@ixo/credentials-kit 0.0.0-stage → 0.1.0

package/dist/oid4vp.d.ts

@@ -0,0 +1,416 @@
+import { DidResolver } from './did.js';
+import { CredentialsKitError } from './index.js';
+import { F as FetchLike } from './http-BhuJ_-RZ.js';
+import { HostPolicy } from './did.js';
+import { Signer } from './jose.js';
+import { DcqlQuerySummary } from './profile.js';
+import { ParsedSdJwt } from './sdjwt.js';
+import { VerifyFailureCode, VerifiedPresentation, VerifyPolicy, VerifyDeps } from './verify.js';
+import './util-DOTEZgTt.js';
+import './display.js';
+
+interface P256PublicJwk {
+    kty: 'EC';
+    crv: 'P-256';
+    x: string;
+    y: string;
+    kid?: string;
+    use?: 'enc';
+    alg?: 'ECDH-ES';
+}
+interface P256PrivateJwk extends P256PublicJwk {
+    d: string;
+}
+/** The content encryption algorithms supported, strongest first. */
+declare const JWE_ENCS: readonly ["A256GCM", "A128GCM"];
+type JweEnc = (typeof JWE_ENCS)[number];
+
+/**
+ * `@ixo/credentials-kit/oid4vp` — OpenID for Verifiable Presentations 1.0, as profiled by
+ * SPEC §3 and §13.3:
+ *
+ * - signed request object (`typ: oauth-authz-req+jwt`, `alg` `EdDSA`; `Ed25519` accepted) with
+ *   `client_id = decentralized_identifier:<did>`, signed by a key of that DID named by `kid`
+ *   (OpenID4VP §5.9.3). The kit's verifier emits `aud: https://self-issued.me/v2` (§5.8, static
+ *   discovery), `iat` and `exp`; the kit's wallet accepts request objects without `aud`, `iat` or
+ *   `exp` (the spec's own examples have none) and enforces each one that is present;
+ * - `response_type: vp_token`, `response_mode: direct_post` or `direct_post.jwt` (§8.2, §8.3.1);
+ * - a DCQL subset: credential queries of format `dc+sd-jwt` with `meta.vct_values`, optional
+ *   one-segment claim paths with optional `values`, and `path: ['iss']` + `values` as the
+ *   accepted-issuer filter. Unknown members are ignored (§6), duplicate claim queries are
+ *   dropped, `multiple: true` is answered with one presentation. `credential_sets`,
+ *   `claim_sets`, `trusted_authorities`, multi-segment paths and other formats are refused with
+ *   `unsupported_request` (and `error.feature`), which the wallet reports to the verifier with
+ *   `sendAuthorizationError` (§8.5);
+ * - `vp_token`: `{ <query id>: [<SD-JWT+KB>] }`;
+ * - encrypted responses: an unsigned JWE (`ECDH-ES`, P-256, `enc` `A128GCM` — the spec default —
+ *   or `A256GCM`, chosen from the verifier's `encrypted_response_enc_values_supported`) to the key
+ *   in `client_metadata.jwks` whose payload is the response parameters (§8.3); the form body is
+ *   `response=<jwe>`;
+ * - wallet invocation: `buildWalletLink` / `parseWalletLink`
+ *   (`openid4vp://?client_id=…&request_uri=…`, §5.10.1, §9).
