@credo-ts/openid4vc 0.6.1-pr-2091-20241119140918 → 0.6.2-alpha-20251210145840

package/build/openid4vc-verifier/repository/OpenId4VcVerificationSessionRepository.mjs

@@ -0,0 +1,22 @@
+import { __decorateMetadata } from "../../_virtual/_@oxc-project_runtime@0.99.0/helpers/decorateMetadata.mjs";
+import { __decorateParam } from "../../_virtual/_@oxc-project_runtime@0.99.0/helpers/decorateParam.mjs";
+import { __decorate } from "../../_virtual/_@oxc-project_runtime@0.99.0/helpers/decorate.mjs";
+import { OpenId4VcVerificationSessionRecord } from "./OpenId4VcVerificationSessionRecord.mjs";
+import { EventEmitter, InjectionSymbols, Repository, inject, injectable } from "@credo-ts/core";
+
+//#region src/openid4vc-verifier/repository/OpenId4VcVerificationSessionRepository.ts
+var _ref;
+let OpenId4VcVerificationSessionRepository = class OpenId4VcVerificationSessionRepository$1 extends Repository {
+	constructor(storageService, eventEmitter) {
+		super(OpenId4VcVerificationSessionRecord, storageService, eventEmitter);
+	}
+};
+OpenId4VcVerificationSessionRepository = __decorate([
+	injectable(),
+	__decorateParam(0, inject(InjectionSymbols.StorageService)),
+	__decorateMetadata("design:paramtypes", [Object, typeof (_ref = typeof EventEmitter !== "undefined" && EventEmitter) === "function" ? _ref : Object])
+], OpenId4VcVerificationSessionRepository);
+
+//#endregion
+export { OpenId4VcVerificationSessionRepository };
+//# sourceMappingURL=OpenId4VcVerificationSessionRepository.mjs.map

package/build/openid4vc-verifier/repository/OpenId4VcVerificationSessionRepository.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenId4VcVerificationSessionRepository.mjs","names":["OpenId4VcVerificationSessionRepository","storageService: StorageService<OpenId4VcVerificationSessionRecord>"],"sources":["../../../src/openid4vc-verifier/repository/OpenId4VcVerificationSessionRepository.ts"],"sourcesContent":["import { EventEmitter, InjectionSymbols, inject, injectable, Repository, type StorageService } from '@credo-ts/core'\n\nimport { OpenId4VcVerificationSessionRecord } from './OpenId4VcVerificationSessionRecord'\n\n@injectable()\nexport class OpenId4VcVerificationSessionRepository extends Repository<OpenId4VcVerificationSessionRecord> {\n  public constructor(\n    @inject(InjectionSymbols.StorageService) storageService: StorageService<OpenId4VcVerificationSessionRecord>,\n    eventEmitter: EventEmitter\n  ) {\n    super(OpenId4VcVerificationSessionRecord, storageService, eventEmitter)\n  }\n}\n"],"mappings":";;;;;;;;AAKO,mDAAMA,iDAA+C,WAA+C;CACzG,AAAO,YACL,AAAyCC,gBACzC,cACA;AACA,QAAM,oCAAoC,gBAAgB,aAAa;;;;CAN1E,YAAY;oBAGR,OAAO,iBAAiB,eAAe"}

package/build/openid4vc-verifier/repository/OpenId4VcVerifierRecord.d.mts

@@ -0,0 +1,33 @@
+import { OpenId4VpVerifierClientMetadata } from "../OpenId4VpVerifierServiceOptions.mjs";
+import { BaseRecord, RecordTags, TagsBase } from "@credo-ts/core";
+
+//#region src/openid4vc-verifier/repository/OpenId4VcVerifierRecord.d.ts
+type OpenId4VcVerifierRecordTags = RecordTags<OpenId4VcVerifierRecord>;
+type DefaultOpenId4VcVerifierRecordTags = {
+  verifierId: string;
+};
+interface OpenId4VcVerifierRecordProps {
+  id?: string;
+  createdAt?: Date;
+  tags?: TagsBase;
+  verifierId: string;
+  clientMetadata?: OpenId4VpVerifierClientMetadata;
+}
+/**
+ * For OID4VC you need to expos metadata files. Each issuer needs to host this metadata. This is not the case for DIDComm where we can just have one /didcomm endpoint.
+ * So we create a record per openid issuer/verifier that you want, and each tenant can create multiple issuers/verifiers which have different endpoints
+ * and metadata files
+ * */
+declare class OpenId4VcVerifierRecord extends BaseRecord<DefaultOpenId4VcVerifierRecordTags> {
+  static readonly type = "OpenId4VcVerifierRecord";
+  readonly type = "OpenId4VcVerifierRecord";
+  verifierId: string;
+  clientMetadata?: OpenId4VpVerifierClientMetadata;
+  constructor(props: OpenId4VcVerifierRecordProps);
+  getTags(): {
+    verifierId: string;
+  };
+}
+//#endregion
+export { DefaultOpenId4VcVerifierRecordTags, OpenId4VcVerifierRecord, OpenId4VcVerifierRecordProps, OpenId4VcVerifierRecordTags };
+//# sourceMappingURL=OpenId4VcVerifierRecord.d.mts.map

package/build/openid4vc-verifier/repository/OpenId4VcVerifierRecord.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenId4VcVerifierRecord.d.mts","names":[],"sources":["../../../src/openid4vc-verifier/repository/OpenId4VcVerifierRecord.ts"],"sourcesContent":[],"mappings":";;;;KAIY,2BAAA,GAA8B,WAAW;AAAzC,KAEA,kCAAA,GAFyC;EAEzC,UAAA,EAAA,MAAA;AAIZ,CAAA;AAEc,UAFG,4BAAA,CAEH;EACL,EAAA,CAAA,EAAA,MAAA;EAIU,SAAA,CAAA,EALL,IAKK;EAA+B,IAAA,CAAA,EAJzC,QAIyC;EAQrC,UAAA,EAAA,MAAA;EAA2C,cAAA,CAAA,EARrC,+BAQqC;;;;;;;cAA3C,uBAAA,SAAgC,WAAW;;;;mBAK9B;qBAEE"}

