@credo-ts/openid4vc 0.5.3 → 0.5.4

package/build/openid4vc/src/openid4vc-holder/OpenId4VciHolderService.js

@@ -0,0 +1,512 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OpenId4VciHolderService = void 0;
+const core_1 = require("@credo-ts/core");
+const oid4vci_client_1 = require("@sphereon/oid4vci-client");
+const oid4vci_common_1 = require("@sphereon/oid4vci-common");
+const shared_1 = require("../shared");
+const issuerMetadataUtils_1 = require("../shared/issuerMetadataUtils");
+const utils_1 = require("../shared/utils");
+const OpenId4VciHolderServiceOptions_1 = require("./OpenId4VciHolderServiceOptions");
+let OpenId4VciHolderService = class OpenId4VciHolderService {
+    constructor(logger, w3cCredentialService, jwsService) {
+        this.w3cCredentialService = w3cCredentialService;
+        this.jwsService = jwsService;
+        this.logger = logger;
+    }
+    async resolveCredentialOffer(credentialOffer) {
+        var _a;
+        const client = await oid4vci_client_1.OpenID4VCIClient.fromURI({
+            uri: credentialOffer,
+            resolveOfferUri: true,
+            retrieveServerMetadata: true,
+            // This is a separate call, so we don't fetch it here, however it may be easier to just construct it here?
+            createAuthorizationRequestURL: false,
+        });
+        if (!((_a = client.credentialOffer) === null || _a === void 0 ? void 0 : _a.credential_offer)) {
+            throw new core_1.CredoError(`Could not resolve credential offer from '${credentialOffer}'`);
+        }
+        const credentialOfferPayload = client.credentialOffer.credential_offer;
+        const metadata = await client.retrieveServerMetadata();
+        if (!metadata.credentialIssuerMetadata) {
+            throw new core_1.CredoError(`Could not retrieve issuer metadata from '${metadata.issuer}'`);
+        }
+        const issuerMetadata = metadata.credentialIssuerMetadata;
+        this.logger.info('Fetched server metadata', {
+            issuer: metadata.issuer,
+            credentialEndpoint: metadata.credential_endpoint,
+            tokenEndpoint: metadata.token_endpoint,
+        });
+        this.logger.debug('Full server metadata', metadata);
+        return {
+            metadata: Object.assign(Object.assign({}, metadata), { credentialIssuerMetadata: issuerMetadata }),
+            credentialOfferPayload,
+            offeredCredentials: (0, issuerMetadataUtils_1.getOfferedCredentials)(credentialOfferPayload.credentials, issuerMetadata.credentials_supported),
+            version: client.version(),
+        };
+    }
+    getAuthDetailsFromOfferedCredential(offeredCredential, authDetailsLocation) {
+        const { format } = offeredCredential;
+        const type = 'openid_credential';
+        const locations = authDetailsLocation ? [authDetailsLocation] : undefined;
+        if (format === shared_1.OpenId4VciCredentialFormatProfile.JwtVcJson) {
+            return { type, format, types: offeredCredential.types, locations };
+        }
+        else if (format === shared_1.OpenId4VciCredentialFormatProfile.LdpVc ||
+            format === shared_1.OpenId4VciCredentialFormatProfile.JwtVcJsonLd) {
+            const credential_definition = {
+                '@context': offeredCredential['@context'],
+                credentialSubject: offeredCredential.credentialSubject,
+                types: offeredCredential.types,
+            };
+            return { type, format, locations, credential_definition };
+        }
+        else if (format === shared_1.OpenId4VciCredentialFormatProfile.SdJwtVc) {
+            return {
+                type,
+                format,
+                locations,
+                vct: offeredCredential.vct,
+                claims: offeredCredential.claims,
+            };
+        }
+        else {
+            throw new core_1.CredoError(`Cannot create authorization_details. Unsupported credential format '${format}'.`);
+        }
+    }
+    async resolveAuthorizationRequest(agentContext, resolvedCredentialOffer, authCodeFlowOptions) {
+        const { credentialOfferPayload, metadata, offeredCredentials } = resolvedCredentialOffer;
+        const codeVerifier = (await Promise.allSettled([agentContext.wallet.generateNonce(), agentContext.wallet.generateNonce()])).join();
+        const codeVerifierSha256 = core_1.Hasher.hash(codeVerifier, 'sha-256');
+        const codeChallenge = core_1.TypedArrayEncoder.toBase64URL(codeVerifierSha256);
+        this.logger.debug('Converted code_verifier to code_challenge', {
+            codeVerifier: codeVerifier,
+            sha256: codeVerifierSha256.toString(),
+            base64Url: codeChallenge,
+        });
+        const authDetailsLocation = metadata.credentialIssuerMetadata.authorization_server
+            ? metadata.credentialIssuerMetadata.authorization_server
+            : undefined;
+        const authDetails = offeredCredentials
+            .map((credential) => this.getAuthDetailsFromOfferedCredential(credential, authDetailsLocation))
+            .filter((authDetail) => authDetail !== undefined);
+        const { clientId, redirectUri, scope } = authCodeFlowOptions;
+        const authorizationRequestUri = await createAuthorizationRequestUri({
+            clientId,
+            codeChallenge,
+            redirectUri,
+            credentialOffer: credentialOfferPayload,
+            codeChallengeMethod: oid4vci_common_1.CodeChallengeMethod.S256,
+            // TODO: Read HAIP SdJwtVc's should always be requested via scopes
+            // TODO: should we now always use scopes instead of authDetails? or both????