+ */
+
+/** Static-discovery audience of a request object (OpenID4VP §5.8). */
+declare const SELF_ISSUED_AUDIENCE = "https://self-issued.me/v2";
+/** The `enc` the kit prefers when the verifier offers it. */
+declare const RESPONSE_ENCRYPTION_ENC = "A256GCM";
+/** `enc` values the kit can produce and decrypt, in the wallet's order of preference. */
+declare const RESPONSE_ENCRYPTION_ENCS: readonly JweEnc[];
+/** The `enc` a wallet must use when the verifier lists none (OpenID4VP §8.3). */
+declare const DEFAULT_RESPONSE_ENCRYPTION_ENC: JweEnc;
+/** Most credential queries / claims per query the kit accepts. */
+declare const MAX_CREDENTIAL_QUERIES = 16;
+declare const MAX_CLAIMS_PER_QUERY = 64;
+/** Largest request object accepted (64 KiB). */
+declare const MAX_REQUEST_OBJECT_LENGTH: number;
+/** Largest response body accepted (256 KiB). */
+declare const MAX_RESPONSE_BODY_LENGTH: number;
+/** Longest lifetime of a request object the wallet accepts (from `iat`, or from now). */
+declare const MAX_REQUEST_LIFETIME_SECONDS: number;
+type ResponseMode = 'direct_post' | 'direct_post.jwt';
+type Oid4vpErrorCode = 'malformed_request' | 'wrong_type' | 'unsupported_client_id' | 'unknown_verifier' | 'unknown_key' | 'bad_signature' | 'expired' | 'unsupported_request' | 'unsupported_response_mode' | 'insecure_response_uri'
+/** No longer thrown (DCQL problems are `malformed_request` / `unsupported_request`). */
+ | 'unsupported_query' | 'unsupported_encryption' | 'malformed_response' | 'decryption_failed' | 'wallet_error' | 'state_mismatch';
+/**
+ * Where a wallet may send an error response for a request whose signature it verified (the
+ * fields of `AuthorizationRequest` that `sendAuthorizationError` needs).
+ */
+interface AuthorizationErrorTarget {
+    clientId: string;
+    responseUri: string;
+    responseMode: ResponseMode;
+    state?: string;
+    /** Present when the error can be encrypted (`direct_post.jwt` with a usable key). */
+    responseEncryptionJwk?: P256PublicJwk;
+    responseEncryptionEnc?: JweEnc;
+}
+declare class Oid4vpError extends CredentialsKitError {
+    readonly code: Oid4vpErrorCode;
+    /** For `wallet_error`: the OAuth error code the wallet sent (e.g. `access_denied`). */
+    readonly walletError?: string;
+    /**
+     * For `unsupported_request`: the feature refused (`credential_sets`, `claim_sets`,
+     * `trusted_authorities`, `nested_path`, `format`, `registered_claim`, `transaction_data`,
+     * `scope`, `response_type`, `request_uri_method`, `request`, `too_many_queries`,
+     * `too_many_claims`).
+     */
+    readonly feature?: string;
+    /**
+     * Set only when the request object's signature verified and its response URI is usable: the
+     * wallet may tell the verifier with `sendAuthorizationError({ target: error.errorTarget, … })`
+     * (OpenID4VP §8.5). Never set for a request that did not verify.
+     */
+    readonly errorTarget?: AuthorizationErrorTarget;
+    constructor(code: Oid4vpErrorCode, walletError?: string, extra?: {
+        feature?: string;
+        errorTarget?: AuthorizationErrorTarget;
+    });
+}
+interface DcqlClaimQuery {
+    id?: string;
+    /** One claim name (one-segment path). */
+    path: [string];
+    values?: (string | number | boolean)[];
+}
+interface DcqlCredentialQuery {
+    id: string;
+    format: 'dc+sd-jwt';
+    meta: {
+        vct_values: string[];
+    };
+    claims?: DcqlClaimQuery[];
+    /** Absent means true (DCQL §6.1). The kit's wallet always presents with key binding. */
+    require_cryptographic_holder_binding?: boolean;
+    /** `true` is accepted and answered with one presentation. */
+    multiple?: boolean;
+}
+interface DcqlQuery {
+    credentials: DcqlCredentialQuery[];
+}
+/**
+ * Validate a DCQL query against the profile's subset and return it in normal form (unknown
+ * members dropped, per DCQL §6 "MUST ignore any unknown properties"; duplicate claim queries
+ * dropped). Throws `Oid4vpError('malformed_request')` for an invalid query and
+ * `Oid4vpError('unsupported_request')` (with `feature`) for a valid one the profile does not
+ * answer.