package/build/openid4vc-verifier/repository/OpenId4VcVerifierRecord.mjs

@@ -0,0 +1,32 @@
+import { BaseRecord, utils } from "@credo-ts/core";
+
+//#region src/openid4vc-verifier/repository/OpenId4VcVerifierRecord.ts
+/**
+* For OID4VC you need to expos metadata files. Each issuer needs to host this metadata. This is not the case for DIDComm where we can just have one /didcomm endpoint.
+* So we create a record per openid issuer/verifier that you want, and each tenant can create multiple issuers/verifiers which have different endpoints
+* and metadata files
+* */
+var OpenId4VcVerifierRecord = class OpenId4VcVerifierRecord extends BaseRecord {
+	constructor(props) {
+		super();
+		this.type = OpenId4VcVerifierRecord.type;
+		if (props) {
+			this.id = props.id ?? utils.uuid();
+			this.createdAt = props.createdAt ?? /* @__PURE__ */ new Date();
+			this._tags = props.tags ?? {};
+			this.verifierId = props.verifierId;
+			this.clientMetadata = props.clientMetadata;
+		}
+	}
+	getTags() {
+		return {
+			...this._tags,
+			verifierId: this.verifierId
+		};
+	}
+};
+OpenId4VcVerifierRecord.type = "OpenId4VcVerifierRecord";
+
+//#endregion
+export { OpenId4VcVerifierRecord };
+//# sourceMappingURL=OpenId4VcVerifierRecord.mjs.map

package/build/openid4vc-verifier/repository/OpenId4VcVerifierRecord.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenId4VcVerifierRecord.mjs","names":[],"sources":["../../../src/openid4vc-verifier/repository/OpenId4VcVerifierRecord.ts"],"sourcesContent":["import type { RecordTags, TagsBase } from '@credo-ts/core'\nimport { BaseRecord, utils } from '@credo-ts/core'\nimport type { OpenId4VpVerifierClientMetadata } from '../OpenId4VpVerifierServiceOptions'\n\nexport type OpenId4VcVerifierRecordTags = RecordTags<OpenId4VcVerifierRecord>\n\nexport type DefaultOpenId4VcVerifierRecordTags = {\n  verifierId: string\n}\n\nexport interface OpenId4VcVerifierRecordProps {\n  id?: string\n  createdAt?: Date\n  tags?: TagsBase\n\n  verifierId: string\n\n  clientMetadata?: OpenId4VpVerifierClientMetadata\n}\n\n/**\n * For OID4VC you need to expos metadata files. Each issuer needs to host this metadata. This is not the case for DIDComm where we can just have one /didcomm endpoint.\n * So we create a record per openid issuer/verifier that you want, and each tenant can create multiple issuers/verifiers which have different endpoints\n * and metadata files\n * */\nexport class OpenId4VcVerifierRecord extends BaseRecord<DefaultOpenId4VcVerifierRecordTags> {\n  public static readonly type = 'OpenId4VcVerifierRecord'\n  public readonly type = OpenId4VcVerifierRecord.type\n\n  public verifierId!: string\n  public clientMetadata?: OpenId4VpVerifierClientMetadata\n\n  public constructor(props: OpenId4VcVerifierRecordProps) {\n    super()\n\n    if (props) {\n      this.id = props.id ?? utils.uuid()\n      this.createdAt = props.createdAt ?? new Date()\n      this._tags = props.tags ?? {}\n\n      this.verifierId = props.verifierId\n      this.clientMetadata = props.clientMetadata\n    }\n  }\n\n  public getTags() {\n    return {\n      ...this._tags,\n      verifierId: this.verifierId,\n    }\n  }\n}\n"],"mappings":";;;;;;;;AAyBA,IAAa,0BAAb,MAAa,gCAAgC,WAA+C;CAO1F,AAAO,YAAY,OAAqC;AACtD,SAAO;OANO,OAAO,wBAAwB;AAQ7C,MAAI,OAAO;AACT,QAAK,KAAK,MAAM,MAAM,MAAM,MAAM;AAClC,QAAK,YAAY,MAAM,6BAAa,IAAI,MAAM;AAC9C,QAAK,QAAQ,MAAM,QAAQ,EAAE;AAE7B,QAAK,aAAa,MAAM;AACxB,QAAK,iBAAiB,MAAM;;;CAIhC,AAAO,UAAU;AACf,SAAO;GACL,GAAG,KAAK;GACR,YAAY,KAAK;GAClB;;;wBAvBoB,OAAO"}

package/build/openid4vc-verifier/repository/OpenId4VcVerifierRepository.d.mts

@@ -0,0 +1,12 @@
+import { OpenId4VcVerifierRecord } from "./OpenId4VcVerifierRecord.mjs";
+import { AgentContext, EventEmitter, Repository, StorageService } from "@credo-ts/core";
+
+//#region src/openid4vc-verifier/repository/OpenId4VcVerifierRepository.d.ts
+declare class OpenId4VcVerifierRepository extends Repository<OpenId4VcVerifierRecord> {
+  constructor(storageService: StorageService<OpenId4VcVerifierRecord>, eventEmitter: EventEmitter);
+  findByVerifierId(agentContext: AgentContext, verifierId: string): Promise<OpenId4VcVerifierRecord | null>;
+  getByVerifierId(agentContext: AgentContext, verifierId: string): Promise<OpenId4VcVerifierRecord>;
+}
+//#endregion
+export { OpenId4VcVerifierRepository };
+//# sourceMappingURL=OpenId4VcVerifierRepository.d.mts.map

package/build/openid4vc-verifier/repository/OpenId4VcVerifierRepository.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenId4VcVerifierRepository.d.mts","names":[],"sources":["../../../src/openid4vc-verifier/repository/OpenId4VcVerifierRepository.ts"],"sourcesContent":[],"mappings":";;;;cAOa,2BAAA,SAAoC,WAAW;EAA/C,WAAA,CAAA,cAAA,EAEgD,cAFpB,CAEmC,uBAFnC,CAAA,EAAA,YAAA,EAGvB,YAHuB;EAAmB,gBAAA,CAAA,YAAA,EAQpB,YARoB,EAAA,UAAA,EAAA,MAAA,CAAA,EAQY,OARZ,CAQY,uBARZ,GAAA,IAAA,CAAA;EAEgB,eAAA,CAAA,YAAA,EAUrC,YAVqC,EAAA,UAAA,EAAA,MAAA,CAAA,EAUL,OAVK,CAUL,uBAVK,CAAA"}