+            scope: scope !== null && scope !== void 0 ? scope : [],
+            authDetails,
+            metadata,
+        });
+        return Object.assign(Object.assign({}, authCodeFlowOptions), { codeVerifier,
+            authorizationRequestUri });
+    }
+    async acceptCredentialOffer(agentContext, options) {
+        var _a, _b, _c, _d;
+        const { resolvedCredentialOffer, acceptCredentialOfferOptions, resolvedAuthorizationRequestWithCode } = options;
+        const { credentialOfferPayload, metadata, version, offeredCredentials } = resolvedCredentialOffer;
+        const { credentialsToRequest, userPin, credentialBindingResolver, verifyCredentialStatus } = acceptCredentialOfferOptions;
+        if ((credentialsToRequest === null || credentialsToRequest === void 0 ? void 0 : credentialsToRequest.length) === 0) {
+            this.logger.warn(`Accepting 0 credential offers. Returning`);
+            return [];
+        }
+        this.logger.info(`Accepting the following credential offers '${credentialsToRequest}'`);
+        const supportedJwaSignatureAlgorithms = (0, utils_1.getSupportedJwaSignatureAlgorithms)(agentContext);
+        const allowedProofOfPossessionSigAlgs = acceptCredentialOfferOptions.allowedProofOfPossessionSignatureAlgorithms;
+        const possibleProofOfPossessionSigAlgs = allowedProofOfPossessionSigAlgs
+            ? allowedProofOfPossessionSigAlgs.filter((algorithm) => supportedJwaSignatureAlgorithms.includes(algorithm))
+            : supportedJwaSignatureAlgorithms;
+        if (possibleProofOfPossessionSigAlgs.length === 0) {
+            throw new core_1.CredoError([
+                `No possible proof of possession signature algorithm found.`,
+                `Signature algorithms supported by the Agent '${supportedJwaSignatureAlgorithms.join(', ')}'`,
+                `Allowed Signature algorithms '${allowedProofOfPossessionSigAlgs === null || allowedProofOfPossessionSigAlgs === void 0 ? void 0 : allowedProofOfPossessionSigAlgs.join(', ')}'`,
+            ].join('\n'));
+        }
+        // acquire the access token
+        let accessTokenResponse;
+        const accessTokenClient = new oid4vci_client_1.AccessTokenClient();
+        if (resolvedAuthorizationRequestWithCode) {
+            const { code, codeVerifier, redirectUri } = resolvedAuthorizationRequestWithCode;
+            accessTokenResponse = await accessTokenClient.acquireAccessToken({
+                metadata: metadata,
+                credentialOffer: { credential_offer: credentialOfferPayload },
+                pin: userPin,
+                code,
+                codeVerifier,
+                redirectUri,
+            });
+        }
+        else {
+            accessTokenResponse = await accessTokenClient.acquireAccessToken({
+                metadata: metadata,
+                credentialOffer: { credential_offer: credentialOfferPayload },
+                pin: userPin,
+            });
+        }
+        if (!accessTokenResponse.successBody) {
+            throw new core_1.CredoError(`could not acquire access token from '${metadata.issuer}'. ${(_a = accessTokenResponse.errorBody) === null || _a === void 0 ? void 0 : _a.error}: ${(_b = accessTokenResponse.errorBody) === null || _b === void 0 ? void 0 : _b.error_description}`);
+        }
+        this.logger.debug('Requested OpenId4VCI Access Token.');
+        const accessToken = accessTokenResponse.successBody;
+        const receivedCredentials = [];
+        let newCNonce;
+        const credentialsSupportedToRequest = (_c = credentialsToRequest === null || credentialsToRequest === void 0 ? void 0 : credentialsToRequest.map((id) => offeredCredentials.find((credential) => credential.id === id)).filter((c, i) => {
+            if (!c) {
+                const offeredCredentialIds = offeredCredentials.map((c) => c.id).join(', ');
+                throw new core_1.CredoError(`Credential to request '${credentialsToRequest[i]}' is not present in offered credentials. Offered credentials are ${offeredCredentialIds}`);
+            }
+            return true;
+        })) !== null && _c !== void 0 ? _c : offeredCredentials;
+        for (const offeredCredential of credentialsSupportedToRequest) {
+            // Get all options for the credential request (such as which kid to use, the signature algorithm, etc)
+            const { credentialBinding, signatureAlgorithm } = await this.getCredentialRequestOptions(agentContext, {
+                possibleProofOfPossessionSignatureAlgorithms: possibleProofOfPossessionSigAlgs,
+                offeredCredential,
+                credentialBindingResolver,
+            });
+            // Create the proof of possession
+            const proofOfPossessionBuilder = oid4vci_client_1.ProofOfPossessionBuilder.fromAccessTokenResponse({
+                accessTokenResponse: accessToken,
+                callbacks: { signCallback: this.proofOfPossessionSignCallback(agentContext) },
+                version,
+            })
+                .withEndpointMetadata(metadata)
+                .withAlg(signatureAlgorithm);
+            if (credentialBinding.method === 'did') {
+                proofOfPossessionBuilder.withClientId((0, core_1.parseDid)(credentialBinding.didUrl).did).withKid(credentialBinding.didUrl);
+            }
+            else if (credentialBinding.method === 'jwk') {
+                proofOfPossessionBuilder.withJWK(credentialBinding.jwk.toJson());
+            }
+            if (newCNonce)
+                proofOfPossessionBuilder.withAccessTokenNonce(newCNonce);
+            const proofOfPossession = await proofOfPossessionBuilder.build();
+            this.logger.debug('Generated JWS', proofOfPossession);
+            // Acquire the credential
+            const credentialRequestBuilder = new oid4vci_client_1.CredentialRequestClientBuilder();
+            credentialRequestBuilder
+                .withVersion(version)
+                .withCredentialEndpoint(metadata.credential_endpoint)
+                .withTokenFromResponse(accessToken);
+            const credentialRequestClient = credentialRequestBuilder.build();
+            const credentialResponse = await credentialRequestClient.acquireCredentialsUsingProof({
+                proofInput: proofOfPossession,
+                credentialTypes: (0, issuerMetadataUtils_1.getTypesFromCredentialSupported)(offeredCredential),
+                format: offeredCredential.format,
+            });
+            newCNonce = (_d = credentialResponse.successBody) === null || _d === void 0 ? void 0 : _d.c_nonce;
+            // Create credential, but we don't store it yet (only after the user has accepted the credential)
+            const credential = await this.handleCredentialResponse(agentContext, credentialResponse, {
+                verifyCredentialStatus: verifyCredentialStatus !== null && verifyCredentialStatus !== void 0 ? verifyCredentialStatus : false,
+            });
+            this.logger.debug('Full credential', credential);
+            receivedCredentials.push(credential);
+        }
+        return receivedCredentials;
+    }
+    /**
+     * Get the options for the credential request. Internally this will resolve the proof of possession
+     * requirements, and based on that it will call the proofOfPossessionVerificationMethodResolver to
+     * allow the caller to select the correct verification method based on the requirements for the proof
+     * of possession.
+     */
+    async getCredentialRequestOptions(agentContext, options) {
+        const { signatureAlgorithm, supportedDidMethods, supportsAllDidMethods, supportsJwk } = this.getProofOfPossessionRequirements(agentContext, {
+            credentialToRequest: options.offeredCredential,
+            possibleProofOfPossessionSignatureAlgorithms: options.possibleProofOfPossessionSignatureAlgorithms,
+        });
+        const JwkClass = (0, core_1.getJwkClassFromJwaSignatureAlgorithm)(signatureAlgorithm);
+        if (!JwkClass) {
+            throw new core_1.CredoError(`Could not determine JWK key type of the JWA signature algorithm '${signatureAlgorithm}'`);
+        }
+        const supportedVerificationMethods = (0, core_1.getSupportedVerificationMethodTypesFromKeyType)(JwkClass.keyType);
+        const format = options.offeredCredential.format;
+        // Now we need to determine how the credential will be bound to us
+        const credentialBinding = await options.credentialBindingResolver({
+            credentialFormat: format,
+            signatureAlgorithm,
+            supportedVerificationMethods,
+            keyType: JwkClass.keyType,
+            supportedCredentialId: options.offeredCredential.id,
+            supportsAllDidMethods,
+            supportedDidMethods,
+            supportsJwk,
+        });
+        // Make sure the issuer of proof of possession is valid according to openid issuer metadata
+        if (credentialBinding.method === 'did' &&
+            !supportsAllDidMethods &&
+            // If supportedDidMethods is undefined, it means the issuer didn't include the binding methods in the metadata
+            // The user can still select a verification method, but we can't validate it
+            supportedDidMethods !== undefined &&
+            !supportedDidMethods.find((supportedDidMethod) => credentialBinding.didUrl.startsWith(supportedDidMethod))) {
+            const { method } = (0, core_1.parseDid)(credentialBinding.didUrl);
+            const supportedDidMethodsString = supportedDidMethods.join(', ');
+            throw new core_1.CredoError(`Resolved credential binding for proof of possession uses did method '${method}', but issuer only supports '${supportedDidMethodsString}'`);
+        }
+        else if (credentialBinding.method === 'jwk' && !supportsJwk) {
+            throw new core_1.CredoError(`Resolved credential binding for proof of possession uses jwk, but openid issuer does not support 'jwk' cryptographic binding method`);
+        }
+        // FIXME: we don't have the verification method here
+        // Make sure the verification method uses a supported verification method type
+        // if (!supportedVerificationMethods.includes(verificationMethod.type)) {
+        //   const supportedVerificationMethodsString = supportedVerificationMethods.join(', ')
+        //   throw new CredoError(
+        //     `Verification method uses verification method type '${verificationMethod.type}', but only '${supportedVerificationMethodsString}' verification methods are supported for key type '${JwkClass.keyType}'`
+        //   )
+        // }
+        return { credentialBinding, signatureAlgorithm };
+    }
+    /**
+     * Get the requirements for creating the proof of possession. Based on the allowed
+     * credential formats, the allowed proof of possession signature algorithms, and the
+     * credential type, this method will select the best credential format and signature
+     * algorithm to use, based on the order of preference.