+ */
+declare function validateDcql(dcql: unknown): DcqlQuery;
+/** What each credential query asks for, for consent screens and catalogs. Validates first. */
+declare function summarizeDcql(dcql: unknown): DcqlQuerySummary[];
+type MatchFailure = 'unsupported_query' | 'wrong_format' | 'wrong_type' | 'untrusted_issuer' | 'missing_claim' | 'value_mismatch' | 'no_holder_binding';
+type MatchResult = {
+    ok: true;
+    disclose: string[];
+} | {
+    ok: false;
+    reason: MatchFailure;
+};
+/**
+ * Whether a held credential (parsed, without KB) answers one credential query, and which
+ * selectively disclosable top-level claims to disclose for it (in query order). Plaintext claims
+ * are matched but never listed. Value restrictions are applied (DCQL §6.4.1). A requested claim
+ * whose value is an object with nested disclosures is disclosed at the top level only (nested
+ * disclosures are not released: one-segment paths only).
+ */
+declare function matchCredential(query: unknown, parsed: ParsedSdJwt): MatchResult;
+/** A fresh P-256 key pair for `direct_post.jwt` (keep `privateJwk` with the request). */
+declare function generateResponseKeyPair(): Promise<{
+    publicJwk: P256PublicJwk;
+    privateJwk: P256PrivateJwk;
+}>;
+interface CreateAuthorizationRequestInput {
+    /** Signs with a key of `clientDid`; `signer.kid` must be a DID URL of `clientDid`. */
+    signer: Signer;
+    clientDid: string;
+    /** Where the wallet POSTs the response (https on a public host; see `allowHttp`/`allowLocal`). */
+    responseUri: string;
+    /** Fresh, random, at least 16 URL-safe characters (OpenID4VP §5.2). */
+    nonce: string;
+    /** URL-safe characters only (OpenID4VP §5.2). */
+    state: string;
+    dcql: DcqlQuery;
+    /**
+     * When given, `response_mode` is `direct_post.jwt` and the response is encrypted to it; the
+     * request lists `A256GCM` and `A128GCM`, both of which `parseAuthorizationResponse` decrypts.
+     */
+    responseEncryptionJwk?: P256PublicJwk;
+    /** Expiry, unix seconds. */
+    exp: number;
+    /** ms since the epoch (for `iat`); default `Date.now()`. */
+    now?: number;
+    /** Allow an http `responseUri` on a loopback host (local development only; needs `allowLocal`). */
+    allowHttp?: boolean;
+    /** Allow a `responseUri` on a loopback / private / local-name host (local development only). */
+    allowLocal?: boolean;
+}
+/** A signed OpenID4VP request object (compact JWS). */
+declare function createAuthorizationRequest(input: CreateAuthorizationRequestInput): Promise<string>;
+interface WalletLink {
+    /** The full client_id, to compare with the request object's (`expectedClientId`). */
+    clientId: string;
+    requestUri: string;
+}
+/**
+ * The standard Authorization Request a non-Hub wallet opens: `openid4vp://?client_id=<…>&
+ * request_uri=<…>` (both URL-encoded, no `request_uri_method`: GET). `scheme` is a custom scheme
+ * (`openid4vp://`, `haip://`, …) or an https base URL (a wallet's universal link) without query
+ * or fragment.
+ */
+declare function buildWalletLink(input: {
+    clientId: string;
+    requestUri: string;
+    scheme?: string;
+}): string;
+/**
+ * Read a wallet link (`openid4vp://?client_id=…&request_uri=…`, or the same query on an https
+ * URL). Throws `Oid4vpError('malformed_request')` when `client_id` or `request_uri` is missing or
+ * repeated, or when `request_uri` fails the kit's URL rules (`isFetchableUrl`: https on a public
+ * host, no credentials or fragment; `opts.allowHttp` / `opts.allowLocal` for local development
+ * only), and `unsupported_request` for a request by value (`request`) or
+ * `request_uri_method=post`. Fetch the request object with no redirects and a timeout, then pass
+ * `clientId` as `expectedClientId` to `verifyAuthorizationRequest` (§5.10.1: they MUST be
+ * identical).