package/build/openid4vc-verifier/repository/OpenId4VcVerifierRepository.mjs

@@ -0,0 +1,28 @@
+import { __decorateMetadata } from "../../_virtual/_@oxc-project_runtime@0.99.0/helpers/decorateMetadata.mjs";
+import { __decorateParam } from "../../_virtual/_@oxc-project_runtime@0.99.0/helpers/decorateParam.mjs";
+import { __decorate } from "../../_virtual/_@oxc-project_runtime@0.99.0/helpers/decorate.mjs";
+import { OpenId4VcVerifierRecord } from "./OpenId4VcVerifierRecord.mjs";
+import { EventEmitter, InjectionSymbols, Repository, inject, injectable } from "@credo-ts/core";
+
+//#region src/openid4vc-verifier/repository/OpenId4VcVerifierRepository.ts
+var _ref;
+let OpenId4VcVerifierRepository = class OpenId4VcVerifierRepository$1 extends Repository {
+	constructor(storageService, eventEmitter) {
+		super(OpenId4VcVerifierRecord, storageService, eventEmitter);
+	}
+	findByVerifierId(agentContext, verifierId) {
+		return this.findSingleByQuery(agentContext, { verifierId });
+	}
+	getByVerifierId(agentContext, verifierId) {
+		return this.getSingleByQuery(agentContext, { verifierId });
+	}
+};
+OpenId4VcVerifierRepository = __decorate([
+	injectable(),
+	__decorateParam(0, inject(InjectionSymbols.StorageService)),
+	__decorateMetadata("design:paramtypes", [Object, typeof (_ref = typeof EventEmitter !== "undefined" && EventEmitter) === "function" ? _ref : Object])
+], OpenId4VcVerifierRepository);
+
+//#endregion
+export { OpenId4VcVerifierRepository };
+//# sourceMappingURL=OpenId4VcVerifierRepository.mjs.map

package/build/openid4vc-verifier/repository/OpenId4VcVerifierRepository.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenId4VcVerifierRepository.mjs","names":["OpenId4VcVerifierRepository","storageService: StorageService<OpenId4VcVerifierRecord>"],"sources":["../../../src/openid4vc-verifier/repository/OpenId4VcVerifierRepository.ts"],"sourcesContent":["import type { AgentContext } from '@credo-ts/core'\n\nimport { EventEmitter, InjectionSymbols, inject, injectable, Repository, type StorageService } from '@credo-ts/core'\n\nimport { OpenId4VcVerifierRecord } from './OpenId4VcVerifierRecord'\n\n@injectable()\nexport class OpenId4VcVerifierRepository extends Repository<OpenId4VcVerifierRecord> {\n  public constructor(\n    @inject(InjectionSymbols.StorageService) storageService: StorageService<OpenId4VcVerifierRecord>,\n    eventEmitter: EventEmitter\n  ) {\n    super(OpenId4VcVerifierRecord, storageService, eventEmitter)\n  }\n\n  public findByVerifierId(agentContext: AgentContext, verifierId: string) {\n    return this.findSingleByQuery(agentContext, { verifierId })\n  }\n\n  public getByVerifierId(agentContext: AgentContext, verifierId: string) {\n    return this.getSingleByQuery(agentContext, { verifierId })\n  }\n}\n"],"mappings":";;;;;;;;AAOO,wCAAMA,sCAAoC,WAAoC;CACnF,AAAO,YACL,AAAyCC,gBACzC,cACA;AACA,QAAM,yBAAyB,gBAAgB,aAAa;;CAG9D,AAAO,iBAAiB,cAA4B,YAAoB;AACtE,SAAO,KAAK,kBAAkB,cAAc,EAAE,YAAY,CAAC;;CAG7D,AAAO,gBAAgB,cAA4B,YAAoB;AACrE,SAAO,KAAK,iBAAiB,cAAc,EAAE,YAAY,CAAC;;;;CAd7D,YAAY;oBAGR,OAAO,iBAAiB,eAAe"}

package/build/openid4vc-verifier/repository/index.d.mts

@@ -0,0 +1,4 @@
+import { DefaultOpenId4VcVerificationSessionRecordTags, OpenId4VcVerificationSessionRecord, OpenId4VcVerificationSessionRecordProps, OpenId4VcVerificationSessionRecordTags } from "./OpenId4VcVerificationSessionRecord.mjs";
+import { OpenId4VcVerificationSessionRepository } from "./OpenId4VcVerificationSessionRepository.mjs";
+import { DefaultOpenId4VcVerifierRecordTags, OpenId4VcVerifierRecord, OpenId4VcVerifierRecordProps, OpenId4VcVerifierRecordTags } from "./OpenId4VcVerifierRecord.mjs";
+import { OpenId4VcVerifierRepository } from "./OpenId4VcVerifierRepository.mjs";

package/build/openid4vc-verifier/repository/index.mjs

@@ -0,0 +1,4 @@
+import { OpenId4VcVerificationSessionRecord } from "./OpenId4VcVerificationSessionRecord.mjs";
+import { OpenId4VcVerificationSessionRepository } from "./OpenId4VcVerificationSessionRepository.mjs";
+import { OpenId4VcVerifierRecord } from "./OpenId4VcVerifierRecord.mjs";
+import { OpenId4VcVerifierRepository } from "./OpenId4VcVerifierRepository.mjs";

