@glinr/theauth 0.4.2

package/dist/vc/index.js

@@ -0,0 +1,692 @@
+import { importJWK, jwtVerify, SignJWT, CompactSign, errors, compactVerify } from 'jose';
+import { z } from 'zod';
+
+// src/vc/audit-export.ts
+
+// src/crypto/web-crypto.ts
+function generateId() {
+  return globalThis.crypto.randomUUID();
+}
+new TextEncoder();
+var VC_CONTEXT_V2 = "https://www.w3.org/ns/credentials/v2";
+var VC_CONTEXT_V1 = "https://www.w3.org/2018/credentials/v1";
+var VC_TYPE_CREDENTIAL = "VerifiableCredential";
+var VC_TYPE_PRESENTATION = "VerifiablePresentation";
+var KAVACH_AGENT_CREDENTIAL = "KavachAgentCredential";
+var KAVACH_PERMISSION_CREDENTIAL = "KavachPermissionCredential";
+var KAVACH_DELEGATION_CREDENTIAL = "KavachDelegationCredential";
+var ProofSchema = z.object({
+  type: z.enum(["Ed25519Signature2020", "JsonWebSignature2020"]),
+  created: z.string(),
+  verificationMethod: z.string(),
+  proofPurpose: z.enum(["assertionMethod", "authentication"]),
+  proofValue: z.string().optional(),
+  jws: z.string().optional()
+});
+var CredentialStatusSchema = z.object({
+  id: z.string(),
+  type: z.string(),
+  statusPurpose: z.enum(["revocation", "suspension"]),
+  statusListIndex: z.number().int().nonnegative(),
+  statusListCredential: z.string()
+});
+var CredentialSubjectSchema = z.object({
+  id: z.string().optional(),
+  agentId: z.string().optional(),
+  permissions: z.array(z.string()).optional(),
+  trustLevel: z.number().min(0).max(1).optional(),
+  delegationScope: z.array(z.string()).optional(),
+  delegationChain: z.array(
+    z.object({
+      delegator: z.string(),
+      delegatee: z.string(),
+      permissions: z.array(z.string()),
+      createdAt: z.string()
+    })
+  ).optional(),
+  name: z.string().optional(),
+  type: z.string().optional()
+}).passthrough();
+var VerifiableCredentialSchema = z.object({
+  "@context": z.array(z.string()).min(1),
+  id: z.string().optional(),
+  type: z.array(z.string()).min(1),
+  issuer: z.union([z.string(), z.object({ id: z.string(), name: z.string().optional() })]),
+  issuanceDate: z.string(),
+  expirationDate: z.string().optional(),
+  credentialSubject: CredentialSubjectSchema,
+  credentialStatus: CredentialStatusSchema.optional(),
+  proof: ProofSchema.optional()
+});
+var VerifiablePresentationSchema = z.object({
+  "@context": z.array(z.string()).min(1),
+  id: z.string().optional(),
+  type: z.array(z.string()).min(1),
+  holder: z.string().optional(),
+  verifiableCredential: z.array(VerifiableCredentialSchema).min(1),
+  proof: ProofSchema.optional()
+});
+
+// src/vc/audit-export.ts
+var THEAUTH_AUDIT_CREDENTIAL = "TheAuthAuditCredential";
+var THEAUTH_AUDIT_CONTEXT = "https://theauth.com/contexts/audit/v1.jsonld";
+var THEAUTH_VERSION = "0.3.0";
+var DEFAULT_TTL_SECONDS = 86400;
+function toDecision(result) {
+  if (result === "allowed") return "allow";
+  return "deny";
+}
+function buildAuditCredential(record, issuerDid) {
+  const subject = {
+    id: record.id,
+    agentId: record.agentId,
+    ...record.userId ? { principalId: record.userId } : {},
+    operation: record.action,
+    target: record.resource,
+    decision: toDecision(record.result),
+    ...record.reason ? { policyName: record.reason } : {},
+    timestamp: record.timestamp.toISOString(),
+    theauthVersion: THEAUTH_VERSION
+  };
+  return {
+    "@context": [VC_CONTEXT_V2, THEAUTH_AUDIT_CONTEXT],
+    id: `urn:uuid:${generateId()}`,
+    type: [VC_TYPE_CREDENTIAL, THEAUTH_AUDIT_CREDENTIAL],
+    issuer: issuerDid,
+    issuanceDate: (/* @__PURE__ */ new Date()).toISOString(),
+    expirationDate: new Date(Date.now() + DEFAULT_TTL_SECONDS * 1e3).toISOString(),
+    // Cast: AuditCredentialSubject is intentionally wider than CredentialSubject
+    // because the VC schema uses an open-ended subject. The additional fields
+    // (operation, target, decision, etc.) are preserved via spread at runtime.