+ */
+declare function parseWalletLink(link: string, opts?: HostPolicy): WalletLink;
+interface AuthorizationRequest {
+    /** The request object as received. */
+    jwt: string;
+    /** The full client_id (`decentralized_identifier:<did>`): the KB-JWT `aud`. */
+    clientId: string;
+    clientDid: string;
+    /** The verification method that signed the request. */
+    kid: string;
+    responseUri: string;
+    responseMode: ResponseMode;
+    nonce: string;
+    state?: string;
+    dcql: DcqlQuery;
+    /** The key the response must be encrypted to (`direct_post.jwt`). */
+    responseEncryptionJwk?: P256PublicJwk;
+    /** The `enc` the wallet uses for `direct_post.jwt` (chosen from the verifier's list). */
+    responseEncryptionEnc?: JweEnc;
+    /** unix seconds; absent when the request object has no `exp`. */
+    exp?: number;
+    iat?: number;
+}
+interface VerifyAuthorizationRequestOptions {
+    resolver: DidResolver;
+    /** ms since the epoch; default `Date.now()`. */
+    now?: number;
+    /** Accept an http `response_uri` on a loopback host (local development only; needs `allowLocal`). */
+    allowHttp?: boolean;
+    /** Accept a `response_uri` on a loopback / private / local-name host (local development only). */
+    allowLocal?: boolean;
+    /**
+     * The `client_id` of the Authorization Request that pointed here (`parseWalletLink`): the
+     * request object's must be identical (§5.10.1), else `malformed_request`.
+     */
+    expectedClientId?: string;
+    /** Refuse a request object without `exp` (the Credentials worker's deposit rule). Default false. */
+    requireExpiry?: boolean;
+}
+/**
+ * Verify a request object as a wallet (or the Credentials worker) must before acting on it:
+ * typ, client_id (and `expectedClientId`), `aud`/`iat`/`exp` when present (lifetime at most
+ * 24 h), the signature by a key of the client_id DID named by `kid` (listed under
+ * `authentication` or `assertionMethod`, controlled by that DID), then the supported response
+ * mode, a public https response URI, nonce and state, encryption parameters and DCQL. Throws
+ * `Oid4vpError` (with `errorTarget` when the verifier can be told, see `sendAuthorizationError`);
+ * `ResolverUnavailable` propagates.
+ */
+declare function verifyAuthorizationRequest(jwt: string, opts: VerifyAuthorizationRequestOptions): Promise<AuthorizationRequest>;
+/**
+ * The request a verifier created, read back from its own JWT WITHOUT checking the signature or
+ * the clock (use only for a request object you produced and stored yourself).
+ */
+declare function decodeOwnAuthorizationRequest(jwt: string, opts?: HostPolicy): AuthorizationRequest;
+interface CreatePresentationInput {
+    /** The held SD-JWT (as issued: `<jwt>~<disclosures>~`). */
+    sdjwt: string;
+    /** Claim names to disclose (from `matchCredential`). */
+    disclose: readonly string[];
+    /** The holder key the credential's `cnf` names. */
+    signer: Pick<Signer, 'sign'>;
+    /** The verifier's full client_id. */
+    audience: string;
+    nonce: string;
+    /** ms since the epoch; default `Date.now()`. */
+    now?: number;
+}
+/** An SD-JWT+KB with only the chosen disclosures and a fresh KB-JWT (RFC 9901 §4.3). */
+declare function createPresentation(input: CreatePresentationInput): Promise<string>;
+/** `{ <query id>: [<presentation>] }` */
+type VpToken = Record<string, string[]>;
+interface AuthorizationResponse {
+    url: string;
+    /** `application/x-www-form-urlencoded` body. */
+    body: string;
+    contentType: 'application/x-www-form-urlencoded';
+}
+/**
+ * The POST the wallet sends to the response URI: form-encoded `vp_token` (JSON) + `state`, or,
+ * for `direct_post.jwt`, `response=<JWE>` (the `enc` the request chose) whose payload carries
+ * `vp_token` and `state`.