package/build/openid4vc-verifier/router/authorizationEndpoint.mjs

@@ -0,0 +1,117 @@
+import { getRequestContext, sendErrorResponse, sendJsonResponse, sendOauth2ErrorResponse, sendUnknownServerErrorResponse } from "../../shared/router/context.mjs";
+import "../../shared/router/index.mjs";
+import { OpenId4VcVerificationSessionRepository } from "../repository/OpenId4VcVerificationSessionRepository.mjs";
+import "../repository/index.mjs";
+import { OpenId4VpVerifierService } from "../OpenId4VpVerifierService.mjs";
+import { AgentContext, TypedArrayEncoder } from "@credo-ts/core";
+import { Oauth2ErrorCodes, Oauth2ServerErrorResponseError, decodeJwtHeader } from "@openid4vc/oauth2";
+import { zOpenid4vpAuthorizationResponse } from "@openid4vc/openid4vp";
+import { ValidationError } from "@openid4vc/utils";
+
+//#region src/openid4vc-verifier/router/authorizationEndpoint.ts
+function configureAuthorizationEndpoint(router, config) {
+	router.post(config.authorizationEndpoint, async (request, response, next) => {
+		const { agentContext, verifier } = getRequestContext(request);
+		const openId4VcVerifierService = agentContext.dependencyManager.resolve(OpenId4VpVerifierService);
+		let authorizationResponseRedirectUri;
+		try {
+			const result = await getVerificationSession(agentContext, request, response, next, verifier);
+			if (!result.success) return;
+			authorizationResponseRedirectUri = result.verificationSession.authorizationResponseRedirectUri;
+			const { verificationSession } = await openId4VcVerifierService.verifyAuthorizationResponse(agentContext, {
+				authorizationResponse: request.body,
+				verificationSession: result.verificationSession
+			});
+			return sendJsonResponse(response, next, {
+				presentation_during_issuance_session: verificationSession.presentationDuringIssuanceSession,
+				redirect_uri: verificationSession.authorizationResponseRedirectUri
+			});
+		} catch (error) {
+			if (error instanceof Oauth2ServerErrorResponseError) {
+				error.errorResponse.redirect_uri = authorizationResponseRedirectUri;
+				return sendOauth2ErrorResponse(response, next, agentContext.config.logger, error);
+			}
+			if (error instanceof ValidationError) return sendOauth2ErrorResponse(response, next, agentContext.config.logger, new Oauth2ServerErrorResponseError({
+				error: Oauth2ErrorCodes.InvalidRequest,
+				error_description: error.message,
+				redirect_uri: authorizationResponseRedirectUri
+			}, { cause: error }));
+			return sendUnknownServerErrorResponse(response, next, agentContext.config.logger, error, { redirect_uri: authorizationResponseRedirectUri });
+		}
+	});
+}
+async function getVerificationSession(agentContext, request, response, next, verifier) {
+	const openId4VcVerificationSessionRepository = agentContext.dependencyManager.resolve(OpenId4VcVerificationSessionRepository);
+	try {
+		if (request.query.session) {
+			if (typeof request.query.session !== "string") {
+				sendErrorResponse(response, next, agentContext.config.logger, 400, Oauth2ErrorCodes.InvalidRequest, `Unexpected value for 'session' query param`);
+				return { success: false };
+			}
+			const verificationSession = await openId4VcVerificationSessionRepository.findSingleByQuery(agentContext, {
+				verifierId: verifier.verifierId,
+				authorizationRequestId: request.query.session
+			});
+			if (!verificationSession) {
+				sendErrorResponse(response, next, agentContext.config.logger, 400, Oauth2ErrorCodes.InvalidRequest, `Invalid 'session' parameter`);
+				return { success: false };
+			}
+			return {
+				success: true,
+				verificationSession
+			};
+		}
+		const parsedResponse = zOpenid4vpAuthorizationResponse.safeParse(request.body);
+		if (parsedResponse.success) {
+			if (!parsedResponse.data.state) {
+				sendErrorResponse(response, next, agentContext.config.logger, 400, Oauth2ErrorCodes.InvalidRequest, `Missing required 'state' parameter in response without response encryption`);
+				return { success: false };
+			}
+			const verificationSession = await openId4VcVerificationSessionRepository.findSingleByQuery(agentContext, {
+				payloadState: parsedResponse.data.state,
+				verifierId: verifier.verifierId
+			});
+			if (!verificationSession) {
+				sendErrorResponse(response, next, agentContext.config.logger, 400, Oauth2ErrorCodes.InvalidRequest, `Invalid 'state' parameter`);
+				return { success: false };
+			}
+			return {
+				success: true,
+				verificationSession
+			};
+		}
+		if (typeof request.body === "object" && "response" in request.body) {
+			const { header } = decodeJwtHeader({ jwt: request.body.response });
+			if (!header.apv) {
+				sendErrorResponse(response, next, agentContext.config.logger, 400, Oauth2ErrorCodes.InvalidRequest, `Missing 'session' query param or 'apv' value in header of encrypted JARM response.`);
+				return { success: false };
+			}
+			if (typeof header.apv !== "string") {
+				sendErrorResponse(response, next, agentContext.config.logger, 400, Oauth2ErrorCodes.InvalidRequest, `'apv' value in header of encrypted JARM response is not of type string.`);
+				return { success: false };
+			}
+			const nonce = TypedArrayEncoder.toUtf8String(TypedArrayEncoder.fromBase64(header.apv));
+			const verificationSession = await openId4VcVerificationSessionRepository.findSingleByQuery(agentContext, {
+				nonce,
+				verifierId: verifier.verifierId
+			});
+			if (!verificationSession) {
+				sendErrorResponse(response, next, agentContext.config.logger, 400, Oauth2ErrorCodes.InvalidRequest, `Invalid 'apv' parameter`);
+				return { success: false };
+			}
+			return {
+				success: true,
+				verificationSession
+			};
+		}
+		sendErrorResponse(response, next, agentContext.config.logger, 400, Oauth2ErrorCodes.InvalidRequest, "Invalid response");
+		return { success: false };
+	} catch (error) {
+		sendUnknownServerErrorResponse(response, next, agentContext.config.logger, error);
+		return { success: false };
+	}
+}
+
+//#endregion
+export { configureAuthorizationEndpoint };
+//# sourceMappingURL=authorizationEndpoint.mjs.map