+    credentialSubject: subject
+  };
+}
+async function signAsJsonLd(credential, config) {
+  const { issuerDid, privateKeyJwk } = config;
+  const kid = `${issuerDid}#${issuerDid.split(":").pop() ?? "key-1"}`;
+  const key = await importJWK(privateKeyJwk, "EdDSA");
+  const { proof: _proof, ...vcWithoutProof } = credential;
+  const payload = new TextEncoder().encode(JSON.stringify(vcWithoutProof));
+  const jws = await new CompactSign(payload).setProtectedHeader({ alg: "EdDSA", kid }).sign(key);
+  const proof = {
+    type: "JsonWebSignature2020",
+    created: (/* @__PURE__ */ new Date()).toISOString(),
+    verificationMethod: kid,
+    proofPurpose: "assertionMethod",
+    jws
+  };
+  return { ...credential, proof };
+}
+async function signAsJwt(credential, config) {
+  const { issuerDid, privateKeyJwk } = config;
+  const ttl = config.defaultTtl ?? DEFAULT_TTL_SECONDS;
+  const kid = `${issuerDid}#${issuerDid.split(":").pop() ?? "key-1"}`;
+  const key = await importJWK(privateKeyJwk, "EdDSA");
+  const { proof: _proof, ...vcWithoutProof } = credential;
+  const builder = new SignJWT({ vc: vcWithoutProof }).setProtectedHeader({ alg: "EdDSA", kid, typ: "JWT" }).setIssuer(issuerDid).setIssuedAt().setExpirationTime(Math.floor(Date.now() / 1e3) + ttl);
+  if (credential.id) builder.setJti(credential.id);
+  if (credential.credentialSubject.id) builder.setSubject(credential.credentialSubject.id);
+  const jwt = await builder.sign(key);
+  return { credential, jwt };
+}
+async function signPresentationAsJsonLd(presentation, config) {
+  const { issuerDid, privateKeyJwk } = config;
+  const kid = `${issuerDid}#${issuerDid.split(":").pop() ?? "key-1"}`;
+  const key = await importJWK(privateKeyJwk, "EdDSA");
+  const { proof: _proof, ...vpWithoutProof } = presentation;
+  const payload = new TextEncoder().encode(JSON.stringify(vpWithoutProof));
+  const jws = await new CompactSign(payload).setProtectedHeader({ alg: "EdDSA", kid }).sign(key);
+  const proof = {
+    type: "JsonWebSignature2020",
+    created: (/* @__PURE__ */ new Date()).toISOString(),
+    verificationMethod: kid,
+    proofPurpose: "assertionMethod",
+    jws
+  };
+  return { ...presentation, proof };
+}
+async function exportAuditAsVC(options) {
+  const {
+    since,
+    until,
+    issuerDid,
+    issuerConfig,
+    format = "ldp_vc",
+    output = "individual",
+    filter,
+    records
+  } = options;
+  const inRange = records.filter((r) => {
+    const t = r.timestamp.getTime();
+    return t >= since.getTime() && t <= until.getTime();
+  });
+  const filtered = filter ? inRange.filter(filter) : inRange;
+  if (filtered.length === 0) {
+    return {
+      credentials: [],
+      format,
+      issuedAt: /* @__PURE__ */ new Date(),
+      count: 0
+    };
+  }
+  const credentials = [];
+  const jwts = [];
+  for (const record of filtered) {
+    const base = buildAuditCredential(record, issuerDid);
+    if (format === "jwt_vc") {
+      const { credential, jwt } = await signAsJwt(base, issuerConfig);
+      credentials.push(credential);
+      jwts.push(jwt);
+    } else {
+      const signed = await signAsJsonLd(base, issuerConfig);
+      credentials.push(signed);
+    }
+  }
+  const issuedAt = /* @__PURE__ */ new Date();
+  if (output === "individual") {
+    return {
+      credentials,
+      ...format === "jwt_vc" ? { jwts } : {},
+      format,
+      issuedAt,
+      count: credentials.length
+    };
+  }
+  const basePresentation = {
+    "@context": [VC_CONTEXT_V2, THEAUTH_AUDIT_CONTEXT],
+    id: `urn:uuid:${generateId()}`,
+    type: [VC_TYPE_PRESENTATION],
+    holder: issuerDid,
+    verifiableCredential: credentials
+  };
+  const presentation = format === "jwt_vc" ? basePresentation : await signPresentationAsJsonLd(basePresentation, issuerConfig);
+  return {
+    credentials,
+    ...format === "jwt_vc" ? { jwts } : {},
+    presentation,
+    format,
+    issuedAt,
+    count: credentials.length
+  };
+}
+function listAuditRecords(records, since, until, filter) {
+  const inRange = records.filter((r) => {