+     */
+    getProofOfPossessionRequirements(agentContext, options) {
+        var _a, _b;
+        const { credentialToRequest } = options;
+        if (!OpenId4VciHolderServiceOptions_1.openId4VciSupportedCredentialFormats.includes(credentialToRequest.format)) {
+            throw new core_1.CredoError([
+                `Requested credential with format '${credentialToRequest.format}',`,
+                `for the credential with id '${credentialToRequest.id},`,
+                `but the wallet only supports the following formats '${OpenId4VciHolderServiceOptions_1.openId4VciSupportedCredentialFormats.join(', ')}'`,
+            ].join('\n'));
+        }
+        // For each of the supported algs, find the key types, then find the proof types
+        const signatureSuiteRegistry = agentContext.dependencyManager.resolve(core_1.SignatureSuiteRegistry);
+        let signatureAlgorithm;
+        const issuerSupportedCryptographicSuites = credentialToRequest.cryptographic_suites_supported;
+        const issuerSupportedBindingMethods = credentialToRequest.cryptographic_binding_methods_supported;
+        // If undefined, it means the issuer didn't include the cryptographic suites in the metadata
+        // We just guess that the first one is supported
+        if (issuerSupportedCryptographicSuites === undefined) {
+            signatureAlgorithm = options.possibleProofOfPossessionSignatureAlgorithms[0];
+        }
+        else {
+            switch (credentialToRequest.format) {
+                case shared_1.OpenId4VciCredentialFormatProfile.JwtVcJson:
+                case shared_1.OpenId4VciCredentialFormatProfile.JwtVcJsonLd:
+                case shared_1.OpenId4VciCredentialFormatProfile.SdJwtVc:
+                    signatureAlgorithm = options.possibleProofOfPossessionSignatureAlgorithms.find((signatureAlgorithm) => issuerSupportedCryptographicSuites.includes(signatureAlgorithm));
+                    break;
+                case shared_1.OpenId4VciCredentialFormatProfile.LdpVc:
+                    signatureAlgorithm = options.possibleProofOfPossessionSignatureAlgorithms.find((signatureAlgorithm) => {
+                        const JwkClass = (0, core_1.getJwkClassFromJwaSignatureAlgorithm)(signatureAlgorithm);
+                        if (!JwkClass)
+                            return false;
+                        const matchingSuite = signatureSuiteRegistry.getAllByKeyType(JwkClass.keyType);
+                        if (matchingSuite.length === 0)
+                            return false;
+                        return issuerSupportedCryptographicSuites.includes(matchingSuite[0].proofType);
+                    });
+                    break;
+                default:
+                    throw new core_1.CredoError(`Unsupported credential format.`);
+            }
+        }
+        if (!signatureAlgorithm) {
+            throw new core_1.CredoError(`Could not establish signature algorithm for format ${credentialToRequest.format} and id ${credentialToRequest.id}`);
+        }
+        const supportsAllDidMethods = (_a = issuerSupportedBindingMethods === null || issuerSupportedBindingMethods === void 0 ? void 0 : issuerSupportedBindingMethods.includes('did')) !== null && _a !== void 0 ? _a : false;
+        const supportedDidMethods = issuerSupportedBindingMethods === null || issuerSupportedBindingMethods === void 0 ? void 0 : issuerSupportedBindingMethods.filter((method) => method.startsWith('did:'));
+        const supportsJwk = (_b = issuerSupportedBindingMethods === null || issuerSupportedBindingMethods === void 0 ? void 0 : issuerSupportedBindingMethods.includes('jwk')) !== null && _b !== void 0 ? _b : false;
+        return {
+            signatureAlgorithm,
+            supportedDidMethods,
+            supportsAllDidMethods,
+            supportsJwk,
+        };
+    }
+    async handleCredentialResponse(agentContext, credentialResponse, options) {
+        var _a, _b, _c, _d, _e, _f;
+        const { verifyCredentialStatus } = options;
+        this.logger.debug('Credential request response', credentialResponse);
+        if (!credentialResponse.successBody || !credentialResponse.successBody.credential) {
+            throw new core_1.CredoError(`Did not receive a successful credential response. ${(_a = credentialResponse.errorBody) === null || _a === void 0 ? void 0 : _a.error}: ${(_b = credentialResponse.errorBody) === null || _b === void 0 ? void 0 : _b.error_description}`);
+        }
+        const format = credentialResponse.successBody.format;
+        if (format === shared_1.OpenId4VciCredentialFormatProfile.SdJwtVc) {
+            if (typeof credentialResponse.successBody.credential !== 'string')
+                throw new core_1.CredoError(`Received a credential of format ${shared_1.OpenId4VciCredentialFormatProfile.SdJwtVc}, but the credential is not a string. ${JSON.stringify(credentialResponse.successBody.credential)}`);
+            const sdJwtVcApi = agentContext.dependencyManager.resolve(core_1.SdJwtVcApi);
+            const verificationResult = await sdJwtVcApi.verify({
+                compactSdJwtVc: credentialResponse.successBody.credential,
+            });
+            if (!verificationResult.isValid) {
+                agentContext.config.logger.error('Failed to validate credential', { verificationResult });
+                throw new core_1.CredoError(`Failed to validate sd-jwt-vc credential. Results = ${JSON.stringify(verificationResult)}`);
+            }
+            return verificationResult.sdJwtVc;
