@credo-ts/core 0.7.3 → 0.7.4

package/build/modules/kms/jwk/knownJwk.d.mts

@@ -49,8 +49,8 @@ export declare const zKmsJwkPublicAsymmetric: z$1.ZodDiscriminatedUnion<[z$1.Zod
 }, z$1.core.$strip>, z$1.ZodObject<{
   kty: z$1.ZodLiteral<"OKP">;
   crv: z$1.ZodEnum<{
-    Ed25519: "Ed25519";
     X25519: "X25519";
+    Ed25519: "Ed25519";
   }>;
   x: z$1.ZodString;
   d: z$1.ZodOptional<z$1.ZodString>;
@@ -122,8 +122,8 @@ export declare const zKmsJwkPublic: z$1.ZodDiscriminatedUnion<[z$1.ZodObject<{
 }, z$1.core.$strip>, z$1.ZodObject<{
   kty: z$1.ZodLiteral<"OKP">;
   crv: z$1.ZodEnum<{
-    Ed25519: "Ed25519";
     X25519: "X25519";
+    Ed25519: "Ed25519";
   }>;
   x: z$1.ZodString;
   d: z$1.ZodOptional<z$1.ZodString>;
@@ -198,8 +198,8 @@ export declare const zKmsJwkPrivate: z$1.ZodDiscriminatedUnion<[z$1.ZodObject<{
   d: z$1.ZodString;
   kty: z$1.ZodLiteral<"OKP">;
   crv: z$1.ZodEnum<{
-    Ed25519: "Ed25519";
     X25519: "X25519";
+    Ed25519: "Ed25519";
   }>;
   x: z$1.ZodString;
   kid: z$1.ZodOptional<z$1.ZodString>;
@@ -261,8 +261,8 @@ export declare const zKmsJwkPrivateAsymmetric: z$1.ZodDiscriminatedUnion<[z$1.Zo
   d: z$1.ZodString;
   kty: z$1.ZodLiteral<"OKP">;
   crv: z$1.ZodEnum<{
-    Ed25519: "Ed25519";
     X25519: "X25519";
+    Ed25519: "Ed25519";
   }>;
   x: z$1.ZodString;
   kid: z$1.ZodOptional<z$1.ZodString>;

package/build/modules/kms/jwk/kty/ec/P256PublicJwk.d.mts

@@ -11,7 +11,7 @@ export declare class P256PublicJwk implements PublicJwkType<Jwk> {
   static supportedEncryptionKeyAgreementAlgorithms: "ECDH-ES"[];
   static multicodecPrefix: number;
   supportedEncryptionKeyAgreementAlgorithms: "ECDH-ES"[];
-  supportedSignatureAlgorithms: ("HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "PS256" | "PS384" | "PS512" | "EdDSA" | "Ed25519" | "ES256K")[];
+  supportedSignatureAlgorithms: ("Ed25519" | "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "PS256" | "PS384" | "PS512" | "EdDSA" | "ES256K")[];
   multicodecPrefix: number;
   constructor(jwk: Jwk);
   get publicKey(): {

package/build/modules/kms/jwk/kty/ec/P384PublicJwk.d.mts

@@ -11,7 +11,7 @@ export declare class P384PublicJwk implements PublicJwkType<Jwk> {
   static supportedEncryptionKeyAgreementAlgorithms: "ECDH-ES"[];
   static multicodecPrefix: number;
   supportedEncryptionKeyAgreementAlgorithms: "ECDH-ES"[];
-  supportedSignatureAlgorithms: ("HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "PS256" | "PS384" | "PS512" | "EdDSA" | "Ed25519" | "ES256K")[];
+  supportedSignatureAlgorithms: ("Ed25519" | "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "PS256" | "PS384" | "PS512" | "EdDSA" | "ES256K")[];
   multicodecPrefix: number;
   constructor(jwk: Jwk);
   get publicKey(): {

package/build/modules/kms/jwk/kty/ec/P521PublicJwk.d.mts

@@ -11,7 +11,7 @@ export declare class P521PublicJwk implements PublicJwkType<Jwk> {
   static supportedEncryptionKeyAgreementAlgorithms: "ECDH-ES"[];
   static multicodecPrefix: number;
   supportedEncryptionKeyAgreementAlgorithms: "ECDH-ES"[];
-  supportedSignatureAlgorithms: ("HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "PS256" | "PS384" | "PS512" | "EdDSA" | "Ed25519" | "ES256K")[];
+  supportedSignatureAlgorithms: ("Ed25519" | "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "PS256" | "PS384" | "PS512" | "EdDSA" | "ES256K")[];
   multicodecPrefix: number;
   constructor(jwk: Jwk);
   get publicKey(): {

package/build/modules/kms/jwk/kty/ec/Secp256k1PublicJwk.d.mts

@@ -11,7 +11,7 @@ export declare class Secp256k1PublicJwk implements PublicJwkType<Jwk> {
   static supportedEncryptionKeyAgreementAlgorithms: "ECDH-ES"[];
   static multicodecPrefix: number;
   supportedEncryptionKeyAgreementAlgorithms: "ECDH-ES"[];
-  supportedSignatureAlgorithms: ("HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "PS256" | "PS384" | "PS512" | "EdDSA" | "Ed25519" | "ES256K")[];
+  supportedSignatureAlgorithms: ("Ed25519" | "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "PS256" | "PS384" | "PS512" | "EdDSA" | "ES256K")[];
   multicodecPrefix: number;
   constructor(jwk: Jwk);
   get publicKey(): {

package/build/modules/kms/jwk/kty/okp/Ed25519PublicJwk.d.mts

@@ -11,7 +11,7 @@ export declare class Ed25519PublicJwk implements PublicJwkType<Jwk> {
   static supportedEncryptionKeyAgreementAlgorithms: KnownJwaKeyAgreementAlgorithm[];
   static multicodecPrefix: number;
   supportedEncryptionKeyAgreementAlgorithms: ("ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A192KW" | "ECDH-ES+A256KW" | "ECDH-HSALSA20" | "HPKE-0" | "HPKE-3" | "HPKE-7")[];
-  supportedSignatureAlgorithms: ("HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "PS256" | "PS384" | "PS512" | "EdDSA" | "Ed25519" | "ES256K")[];
+  supportedSignatureAlgorithms: ("Ed25519" | "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "PS256" | "PS384" | "PS512" | "EdDSA" | "ES256K")[];
   multicodecPrefix: number;
   constructor(jwk: Jwk);
   get publicKey(): {
@@ -28,7 +28,7 @@ export declare class Ed25519PublicJwk implements PublicJwkType<Jwk> {
   static fromMulticodec(multicodec: Uint8Array): Ed25519PublicJwk;
   toX25519PublicJwk(): {
     kty: "OKP";
-    crv: "Ed25519" | "X25519";
+    crv: "X25519" | "Ed25519";
     x: string;
     d?: string | undefined;
     kid?: string | undefined;

package/build/modules/kms/jwk/kty/okp/X25519PublicJwk.d.mts

@@ -11,7 +11,7 @@ export declare class X25519PublicJwk implements PublicJwkType<Jwk> {
   static supportedSignatureAlgorithms: KnownJwaSignatureAlgorithm[];
   static multicodecPrefix: number;
   supportedEncryptionKeyAgreementAlgorithms: "ECDH-HSALSA20"[];
-  supportedSignatureAlgorithms: ("HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "PS256" | "PS384" | "PS512" | "EdDSA" | "Ed25519" | "ES256K")[];
+  supportedSignatureAlgorithms: ("Ed25519" | "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "PS256" | "PS384" | "PS512" | "EdDSA" | "ES256K")[];
   multicodecPrefix: number;
   constructor(jwk: Jwk);
   get publicKey(): {

package/build/modules/kms/jwk/kty/okp/okpJwk.d.mts

@@ -3,8 +3,8 @@ import { z as z$1 } from "zod";
 export declare const zKmsJwkPublicOkp: z$1.ZodObject<{
   kty: z$1.ZodLiteral<"OKP">;
   crv: z$1.ZodEnum<{
-    Ed25519: "Ed25519";
     X25519: "X25519";
+    Ed25519: "Ed25519";
   }>;
   x: z$1.ZodString;
   d: z$1.ZodOptional<z$1.ZodString>;
@@ -23,8 +23,8 @@ export declare const zKmsJwkPrivateOkp: z$1.ZodObject<{
   d: z$1.ZodString;
   kty: z$1.ZodLiteral<"OKP">;
   crv: z$1.ZodEnum<{
-    Ed25519: "Ed25519";
     X25519: "X25519";
+    Ed25519: "Ed25519";
   }>;
   x: z$1.ZodString;
   kid: z$1.ZodOptional<z$1.ZodString>;