+    const t = r.timestamp.getTime();
+    return t >= since.getTime() && t <= until.getTime();
+  });
+  return filter ? inRange.filter(filter) : inRange;
+}
+var DEFAULT_TTL_SECONDS2 = 86400;
+function makeError(code, message, details) {
+  return { code, message, ...{} };
+}
+function nowISO() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function futureISO(seconds) {
+  return new Date(Date.now() + seconds * 1e3).toISOString();
+}
+function createVCIssuer(config) {
+  const { issuerDid, privateKeyJwk, defaultTtl = DEFAULT_TTL_SECONDS2 } = config;
+  const kid = `${issuerDid}#${issuerDid.split(":").pop() ?? "key-1"}`;
+  async function signAsJwt2(credential, subject, ttl) {
+    try {
+      const key = await importJWK(privateKeyJwk, "EdDSA");
+      const { proof: _proof, ...vcWithoutProof } = credential;
+      const builder = new SignJWT({
+        vc: vcWithoutProof
+      }).setProtectedHeader({ alg: "EdDSA", kid, typ: "JWT" }).setIssuer(issuerDid).setIssuedAt().setExpirationTime(Math.floor(Date.now() / 1e3) + ttl);
+      if (credential.id) {
+        builder.setJti(credential.id);
+      }
+      if (subject) {
+        builder.setSubject(subject);
+      }
+      const jwt = await builder.sign(key);
+      return { success: true, data: { credential, jwt } };
+    } catch (err) {
+      return {
+        success: false,
+        error: makeError(
+          "VC_SIGN_FAILED",
+          err instanceof Error ? err.message : "Failed to sign credential as JWT"
+        )
+      };
+    }
+  }
+  async function signAsJsonLd2(credential) {
+    try {
+      const key = await importJWK(privateKeyJwk, "EdDSA");
+      const { proof: _proof, ...vcWithoutProof } = credential;
+      const payload = new TextEncoder().encode(JSON.stringify(vcWithoutProof));
+      const { CompactSign: CompactSign2 } = await import('jose');
+      const jws = await new CompactSign2(payload).setProtectedHeader({ alg: "EdDSA", kid }).sign(key);
+      const proof = {
+        type: "JsonWebSignature2020",
+        created: nowISO(),
+        verificationMethod: kid,
+        proofPurpose: "assertionMethod",
+        jws
+      };
+      const signedCredential = {
+        ...credential,
+        proof
+      };
+      return { success: true, data: { credential: signedCredential } };
+    } catch (err) {
+      return {
+        success: false,
+        error: makeError(
+          "VC_SIGN_FAILED",
+          err instanceof Error ? err.message : "Failed to sign credential as JSON-LD"
+        )
+      };
+    }
+  }
+  function buildCredential(types, subject, ttl, expirationDate) {
+    return {
+      "@context": [VC_CONTEXT_V2],
+      id: `urn:uuid:${generateId()}`,
+      type: [VC_TYPE_CREDENTIAL, ...types],
+      issuer: issuerDid,
+      issuanceDate: nowISO(),
+      expirationDate: futureISO(ttl),
+      credentialSubject: subject
+    };
+  }
+  async function signCredential(credential, subject, ttl, format) {
+    if (format === "jwt") {
+      return signAsJwt2(credential, subject, ttl);
+    }
+    return signAsJsonLd2(credential);
+  }
+  async function issueAgentCredential(input) {
+    const {
+      agentId,
+      name,
+      agentType,
+      permissions,
+      trustLevel,
+      ttl = defaultTtl,
+      format = "jwt"
+    } = input;
+    if (!agentId) {
+      return {
+        success: false,
+        error: makeError("VC_INVALID_INPUT", "agentId is required")
+      };
+    }
+    if (trustLevel !== void 0 && (trustLevel < 0 || trustLevel > 1)) {
+      return {
+        success: false,
+        error: makeError("VC_INVALID_INPUT", "trustLevel must be between 0 and 1")
+      };
+    }
+    const subject = {
+      id: agentId,
+      agentId,
+      ...name !== void 0 ? { name } : {},
+      ...agentType !== void 0 ? { type: agentType } : {},
+      ...permissions !== void 0 ? { permissions } : {},
+      ...trustLevel !== void 0 ? { trustLevel } : {}
+    };
+    const credential = buildCredential([KAVACH_AGENT_CREDENTIAL], subject, ttl);
