS;KACT;IACF;IAEA,OAAO;GACT;GAEA,MAAM,2BAA2B,MAAM,4BAA4B,cAAc,YAAY,CAAC,iBAAiB,CAAC;GAChH,MAAM,kBAAkB,mCAAmC,wBAAwB;GAKnF,MAAM,qBAAqB,oBACzB,cACA;IACE,QAAQ;KAAE,QAAQ;KAAO,QAAQ,yBAAyB;IAAG;IAC7D,cAAc;KAAE,MAAM;KAAc;IAAW;GACjD,GACA,QAAQ,cACV;GAEA,IAAI;GACJ,IAAI;IAEF,kBAAkB,MAAM,KAAK,WAAW,UAAU,cAAc;KAC9D,KAAK,WAAW,IAAI;KAEpB,WAAW;MACT,QAAQ;MACR,KAAK;MACL,QAAQ,yBAAyB;KACnC;IACF,CAAC;IAED,IAAI,CAAC,gBAAgB,SACnB,kBAAkB,YAAY,YAAY;KACxC,SAAS;KACT,OAAO,IAAI,WAAW,uBAAuB;IAC/C;SAEA,kBAAkB,YAAY,YAAY,EACxC,SAAS,KACX;GAEJ,SAAS,OAAO;IACd,kBAAkB,YAAY,YAAY;KACxC,SAAS;KACT;IACF;GACF;GAIA,IAAI,WAAW,mBAAmB,aAAa,yBAAyB,YACtE,kBAAkB,YAAY,iBAAiB;IAC7C,SAAS;IACT,OAAO,IAAI,WACT,kDAAkD,yBAAyB,GAAG,2CAA2C,WAAW,mBAAmB,SAAS,EAClK;GACF;QAEA,kBAAkB,YAAY,iBAAiB,EAC7C,SAAS,KACX;GAOF,IAAI,CAHmB,iBAAiB,WAAW,MAChD,cAAc,UAAU,IAAI,gBAAgB,gBAAgB,WAC/D,GAEE,kBAAkB,YAAY,iBAAiB;IAC7C,SAAS;IACT,OAAO,IAAI,WAAW,0DAA0D;GAClF;QAEA,kBAAkB,YAAY,iBAAiB,EAC7C,SAAS,KACX;GAGF,kBAAkB,UAAU,OAAO,OAAO,kBAAkB,WAAW,CAAC,CAAC,OACtE,eAAe,YAAY,YAAY,IAC1C;GAEA,OAAO;EACT,SAAS,OAAO;GACd,kBAAkB,QAAQ;GAC1B,OAAO;EACT;CACF;;;;;;;CAQA,MAAa,iBACX,cACA,SACyC;EAEzC,iBAAiB,aAAa,QAAQ,YAAY;EAGlD,MAAM,aAAa,IAAI,WAAW,EAChC,kBAAkB,gBAAgB,OAAO,QAAQ,YAAY,EAC/D,CAAC;EAGD,WAAW,iBAAiB,QAAQ,QAAQ;EAC5C,WAAW,MAAM,QAAQ;EAEzB,MAAM,SAAS,MAAM,yCAAyC,cAAc,QAAQ,YAAY;EAGhG,MAAM,MAAM,MAAM,KAAK,WAAW,iBAAiB,cAAc;GAC/D,SAAS;GACT,OAAO,OAAO,UAAU;GACxB,wBAAwB;IACtB,KAAK;IACL,KAAK,OAAO;IACZ,KAAK,QAAQ,KAAK;GACpB;EACF,CAAC;EAED,OAAO,+BAA+B,YAAY,GAAG;CACvD;;;;;;;CAQA,MAAa,mBACX,cACA,SACwC;EACxC,MAAM,oBAAmD;GACvD,SAAS;GACT,cAAc;IACZ,SAAS;IACT,aAAa,CAAC;GAChB;GACA,mBAAmB,CAAC;EACtB;EAEA,IAAI;GACF,IAAI;GACJ,IAAI;IAEF,IAAI,QAAQ,wBAAwB,gCAClC,QAAQ,aAAa,SAAS;IAGhC,eACE,QAAQ,wBAAwB,iCAC5B,QAAQ,eACR,+BAA+B,YAAY,QAAQ,YAAY;IAGrE,aAAa,IAAI,QAAQ,SAAS,EAChC,aAAa,aAAa,OAAO,oBACnC,CAAC;IAED,KAAK,8BAA8B,cAAc,YAAY;IAG7D,IAAI,QAAQ,cAAc,aAAa,IAAI,QAAQ,iBAAiB,OAClE,MAAM,IAAI,WAAW,iDAAiD,QAAQ,UAAU,EAAE;IAG5F,MAAM,WAAW,QAAQ,aAAa,IAAI,QAAQ,GAAG;IACrD,IAAI,QAAQ,UAAU,CAAC,SAAS,SAAS,QAAQ,MAAM,GACrD,MAAM,IAAI,WAAW,8CAA8C,QAAQ,OAAO,EAAE;IAGtF,MAAM,0BAA0B,2BAA2B,aAAa,qBAAqB,OAAO;IACpG,IAAI,CAAC,wBAAwB,SAC3B,MAAM,wBAAwB;IAGhC,kBAAkB,aAAa,YAAY,YAAY,EACrD,SAAS,KACX;GACF,SAAS,OAAO;IACd,kBAAkB,aAAa,YAAY,YAAY;KACrD,SAAS;KACT;IACF;IAEA,OAAO;GACT;GAEA,MAAM,2BAA2B,MAAM,4BAA4B,cAAc,cAAc,CAAC,gBAAgB,CAAC;GACjH,MAAM,kBAAkB,mCAAmC,wBAAwB;GAEnF,IAAI;IAaF,IAAI,EAAC,MAXyB,KAAK,WAAW,UAAU,cAAc;KACpE,KAAK,aAAa,IAAI;KACtB,yBAAyB,CAAC,KAAK;KAC/B,WAAW;MACT,QAAQ;MACR,QAAQ,yBAAyB;MACjC,KAAK;KACP;KACA,qBAAqB,CAAC;IACxB,CAAC,EAAA,CAEoB,SACnB,kBAAkB,aAAa,YAAY,wBAAwB;KACjE,SAAS;KACT,OAAO,IAAI,WAAW,uCAAuC;IAC/D;SAEA,kBAAkB,aAAa,YAAY,wBAAwB,EACjE,SAAS,KACX;GAEJ,SAAS,OAAO;IACd,kBAAkB,aAAa,YAAY,wBAAwB;KACjE,SAAS;KACT;IACF;GACF;GAIA,IACE,aAAa,qBAAqB,YAClC,yBAAyB,eAAe,aAAa,qBAAqB,UAE1E,kBAAkB,aAAa,YAAY,iBAAiB;IAC1D,SAAS;IACT,OAAO,IAAI,WACT,oDAAoD,yBAAyB,GAAG,6CAA6C,aAAa,qBAAqB,SAAS,EAC1K;GACF;QAIA,kBAAkB,aAAa,YAAY,iBAAiB,EAC1D,SAAS,KACX;GAGF,kBAAkB,aAAa,UAAU,OAAO,OAAO,kBAAkB,aAAa,WAAW,CAAC,CAAC,OAChG,eAAe,WAAW,OAC7B;GAIA,kBAAkB,UAAU,kBAAkB,aAAa;GAE3D,OAAO;EACT,SAAS,OAAO;GACd,kBAAkB,QAAQ;GAC1B,OAAO;EACT;CACF;CAEA,4BAAoC,cAA4B,YAA0C;EACxG,MAAM,UAAU,WAAW,IAAI;EAC/B,MAAM,YAAY,WAAW,IAAI,OAAO;EAExC,IAAI,OAAO,cAAc,YAAY,OAAO,QAAQ,QAAQ,YAAY,cAAc,QAAQ,KAC5F,aAAa,OAAO,OAAO,KAAK,2EAA2E;GACzG,QAAQ;GACR;GACA,YAAY,QAAQ;EACtB,CAAC;EAGH,IACE,OAAO,QAAQ,QAAQ,YACvB,WAAW,mBAAmB,MAC9B,WAAW,mBAAmB,OAAO,QAAQ,KAE7C,aAAa,OAAO,OAAO,KAAK,uEAAuE;GACrG,QAAQ;GACR,KAAK,QAAQ;GACb,cAAc,WAAW,mBAAmB;EAC9C,CAAC;EAGH,IAAI,OAAO,QAAQ,QAAQ,YAAY,CAAC,WAAW,mBAAmB,qBAAqB,SAAS,QAAQ,GAAG,GAC7G,aAAa,OAAO,OAAO,KACzB,kFACA;GACE,QAAQ;GACR,KAAK,QAAQ;GACb,sBAAsB,WAAW,mBAAmB;EACtD,CACF;CAEJ;CAEA,8BAAsC,cAA4B,cAA8C;EAC9G,MAAM,UAAU,aAAa,IAAI;EACjC,MAAM,YAAY,aAAa,IAAI,OAAO;EAE1C,IAAI,OAAO,cAAc,YAAY,OAAO,QAAQ,QAAQ,YAAY,cAAc,QAAQ,KAC5F,aAAa,OAAO,OAAO,KAAK,2EAA2E;GACzG,QAAQ;GACR;GACA,YAAY,QAAQ;EACtB,CAAC;EAGH,IACE,OAAO,QAAQ,QAAQ,YACvB,aAAa,qBAAqB,MAClC,aAAa,qBAAqB,OAAO,QAAQ,KAEjD,aAAa,OAAO,OAAO,KAAK,yEAAyE;GACvG,QAAQ;GACR,KAAK,QAAQ;GACb,gBAAgB,aAAa,qBAAqB;EACpD,CAAC;CAEL;AACF;AA/aC,4BAAA,WAAA,CAAA,WAAW,GAAA,mBAAA,qBAAA,CAAA,OAAA,eAAA,cAAA,SAAA,UAAA,CAAA,CAAA,GAAA,yBAAA"}
+{"version":3,"file":"W3cV2JwtCredentialService.mjs","names":[],"sources":["../../../../src/modules/vc/jwt-vc/W3cV2JwtCredentialService.ts"],"sourcesContent":["import type { AgentContext } from '../../../agent/context'\nimport { TrustedIssuerContext } from '../../../agent/TrustedIssuerContext'\nimport { JwsService, JwtPayload } from '../../../crypto'\nimport type { VerifyJwsResult } from '../../../crypto/JwsService'\nimport { CredoError } from '../../../error'\nimport { injectable } from '../../../plugins'\nimport { asArray, JsonTransformer, MessageValidator, nowInSeconds } from '../../../utils'\nimport { getPublicJwkFromVerificationMethod } from '../../dids/domain/key-type/keyDidMapping'\nimport { extractKeyFromHolderBinding } from '../../sd-jwt-vc/utils'\nimport type { W3cV2VerifyCredentialResult, W3cV2VerifyPresentationResult } from '../models'\nimport { validateSignerIsExpectedParty } from '../resolveSigner'\nimport {\n  extractHolderFromPresentationCredentials,\n  getSignerForJwt,\n  validateAndResolveVerificationMethod,\n} from '../v2-jwt-utils'\nimport {\n  validateVc2ContextBaseline,\n  validateVc2CredentialStatus,\n  validateVc2CredentialValidityPeriod,\n} from '../validators'\nimport type {\n  W3cV2JwtSignCredentialOptions,\n  W3cV2JwtSignPresentationOptions,\n  W3cV2JwtVerifyCredentialOptions,\n  W3cV2JwtVerifyPresentationOptions,\n} from '../W3cV2CredentialServiceOptions'\nimport { W3cV2JwtVerifiableCredential } from './W3cV2JwtVerifiableCredential'\nimport { W3cV2JwtVerifiablePresentation } from './W3cV2JwtVerifiablePresentation'\n\n/**\n * Supports signing and verifying W3C Verifiable Credentials and Presentations\n * secured with JSON Web Tokens (JWT).\n *\n * @see https://www.w3.org/TR/vc-data-model/\n * @see https://www.w3.org/TR/vc-jose-cose/#with-jose\n */\n@injectable()\nexport class W3cV2JwtCredentialService {\n  private jwsService: JwsService\n\n  public constructor(jwsService: JwsService) {\n    this.jwsService = jwsService\n  }\n\n  /**\n   * Signs a credential\n   */\n  public async signCredential(\n    agentContext: AgentContext,\n    options: W3cV2JwtSignCredentialOptions\n  ): Promise<W3cV2JwtVerifiableCredential> {\n    // Validate the instance\n    MessageValidator.validateSync(options.credential)\n\n    // The JWT payload is simply the credential\n    const jwtPayload = new JwtPayload({\n      additionalClaims: JsonTransformer.toJSON(options.credential),\n    })\n\n    // Add iat and cnf to the payload\n    jwtPayload.iat = nowInSeconds()\n    jwtPayload.additionalClaims.cnf = options.holder\n      ? (await extractKeyFromHolderBinding(agentContext, options.holder, { didPurposes: ['authentication'] })).cnf\n      : undefined\n\n    // Validate and resolve the verification method\n    const publicJwk = await validateAndResolveVerificationMethod(agentContext, options.verificationMethod, [\n      'assertionMethod',\n    ])\n\n    // Sign the JWT\n    const jwt = await this.jwsService.createJwsCompact(agentContext, {\n      payload: jwtPayload,\n      keyId: publicJwk.keyId,\n      protectedHeaderOptions: {\n        typ: 'vc+jwt',\n        alg: options.alg,\n        kid: options.verificationMethod,\n      },\n    })\n\n    return W3cV2JwtVerifiableCredential.fromCompact(jwt)\n  }\n\n  /**\n   * Verifies the signature(s) of a credential\n   *\n   * @param credential the credential to be verified\n   * @returns the verification result\n   */\n  public async verifyCredential(\n    agentContext: AgentContext,\n    options: W3cV2JwtVerifyCredentialOptions\n  ): Promise<W3cV2VerifyCredentialResult> {\n    const validationResults: W3cV2VerifyCredentialResult = {\n      isValid: false,\n      validations: {},\n    }\n\n    try {\n      let credential: W3cV2JwtVerifiableCredential\n      try {\n        // If instance is provided as input, we want to validate the credential.\n        // Otherwise, it is done by the fromCompact method below\n        if (options.credential instanceof W3cV2JwtVerifiableCredential) {\n          options.credential.validate()\n        }\n\n        credential =\n          options.credential instanceof W3cV2JwtVerifiableCredential\n            ? options.credential\n            : W3cV2JwtVerifiableCredential.fromCompact(options.credential)\n\n        // Verify the JWT payload (verifies whether it's not expired, etc...)\n        credential.jwt.payload.validate({\n          skewSeconds: agentContext.config.validitySkewSeconds,\n        })\n\n        this.logCredentialShouldWarnings(agentContext, credential)\n\n        validationResults.validations.dataModel = validateVc2ContextBaseline(credential.resolvedCredential.context)\n        if (!validationResults.validations.dataModel.isValid) {\n          return validationResults\n        }\n\n        validationResults.validations.dataModel = {\n          isValid: true,\n        }\n\n        validationResults.validations.validityPeriod = validateVc2CredentialValidityPeriod({\n          validFrom: credential.resolvedCredential.validFrom,\n          validUntil: credential.resolvedCredential.validUntil,\n          skewSeconds: agentContext.config.validitySkewSeconds,\n        })\n\n        validationResults.validations.credentialStatus = validateVc2CredentialStatus({\n          credentialStatus: credential.resolvedCredential.credentialStatus,\n          credentialFormat: 'JWT',\n          verifyCredentialStatus: options.verifyCredentialStatus,\n        })\n      } catch (error) {\n        validationResults.validations.dataModel = {\n          isValid: false,\n          error,\n        }\n\n        return validationResults\n      }\n\n      const issuer = await getSignerForJwt(agentContext, credential, ['assertionMethod'])\n      const issuerVerificationMethod = issuer.verificationMethod\n      const issuerPublicKey = getPublicJwkFromVerificationMethod(issuerVerificationMethod)\n\n      // Ensure the issuer is trusted according to the (optional) `getTrustedIssuersForVerification`\n      // callback. For did-based issuers this is a no-op when no trusted issuers are configured,\n      // preserving the previous \"trust any valid signature\" behavior. Throws when the issuer is not trusted.\n      await TrustedIssuerContext.ensureTrustedCredentialSigner(\n        agentContext,\n        {\n          signer: { method: 'did', didUrl: issuerVerificationMethod.id },\n          verification: { type: 'credential', credential },\n        },\n        options.trustedIssuers\n      )\n\n      let signatureResult: VerifyJwsResult | undefined\n      try {\n        // Verify the JWS signature\n        signatureResult = await this.jwsService.verifyJws(agentContext, {\n          jws: credential.jwt.serializedJwt,\n          // We have pre-fetched the key based on the issuer/signer of the credential\n          jwsSigner: {\n            method: 'did',\n            jwk: issuerPublicKey,\n            didUrl: issuerVerificationMethod.id,\n          },\n        })\n\n        if (!signatureResult.isValid) {\n          validationResults.validations.signature = {\n            isValid: false,\n            error: new CredoError('Invalid JWS signature'),\n          }\n        } else {\n          validationResults.validations.signature = {\n            isValid: true,\n          }\n        }\n      } catch (error) {\n        validationResults.validations.signature = {\n          isValid: false,\n          error,\n        }\n      }\n\n      const isSignedByIssuerKey = signatureResult?.jwsSigners.some(\n        (jwsSigner) => jwsSigner.jwk.fingerprint === issuerPublicKey.fingerprint\n      )\n      validationResults.validations.issuerIsSigner = isSignedByIssuerKey\n        ? validateSignerIsExpectedParty(issuer, credential.resolvedCredential.issuerId, 'issuer')\n        : { isValid: false, error: new CredoError('Credential is not signed by the issuer of the credential') }\n\n      validationResults.isValid = Object.values(validationResults.validations).every(\n        (validation) => validation?.isValid === true\n      )\n\n      return validationResults\n    } catch (error) {\n      validationResults.error = error\n      return validationResults\n    }\n  }\n\n  /**\n   * Signs a presentation including the credentials it includes\n   *\n   * @param presentation the presentation to be signed\n   * @returns the signed presentation\n   */\n  public async signPresentation(\n    agentContext: AgentContext,\n    options: W3cV2JwtSignPresentationOptions\n  ): Promise<W3cV2JwtVerifiablePresentation> {\n    // Validate the instance\n    MessageValidator.validateSync(options.presentation)\n\n    // The JWT payload is simply the presentation\n    const jwtPayload = new JwtPayload({\n      additionalClaims: JsonTransformer.toJSON(options.presentation),\n    })\n\n    // Add the nonce and aud to the payload\n    jwtPayload.additionalClaims.nonce = options.challenge\n    jwtPayload.aud = options.domain\n\n    const holder = await extractHolderFromPresentationCredentials(agentContext, options.presentation)\n\n    // Sign JWT\n    const jwt = await this.jwsService.createJwsCompact(agentContext, {\n      payload: jwtPayload,\n      keyId: holder.publicJwk.keyId,\n      protectedHeaderOptions: {\n        typ: 'vp+jwt',\n        alg: holder.alg,\n        kid: holder?.cnf?.kid,\n      },\n    })\n\n    return W3cV2JwtVerifiablePresentation.fromCompact(jwt)\n  }\n\n  /**\n   * Verifies a presentation including the credentials it includes\n   *\n   * @param presentation the presentation to be verified\n   * @returns the verification result\n   */\n  public async verifyPresentation(\n    agentContext: AgentContext,\n    options: W3cV2JwtVerifyPresentationOptions\n  ): Promise<W3cV2VerifyPresentationResult> {\n    const validationResults: W3cV2VerifyPresentationResult = {\n      isValid: false,\n      presentation: {\n        isValid: false,\n        validations: {},\n      },\n      credentialEntries: [],\n    }\n\n    try {\n      let presentation: W3cV2JwtVerifiablePresentation\n      try {\n        // If instance is provided as input, we want to validate the presentation\n        if (options.presentation instanceof W3cV2JwtVerifiablePresentation) {\n          options.presentation.validate()\n        }\n\n        presentation =\n          options.presentation instanceof W3cV2JwtVerifiablePresentation\n            ? options.presentation\n            : W3cV2JwtVerifiablePresentation.fromCompact(options.presentation)\n\n        // Verify the JWT payload (verifies whether it's not expired, etc...)\n        presentation.jwt.payload.validate({\n          skewSeconds: agentContext.config.validitySkewSeconds,\n        })\n\n        this.logPresentationShouldWarnings(agentContext, presentation)\n\n        // Make sure challenge matches nonce\n        if (options.challenge !== presentation.jwt.payload.additionalClaims.nonce) {\n          throw new CredoError(`JWT payload 'nonce' does not match challenge '${options.challenge}'`)\n        }\n\n        const audArray = asArray(presentation.jwt.payload.aud)\n        if (options.domain && !audArray.includes(options.domain)) {\n          throw new CredoError(`JWT payload 'aud' does not include domain '${options.domain}'`)\n        }\n\n        const contextValidationResult = validateVc2ContextBaseline(presentation.resolvedPresentation.context)\n        if (!contextValidationResult.isValid) {\n          throw contextValidationResult.error\n        }\n\n        validationResults.presentation.validations.dataModel = {\n          isValid: true,\n        }\n      } catch (error) {\n        validationResults.presentation.validations.dataModel = {\n          isValid: false,\n          error,\n        }\n\n        return validationResults\n      }\n\n      const prover = await getSignerForJwt(agentContext, presentation, ['authentication'])\n      const proverVerificationMethod = prover.verificationMethod\n      const proverPublicKey = getPublicJwkFromVerificationMethod(proverVerificationMethod)\n\n      try {\n        // Verify the JWS signature\n        const signatureResult = await this.jwsService.verifyJws(agentContext, {\n          jws: presentation.jwt.serializedJwt,\n          allowedJwsSignerMethods: ['did'],\n          jwsSigner: {\n            method: 'did',\n            didUrl: proverVerificationMethod.id,\n            jwk: proverPublicKey,\n          },\n          trustedCertificates: [],\n        })\n\n        if (!signatureResult.isValid) {\n          validationResults.presentation.validations.presentationSignature = {\n            isValid: false,\n            error: new CredoError('Invalid JWS signature on presentation'),\n          }\n        } else {\n          validationResults.presentation.validations.presentationSignature = {\n            isValid: true,\n          }\n        }\n      } catch (error) {\n        validationResults.presentation.validations.presentationSignature = {\n          isValid: false,\n          error,\n        }\n      }\n\n      validationResults.presentation.validations.holderIsSigner = validateSignerIsExpectedParty(\n        prover,\n        presentation.resolvedPresentation.holderId,\n        'holder'\n      )\n\n      validationResults.presentation.isValid = Object.values(validationResults.presentation.validations).every(\n        (validation) => validation.isValid\n      )\n\n      // Credential-entry dispatch is orchestrated by W3cV2CredentialService.\n      // This service verifies VP container integrity only.\n      validationResults.isValid = validationResults.presentation.isValid\n\n      return validationResults\n    } catch (error) {\n      validationResults.error = error\n      return validationResults\n    }\n  }\n\n  private logCredentialShouldWarnings(agentContext: AgentContext, credential: W3cV2JwtVerifiableCredential) {\n    const payload = credential.jwt.payload\n    const headerIss = credential.jwt.header.iss\n\n    if (typeof headerIss === 'string' && typeof payload.iss === 'string' && headerIss !== payload.iss) {\n      agentContext.config.logger.warn('VC-JOSE-COSE SHOULD warning: JOSE header iss conflicts with payload iss', {\n        format: 'vc+jwt',\n        headerIss,\n        payloadIss: payload.iss,\n      })\n    }\n\n    if (\n      typeof payload.jti === 'string' &&\n      credential.resolvedCredential.id &&\n      credential.resolvedCredential.id !== payload.jti\n    ) {\n      agentContext.config.logger.warn('VC-JOSE-COSE SHOULD warning: jti claim conflicts with credential id', {\n        format: 'vc+jwt',\n        jti: payload.jti,\n        credentialId: credential.resolvedCredential.id,\n      })\n    }\n\n    if (typeof payload.sub === 'string' && !credential.resolvedCredential.credentialSubjectIds.includes(payload.sub)) {\n      agentContext.config.logger.warn(\n        'VC-JOSE-COSE SHOULD warning: sub claim does not match any credentialSubject.id',\n        {\n          format: 'vc+jwt',\n          sub: payload.sub,\n          credentialSubjectIds: credential.resolvedCredential.credentialSubjectIds,\n        }\n      )\n    }\n  }\n\n  private logPresentationShouldWarnings(agentContext: AgentContext, presentation: W3cV2JwtVerifiablePresentation) {\n    const payload = presentation.jwt.payload\n    const headerIss = presentation.jwt.header.iss\n\n    if (typeof headerIss === 'string' && typeof payload.iss === 'string' && headerIss !== payload.iss) {\n      agentContext.config.logger.warn('VC-JOSE-COSE SHOULD warning: JOSE header iss conflicts with payload iss', {\n        format: 'vp+jwt',\n        headerIss,\n        payloadIss: payload.iss,\n      })\n    }\n\n    if (\n      typeof payload.jti === 'string' &&\n      presentation.resolvedPresentation.id &&\n      presentation.resolvedPresentation.id !== payload.jti\n    ) {\n      agentContext.config.logger.warn('VC-JOSE-COSE SHOULD warning: jti claim conflicts with presentation id', {\n        format: 'vp+jwt',\n        jti: payload.jti,\n        presentationId: presentation.resolvedPresentation.id,\n      })\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAsCO,IAAM,4BAAN,MAAM,0BAA0B;CAGrC,YAAmB,YAAwB;EACzC,KAAK,aAAa;CACpB;;;;CAKA,MAAa,eACX,cACA,SACuC;EAEvC,iBAAiB,aAAa,QAAQ,UAAU;EAGhD,MAAM,aAAa,IAAI,WAAW,EAChC,kBAAkB,gBAAgB,OAAO,QAAQ,UAAU,EAC7D,CAAC;EAGD,WAAW,MAAM,aAAa;EAC9B,WAAW,iBAAiB,MAAM,QAAQ,UACrC,MAAM,4BAA4B,cAAc,QAAQ,QAAQ,EAAE,aAAa,CAAC,gBAAgB,EAAE,CAAC,EAAA,CAAG,MACvG,KAAA;EAGJ,MAAM,YAAY,MAAM,qCAAqC,cAAc,QAAQ,oBAAoB,CACrG,iBACF,CAAC;EAGD,MAAM,MAAM,MAAM,KAAK,WAAW,iBAAiB,cAAc;GAC/D,SAAS;GACT,OAAO,UAAU;GACjB,wBAAwB;IACtB,KAAK;IACL,KAAK,QAAQ;IACb,KAAK,QAAQ;GACf;EACF,CAAC;EAED,OAAO,6BAA6B,YAAY,GAAG;CACrD;;;;;;;CAQA,MAAa,iBACX,cACA,SACsC;EACtC,MAAM,oBAAiD;GACrD,SAAS;GACT,aAAa,CAAC;EAChB;EAEA,IAAI;GACF,IAAI;GACJ,IAAI;IAGF,IAAI,QAAQ,sBAAsB,8BAChC,QAAQ,WAAW,SAAS;IAG9B,aACE,QAAQ,sBAAsB,+BAC1B,QAAQ,aACR,6BAA6B,YAAY,QAAQ,UAAU;IAGjE,WAAW,IAAI,QAAQ,SAAS,EAC9B,aAAa,aAAa,OAAO,oBACnC,CAAC;IAED,KAAK,4BAA4B,cAAc,UAAU;IAEzD,kBAAkB,YAAY,YAAY,2BAA2B,WAAW,mBAAmB,OAAO;IAC1G,IAAI,CAAC,kBAAkB,YAAY,UAAU,SAC3C,OAAO;IAGT,kBAAkB,YAAY,YAAY,EACxC,SAAS,KACX;IAEA,kBAAkB,YAAY,iBAAiB,oCAAoC;KACjF,WAAW,WAAW,mBAAmB;KACzC,YAAY,WAAW,mBAAmB;KAC1C,aAAa,aAAa,OAAO;IACnC,CAAC;IAED,kBAAkB,YAAY,mBAAmB,4BAA4B;KAC3E,kBAAkB,WAAW,mBAAmB;KAChD,kBAAkB;KAClB,wBAAwB,QAAQ;IAClC,CAAC;GACH,SAAS,OAAO;IACd,kBAAkB,YAAY,YAAY;KACxC,SAAS;KACT;IACF;IAEA,OAAO;GACT;GAEA,MAAM,SAAS,MAAM,gBAAgB,cAAc,YAAY,CAAC,iBAAiB,CAAC;GAClF,MAAM,2BAA2B,OAAO;GACxC,MAAM,kBAAkB,mCAAmC,wBAAwB;GAKnF,MAAM,qBAAqB,8BACzB,cACA;IACE,QAAQ;KAAE,QAAQ;KAAO,QAAQ,yBAAyB;IAAG;IAC7D,cAAc;KAAE,MAAM;KAAc;IAAW;GACjD,GACA,QAAQ,cACV;GAEA,IAAI;GACJ,IAAI;IAEF,kBAAkB,MAAM,KAAK,WAAW,UAAU,cAAc;KAC9D,KAAK,WAAW,IAAI;KAEpB,WAAW;MACT,QAAQ;MACR,KAAK;MACL,QAAQ,yBAAyB;KACnC;IACF,CAAC;IAED,IAAI,CAAC,gBAAgB,SACnB,kBAAkB,YAAY,YAAY;KACxC,SAAS;KACT,OAAO,IAAI,WAAW,uBAAuB;IAC/C;SAEA,kBAAkB,YAAY,YAAY,EACxC,SAAS,KACX;GAEJ,SAAS,OAAO;IACd,kBAAkB,YAAY,YAAY;KACxC,SAAS;KACT;IACF;GACF;GAEA,MAAM,sBAAsB,iBAAiB,WAAW,MACrD,cAAc,UAAU,IAAI,gBAAgB,gBAAgB,WAC/D;GACA,kBAAkB,YAAY,iBAAiB,sBAC3C,8BAA8B,QAAQ,WAAW,mBAAmB,UAAU,QAAQ,IACtF;IAAE,SAAS;IAAO,OAAO,IAAI,WAAW,0DAA0D;GAAE;GAExG,kBAAkB,UAAU,OAAO,OAAO,kBAAkB,WAAW,CAAC,CAAC,OACtE,eAAe,YAAY,YAAY,IAC1C;GAEA,OAAO;EACT,SAAS,OAAO;GACd,kBAAkB,QAAQ;GAC1B,OAAO;EACT;CACF;;;;;;;CAQA,MAAa,iBACX,cACA,SACyC;EAEzC,iBAAiB,aAAa,QAAQ,YAAY;EAGlD,MAAM,aAAa,IAAI,WAAW,EAChC,kBAAkB,gBAAgB,OAAO,QAAQ,YAAY,EAC/D,CAAC;EAGD,WAAW,iBAAiB,QAAQ,QAAQ;EAC5C,WAAW,MAAM,QAAQ;EAEzB,MAAM,SAAS,MAAM,yCAAyC,cAAc,QAAQ,YAAY;EAGhG,MAAM,MAAM,MAAM,KAAK,WAAW,iBAAiB,cAAc;GAC/D,SAAS;GACT,OAAO,OAAO,UAAU;GACxB,wBAAwB;IACtB,KAAK;IACL,KAAK,OAAO;IACZ,KAAK,QAAQ,KAAK;GACpB;EACF,CAAC;EAED,OAAO,+BAA+B,YAAY,GAAG;CACvD;;;;;;;CAQA,MAAa,mBACX,cACA,SACwC;EACxC,MAAM,oBAAmD;GACvD,SAAS;GACT,cAAc;IACZ,SAAS;IACT,aAAa,CAAC;GAChB;GACA,mBAAmB,CAAC;EACtB;EAEA,IAAI;GACF,IAAI;GACJ,IAAI;IAEF,IAAI,QAAQ,wBAAwB,gCAClC,QAAQ,aAAa,SAAS;IAGhC,eACE,QAAQ,wBAAwB,iCAC5B,QAAQ,eACR,+BAA+B,YAAY,QAAQ,YAAY;IAGrE,aAAa,IAAI,QAAQ,SAAS,EAChC,aAAa,aAAa,OAAO,oBACnC,CAAC;IAED,KAAK,8BAA8B,cAAc,YAAY;IAG7D,IAAI,QAAQ,cAAc,aAAa,IAAI,QAAQ,iBAAiB,OAClE,MAAM,IAAI,WAAW,iDAAiD,QAAQ,UAAU,EAAE;IAG5F,MAAM,WAAW,QAAQ,aAAa,IAAI,QAAQ,GAAG;IACrD,IAAI,QAAQ,UAAU,CAAC,SAAS,SAAS,QAAQ,MAAM,GACrD,MAAM,IAAI,WAAW,8CAA8C,QAAQ,OAAO,EAAE;IAGtF,MAAM,0BAA0B,2BAA2B,aAAa,qBAAqB,OAAO;IACpG,IAAI,CAAC,wBAAwB,SAC3B,MAAM,wBAAwB;IAGhC,kBAAkB,aAAa,YAAY,YAAY,EACrD,SAAS,KACX;GACF,SAAS,OAAO;IACd,kBAAkB,aAAa,YAAY,YAAY;KACrD,SAAS;KACT;IACF;IAEA,OAAO;GACT;GAEA,MAAM,SAAS,MAAM,gBAAgB,cAAc,cAAc,CAAC,gBAAgB,CAAC;GACnF,MAAM,2BAA2B,OAAO;GACxC,MAAM,kBAAkB,mCAAmC,wBAAwB;GAEnF,IAAI;IAaF,IAAI,EAAC,MAXyB,KAAK,WAAW,UAAU,cAAc;KACpE,KAAK,aAAa,IAAI;KACtB,yBAAyB,CAAC,KAAK;KAC/B,WAAW;MACT,QAAQ;MACR,QAAQ,yBAAyB;MACjC,KAAK;KACP;KACA,qBAAqB,CAAC;IACxB,CAAC,EAAA,CAEoB,SACnB,kBAAkB,aAAa,YAAY,wBAAwB;KACjE,SAAS;KACT,OAAO,IAAI,WAAW,uCAAuC;IAC/D;SAEA,kBAAkB,aAAa,YAAY,wBAAwB,EACjE,SAAS,KACX;GAEJ,SAAS,OAAO;IACd,kBAAkB,aAAa,YAAY,wBAAwB;KACjE,SAAS;KACT;IACF;GACF;GAEA,kBAAkB,aAAa,YAAY,iBAAiB,8BAC1D,QACA,aAAa,qBAAqB,UAClC,QACF;GAEA,kBAAkB,aAAa,UAAU,OAAO,OAAO,kBAAkB,aAAa,WAAW,CAAC,CAAC,OAChG,eAAe,WAAW,OAC7B;GAIA,kBAAkB,UAAU,kBAAkB,aAAa;GAE3D,OAAO;EACT,SAAS,OAAO;GACd,kBAAkB,QAAQ;GAC1B,OAAO;EACT;CACF;CAEA,4BAAoC,cAA4B,YAA0C;EACxG,MAAM,UAAU,WAAW,IAAI;EAC/B,MAAM,YAAY,WAAW,IAAI,OAAO;EAExC,IAAI,OAAO,cAAc,YAAY,OAAO,QAAQ,QAAQ,YAAY,cAAc,QAAQ,KAC5F,aAAa,OAAO,OAAO,KAAK,2EAA2E;GACzG,QAAQ;GACR;GACA,YAAY,QAAQ;EACtB,CAAC;EAGH,IACE,OAAO,QAAQ,QAAQ,YACvB,WAAW,mBAAmB,MAC9B,WAAW,mBAAmB,OAAO,QAAQ,KAE7C,aAAa,OAAO,OAAO,KAAK,uEAAuE;GACrG,QAAQ;GACR,KAAK,QAAQ;GACb,cAAc,WAAW,mBAAmB;EAC9C,CAAC;EAGH,IAAI,OAAO,QAAQ,QAAQ,YAAY,CAAC,WAAW,mBAAmB,qBAAqB,SAAS,QAAQ,GAAG,GAC7G,aAAa,OAAO,OAAO,KACzB,kFACA;GACE,QAAQ;GACR,KAAK,QAAQ;GACb,sBAAsB,WAAW,mBAAmB;EACtD,CACF;CAEJ;CAEA,8BAAsC,cAA4B,cAA8C;EAC9G,MAAM,UAAU,aAAa,IAAI;EACjC,MAAM,YAAY,aAAa,IAAI,OAAO;EAE1C,IAAI,OAAO,cAAc,YAAY,OAAO,QAAQ,QAAQ,YAAY,cAAc,QAAQ,KAC5F,aAAa,OAAO,OAAO,KAAK,2EAA2E;GACzG,QAAQ;GACR;GACA,YAAY,QAAQ;EACtB,CAAC;EAGH,IACE,OAAO,QAAQ,QAAQ,YACvB,aAAa,qBAAqB,MAClC,aAAa,qBAAqB,OAAO,QAAQ,KAEjD,aAAa,OAAO,OAAO,KAAK,yEAAyE;GACvG,QAAQ;GACR,KAAK,QAAQ;GACb,gBAAgB,aAAa,qBAAqB;EACpD,CAAC;CAEL;AACF;AA5YC,4BAAA,WAAA,CAAA,WAAW,GAAA,mBAAA,qBAAA,CAAA,OAAA,eAAA,cAAA,SAAA,UAAA,CAAA,CAAA,GAAA,yBAAA"}