+        }
+        else if (format === shared_1.OpenId4VciCredentialFormatProfile.JwtVcJson ||
+            format === shared_1.OpenId4VciCredentialFormatProfile.JwtVcJsonLd) {
+            const credential = core_1.W3cJwtVerifiableCredential.fromSerializedJwt(credentialResponse.successBody.credential);
+            const result = await this.w3cCredentialService.verifyCredential(agentContext, {
+                credential,
+                verifyCredentialStatus,
+            });
+            if (!result.isValid) {
+                agentContext.config.logger.error('Failed to validate credential', { result });
+                throw new core_1.CredoError(`Failed to validate credential, error = ${(_d = (_c = result.error) === null || _c === void 0 ? void 0 : _c.message) !== null && _d !== void 0 ? _d : 'Unknown'}`);
+            }
+            return credential;
+        }
+        else if (format === shared_1.OpenId4VciCredentialFormatProfile.LdpVc) {
+            const credential = core_1.W3cJsonLdVerifiableCredential.fromJson(credentialResponse.successBody.credential);
+            const result = await this.w3cCredentialService.verifyCredential(agentContext, {
+                credential,
+                verifyCredentialStatus,
+            });
+            if (!result.isValid) {
+                agentContext.config.logger.error('Failed to validate credential', { result });
+                throw new core_1.CredoError(`Failed to validate credential, error = ${(_f = (_e = result.error) === null || _e === void 0 ? void 0 : _e.message) !== null && _f !== void 0 ? _f : 'Unknown'}`);
+            }
+            return credential;
+        }
+        throw new core_1.CredoError(`Unsupported credential format ${credentialResponse.successBody.format}`);
+    }
+    proofOfPossessionSignCallback(agentContext) {
+        return async (jwt, kid) => {
+            if (!jwt.header)
+                throw new core_1.CredoError('No header present on JWT');
+            if (!jwt.payload)
+                throw new core_1.CredoError('No payload present on JWT');
+            if (kid && jwt.header.jwk) {
+                throw new core_1.CredoError('Both KID and JWK are present in the callback. Only one can be present');
+            }
+            let key;
+            if (kid) {
+                if (!kid.startsWith('did:')) {
+                    throw new core_1.CredoError(`kid '${kid}' is not a DID. Only dids are supported for kid`);
+                }
+                else if (!kid.includes('#')) {
+                    throw new core_1.CredoError(`kid '${kid}' does not contain a fragment. kid MUST point to a specific key in the did document.`);
+                }
+                const didsApi = agentContext.dependencyManager.resolve(core_1.DidsApi);
+                const didDocument = await didsApi.resolveDidDocument(kid);
+                const verificationMethod = didDocument.dereferenceKey(kid, ['authentication']);
+                key = (0, core_1.getKeyFromVerificationMethod)(verificationMethod);
+            }
+            else if (jwt.header.jwk) {
+                key = (0, core_1.getJwkFromJson)(jwt.header.jwk).key;
+            }
+            else {
+                throw new core_1.CredoError('No KID or JWK is present in the callback');
+            }
+            const jwk = (0, core_1.getJwkFromKey)(key);
+            if (!jwk.supportsSignatureAlgorithm(jwt.header.alg)) {
+                throw new core_1.CredoError(`key type '${jwk.keyType}', does not support the JWS signature alg '${jwt.header.alg}'`);
+            }
+            // We don't support these properties, remove them, so we can pass all other header properties to the JWS service
+            if (jwt.header.x5c)
+                throw new core_1.CredoError('x5c is not supported');
+            // eslint-disable-next-line @typescript-eslint/no-unused-vars
+            const _a = jwt.header, { x5c: _x5c } = _a, supportedHeaderOptions = __rest(_a, ["x5c"]);
+            const jws = await this.jwsService.createJwsCompact(agentContext, {
+                key,
+                payload: core_1.JsonEncoder.toBuffer(jwt.payload),
+                protectedHeaderOptions: Object.assign(Object.assign({}, supportedHeaderOptions), { 
+                    // only pass jwk if it was present in the header
+                    jwk: jwt.header.jwk ? jwk : undefined }),
+            });
+            return jws;
+        };
+    }
+};
+exports.OpenId4VciHolderService = OpenId4VciHolderService;
+exports.OpenId4VciHolderService = OpenId4VciHolderService = __decorate([
+    (0, core_1.injectable)(),
+    __param(0, (0, core_1.inject)(core_1.InjectionSymbols.Logger)),
+    __metadata("design:paramtypes", [Object, core_1.W3cCredentialService,
+        core_1.JwsService])
+], OpenId4VciHolderService);
+// NOTE: this is also defined in the sphereon lib, but we use
+// this custom method to get PAR working and because we don't
+// use the oid4vci client in sphereon's lib
+// Once PAR is supported in the sphereon lib, we should to try remove this
+// and use the one from the sphereon lib
+async function createAuthorizationRequestUri(options) {
+    var _a, _b, _c;
+    const { scope, authDetails, metadata, clientId, codeChallenge, codeChallengeMethod, redirectUri } = options;
+    let nonEmptyScope = !scope || scope.length === 0 ? undefined : scope;
+    const nonEmptyAuthDetails = !authDetails || authDetails.length === 0 ? undefined : authDetails;
+    // Scope and authorization_details can be used in the same authorization request