package/build/modules/kms/options/KmsCreateKeyOptions.d.mts

@@ -19,8 +19,8 @@ export type KmsCreateKeyTypeEc = z$1.output<typeof zKmsCreateKeyTypeEc>;
 declare const zKmsCreateKeyTypeOkp: z$1.ZodObject<{
   kty: z$1.ZodLiteral<"OKP">;
   crv: z$1.ZodEnum<{
-    Ed25519: "Ed25519";
     X25519: "X25519";
+    Ed25519: "Ed25519";
   }>;
 }, z$1.core.$strip>;
 export type KmsCreateKeyTypeOkp = z$1.output<typeof zKmsCreateKeyTypeOkp>;
@@ -59,8 +59,8 @@ export declare const zKmsCreateKeyTypeAsymmetric: z$1.ZodUnion<readonly [z$1.Zod
 }, z$1.core.$strip>, z$1.ZodObject<{
   kty: z$1.ZodLiteral<"OKP">;
   crv: z$1.ZodEnum<{
-    Ed25519: "Ed25519";
     X25519: "X25519";
+    Ed25519: "Ed25519";
   }>;
 }, z$1.core.$strip>, z$1.ZodObject<{
   kty: z$1.ZodLiteral<"RSA">;
@@ -78,8 +78,8 @@ export declare const zKmsCreateKeyType: z$1.ZodUnion<readonly [z$1.ZodObject<{
 }, z$1.core.$strip>, z$1.ZodObject<{
   kty: z$1.ZodLiteral<"OKP">;
   crv: z$1.ZodEnum<{
-    Ed25519: "Ed25519";
     X25519: "X25519";
+    Ed25519: "Ed25519";
   }>;
 }, z$1.core.$strip>, z$1.ZodObject<{
   kty: z$1.ZodLiteral<"RSA">;

package/build/modules/kms/options/KmsSignOptions.d.mts

@@ -3,6 +3,7 @@ import { z as z$1 } from "zod";
 export declare const zKmsSignOptions: z$1.ZodObject<{
   keyId: z$1.ZodString;
   algorithm: z$1.ZodEnum<{
+    Ed25519: "Ed25519";
     HS256: "HS256";
     HS384: "HS384";
     HS512: "HS512";
@@ -16,7 +17,6 @@ export declare const zKmsSignOptions: z$1.ZodObject<{
     PS384: "PS384";
     PS512: "PS512";
     EdDSA: "EdDSA";
-    Ed25519: "Ed25519";
     ES256K: "ES256K";
   }>;
   data: z$1.ZodInstanceOf<Uint8Array<ArrayBufferLike>>;

package/build/modules/kms/options/KmsVerifyOptions.d.mts

@@ -49,8 +49,8 @@ export declare const zKmsVerifyOptions: z$1.ZodObject<{
     }, z$1.core.$strip>, z$1.ZodObject<{
       kty: z$1.ZodLiteral<"OKP">;
       crv: z$1.ZodEnum<{
-        Ed25519: "Ed25519";
         X25519: "X25519";
+        Ed25519: "Ed25519";
       }>;
       x: z$1.ZodString;
       d: z$1.ZodOptional<z$1.ZodString>;
@@ -67,6 +67,7 @@ export declare const zKmsVerifyOptions: z$1.ZodObject<{
     keyId: z$1.ZodOptional<z$1.ZodNever>;
   }, z$1.core.$strip>]>;
   algorithm: z$1.ZodEnum<{
+    Ed25519: "Ed25519";
     HS256: "HS256";
     HS384: "HS384";
     HS512: "HS512";
@@ -80,7 +81,6 @@ export declare const zKmsVerifyOptions: z$1.ZodObject<{
     PS384: "PS384";
     PS512: "PS512";
     EdDSA: "EdDSA";
-    Ed25519: "Ed25519";
     ES256K: "ES256K";
   }>;
   data: z$1.ZodInstanceOf<Uint8Array<ArrayBufferLike>>;

package/build/modules/mdoc/repository/MdocRecord.d.mts

@@ -58,7 +58,7 @@ export declare class MdocRecord extends BaseRecord<DefaultMdocRecordTags> {
   static fromMdoc(mdoc: Mdoc): MdocRecord;
   getTags(): {
     docType: string;
-    alg: "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "PS256" | "PS384" | "PS512" | "EdDSA" | "Ed25519" | "ES256K";
+    alg: "Ed25519" | "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "PS256" | "PS384" | "PS512" | "EdDSA" | "ES256K";
     multiInstanceState: CredentialMultiInstanceState;
   };
   clone(): this;

package/build/modules/sd-jwt-vc/repository/SdJwtVcRecord.d.mts

@@ -89,7 +89,7 @@ export declare class SdJwtVcRecord extends BaseRecord<DefaultSdJwtVcRecordTags>
     vct: string;
     extendedVctValues: string[];
     sdAlg: string;
-    alg: "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "PS256" | "PS384" | "PS512" | "EdDSA" | "Ed25519" | "ES256K";
+    alg: "Ed25519" | "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "PS256" | "PS384" | "PS512" | "EdDSA" | "ES256K";
     multiInstanceState: CredentialMultiInstanceState;
   };
   clone(): this;

package/build/modules/sd-jwt-vc/utils.mjs

@@ -19,20 +19,20 @@ async function resolveSigningPublicJwkFromDidUrl(agentContext, didUrl) {
 	const { publicJwk } = await agentContext.dependencyManager.resolve(DidsApi).resolveVerificationMethodFromCreatedDidRecord(didUrl);
 	return publicJwk;
 }
-async function resolveDidUrl(agentContext, didUrl) {
+async function resolveDidUrl(agentContext, didUrl, purposes = ["assertionMethod"]) {
 	const didDocument = await agentContext.dependencyManager.resolve(DidResolverService).resolveDidDocument(agentContext, didUrl);
 	return {
-		verificationMethod: didDocument.dereferenceKey(didUrl, ["assertionMethod"]),
+		verificationMethod: didDocument.dereferenceKey(didUrl, purposes),
 		didDocument
 	};
 }
-async function extractKeyFromHolderBinding(agentContext, holder, { forSigning = false, jwkKeyId } = {}) {
+async function extractKeyFromHolderBinding(agentContext, holder, { forSigning = false, jwkKeyId, didPurposes } = {}) {
 	if (holder.method === "did") {
 		if (!parseDid(holder.didUrl).fragment) throw new CredoError(`didUrl '${holder.didUrl}' does not contain a '#'. Unable to derive key from did document`);
 		let publicJwk;
 		if (forSigning) publicJwk = await resolveSigningPublicJwkFromDidUrl(agentContext, holder.didUrl);
 		else {
-			const { verificationMethod } = await resolveDidUrl(agentContext, holder.didUrl);
+			const { verificationMethod } = await resolveDidUrl(agentContext, holder.didUrl, didPurposes);
 			publicJwk = getPublicJwkFromVerificationMethod(verificationMethod);
 		}
 		const supportedSignatureAlgorithms = publicJwk.supportedSignatureAlgorithms;