package/build/modules/vc/linked-data-proofs/W3cJsonLdCredentialService.d.mts

@@ -51,6 +51,11 @@ export declare class W3cJsonLdCredentialService {
   getVerificationMethodTypesByProofType(proofType: string): string[];
   getExpandedTypesForCredential(agentContext: AgentContext, credential: W3cJsonLdVerifiableCredential): Promise<string[]>;
   private ensureCredentialIssuerTrusted;
+  /**
+   * Resolves the DID that signed with a verification method, loading it through the configured
+   * document loader like vc-js does. vc-js has already validated its proof purpose.
+   */
+  private resolveSigner;
   private getSigningSuiteInfo;
   private prepareSigningSuite;
   private getSignatureSuitesForCredential;

package/build/modules/vc/linked-data-proofs/W3cJsonLdCredentialService.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"W3cJsonLdCredentialService.d.mts","names":[],"sources":["../../../../src/modules/vc/linked-data-proofs/W3cJsonLdCredentialService.ts"],"mappings":";;;;;;;;;;;;;;;qBAiCa;UACH;UACA;EAEW,YAAA,wBAAwB,wBAAwB,oBAAoB;;;;EAQ1E,eACX,cAAc,cACd,SAAS,iCACR,QAAQ;;;;EA4BE,wBACX,cAAc,cACd,SAAS,KAAK;IAAwE;MACrF;;;;;;;EAeU,iBACX,cAAc,cACd,SAAS,mCACR,QAAQ;;;;;;;EAoEE,iBACX,cAAc,cACd,SAAS,mCACR,QAAQ;;;;;;;EAgCE,mBACX,cAAc,cACd,SAAS,qCACR,QAAQ;EAoIJ,sCAAsC;EAIhC,8BAA8B,cAAc,cAAc,YAAY,gCAA6B;UAWlG;UA+BN;UAWM;UA8FN;UAsBA"}
+{"version":3,"file":"W3cJsonLdCredentialService.d.mts","names":[],"sources":["../../../../src/modules/vc/linked-data-proofs/W3cJsonLdCredentialService.ts"],"mappings":";;;;;;;;;;;;;;;qBAkCa;UACH;UACA;EAEW,YAAA,wBAAwB,wBAAwB,oBAAoB;;;;EAQ1E,eACX,cAAc,cACd,SAAS,iCACR,QAAQ;;;;EA4BE,wBACX,cAAc,cACd,SAAS,KAAK;IAAwE;MACrF;;;;;;;EAeU,iBACX,cAAc,cACd,SAAS,mCACR,QAAQ;;;;;;;EAoEE,iBACX,cAAc,cACd,SAAS,mCACR,QAAQ;;;;;;;EAgCE,mBACX,cAAc,cACd,SAAS,qCACR,QAAQ;EAgIJ,sCAAsC;EAIhC,8BAA8B,cAAc,cAAc,YAAY,gCAA6B;UAWlG;;;;;UAsCA;UAQN;UAWM;UA8FN;UAsBA"}

package/build/modules/vc/linked-data-proofs/W3cJsonLdCredentialService.mjs

@@ -14,6 +14,7 @@ import { TrustedIssuerContext } from "../../../agent/TrustedIssuerContext.mjs";
 import "../anoncreds-w3c-credential/IAnonCredsW3cCredentialService.mjs";
 import "../anoncreds-w3c-credential/index.mjs";
 import { W3cJsonLdVerifiableCredential } from "./models/W3cJsonLdVerifiableCredential.mjs";
+import { assertControlledByDid } from "../resolveSigner.mjs";
 import { validateCredentialSubjectAuthentication, w3cDate } from "../util.mjs";
 import jsonld_default from "../jsonld/jsonld.mjs";
 import { JsonLdModuleConfig } from "../jsonld/JsonLdModuleConfig.mjs";
@@ -170,10 +171,10 @@ let W3cJsonLdCredentialService = class W3cJsonLdCredentialService {
 			const result = await vc_adapter_default.verify(verifyOptions);
 			const { verified: isValid, ...remainingResult } = result;
 			const holderProofPurpose = options.purpose?.term ?? "authentication";
-			const holderVerificationMethods = asArray(options.presentation.proof).filter((proof) => proof.proofPurpose === holderProofPurpose).map((proof) => proof.verificationMethod);
+			const holders = await Promise.all(asArray(options.presentation.proof).filter((proof) => proof.proofPurpose === holderProofPurpose).map((proof) => this.resolveSigner(agentContext, proof.verificationMethod)));
 			const credentialValidations = credentials.map((credential) => {
 				const credentialSubjectIds = credential.credentialSubjectIds;
-				const credentialSubjectAuthentication = credentialSubjectIds.length === 0 || holderVerificationMethods.some((verificationMethod) => validateCredentialSubjectAuthentication(credentialSubjectIds, verificationMethod).isValid) ? { isValid: true } : {
+				const credentialSubjectAuthentication = credentialSubjectIds.length === 0 || holders.some((holder) => validateCredentialSubjectAuthentication(credentialSubjectIds, holder).isValid) ? { isValid: true } : {
 					isValid: false,
 					error: new CredoError("Presentation does not authenticate the credentialSubject of one or more included credentials")
 				};
@@ -214,8 +215,8 @@ let W3cJsonLdCredentialService = class W3cJsonLdCredentialService {
 		const issuerDid = parseDid(issuerId).did;
 		for (const proof of asArray(credential.proof)) {
 			const verificationMethod = proof.verificationMethod;
-			if (!verificationMethod.startsWith("did:") || parseDid(verificationMethod).did !== issuerDid) throw new CredoError(`The proof verification method '${verificationMethod}' does not match the credential issuer did '${issuerDid}'.`);
-			await TrustedIssuerContext.ensureTrustedSigner(agentContext, {
+			if (!verificationMethod.startsWith("did:") || await this.resolveSigner(agentContext, verificationMethod) !== issuerDid) throw new CredoError(`The proof verification method '${verificationMethod}' does not match the credential issuer did '${issuerDid}'.`);
+			await TrustedIssuerContext.ensureTrustedCredentialSigner(agentContext, {
 				signer: {
 					method: "did",
 					didUrl: verificationMethod
@@ -227,6 +228,19 @@ let W3cJsonLdCredentialService = class W3cJsonLdCredentialService {
 			}, trustedIssuers);
 		}
 	}
+	/**
+	* Resolves the DID that signed with a verification method, loading it through the configured
+	* document loader like vc-js does. vc-js has already validated its proof purpose.
+	*/
+	async resolveSigner(agentContext, verificationMethodId) {
+		const did = parseDid(verificationMethodId).did;
+		const { document } = await this.jsonLdModuleConfig.documentLoader(agentContext)(verificationMethodId);
+		assertControlledByDid({
+			id: verificationMethodId,
+			controller: document.controller
+		}, did);
+		return did;
+	}
 	getSigningSuiteInfo(proofType) {
 		if (!this.signatureSuiteRegistry.supportedProofTypes.includes(proofType)) throw new W3cJsonLdCredentialSigningNotSupportedError(`The requested proofType ${proofType} is not supported`, "unsupported-proof-type");
 		return this.signatureSuiteRegistry.getByProofType(proofType);