+ */
+declare function createAuthorizationResponse(input: {
+    request: AuthorizationRequest;
+    vpToken: VpToken;
+}): Promise<AuthorizationResponse>;
+/** OpenID4VP §8.5 / RFC 6749 §4.1.2.1 error codes a wallet sends. */
+type AuthorizationErrorCode = 'invalid_request' | 'access_denied' | 'invalid_client' | 'invalid_scope' | 'vp_formats_not_supported' | 'invalid_request_uri_method' | 'invalid_transaction_data' | 'wallet_unavailable';
+/**
+ * The §8.5 error code for a refusal `verifyAuthorizationRequest` threw WITH an `errorTarget`;
+ * null when the verifier is not to be told (no target: the request did not verify).
+ */
+declare function authorizationErrorFor(e: unknown): AuthorizationErrorCode | null;
+/**
+ * The form body of an error response (§8.5, §8.2): `error`, `error_description`, `state`;
+ * encrypted as `response=<JWE>` for `direct_post.jwt` when the target has a usable key, else
+ * plain (§8.3.1 allows an unencrypted error response). `errorDescription` must be RFC 6749
+ * characters (printable ASCII without `"` and `\`), at most 300; never put personal data in it.
+ */
+declare function createAuthorizationErrorResponse(input: {
+    target: AuthorizationRequest | AuthorizationErrorTarget;
+    error: AuthorizationErrorCode;
+    errorDescription?: string;
+}): Promise<AuthorizationResponse>;
+interface SendAuthorizationErrorInput extends HostPolicy {
+    /** A verified request, or `error.errorTarget` of a refusal. */
+    target: AuthorizationRequest | AuthorizationErrorTarget;
+    error: AuthorizationErrorCode;
+    errorDescription?: string;
+    fetch: FetchLike;
+    timeoutMs?: number;
+}
+/**
+ * Tell the verifier the request will not be answered (OpenID4VP §8.5): POST the error response
+ * to its response URI (no redirects, timeout, capped answer). Privacy (§15.9): do not send an
+ * error that reveals whether a matching credential exists before the person has decided; use
+ * `access_denied` after they declined. Returns `{ delivered, status, redirectUri? }`
+ * (`delivered` = HTTP 200; `status` null when unreachable). Throws `TypeError` for a bad code or
+ * description, `Oid4vpError('insecure_response_uri')` when the URI fails the host policy.
+ */
+declare function sendAuthorizationError(input: SendAuthorizationErrorInput): Promise<{
+    delivered: boolean;
+    status: number | null;
+    redirectUri?: string;
+}>;
+interface ParsedAuthorizationResponse {
+    vpToken: VpToken;
+    state?: string;
+}
+/**
+ * Read the wallet's POST body (form-encoded string or `URLSearchParams`). With `decryptionKey`
+ * the body MUST be `response=<JWE>` (`A128GCM` or `A256GCM`; an unencrypted response is
+ * refused); without it the body must be `vp_token=…`. Pass your `request` to make the key
+ * mandatory for a `direct_post.jwt` request (TypeError without it). A wallet error response
+ * (encrypted or not, §8.3.1) throws `Oid4vpError('wallet_error')` carrying the OAuth error code.
+ */
+declare function parseAuthorizationResponse(body: string | URLSearchParams, opts?: {
+    decryptionKey?: P256PrivateJwk;
+    request?: AuthorizationRequest;
+}): Promise<ParsedAuthorizationResponse>;
+type ResponseFailureCode = VerifyFailureCode | 'missing_presentation' | 'unexpected_presentation' | 'missing_claim' | 'value_mismatch';
+interface FailedQuery {
+    ok: false;
+    code: ResponseFailureCode;
+    /**
+     * True when the person you expected (`expectedSubject` in `policyFor`, matched) is proven to
+     * have sent this presentation for this request's nonce, and it still does not meet the policy
+     * or query. Always false when the policy has no `expectedSubject`. See `FailedPresentation`.