package/build/modules/sd-jwt-vc/utils.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"utils.mjs","names":[],"sources":["../../../src/modules/sd-jwt-vc/utils.ts"],"sourcesContent":["import type { Signer, Verifier } from '@sd-jwt/core'\nimport { AgentContext } from '../../agent'\nimport type { HashName } from '../../crypto'\nimport { CredoError } from '../../error'\nimport { TypedArrayEncoder } from '../../utils'\nimport { DidResolverService, DidsApi, getPublicJwkFromVerificationMethod, parseDid } from '../dids'\nimport { isKnownJwaSignatureAlgorithm, type Jwk, KeyManagementApi, PublicJwk } from '../kms'\nimport { X509Certificate } from '../x509/X509Certificate'\nimport { SdJwtVcError } from './SdJwtVcError'\nimport type { SdJwtVcHolderBinding, SdJwtVcIssuer } from './SdJwtVcOptions'\n\nexport async function resolveSigningPublicJwkFromDidUrl(agentContext: AgentContext, didUrl: string) {\n  const dids = agentContext.dependencyManager.resolve(DidsApi)\n\n  const { publicJwk } = await dids.resolveVerificationMethodFromCreatedDidRecord(didUrl)\n  return publicJwk\n}\n\nexport async function resolveDidUrl(agentContext: AgentContext, didUrl: string) {\n  const didResolver = agentContext.dependencyManager.resolve(DidResolverService)\n  const didDocument = await didResolver.resolveDidDocument(agentContext, didUrl)\n\n  return {\n    verificationMethod: didDocument.dereferenceKey(didUrl, ['assertionMethod']),\n    didDocument,\n  }\n}\n\nexport async function extractKeyFromHolderBinding(\n  agentContext: AgentContext,\n  holder: SdJwtVcHolderBinding,\n  { forSigning = false, jwkKeyId }: { forSigning?: boolean; jwkKeyId?: string } = {}\n) {\n  if (holder.method === 'did') {\n    const parsedDid = parseDid(holder.didUrl)\n    if (!parsedDid.fragment) {\n      throw new CredoError(`didUrl '${holder.didUrl}' does not contain a '#'. Unable to derive key from did document`)\n    }\n\n    let publicJwk: PublicJwk\n    if (forSigning) {\n      publicJwk = await resolveSigningPublicJwkFromDidUrl(agentContext, holder.didUrl)\n    } else {\n      const { verificationMethod } = await resolveDidUrl(agentContext, holder.didUrl)\n      publicJwk = getPublicJwkFromVerificationMethod(verificationMethod)\n    }\n\n    const supportedSignatureAlgorithms = publicJwk.supportedSignatureAlgorithms\n    if (supportedSignatureAlgorithms.length === 0) {\n      throw new CredoError(`No supported JWA signature algorithms found for key ${publicJwk.jwkTypeHumanDescription}`)\n    }\n    const alg = supportedSignatureAlgorithms[0]\n\n    return {\n      alg,\n      publicJwk,\n      cnf: {\n        // We need to include the whole didUrl here, otherwise the verifier\n        // won't know which did it is associated with\n        kid: holder.didUrl,\n      },\n    }\n  }\n  if (holder.method === 'jwk') {\n    const publicJwk = holder.jwk\n    const alg = publicJwk.supportedSignatureAlgorithms[0]\n\n    if (forSigning) {\n      publicJwk.keyId = jwkKeyId ?? publicJwk.legacyKeyId\n    }\n\n    return {\n      alg,\n      publicJwk,\n      cnf: {\n        jwk: publicJwk.toJson(),\n      },\n    }\n  }\n\n  throw new CredoError(\"Unsupported credential holder binding. Only 'did' and 'jwk' are supported at the moment.\")\n}\n\n/**\n * Set the `alg` from a JWT header on the public jwk, so signing and verification use the\n * algorithm of the JWT rather than the first supported signature algorithm of the key.\n *\n * Throws an error if the alg is not a known JWA signature algorithm, or if the alg is not\n * supported by the jwk.\n */\nexport function setJwkAlgFromJwtHeader(publicJwk: PublicJwk, jwtHeaderAlg: unknown) {\n  if (typeof jwtHeaderAlg !== 'string' || !isKnownJwaSignatureAlgorithm(jwtHeaderAlg)) {\n    throw new CredoError(`Expected JWT header 'alg' to be a known JWA signature algorithm, found '${jwtHeaderAlg}'`)\n  }\n\n  publicJwk.alg = jwtHeaderAlg\n}\n\n/**\n * Hashing algorithms that can be used for the disclosure digests of an SD-JWT, and are placed\n * in the `_sd_alg` claim.\n *\n * `sha-1` is omitted, as SD-JWT requires a hash algorithm that is considered secure at the\n * time of issuance.\n *\n * @see https://www.ietf.org/archive/id/draft-ietf-oauth-selective-disclosure-jwt-22.html#name-hash-function-claim\n */\nexport const sdJwtHashingAlgorithms: Array<Exclude<HashName, 'sha-1'>> = ['sha-256', 'sha-384', 'sha-512']\n\n/**\n * Get the hashing algorithm to use for the disclosure digests of an SD-JWT, defaulting to `sha-256`.\n *\n * The sign options already exclude insecure hashing algorithms on a type level, but this is\n * enforced at runtime as well, as the value can originate from JavaScript callers or dynamic input.\n */\nexport function getSdJwtHashingAlgorithm(hashingAlgorithm?: HashName): Exclude<HashName, 'sha-1'> {\n  const hashAlg = hashingAlgorithm ?? 'sha-256'\n\n  if (!sdJwtHashingAlgorithms.includes(hashAlg as Exclude<HashName, 'sha-1'>)) {\n    throw new CredoError(\n      `Unsupported hashing algorithm '${hashAlg}' for the disclosure digests of an SD-JWT. Supported hashing algorithms are ${sdJwtHashingAlgorithms.join(', ')}`\n    )\n  }\n\n  return hashAlg as Exclude<HashName, 'sha-1'>\n}\n\nexport function getSdJwtSigner(agentContext: AgentContext, key: PublicJwk): Signer {\n  const kms = agentContext.resolve(KeyManagementApi)\n\n  return async (input: string) => {\n    const result = await kms.sign({\n      keyId: key.keyId,\n      data: TypedArrayEncoder.fromUtf8String(input),\n      algorithm: key.signatureAlgorithm,\n    })\n\n    return TypedArrayEncoder.toBase64Url(result.signature)\n  }\n}\n\nexport function getSdJwtVerifier(agentContext: AgentContext, key: PublicJwk): Verifier {\n  const kms = agentContext.resolve(KeyManagementApi)\n\n  return async (message: string, signatureBase64Url: string) => {\n    const result = await kms.verify({\n      signature: TypedArrayEncoder.fromBase64Url(signatureBase64Url),\n      key: {\n        publicJwk: key.toJson(),\n      },\n      data: TypedArrayEncoder.fromUtf8String(message),\n      algorithm: key.signatureAlgorithm,\n    })\n\n    return result.verified\n  }\n}\n\nexport interface CnfPayload {\n  jwk?: Jwk\n  kid?: string\n}\n\nexport function parseHolderBindingFromCredential(payload?: Record<string, unknown>): SdJwtVcHolderBinding | null {\n  if (!payload) {\n    throw new CredoError('Unable to extract payload from SD-JWT VC')\n  }\n\n  if (!payload.cnf) {\n    return null\n  }\n  const cnf: CnfPayload = payload.cnf\n\n  if (cnf.jwk) {\n    return {\n      method: 'jwk',\n      jwk: PublicJwk.fromUnknown(cnf.jwk),\n    }\n  }\n  if (cnf.kid) {\n    if (!cnf.kid.startsWith('did:') || !cnf.kid.includes('#')) {\n      throw new CredoError('Invalid holder kid for did. Only absolute KIDs for cnf are supported')\n    }\n    return {\n      method: 'did',\n      didUrl: cnf.kid,\n    }\n  }\n\n  throw new CredoError(\"Unsupported credential holder binding. Only 'did' and 'jwk' are supported at the moment.\")\n}\n\nexport function parseIssuerFromCredential(\n  header?: Record<string, unknown>,\n  payload?: Record<string, unknown>\n): SdJwtVcIssuer {\n  if (!payload || !header) throw new SdJwtVcError('SD-JWT is missing payload')\n  const iss = payload.iss as string | undefined\n\n  if (header?.x5c) {\n    if (!Array.isArray(header.x5c)) {\n      throw new SdJwtVcError('Invalid x5c header in credential. Not an array.')\n    }\n    if (header.x5c.length === 0) {\n      throw new SdJwtVcError('Invalid x5c header in credential. Empty array.')\n    }\n    if (header.x5c.some((x5c) => typeof x5c !== 'string')) {\n      throw new SdJwtVcError('Invalid x5c header in credential. Not an array of strings.')\n    }\n\n    const certificateChain = header.x5c.map((cert) => X509Certificate.fromEncodedCertificate(cert))\n\n    return {\n      method: 'x5c',\n      x5c: certificateChain,\n      issuer: iss,\n    }\n  }\n\n  if (iss?.startsWith('did:')) {\n    // If `did` is used, we require a relative KID to be present to identify\n    // the key used by issuer to sign the sd-jwt-vc\n    if (!header.kid) {\n      throw new SdJwtVcError('Credential does not contain a kid in the header')\n    }\n\n    const issuerKid = header.kid as string\n\n    let didUrl: string\n    if (issuerKid.startsWith('#')) {\n      didUrl = `${iss}${issuerKid}`\n    } else if (issuerKid.startsWith('did:')) {\n      const didFromKid = parseDid(issuerKid)\n      if (didFromKid.did !