+    return signCredential(credential, agentId, ttl, format);
+  }
+  async function issuePermissionCredential(input) {
+    const { agentId, permissions, ttl = defaultTtl, format = "jwt" } = input;
+    if (!agentId) {
+      return {
+        success: false,
+        error: makeError("VC_INVALID_INPUT", "agentId is required")
+      };
+    }
+    if (!permissions || permissions.length === 0) {
+      return {
+        success: false,
+        error: makeError("VC_INVALID_INPUT", "At least one permission is required")
+      };
+    }
+    const subject = {
+      id: agentId,
+      agentId,
+      permissions
+    };
+    const credential = buildCredential([KAVACH_PERMISSION_CREDENTIAL], subject, ttl);
+    return signCredential(credential, agentId, ttl, format);
+  }
+  async function issueDelegationCredential(input) {
+    const { agentId, chain, delegationScope, ttl = defaultTtl, format = "jwt" } = input;
+    if (!agentId) {
+      return {
+        success: false,
+        error: makeError("VC_INVALID_INPUT", "agentId is required")
+      };
+    }
+    if (!chain || chain.length === 0) {
+      return {
+        success: false,
+        error: makeError("VC_INVALID_INPUT", "Delegation chain must have at least one link")
+      };
+    }
+    const subject = {
+      id: agentId,
+      agentId,
+      delegationChain: chain,
+      ...delegationScope !== void 0 ? { delegationScope } : {}
+    };
+    const credential = buildCredential([KAVACH_DELEGATION_CREDENTIAL], subject, ttl);
+    return signCredential(credential, agentId, ttl, format);
+  }
+  return {
+    issueAgentCredential,
+    issuePermissionCredential,
+    issueDelegationCredential,
+    issuerDid
+  };
+}
+function makeError2(code, message, details) {
+  return { code, message, ...details !== void 0 ? { details } : {} };
+}
+function getIssuerString(issuer) {
+  if (typeof issuer === "string") return issuer;
+  return issuer.id;
+}
+function createVCVerifier(config = {}) {
+  const { resolveDidKey, checkRevocationStatus } = config;
+  async function resolveKey(did, providedKey) {
+    if (providedKey) {
+      return { success: true, data: providedKey };
+    }
+    if (resolveDidKey) {
+      const resolved = await resolveDidKey(did);
+      if (resolved) {
+        return { success: true, data: resolved };
+      }
+    }
+    return {
+      success: false,
+      error: makeError2("VC_KEY_NOT_FOUND", `Could not resolve public key for DID: ${did}`)
+    };
+  }
+  async function verifyJwtCredential(jwt, providedKey) {
+    try {
+      const parts = jwt.split(".");
+      if (parts.length !== 3) {
+        return {
+          success: false,
+          error: makeError2("VC_INVALID_JWT", "JWT must have three parts")
+        };
+      }
+      const payloadB64 = parts[1];
+      if (!payloadB64) {
+        return {
+          success: false,
+          error: makeError2("VC_INVALID_JWT", "JWT payload is missing")
+        };
+      }
+      const rawPayload = JSON.parse(
+        new TextDecoder().decode(
+          Uint8Array.from(
+            atob(payloadB64.replace(/-/g, "+").replace(/_/g, "/")),
+            (c) => c.charCodeAt(0)
+          )
+        )
+      );
+      const issuerDid = typeof rawPayload.iss === "string" ? rawPayload.iss : null;
+      if (!issuerDid) {
+        return {
+          success: false,
+          error: makeError2("VC_NO_ISSUER", "JWT has no iss claim")
+        };
+      }
+      const keyResult = await resolveKey(issuerDid, providedKey);
+      if (!keyResult.success) return keyResult;
+      const publicKey = await importJWK(keyResult.data, "EdDSA");
+      const { payload } = await jwtVerify(jwt, publicKey);
+      const vcClaim = payload.vc;
+      if (!vcClaim) {
+        return {
+          success: false,
+          error: makeError2("VC_MISSING_VC_CLAIM", "JWT does not contain a vc claim")
+        };
+      }
+      const credential = {
+        ...vcClaim,
+        issuer: issuerDid
+      };
+      const parsed = VerifiableCredentialSchema.safeParse(credential);
+      if (!parsed.success) {