+     */
+    holderAuthenticated: boolean;
+    /**
+     * True when the KB-JWT verified for this request's nonce and audience with the presented
+     * credential's own `cnf` key: its holder answered, whoever that is. Never close on it alone.
+     */
+    keyBindingValid: boolean;
+}
+type QueryResult = VerifiedPresentation | FailedQuery;
+interface VerifyAuthorizationResponseInput {
+    vpToken: VpToken;
+    /** The request (from `verifyAuthorizationRequest` / `decodeOwnAuthorizationRequest`), or your own request JWT. */
+    request: AuthorizationRequest | string;
+    /** The verifier's policy for one credential query (audience, nonce and key binding are set from the request). */
+    policyFor: (queryId: string) => Omit<VerifyPolicy, 'audience' | 'nonce' | 'requireKeyBinding'>;
+    deps: VerifyDeps;
+    /** The `state` the response carried; must equal the request's (required when the request has one). */
+    state?: string;
+}
+interface VerifiedAuthorizationResponse {
+    /** True only when every credential query was answered and verified. */
+    ok: boolean;
+    results: Record<string, QueryResult>;
+    /**
+     * True when every query's policy named `expectedSubject` and every result is either verified
+     * or a failure after that person was authenticated: the answer certainly came from the person
+     * you asked (close the request). False when any part could have come from someone else (keep
+     * the request open), and ALWAYS false when a policy has no `expectedSubject`: anyone holding a
+     * credential from an accepted issuer can answer such a request (OpenID4VP §14.2; for
+     * subject-less flows bind the answer to the browser session with a redirect URI and response
+     * code instead).
+     */
+    holderAuthenticated: boolean;
+    /**
+     * True when every result is either verified or a failure after the key binding held: each
+     * presentation was signed by the holder of the credential it carries, for this nonce and
+     * audience. It says nothing about who that holder is.
+     */
+    keyBindingValid: boolean;
+}
+/**
+ * Verify every presentation in a `vp_token` against the request: one presentation per credential
+ * query, each verified with `verifyPresentation` (KB-JWT `aud` = the request's client_id, `nonce`
+ * = its nonce, key binding required), each meeting its query (vct, accepted issuers, every
+ * requested claim present and, when `values` is given, matching; a requested `sub` or `iat` is
+ * read from the issuer-signed credential), and all of them from the same holder (`sub` and
+ * `cnf`). `ok` is true only when every query passed. Pass `expectedSubject` in every policy:
+ * without it `holderAuthenticated` is false. Throws
+ * `VerificationUnavailable` when a dependency is down and `Oid4vpError('state_mismatch')` when
+ * the state differs from the request's (or is missing while the request has one).
+ */
+declare function verifyAuthorizationResponse(input: VerifyAuthorizationResponseInput): Promise<VerifiedAuthorizationResponse>;
+
+export { DEFAULT_RESPONSE_ENCRYPTION_ENC, FetchLike, MAX_CLAIMS_PER_QUERY, MAX_CREDENTIAL_QUERIES, MAX_REQUEST_LIFETIME_SECONDS, MAX_REQUEST_OBJECT_LENGTH, MAX_RESPONSE_BODY_LENGTH, Oid4vpError, RESPONSE_ENCRYPTION_ENC, RESPONSE_ENCRYPTION_ENCS, SELF_ISSUED_AUDIENCE, authorizationErrorFor, buildWalletLink, createAuthorizationErrorResponse, createAuthorizationRequest, createAuthorizationResponse, createPresentation, decodeOwnAuthorizationRequest, generateResponseKeyPair, matchCredential, parseAuthorizationResponse, parseWalletLink, sendAuthorizationError, summarizeDcql, validateDcql, verifyAuthorizationRequest, verifyAuthorizationResponse };