== iss) {\n        throw new SdJwtVcError(\n          `kid in header is an absolute DID URL, but the did (${didFromKid.did}) does not match with the 'iss' did (${iss})`\n        )\n      }\n\n      didUrl = issuerKid\n    } else {\n      throw new SdJwtVcError(\n        'Invalid issuer kid for did. Only absolute or relative (starting with #) did urls are supported.'\n      )\n    }\n\n    return {\n      method: 'did',\n      didUrl,\n    }\n  }\n\n  throw new SdJwtVcError('Unsupported signing method for SD-JWT VC. Only did and x5c are supported at the moment.')\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAWA,eAAsB,kCAAkC,cAA4B,QAAgB;CAGlG,MAAM,EAAE,cAAc,MAFT,aAAa,kBAAkB,QAAQ,OAErB,CAAC,CAAC,8CAA8C,MAAM;CACrF,OAAO;AACT;AAEA,eAAsB,cAAc,cAA4B,QAAgB;CAE9E,MAAM,cAAc,MADA,aAAa,kBAAkB,QAAQ,kBACvB,CAAC,CAAC,mBAAmB,cAAc,MAAM;CAE7E,OAAO;EACL,oBAAoB,YAAY,eAAe,QAAQ,CAAC,iBAAiB,CAAC;EAC1E;CACF;AACF;AAEA,eAAsB,4BACpB,cACA,QACA,EAAE,aAAa,OAAO,aAA0D,CAAC,GACjF;CACA,IAAI,OAAO,WAAW,OAAO;EAE3B,IAAI,CADc,SAAS,OAAO,MACrB,CAAC,CAAC,UACb,MAAM,IAAI,WAAW,WAAW,OAAO,OAAO,iEAAiE;EAGjH,IAAI;EACJ,IAAI,YACF,YAAY,MAAM,kCAAkC,cAAc,OAAO,MAAM;OAC1E;GACL,MAAM,EAAE,uBAAuB,MAAM,cAAc,cAAc,OAAO,MAAM;GAC9E,YAAY,mCAAmC,kBAAkB;EACnE;EAEA,MAAM,+BAA+B,UAAU;EAC/C,IAAI,6BAA6B,WAAW,GAC1C,MAAM,IAAI,WAAW,uDAAuD,UAAU,yBAAyB;EAIjH,OAAO;GACL,KAHU,6BAA6B;GAIvC;GACA,KAAK,EAGH,KAAK,OAAO,OACd;EACF;CACF;CACA,IAAI,OAAO,WAAW,OAAO;EAC3B,MAAM,YAAY,OAAO;EACzB,MAAM,MAAM,UAAU,6BAA6B;EAEnD,IAAI,YACF,UAAU,QAAQ,YAAY,UAAU;EAG1C,OAAO;GACL;GACA;GACA,KAAK,EACH,KAAK,UAAU,OAAO,EACxB;EACF;CACF;CAEA,MAAM,IAAI,WAAW,0FAA0F;AACjH;;;;;;;;AASA,SAAgB,uBAAuB,WAAsB,cAAuB;CAClF,IAAI,OAAO,iBAAiB,YAAY,CAAC,6BAA6B,YAAY,GAChF,MAAM,IAAI,WAAW,2EAA2E,aAAa,EAAE;CAGjH,UAAU,MAAM;AAClB;;;;;;;;;;AAWA,MAAa,yBAA4D;CAAC;CAAW;CAAW;AAAS;;;;;;;AAQzG,SAAgB,yBAAyB,kBAAyD;CAChG,MAAM,UAAU,oBAAoB;CAEpC,IAAI,CAAC,uBAAuB,SAAS,OAAqC,GACxE,MAAM,IAAI,WACR,kCAAkC,QAAQ,8EAA8E,uBAAuB,KAAK,IAAI,GAC1J;CAGF,OAAO;AACT;AAEA,SAAgB,eAAe,cAA4B,KAAwB;CACjF,MAAM,MAAM,aAAa,QAAQ,gBAAgB;CAEjD,OAAO,OAAO,UAAkB;EAC9B,MAAM,SAAS,MAAM,IAAI,KAAK;GAC5B,OAAO,IAAI;GACX,MAAM,kBAAkB,eAAe,KAAK;GAC5C,WAAW,IAAI;EACjB,CAAC;EAED,OAAO,kBAAkB,YAAY,OAAO,SAAS;CACvD;AACF;AAEA,SAAgB,iBAAiB,cAA4B,KAA0B;CACrF,MAAM,MAAM,aAAa,QAAQ,gBAAgB;CAEjD,OAAO,OAAO,SAAiB,uBAA+B;EAU5D,QAAO,MATc,IAAI,OAAO;GAC9B,WAAW,kBAAkB,cAAc,kBAAkB;GAC7D,KAAK,EACH,WAAW,IAAI,OAAO,EACxB;GACA,MAAM,kBAAkB,eAAe,OAAO;GAC9C,WAAW,IAAI;EACjB,CAAC,EAAA,CAEa;CAChB;AACF;AAOA,SAAgB,iCAAiC,SAAgE;CAC/G,IAAI,CAAC,SACH,MAAM,IAAI,WAAW,0CAA0C;CAGjE,IAAI,CAAC,QAAQ,KACX,OAAO;CAET,MAAM,MAAkB,QAAQ;CAEhC,IAAI,IAAI,KACN,OAAO;EACL,QAAQ;EACR,KAAK,UAAU,YAAY,IAAI,GAAG;CACpC;CAEF,IAAI,IAAI,KAAK;EACX,IAAI,CAAC,IAAI,IAAI,WAAW,MAAM,KAAK,CAAC,IAAI,IAAI,SAAS,GAAG,GACtD,MAAM,IAAI,WAAW,sEAAsE;EAE7F,OAAO;GACL,QAAQ;GACR,QAAQ,IAAI;EACd;CACF;CAEA,MAAM,IAAI,WAAW,0FAA0F;AACjH;AAEA,SAAgB,0BACd,QACA,SACe;CACf,IAAI,CAAC,WAAW,CAAC,QAAQ,MAAM,IAAI,aAAa,2BAA2B;CAC3E,MAAM,MAAM,QAAQ;CAEpB,IAAI,QAAQ,KAAK;EACf,IAAI,CAAC,MAAM,QAAQ,OAAO,GAAG,GAC3B,MAAM,IAAI,aAAa,iDAAiD;EAE1E,IAAI,OAAO,IAAI,WAAW,GACxB,MAAM,IAAI,aAAa,gDAAgD;EAEzE,IAAI,OAAO,IAAI,MAAM,QAAQ,OAAO,QAAQ,QAAQ,GAClD,MAAM,IAAI,aAAa,4DAA4D;EAKrF,OAAO;GACL,QAAQ;GACR,KAJuB,OAAO,IAAI,KAAK,SAAS,gBAAgB,uBAAuB,IAAI,CAIvE;GACpB,QAAQ;EACV;CACF;CAEA,IAAI,KAAK,WAAW,MAAM,GAAG;EAG3B,IAAI,CAAC,OAAO,KACV,MAAM,IAAI,aAAa,iDAAiD;EAG1E,MAAM,YAAY,OAAO;EAEzB,IAAI;EACJ,IAAI,UAAU,WAAW,GAAG,GAC1B,SAAS,GAAG,MAAM;OACb,IAAI,UAAU,WAAW,MAAM,GAAG;GACvC,MAAM,aAAa,SAAS,SAAS;GACrC,IAAI,WAAW,QAAQ,KACrB,MAAM,IAAI,aACR,sDAAsD,WAAW,IAAI,uCAAuC,IAAI,EAClH;GAGF,SAAS;EACX,OACE,MAAM,IAAI,aACR,iGACF;EAGF,OAAO;GACL,QAAQ;GACR;EACF;CACF;CAEA,MAAM,IAAI,aAAa,yFAAyF;AAClH"}
+{"version":3,"file":"utils.mjs","names":[],"sources":["../../../src/modules/sd-jwt-vc/utils.ts"],"sourcesContent":["import type { Signer, Verifier } from '@sd-jwt/core'\nimport { AgentContext } from '../../agent'\nimport type { HashName } from '../../crypto'\nimport { CredoError } from '../../error'\nimport { TypedArrayEncoder } from '../../utils'\nimport { type DidPurpose, DidResolverService, DidsApi, getPublicJwkFromVerificationMethod, parseDid } from '../dids'\nimport { isKnownJwaSignatureAlgorithm, type Jwk, KeyManagementApi, PublicJwk } from '../kms'\nimport { X509Certificate } from '../x509/X509Certificate'\nimport { SdJwtVcError } from './SdJwtVcError'\nimport type { SdJwtVcHolderBinding, SdJwtVcIssuer } from './SdJwtVcOptions'\n\nexport async function resolveSigningPublicJwkFromDidUrl(agentContext: AgentContext, didUrl: string) {\n  const dids = agentContext.dependencyManager.resolve(DidsApi)\n\n  const { publicJwk } = await dids.resolveVerificationMethodFromCreatedDidRecord(didUrl)\n  return publicJwk\n}\n\nexport async function resolveDidUrl(\n  agentContext: AgentContext,\n  didUrl: string,\n  purposes: DidPurpose[] = ['assertionMethod']\n) {\n  const didResolver = agentContext.dependencyManager.resolve(DidResolverService)\n  const didDocument = await didResolver.resolveDidDocument(agentContext, didUrl)\n\n  return {\n    verificationMethod: didDocument.dereferenceKey(didUrl, purposes),\n    didDocument,\n  }\n}\n\nexport async function extractKeyFromHolderBinding(\n  agentContext: AgentContext,\n  holder: SdJwtVcHolderBinding,\n  {\n    forSigning = false,\n    jwkKeyId,\n    didPurposes,\n  }: { forSigning?: boolean; jwkKeyId?: string; didPurposes?: DidPurpose[] } = {}\n) {\n  if (holder.method === 'did') {\n    const parsedDid = parseDid(holder.didUrl)\n    if (!parsedDid.fragment) {\n      throw new CredoError(`didUrl '${holder.didUrl}' does not contain a '#'. Unable to derive key from did document`)\n    }\n\n    let publicJwk: PublicJwk\n    if (forSigning) {\n      publicJwk = await resolveSigningPublicJwkFromDidUrl(agentContext, holder.didUrl)\n    } else {\n      const { verificationMethod } = await resolveDidUrl(agentContext, holder.didUrl, didPurposes)\n      publicJwk = getPublicJwkFromVerificationMethod(verificationMethod)\n    }\n\n    const supportedSignatureAlgorithms = publicJwk.supportedSignatureAlgorithms\n    if (supportedSignatureAlgorithms.length === 0) {\n      throw new CredoError(`No supported JWA signature algorithms found for key ${publicJwk.jwkTypeHumanDescription}`)\n    }\n    const alg = supportedSignatureAlgorithms[0]\n\n    return {\n      alg,\n      publicJwk,\n      cnf: {\n        // We need to include the whole didUrl here, otherwise the verifier\n        // won't know which did it is associated with\n        kid: holder.didUrl,\n      },\n    }\n  }\n  if (holder.method === 'jwk') {\n    const publicJwk = holder.jwk\n    const alg = publicJwk.supportedSignatureAlgorithms[0]\n\n    if (forSigning) {\n      publicJwk.keyId = jwkKeyId ?? publicJwk.legacyKeyId\n    }\n\n    return {\n      alg,\n      publicJwk,\n      cnf: {\n        jwk: publicJwk.toJson(),\n      },\n    }\n  }\n\n  throw new CredoError(\"Unsupported credential holder binding. Only 'did' and 'jwk' are supported at the moment.\")\n}\n\n/**\n * Set the `alg` from a JWT header on the public jwk, so signing and verification use the\n * algorithm of the JWT rather than the first supported signature algorithm of the key.\n *\n * Throws an error if the alg is not a known JWA signature algorithm, or if the alg is not\n * supported by the jwk.\n */\nexport function setJwkAlgFromJwtHeader(publicJwk: PublicJwk, jwtHeaderAlg: unknown) {\n  if (typeof jwtHeaderAlg !== 'string' || !isKnownJwaSignatureAlgorithm(jwtHeaderAlg)) {\n    throw new CredoError(`Expected JWT header 'alg' to be a known JWA signature algorithm, found '${jwtHeaderAlg}'`)\n  }\n\n  publicJwk.alg = jwtHeaderAlg\n}\n\n/**\n * Hashing algorithms that can be used for the disclosure digests of an SD-JWT, and are placed\n * in the `_sd_alg` claim.