package/build/modules/vc/linked-data-proofs/W3cJsonLdCredentialService.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"W3cJsonLdCredentialService.mjs","names":["vc","jsonld"],"sources":["../../../../src/modules/vc/linked-data-proofs/W3cJsonLdCredentialService.ts"],"sourcesContent":["import type { AgentContext } from '../../../agent/context'\nimport { TrustedIssuerContext } from '../../../agent/TrustedIssuerContext'\nimport type { TrustedIssuerDid } from '../../../agent/TrustedIssuersForVerification'\nimport { createKmsKeyPairClass } from '../../../crypto/KmsKeyPair'\nimport { CredoError, RecordNotFoundError } from '../../../error'\nimport { injectable } from '../../../plugins'\nimport type { SingleOrArray } from '../../../types'\nimport { asArray, JsonTransformer } from '../../../utils'\nimport { type DidPurpose, DidsApi, parseDid } from '../../dids'\nimport { ANONCREDS_W3C_CREDENTIAL_CRYPTOSUITE } from '../anoncreds-w3c-credential'\nimport { JsonLdModuleConfig } from '../jsonld'\nimport jsonld from '../jsonld/jsonld'\nimport type { SingleValidationResult, W3cVerifyCredentialResult, W3cVerifyPresentationResult } from '../models'\nimport type { W3cJsonCredential } from '../models/credential/W3cJsonCredential'\nimport { validateCredentialSubjectAuthentication, w3cDate } from '../util'\nimport type {\n  W3cJsonLdSignCredentialOptions,\n  W3cJsonLdSignPresentationOptions,\n  W3cJsonLdVerifyCredentialOptions,\n  W3cJsonLdVerifyPresentationOptions,\n} from '../W3cCredentialServiceOptions'\nimport vc from './adapters/vc-adapter'\nimport { W3cJsonLdVerifiableCredential } from './models/W3cJsonLdVerifiableCredential'\nimport { W3cJsonLdVerifiablePresentation } from './models/W3cJsonLdVerifiablePresentation'\nimport { assertOnlyW3cJsonLdVerifiableCredentials } from './proof-ops/jsonldUtil'\nimport { SignatureSuiteRegistry } from './SignatureSuiteRegistry'\nimport { W3cJsonLdCredentialSigningNotSupportedError } from './W3cJsonLdCredentialSigningNotSupportedError'\n\n/**\n * Supports signing and verification of credentials according to the [Verifiable Credential Data Model](https://www.w3.org/TR/vc-data-model)\n * using [Linked Data Proofs](https://www.w3.org/TR/vc-data-model/#proofs).\n */\n@injectable()\nexport class W3cJsonLdCredentialService {\n  private signatureSuiteRegistry: SignatureSuiteRegistry\n  private jsonLdModuleConfig: JsonLdModuleConfig\n\n  public constructor(signatureSuiteRegistry: SignatureSuiteRegistry, jsonLdModuleConfig: JsonLdModuleConfig) {\n    this.signatureSuiteRegistry = signatureSuiteRegistry\n    this.jsonLdModuleConfig = jsonLdModuleConfig\n  }\n\n  /**\n   * Signs a credential\n   */\n  public async signCredential(\n    agentContext: AgentContext,\n    options: W3cJsonLdSignCredentialOptions\n  ): Promise<W3cJsonLdVerifiableCredential> {\n    const { suite } = await this.prepareSigningSuite(agentContext, {\n      proofType: options.proofType,\n      verificationMethodId: options.verificationMethod,\n      allowedPurposes: options.proofPurpose?.term ? [options.proofPurpose.term] : ['assertionMethod'],\n      date: options.created ?? w3cDate(),\n      controller: options.credential.issuerId,\n    })\n\n    try {\n      const result = await vc.issue({\n        credential: JsonTransformer.toJSON(options.credential),\n        suite: suite,\n        purpose: options.proofPurpose,\n        documentLoader: this.jsonLdModuleConfig.documentLoader(agentContext),\n      })\n\n      return JsonTransformer.fromJSON(result, W3cJsonLdVerifiableCredential)\n    } catch (error) {\n      throw new CredoError(`Error issuing W3C JSON-LD VC. ${error.message}`, {\n        cause: error,\n      })\n    }\n  }\n\n  /**\n   * Validate that the agent can prepare to sign a credential with the given proof type and verification method.\n   */\n  public async assertCanSignCredential(\n    agentContext: AgentContext,\n    options: Pick<W3cJsonLdSignCredentialOptions, 'proofType' | 'verificationMethod'> & { controller?: string }\n  ): Promise<void> {\n    await this.prepareSigningSuite(agentContext, {\n      proofType: options.proofType,\n      verificationMethodId: options.verificationMethod,\n      allowedPurposes: ['assertionMethod'],\n      controller: options.controller,\n    })\n  }\n\n  /**\n   * Verifies the signature(s) of a credential\n   *\n   * @param credential the credential to be verified\n   * @returns the verification result\n   */\n  public async verifyCredential(\n    agentContext: AgentContext,\n    options: W3cJsonLdVerifyCredentialOptions\n  ): Promise<W3cVerifyCredentialResult> {\n    try {\n      this.assertNoAnonCredsW3cCredentialProof(options.credential.proof)\n\n      const verifyCredentialStatus = options.verifyCredentialStatus ?? true\n\n      await this.ensureCredentialIssuerTrusted(agentContext, options.credential, options.trustedIssuers)\n\n      const suites = this.getSignatureSuitesForCredential(agentContext, options.credential)\n\n      const verifyOptions: Record<string, unknown> = {\n        credential: JsonTransformer.toJSON(options.credential),\n        suite: suites,\n        documentLoader: this.jsonLdModuleConfig.documentLoader(agentContext),\n        checkStatus: ({ credential }: { credential: W3cJsonCredential }) => {\n          // Only throw error if credentialStatus is present\n          if (verifyCredentialStatus && 'credentialStatus' in credential) {\n            throw new CredoError('Verifying credential status for JSON-LD credentials is currently not supported')\n          }\n          return {\n            verified: true,\n          }\n        },\n      }\n\n      // this is a hack because vcjs throws if purpose is passed as undefined or null\n      if (options.proofPurpose) {\n        verifyOptions.purpose = options.proofPurpose\n      }\n\n      const result = await vc.verifyCredential(verifyOptions)\n\n      const { verified: isValid, ...remainingResult } = result\n\n      if (!isValid) {\n        agentContext.config.logger.debug(`Credential verification failed: ${result.error?.message}`, {\n          stack: result.error?.stack,\n        })\n      }\n\n      // We map the result to our own result type to make it easier to work with\n      // however, for now we just add a single vcJs validation result as we don't\n      // have access to the internal validation results of vc-js\n      return {\n        isValid,\n        validations: {\n          vcJs: {\n            isValid,\n            ...remainingResult,\n          },\n        },\n        error: result.error,\n      }\n    } catch (error) {\n      return {\n        isValid: false,\n        validations: {},\n        error,\n      }\n    }\n  }\n\n  /**\n   * Signs a presentation including the credentials it includes\n   *\n   * @param presentation the presentation to be signed\n   * @returns the signed presentation\n   */\n  public async signPresentation(\n    agentContext: AgentContext,\n    options: W3cJsonLdSignPresentationOptions\n  ): Promise<W3cJsonLdVerifiablePresentation> {\n    const { suite } = await this.prepareSigningSuite(agentContext, {\n      proofType: options.proofType,\n      verificationMethodId: options.verificationMethod,\n      allowedPurposes: options.proofPurpose?.term ? [options.proofPurpose.term] : ['authentication'],\n      date: new Date().toISOString(),\n    })\n\n    const signOptions: Record<string, unknown> = {\n      presentation: JsonTransformer.toJSON(options.presentation),\n      suite: suite,\n      challenge: options.challenge,\n      domain: options.domain,\n      documentLoader: this.jsonLdModuleConfig.documentLoader(agentContext),\n    }\n\n    // this is a hack because vcjs throws if purpose is passed as undefined or null\n    if (options.proofPurpose) {\n      signOptions.purpose = options.proofPurpose\n    }\n\n    const result = await vc.signPresentation(signOptions)\n\n    return JsonTransformer.fromJSON(result, W3cJsonLdVerifiablePresentation)\n  }\n\n  /**\n   * Verifies a presentation including the credentials it includes\n   *\n   * @param presentation the presentation to be verified\n   * @returns the verification result\n   */\n  public async verifyPresentation(\n    agentContext: AgentContext,\n    options: W3cJsonLdVerifyPresentationOptions\n  ): Promise<W3cVerifyPresentationResult> {\n    try {\n      this.assertNoAnonCredsW3cCredentialProof(options.presentation.proof)\n\n      // create keyPair\n      const WalletKeyPair = createKmsKeyPairClass(agentContext)\n\n      let proofs = options.presentation.proof\n\n      if (!Array.isArray(proofs)) {\n        proofs = [proofs]\n      }\n      if (options.purpose) {\n        proofs = proofs.filter((proof) => proof.proofPurpose === options.purpose.term)\n      }\n\n      const presentationSuites = proofs.map((proof) => {\n        const SuiteClass = this.signatureSuiteRegistry.getByProofType(proof.type).suiteClass\n        return new SuiteClass({\n          LDKeyClass: WalletKeyPair,\n          proof: {\n            verificationMethod: proof.verificationMethod,\n          },\n          date: proof.created,\n          useNativeCanonize: false,\n        })\n      })\n\n      const credentials = asArray(options.presentation.verifiableCredential)\n      assertOnlyW3cJsonLdVerifiableCredentials(credentials)\n\n      for (const credential of credentials) {\n        this.assertNoAnonCredsW3cCredentialProof(credential.proof)\n        await this.ensureCredentialIssuerTrusted(agentContext, credential, options.trustedIssuers)\n      }\n\n      const credentialSuites = credentials.map((credential) =>\n        this.getSignatureSuitesForCredential(agentContext, credential)\n      )\n      const allSuites = presentationSuites.concat(...credentialSuites)\n\n      const verifyOptions: Record<string, unknown> = {\n        presentation: JsonTransformer.toJSON(options.presentation),\n        suite: allSuites,\n        challenge: options.challenge,\n        domain: options.domain,\n        documentLoader: this.jsonLdModuleConfig.documentLoader(agentContext),\n      }\n\n      // this is a hack because vcjs throws if purpose is passed as undefined or null\n      if (options.purpose) {\n        verifyOptions.presentationPurpose = options.purpose\n      }\n\n      const result = await vc.verify(verifyOptions)\n\n      const { verified: isValid, ...remainingResult } = result\n\n      // The vc-js / jsonld-signatures libraries verify the presentation proof and each embedded\n      // credential's issuer proof, but do NOT bind the presentation signer (holder) to the\n      // credentialSubject of the embedded credentials. Without this check an attacker could wrap\n      // someone else's credential (a data object, not a secret) in a presentation signed with their\n      // own key and have it accepted. Enforce the binding here, mirroring the jwt_vp and sd-jwt paths\n      // (see validateCredentialSubjectAuthentication).\n      //\n      // The holder identity is derived from the verificationMethod of the presentation's\n      // authentication proof(s), which vc-js has already cryptographically verified and authorized\n      // for the authentication purpose. validateCredentialSubjectAuthentication normalizes the DID\n      // URL to its bare DID before comparison; for the DID methods used with linked-data proofs the\n      // verificationMethod's DID equals its controller.\n      const holderProofPurpose = options.purpose?.term ?? 'authentication'\n      const holderVerificationMethods = asArray(options.presentation.proof)\n        .filter((proof) => proof.proofPurpose === holderProofPurpose)\n        .map((proof) => proof.verificationMethod)\n\n      // Surfaced per credential under `credentials[]` to mirror the jwt_vp result shape. The\n      // library-level signature/status validations remain lumped in `vcJs`, so each entry here\n      // only carries the credentialSubjectAuthentication check.\n      const credentialValidations = credentials.map((credential) => {\n        const credentialSubjectIds = credential.credentialSubjectIds\n\n        // A credential without subject identifiers is treated as a bearer credential,\n        // so there is no subject to authenticate.\n        const isAuthenticated =\n          credentialSubjectIds.length === 0 ||\n          holderVerificationMethods.some(\n            (verificationMethod) =>\n              validateCredentialSubjectAuthentication(credentialSubjectIds, verificationMethod).isValid\n          )\n\n        const credentialSubjectAuthentication: SingleValidationResult = isAuthenticated\n          ? { isValid: true }\n          : {\n              isValid: false,\n              error: new CredoError(\n                'Presentation does not authenticate the credentialSubject of one or more included credentials'\n              ),\n            }\n\n        return {\n          isValid: credentialSubjectAuthentication.isValid,\n          validations: { credentialSubjectAuthentication },\n        }\n      })\n\n      // We map the result to our own result type to make it easier to work with. The library\n      // validations are lumped into a single vcJs result as we don't have access to the internal\n      // validation results of vc-js; the credentialSubject authentication check that Credo performs\n      // on top is surfaced per credential under `credentials`.\n      return {\n        isValid: isValid && credentialValidations.every((credential) => credential.isValid),\n        validations: {\n          vcJs: {\n            isValid,\n            ...remainingResult,\n          },\n          credentials: credentialValidations,\n        },\n        error:\n          result.error ??\n          credentialValidations.find((credential) => !credential.isValid)?.validations.credentialSubjectAuthentication\n            .error,\n      }\n    } catch (error) {\n      return {\n        isValid: false,\n        validations: {},\n        error,\n      }\n    }\n  }\n\n  public getVerificationMethodTypesByProofType(proofType: string): string[] {\n    return this.getSigningSuiteInfo(proofType).verificationMethodTypes\n  }\n\n  public async getExpandedTypesForCredential(agentContext: AgentContext, credential: W3cJsonLdVerifiableCredential) {\n    // Get the expanded types\n    const expandedTypes: SingleOrArray<string> = (\n      await jsonld.expand(JsonTransformer.toJSON(credential), {\n        documentLoader: this.jsonLdModuleConfig.documentLoader(agentContext),\n      })\n    )[0]['@type']\n\n    return asArray(expandedTypes)\n  }\n\n  private async ensureCredentialIssuerTrusted(\n    agentContext: AgentContext,\n    credential: W3cJsonLdVerifiableCredential,\n    trustedIssuers?: TrustedIssuerDid[]\n  ): Promise<void> {\n    const issuerId = credential.issuerId\n\n    // Only enforced for did-based issuers\n    if (!issuerId.startsWith('did:')) return\n\n    const issuerDid = parseDid(issuerId).did\n\n    for (const proof of asArray(credential.proof)) {\n      const verificationMethod = proof.verificationMethod\n      if (!verificationMethod.startsWith('did:') || parseDid(verificationMethod).did !== issuerDid) {\n        throw new CredoError(\n          `The proof verification method '${verificationMethod}' does not match the credential issuer did '${issuerDid}'.`\n        )\n      }\n\n      await TrustedIssuerContext.ensureTrustedSigner(\n        agentContext,\n        {\n          signer: { method: 'did', didUrl: verificationMethod },\n          verification: { type: 'credential', credential },\n        },\n        trustedIssuers\n      )\n    }\n  }\n\n  private getSigningSuiteInfo(proofType: string) {\n    if (!this.signatureSuiteRegistry.supportedProofTypes.includes(proofType)) {\n      throw new W3cJsonLdCredentialSigningNotSupportedError(\n        `The requested proofType ${proofType} is not supported`,\n        'unsupported-proof-type'\n      )\n    }\n\n    return this.signatureSuiteRegistry.getByProofType(proofType)\n  }\n\n  private async prepareSigningSuite(\n    agentContext: AgentContext,\n    options: {\n      proofType: string\n      verificationMethodId: string\n      allowedPurposes: Array<DidPurpose | 'verificationMethod'>\n      date?: string\n      controller?: string\n    }\n  ) {\n    const suiteInfo = this.getSigningSuiteInfo(options.proofType)\n\n    const dids = agentContext.resolve(DidsApi)\n    let resolved: Awaited<ReturnType<typeof dids.resolveVerificationMethodFromCreatedDidRecord>>\n    try {\n      resolved = await dids.resolveVerificationMethodFromCreatedDidRecord(\n        options.verificationMethodId,\n        options.allowedPurposes\n      )\n    } catch (error) {\n      if (error instanceof RecordNotFoundError) {\n        throw new W3cJsonLdCredentialSigningNotSupportedError(\n          error.message,\n          'verification-method-not-controlled',\n          error\n        )\n      }\n      if (\n        error instanceof CredoError &&\n        error.message ===\n          `Unable to locate verification method with id '${options.verificationMethodId}' in purposes ${options.allowedPurposes}`\n      ) {\n        throw new W3cJsonLdCredentialSigningNotSupportedError(error.message, 'verification-method-not-found', error)\n      }\n      throw error\n    }\n\n    const { verificationMethod: nativeVerificationMethod, publicJwk } = resolved\n\n    if (!suiteInfo.verificationMethodTypes.includes(nativeVerificationMethod.type)) {\n      throw new W3cJsonLdCredentialSigningNotSupportedError(\n        `Unsupported verification method type '${nativeVerificationMethod.type}' for proof type '${options.proofType}'. Supported types are: ${suiteInfo.verificationMethodTypes.join(', ')}`,\n        'unsupported-verification-method-type'\n      )\n    }\n\n    const documentLoader = this.jsonLdModuleConfig.documentLoader(agentContext)\n    const loaderResult = await documentLoader(options.verificationMethodId)\n    const framedVerificationMethod =\n      typeof loaderResult.document === 'string' ? JSON.parse(loaderResult.document) : loaderResult.document\n\n    const WalletKeyPair = createKmsKeyPairClass(agentContext)\n\n    // Instantiate suite to validate verification method and framing context\n    const SuiteClass = suiteInfo.suiteClass\n    const validationSuite = new SuiteClass({\n      LDKeyClass: WalletKeyPair,\n      proof: {\n        verificationMethod: options.verificationMethodId,\n      },\n      useNativeCanonize: false,\n      date: options.date ?? w3cDate(),\n    })\n\n    await validationSuite.assertVerificationMethod(framedVerificationMethod)\n\n    const suitesForKey = this.signatureSuiteRegistry.getAllByPublicJwkType(publicJwk)\n    if (!suitesForKey.some(({ suiteClass }) => suiteClass === suiteInfo.suiteClass)) {\n      throw new W3cJsonLdCredentialSigningNotSupportedError(\n        'The key type of the verification method does not match the suite',\n        'unsupported-key-type'\n      )\n    }\n\n    const keyPair = new WalletKeyPair({\n      controller:\n        options.controller ?? (framedVerificationMethod.controller as string) ?? nativeVerificationMethod.controller,\n      id: options.verificationMethodId,\n      publicJwk,\n    })\n\n    const suite = new SuiteClass({\n      key: keyPair,\n      LDKeyClass: WalletKeyPair,\n      proof: {\n        verificationMethod: options.verificationMethodId,\n      },\n      useNativeCanonize: false,\n      date: options.date ?? w3cDate(),\n    })\n\n    return { suite, suiteInfo, keyPair, WalletKeyPair }\n  }\n\n  private getSignatureSuitesForCredential(agentContext: AgentContext, credential: W3cJsonLdVerifiableCredential) {\n    const WalletKeyPair = createKmsKeyPairClass(agentContext)\n\n    let proofs = credential.proof\n\n    if (!Array.isArray(proofs)) {\n      proofs = [proofs]\n    }\n\n    return proofs.map((proof) => {\n      const SuiteClass = this.signatureSuiteRegistry.getByProofType(proof.type).suiteClass\n      return new SuiteClass({\n        LDKeyClass: WalletKeyPair,\n        proof: {\n          verificationMethod: proof.verificationMethod,\n        },\n        date: proof.created,\n        useNativeCanonize: false,\n      })\n    })\n  }\n\n  private assertNoAnonCredsW3cCredentialProof(\n    proofsInput: W3cJsonLdVerifiableCredential['proof'] | W3cJsonLdVerifiablePresentation['proof']\n  ) {\n    const proofs = asArray(proofsInput)\n    const hasAnonCredsW3cCredentialProof = proofs.some(\n      (proof) =>\n        proof.type === 'DataIntegrityProof' &&\n        'cryptosuite' in proof &&\n        proof.cryptosuite === ANONCREDS_W3C_CREDENTIAL_CRYPTOSUITE\n    )\n\n    if (hasAnonCredsW3cCredentialProof) {\n      throw new CredoError(\n        'W3C credential proof with cryptosuite anoncreds-2023 must be verified through the anoncreds W3C credential path, not the generic linked-data verifier'\n      )\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCO,IAAM,6BAAN,MAAM,2BAA2B;CAItC,YAAmB,wBAAgD,oBAAwC;EACzG,KAAK,yBAAyB;EAC9B,KAAK,qBAAqB;CAC5B;;;;CAKA,MAAa,eACX,cACA,SACwC;EACxC,MAAM,EAAE,UAAU,MAAM,KAAK,oBAAoB,cAAc;GAC7D,WAAW,QAAQ;GACnB,sBAAsB,QAAQ;GAC9B,iBAAiB,QAAQ,cAAc,OAAO,CAAC,QAAQ,aAAa,IAAI,IAAI,CAAC,iBAAiB;GAC9F,MAAM,QAAQ,WAAW,QAAQ;GACjC,YAAY,QAAQ,WAAW;EACjC,CAAC;EAED,IAAI;GACF,MAAM,SAAS,MAAMA,mBAAG,MAAM;IAC5B,YAAY,gBAAgB,OAAO,QAAQ,UAAU;IAC9C;IACP,SAAS,QAAQ;IACjB,gBAAgB,KAAK,mBAAmB,eAAe,YAAY;GACrE,CAAC;GAED,OAAO,gBAAgB,SAAS,QAAQ,6BAA6B;EACvE,SAAS,OAAO;GACd,MAAM,IAAI,WAAW,iCAAiC,MAAM,WAAW,EACrE,OAAO,MACT,CAAC;EACH;CACF;;;;CAKA,MAAa,wBACX,cACA,SACe;EACf,MAAM,KAAK,oBAAoB,cAAc;GAC3C,WAAW,QAAQ;GACnB,sBAAsB,QAAQ;GAC9B,iBAAiB,CAAC,iBAAiB;GACnC,YAAY,QAAQ;EACtB,CAAC;CACH;;;;;;;CAQA,MAAa,iBACX,cACA,SACoC;EACpC,IAAI;GACF,KAAK,oCAAoC,QAAQ,WAAW,KAAK;GAEjE,MAAM,yBAAyB,QAAQ,0BAA0B;GAEjE,MAAM,KAAK,8BAA8B,cAAc,QAAQ,YAAY,QAAQ,cAAc;GAEjG,MAAM,SAAS,KAAK,gCAAgC,cAAc,QAAQ,UAAU;GAEpF,MAAM,gBAAyC;IAC7C,YAAY,gBAAgB,OAAO,QAAQ,UAAU;IACrD,OAAO;IACP,gBAAgB,KAAK,mBAAmB,eAAe,YAAY;IACnE,cAAc,EAAE,iBAAoD;KAElE,IAAI,0BAA0B,sBAAsB,YAClD,MAAM,IAAI,WAAW,gFAAgF;KAEvG,OAAO,EACL,UAAU,KACZ;IACF;GACF;GAGA,IAAI,QAAQ,cACV,cAAc,UAAU,QAAQ;GAGlC,MAAM,SAAS,MAAMA,mBAAG,iBAAiB,aAAa;GAEtD,MAAM,EAAE,UAAU,SAAS,GAAG,oBAAoB;GAElD,IAAI,CAAC,SACH,aAAa,OAAO,OAAO,MAAM,mCAAmC,OAAO,OAAO,WAAW,EAC3F,OAAO,OAAO,OAAO,MACvB,CAAC;GAMH,OAAO;IACL;IACA,aAAa,EACX,MAAM;KACJ;KACA,GAAG;IACL,EACF;IACA,OAAO,OAAO;GAChB;EACF,SAAS,OAAO;GACd,OAAO;IACL,SAAS;IACT,aAAa,CAAC;IACd;GACF;EACF;CACF;;;;;;;CAQA,MAAa,iBACX,cACA,SAC0C;EAC1C,MAAM,EAAE,UAAU,MAAM,KAAK,oBAAoB,cAAc;GAC7D,WAAW,QAAQ;GACnB,sBAAsB,QAAQ;GAC9B,iBAAiB,QAAQ,cAAc,OAAO,CAAC,QAAQ,aAAa,IAAI,IAAI,CAAC,gBAAgB;GAC7F,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;EAC/B,CAAC;EAED,MAAM,cAAuC;GAC3C,cAAc,gBAAgB,OAAO,QAAQ,YAAY;GAClD;GACP,WAAW,QAAQ;GACnB,QAAQ,QAAQ;GAChB,gBAAgB,KAAK,mBAAmB,eAAe,YAAY;EACrE;EAGA,IAAI,QAAQ,cACV,YAAY,UAAU,QAAQ;EAGhC,MAAM,SAAS,MAAMA,mBAAG,iBAAiB,WAAW;EAEpD,OAAO,gBAAgB,SAAS,QAAQ,+BAA+B;CACzE;;;;;;;CAQA,MAAa,mBACX,cACA,SACsC;EACtC,IAAI;GACF,KAAK,oCAAoC,QAAQ,aAAa,KAAK;GAGnE,MAAM,gBAAgB,sBAAsB,YAAY;GAExD,IAAI,SAAS,QAAQ,aAAa;GAElC,IAAI,CAAC,MAAM,QAAQ,MAAM,GACvB,SAAS,CAAC,MAAM;GAElB,IAAI,QAAQ,SACV,SAAS,OAAO,QAAQ,UAAU,MAAM,iBAAiB,QAAQ,QAAQ,IAAI;GAG/E,MAAM,qBAAqB,OAAO,KAAK,UAAU;IAC/C,MAAM,aAAa,KAAK,uBAAuB,eAAe,MAAM,IAAI,CAAC,CAAC;IAC1E,OAAO,IAAI,WAAW;KACpB,YAAY;KACZ,OAAO,EACL,oBAAoB,MAAM,mBAC5B;KACA,MAAM,MAAM;KACZ,mBAAmB;IACrB,CAAC;GACH,CAAC;GAED,MAAM,cAAc,QAAQ,QAAQ,aAAa,oBAAoB;GACrE,yCAAyC,WAAW;GAEpD,KAAK,MAAM,cAAc,aAAa;IACpC,KAAK,oCAAoC,WAAW,KAAK;IACzD,MAAM,KAAK,8BAA8B,cAAc,YAAY,QAAQ,cAAc;GAC3F;GAEA,MAAM,mBAAmB,YAAY,KAAK,eACxC,KAAK,gCAAgC,cAAc,UAAU,CAC/D;GACA,MAAM,YAAY,mBAAmB,OAAO,GAAG,gBAAgB;GAE/D,MAAM,gBAAyC;IAC7C,cAAc,gBAAgB,OAAO,QAAQ,YAAY;IACzD,OAAO;IACP,WAAW,QAAQ;IACnB,QAAQ,QAAQ;IAChB,gBAAgB,KAAK,mBAAmB,eAAe,YAAY;GACrE;GAGA,IAAI,QAAQ,SACV,cAAc,sBAAsB,QAAQ;GAG9C,MAAM,SAAS,MAAMA,mBAAG,OAAO,aAAa;GAE5C,MAAM,EAAE,UAAU,SAAS,GAAG,oBAAoB;GAclD,MAAM,qBAAqB,QAAQ,SAAS,QAAQ;GACpD,MAAM,4BAA4B,QAAQ,QAAQ,aAAa,KAAK,CAAC,CAClE,QAAQ,UAAU,MAAM,iBAAiB,kBAAkB,CAAC,CAC5D,KAAK,UAAU,MAAM,kBAAkB;GAK1C,MAAM,wBAAwB,YAAY,KAAK,eAAe;IAC5D,MAAM,uBAAuB,WAAW;IAWxC,MAAM,kCANJ,qBAAqB,WAAW,KAChC,0BAA0B,MACvB,uBACC,wCAAwC,sBAAsB,kBAAkB,CAAC,CAAC,OACtF,IAGE,EAAE,SAAS,KAAK,IAChB;KACE,SAAS;KACT,OAAO,IAAI,WACT,8FACF;IACF;IAEJ,OAAO;KACL,SAAS,gCAAgC;KACzC,aAAa,EAAE,gCAAgC;IACjD;GACF,CAAC;GAMD,OAAO;IACL,SAAS,WAAW,sBAAsB,OAAO,eAAe,WAAW,OAAO;IAClF,aAAa;KACX,MAAM;MACJ;MACA,GAAG;KACL;KACA,aAAa;IACf;IACA,OACE,OAAO,SACP,sBAAsB,MAAM,eAAe,CAAC,WAAW,OAAO,CAAC,EAAE,YAAY,gCAC1E;GACP;EACF,SAAS,OAAO;GACd,OAAO;IACL,SAAS;IACT,aAAa,CAAC;IACd;GACF;EACF;CACF;CAEA,sCAA6C,WAA6B;EACxE,OAAO,KAAK,oBAAoB,SAAS,CAAC,CAAC;CAC7C;CAEA,MAAa,8BAA8B,cAA4B,YAA2C;EAEhH,MAAM,iBACJ,MAAMC,eAAO,OAAO,gBAAgB,OAAO,UAAU,GAAG,EACtD,gBAAgB,KAAK,mBAAmB,eAAe,YAAY,EACrE,CAAC,EAAA,CACD,EAAE,CAAC;EAEL,OAAO,QAAQ,aAAa;CAC9B;CAEA,MAAc,8BACZ,cACA,YACA,gBACe;EACf,MAAM,WAAW,WAAW;EAG5B,IAAI,CAAC,SAAS,WAAW,MAAM,GAAG;EAElC,MAAM,YAAY,SAAS,QAAQ,CAAC,CAAC;EAErC,KAAK,MAAM,SAAS,QAAQ,WAAW,KAAK,GAAG;GAC7C,MAAM,qBAAqB,MAAM;GACjC,IAAI,CAAC,mBAAmB,WAAW,MAAM,KAAK,SAAS,kBAAkB,CAAC,CAAC,QAAQ,WACjF,MAAM,IAAI,WACR,kCAAkC,mBAAmB,8CAA8C,UAAU,GAC/G;GAGF,MAAM,qBAAqB,oBACzB,cACA;IACE,QAAQ;KAAE,QAAQ;KAAO,QAAQ;IAAmB;IACpD,cAAc;KAAE,MAAM;KAAc;IAAW;GACjD,GACA,cACF;EACF;CACF;CAEA,oBAA4B,WAAmB;EAC7C,IAAI,CAAC,KAAK,uBAAuB,oBAAoB,SAAS,SAAS,GACrE,MAAM,IAAI,4CACR,2BAA2B,UAAU,oBACrC,wBACF;EAGF,OAAO,KAAK,uBAAuB,eAAe,SAAS;CAC7D;CAEA,MAAc,oBACZ,cACA,SAOA;EACA,MAAM,YAAY,KAAK,oBAAoB,QAAQ,SAAS;EAE5D,MAAM,OAAO,aAAa,QAAQ,OAAO;EACzC,IAAI;EACJ,IAAI;GACF,WAAW,MAAM,KAAK,8CACpB,QAAQ,sBACR,QAAQ,eACV;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,qBACnB,MAAM,IAAI,4CACR,MAAM,SACN,sCACA,KACF;GAEF,IACE,iBAAiB,cACjB,MAAM,YACJ,iDAAiD,QAAQ,qBAAqB,gBAAgB,QAAQ,mBAExG,MAAM,IAAI,4CAA4C,MAAM,SAAS,iCAAiC,KAAK;GAE7G,MAAM;EACR;EAEA,MAAM,EAAE,oBAAoB,0BAA0B,cAAc;EAEpE,IAAI,CAAC,UAAU,wBAAwB,SAAS,yBAAyB,IAAI,GAC3E,MAAM,IAAI,4CACR,yCAAyC,yBAAyB,KAAK,oBAAoB,QAAQ,UAAU,0BAA0B,UAAU,wBAAwB,KAAK,IAAI,KAClL,sCACF;EAIF,MAAM,eAAe,MADE,KAAK,mBAAmB,eAAe,YACtB,CAAC,CAAC,QAAQ,oBAAoB;EACtE,MAAM,2BACJ,OAAO,aAAa,aAAa,WAAW,KAAK,MAAM,aAAa,QAAQ,IAAI,aAAa;EAE/F,MAAM,gBAAgB,sBAAsB,YAAY;EAGxD,MAAM,aAAa,UAAU;EAU7B,MAAM,IATsB,WAAW;GACrC,YAAY;GACZ,OAAO,EACL,oBAAoB,QAAQ,qBAC9B;GACA,mBAAmB;GACnB,MAAM,QAAQ,QAAQ,QAAQ;EAChC,CAEoB,CAAC,CAAC,yBAAyB,wBAAwB;EAGvE,IAAI,CADiB,KAAK,uBAAuB,sBAAsB,SACvD,CAAC,CAAC,MAAM,EAAE,iBAAiB,eAAe,UAAU,UAAU,GAC5E,MAAM,IAAI,4CACR,oEACA,sBACF;EAGF,MAAM,UAAU,IAAI,cAAc;GAChC,YACE,QAAQ,cAAe,yBAAyB,cAAyB,yBAAyB;GACpG,IAAI,QAAQ;GACZ;EACF,CAAC;EAYD,OAAO;GAAE,OAAA,IAVS,WAAW;IAC3B,KAAK;IACL,YAAY;IACZ,OAAO,EACL,oBAAoB,QAAQ,qBAC9B;IACA,mBAAmB;IACnB,MAAM,QAAQ,QAAQ,QAAQ;GAChC,CAEa;GAAG;GAAW;GAAS;EAAc;CACpD;CAEA,gCAAwC,cAA4B,YAA2C;EAC7G,MAAM,gBAAgB,sBAAsB,YAAY;EAExD,IAAI,SAAS,WAAW;EAExB,IAAI,CAAC,MAAM,QAAQ,MAAM,GACvB,SAAS,CAAC,MAAM;EAGlB,OAAO,OAAO,KAAK,UAAU;GAC3B,MAAM,aAAa,KAAK,uBAAuB,eAAe,MAAM,IAAI,CAAC,CAAC;GAC1E,OAAO,IAAI,WAAW;IACpB,YAAY;IACZ,OAAO,EACL,oBAAoB,MAAM,mBAC5B;IACA,MAAM,MAAM;IACZ,mBAAmB;GACrB,CAAC;EACH,CAAC;CACH;CAEA,oCACE,aACA;EASA,IARe,QAAQ,WACqB,CAAC,CAAC,MAC3C,UACC,MAAM,SAAS,wBACf,iBAAiB,SACjB,MAAM,gBAAA,gBAGuB,GAC/B,MAAM,IAAI,WACR,uJACF;CAEJ;AACF;AA7eC,6BAAA,WAAA,CAAA,WAAW,GAAA,mBAAA,qBAAA,CAAA,OAAA,2BAAA,cAAA,SAAA,wBAAA,OAAA,uBAAA,cAAA,SAAA,kBAAA,CAAA,CAAA,GAAA,0BAAA"}
+{"version":3,"file":"W3cJsonLdCredentialService.mjs","names":["vc","jsonld"],"sources":["../../../../src/modules/vc/linked-data-proofs/W3cJsonLdCredentialService.ts"],"sourcesContent":["import type { AgentContext } from '../../../agent/context'\nimport { TrustedIssuerContext } from '../../../agent/TrustedIssuerContext'\nimport type { GetTrustedIssuersForCredential, TrustedIssuerDid } from '../../../agent/TrustedIssuersForVerification'\nimport { createKmsKeyPairClass } from '../../../crypto/KmsKeyPair'\nimport { CredoError, RecordNotFoundError } from '../../../error'\nimport { injectable } from '../../../plugins'\nimport type { SingleOrArray } from '../../../types'\nimport { asArray, JsonTransformer } from '../../../utils'\nimport { type DidPurpose, DidsApi, parseDid } from '../../dids'\nimport { ANONCREDS_W3C_CREDENTIAL_CRYPTOSUITE } from '../anoncreds-w3c-credential'\nimport { JsonLdModuleConfig } from '../jsonld'\nimport jsonld from '../jsonld/jsonld'\nimport type { SingleValidationResult, W3cVerifyCredentialResult, W3cVerifyPresentationResult } from '../models'\nimport type { W3cJsonCredential } from '../models/credential/W3cJsonCredential'\nimport { assertControlledByDid } from '../resolveSigner'\nimport { validateCredentialSubjectAuthentication, w3cDate } from '../util'\nimport type {\n  W3cJsonLdSignCredentialOptions,\n  W3cJsonLdSignPresentationOptions,\n  W3cJsonLdVerifyCredentialOptions,\n  W3cJsonLdVerifyPresentationOptions,\n} from '../W3cCredentialServiceOptions'\nimport vc from './adapters/vc-adapter'\nimport { W3cJsonLdVerifiableCredential } from './models/W3cJsonLdVerifiableCredential'\nimport { W3cJsonLdVerifiablePresentation } from './models/W3cJsonLdVerifiablePresentation'\nimport { assertOnlyW3cJsonLdVerifiableCredentials } from './proof-ops/jsonldUtil'\nimport { SignatureSuiteRegistry } from './SignatureSuiteRegistry'\nimport { W3cJsonLdCredentialSigningNotSupportedError } from './W3cJsonLdCredentialSigningNotSupportedError'\n\n/**\n * Supports signing and verification of credentials according to the [Verifiable Credential Data Model](https://www.w3.org/TR/vc-data-model)\n * using [Linked Data Proofs](https://www.w3.org/TR/vc-data-model/#proofs).\n */\n@injectable()\nexport class W3cJsonLdCredentialService {\n  private signatureSuiteRegistry: SignatureSuiteRegistry\n  private jsonLdModuleConfig: JsonLdModuleConfig\n\n  public constructor(signatureSuiteRegistry: SignatureSuiteRegistry, jsonLdModuleConfig: JsonLdModuleConfig) {\n    this.signatureSuiteRegistry = signatureSuiteRegistry\n    this.jsonLdModuleConfig = jsonLdModuleConfig\n  }\n\n  /**\n   * Signs a credential\n   */\n  public async signCredential(\n    agentContext: AgentContext,\n    options: W3cJsonLdSignCredentialOptions\n  ): Promise<W3cJsonLdVerifiableCredential> {\n    const { suite } = await this.prepareSigningSuite(agentContext, {\n      proofType: options.proofType,\n      verificationMethodId: options.verificationMethod,\n      allowedPurposes: options.proofPurpose?.term ? [options.proofPurpose.term] : ['assertionMethod'],\n      date: options.created ?? w3cDate(),\n      controller: options.credential.issuerId,\n    })\n\n    try {\n      const result = await vc.issue({\n        credential: JsonTransformer.toJSON(options.credential),\n        suite: suite,\n        purpose: options.proofPurpose,\n        documentLoader: this.jsonLdModuleConfig.documentLoader(agentContext),\n      })\n\n      return JsonTransformer.fromJSON(result, W3cJsonLdVerifiableCredential)\n    } catch (error) {\n      throw new CredoError(`Error issuing W3C JSON-LD VC. ${error.message}`, {\n        cause: error,\n      })\n    }\n  }\n\n  /**\n   * Validate that the agent can prepare to sign a credential with the given proof type and verification method.\n   */\n  public async assertCanSignCredential(\n    agentContext: AgentContext,\n    options: Pick<W3cJsonLdSignCredentialOptions, 'proofType' | 'verificationMethod'> & { controller?: string }\n  ): Promise<void> {\n    await this.prepareSigningSuite(agentContext, {\n      proofType: options.proofType,\n      verificationMethodId: options.verificationMethod,\n      allowedPurposes: ['assertionMethod'],\n      controller: options.controller,\n    })\n  }\n\n  /**\n   * Verifies the signature(s) of a credential\n   *\n   * @param credential the credential to be verified\n   * @returns the verification result\n   */\n  public async verifyCredential(\n    agentContext: AgentContext,\n    options: W3cJsonLdVerifyCredentialOptions\n  ): Promise<W3cVerifyCredentialResult> {\n    try {\n      this.assertNoAnonCredsW3cCredentialProof(options.credential.proof)\n\n      const verifyCredentialStatus = options.verifyCredentialStatus ?? true\n\n      await this.ensureCredentialIssuerTrusted(agentContext, options.credential, options.trustedIssuers)\n\n      const suites = this.getSignatureSuitesForCredential(agentContext, options.credential)\n\n      const verifyOptions: Record<string, unknown> = {\n        credential: JsonTransformer.toJSON(options.credential),\n        suite: suites,\n        documentLoader: this.jsonLdModuleConfig.documentLoader(agentContext),\n        checkStatus: ({ credential }: { credential: W3cJsonCredential }) => {\n          // Only throw error if credentialStatus is present\n          if (verifyCredentialStatus && 'credentialStatus' in credential) {\n            throw new CredoError('Verifying credential status for JSON-LD credentials is currently not supported')\n          }\n          return {\n            verified: true,\n          }\n        },\n      }\n\n      // this is a hack because vcjs throws if purpose is passed as undefined or null\n      if (options.proofPurpose) {\n        verifyOptions.purpose = options.proofPurpose\n      }\n\n      const result = await vc.verifyCredential(verifyOptions)\n\n      const { verified: isValid, ...remainingResult } = result\n\n      if (!isValid) {\n        agentContext.config.logger.debug(`Credential verification failed: ${result.error?.message}`, {\n          stack: result.error?.stack,\n        })\n      }\n\n      // We map the result to our own result type to make it easier to work with\n      // however, for now we just add a single vcJs validation result as we don't\n      // have access to the internal validation results of vc-js\n      return {\n        isValid,\n        validations: {\n          vcJs: {\n            isValid,\n            ...remainingResult,\n          },\n        },\n        error: result.error,\n      }\n    } catch (error) {\n      return {\n        isValid: false,\n        validations: {},\n        error,\n      }\n    }\n  }\n\n  /**\n   * Signs a presentation including the credentials it includes\n   *\n   * @param presentation the presentation to be signed\n   * @returns the signed presentation\n   */\n  public async signPresentation(\n    agentContext: AgentContext,\n    options: W3cJsonLdSignPresentationOptions\n  ): Promise<W3cJsonLdVerifiablePresentation> {\n    const { suite } = await this.prepareSigningSuite(agentContext, {\n      proofType: options.proofType,\n      verificationMethodId: options.verificationMethod,\n      allowedPurposes: options.proofPurpose?.term ? [options.proofPurpose.term] : ['authentication'],\n      date: new Date().toISOString(),\n    })\n\n    const signOptions: Record<string, unknown> = {\n      presentation: JsonTransformer.toJSON(options.presentation),\n      suite: suite,\n      challenge: options.challenge,\n      domain: options.domain,\n      documentLoader: this.jsonLdModuleConfig.documentLoader(agentContext),\n    }\n\n    // this is a hack because vcjs throws if purpose is passed as undefined or null\n    if (options.proofPurpose) {\n      signOptions.purpose = options.proofPurpose\n    }\n\n    const result = await vc.signPresentation(signOptions)\n\n    return JsonTransformer.fromJSON(result, W3cJsonLdVerifiablePresentation)\n  }\n\n  /**\n   * Verifies a presentation including the credentials it includes\n   *\n   * @param presentation the presentation to be verified\n   * @returns the verification result\n   */\n  public async verifyPresentation(\n    agentContext: AgentContext,\n    options: W3cJsonLdVerifyPresentationOptions\n  ): Promise<W3cVerifyPresentationResult> {\n    try {\n      this.assertNoAnonCredsW3cCredentialProof(options.presentation.proof)\n\n      // create keyPair\n      const WalletKeyPair = createKmsKeyPairClass(agentContext)\n\n      let proofs = options.presentation.proof\n\n      if (!Array.isArray(proofs)) {\n        proofs = [proofs]\n      }\n      if (options.purpose) {\n        proofs = proofs.filter((proof) => proof.proofPurpose === options.purpose.term)\n      }\n\n      const presentationSuites = proofs.map((proof) => {\n        const SuiteClass = this.signatureSuiteRegistry.getByProofType(proof.type).suiteClass\n        return new SuiteClass({\n          LDKeyClass: WalletKeyPair,\n          proof: {\n            verificationMethod: proof.verificationMethod,\n          },\n          date: proof.created,\n          useNativeCanonize: false,\n        })\n      })\n\n      const credentials = asArray(options.presentation.verifiableCredential)\n      assertOnlyW3cJsonLdVerifiableCredentials(credentials)\n\n      for (const credential of credentials) {\n        this.assertNoAnonCredsW3cCredentialProof(credential.proof)\n        await this.ensureCredentialIssuerTrusted(agentContext, credential, options.trustedIssuers)\n      }\n\n      const credentialSuites = credentials.map((credential) =>\n        this.getSignatureSuitesForCredential(agentContext, credential)\n      )\n      const allSuites = presentationSuites.concat(...credentialSuites)\n\n      const verifyOptions: Record<string, unknown> = {\n        presentation: JsonTransformer.toJSON(options.presentation),\n        suite: allSuites,\n        challenge: options.challenge,\n        domain: options.domain,\n        documentLoader: this.jsonLdModuleConfig.documentLoader(agentContext),\n      }\n\n      // this is a hack because vcjs throws if purpose is passed as undefined or null\n      if (options.purpose) {\n        verifyOptions.presentationPurpose = options.purpose\n      }\n\n      const result = await vc.verify(verifyOptions)\n\n      const { verified: isValid, ...remainingResult } = result\n\n      // The vc-js / jsonld-signatures libraries verify the presentation proof and each embedded\n      // credential's issuer proof, but do NOT bind the presentation signer (holder) to the\n      // credentialSubject of the embedded credentials. Without this check an attacker could wrap\n      // someone else's credential (a data object, not a secret) in a presentation signed with their\n      // own key and have it accepted. Enforce the binding here, mirroring the jwt_vp and sd-jwt paths\n      // (see validateCredentialSubjectAuthentication).\n      //\n      // The holders are the signers of the presentation proofs, which vc-js has already verified\n      // for their proof purpose.\n      const holderProofPurpose = options.purpose?.term ?? 'authentication'\n      const holders = await Promise.all(\n        asArray(options.presentation.proof)\n          .filter((proof) => proof.proofPurpose === holderProofPurpose)\n          .map((proof) => this.resolveSigner(agentContext, proof.verificationMethod))\n      )\n\n      // Surfaced per credential under `credentials[]` to mirror the jwt_vp result shape. The\n      // library-level signature/status validations remain lumped in `vcJs`, so each entry here\n      // only carries the credentialSubjectAuthentication check.\n      const credentialValidations = credentials.map((credential) => {\n        const credentialSubjectIds = credential.credentialSubjectIds\n\n        // A credential without subject identifiers is treated as a bearer credential,\n        // so there is no subject to authenticate.\n        const isAuthenticated =\n          credentialSubjectIds.length === 0 ||\n          holders.some((holder) => validateCredentialSubjectAuthentication(credentialSubjectIds, holder).isValid)\n\n        const credentialSubjectAuthentication: SingleValidationResult = isAuthenticated\n          ? { isValid: true }\n          : {\n              isValid: false,\n              error: new CredoError(\n                'Presentation does not authenticate the credentialSubject of one or more included credentials'\n              ),\n            }\n\n        return {\n          isValid: credentialSubjectAuthentication.isValid,\n          validations: { credentialSubjectAuthentication },\n        }\n      })\n\n      // We map the result to our own result type to make it easier to work with. The library\n      // validations are lumped into a single vcJs result as we don't have access to the internal\n      // validation results of vc-js; the credentialSubject authentication check that Credo performs\n      // on top is surfaced per credential under `credentials`.\n      return {\n        isValid: isValid && credentialValidations.every((credential) => credential.isValid),\n        validations: {\n          vcJs: {\n            isValid,\n            ...remainingResult,\n          },\n          credentials: credentialValidations,\n        },\n        error:\n          result.error ??\n          credentialValidations.find((credential) => !credential.isValid)?.validations.credentialSubjectAuthentication\n            .error,\n      }\n    } catch (error) {\n      return {\n        isValid: false,\n        validations: {},\n        error,\n      }\n    }\n  }\n\n  public getVerificationMethodTypesByProofType(proofType: string): string[] {\n    return this.getSigningSuiteInfo(proofType).verificationMethodTypes\n  }\n\n  public async getExpandedTypesForCredential(agentContext: AgentContext, credential: W3cJsonLdVerifiableCredential) {\n    // Get the expanded types\n    const expandedTypes: SingleOrArray<string> = (\n      await jsonld.expand(JsonTransformer.toJSON(credential), {\n        documentLoader: this.jsonLdModuleConfig.documentLoader(agentContext),\n      })\n    )[0]['@type']\n\n    return asArray(expandedTypes)\n  }\n\n  private async ensureCredentialIssuerTrusted(\n    agentContext: AgentContext,\n    credential: W3cJsonLdVerifiableCredential,\n    trustedIssuers?: TrustedIssuerDid[] | GetTrustedIssuersForCredential\n  ): Promise<void> {\n    const issuerId = credential.issuerId\n\n    // Only enforced for did-based issuers\n    if (!issuerId.startsWith('did:')) return\n\n    const issuerDid = parseDid(issuerId).did\n\n    for (const proof of asArray(credential.proof)) {\n      const verificationMethod = proof.verificationMethod\n      if (\n        !verificationMethod.startsWith('did:') ||\n        (await this.resolveSigner(agentContext, verificationMethod)) !== issuerDid\n      ) {\n        throw new CredoError(\n          `The proof verification method '${verificationMethod}' does not match the credential issuer did '${issuerDid}'.`\n        )\n      }\n\n      await TrustedIssuerContext.ensureTrustedCredentialSigner(\n        agentContext,\n        {\n          signer: { method: 'did', didUrl: verificationMethod },\n          verification: { type: 'credential', credential },\n        },\n        trustedIssuers\n      )\n    }\n  }\n\n  /**\n   * Resolves the DID that signed with a verification method, loading it through the configured\n   * document loader like vc-js does. vc-js has already validated its proof purpose.\n   */\n  private async resolveSigner(agentContext: AgentContext, verificationMethodId: string) {\n    const did = parseDid(verificationMethodId).did\n    const { document } = await this.jsonLdModuleConfig.documentLoader(agentContext)(verificationMethodId)\n    assertControlledByDid({ id: verificationMethodId, controller: document.controller }, did)\n\n    return did\n  }\n\n  private getSigningSuiteInfo(proofType: string) {\n    if (!this.signatureSuiteRegistry.supportedProofTypes.includes(proofType)) {\n      throw new W3cJsonLdCredentialSigningNotSupportedError(\n        `The requested proofType ${proofType} is not supported`,\n        'unsupported-proof-type'\n      )\n    }\n\n    return this.signatureSuiteRegistry.getByProofType(proofType)\n  }\n\n  private async prepareSigningSuite(\n    agentContext: AgentContext,\n    options: {\n      proofType: string\n      verificationMethodId: string\n      allowedPurposes: Array<DidPurpose | 'verificationMethod'>\n      date?: string\n      controller?: string\n    }\n  ) {\n    const suiteInfo = this.getSigningSuiteInfo(options.proofType)\n\n    const dids = agentContext.resolve(DidsApi)\n    let resolved: Awaited<ReturnType<typeof dids.resolveVerificationMethodFromCreatedDidRecord>>\n    try {\n      resolved = await dids.resolveVerificationMethodFromCreatedDidRecord(\n        options.verificationMethodId,\n        options.allowedPurposes\n      )\n    } catch (error) {\n      if (error instanceof RecordNotFoundError) {\n        throw new W3cJsonLdCredentialSigningNotSupportedError(\n          error.message,\n          'verification-method-not-controlled',\n          error\n        )\n      }\n      if (\n        error instanceof CredoError &&\n        error.message ===\n          `Unable to locate verification method with id '${options.verificationMethodId}' in purposes ${options.allowedPurposes}`\n      ) {\n        throw new W3cJsonLdCredentialSigningNotSupportedError(error.message, 'verification-method-not-found', error)\n      }\n      throw error\n    }\n\n    const { verificationMethod: nativeVerificationMethod, publicJwk } = resolved\n\n    if (!suiteInfo.verificationMethodTypes.includes(nativeVerificationMethod.type)) {\n      throw new W3cJsonLdCredentialSigningNotSupportedError(\n        `Unsupported verification method type '${nativeVerificationMethod.type}' for proof type '${options.proofType}'. Supported types are: ${suiteInfo.verificationMethodTypes.join(', ')}`,\n        'unsupported-verification-method-type'\n      )\n    }\n\n    const documentLoader = this.jsonLdModuleConfig.documentLoader(agentContext)\n    const loaderResult = await documentLoader(options.verificationMethodId)\n    const framedVerificationMethod =\n      typeof loaderResult.document === 'string' ? JSON.parse(loaderResult.document) : loaderResult.document\n\n    const WalletKeyPair = createKmsKeyPairClass(agentContext)\n\n    // Instantiate suite to validate verification method and framing context\n    const SuiteClass = suiteInfo.suiteClass\n    const validationSuite = new SuiteClass({\n      LDKeyClass: WalletKeyPair,\n      proof: {\n        verificationMethod: options.verificationMethodId,\n      },\n      useNativeCanonize: false,\n      date: options.date ?? w3cDate(),\n    })\n\n    await validationSuite.assertVerificationMethod(framedVerificationMethod)\n\n    const suitesForKey = this.signatureSuiteRegistry.getAllByPublicJwkType(publicJwk)\n    if (!suitesForKey.some(({ suiteClass }) => suiteClass === suiteInfo.suiteClass)) {\n      throw new W3cJsonLdCredentialSigningNotSupportedError(\n        'The key type of the verification method does not match the suite',\n        'unsupported-key-type'\n      )\n    }\n\n    const keyPair = new WalletKeyPair({\n      controller:\n        options.controller ?? (framedVerificationMethod.controller as string) ?? nativeVerificationMethod.controller,\n      id: options.verificationMethodId,\n      publicJwk,\n    })\n\n    const suite = new SuiteClass({\n      key: keyPair,\n      LDKeyClass: WalletKeyPair,\n      proof: {\n        verificationMethod: options.verificationMethodId,\n      },\n      useNativeCanonize: false,\n      date: options.date ?? w3cDate(),\n    })\n\n    return { suite, suiteInfo, keyPair, WalletKeyPair }\n  }\n\n  private getSignatureSuitesForCredential(agentContext: AgentContext, credential: W3cJsonLdVerifiableCredential) {\n    const WalletKeyPair = createKmsKeyPairClass(agentContext)\n\n    let proofs = credential.proof\n\n    if (!Array.isArray(proofs)) {\n      proofs = [proofs]\n    }\n\n    return proofs.map((proof) => {\n      const SuiteClass = this.signatureSuiteRegistry.getByProofType(proof.type).suiteClass\n      return new SuiteClass({\n        LDKeyClass: WalletKeyPair,\n        proof: {\n          verificationMethod: proof.verificationMethod,\n        },\n        date: proof.created,\n        useNativeCanonize: false,\n      })\n    })\n  }\n\n  private assertNoAnonCredsW3cCredentialProof(\n    proofsInput: W3cJsonLdVerifiableCredential['proof'] | W3cJsonLdVerifiablePresentation['proof']\n  ) {\n    const proofs = asArray(proofsInput)\n    const hasAnonCredsW3cCredentialProof = proofs.some(\n      (proof) =>\n        proof.type === 'DataIntegrityProof' &&\n        'cryptosuite' in proof &&\n        proof.cryptosuite === ANONCREDS_W3C_CREDENTIAL_CRYPTOSUITE\n    )\n\n    if (hasAnonCredsW3cCredentialProof) {\n      throw new CredoError(\n        'W3C credential proof with cryptosuite anoncreds-2023 must be verified through the anoncreds W3C credential path, not the generic linked-data verifier'\n      )\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCO,IAAM,6BAAN,MAAM,2BAA2B;CAItC,YAAmB,wBAAgD,oBAAwC;EACzG,KAAK,yBAAyB;EAC9B,KAAK,qBAAqB;CAC5B;;;;CAKA,MAAa,eACX,cACA,SACwC;EACxC,MAAM,EAAE,UAAU,MAAM,KAAK,oBAAoB,cAAc;GAC7D,WAAW,QAAQ;GACnB,sBAAsB,QAAQ;GAC9B,iBAAiB,QAAQ,cAAc,OAAO,CAAC,QAAQ,aAAa,IAAI,IAAI,CAAC,iBAAiB;GAC9F,MAAM,QAAQ,WAAW,QAAQ;GACjC,YAAY,QAAQ,WAAW;EACjC,CAAC;EAED,IAAI;GACF,MAAM,SAAS,MAAMA,mBAAG,MAAM;IAC5B,YAAY,gBAAgB,OAAO,QAAQ,UAAU;IAC9C;IACP,SAAS,QAAQ;IACjB,gBAAgB,KAAK,mBAAmB,eAAe,YAAY;GACrE,CAAC;GAED,OAAO,gBAAgB,SAAS,QAAQ,6BAA6B;EACvE,SAAS,OAAO;GACd,MAAM,IAAI,WAAW,iCAAiC,MAAM,WAAW,EACrE,OAAO,MACT,CAAC;EACH;CACF;;;;CAKA,MAAa,wBACX,cACA,SACe;EACf,MAAM,KAAK,oBAAoB,cAAc;GAC3C,WAAW,QAAQ;GACnB,sBAAsB,QAAQ;GAC9B,iBAAiB,CAAC,iBAAiB;GACnC,YAAY,QAAQ;EACtB,CAAC;CACH;;;;;;;CAQA,MAAa,iBACX,cACA,SACoC;EACpC,IAAI;GACF,KAAK,oCAAoC,QAAQ,WAAW,KAAK;GAEjE,MAAM,yBAAyB,QAAQ,0BAA0B;GAEjE,MAAM,KAAK,8BAA8B,cAAc,QAAQ,YAAY,QAAQ,cAAc;GAEjG,MAAM,SAAS,KAAK,gCAAgC,cAAc,QAAQ,UAAU;GAEpF,MAAM,gBAAyC;IAC7C,YAAY,gBAAgB,OAAO,QAAQ,UAAU;IACrD,OAAO;IACP,gBAAgB,KAAK,mBAAmB,eAAe,YAAY;IACnE,cAAc,EAAE,iBAAoD;KAElE,IAAI,0BAA0B,sBAAsB,YAClD,MAAM,IAAI,WAAW,gFAAgF;KAEvG,OAAO,EACL,UAAU,KACZ;IACF;GACF;GAGA,IAAI,QAAQ,cACV,cAAc,UAAU,QAAQ;GAGlC,MAAM,SAAS,MAAMA,mBAAG,iBAAiB,aAAa;GAEtD,MAAM,EAAE,UAAU,SAAS,GAAG,oBAAoB;GAElD,IAAI,CAAC,SACH,aAAa,OAAO,OAAO,MAAM,mCAAmC,OAAO,OAAO,WAAW,EAC3F,OAAO,OAAO,OAAO,MACvB,CAAC;GAMH,OAAO;IACL;IACA,aAAa,EACX,MAAM;KACJ;KACA,GAAG;IACL,EACF;IACA,OAAO,OAAO;GAChB;EACF,SAAS,OAAO;GACd,OAAO;IACL,SAAS;IACT,aAAa,CAAC;IACd;GACF;EACF;CACF;;;;;;;CAQA,MAAa,iBACX,cACA,SAC0C;EAC1C,MAAM,EAAE,UAAU,MAAM,KAAK,oBAAoB,cAAc;GAC7D,WAAW,QAAQ;GACnB,sBAAsB,QAAQ;GAC9B,iBAAiB,QAAQ,cAAc,OAAO,CAAC,QAAQ,aAAa,IAAI,IAAI,CAAC,gBAAgB;GAC7F,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;EAC/B,CAAC;EAED,MAAM,cAAuC;GAC3C,cAAc,gBAAgB,OAAO,QAAQ,YAAY;GAClD;GACP,WAAW,QAAQ;GACnB,QAAQ,QAAQ;GAChB,gBAAgB,KAAK,mBAAmB,eAAe,YAAY;EACrE;EAGA,IAAI,QAAQ,cACV,YAAY,UAAU,QAAQ;EAGhC,MAAM,SAAS,MAAMA,mBAAG,iBAAiB,WAAW;EAEpD,OAAO,gBAAgB,SAAS,QAAQ,+BAA+B;CACzE;;;;;;;CAQA,MAAa,mBACX,cACA,SACsC;EACtC,IAAI;GACF,KAAK,oCAAoC,QAAQ,aAAa,KAAK;GAGnE,MAAM,gBAAgB,sBAAsB,YAAY;GAExD,IAAI,SAAS,QAAQ,aAAa;GAElC,IAAI,CAAC,MAAM,QAAQ,MAAM,GACvB,SAAS,CAAC,MAAM;GAElB,IAAI,QAAQ,SACV,SAAS,OAAO,QAAQ,UAAU,MAAM,iBAAiB,QAAQ,QAAQ,IAAI;GAG/E,MAAM,qBAAqB,OAAO,KAAK,UAAU;IAC/C,MAAM,aAAa,KAAK,uBAAuB,eAAe,MAAM,IAAI,CAAC,CAAC;IAC1E,OAAO,IAAI,WAAW;KACpB,YAAY;KACZ,OAAO,EACL,oBAAoB,MAAM,mBAC5B;KACA,MAAM,MAAM;KACZ,mBAAmB;IACrB,CAAC;GACH,CAAC;GAED,MAAM,cAAc,QAAQ,QAAQ,aAAa,oBAAoB;GACrE,yCAAyC,WAAW;GAEpD,KAAK,MAAM,cAAc,aAAa;IACpC,KAAK,oCAAoC,WAAW,KAAK;IACzD,MAAM,KAAK,8BAA8B,cAAc,YAAY,QAAQ,cAAc;GAC3F;GAEA,MAAM,mBAAmB,YAAY,KAAK,eACxC,KAAK,gCAAgC,cAAc,UAAU,CAC/D;GACA,MAAM,YAAY,mBAAmB,OAAO,GAAG,gBAAgB;GAE/D,MAAM,gBAAyC;IAC7C,cAAc,gBAAgB,OAAO,QAAQ,YAAY;IACzD,OAAO;IACP,WAAW,QAAQ;IACnB,QAAQ,QAAQ;IAChB,gBAAgB,KAAK,mBAAmB,eAAe,YAAY;GACrE;GAGA,IAAI,QAAQ,SACV,cAAc,sBAAsB,QAAQ;GAG9C,MAAM,SAAS,MAAMA,mBAAG,OAAO,aAAa;GAE5C,MAAM,EAAE,UAAU,SAAS,GAAG,oBAAoB;GAWlD,MAAM,qBAAqB,QAAQ,SAAS,QAAQ;GACpD,MAAM,UAAU,MAAM,QAAQ,IAC5B,QAAQ,QAAQ,aAAa,KAAK,CAAC,CAChC,QAAQ,UAAU,MAAM,iBAAiB,kBAAkB,CAAC,CAC5D,KAAK,UAAU,KAAK,cAAc,cAAc,MAAM,kBAAkB,CAAC,CAC9E;GAKA,MAAM,wBAAwB,YAAY,KAAK,eAAe;IAC5D,MAAM,uBAAuB,WAAW;IAQxC,MAAM,kCAHJ,qBAAqB,WAAW,KAChC,QAAQ,MAAM,WAAW,wCAAwC,sBAAsB,MAAM,CAAC,CAAC,OAAO,IAGpG,EAAE,SAAS,KAAK,IAChB;KACE,SAAS;KACT,OAAO,IAAI,WACT,8FACF;IACF;IAEJ,OAAO;KACL,SAAS,gCAAgC;KACzC,aAAa,EAAE,gCAAgC;IACjD;GACF,CAAC;GAMD,OAAO;IACL,SAAS,WAAW,sBAAsB,OAAO,eAAe,WAAW,OAAO;IAClF,aAAa;KACX,MAAM;MACJ;MACA,GAAG;KACL;KACA,aAAa;IACf;IACA,OACE,OAAO,SACP,sBAAsB,MAAM,eAAe,CAAC,WAAW,OAAO,CAAC,EAAE,YAAY,gCAC1E;GACP;EACF,SAAS,OAAO;GACd,OAAO;IACL,SAAS;IACT,aAAa,CAAC;IACd;GACF;EACF;CACF;CAEA,sCAA6C,WAA6B;EACxE,OAAO,KAAK,oBAAoB,SAAS,CAAC,CAAC;CAC7C;CAEA,MAAa,8BAA8B,cAA4B,YAA2C;EAEhH,MAAM,iBACJ,MAAMC,eAAO,OAAO,gBAAgB,OAAO,UAAU,GAAG,EACtD,gBAAgB,KAAK,mBAAmB,eAAe,YAAY,EACrE,CAAC,EAAA,CACD,EAAE,CAAC;EAEL,OAAO,QAAQ,aAAa;CAC9B;CAEA,MAAc,8BACZ,cACA,YACA,gBACe;EACf,MAAM,WAAW,WAAW;EAG5B,IAAI,CAAC,SAAS,WAAW,MAAM,GAAG;EAElC,MAAM,YAAY,SAAS,QAAQ,CAAC,CAAC;EAErC,KAAK,MAAM,SAAS,QAAQ,WAAW,KAAK,GAAG;GAC7C,MAAM,qBAAqB,MAAM;GACjC,IACE,CAAC,mBAAmB,WAAW,MAAM,KACpC,MAAM,KAAK,cAAc,cAAc,kBAAkB,MAAO,WAEjE,MAAM,IAAI,WACR,kCAAkC,mBAAmB,8CAA8C,UAAU,GAC/G;GAGF,MAAM,qBAAqB,8BACzB,cACA;IACE,QAAQ;KAAE,QAAQ;KAAO,QAAQ;IAAmB;IACpD,cAAc;KAAE,MAAM;KAAc;IAAW;GACjD,GACA,cACF;EACF;CACF;;;;;CAMA,MAAc,cAAc,cAA4B,sBAA8B;EACpF,MAAM,MAAM,SAAS,oBAAoB,CAAC,CAAC;EAC3C,MAAM,EAAE,aAAa,MAAM,KAAK,mBAAmB,eAAe,YAAY,CAAC,CAAC,oBAAoB;EACpG,sBAAsB;GAAE,IAAI;GAAsB,YAAY,SAAS;EAAW,GAAG,GAAG;EAExF,OAAO;CACT;CAEA,oBAA4B,WAAmB;EAC7C,IAAI,CAAC,KAAK,uBAAuB,oBAAoB,SAAS,SAAS,GACrE,MAAM,IAAI,4CACR,2BAA2B,UAAU,oBACrC,wBACF;EAGF,OAAO,KAAK,uBAAuB,eAAe,SAAS;CAC7D;CAEA,MAAc,oBACZ,cACA,SAOA;EACA,MAAM,YAAY,KAAK,oBAAoB,QAAQ,SAAS;EAE5D,MAAM,OAAO,aAAa,QAAQ,OAAO;EACzC,IAAI;EACJ,IAAI;GACF,WAAW,MAAM,KAAK,8CACpB,QAAQ,sBACR,QAAQ,eACV;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,qBACnB,MAAM,IAAI,4CACR,MAAM,SACN,sCACA,KACF;GAEF,IACE,iBAAiB,cACjB,MAAM,YACJ,iDAAiD,QAAQ,qBAAqB,gBAAgB,QAAQ,mBAExG,MAAM,IAAI,4CAA4C,MAAM,SAAS,iCAAiC,KAAK;GAE7G,MAAM;EACR;EAEA,MAAM,EAAE,oBAAoB,0BAA0B,cAAc;EAEpE,IAAI,CAAC,UAAU,wBAAwB,SAAS,yBAAyB,IAAI,GAC3E,MAAM,IAAI,4CACR,yCAAyC,yBAAyB,KAAK,oBAAoB,QAAQ,UAAU,0BAA0B,UAAU,wBAAwB,KAAK,IAAI,KAClL,sCACF;EAIF,MAAM,eAAe,MADE,KAAK,mBAAmB,eAAe,YACtB,CAAC,CAAC,QAAQ,oBAAoB;EACtE,MAAM,2BACJ,OAAO,aAAa,aAAa,WAAW,KAAK,MAAM,aAAa,QAAQ,IAAI,aAAa;EAE/F,MAAM,gBAAgB,sBAAsB,YAAY;EAGxD,MAAM,aAAa,UAAU;EAU7B,MAAM,IATsB,WAAW;GACrC,YAAY;GACZ,OAAO,EACL,oBAAoB,QAAQ,qBAC9B;GACA,mBAAmB;GACnB,MAAM,QAAQ,QAAQ,QAAQ;EAChC,CAEoB,CAAC,CAAC,yBAAyB,wBAAwB;EAGvE,IAAI,CADiB,KAAK,uBAAuB,sBAAsB,SACvD,CAAC,CAAC,MAAM,EAAE,iBAAiB,eAAe,UAAU,UAAU,GAC5E,MAAM,IAAI,4CACR,oEACA,sBACF;EAGF,MAAM,UAAU,IAAI,cAAc;GAChC,YACE,QAAQ,cAAe,yBAAyB,cAAyB,yBAAyB;GACpG,IAAI,QAAQ;GACZ;EACF,CAAC;EAYD,OAAO;GAAE,OAAA,IAVS,WAAW;IAC3B,KAAK;IACL,YAAY;IACZ,OAAO,EACL,oBAAoB,QAAQ,qBAC9B;IACA,mBAAmB;IACnB,MAAM,QAAQ,QAAQ,QAAQ;GAChC,CAEa;GAAG;GAAW;GAAS;EAAc;CACpD;CAEA,gCAAwC,cAA4B,YAA2C;EAC7G,MAAM,gBAAgB,sBAAsB,YAAY;EAExD,IAAI,SAAS,WAAW;EAExB,IAAI,CAAC,MAAM,QAAQ,MAAM,GACvB,SAAS,CAAC,MAAM;EAGlB,OAAO,OAAO,KAAK,UAAU;GAC3B,MAAM,aAAa,KAAK,uBAAuB,eAAe,MAAM,IAAI,CAAC,CAAC;GAC1E,OAAO,IAAI,WAAW;IACpB,YAAY;IACZ,OAAO,EACL,oBAAoB,MAAM,mBAC5B;IACA,MAAM,MAAM;IACZ,mBAAmB;GACrB,CAAC;EACH,CAAC;CACH;CAEA,oCACE,aACA;EASA,IARe,QAAQ,WACqB,CAAC,CAAC,MAC3C,UACC,MAAM,SAAS,wBACf,iBAAiB,SACjB,MAAM,gBAAA,gBAGuB,GAC/B,MAAM,IAAI,WACR,uJACF;CAEJ;AACF;AAxfC,6BAAA,WAAA,CAAA,WAAW,GAAA,mBAAA,qBAAA,CAAA,OAAA,2BAAA,cAAA,SAAA,wBAAA,OAAA,uBAAA,cAAA,SAAA,kBAAA,CAAA,CAAA,GAAA,0BAAA"}