package/build/openid4vc-verifier/router/authorizationEndpoint.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizationEndpoint.mjs","names":["authorizationResponseRedirectUri: string | undefined"],"sources":["../../../src/openid4vc-verifier/router/authorizationEndpoint.ts"],"sourcesContent":["import { AgentContext, TypedArrayEncoder } from '@credo-ts/core'\nimport { decodeJwtHeader, Oauth2ErrorCodes, Oauth2ServerErrorResponseError } from '@openid4vc/oauth2'\n// FIXME: export parseOpenid4VpAuthorizationResponsePayload from openid4vp\nimport { zOpenid4vpAuthorizationResponse } from '@openid4vc/openid4vp'\nimport { ValidationError } from '@openid4vc/utils'\nimport type { NextFunction, Request, Response, Router } from 'express'\nimport {\n  getRequestContext,\n  sendErrorResponse,\n  sendJsonResponse,\n  sendOauth2ErrorResponse,\n  sendUnknownServerErrorResponse,\n} from '../../shared/router'\nimport { OpenId4VcVerifierModuleConfig } from '../OpenId4VcVerifierModuleConfig'\nimport { OpenId4VpVerifierService } from '../OpenId4VpVerifierService'\nimport {\n  OpenId4VcVerificationSessionRecord,\n  OpenId4VcVerificationSessionRepository,\n  OpenId4VcVerifierRecord,\n} from '../repository'\nimport type { OpenId4VcVerificationRequest } from './requestContext'\n\nexport function configureAuthorizationEndpoint(router: Router, config: OpenId4VcVerifierModuleConfig) {\n  router.post(config.authorizationEndpoint, async (request: OpenId4VcVerificationRequest, response: Response, next) => {\n    const { agentContext, verifier } = getRequestContext(request)\n    const openId4VcVerifierService = agentContext.dependencyManager.resolve(OpenId4VpVerifierService)\n\n    let authorizationResponseRedirectUri: string | undefined\n\n    try {\n      const result = await getVerificationSession(agentContext, request, response, next, verifier)\n\n      // Response already handled in the method\n      if (!result.success) return\n\n      authorizationResponseRedirectUri = result.verificationSession.authorizationResponseRedirectUri\n\n      const { verificationSession } = await openId4VcVerifierService.verifyAuthorizationResponse(agentContext, {\n        authorizationResponse: request.body,\n        verificationSession: result.verificationSession,\n      })\n\n      return sendJsonResponse(response, next, {\n        // Used only for presentation during issuance flow, to prevent session fixation.\n        presentation_during_issuance_session: verificationSession.presentationDuringIssuanceSession,\n\n        redirect_uri: verificationSession.authorizationResponseRedirectUri,\n      })\n    } catch (error) {\n      if (error instanceof Oauth2ServerErrorResponseError) {\n        error.errorResponse.redirect_uri = authorizationResponseRedirectUri\n        return sendOauth2ErrorResponse(response, next, agentContext.config.logger, error)\n      }\n\n      // FIXME: should throw a Oauth2ServerErrorResponseError in the oid4vp library\n      if (error instanceof ValidationError) {\n        return sendOauth2ErrorResponse(\n          response,\n          next,\n          agentContext.config.logger,\n          new Oauth2ServerErrorResponseError(\n            {\n              error: Oauth2ErrorCodes.InvalidRequest,\n              error_description: error.message,\n              redirect_uri: authorizationResponseRedirectUri,\n            },\n            { cause: error }\n          )\n        )\n      }\n\n      return sendUnknownServerErrorResponse(response, next, agentContext.config.logger, error, {\n        redirect_uri: authorizationResponseRedirectUri,\n      })\n    }\n  })\n}\n\nasync function getVerificationSession(\n  agentContext: AgentContext,\n  request: Request,\n  response: Response,\n  next: NextFunction,\n  verifier: OpenId4VcVerifierRecord\n): Promise<{ success: true; verificationSession: OpenId4VcVerificationSessionRecord } | { success: false }> {\n  const openId4VcVerificationSessionRepository = agentContext.dependencyManager.resolve(\n    OpenId4VcVerificationSessionRepository\n  )\n\n  try {\n    if (request.query.session) {\n      if (typeof request.query.session !== 'string') {\n        sendErrorResponse(\n          response,\n          next,\n          agentContext.config.logger,\n          400,\n          Oauth2ErrorCodes.InvalidRequest,\n          `Unexpected value for 'session' query param`\n        )\n        return { success: false }\n      }\n\n      const verificationSession = await openId4VcVerificationSessionRepository.findSingleByQuery(agentContext, {\n        verifierId: verifier.verifierId,\n        authorizationRequestId: request.query.session,\n      })\n\n      if (!verificationSession) {\n        sendErrorResponse(\n          response,\n          next,\n          agentContext.config.logger,\n          400,\n          Oauth2ErrorCodes.InvalidRequest,\n          `Invalid 'session' parameter`\n        )\n        return { success: false }\n      }\n\n      return { success: true, verificationSession }\n    }\n\n    const parsedResponse = zOpenid4vpAuthorizationResponse.safeParse(request.body)\n    if (parsedResponse.success) {\n      if (!parsedResponse.data.state) {\n        sendErrorResponse(\n          response,\n          next,\n          