\n *\n * `sha-1` is omitted, as SD-JWT requires a hash algorithm that is considered secure at the\n * time of issuance.\n *\n * @see https://www.ietf.org/archive/id/draft-ietf-oauth-selective-disclosure-jwt-22.html#name-hash-function-claim\n */\nexport const sdJwtHashingAlgorithms: Array<Exclude<HashName, 'sha-1'>> = ['sha-256', 'sha-384', 'sha-512']\n\n/**\n * Get the hashing algorithm to use for the disclosure digests of an SD-JWT, defaulting to `sha-256`.\n *\n * The sign options already exclude insecure hashing algorithms on a type level, but this is\n * enforced at runtime as well, as the value can originate from JavaScript callers or dynamic input.\n */\nexport function getSdJwtHashingAlgorithm(hashingAlgorithm?: HashName): Exclude<HashName, 'sha-1'> {\n  const hashAlg = hashingAlgorithm ?? 'sha-256'\n\n  if (!sdJwtHashingAlgorithms.includes(hashAlg as Exclude<HashName, 'sha-1'>)) {\n    throw new CredoError(\n      `Unsupported hashing algorithm '${hashAlg}' for the disclosure digests of an SD-JWT. Supported hashing algorithms are ${sdJwtHashingAlgorithms.join(', ')}`\n    )\n  }\n\n  return hashAlg as Exclude<HashName, 'sha-1'>\n}\n\nexport function getSdJwtSigner(agentContext: AgentContext, key: PublicJwk): Signer {\n  const kms = agentContext.resolve(KeyManagementApi)\n\n  return async (input: string) => {\n    const result = await kms.sign({\n      keyId: key.keyId,\n      data: TypedArrayEncoder.fromUtf8String(input),\n      algorithm: key.signatureAlgorithm,\n    })\n\n    return TypedArrayEncoder.toBase64Url(result.signature)\n  }\n}\n\nexport function getSdJwtVerifier(agentContext: AgentContext, key: PublicJwk): Verifier {\n  const kms = agentContext.resolve(KeyManagementApi)\n\n  return async (message: string, signatureBase64Url: string) => {\n    const result = await kms.verify({\n      signature: TypedArrayEncoder.fromBase64Url(signatureBase64Url),\n      key: {\n        publicJwk: key.toJson(),\n      },\n      data: TypedArrayEncoder.fromUtf8String(message),\n      algorithm: key.signatureAlgorithm,\n    })\n\n    return result.verified\n  }\n}\n\nexport interface CnfPayload {\n  jwk?: Jwk\n  kid?: string\n}\n\nexport function parseHolderBindingFromCredential(payload?: Record<string, unknown>): SdJwtVcHolderBinding | null {\n  if (!payload) {\n    throw new CredoError('Unable to extract payload from SD-JWT VC')\n  }\n\n  if (!payload.cnf) {\n    return null\n  }\n  const cnf: CnfPayload = payload.cnf\n\n  if (cnf.jwk) {\n    return {\n      method: 'jwk',\n      jwk: PublicJwk.fromUnknown(cnf.jwk),\n    }\n  }\n  if (cnf.kid) {\n    if (!cnf.kid.startsWith('did:') || !cnf.kid.includes('#')) {\n      throw new CredoError('Invalid holder kid for did. Only absolute KIDs for cnf are supported')\n    }\n    return {\n      method: 'did',\n      didUrl: cnf.kid,\n    }\n  }\n\n  throw new CredoError(\"Unsupported credential holder binding. Only 'did' and 'jwk' are supported at the moment.\")\n}\n\nexport function parseIssuerFromCredential(\n  header?: Record<string, unknown>,\n  payload?: Record<string, unknown>\n): SdJwtVcIssuer {\n  if (!payload || !header) throw new SdJwtVcError('SD-JWT is missing payload')\n  const iss = payload.iss as string | undefined\n\n  if (header?.x5c) {\n    if (!Array.isArray(header.x5c)) {\n      throw new SdJwtVcError('Invalid x5c header in credential. Not an array.')\n    }\n    if (header.x5c.length === 0) {\n      throw new SdJwtVcError('Invalid x5c header in credential. Empty array.')\n    }\n    if (header.x5c.some((x5c) => typeof x5c !== 'string')) {\n      throw new SdJwtVcError('Invalid x5c header in credential. Not an array of strings.')\n    }\n\n    const certificateChain = header.x5c.map((cert) => X509Certificate.fromEncodedCertificate(cert))\n\n    return {\n      method: 'x5c',\n      x5c: certificateChain,\n      issuer: iss,\n    }\n  }\n\n  if (iss?.startsWith('did:')) {\n    // If `did` is used, we require a relative KID to be present to identify\n    // the key used by issuer to sign the sd-jwt-vc\n    if (!header.kid) {\n      throw new SdJwtVcError('Credential does not contain a kid in the header')\n    }\n\n    const issuerKid = header.kid as string\n\n    let didUrl: string\n    if (issuerKid.startsWith('#')) {\n      didUrl = `${iss}${issuerKid}`\n    } else if (issuerKid.startsWith('did:')) {\n      const didFromKid = parseDid(issuerKid)\n      if (didFromKid.did !== iss) {\n        throw new SdJwtVcError(\n          `kid in header is an absolute DID URL, but the did (${didFromKid.did}) does not match with the 'iss' did (${iss})`\n        )\n      }\n\n      didUrl = issuerKid\n    } else {\n      throw new SdJwtVcError(\n        'Invalid issuer kid for did. Only absolute or relative (starting with #) did urls are supported.'\n      )\n    }\n\n    return {\n      method: 'did',\n      didUrl,\n    }\n  }\n\n  throw new SdJwtVcError('Unsupported signing method for SD-JWT VC. Only did and x5c are supported at the moment.')\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAWA,eAAsB,kCAAkC,cAA4B,QAAgB;CAGlG,MAAM,EAAE,cAAc,MAFT,aAAa,kBAAkB,QAAQ,OAErB,CAAC,CAAC,8CAA8C,MAAM;CACrF,OAAO;AACT;AAEA,eAAsB,cACpB,cACA,QACA,WAAyB,CAAC,iBAAiB,GAC3C;CAEA,MAAM,cAAc,MADA,aAAa,kBAAkB,QAAQ,kBACvB,CAAC,CAAC,mBAAmB,cAAc,MAAM;CAE7E,OAAO;EACL,oBAAoB,YAAY,eAAe,QAAQ,QAAQ;EAC/D;CACF;AACF;AAEA,eAAsB,4BACpB,cACA,QACA,EACE,aAAa,OACb,UACA,gBAC2E,CAAC,GAC9E;CACA,IAAI,OAAO,WAAW,OAAO;EAE3B,IAAI,CADc,SAAS,OAAO,MACrB,CAAC,CAAC,UACb,MAAM,IAAI,WAAW,WAAW,OAAO,OAAO,iEAAiE;EAGjH,IAAI;EACJ,IAAI,YACF,YAAY,MAAM,kCAAkC,cAAc,OAAO,MAAM;OAC1E;GACL,MAAM,EAAE,uBAAuB,MAAM,cAAc,cAAc,OAAO,QAAQ,WAAW;GAC3F,YAAY,mCAAmC,kBAAkB;EACnE;EAEA,MAAM,+BAA+B,UAAU;EAC/C,IAAI,6BAA6B,WAAW,GAC1C,MAAM,IAAI,WAAW,uDAAuD,UAAU,yBAAyB;EAIjH,OAAO;GACL,KAHU,6BAA6B;GAIvC;GACA,KAAK,EAGH,KAAK,OAAO,OACd;EACF;CACF;CACA,IAAI,OAAO,WAAW,OAAO;EAC3B,MAAM,YAAY,OAAO;EACzB,MAAM,MAAM,UAAU,6BAA6B;EAEnD,IAAI,YACF,UAAU,QAAQ,YAAY,UAAU;EAG1C,OAAO;GACL;GACA;GACA,KAAK,EACH,KAAK,UAAU,OAAO,EACxB;EACF;CACF;CAEA,MAAM,IAAI,WAAW,0FAA0F;AACjH;;;;;;;;AASA,SAAgB,uBAAuB,WAAsB,cAAuB;CAClF,IAAI,OAAO,iBAAiB,YAAY,CAAC,6BAA6B,YAAY,GAChF,MAAM,IAAI,WAAW,2EAA2E,aAAa,EAAE;CAGjH,UAAU,MAAM;AAClB;;;;;;;;;;AAWA,MAAa,yBAA4D;CAAC;CAAW;CAAW;AAAS;;;;;;;AAQzG,SAAgB,yBAAyB,kBAAyD;CAChG,MAAM,UAAU,oBAAoB;CAEpC,IAAI,CAAC,uBAAuB,SAAS,OAAqC,GACxE,MAAM,IAAI,WACR,kCAAkC,QAAQ,8EAA8E,uBAAuB,KAAK,IAAI,GAC1J;CAGF,OAAO;AACT;AAEA,SAAgB,eAAe,cAA4B,KAAwB;CACjF,MAAM,MAAM,aAAa,QAAQ,gBAAgB;CAEjD,OAAO,OAAO,UAAkB;EAC9B,MAAM,SAAS,MAAM,IAAI,KAAK;GAC5B,OAAO,IAAI;GACX,MAAM,kBAAkB,eAAe,KAAK;GAC5C,WAAW,IAAI;EACjB,CAAC;EAED,OAAO,kBAAkB,YAAY,OAAO,SAAS;CACvD;AACF;AAEA,SAAgB,iBAAiB,cAA4B,KAA0B;CACrF,MAAM,MAAM,aAAa,QAAQ,gBAAgB;CAEjD,OAAO,OAAO,SAAiB,uBAA+B;EAU5D,QAAO,MATc,IAAI,OAAO;GAC9B,WAAW,kBAAkB,cAAc,kBAAkB;GAC7D,KAAK,EACH,WAAW,IAAI,OAAO,EACxB;GACA,MAAM,kBAAkB,eAAe,OAAO;GAC9C,WAAW,IAAI;EACjB,CAAC,EAAA,CAEa;CAChB;AACF;AAOA,SAAgB,iCAAiC,SAAgE;CAC/G,IAAI,CAAC,SACH,MAAM,IAAI,WAAW,0CAA0C;CAGjE,IAAI,CAAC,QAAQ,KACX,OAAO;CAET,MAAM,MAAkB,QAAQ;CAEhC,IAAI,IAAI,KACN,OAAO;EACL,QAAQ;EACR,KAAK,UAAU,YAAY,IAAI,GAAG;CACpC;CAEF,IAAI,IAAI,KAAK;EACX,IAAI,CAAC,IAAI,IAAI,WAAW,MAAM,KAAK,CAAC,IAAI,IAAI,SAAS,GAAG,GACtD,MAAM,IAAI,WAAW,sEAAsE;EAE7F,OAAO;GACL,QAAQ;GACR,QAAQ,IAAI;EACd;CACF;CAEA,MAAM,IAAI,WAAW,0FAA0F;AACjH;AAEA,SAAgB,0BACd,QACA,SACe;CACf,IAAI,CAAC,WAAW,CAAC,QAAQ,MAAM,IAAI,aAAa,2BAA2B;CAC3E,MAAM,MAAM,QAAQ;CAEpB,IAAI,QAAQ,KAAK;EACf,IAAI,CAAC,MAAM,QAAQ,OAAO,GAAG,GAC3B,MAAM,IAAI,aAAa,iDAAiD;EAE1E,IAAI,OAAO,IAAI,WAAW,GACxB,MAAM,IAAI,aAAa,gDAAgD;EAEzE,IAAI,OAAO,IAAI,MAAM,QAAQ,OAAO,QAAQ,QAAQ,GAClD,MAAM,IAAI,aAAa,4DAA4D;EAKrF,OAAO;GACL,QAAQ;GACR,KAJuB,OAAO,IAAI,KAAK,SAAS,gBAAgB,uBAAuB,IAAI,CAIvE;GACpB,QAAQ;EACV;CACF;CAEA,IAAI,KAAK,WAAW,MAAM,GAAG;EAG3B,IAAI,CAAC,OAAO,KACV,MAAM,IAAI,aAAa,iDAAiD;EAG1E,MAAM,YAAY,OAAO;EAEzB,IAAI;EACJ,IAAI,UAAU,WAAW,GAAG,GAC1B,SAAS,GAAG,MAAM;OACb,IAAI,UAAU,WAAW,MAAM,GAAG;GACvC,MAAM,aAAa,SAAS,SAAS;GACrC,IAAI,WAAW,QAAQ,KACrB,MAAM,IAAI,aACR,sDAAsD,WAAW,IAAI,uCAAuC,IAAI,EAClH;GAGF,SAAS;EACX,OACE,MAAM,IAAI,aACR,iGACF;EAGF,OAAO;GACL,QAAQ;GACR;EACF;CACF;CAEA,MAAM,IAAI,aAAa,yFAAyF;AAClH"}