package/build/modules/vc/models/W3cV2VerifyResult.d.mts

@@ -100,6 +100,12 @@ export type W3cV2PresentationCredentialEntryResult = W3cV2VerifyResult<W3cV2Cred
    *    is signed by at least one of the credential subject ids.
    */
   credentialSubjectAuthentication: SingleValidationResult;
+  /**
+   * Whether a credential bound to a key with `cnf` is presented with that key. Valid when the
+   * credential has no `cnf`, which includes an SD-JWT credential whose `cnf` disclosure was left out.
+   * Callers that require holder binding must check that the credential has a `cnf`.
+   */
+  holderBinding: SingleValidationResult;
 }>;
 //#endregion
 //# sourceMappingURL=W3cV2VerifyResult.d.mts.map

package/build/modules/vc/models/W3cV2VerifyResult.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"W3cV2VerifyResult.d.mts","names":[],"sources":["../../../../src/modules/vc/models/W3cV2VerifyResult.ts"],"mappings":";;YAEY,8BAA8B,kBAAkB;iBAE3C;;;;;EAKf;;;;EAKA,cAAc,kBAAkB;;;;;EAMhC,mBAAmB;;;;;EAMnB,QAAQ;;UAGA,kBAAkB;;;;;EAK1B;;;;EAKA,aAAa,QAAQ;;;;;EAMrB,QAAQ;;UAGA;;;;;EAKR,WAAW;;;;;EAMX,gBAAgB;;;;EAKhB,WAAW;;;;;EAMX,kBAAkB;;;;;EAMlB,gBAAgB;;UAGR;;;;;EAKR,WAAW;;;;EAKX,uBAAuB;;;;;;;;;;;;EAavB,gBAAgB;;YAGN,yCAAyC,kBACnD;;;;;;;;;;;;EAYE,iCAAiC"}
+{"version":3,"file":"W3cV2VerifyResult.d.mts","names":[],"sources":["../../../../src/modules/vc/models/W3cV2VerifyResult.ts"],"mappings":";;YAEY,8BAA8B,kBAAkB;iBAE3C;;;;;EAKf;;;;EAKA,cAAc,kBAAkB;;;;;EAMhC,mBAAmB;;;;;EAMnB,QAAQ;;UAGA,kBAAkB;;;;;EAK1B;;;;EAKA,aAAa,QAAQ;;;;;EAMrB,QAAQ;;UAGA;;;;;EAKR,WAAW;;;;;EAMX,gBAAgB;;;;EAKhB,WAAW;;;;;EAMX,kBAAkB;;;;;EAMlB,gBAAgB;;UAGR;;;;;EAKR,WAAW;;;;EAKX,uBAAuB;;;;;;;;;;;;EAavB,gBAAgB;;YAGN,yCAAyC,kBACnD;;;;;;;;;;;;EAYE,iCAAiC;;;;;;EAOjC,eAAe"}

package/build/modules/vc/models/credential/W3cV2EnvelopedVerifiableCredential.d.mts

@@ -20,7 +20,7 @@ export declare class W3cV2EnvelopedVerifiableCredential {
   /**
    * Gets the enveloped credential.
    */
-  get envelopedCredential(): W3cV2JwtVerifiableCredential | W3cV2SdJwtVerifiableCredential;
+  get envelopedCredential(): W3cV2SdJwtVerifiableCredential | W3cV2JwtVerifiableCredential;
   /**
    * Resolved credential is the fully resolved {@link W3cV2Credential} instance.
    */

package/build/modules/vc/models/credential/W3cV2EnvelopedVerifiableCredential.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"W3cV2EnvelopedVerifiableCredential.d.mts","names":[],"sources":["../../../../../src/modules/vc/models/credential/W3cV2EnvelopedVerifiableCredential.ts"],"mappings":";;;;;;;iBAWiB;EACf;EACA,mBAAmB,eAAe;EAClC,OAAO;;qBAGI;UAEH;EAEW,YAAA,SAAS;SASd,yBACZ,YAAY,iCAAiC,+BAC5C;EAUI,kBAAmB,eAAe;EAGlC;EAGA,MAAO;;;;MAKH,uBAAmB,+BAAA;;;;MAWnB,sBAAsB;;;;MAOtB,eAAe,YAAY,aAAa,YAAY;;wBAMjD,qCACd,iBACC,SAAS;wBAyBI,iDAA6C;wBAgB7C,oCAAoC,oBAAoB,oBAAoB"}
+{"version":3,"file":"W3cV2EnvelopedVerifiableCredential.d.mts","names":[],"sources":["../../../../../src/modules/vc/models/credential/W3cV2EnvelopedVerifiableCredential.ts"],"mappings":";;;;;;;iBAWiB;EACf;EACA,mBAAmB,eAAe;EAClC,OAAO;;qBAGI;UAEH;EAEW,YAAA,SAAS;SASd,yBACZ,YAAY,iCAAiC,+BAC5C;EAUI,kBAAmB,eAAe;EAGlC;EAGA,MAAO;;;;MAKH,uBAAmB,iCAAA;;;;MAWnB,sBAAsB;;;;MAOtB,eAAe,YAAY,aAAa,YAAY;;wBAMjD,qCACd,iBACC,SAAS;wBAyBI,iDAA6C;wBAgB7C,oCAAoC,oBAAoB,oBAAoB"}

package/build/modules/vc/models/credential/W3cV2VerifiableCredential.d.mts

@@ -6,7 +6,7 @@ import "../../sd-jwt-vc/index.mjs";
 import "../../jwt-vc/index.mjs";
 import "../../data-integrity/index.mjs";
 //#region src/modules/vc/models/credential/W3cV2VerifiableCredential.d.ts
-export declare const decodeW3cV2VerifiableCredential: (v: unknown) => W3cV2DataIntegrityVerifiableCredential | W3cV2JwtVerifiableCredential | W3cV2SdJwtVerifiableCredential;
+export declare const decodeW3cV2VerifiableCredential: (v: unknown) => W3cV2DataIntegrityVerifiableCredential | W3cV2SdJwtVerifiableCredential | W3cV2JwtVerifiableCredential;
 export declare function W3cV2VerifiableCredentialTransformer(): PropertyDecorator;
 /**
  * A Secured W3C Verifiable Credential (VC) as defined in the W3C VC Data Model 2.0

package/build/modules/vc/models/credential/W3cV2VerifiableCredential.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"W3cV2VerifiableCredential.d.mts","names":[],"sources":["../../../../../src/modules/vc/models/credential/W3cV2VerifiableCredential.ts"],"mappings":";;;;;;;;qBAaa,kCAAmC,eAAU,yCAAA,+BAAA;wBAoE1C,wCAAoC;;;;;;;;;;;;;;YA6BxC,0BACV,eAAe,YAAY,WAAW,YAAY,aAAa,YAAY,4BACzE,eAAe,YAAY,WAC3B,+BACA,eAAe,YAAY,aACzB,iCACA,eAAe,YAAY,OACzB,yCACA,+BAA+B,iCAAiC;YAE5D,iCACV,eAAe,YAAY,WAAW,YAAY,aAAa,YAAY,4BACzE,eAAe,YAAY,WAC3B,sCACA,eAAe,YAAY,aACzB,wCACA,eAAe,YAAY,OACzB,gDAEI,sCACA,wCACA"}
+{"version":3,"file":"W3cV2VerifiableCredential.d.mts","names":[],"sources":["../../../../../src/modules/vc/models/credential/W3cV2VerifiableCredential.ts"],"mappings":";;;;;;;;qBAaa,kCAAmC,eAAU,yCAAA,iCAAA;wBAoE1C,wCAAoC;;;;;;;;;;;;;;YA6BxC,0BACV,eAAe,YAAY,WAAW,YAAY,aAAa,YAAY,4BACzE,eAAe,YAAY,WAC3B,+BACA,eAAe,YAAY,aACzB,iCACA,eAAe,YAAY,OACzB,yCACA,+BAA+B,iCAAiC;YAE5D,iCACV,eAAe,YAAY,WAAW,YAAY,aAAa,YAAY,4BACzE,eAAe,YAAY,WAC3B,sCACA,eAAe,YAAY,aACzB,wCACA,eAAe,YAAY,OACzB,gDAEI,sCACA,wCACA"}

package/build/modules/vc/resolveSigner.mjs

@@ -0,0 +1,74 @@
+import { CredoError } from "../../error/CredoError.mjs";
+import "../../error/index.mjs";
+import { isDid } from "../../utils/did.mjs";
+import "../../utils/index.mjs";
+import { PublicJwk } from "../kms/jwk/PublicJwk.mjs";
+import "../kms/index.mjs";
+import { getSupportedVerificationMethodTypesForPublicJwk } from "../dids/domain/key-type/keyDidMapping.mjs";
+import { DidsApi } from "../dids/DidsApi.mjs";
+import "../dids/index.mjs";
+//#region src/modules/vc/resolveSigner.ts
+/**
+* Resolves the verification method of a signature and the DID that signed with it, following
+* Controlled Identifiers 1.0 §3.3 ("Retrieve Verification Method"). The verification method must be
+* listed under `purpose` in the DID document of its own DID, and be controlled by that DID.
+*
+* @param purpose omit when the proof purpose is already validated
+*/
+async function resolveSigner(agentContext, verificationMethodId, purpose) {
+	const didDocument = await agentContext.dependencyManager.resolve(DidsApi).resolveDidDocument(verificationMethodId);
+	const verificationMethod = didDocument.dereferenceKey(verificationMethodId, purpose);
+	assertControlledByDid(verificationMethod, didDocument.id);
+	return {
+		verificationMethod,
+		signer: didDocument.id
+	};
+}
+/**
+* Resolves the signer of a JWT from its `kid`, or from the `iss` and `alg` when there is no
+* `kid`. When `iss` is present, it must be the signer.
+*/
+async function resolveJwtSigner(agentContext, { kid, iss, alg, purpose }) {
+	let resolved;
+	if (kid?.startsWith("#")) {
+		if (!iss || !isDid(iss)) throw new CredoError(`JWT 'iss' MUST be a did when 'kid' is a relative did url`);
+		resolved = await resolveSigner(agentContext, `${iss}${kid}`, purpose);
+	} else if (kid && isDid(kid)) resolved = await resolveSigner(agentContext, kid, purpose);
+	else {
+		if (!iss) throw new CredoError(`JWT 'iss' MUST be present in payload when no 'kid' is specified`);
+		const jwkClass = PublicJwk.supportedPublicJwkClassForSignatureAlgorithm(alg);
+		const didDocument = await agentContext.dependencyManager.resolve(DidsApi).resolveDidDocument(iss);
+		const verificationMethods = didDocument.findVerificationMethodsByTypeAndPurpose(getSupportedVerificationMethodTypesForPublicJwk(jwkClass), purpose);
+		if (verificationMethods.length !== 1) throw new CredoError(`${verificationMethods.length === 0 ? "No" : "Multiple"} verification methods found for signer '${iss}' and key type '${jwkClass.name}' for alg '${alg}'. Unable to determine which public key is associated with the JWT.`);
+		assertControlledByDid(verificationMethods[0], didDocument.id);
+		resolved = {
+			verificationMethod: verificationMethods[0],
+			signer: didDocument.id
+		};
+	}
+	if (iss && resolved.signer !== iss) throw new CredoError(`JWT is signed by '${resolved.signer}', but its 'iss' is '${iss}'`);
+	return resolved;
+}
+/**
+* Validates that the `issuer` of a credential or the `holder` of a presentation is the signer. A
+* missing `holder` makes no claim, so it passes.
+*/
+function validateSignerIsExpectedParty({ verificationMethod, signer }, expectedSigner, role) {
+	if (!expectedSigner || signer === expectedSigner) return { isValid: true };
+	const description = role === "issuer" ? `Credential is signed using verification method ${verificationMethod.id}, while the issuer of the credential is '${expectedSigner}'` : `Presentation is signed using verification method ${verificationMethod.id}, while the holder of the presentation is '${expectedSigner}'`;
+	return {
+		isValid: false,
+		error: new CredoError(description)
+	};
+}
+/**
+* A DID document can name any controller for its keys, so only the DID of the document that lists
+* the verification method is accepted.
+*/
+function assertControlledByDid(verificationMethod, did) {
+	if (verificationMethod.controller !== did) throw new CredoError(`Verification method '${verificationMethod.id}' is controlled by '${verificationMethod.controller}', not by the DID document '${did}' it is listed in`);
+}
+//#endregion
+export { assertControlledByDid, resolveJwtSigner, resolveSigner, validateSignerIsExpectedParty };
+
+//# sourceMappingURL=resolveSigner.mjs.map