agentContext.config.logger,\n          400,\n          Oauth2ErrorCodes.InvalidRequest,\n          `Missing required 'state' parameter in response without response encryption`\n        )\n        return { success: false }\n      }\n\n      const verificationSession = await openId4VcVerificationSessionRepository.findSingleByQuery(agentContext, {\n        payloadState: parsedResponse.data.state,\n        verifierId: verifier.verifierId,\n      })\n\n      if (!verificationSession) {\n        sendErrorResponse(\n          response,\n          next,\n          agentContext.config.logger,\n          400,\n          Oauth2ErrorCodes.InvalidRequest,\n          `Invalid 'state' parameter`\n        )\n        return { success: false }\n      }\n\n      return { success: true, verificationSession }\n    }\n\n    // Try extracting apv (request nonce), which is used in encrypted responses (for ISO 18013-7/before draft 24)\n    if (typeof request.body === 'object' && 'response' in request.body) {\n      const { header } = decodeJwtHeader({\n        jwt: request.body.response,\n      })\n\n      if (!header.apv) {\n        sendErrorResponse(\n          response,\n          next,\n          agentContext.config.logger,\n          400,\n          Oauth2ErrorCodes.InvalidRequest,\n          `Missing 'session' query param or 'apv' value in header of encrypted JARM response.`\n        )\n        return { success: false }\n      }\n\n      if (typeof header.apv !== 'string') {\n        sendErrorResponse(\n          response,\n          next,\n          agentContext.config.logger,\n          400,\n          Oauth2ErrorCodes.InvalidRequest,\n          `'apv' value in header of encrypted JARM response is not of type string.`\n        )\n        return { success: false }\n      }\n\n      const nonce = TypedArrayEncoder.toUtf8String(TypedArrayEncoder.fromBase64(header.apv))\n      const verificationSession = await openId4VcVerificationSessionRepository.findSingleByQuery(agentContext, {\n        nonce,\n        verifierId: verifier.verifierId,\n      })\n\n      if (!verificationSession) {\n        sendErrorResponse(\n          response,\n          next,\n          agentContext.config.logger,\n          400,\n          Oauth2ErrorCodes.InvalidRequest,\n          `Invalid 'apv' parameter`\n        )\n        return { success: false }\n      }\n\n      return { success: true, verificationSession }\n    }\n\n    sendErrorResponse(\n      response,\n      next,\n      agentContext.config.logger,\n      400,\n      Oauth2ErrorCodes.InvalidRequest,\n      'Invalid response'\n    )\n    return { success: false }\n  } catch (error) {\n    sendUnknownServerErrorResponse(response, next, agentContext.config.logger, error)\n    return { success: false }\n  }\n}\n"],"mappings":";;;;;;;;;;;AAsBA,SAAgB,+BAA+B,QAAgB,QAAuC;AACpG,QAAO,KAAK,OAAO,uBAAuB,OAAO,SAAuC,UAAoB,SAAS;EACnH,MAAM,EAAE,cAAc,aAAa,kBAAkB,QAAQ;EAC7D,MAAM,2BAA2B,aAAa,kBAAkB,QAAQ,yBAAyB;EAEjG,IAAIA;AAEJ,MAAI;GACF,MAAM,SAAS,MAAM,uBAAuB,cAAc,SAAS,UAAU,MAAM,SAAS;AAG5F,OAAI,CAAC,OAAO,QAAS;AAErB,sCAAmC,OAAO,oBAAoB;GAE9D,MAAM,EAAE,wBAAwB,MAAM,yBAAyB,4BAA4B,cAAc;IACvG,uBAAuB,QAAQ;IAC/B,qBAAqB,OAAO;IAC7B,CAAC;AAEF,UAAO,iBAAiB,UAAU,MAAM;IAEtC,sCAAsC,oBAAoB;IAE1D,cAAc,oBAAoB;IACnC,CAAC;WACK,OAAO;AACd,OAAI,iBAAiB,gCAAgC;AACnD,UAAM,cAAc,eAAe;AACnC,WAAO,wBAAwB,UAAU,MAAM,aAAa,OAAO,QAAQ,MAAM;;AAInF,OAAI,iBAAiB,gBACnB,QAAO,wBACL,UACA,MACA,aAAa,OAAO,QACpB,IAAI,+BACF;IACE,OAAO,iBAAiB;IACxB,mBAAmB,MAAM;IACzB,cAAc;IACf,EACD,EAAE,OAAO,OAAO,CACjB,CACF;AAGH,UAAO,+BAA+B,UAAU,MAAM,aAAa,OAAO,QAAQ,OAAO,EACvF,cAAc,kCACf,CAAC;;GAEJ;;AAGJ,eAAe,uBACb,cACA,SACA,UACA,MACA,UAC0G;CAC1G,MAAM,yCAAyC,aAAa,kBAAkB,QAC5E,uCACD;AAED,KAAI;AACF,MAAI,QAAQ,MAAM,SAAS;AACzB,OAAI,OAAO,QAAQ,MAAM,YAAY,UAAU;AAC7C,sBACE,UACA,MACA,aAAa,OAAO,QACpB,KACA,iBAAiB,gBACjB,6CACD;AACD,WAAO,EAAE,SAAS,OAAO;;GAG3B,MAAM,sBAAsB,MAAM,uCAAuC,kBAAkB,cAAc;IACvG,YAAY,SAAS;IACrB,wBAAwB,QAAQ,MAAM;IACvC,CAAC;AAEF,OAAI,CAAC,qBAAqB;AACxB,sBACE,UACA,MACA,aAAa,OAAO,QACpB,KACA,iBAAiB,gBACjB,8BACD;AACD,WAAO,EAAE,SAAS,OAAO;;AAG3B,UAAO;IAAE,SAAS;IAAM;IAAqB;;EAG/C,MAAM,iBAAiB,gCAAgC,UAAU,QAAQ,KAAK;AAC9E,MAAI,eAAe,SAAS;AAC1B,OAAI,CAAC,eAAe,KAAK,OAAO;AAC9B,sBACE,UACA,MACA,aAAa,OAAO,QACpB,KACA,iBAAiB,gBACjB,6EACD;AACD,WAAO,EAAE,SAAS,OAAO;;GAG3B,MAAM,sBAAsB,MAAM,uCAAuC,kBAAkB,cAAc;IACvG,cAAc,eAAe,KAAK;IAClC,YAAY,SAAS;IACtB,CAAC;AAEF,OAAI,CAAC,qBAAqB;AACxB,sBACE,UACA,MACA,aAAa,OAAO,QACpB,KACA,iBAAiB,gBACjB,4BACD;AACD,WAAO,EAAE,SAAS,OAAO;;AAG3B,UAAO;IAAE,SAAS;IAAM;IAAqB;;AAI/C,MAAI,OAAO,QAAQ,SAAS,YAAY,cAAc,QAAQ,MAAM;GAClE,MAAM,EAAE,WAAW,gBAAgB,EACjC,KAAK,QAAQ,KAAK,UACnB,CAAC;AAEF,OAAI,CAAC,OAAO,KAAK;AACf,sBACE,UACA,MACA,aAAa,OAAO,QACpB,KACA,iBAAiB,gBACjB,qFACD;AACD,WAAO,EAAE,SAAS,OAAO;;AAG3B,OAAI,OAAO,OAAO,QAAQ,UAAU;AAClC,sBACE,UACA,MACA,aAAa,OAAO,QACpB,KACA,iBAAiB,gBACjB,0EACD;AACD,WAAO,EAAE,SAAS,OAAO;;GAG3B,MAAM,QAAQ,kBAAkB,aAAa,kBAAkB,WAAW,OAAO,IAAI,CAAC;GACtF,MAAM,sBAAsB,MAAM,uCAAuC,kBAAkB,cAAc;IACvG;IACA,YAAY,SAAS;IACtB,CAAC;AAEF,OAAI,CAAC,qBAAqB;AACxB,sBACE,UACA,MACA,aAAa,OAAO,QACpB,KACA,iBAAiB,gBACjB,0BACD;AACD,WAAO,EAAE,SAAS,OAAO;;AAG3B,UAAO;IAAE,SAAS;IAAM;IAAqB;;AAG/C,oBACE,UACA,MACA,aAAa,OAAO,QACpB,KACA,iBAAiB,gBACjB,mBACD;AACD,SAAO,EAAE,SAAS,OAAO;UAClB,OAAO;AACd,iCAA+B,UAAU,MAAM,aAAa,OAAO,QAAQ,MAAM;AACjF,SAAO,EAAE,SAAS,OAAO"}