+        return {
+          success: false,
+          error: makeError2("VC_INVALID_CREDENTIAL", "Credential does not match W3C schema", {
+            issues: parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`)
+          })
+        };
+      }
+      if (payload.exp && payload.exp < Math.floor(Date.now() / 1e3)) {
+        return {
+          success: false,
+          error: makeError2("VC_EXPIRED", "Credential has expired")
+        };
+      }
+      if (parsed.data.credentialStatus && checkRevocationStatus) {
+        const revoked = await checkRevocationStatus(parsed.data.credentialStatus);
+        if (revoked) {
+          return {
+            success: false,
+            error: makeError2("VC_REVOKED", "Credential has been revoked")
+          };
+        }
+      }
+      return {
+        success: true,
+        data: {
+          credential: parsed.data,
+          format: "jwt",
+          issuer: issuerDid,
+          issuedAt: new Date((payload.iat ?? 0) * 1e3),
+          expiresAt: payload.exp ? new Date(payload.exp * 1e3) : null
+        }
+      };
+    } catch (err) {
+      if (err instanceof errors.JWTExpired) {
+        return {
+          success: false,
+          error: makeError2("VC_EXPIRED", "Credential has expired")
+        };
+      }
+      return {
+        success: false,
+        error: makeError2(
+          "VC_VERIFY_FAILED",
+          err instanceof Error ? err.message : "Failed to verify JWT credential"
+        )
+      };
+    }
+  }
+  async function verifyJsonLdCredential(vc, providedKey) {
+    const parsed = VerifiableCredentialSchema.safeParse(vc);
+    if (!parsed.success) {
+      return {
+        success: false,
+        error: makeError2("VC_INVALID_CREDENTIAL", "Credential does not match W3C schema", {
+          issues: parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`)
+        })
+      };
+    }
+    const credential = parsed.data;
+    if (!credential.proof) {
+      return {
+        success: false,
+        error: makeError2("VC_NO_PROOF", "JSON-LD credential has no embedded proof")
+      };
+    }
+    if (!credential.proof.jws) {
+      return {
+        success: false,
+        error: makeError2("VC_NO_JWS", "Proof does not contain a JWS value")
+      };
+    }
+    const issuerDid = getIssuerString(credential.issuer);
+    const keyResult = await resolveKey(issuerDid, providedKey);
+    if (!keyResult.success) return keyResult;
+    try {
+      const publicKey = await importJWK(keyResult.data, "EdDSA");
+      const { payload } = await compactVerify(credential.proof.jws, publicKey);
+      const { proof: _proof, ...vcWithoutProof } = credential;
+      const signedContent = new TextDecoder().decode(payload);
+      const currentContent = JSON.stringify(vcWithoutProof);
+      if (signedContent !== currentContent) {
+        return {
+          success: false,
+          error: makeError2("VC_TAMPERED", "Credential content does not match the signed payload")
+        };
+      }
+      if (credential.expirationDate) {
+        const expiry = new Date(credential.expirationDate);
+        if (expiry <= /* @__PURE__ */ new Date()) {
+          return {
+            success: false,
+            error: makeError2("VC_EXPIRED", "Credential has expired")
+          };
+        }
+      }
+      if (credential.credentialStatus && checkRevocationStatus) {
+        const revoked = await checkRevocationStatus(credential.credentialStatus);
+        if (revoked) {
+          return {
+            success: false,
+            error: makeError2("VC_REVOKED", "Credential has been revoked")
+          };
+        }
+      }
+      return {
+        success: true,
+        data: {
+          credential,
+          format: "json-ld",
+          issuer: issuerDid,
+          issuedAt: new Date(credential.issuanceDate),
+          expiresAt: credential.expirationDate ? new Date(credential.expirationDate) : null
+        }
+      };
+    } catch (err) {
+      return {
+        success: false,
+        error: makeError2(