+    // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-rar-23#name-relationship-to-scope-param
+    if (!nonEmptyScope && !nonEmptyAuthDetails) {
+        throw new core_1.CredoError(`Please provide a 'scope' or 'authDetails' via the options.`);
+    }
+    // Authorization servers supporting PAR SHOULD include the URL of their pushed authorization request endpoint in their authorization server metadata document
+    // Note that the presence of pushed_authorization_request_endpoint is sufficient for a client to determine that it may use the PAR flow.
+    const parEndpoint = metadata.credentialIssuerMetadata.pushed_authorization_request_endpoint;
+    const authorizationEndpoint = (_a = metadata.credentialIssuerMetadata) === null || _a === void 0 ? void 0 : _a.authorization_endpoint;
+    if (!authorizationEndpoint && !parEndpoint) {
+        throw new core_1.CredoError("Server metadata does not contain an 'authorization_endpoint' which is required for the 'Authorization Code Flow'");
+    }
+    // add 'openid' scope if not present
+    if (nonEmptyScope && !(nonEmptyScope === null || nonEmptyScope === void 0 ? void 0 : nonEmptyScope.includes('openid'))) {
+        nonEmptyScope = ['openid', ...nonEmptyScope];
+    }
+    const queryObj = {
+        client_id: clientId,
+        response_type: oid4vci_common_1.ResponseType.AUTH_CODE,
+        code_challenge_method: codeChallengeMethod,
+        code_challenge: codeChallenge,
+        redirect_uri: redirectUri,
+    };
+    if (nonEmptyScope)
+        queryObj['scope'] = nonEmptyScope.join(' ');
+    if (nonEmptyAuthDetails)
+        queryObj['authorization_details'] = JSON.stringify((0, issuerMetadataUtils_1.handleAuthorizationDetails)(nonEmptyAuthDetails, metadata));
+    const issuerState = (_c = (_b = options.credentialOffer.grants) === null || _b === void 0 ? void 0 : _b.authorization_code) === null || _c === void 0 ? void 0 : _c.issuer_state;
+    if (issuerState)
+        queryObj['issuer_state'] = issuerState;
+    if (parEndpoint) {
+        const body = new URLSearchParams(queryObj);
+        const response = await (0, oid4vci_client_1.formPost)(parEndpoint, body);
+        if (!response.successBody) {
+            throw new core_1.CredoError(`Could not acquire the authorization request uri from '${parEndpoint}'`);
+        }
+        return (0, oid4vci_common_1.convertJsonToURI)({ request_uri: response.successBody.request_uri, client_id: clientId, response_type: oid4vci_common_1.ResponseType.AUTH_CODE }, {
+            baseUrl: authorizationEndpoint,
+            uriTypeProperties: ['request_uri', 'client_id', 'response_type'],
+            mode: oid4vci_common_1.JsonURIMode.X_FORM_WWW_URLENCODED,
+        });
+    }
+    else {
+        return (0, oid4vci_common_1.convertJsonToURI)(queryObj, {
+            baseUrl: authorizationEndpoint,
+            uriTypeProperties: ['redirect_uri', 'scope', 'authorization_details', 'issuer_state'],
+            mode: oid4vci_common_1.JsonURIMode.X_FORM_WWW_URLENCODED,
+        });
+    }
+}
+//# sourceMappingURL=OpenId4VciHolderService.js.map

package/build/openid4vc/src/openid4vc-holder/OpenId4VciHolderService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenId4VciHolderService.js","sourceRoot":"","sources":["../../../../src/openid4vc-holder/OpenId4VciHolderService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,yCAsBuB;AACvB,6DAMiC;AACjC,6DAA2G;AAE3G,sCAA6D;AAC7D,uEAIsC;AACtC,2CAAoE;AAEpE,qFAAuF;AAGhF,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAKlC,YACmC,MAAc,EAC/C,oBAA0C,EAC1C,UAAsB;QAEtB,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAA;QAChD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAEM,KAAK,CAAC,sBAAsB,CAAC,eAAuB;;QACzD,MAAM,MAAM,GAAG,MAAM,iCAAgB,CAAC,OAAO,CAAC;YAC5C,GAAG,EAAE,eAAe;YACpB,eAAe,EAAE,IAAI;YACrB,sBAAsB,EAAE,IAAI;YAC5B,0GAA0G;YAC1G,6BAA6B,EAAE,KAAK;SACrC,CAAC,CAAA;QAEF,IAAI,CAAC,CAAA,MAAA,MAAM,CAAC,eAAe,0CAAE,gBAAgB,CAAA,EAAE,CAAC;YAC9C,MAAM,IAAI,iBAAU,CAAC,4CAA4C,eAAe,GAAG,CAAC,CAAA;QACtF,CAAC;QACD,MAAM,sBAAsB,GAAqC,MAAM,CAAC,eAAe,CAAC,gBAAgB,CAAA;QAExG,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,sBAAsB,EAAE,CAAA;QACtD,IAAI,CAAC,QAAQ,CAAC,wBAAwB,EAAE,CAAC;YACvC,MAAM,IAAI,iBAAU,CAAC,4CAA4C,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;QACtF,CAAC;QACD,MAAM,cAAc,GAAG,QAAQ,CAAC,wBAAoD,CAAA;QAEpF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;YAC1C,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,kBAAkB,EAAE,QAAQ,CAAC,mBAAmB;YAChD,aAAa,EAAE,QAAQ,CAAC,cAAc;SACvC,CAAC,CAAA;QAEF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAA;QAEnD,OAAO;YACL,QAAQ,kCACH,QAAQ,KACX,wBAAwB,EAAE,cAAc,GACzC;YACD,sBAAsB;YACtB,kBAAkB,EAAE,IAAA,2CAAqB,EACvC,sBAAsB,CAAC,WAAW,EAClC,cAAc,CAAC,qBAAqB,CACrC;YACD,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;SAC1B,CAAA;IACH,CAAC;IAEO,mCAAmC,CACzC,iBAAgD,EAChD,mBAAuC;QAEvC,MAAM,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAA;QACpC,MAAM,IAAI,GAAG,mBAAmB,CAAA;QAEhC,MAAM,SAAS,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACzE,IAAI,MAAM,KAAK,0CAAiC,CAAC,SAAS,EAAE,CAAC;YAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,CAAC,KAAK,EAAE,SAAS,EAA0C,CAAA;QAC5G,CAAC;aAAM,IACL,MAAM,KAAK,0CAAiC,CAAC,KAAK;YAClD,MAAM,KAAK,0CAAiC,CAAC,WAAW,EACxD,CAAC;YACD,MAAM,qBAAqB,GAAG;gBAC5B,UAAU,EAAE,iBAAiB,CAAC,UAAU,CAAC;gBACzC,iBAAiB,EAAE,iBAAiB,CAAC,iBAAiB;gBACtD,KAAK,EAAE,iBAAiB,CAAC,KAAK;aAC/B,CAAA;YAED,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAA;QAC3D,CAAC;aAAM,IAAI,MAAM,KAAK,0CAAiC,CAAC,OAAO,EAAE,CAAC;YAChE,OAAO;gBACL,IAAI;gBACJ,MAAM;gBACN,SAAS;gBACT,GAAG,EAAE,iBAAiB,CAAC,GAAG;gBAC1B,MAAM,EAAE,iBAAiB,CAAC,MAAM;aACjC,CAAA;QACH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,iBAAU,CAAC,uEAAuE,MAAM,IAAI,CAAC,CAAA;QACzG,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,2BAA2B,CACtC,YAA0B,EAC1B,uBAA0D,EAC1D,mBAAkD;QAElD,MAAM,EAAE,sBAAsB,EAAE,QAAQ,EAAE,kBAAkB,EAAE,GAAG,uBAAuB,CAAA;QACxF,MAAM,YAAY,GAAG,CACnB,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,YAAY,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CACrG,CAAC,IAAI,EAAE,CAAA;QACR,MAAM,kBAAkB,GAAG,aAAM,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;QAC/D,MAAM,aAAa,GAAG,wBAAiB,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAA;QAEvE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE;YAC7D,YAAY,EAAE,YAAY;YAC1B,MAAM,EAAE,kBAAkB,CAAC,QAAQ,EAAE;YACrC,SAAS,EAAE,aAAa;SACzB,CAAC,CAAA;QAEF,MAAM,mBAAmB,GAAG,QAAQ,CAAC,wBAAwB,CAAC,oBAAoB;YAChF,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC,oBAAoB;YACxD,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,WAAW,GAAG,kBAAkB;aACnC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,mCAAmC,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;aAC9F,MAAM,CAAC,CAAC,UAAU,EAAsC,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,CAAA;QAEvF,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAA;QAC5D,MAAM,uBAAuB,GAAG,MAAM,6BAA6B,CAAC;YAClE,QAAQ;YACR,aAAa;YACb,WAAW;YACX,eAAe,EAAE,sBAAsB;YACvC,mBAAmB,EAAE,oCAAmB,CAAC,IAAI;YAC7C,kEAAkE;YAClE,4EAA4E;YAC5E,KAAK,EAAE,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE;YAClB,WAAW;YACX,QAAQ;SACT,CAAC,CAAA;QAEF,uCACK,mBAAmB,KACtB,YAAY;YACZ,uBAAuB,IACxB;IACH,CAAC;IAEM,KAAK,CAAC,qBAAqB,CAChC,YAA0B,EAC1B,OAIC;;QAED,MAAM,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,oCAAoC,EAAE,GAAG,OAAO,CAAA;QAC/G,MAAM,EAAE,sBAAsB,EAAE,QAAQ,EAAE,OAAO,EAAE,kBAAkB,EAAE,GAAG,uBAAuB,CAAA;QAEjG,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,GACxF,4BAA4B,CAAA;QAE9B,IAAI,CAAA,oBAAoB,aAApB,oBAAoB,uBAApB,oBAAoB,CAAE,MAAM,MAAK,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAA;YAC5D,OAAO,EAAE,CAAA;QACX,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8CAA8C,oBAAoB,GAAG,CAAC,CAAA;QAEvF,MAAM,+BAA+B,GAAG,IAAA,0CAAkC,EAAC,YAAY,CAAC,CAAA;QAExF,MAAM,+BAA+B,GAAG,4BAA4B,CAAC,2CAA2C,CAAA;QAChH,MAAM,gCAAgC,GAAG,+BAA+B;YACtE,CAAC,CAAC,+BAA+B,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,+BAA+B,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC5G,CAAC,CAAC,+BAA+B,CAAA;QAEnC,IAAI,gCAAgC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,iBAAU,CAClB;gBACE,4DAA4D;gBAC5D,gDAAgD,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAC7F,iCAAiC,+BAA+B,aAA/B,+BAA+B,uBAA/B,+BAA+B,CAAE,IAAI,CAAC,IAAI,CAAC,GAAG;aAChF,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAA;QACH,CAAC;QAED,2BAA2B;QAC3B,IAAI,mBAAwD,CAAA;QAE5D,MAAM,iBAAiB,GAAG,IAAI,kCAAiB,EAAE,CAAA;QACjD,IAAI,oCAAoC,EAAE,CAAC;YACzC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,oCAAoC,CAAA;YAChF,mBAAmB,GAAG,MAAM,iBAAiB,CAAC,kBAAkB,CAAC;gBAC/D,QAAQ,EAAE,QAAQ;gBAClB,eAAe,EAAE,EAAE,gBAAgB,EAAE,sBAAsB,EAAE;gBAC7D,GAAG,EAAE,OAAO;gBACZ,IAAI;gBACJ,YAAY;gBACZ,WAAW;aACZ,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,mBAAmB,GAAG,MAAM,iBAAiB,CAAC,kBAAkB,CAAC;gBAC/D,QAAQ,EAAE,QAAQ;gBAClB,eAAe,EAAE,EAAE,gBAAgB,EAAE,sBAAsB,EAAE;gBAC7D,GAAG,EAAE,OAAO;aACb,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,IAAI,iBAAU,CAClB,wCAAwC,QAAQ,CAAC,MAAM,MAAM,MAAA,mBAAmB,CAAC,SAAS,0CAAE,KAAK,KAAK,MAAA,mBAAmB,CAAC,SAAS,0CAAE,iBAAiB,EAAE,CACzJ,CAAA;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAA;QAEvD,MAAM,WAAW,GAAG,mBAAmB,CAAC,WAAW,CAAA;QACnD,MAAM,mBAAmB,GAAgC,EAAE,CAAA;QAC3D,IAAI,SAA6B,CAAA;QAEjC,MAAM,6BAA6B,GACjC,MAAA,oBAAoB,aAApB,oBAAoB,uBAApB,oBAAoB,CAChB,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,EAC1E,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAA4C,EAAE;YACzD,IAAI,CAAC,CAAC,EAAE,CAAC;gBACP,MAAM,oBAAoB,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC3E,MAAM,IAAI,iBAAU,CAClB,0BAA0B,oBAAoB,CAAC,CAAC,CAAC,oEAAoE,oBAAoB,EAAE,CAC5I,CAAA;YACH,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,mCAAI,kBAAkB,CAAA;QAE5B,KAAK,MAAM,iBAAiB,IAAI,6BAA6B,EAAE,CAAC;YAC9D,sGAAsG;YACtG,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,YAAY,EAAE;gBACrG,4CAA4C,EAAE,gCAAgC;gBAC9E,iBAAiB;gBACjB,yBAAyB;aAC1B,CAAC,CAAA;YAEF,iCAAiC;YACjC,MAAM,wBAAwB,GAAG,yCAAwB,CAAC,uBAAuB,CAAC;gBAChF,mBAAmB,EAAE,WAAW;gBAChC,SAAS,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,6BAA6B,CAAC,YAAY,CAAC,EAAE;gBAC7E,OAAO;aACR,CAAC;iBACC,oBAAoB,CAAC,QAAQ,CAAC;iBAC9B,OAAO,CAAC,kBAAkB,CAAC,CAAA;YAE9B,IAAI,iBAAiB,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACvC,wBAAwB,CAAC,YAAY,CAAC,IAAA,eAAQ,EAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;YACjH,CAAC;iBAAM,IAAI,iBAAiB,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC9C,wBAAwB,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;YAClE,CAAC;YAED,IAAI,SAAS;gBAAE,wBAAwB,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAA;YAEvE,MAAM,iBAAiB,GAAG,MAAM,wBAAwB,CAAC,KAAK,EAAE,CAAA;YAChE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAA;YAErD,yBAAyB;YACzB,MAAM,wBAAwB,GAAG,IAAI,+CAA8B,EAAE,CAAA;YACrE,wBAAwB;iBACrB,WAAW,CAAC,OAAO,CAAC;iBACpB,sBAAsB,CAAC,QAAQ,CAAC,mBAAmB,CAAC;iBACpD,qBAAqB,CAAC,WAAW,CAAC,CAAA;YAErC,MAAM,uBAAuB,GAAG,wBAAwB,CAAC,KAAK,EAAE,CAAA;YAChE,MAAM,kBAAkB,GAAG,MAAM,uBAAuB,CAAC,4BAA4B,CAAC;gBACpF,UAAU,EAAE,iBAAiB;gBAC7B,eAAe,EAAE,IAAA,qDAA+B,EAAC,iBAAiB,CAAC;gBACnE,MAAM,EAAE,iBAAiB,CAAC,MAAM;aACjC,CAAC,CAAA;YAEF,SAAS,GAAG,MAAA,kBAAkB,CAAC,WAAW,0CAAE,OAAO,CAAA;YAEnD,iGAAiG;YACjG,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,YAAY,EAAE,kBAAkB,EAAE;gBACvF,sBAAsB,EAAE,sBAAsB,aAAtB,sBAAsB,cAAtB,sBAAsB,GAAI,KAAK;aACxD,CAAC,CAAA;YAEF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAA;YAChD,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACtC,CAAC;QAED,OAAO,mBAAmB,CAAA;IAC5B,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,2BAA2B,CACvC,YAA0B,EAC1B,OAIC;QAED,MAAM,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,WAAW,EAAE,GACnF,IAAI,CAAC,gCAAgC,CAAC,YAAY,EAAE;YAClD,mBAAmB,EAAE,OAAO,CAAC,iBAAiB;YAC9C,4CAA4C,EAAE,OAAO,CAAC,4CAA4C;SACnG,CAAC,CAAA;QAEJ,MAAM,QAAQ,GAAG,IAAA,2CAAoC,EAAC,kBAAkB,CAAC,CAAA;QACzE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,iBAAU,CAAC,oEAAoE,kBAAkB,GAAG,CAAC,CAAA;QACjH,CAAC;QAED,MAAM,4BAA4B,GAAG,IAAA,qDAA8C,EAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QAErG,MAAM,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAA8C,CAAA;QAEvF,kEAAkE;QAClE,MAAM,iBAAiB,GAAG,MAAM,OAAO,CAAC,yBAAyB,CAAC;YAChE,gBAAgB,EAAE,MAAM;YACxB,kBAAkB;YAClB,4BAA4B;YAC5B,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,qBAAqB,EAAE,OAAO,CAAC,iBAAiB,CAAC,EAAE;YACnD,qBAAqB;YACrB,mBAAmB;YACnB,WAAW;SACZ,CAAC,CAAA;QAEF,2FAA2F;QAC3F,IACE,iBAAiB,CAAC,MAAM,KAAK,KAAK;YAClC,CAAC,qBAAqB;YACtB,8GAA8G;YAC9G,4EAA4E;YAC5E,mBAAmB,KAAK,SAAS;YACjC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,kBAAkB,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,EAC1G,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,eAAQ,EAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;YACrD,MAAM,yBAAyB,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAChE,MAAM,IAAI,iBAAU,CAClB,wEAAwE,MAAM,gCAAgC,yBAAyB,GAAG,CAC3I,CAAA;QACH,CAAC;aAAM,IAAI,iBAAiB,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9D,MAAM,IAAI,iBAAU,CAClB,qIAAqI,CACtI,CAAA;QACH,CAAC;QAED,oDAAoD;QACpD,8EAA8E;QAC9E,yEAAyE;QACzE,uFAAuF;QACvF,0BAA0B;QAC1B,+MAA+M;QAC/M,MAAM;QACN,IAAI;QAEJ,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,CAAA;IAClD,CAAC;IAED;;;;;OAKG;IACK,gCAAgC,CACtC,YAA0B,EAC1B,OAGC;;QAED,MAAM,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAA;QAEvC,IACE,CAAC,qEAAoC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,MAA8C,CAAC,EAClH,CAAC;YACD,MAAM,IAAI,iBAAU,CAClB;gBACE,qCAAqC,mBAAmB,CAAC,MAAM,IAAI;gBACnE,+BAA+B,mBAAmB,CAAC,EAAE,GAAG;gBACxD,uDAAuD,qEAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aAC1G,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAA;QACH,CAAC;QAED,gFAAgF;QAChF,MAAM,sBAAsB,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,6BAAsB,CAAC,CAAA;QAE7F,IAAI,kBAAqD,CAAA;QAEzD,MAAM,kCAAkC,GAAG,mBAAmB,CAAC,8BAA8B,CAAA;QAC7F,MAAM,6BAA6B,GAAG,mBAAmB,CAAC,uCAAuC,CAAA;QAEjG,4FAA4F;QAC5F,gDAAgD;QAChD,IAAI,kCAAkC,KAAK,SAAS,EAAE,CAAC;YACrD,kBAAkB,GAAG,OAAO,CAAC,4CAA4C,CAAC,CAAC,CAAC,CAAA;QAC9E,CAAC;aAAM,CAAC;YACN,QAAQ,mBAAmB,CAAC,MAAM,EAAE,CAAC;gBACnC,KAAK,0CAAiC,CAAC,SAAS,CAAC;gBACjD,KAAK,0CAAiC,CAAC,WAAW,CAAC;gBACnD,KAAK,0CAAiC,CAAC,OAAO;oBAC5C,kBAAkB,GAAG,OAAO,CAAC,4CAA4C,CAAC,IAAI,CAAC,CAAC,kBAAkB,EAAE,EAAE,CACpG,kCAAkC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAChE,CAAA;oBACD,MAAK;gBACP,KAAK,0CAAiC,CAAC,KAAK;oBAC1C,kBAAkB,GAAG,OAAO,CAAC,4CAA4C,CAAC,IAAI,CAAC,CAAC,kBAAkB,EAAE,EAAE;wBACpG,MAAM,QAAQ,GAAG,IAAA,2CAAoC,EAAC,kBAAkB,CAAC,CAAA;wBACzE,IAAI,CAAC,QAAQ;4BAAE,OAAO,KAAK,CAAA;wBAE3B,MAAM,aAAa,GAAG,sBAAsB,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;wBAC9E,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;4BAAE,OAAO,KAAK,CAAA;wBAE5C,OAAO,kCAAkC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;oBAChF,CAAC,CAAC,CAAA;oBACF,MAAK;gBACP;oBACE,MAAM,IAAI,iBAAU,CAAC,gCAAgC,CAAC,CAAA;YAC1D,CAAC;QACH,CAAC;QAED,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,MAAM,IAAI,iBAAU,CAClB,sDAAsD,mBAAmB,CAAC,MAAM,WAAW,mBAAmB,CAAC,EAAE,EAAE,CACpH,CAAA;QACH,CAAC;QAED,MAAM,qBAAqB,GAAG,MAAA,6BAA6B,aAA7B,6BAA6B,uBAA7B,6BAA6B,CAAE,QAAQ,CAAC,KAAK,CAAC,mCAAI,KAAK,CAAA;QACrF,MAAM,mBAAmB,GAAG,6BAA6B,aAA7B,6BAA6B,uBAA7B,6BAA6B,CAAE,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;QACxG,MAAM,WAAW,GAAG,MAAA,6BAA6B,aAA7B,6BAA6B,uBAA7B,6BAA6B,CAAE,QAAQ,CAAC,KAAK,CAAC,mCAAI,KAAK,CAAA;QAE3E,OAAO;YACL,kBAAkB;YAClB,mBAAmB;YACnB,qBAAqB;YACrB,WAAW;SACZ,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,wBAAwB,CACpC,YAA0B,EAC1B,kBAAsD,EACtD,OAA4C;;QAE5C,MAAM,EAAE,sBAAsB,EAAE,GAAG,OAAO,CAAA;QAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,kBAAkB,CAAC,CAAA;QAEpE,IAAI,CAAC,kBAAkB,CAAC,WAAW,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;YAClF,MAAM,IAAI,iBAAU,CAClB,qDAAqD,MAAA,kBAAkB,CAAC,SAAS,0CAAE,KAAK,KAAK,MAAA,kBAAkB,CAAC,SAAS,0CAAE,iBAAiB,EAAE,CAC/I,CAAA;QACH,CAAC;QAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,WAAW,CAAC,MAAM,CAAA;QACpD,IAAI,MAAM,KAAK,0CAAiC,CAAC,OAAO,EAAE,CAAC;YACzD,IAAI,OAAO,kBAAkB,CAAC,WAAW,CAAC,UAAU,KAAK,QAAQ;gBAC/D,MAAM,IAAI,iBAAU,CAClB,mCACE,0CAAiC,CAAC,OACpC,yCAAyC,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CACrG,CAAA;YAEH,MAAM,UAAU,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,iBAAU,CAAC,CAAA;YACrE,MAAM,kBAAkB,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC;gBACjD,cAAc,EAAE,kBAAkB,CAAC,WAAW,CAAC,UAAU;aAC1D,CAAC,CAAA;YAEF,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,CAAC;gBAChC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,kBAAkB,EAAE,CAAC,CAAA;gBACzF,MAAM,IAAI,iBAAU,CAAC,sDAAsD,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAA;YAClH,CAAC;YAED,OAAO,kBAAkB,CAAC,OAAO,CAAA;QACnC,CAAC;aAAM,IACL,MAAM,KAAK,0CAAiC,CAAC,SAAS;YACtD,MAAM,KAAK,0CAAiC,CAAC,WAAW,EACxD,CAAC;YACD,MAAM,UAAU,GAAG,iCAA0B,CAAC,iBAAiB,CAC7D,kBAAkB,CAAC,WAAW,CAAC,UAAoB,CACpD,CAAA;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,YAAY,EAAE;gBAC5E,UAAU;gBACV,sBAAsB;aACvB,CAAC,CAAA;YACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;gBAC7E,MAAM,IAAI,iBAAU,CAAC,0CAA0C,MAAA,MAAA,MAAM,CAAC,KAAK,0CAAE,OAAO,mCAAI,SAAS,EAAE,CAAC,CAAA;YACtG,CAAC;YAED,OAAO,UAAU,CAAA;QACnB,CAAC;aAAM,IAAI,MAAM,KAAK,0CAAiC,CAAC,KAAK,EAAE,CAAC;YAC9D,MAAM,UAAU,GAAG,oCAA6B,CAAC,QAAQ,CACvD,kBAAkB,CAAC,WAAW,CAAC,UAAqC,CACrE,CAAA;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,YAAY,EAAE;gBAC5E,UAAU;gBACV,sBAAsB;aACvB,CAAC,CAAA;YACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;gBAC7E,MAAM,IAAI,iBAAU,CAAC,0CAA0C,MAAA,MAAA,MAAM,CAAC,KAAK,0CAAE,OAAO,mCAAI,SAAS,EAAE,CAAC,CAAA;YACtG,CAAC;YAED,OAAO,UAAU,CAAA;QACnB,CAAC;QAED,MAAM,IAAI,iBAAU,CAAC,iCAAiC,kBAAkB,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAA;IAChG,CAAC;IAEO,6BAA6B,CAAC,YAA0B;QAC9D,OAAO,KAAK,EAAE,GAAQ,EAAE,GAAY,EAAE,EAAE;YACtC,IAAI,CAAC,GAAG,CAAC,MAAM;gBAAE,MAAM,IAAI,iBAAU,CAAC,0BAA0B,CAAC,CAAA;YACjE,IAAI,CAAC,GAAG,CAAC,OAAO;gBAAE,MAAM,IAAI,iBAAU,CAAC,2BAA2B,CAAC,CAAA;YACnE,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gBAC1B,MAAM,IAAI,iBAAU,CAAC,uEAAuE,CAAC,CAAA;YAC/F,CAAC;YAED,IAAI,GAAQ,CAAA;YAEZ,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC5B,MAAM,IAAI,iBAAU,CAAC,QAAQ,GAAG,iDAAiD,CAAC,CAAA;gBACpF,CAAC;qBAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9B,MAAM,IAAI,iBAAU,CAClB,QAAQ,GAAG,sFAAsF,CAClG,CAAA;gBACH,CAAC;gBAED,MAAM,OAAO,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,cAAO,CAAC,CAAA;gBAC/D,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAA;gBACzD,MAAM,kBAAkB,GAAG,WAAW,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAA;gBAE9E,GAAG,GAAG,IAAA,mCAA4B,EAAC,kBAAkB,CAAC,CAAA;YACxD,CAAC;iBAAM,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gBAC1B,GAAG,GAAG,IAAA,qBAAc,EAAC,GAAG,CAAC,MAAM,CAAC,GAAc,CAAC,CAAC,GAAG,CAAA;YACrD,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,iBAAU,CAAC,0CAA0C,CAAC,CAAA;YAClE,CAAC;YAED,MAAM,GAAG,GAAG,IAAA,oBAAa,EAAC,GAAG,CAAC,CAAA;YAC9B,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,iBAAU,CAAC,aAAa,GAAG,CAAC,OAAO,8CAA8C,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAA;YAC/G,CAAC;YAED,gHAAgH;YAChH,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG;gBAAE,MAAM,IAAI,iBAAU,CAAC,sBAAsB,CAAC,CAAA;YAEhE,6DAA6D;YAC7D,MAAM,KAA2C,GAAG,CAAC,MAAM,EAArD,EAAE,GAAG,EAAE,IAAI,OAA0C,EAArC,sBAAsB,cAAtC,OAAwC,CAAa,CAAA;YAE3D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,YAAY,EAAE;gBAC/D,GAAG;gBACH,OAAO,EAAE,kBAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;gBAC1C,sBAAsB,kCACjB,sBAAsB;oBACzB,gDAAgD;oBAChD,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,GACtC;aACF,CAAC,CAAA;YAEF,OAAO,GAAG,CAAA;QACZ,CAAC,CAAA;IACH,CAAC;CACF,CAAA;AA9iBY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,iBAAU,GAAE;IAOR,WAAA,IAAA,aAAM,EAAC,uBAAgB,CAAC,MAAM,CAAC,CAAA;6CACV,2BAAoB;QAC9B,iBAAU;GARb,uBAAuB,CA8iBnC;AAED,6DAA6D;AAC7D,6DAA6D;AAC7D,2CAA2C;AAC3C,0EAA0E;AAC1E,wCAAwC;AACxC,KAAK,UAAU,6BAA6B,CAAC,OAS5C;;IACC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,mBAAmB,EAAE,WAAW,EAAE,GAAG,OAAO,CAAA;IAC3G,IAAI,aAAa,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAA;IACpE,MAAM,mBAAmB,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAA;IAE9F,gFAAgF;IAChF,iGAAiG;IACjG,IAAI,CAAC,aAAa,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC3C,MAAM,IAAI,iBAAU,CAAC,4DAA4D,CAAC,CAAA;IACpF,CAAC;IAED,6JAA6J;IAC7J,wIAAwI;IACxI,MAAM,WAAW,GAAG,QAAQ,CAAC,wBAAwB,CAAC,qCAAqC,CAAA;IAE3F,MAAM,qBAAqB,GAAG,MAAA,QAAQ,CAAC,wBAAwB,0CAAE,sBAAsB,CAAA;IAEvF,IAAI,CAAC,qBAAqB,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,IAAI,iBAAU,CAClB,kHAAkH,CACnH,CAAA;IACH,CAAC;IAED,oCAAoC;IACpC,IAAI,aAAa,IAAI,CAAC,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA,EAAE,CAAC;QACxD,aAAa,GAAG,CAAC,QAAQ,EAAE,GAAG,aAAa,CAAC,CAAA;IAC9C,CAAC;IAED,MAAM,QAAQ,GAA2B;QACvC,SAAS,EAAE,QAAQ;QACnB,aAAa,EAAE,6BAAY,CAAC,SAAS;QACrC,qBAAqB,EAAE,mBAAmB;QAC1C,cAAc,EAAE,aAAa;QAC7B,YAAY,EAAE,WAAW;KAC1B,CAAA;IAED,IAAI,aAAa;QAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAE9D,IAAI,mBAAmB;QACrB,QAAQ,CAAC,uBAAuB,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAA,gDAA0B,EAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC,CAAA;IAE/G,MAAM,WAAW,GAAG,MAAA,MAAA,OAAO,CAAC,eAAe,CAAC,MAAM,0CAAE,kBAAkB,0CAAE,YAAY,CAAA;IACpF,IAAI,WAAW;QAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,WAAW,CAAA;IAEvD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAA;QAC1C,MAAM,QAAQ,GAAG,MAAM,IAAA,yBAAQ,EAA8B,WAAW,EAAE,IAAI,CAAC,CAAA;QAC/E,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC1B,MAAM,IAAI,iBAAU,CAAC,yDAAyD,WAAW,GAAG,CAAC,CAAA;QAC/F,CAAC;QACD,OAAO,IAAA,iCAAgB,EACrB,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,6BAAY,CAAC,SAAS,EAAE,EAC7G;YACE,OAAO,EAAE,qBAAqB;YAC9B,iBAAiB,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,eAAe,CAAC;YAChE,IAAI,EAAE,4BAAW,CAAC,qBAAqB;SACxC,CACF,CAAA;IACH,CAAC;SAAM,CAAC;QACN,OAAO,IAAA,iCAAgB,EAAC,QAAQ,EAAE;YAChC,OAAO,EAAE,qBAAqB;YAC9B,iBAAiB,EAAE,CAAC,cAAc,EAAE,OAAO,EAAE,uBAAuB,EAAE,cAAc,CAAC;YACrF,IAAI,EAAE,4BAAW,CAAC,qBAAqB;SACxC,CAAC,CAAA;IACJ,CAAC;AACH,CAAC"}

package/build/openid4vc/src/openid4vc-holder/OpenId4VciHolderServiceOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenId4VciHolderServiceOptions.js","sourceRoot":"","sources":["../../../../src/openid4vc-holder/OpenId4VciHolderServiceOptions.ts"],"names":[],"mappings":";;;AASA,0GAAsG;AAQzF,QAAA,oCAAoC,GAA2C;IAC1F,qEAAiC,CAAC,SAAS;IAC3C,qEAAiC,CAAC,WAAW;IAC7C,qEAAiC,CAAC,OAAO;IACzC,qEAAiC,CAAC,KAAK;CACxC,CAAA"}