package/build/openid4vc-verifier/router/authorizationRequestEndpoint.mjs

@@ -0,0 +1,39 @@
+import { OpenId4VcVerifierModuleConfig } from "../OpenId4VcVerifierModuleConfig.mjs";
+import { getRequestContext, sendErrorResponse, sendNotFoundResponse, sendUnknownServerErrorResponse } from "../../shared/router/context.mjs";
+import "../../shared/router/index.mjs";
+import { OpenId4VcVerificationSessionState } from "../OpenId4VcVerificationSessionState.mjs";
+import { OpenId4VpVerifierService } from "../OpenId4VpVerifierService.mjs";
+import { joinUriParts } from "@credo-ts/core";
+
+//#region src/openid4vc-verifier/router/authorizationRequestEndpoint.ts
+function configureAuthorizationRequestEndpoint(router, config) {
+	router.get(joinUriParts(config.authorizationRequestEndpoint, [":authorizationRequestId"]), async (request, response, next) => {
+		const { agentContext, verifier } = getRequestContext(request);
+		if (!request.params.authorizationRequestId || typeof request.params.authorizationRequestId !== "string") return sendErrorResponse(response, next, agentContext.config.logger, 400, "invalid_request", "Invalid authorization request url");
+		try {
+			const verifierService = agentContext.dependencyManager.resolve(OpenId4VpVerifierService);
+			const verifierConfig = agentContext.dependencyManager.resolve(OpenId4VcVerifierModuleConfig);
+			const fullAuthorizationRequestUri = joinUriParts(verifierConfig.baseUrl, [
+				verifier.verifierId,
+				verifierConfig.authorizationRequestEndpoint,
+				request.params.authorizationRequestId
+			]);
+			const [verificationSession] = await verifierService.findVerificationSessionsByQuery(agentContext, {
+				verifierId: verifier.verifierId,
+				$or: [{ authorizationRequestId: request.params.authorizationRequestId }, { authorizationRequestUri: fullAuthorizationRequestUri }]
+			});
+			if (!verificationSession || !verificationSession.authorizationRequestJwt) return sendErrorResponse(response, next, agentContext.config.logger, 404, "not_found", "Authorization request not found");
+			if (![OpenId4VcVerificationSessionState.RequestCreated, OpenId4VcVerificationSessionState.RequestUriRetrieved].includes(verificationSession.state)) return sendErrorResponse(response, next, agentContext.config.logger, 400, "invalid_request", "Invalid state for authorization request");
+			if (verificationSession.expiresAt && Date.now() > verificationSession.expiresAt.getTime()) return sendNotFoundResponse(response, next, agentContext.config.logger, "Session expired");
+			if (verificationSession.state !== OpenId4VcVerificationSessionState.RequestUriRetrieved) await verifierService.updateState(agentContext, verificationSession, OpenId4VcVerificationSessionState.RequestUriRetrieved);
+			response.type("application/oauth-authz-req+jwt").status(200).send(verificationSession.authorizationRequestJwt);
+			next();
+		} catch (error) {
+			return sendUnknownServerErrorResponse(response, next, agentContext.config.logger, error);
+		}
+	});
+}
+
+//#endregion
+export { configureAuthorizationRequestEndpoint };
+//# sourceMappingURL=authorizationRequestEndpoint.mjs.map

package/build/openid4vc-verifier/router/authorizationRequestEndpoint.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizationRequestEndpoint.mjs","names":[],"sources":["../../../src/openid4vc-verifier/router/authorizationRequestEndpoint.ts"],"sourcesContent":["import { joinUriParts } from '@credo-ts/core'\nimport type { Response, Router } from 'express'\nimport {\n  getRequestContext,\n  sendErrorResponse,\n  sendNotFoundResponse,\n  sendUnknownServerErrorResponse,\n} from '../../shared/router'\nimport { OpenId4VcVerificationSessionState } from '../OpenId4VcVerificationSessionState'\nimport { OpenId4VcVerifierModuleConfig } from '../OpenId4VcVerifierModuleConfig'\nimport { OpenId4VpVerifierService } from '../OpenId4VpVerifierService'\nimport type { OpenId4VcVerificationRequest } from './requestContext'\n\nexport function configureAuthorizationRequestEndpoint(router: Router, config: OpenId4VcVerifierModuleConfig) {\n  router.get(\n    joinUriParts(config.authorizationRequestEndpoint, [':authorizationRequestId']),\n    async (request: OpenId4VcVerificationRequest, response: Response, next) => {\n      const { agentContext, verifier } = getRequestContext(request)\n\n      if (!request.params.authorizationRequestId || typeof request.params.authorizationRequestId !== 'string') {\n        return sendErrorResponse(\n          response,\n          next,\n          agentContext.config.logger,\n          400,\n          'invalid_request',\n          'Invalid authorization request url'\n        )\n      }\n\n      try {\n        const verifierService = agentContext.dependencyManager.resolve(OpenId4VpVerifierService)\n        const verifierConfig = agentContext.dependencyManager.resolve(OpenId4VcVerifierModuleConfig)\n\n        // We always use shortened URIs currently\n        const fullAuthorizationRequestUri = joinUriParts(verifierConfig.baseUrl, [\n          verifier.verifierId,\n          verifierConfig.authorizationRequestEndpoint,\n          request.params.authorizationRequestId,\n        ])\n\n        const [verificationSession] = await verifierService.findVerificationSessionsByQuery(agentContext, {\n          verifierId: verifier.verifierId,\n          $or: [\n            {\n              authorizationRequestId: request.params.authorizationRequestId,\n            },\n            // NOTE: this can soon be removed, authorization request id is cleaner,\n            // but only introduced since 0.6\n            {\n              authorizationRequestUri: fullAuthorizationRequestUri,\n            },\n          ],\n        })\n\n        // Not all requets are signed, and those are not fetcheable\n        if (!verificationSession || !verificationSession.authorizationRequestJwt) {\n          return sendErrorResponse(\n            response,\n            next,\n            agentContext.config.logger,\n            404,\n            'not_found',\n            'Authorization request not found'\n          )\n        }\n\n        if (\n          ![\n            OpenId4VcVerificationSessionState.RequestCreated,\n            OpenId4VcVerificationSessionState.RequestUriRetrieved,\n          ].includes(verificationSession.state)\n        ) {\n          return sendErrorResponse(\n            response,\n            next,\n            agentContext.config.logger,\n            400,\n            'invalid_request',\n            'Invalid state for authorization request'\n          )\n        }\n\n        if (verificationSession.expiresAt && Date.now() > verificationSession.expiresAt.getTime()) {\n          return sendNotFoundResponse(response, next, agentContext.config.logger, 'Session expired')\n        }\n\n        // It's okay to retrieve the offer multiple times. So we only update the state if it's not already retrieved\n        if (verificationSession.state !== OpenId4VcVerificationSessionState.RequestUriRetrieved) {\n          await verifierService.updateState(\n            agentContext,\n            verificationSession,\n            OpenId4VcVerificationSessionState.RequestUriRetrieved\n          )\n        }\n\n        response.type('application/oauth-authz-req+jwt').status(200).send(verificationSession.authorizationRequestJwt)\n        next()\n      } catch (error) {\n        return sendUnknownServerErrorResponse(response, next, agentContext.config.logger, error)\n      }\n    }\n  )\n}\n"],"mappings":";;;;;;;;AAaA,SAAgB,sCAAsC,QAAgB,QAAuC;AAC3G,QAAO,IACL,aAAa,OAAO,8BAA8B,CAAC,0BAA0B,CAAC,EAC9E,OAAO,SAAuC,UAAoB,SAAS;EACzE,MAAM,EAAE,cAAc,aAAa,kBAAkB,QAAQ;AAE7D,MAAI,CAAC,QAAQ,OAAO,0BAA0B,OAAO,QAAQ,OAAO,2BAA2B,SAC7F,QAAO,kBACL,UACA,MACA,aAAa,OAAO,QACpB,KACA,mBACA,oCACD;AAGH,MAAI;GACF,MAAM,kBAAkB,aAAa,kBAAkB,QAAQ,yBAAyB;GACxF,MAAM,iBAAiB,aAAa,kBAAkB,QAAQ,8BAA8B;GAG5F,MAAM,8BAA8B,aAAa,eAAe,SAAS;IACvE,SAAS;IACT,eAAe;IACf,QAAQ,OAAO;IAChB,CAAC;GAEF,MAAM,CAAC,uBAAuB,MAAM,gBAAgB,gCAAgC,cAAc;IAChG,YAAY,SAAS;IACrB,KAAK,CACH,EACE,wBAAwB,QAAQ,OAAO,wBACxC,EAGD,EACE,yBAAyB,6BAC1B,CACF;IACF,CAAC;AAGF,OAAI,CAAC,uBAAuB,CAAC,oBAAoB,wBAC/C,QAAO,kBACL,UACA,MACA,aAAa,OAAO,QACpB,KACA,aACA,kCACD;AAGH,OACE,CAAC,CACC,kCAAkC,gBAClC,kCAAkC,oBACnC,CAAC,SAAS,oBAAoB,MAAM,CAErC,QAAO,kBACL,UACA,MACA,aAAa,OAAO,QACpB,KACA,mBACA,0CACD;AAGH,OAAI,oBAAoB,aAAa,KAAK,KAAK,GAAG,oBAAoB,UAAU,SAAS,CACvF,QAAO,qBAAqB,UAAU,MAAM,aAAa,OAAO,QAAQ,kBAAkB;AAI5F,OAAI,oBAAoB,UAAU,kCAAkC,oBAClE,OAAM,gBAAgB,YACpB,cACA,qBACA,kCAAkC,oBACnC;AAGH,YAAS,KAAK,kCAAkC,CAAC,OAAO,IAAI,CAAC,KAAK,oBAAoB,wBAAwB;AAC9G,SAAM;WACC,OAAO;AACd,UAAO,+BAA+B,UAAU,MAAM,aAAa,OAAO,QAAQ,MAAM;;GAG7F"}