package/build/modules/vc/W3cCredentialServiceOptions.d.mts

@@ -13,7 +13,7 @@ import { ProofPurpose } from "./linked-data-proofs/proof-purposes/ProofPurpose.m
 import "./linked-data-proofs/index.mjs";
 import { W3cCredentialRecord } from "./repository/W3cCredentialRecord.mjs";
 import "./repository/index.mjs";
-import { TrustedIssuerDid } from "../../agent/TrustedIssuersForVerification.mjs";
+import { GetTrustedIssuersForCredential, TrustedIssuerDid } from "../../agent/TrustedIssuersForVerification.mjs";
 import "../kms/index.mjs";
 //#region src/modules/vc/W3cCredentialServiceOptions.d.ts
 export type W3cSignCredentialOptions<Format extends ClaimFormat.JwtVc | ClaimFormat.LdpVc | undefined = undefined> = Format extends ClaimFormat.JwtVc ? W3cJwtSignCredentialOptions : Format extends ClaimFormat.LdpVc ? W3cJsonLdSignCredentialOptions : W3cJwtSignCredentialOptions | W3cJsonLdSignCredentialOptions;
@@ -69,9 +69,9 @@ interface W3cVerifyCredentialOptionsBase {
    */
   verifyCredentialStatus?: boolean;
   /**
-   * Trusted issuers for the verification.
+   * Trusted issuers for the verification, or a callback that resolves them for each credential.
    */
-  trustedIssuers?: TrustedIssuerDid[];
+  trustedIssuers?: TrustedIssuerDid[] | GetTrustedIssuersForCredential;
 }
 export interface W3cJwtVerifyCredentialOptions extends W3cVerifyCredentialOptionsBase {
   credential: W3cJwtVerifiableCredential | string;
@@ -148,9 +148,9 @@ interface W3cVerifyPresentationOptionsBase {
    */
   verifyCredentialStatus?: boolean;
   /**
-   * Trusted issuers for the verification.
+   * Trusted issuers for the verification, or a callback that resolves them for each credential.
    */
-  trustedIssuers?: TrustedIssuerDid[];
+  trustedIssuers?: TrustedIssuerDid[] | GetTrustedIssuersForCredential;
 }
 export interface W3cJwtVerifyPresentationOptions extends W3cVerifyPresentationOptionsBase {
   presentation: W3cJwtVerifiablePresentation | string;

package/build/modules/vc/W3cCredentialServiceOptions.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"W3cCredentialServiceOptions.d.mts","names":[],"sources":["../../../src/modules/vc/W3cCredentialServiceOptions.ts"],"mappings":";;;;;;;;;;;;;;;;;;YAWY,yBAAyB,eAAe,YAAY,QAAQ,YAAY,iCAClF,eAAe,YAAY,QACvB,8BACA,eAAe,YAAY,QACzB,iCACA,8BAA8B;YAC1B,2BAA2B,eAAe,YAAY,QAAQ,YAAY,iCACpF,eAAe,YAAY,QACvB,gCACA,eAAe,YAAY,QACzB,mCACA,gCAAgC;YAC5B,2BAA2B,eAAe,YAAY,QAAQ,YAAY,iCACpF,eAAe,YAAY,QACvB,gCACA,eAAe,YAAY,QACzB,mCACA,gCAAgC;YAC5B,+BAA+B,kCAAkC;UAEnE;;;;;;EAMR,QAAQ;;;;EAKR,YAAY;;;;;;EAOZ;;iBAGe,oCAAoC;EACnD,QAAQ,YAAY;;;;;;EAOpB,KAAK;;iBAGU,uCAAuC;;;;;EAKtD,QAAQ,YAAY;;;;;;EAOpB;EAEA,eAAe;EACf;;UAGQ;EACR;;;;EAKA;;;;EAKA,iBAAiB;;iBAGF,sCAAsC;EACrD,YAAY;;iBAGG,yCAAyC;EACxD,YAAY;EACZ,eAAe;;iBAGA;EACf,aAAa,cAAc;EAC3B;EACA;;UAGQ;;;;;;EAMR,QAAQ;;;;EAKR,cAAc;;;;;;EAOd;;;;EAKA;;;;EAKA;;iBAGe,yCAAyC;EACxD,QAAQ,YAAY;;;;;;EAOpB;EAEA,cAAc;;iBAGC,sCAAsC;EACrD,QAAQ,YAAY;;;;;;EAOpB,KAAK;;UAGG;;;;EAIR;;;;EAKA;;;;EAKA;;;;EAKA;;;;EAKA,iBAAiB;;iBAGF,wCAAwC;EACvD,cAAc;;iBAGC,2CAA2C;EAC1D,cAAc;EACd,UAAU;;YAGA;EACV,QAAQ"}
+{"version":3,"file":"W3cCredentialServiceOptions.d.mts","names":[],"sources":["../../../src/modules/vc/W3cCredentialServiceOptions.ts"],"mappings":";;;;;;;;;;;;;;;;;;YAWY,yBAAyB,eAAe,YAAY,QAAQ,YAAY,iCAClF,eAAe,YAAY,QACvB,8BACA,eAAe,YAAY,QACzB,iCACA,8BAA8B;YAC1B,2BAA2B,eAAe,YAAY,QAAQ,YAAY,iCACpF,eAAe,YAAY,QACvB,gCACA,eAAe,YAAY,QACzB,mCACA,gCAAgC;YAC5B,2BAA2B,eAAe,YAAY,QAAQ,YAAY,iCACpF,eAAe,YAAY,QACvB,gCACA,eAAe,YAAY,QACzB,mCACA,gCAAgC;YAC5B,+BAA+B,kCAAkC;UAEnE;;;;;;EAMR,QAAQ;;;;EAKR,YAAY;;;;;;EAOZ;;iBAGe,oCAAoC;EACnD,QAAQ,YAAY;;;;;;EAOpB,KAAK;;iBAGU,uCAAuC;;;;;EAKtD,QAAQ,YAAY;;;;;;EAOpB;EAEA,eAAe;EACf;;UAGQ;EACR;;;;EAKA;;;;EAKA,iBAAiB,qBAAqB;;iBAGvB,sCAAsC;EACrD,YAAY;;iBAGG,yCAAyC;EACxD,YAAY;EACZ,eAAe;;iBAGA;EACf,aAAa,cAAc;EAC3B;EACA;;UAGQ;;;;;;EAMR,QAAQ;;;;EAKR,cAAc;;;;;;EAOd;;;;EAKA;;;;EAKA;;iBAGe,yCAAyC;EACxD,QAAQ,YAAY;;;;;;EAOpB;EAEA,cAAc;;iBAGC,sCAAsC;EACrD,QAAQ,YAAY;;;;;;EAOpB,KAAK;;UAGG;;;;EAIR;;;;EAKA;;;;EAKA;;;;EAKA;;;;EAKA,iBAAiB,qBAAqB;;iBAGvB,wCAAwC;EACvD,cAAc;;iBAGC,2CAA2C;EAC1D,cAAc;EACd,UAAU;;YAGA;EACV,QAAQ"}