package/build/modules/vc/resolveSigner.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveSigner.mjs","names":[],"sources":["../../../src/modules/vc/resolveSigner.ts"],"sourcesContent":["import type { AgentContext } from '../../agent'\nimport { CredoError } from '../../error'\nimport { isDid } from '../../utils'\nimport { type DidPurpose, DidsApi, type VerificationMethod } from '../dids'\nimport { getSupportedVerificationMethodTypesForPublicJwk } from '../dids/domain/key-type/keyDidMapping'\nimport { type KnownJwaSignatureAlgorithm, PublicJwk } from '../kms'\nimport type { SingleValidationResult } from './models/W3cVerifyResult'\n\nexport interface ResolvedSigner {\n  verificationMethod: VerificationMethod\n\n  /** The DID of the DID document that lists and controls `verificationMethod` */\n  signer: string\n}\n\n/**\n * Resolves the verification method of a signature and the DID that signed with it, following\n * Controlled Identifiers 1.0 §3.3 (\"Retrieve Verification Method\"). The verification method must be\n * listed under `purpose` in the DID document of its own DID, and be controlled by that DID.\n *\n * @param purpose omit when the proof purpose is already validated\n */\nexport async function resolveSigner(\n  agentContext: AgentContext,\n  verificationMethodId: string,\n  purpose?: DidPurpose[]\n): Promise<ResolvedSigner> {\n  const didDocument = await agentContext.dependencyManager.resolve(DidsApi).resolveDidDocument(verificationMethodId)\n\n  const verificationMethod = didDocument.dereferenceKey(verificationMethodId, purpose)\n  assertControlledByDid(verificationMethod, didDocument.id)\n\n  return { verificationMethod, signer: didDocument.id }\n}\n\n/**\n * Resolves the signer of a JWT from its `kid`, or from the `iss` and `alg` when there is no\n * `kid`. When `iss` is present, it must be the signer.\n */\nexport async function resolveJwtSigner(\n  agentContext: AgentContext,\n  { kid, iss, alg, purpose }: { kid?: string; iss?: string; alg: KnownJwaSignatureAlgorithm; purpose: DidPurpose[] }\n): Promise<ResolvedSigner> {\n  let resolved: ResolvedSigner\n\n  if (kid?.startsWith('#')) {\n    if (!iss || !isDid(iss)) {\n      throw new CredoError(`JWT 'iss' MUST be a did when 'kid' is a relative did url`)\n    }\n\n    resolved = await resolveSigner(agentContext, `${iss}${kid}`, purpose)\n  } else if (kid && isDid(kid)) {\n    resolved = await resolveSigner(agentContext, kid, purpose)\n  } else {\n    if (!iss) {\n      throw new CredoError(`JWT 'iss' MUST be present in payload when no 'kid' is specified`)\n    }\n\n    const jwkClass = PublicJwk.supportedPublicJwkClassForSignatureAlgorithm(alg)\n    const didDocument = await agentContext.dependencyManager.resolve(DidsApi).resolveDidDocument(iss)\n    const verificationMethods = didDocument.findVerificationMethodsByTypeAndPurpose(\n      getSupportedVerificationMethodTypesForPublicJwk(jwkClass),\n      purpose\n    )\n\n    if (verificationMethods.length !== 1) {\n      throw new CredoError(\n        `${verificationMethods.length === 0 ? 'No' : 'Multiple'} verification methods found for signer '${iss}' and key type '${jwkClass.name}' for alg '${alg}'. Unable to determine which public key is associated with the JWT.`\n      )\n    }\n\n    assertControlledByDid(verificationMethods[0], didDocument.id)\n    resolved = { verificationMethod: verificationMethods[0], signer: didDocument.id }\n  }\n\n  if (iss && resolved.signer !== iss) {\n    throw new CredoError(`JWT is signed by '${resolved.signer}', but its 'iss' is '${iss}'`)\n  }\n\n  return resolved\n}\n\n/**\n * Validates that the `issuer` of a credential or the `holder` of a presentation is the signer. A\n * missing `holder` makes no claim, so it passes.\n */\nexport function validateSignerIsExpectedParty(\n  { verificationMethod, signer }: ResolvedSigner,\n  expectedSigner: string | null | undefined,\n  role: 'issuer' | 'holder'\n): SingleValidationResult {\n  if (!expectedSigner || signer === expectedSigner) return { isValid: true }\n\n  const description =\n    role === 'issuer'\n      ? `Credential is signed using verification method ${verificationMethod.id}, while the issuer of the credential is '${expectedSigner}'`\n      : `Presentation is signed using verification method ${verificationMethod.id}, while the holder of the presentation is '${expectedSigner}'`\n\n  return { isValid: false, error: new CredoError(description) }\n}\n\n/**\n * A DID document can name any controller for its keys, so only the DID of the document that lists\n * the verification method is accepted.\n */\nexport function assertControlledByDid(verificationMethod: { id: string; controller?: unknown }, did: string) {\n  if (verificationMethod.controller !== did) {\n    throw new CredoError(\n      `Verification method '${verificationMethod.id}' is controlled by '${verificationMethod.controller}', not by the DID document '${did}' it is listed in`\n    )\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAsBA,eAAsB,cACpB,cACA,sBACA,SACyB;CACzB,MAAM,cAAc,MAAM,aAAa,kBAAkB,QAAQ,OAAO,CAAC,CAAC,mBAAmB,oBAAoB;CAEjH,MAAM,qBAAqB,YAAY,eAAe,sBAAsB,OAAO;CACnF,sBAAsB,oBAAoB,YAAY,EAAE;CAExD,OAAO;EAAE;EAAoB,QAAQ,YAAY;CAAG;AACtD;;;;;AAMA,eAAsB,iBACpB,cACA,EAAE,KAAK,KAAK,KAAK,WACQ;CACzB,IAAI;CAEJ,IAAI,KAAK,WAAW,GAAG,GAAG;EACxB,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,GACpB,MAAM,IAAI,WAAW,0DAA0D;EAGjF,WAAW,MAAM,cAAc,cAAc,GAAG,MAAM,OAAO,OAAO;CACtE,OAAO,IAAI,OAAO,MAAM,GAAG,GACzB,WAAW,MAAM,cAAc,cAAc,KAAK,OAAO;MACpD;EACL,IAAI,CAAC,KACH,MAAM,IAAI,WAAW,iEAAiE;EAGxF,MAAM,WAAW,UAAU,6CAA6C,GAAG;EAC3E,MAAM,cAAc,MAAM,aAAa,kBAAkB,QAAQ,OAAO,CAAC,CAAC,mBAAmB,GAAG;EAChG,MAAM,sBAAsB,YAAY,wCACtC,gDAAgD,QAAQ,GACxD,OACF;EAEA,IAAI,oBAAoB,WAAW,GACjC,MAAM,IAAI,WACR,GAAG,oBAAoB,WAAW,IAAI,OAAO,WAAW,0CAA0C,IAAI,kBAAkB,SAAS,KAAK,aAAa,IAAI,oEACzJ;EAGF,sBAAsB,oBAAoB,IAAI,YAAY,EAAE;EAC5D,WAAW;GAAE,oBAAoB,oBAAoB;GAAI,QAAQ,YAAY;EAAG;CAClF;CAEA,IAAI,OAAO,SAAS,WAAW,KAC7B,MAAM,IAAI,WAAW,qBAAqB,SAAS,OAAO,uBAAuB,IAAI,EAAE;CAGzF,OAAO;AACT;;;;;AAMA,SAAgB,8BACd,EAAE,oBAAoB,UACtB,gBACA,MACwB;CACxB,IAAI,CAAC,kBAAkB,WAAW,gBAAgB,OAAO,EAAE,SAAS,KAAK;CAEzE,MAAM,cACJ,SAAS,WACL,kDAAkD,mBAAmB,GAAG,2CAA2C,eAAe,KAClI,oDAAoD,mBAAmB,GAAG,6CAA6C,eAAe;CAE5I,OAAO;EAAE,SAAS;EAAO,OAAO,IAAI,WAAW,WAAW;CAAE;AAC9D;;;;;AAMA,SAAgB,sBAAsB,oBAA0D,KAAa;CAC3G,IAAI,mBAAmB,eAAe,KACpC,MAAM,IAAI,WACR,wBAAwB,mBAAmB,GAAG,sBAAsB,mBAAmB,WAAW,8BAA8B,IAAI,kBACtI;AAEJ"}

package/build/modules/vc/sd-jwt-vc/W3cV2SdJwtCredentialService.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"W3cV2SdJwtCredentialService.d.mts","names":[],"sources":["../../../../src/modules/vc/sd-jwt-vc/W3cV2SdJwtCredentialService.ts"],"mappings":";;;;;;;;;;;;;;;;;qBAwDa;;;;EAIE,eACX,cAAc,cACd,SAAS,kCACR,QAAQ;;;;;;;EA+CE,iBACX,cAAc,cACd,SAAS,oCACR,QAAQ;;;;;;;EAsIE,iBACX,cAAc,cACd,SAAS,oCACR,QAAQ;;;;;;;EA4CE,mBACX,cAAc,cACd,SAAS,sCACR,QAAQ;EA+HE,QACX,cAAc,cACd,SAAS,6BACR,QAAQ;;;;EAeJ,2BACL,wBACA,kBAAkB,aACjB;EAKI,yBAAyB,wBAAwB,gBAAgB,cAAc;UAK9E;UAIA;UASA;UAoCA"}
+{"version":3,"file":"W3cV2SdJwtCredentialService.d.mts","names":[],"sources":["../../../../src/modules/vc/sd-jwt-vc/W3cV2SdJwtCredentialService.ts"],"mappings":";;;;;;;;;;;;;;;;;qBAyDa;;;;EAIE,eACX,cAAc,cACd,SAAS,kCACR,QAAQ;;;;;;;EAiDE,iBACX,cAAc,cACd,SAAS,oCACR,QAAQ;;;;;;;EAkIE,iBACX,cAAc,cACd,SAAS,oCACR,QAAQ;;;;;;;EA4CE,mBACX,cAAc,cACd,SAAS,sCACR,QAAQ;EAiHE,QACX,cAAc,cACd,SAAS,6BACR,QAAQ;;;;EAeJ,2BACL,wBACA,kBAAkB,aACjB;EAKI,yBAAyB,wBAAwB,gBAAgB,cAAc;UAK9E;UAIA;UASA;UAoCA"}

package/build/modules/vc/sd-jwt-vc/W3cV2SdJwtCredentialService.mjs

@@ -14,12 +14,13 @@ import "../../kms/index.mjs";
 import { getPublicJwkFromVerificationMethod } from "../../dids/domain/key-type/keyDidMapping.mjs";
 import { TrustedIssuerContext } from "../../../agent/TrustedIssuerContext.mjs";
 import { validateVc2ContextBaseline, validateVc2CredentialStatus, validateVc2CredentialValidityPeriod } from "../validators.mjs";
+import { validateSignerIsExpectedParty } from "../resolveSigner.mjs";
 import "../../../crypto/index.mjs";
 import { extractKeyFromHolderBinding, getSdJwtHashingAlgorithm, getSdJwtSigner, getSdJwtVerifier, parseHolderBindingFromCredential, setJwkAlgFromJwtHeader } from "../../sd-jwt-vc/utils.mjs";
 import { sdJwtVcHasher } from "./W3cV2SdJwt.mjs";
 import { W3cV2SdJwtVerifiableCredential } from "./W3cV2SdJwtVerifiableCredential.mjs";
 import { W3cV2SdJwtVerifiablePresentation } from "./W3cV2SdJwtVerifiablePresentation.mjs";
-import { extractHolderFromPresentationCredentials, getVerificationMethodForJwt, validateAndResolveVerificationMethod } from "../v2-jwt-utils.mjs";
+import { extractHolderFromPresentationCredentials, getSignerForJwt, validateAndResolveVerificationMethod } from "../v2-jwt-utils.mjs";
 import { validateW3cV2SdJwtDisclosureFrame } from "./disclosureFrame.mjs";
 import { applyDisclosuresForPaths, applyDisclosuresForPayload } from "../../sd-jwt-vc/disclosureFrame.mjs";
 import { SDJwtInstance } from "@sd-jwt/core";
@@ -32,7 +33,7 @@ let W3cV2SdJwtCredentialService = class W3cV2SdJwtCredentialService {
 		MessageValidator.validateSync(options.credential);
 		const payload = JsonTransformer.toJSON(options.credential);
 		payload.iat = nowInSeconds();
-		payload.cnf = options.holder ? (await extractKeyFromHolderBinding(agentContext, options.holder)).cnf : void 0;
+		payload.cnf = options.holder ? (await extractKeyFromHolderBinding(agentContext, options.holder, { didPurposes: ["authentication"] })).cnf : void 0;
 		const publicJwk = await validateAndResolveVerificationMethod(agentContext, options.verificationMethod, ["assertionMethod"]);
 		const disclosureFrame = options.disclosureFrame;
 		this.validateDisclosureFrame(disclosureFrame);
@@ -88,9 +89,10 @@ let W3cV2SdJwtCredentialService = class W3cV2SdJwtCredentialService {
 				};
 				return validationResults;
 			}
-			const issuerVerificationMethod = await getVerificationMethodForJwt(agentContext, credential, ["assertionMethod"]);
+			const issuer = await getSignerForJwt(agentContext, credential, ["assertionMethod"]);
+			const issuerVerificationMethod = issuer.verificationMethod;
 			const issuerPublicKey = getPublicJwkFromVerificationMethod(issuerVerificationMethod);
-			await TrustedIssuerContext.ensureTrustedSigner(agentContext, {
+			await TrustedIssuerContext.ensureTrustedCredentialSigner(agentContext, {
 				signer: {
 					method: "did",
 					didUrl: issuerVerificationMethod.id
@@ -101,7 +103,7 @@ let W3cV2SdJwtCredentialService = class W3cV2SdJwtCredentialService {
 				}
 			}, options.trustedIssuers);
 			const holderBinding = parseHolderBindingFromCredential(credential.sdJwt.prettyClaims);
-			const holder = holderBinding ? await extractKeyFromHolderBinding(agentContext, holderBinding) : void 0;
+			const holder = holderBinding ? await extractKeyFromHolderBinding(agentContext, holderBinding, { didPurposes: ["authentication"] }) : void 0;
 			setJwkAlgFromJwtHeader(issuerPublicKey, credential.sdJwt.header.alg);
 			if (holder && credential.sdJwt.kbJwt) setJwkAlgFromJwtHeader(holder.publicJwk, credential.sdJwt.kbJwt.header?.alg);
 			sdJwt.config({
@@ -109,7 +111,11 @@ let W3cV2SdJwtCredentialService = class W3cV2SdJwtCredentialService {
 				kbVerifier: holder ? getSdJwtVerifier(agentContext, holder.publicJwk) : void 0
 			});
 			try {
-				await sdJwt.verify(credential.encoded, { skewSeconds: agentContext.config.validitySkewSeconds });
+				await sdJwt.verify(credential.encoded, {
+					skewSeconds: agentContext.config.validitySkewSeconds,
+					keyBindingNonce: options.keyBinding?.nonce,
+					expectedKeyBindingAudience: options.keyBinding?.audience
+				});
 				validationResults.validations.signature = { isValid: true };
 			} catch (error) {
 				validationResults.validations.signature = {
@@ -117,11 +123,7 @@ let W3cV2SdJwtCredentialService = class W3cV2SdJwtCredentialService {
 					error
 				};
 			}
-			if (credential.resolvedCredential.issuerId !== issuerVerificationMethod.controller) validationResults.validations.issuerIsSigner = {
-				isValid: false,
-				error: new CredoError(`Credential is signed using verification method ${issuerVerificationMethod.id}, while the issuer of the credential is '${credential.resolvedCredential.issuerId}'`)
-			};
-			else validationResults.validations.issuerIsSigner = { isValid: true };
+			validationResults.validations.issuerIsSigner = validateSignerIsExpectedParty(issuer, credential.resolvedCredential.issuerId, "issuer");
 			validationResults.isValid = Object.values(validationResults.validations).every((validation) => validation?.isValid === true);
 			return validationResults;
 		} catch (error) {
@@ -193,8 +195,8 @@ let W3cV2SdJwtCredentialService = class W3cV2SdJwtCredentialService {
 				};
 				return validationResults;
 			}
-			const proverVerificationMethod = await getVerificationMethodForJwt(agentContext, presentation, ["authentication"]);
-			const proverPublicKey = getPublicJwkFromVerificationMethod(proverVerificationMethod);
+			const prover = await getSignerForJwt(agentContext, presentation, ["authentication"]);
+			const proverPublicKey = getPublicJwkFromVerificationMethod(prover.verificationMethod);
 			const holderBinding = parseHolderBindingFromCredential(presentation.sdJwt.prettyClaims);
 			const holder = holderBinding ? await extractKeyFromHolderBinding(agentContext, holderBinding) : void 0;
 			setJwkAlgFromJwtHeader(proverPublicKey, presentation.sdJwt.header.alg);
@@ -212,11 +214,7 @@ let W3cV2SdJwtCredentialService = class W3cV2SdJwtCredentialService {
 					error
 				};
 			}
-			if (presentation.resolvedPresentation.holderId && proverVerificationMethod.controller !== presentation.resolvedPresentation.holderId) validationResults.presentation.validations.holderIsSigner = {
-				isValid: false,
-				error: new CredoError(`Presentation is signed using verification method ${proverVerificationMethod.id}, while the holder of the presentation is '${presentation.resolvedPresentation.holderId}'`)
-			};
-			else validationResults.presentation.validations.holderIsSigner = { isValid: true };
+			validationResults.presentation.validations.holderIsSigner = validateSignerIsExpectedParty(prover, presentation.resolvedPresentation.holderId, "holder");
 			validationResults.presentation.isValid = Object.values(validationResults.presentation.validations).every((validation) => validation.isValid);
 			validationResults.isValid = validationResults.presentation.isValid;
 			return validationResults;