package/build/openid4vc-verifier/router/index.mjs

@@ -0,0 +1 @@
+import { configureAuthorizationEndpoint } from "./authorizationEndpoint.mjs";

package/build/shared/callbacks.d.mts

@@ -0,0 +1,47 @@
+import { OpenId4VcIssuerRecord } from "../openid4vc-issuer/repository/OpenId4VcIssuerRecord.mjs";
+import "../openid4vc-issuer/repository/index.mjs";
+import { AgentContext, Kms } from "@credo-ts/core";
+import * as _openid4vc_oauth20 from "@openid4vc/oauth2";
+import { ClientAuthenticationCallback, DecryptJweCallback, EncryptJweCallback, SignJwtCallback, VerifyJwtCallback } from "@openid4vc/oauth2";
+
+//#region src/shared/callbacks.d.ts
+declare function getOid4vcJwtVerifyCallback(agentContext: AgentContext, options?: {
+  trustedCertificates?: string[];
+  issuanceSessionId?: string;
+  /**
+   * Whether this verification callback should assume a JAR authorization is verified
+   * Starting from OID4VP draft 24 the JAR must use oauth-authz-req+jwt header typ
+   * but for backwards compatiblity we need to also handle the case where the header typ is different
+   * @default false
+   */
+  isAuthorizationRequestJwt?: boolean;
+}): VerifyJwtCallback;
+declare function getOid4vcEncryptJweCallback(agentContext: AgentContext): EncryptJweCallback;
+declare function getOid4vcDecryptJweCallback(agentContext: AgentContext): DecryptJweCallback;
+declare function getOid4vcJwtSignCallback(agentContext: AgentContext): SignJwtCallback;
+declare function getOid4vcCallbacks(agentContext: AgentContext, options?: {
+  trustedCertificates?: string[];
+  isVerifyOpenId4VpAuthorizationRequest?: boolean;
+  issuanceSessionId?: string;
+}): {
+  hash: (data: Uint8Array<ArrayBufferLike>, alg: _openid4vc_oauth20.HashAlgorithm) => Uint8Array<ArrayBuffer>;
+  generateRandom: (length: number) => Kms.KmsRandomBytesReturn;
+  signJwt: SignJwtCallback;
+  clientAuthentication: () => never;
+  verifyJwt: VerifyJwtCallback;
+  fetch: typeof fetch;
+  encryptJwe: EncryptJweCallback;
+  decryptJwe: DecryptJweCallback;
+  getX509CertificateMetadata: (certificate: string) => {
+    sanDnsNames: string[];
+    sanUriNames: string[];
+  };
+};
+/**
+ * Allows us to authenticate when making requests to an external
+ * authorization server
+ */
+declare function dynamicOid4vciClientAuthentication(agentContext: AgentContext, issuerRecord: OpenId4VcIssuerRecord): ClientAuthenticationCallback;
+//#endregion
+export { dynamicOid4vciClientAuthentication, getOid4vcCallbacks, getOid4vcDecryptJweCallback, getOid4vcEncryptJweCallback, getOid4vcJwtSignCallback, getOid4vcJwtVerifyCallback };
+//# sourceMappingURL=callbacks.d.mts.map

package/build/shared/callbacks.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callbacks.d.mts","names":[],"sources":["../../src/shared/callbacks.ts"],"sourcesContent":[],"mappings":";;;;;;;iBA6BgB,0BAAA,eACA;;;;AADhB;AAgJA;AAyFA;AA4FA;AA8CA;EACgB,yBAAA,CAAA,EAAA,OAAA;IArWb;iBAiIa,2BAAA,eAA0C,eAAe;iBAyFzD,2BAAA,eAA0C,eAAe;iBA4FzD,wBAAA,eAAuC,eAAe;iBA8CtD,kBAAA,eACA;;;;;;;;EAsCA,oBAAA,EAAA,GAAA,GAAA,KAAA;EACA,SAAA,mBAAA;EACA,KAAA,EAAA,YAAA;EACb,UAAA,oBAAA;EAA4B,UAAA,oBAAA;;;;;;;;;;iBAHf,kCAAA,eACA,4BACA,wBACb"}