package/build/modules/vc/W3cV2CredentialService.d.mts

@@ -71,11 +71,15 @@ export declare class W3cV2CredentialService {
    */
   verifyPresentation(agentContext: AgentContext, options: W3cV2VerifyPresentationOptions): Promise<W3cV2VerifyPresentationResult>;
   private verifyPresentationEntry;
+  /**
+   * A credential bound to a key with `cnf` must be presented with that key.
+   */
+  private verifyHolderBinding;
   private extractCredentialEntriesFromPresentation;
   private extractCredentialEntriesFromResolvedPresentation;
   private createInvalidCredentialEntryResult;
   private getClaimFormat;
-  private mergeCredentialSubjectAuthenticationValidation;
+  private mergeHolderValidations;
   /**
    * Writes a credential to storage
    *

package/build/modules/vc/W3cV2CredentialService.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"W3cV2CredentialService.d.mts","names":[],"sources":["../../../src/modules/vc/W3cV2CredentialService.ts"],"mappings":";;;;;;;;;;;;;;;;;;qBAsDa;UACH;UACA;UACA;UACA;EAGN,YAAA,2BAA2B,2BAC3B,6BAA6B,6BAC7B,2BAA2B,2BAC3B,qCAAqC;;;;;;;EAc1B,eAAe,eAAe,YAAY,WAAW,YAAY,aAAa,YAAY,MACrG,cAAc,cACd,SAAS,2BAA2B,UACnC,QAAQ,0BAA0B;;;;EAsBxB,iBACX,cAAc,cACd,SAAS,+BACR,QAAQ;;;;;;;EAoCE,iBAAiB,eAAe,YAAY,WAAW,YAAY,aAAa,YAAY,MACvG,cAAc,cACd,SAAS,6BAA6B,UACrC,QAAQ,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgD1B,mBACX,cAAc,cACd,SAAS,iCACR,QAAQ;UAwHG;UAuEN;UASA;UAMA;UAQA;UAOA;;;;;;;EAmCK,gBACX,cAAc,cACd,SAAS,8BACR,QAAQ;EAOE,uBAAuB,cAAc,cAAc,aAAU;EAI7D,wBAAwB,cAAc,eAAe,QAAQ;EAI7D,wBAAwB,cAAc,cAAc,aAAa,QAAQ;EAIzE,uBACX,cAAc,cACd,OAAO,MAAM,wBACb,eAAe,eACd,QAAQ;EAKE,4BACX,cAAc,cACd,OAAO,MAAM,yBACZ,QAAQ"}
+{"version":3,"file":"W3cV2CredentialService.d.mts","names":[],"sources":["../../../src/modules/vc/W3cV2CredentialService.ts"],"mappings":";;;;;;;;;;;;;;;;;;qBA2Da;UACH;UACA;UACA;UACA;EAGN,YAAA,2BAA2B,2BAC3B,6BAA6B,6BAC7B,2BAA2B,2BAC3B,qCAAqC;;;;;;;EAc1B,eAAe,eAAe,YAAY,WAAW,YAAY,aAAa,YAAY,MACrG,cAAc,cACd,SAAS,2BAA2B,UACnC,QAAQ,0BAA0B;;;;EAsBxB,iBACX,cAAc,cACd,SAAS,+BACR,QAAQ;;;;;;;EAoCE,iBAAiB,eAAe,YAAY,WAAW,YAAY,aAAa,YAAY,MACvG,cAAc,cACd,SAAS,6BAA6B,UACrC,QAAQ,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgD1B,mBACX,cAAc,cACd,SAAS,iCACR,QAAQ;UAkHG;;;;UA4FA;UA0BN;UASA;UAMA;UAQA;UAOA;;;;;;;EAuCK,gBACX,cAAc,cACd,SAAS,8BACR,QAAQ;EAOE,uBAAuB,cAAc,cAAc,aAAU;EAI7D,wBAAwB,cAAc,eAAe,QAAQ;EAI7D,wBAAwB,cAAc,cAAc,aAAa,QAAQ;EAIzE,uBACX,cAAc,cACd,OAAO,MAAM,wBACb,eAAe,eACd,QAAQ;EAKE,4BACX,cAAc,cACd,OAAO,MAAM,yBACZ,QAAQ"}