+          "VC_VERIFY_FAILED",
+          err instanceof Error ? err.message : "Failed to verify JSON-LD credential"
+        )
+      };
+    }
+  }
+  async function verifyCredential(vc, publicKeyJwk) {
+    if (typeof vc === "string") {
+      return verifyJwtCredential(vc, publicKeyJwk);
+    }
+    return verifyJsonLdCredential(vc, publicKeyJwk);
+  }
+  async function verifyPresentation(vp, publicKeyJwk) {
+    let presentation;
+    if (typeof vp === "string") {
+      try {
+        const parts = vp.split(".");
+        if (parts.length !== 3 || !parts[1]) {
+          return {
+            success: false,
+            error: makeError2("VC_INVALID_JWT", "Presentation JWT must have three parts")
+          };
+        }
+        const payloadB64 = parts[1];
+        const rawPayload = JSON.parse(
+          new TextDecoder().decode(
+            Uint8Array.from(
+              atob(payloadB64.replace(/-/g, "+").replace(/_/g, "/")),
+              (c) => c.charCodeAt(0)
+            )
+          )
+        );
+        const issuerDid = typeof rawPayload.iss === "string" ? rawPayload.iss : null;
+        if (!issuerDid) {
+          return {
+            success: false,
+            error: makeError2("VC_NO_ISSUER", "Presentation JWT has no iss claim")
+          };
+        }
+        const keyResult = await resolveKey(issuerDid, publicKeyJwk);
+        if (!keyResult.success) return keyResult;
+        const publicKey = await importJWK(keyResult.data, "EdDSA");
+        const { payload } = await jwtVerify(vp, publicKey);
+        const vpClaim = payload.vp;
+        if (!vpClaim) {
+          return {
+            success: false,
+            error: makeError2("VC_MISSING_VP_CLAIM", "JWT does not contain a vp claim")
+          };
+        }
+        presentation = vpClaim;
+      } catch (err) {
+        return {
+          success: false,
+          error: makeError2(
+            "VC_VERIFY_FAILED",
+            err instanceof Error ? err.message : "Failed to verify presentation JWT"
+          )
+        };
+      }
+    } else {
+      presentation = vp;
+    }
+    const parsed = VerifiablePresentationSchema.safeParse(presentation);
+    if (!parsed.success) {
+      return {
+        success: false,
+        error: makeError2("VC_INVALID_PRESENTATION", "Presentation does not match W3C schema", {
+          issues: parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`)
+        })
+      };
+    }
+    const verifiedCredentials = [];
+    for (const vc of parsed.data.verifiableCredential) {
+      const result = await verifyCredential(vc, publicKeyJwk);
+      if (!result.success) {
+        return {
+          success: false,
+          error: makeError2(
+            "VC_PRESENTATION_CREDENTIAL_INVALID",
+            `Failed to verify credential in presentation: ${result.error.message}`,
+            { originalError: result.error }
+          )
+        };
+      }
+      verifiedCredentials.push(result.data);
+    }
+    return {
+      success: true,
+      data: {
+        presentation: parsed.data,
+        credentials: verifiedCredentials,
+        holder: parsed.data.holder ?? null
+      }
+    };
+  }
+  function extractPermissions(vc) {
+    const subject = vc.credentialSubject;
+    return {
+      agentId: subject.agentId ?? subject.id ?? null,
+      permissions: subject.permissions ?? [],
+      trustLevel: subject.trustLevel ?? null,
+      delegationScope: subject.delegationScope ?? []
+    };
+  }
+  return {
+    verifyCredential,
+    verifyPresentation,
+    extractPermissions
+  };
+}
+
+export { CredentialStatusSchema, CredentialSubjectSchema, KAVACH_AGENT_CREDENTIAL, KAVACH_DELEGATION_CREDENTIAL, KAVACH_PERMISSION_CREDENTIAL, ProofSchema, THEAUTH_AUDIT_CONTEXT, THEAUTH_AUDIT_CREDENTIAL, VC_CONTEXT_V1, VC_CONTEXT_V2, VC_TYPE_CREDENTIAL, VC_TYPE_PRESENTATION, VerifiableCredentialSchema, VerifiablePresentationSchema, createVCIssuer, createVCVerifier, exportAuditAsVC, listAuditRecords };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map