package/build/modules/vc/W3cV2CredentialService.mjs

@@ -4,7 +4,11 @@ import { asArray } from "../../utils/array.mjs";
 import { injectable } from "../../plugins/index.mjs";
 import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/decorateMetadata.mjs";
 import __decorate from "../../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/decorate.mjs";
+import { getPublicJwkFromVerificationMethod } from "../dids/domain/key-type/keyDidMapping.mjs";
+import "../dids/index.mjs";
 import "./models/ClaimFormat.mjs";
+import "./resolveSigner.mjs";
+import { extractKeyFromHolderBinding, parseHolderBindingFromCredential } from "../sd-jwt-vc/utils.mjs";
 import { W3cV2JwtVerifiableCredential } from "./jwt-vc/W3cV2JwtVerifiableCredential.mjs";
 import { W3cV2DataIntegrityVerifiableCredential } from "./data-integrity/W3cV2DataIntegrityVerifiableCredential.mjs";
 import { W3cV2DataIntegrityVerifiablePresentation } from "./data-integrity/W3cV2DataIntegrityVerifiablePresentation.mjs";
@@ -13,10 +17,10 @@ import { W3cV2EnvelopedVerifiableCredential } from "./models/credential/W3cV2Env
 import { W3cV2EnvelopedVerifiablePresentation } from "./models/presentation/W3cV2EnvelopedVerifiablePresentation.mjs";
 import { W3cV2JwtVerifiablePresentation } from "./jwt-vc/W3cV2JwtVerifiablePresentation.mjs";
 import { W3cV2SdJwtVerifiablePresentation } from "./sd-jwt-vc/W3cV2SdJwtVerifiablePresentation.mjs";
-import { getVerificationMethodForJwt } from "./v2-jwt-utils.mjs";
+import { getSignerForJwt } from "./v2-jwt-utils.mjs";
 import { W3cV2JwtCredentialService } from "./jwt-vc/W3cV2JwtCredentialService.mjs";
 import "./jwt-vc/index.mjs";
-import { getSignerForDataIntegrityProof } from "./data-integrity/v2-di-utils.mjs";
+import { resolveDataIntegritySigner } from "./data-integrity/v2-di-utils.mjs";
 import { W3cV2DataIntegrityCredentialService } from "./data-integrity/W3cV2DataIntegrityCredentialService.mjs";
 import "./data-integrity/index.mjs";
 import { W3cV2SdJwtCredentialService } from "./sd-jwt-vc/W3cV2SdJwtCredentialService.mjs";
@@ -117,7 +121,7 @@ let W3cV2CredentialService = class W3cV2CredentialService {
 			credentialEntries: []
 		};
 		let entries = [];
-		let signerId;
+		let signer;
 		if (presentation instanceof W3cV2JwtVerifiablePresentation) {
 			const presentationResult = await this.w3cV2JwtCredentialService.verifyPresentation(agentContext, {
 				...options,
@@ -126,12 +130,11 @@ let W3cV2CredentialService = class W3cV2CredentialService {
 			validationResults.presentation = presentationResult.presentation;
 			if (!presentationResult.presentation.isValid) {
 				validationResults.isValid = false;
+				validationResults.error = presentationResult.error;
 				return validationResults;
 			}
-			const holderId = presentation.resolvedPresentation.holderId;
-			if (holderId) signerId = holderId;
-			else try {
-				signerId = (await getVerificationMethodForJwt(agentContext, presentation, ["authentication"])).controller;
+			try {
+				signer = await getSignerForJwt(agentContext, presentation, ["authentication"]);
 			} catch (error) {
 				validationResults.isValid = false;
 				validationResults.error = error;
@@ -146,12 +149,11 @@ let W3cV2CredentialService = class W3cV2CredentialService {
 			validationResults.presentation = presentationResult.presentation;
 			if (!presentationResult.presentation.isValid) {
 				validationResults.isValid = false;
+				validationResults.error = presentationResult.error;
 				return validationResults;
 			}
-			const holderId = presentation.resolvedPresentation.holderId;
-			if (holderId) signerId = holderId;
-			else try {
-				signerId = (await getVerificationMethodForJwt(agentContext, presentation, ["authentication"])).controller;
+			try {
+				signer = await getSignerForJwt(agentContext, presentation, ["authentication"]);
 			} catch (error) {
 				validationResults.isValid = false;
 				validationResults.error = error;
@@ -166,11 +168,11 @@ let W3cV2CredentialService = class W3cV2CredentialService {
 			validationResults.presentation = presentationResult.presentation;
 			if (!presentationResult.presentation.isValid) {
 				validationResults.isValid = false;
+				validationResults.error = presentationResult.error;
 				return validationResults;
 			}
-			signerId = presentation.resolvedPresentation.holderId;
-			if (!signerId) try {
-				signerId = await getSignerForDataIntegrityProof(agentContext, presentation.securedPresentation, "authentication");
+			try {
+				signer = await resolveDataIntegritySigner(agentContext, presentation.securedPresentation, "authentication", presentation.resolvedPresentation.holderId);
 			} catch (error) {
 				validationResults.isValid = false;
 				validationResults.error = error;
@@ -178,24 +180,67 @@ let W3cV2CredentialService = class W3cV2CredentialService {
 			}
 			entries = this.extractCredentialEntriesFromPresentation(presentation);
 		} else throw new CredoError("Unsupported credential type in options. Presentation must be either a W3cV2JwtVerifiablePresentation, a W3cV2SdJwtVerifiablePresentation, or a W3cV2DataIntegrityVerifiablePresentation");
-		validationResults.credentialEntries = (await Promise.all(entries.map((entry) => this.verifyPresentationEntry(agentContext, entry, signerId)))).flat();
+		validationResults.credentialEntries = (await Promise.all(entries.map((entry) => this.verifyPresentationEntry(agentContext, entry, signer, options.trustedIssuers, {
+			nonce: options.challenge,
+			audience: options.domain
+		})))).flat();
 		validationResults.isValid = validationResults.presentation.isValid && validationResults.credentialEntries.every((entry) => entry.isValid);
 		return validationResults;
 	}
-	async verifyPresentationEntry(agentContext, entry, signerId) {
+	async verifyPresentationEntry(agentContext, entry, signer, trustedIssuers, presentationBinding) {
 		if (entry instanceof W3cV2DataIntegrityVerifiablePresentation) return [this.createInvalidCredentialEntryResult(new CredoError("Nested verifiable presentation entries are not supported in VC 2.0 presentations."))];
 		if (entry instanceof W3cV2DataIntegrityVerifiableCredential) {
-			const credentialResult = await this.w3cV2DataIntegrityCredentialService.verifyCredential(agentContext, { credential: entry });
-			return [this.mergeCredentialSubjectAuthenticationValidation(credentialResult, signerId, entry.resolvedCredential?.credentialSubjectIds ?? [])];
+			const credentialResult = await this.w3cV2DataIntegrityCredentialService.verifyCredential(agentContext, {
+				credential: entry,
+				trustedIssuers
+			});
+			return [this.mergeHolderValidations(credentialResult, signer, entry.resolvedCredential?.credentialSubjectIds ?? [], { isValid: true })];
 		}
 		if (entry instanceof W3cV2EnvelopedVerifiablePresentation) return [this.createInvalidCredentialEntryResult(new CredoError("Nested verifiable presentation entries are not supported in VC 2.0 presentations."))];
 		if (!(entry instanceof W3cV2EnvelopedVerifiableCredential)) return [this.createInvalidCredentialEntryResult(new CredoError("Unsupported credential entry type in presentation."))];
 		const enclosed = entry.envelopedCredential;
 		let credentialResult;
-		if (enclosed instanceof W3cV2JwtVerifiableCredential) credentialResult = await this.w3cV2JwtCredentialService.verifyCredential(agentContext, { credential: enclosed });
-		else if (enclosed instanceof W3cV2SdJwtVerifiableCredential) credentialResult = await this.w3cV2SdJwtCredentialService.verifyCredential(agentContext, { credential: enclosed });
-		else return [this.createInvalidCredentialEntryResult(new CredoError(`Credential entry uses '${this.getClaimFormat(enclosed) ?? "an unsupported enclosed credential format"}'.`))];
-		return [this.mergeCredentialSubjectAuthenticationValidation(credentialResult, signerId, entry.resolvedCredential.credentialSubjectIds)];
+		let claims;
+		if (enclosed instanceof W3cV2JwtVerifiableCredential) {
+			credentialResult = await this.w3cV2JwtCredentialService.verifyCredential(agentContext, {
+				credential: enclosed,
+				trustedIssuers
+			});
+			claims = enclosed.jwt.payload.toJson();
+		} else if (enclosed instanceof W3cV2SdJwtVerifiableCredential) {
+			const { nonce, audience } = presentationBinding;
+			if (enclosed.sdJwt.kbJwt && !audience) return [this.createInvalidCredentialEntryResult(new CredoError("Credential has a KB-JWT, but no domain is provided to verify its audience"))];
+			credentialResult = await this.w3cV2SdJwtCredentialService.verifyCredential(agentContext, {
+				credential: enclosed,
+				trustedIssuers,
+				keyBinding: enclosed.sdJwt.kbJwt && audience ? {
+					nonce,
+					audience
+				} : void 0
+			});
+			claims = enclosed.sdJwt.prettyClaims;
+		} else return [this.createInvalidCredentialEntryResult(new CredoError(`Credential entry uses '${this.getClaimFormat(enclosed) ?? "an unsupported enclosed credential format"}'.`))];
+		return [this.mergeHolderValidations(credentialResult, signer, entry.resolvedCredential.credentialSubjectIds, await this.verifyHolderBinding(agentContext, claims, signer))];
+	}
+	/**
+	* A credential bound to a key with `cnf` must be presented with that key.
+	*/
+	async verifyHolderBinding(agentContext, claims, signer) {
+		try {
+			const holderBinding = parseHolderBindingFromCredential(claims);
+			if (!holderBinding) return { isValid: true };
+			const { publicJwk } = await extractKeyFromHolderBinding(agentContext, holderBinding, { didPurposes: ["authentication"] });
+			if (publicJwk.equals(getPublicJwkFromVerificationMethod(signer.verificationMethod))) return { isValid: true };
+			return {
+				isValid: false,
+				error: new CredoError(`Credential is bound to a different key than verification method ${signer.verificationMethod.id} that signed the presentation`)
+			};
+		} catch (error) {
+			return {
+				isValid: false,
+				error
+			};
+		}
 	}
 	extractCredentialEntriesFromPresentation(presentation) {
 		return this.extractCredentialEntriesFromResolvedPresentation(presentation.resolvedPresentation);
@@ -215,18 +260,19 @@ let W3cV2CredentialService = class W3cV2CredentialService {
 		const candidate = value;
 		return typeof candidate.claimFormat === "string" ? candidate.claimFormat : void 0;
 	}
-	mergeCredentialSubjectAuthenticationValidation(credentialResult, signerId, credentialSubjectIds) {
-		const presentationAuthenticatesCredentialSubject = credentialSubjectIds.some((subjectId) => signerId === subjectId);
+	mergeHolderValidations(credentialResult, signer, credentialSubjectIds, holderBinding) {
+		const presentationAuthenticatesCredentialSubject = credentialSubjectIds.some((subjectId) => signer.signer === subjectId);
 		const credentialSubjectAuthentication = credentialSubjectIds.length > 0 && !presentationAuthenticatesCredentialSubject ? {
 			isValid: false,
 			error: new CredoError("Credential has one or more credentialSubject ids, but presentation does not authenticate credential subject")
 		} : { isValid: true };
 		return {
 			...credentialResult,
-			isValid: credentialResult.isValid && credentialSubjectAuthentication.isValid,
+			isValid: credentialResult.isValid && credentialSubjectAuthentication.isValid && holderBinding.isValid,
 			validations: {
 				...credentialResult.validations,
-				credentialSubjectAuthentication
+				credentialSubjectAuthentication,
+				holderBinding
 			}
 		};
 	}