+export type { AuthorizationErrorCode, AuthorizationErrorTarget, AuthorizationRequest, AuthorizationResponse, CreateAuthorizationRequestInput, CreatePresentationInput, DcqlClaimQuery, DcqlCredentialQuery, DcqlQuery, FailedQuery, JweEnc, MatchFailure, MatchResult, Oid4vpErrorCode, P256PrivateJwk, P256PublicJwk, ParsedAuthorizationResponse, QueryResult, ResponseFailureCode, ResponseMode, SendAuthorizationErrorInput, VerifiedAuthorizationResponse, VerifyAuthorizationRequestOptions, VerifyAuthorizationResponseInput, VpToken, WalletLink };

package/dist/oid4vp.js

@@ -0,0 +1,11 @@
+export { DEFAULT_RESPONSE_ENCRYPTION_ENC, MAX_CLAIMS_PER_QUERY, MAX_CREDENTIAL_QUERIES, MAX_REQUEST_LIFETIME_SECONDS, MAX_REQUEST_OBJECT_LENGTH, MAX_RESPONSE_BODY_LENGTH, Oid4vpError, RESPONSE_ENCRYPTION_ENC, RESPONSE_ENCRYPTION_ENCS, SELF_ISSUED_AUDIENCE, authorizationErrorFor, buildWalletLink, createAuthorizationErrorResponse, createAuthorizationRequest, createAuthorizationResponse, createPresentation, decodeOwnAuthorizationRequest, generateResponseKeyPair, matchCredential, parseAuthorizationResponse, parseWalletLink, sendAuthorizationError, summarizeDcql, validateDcql, verifyAuthorizationRequest, verifyAuthorizationResponse } from './chunk-2SF56NEJ.js';
+import './chunk-I6GBYFIJ.js';
+import './chunk-STMMFNVW.js';
+import './chunk-XREZY53L.js';
+import './chunk-JBUX6V2Q.js';
+import './chunk-WIEGZFUO.js';
+import './chunk-Q3MZNMCK.js';
+import './chunk-VXKONZK4.js';
+import './chunk-AQ3IINHC.js';
+//# sourceMappingURL=oid4vp.js.map
+//# sourceMappingURL=oid4vp.js.map

package/dist/oid4vp.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"oid4vp.js"}

package/dist/profile.d.ts

@@ -0,0 +1,218 @@
+import { CardDisplay } from './display.js';
+import './http-BhuJ_-RZ.js';
+
+/** The UCAN resource of the Credentials worker; the caller acts as itself. */
+declare const UCAN_RESOURCE = "ixo:credentials";
+/** `ixo:credentials/<entity DID>`: the caller acts as that entity (SPEC §5.1). */
+declare function entityResource(entityDid: string): string;
+declare const ABILITY_ISSUE = "credentials/issue";
+declare const ABILITY_VERIFY = "credentials/verify";
+declare const ABILITY_HOLD = "credentials/hold";
+/** Consent: the holder lets an issuer deposit offers that the wallet may store automatically. */
+declare const ABILITY_OFFER = "credentials/offer";
+/** Standing presentation consent: the holder lets a verifier be answered without asking. */
+declare const ABILITY_PRESENT = "credentials/present";
+declare const ABILITIES: {
+    readonly issue: "credentials/issue";
+    readonly verify: "credentials/verify";
+    readonly hold: "credentials/hold";
+    readonly offer: "credentials/offer";
+    readonly present: "credentials/present";
+};
+type Ability = (typeof ABILITIES)[keyof typeof ABILITIES];
+declare const CREDENTIAL_FORMAT = "dc+sd-jwt";
+declare const SD_JWT_TYP = "dc+sd-jwt";
+declare const KB_JWT_TYP = "kb+jwt";
+declare const STATUS_LIST_JWT_TYP = "statuslist+jwt";
+declare const REQUEST_OBJECT_TYP = "oauth-authz-req+jwt";
+declare const PROOF_JWT_TYP = "openid4vci-proof+jwt";
+declare const MEDIA_TYPES: {
+    readonly statusList: "application/statuslist+jwt";
+    readonly requestObject: "application/oauth-authz-req+jwt";
+    readonly json: "application/json";
+    readonly form: "application/x-www-form-urlencoded";
+};
+/** OpenID4VP Client Identifier Prefix for DID verifiers. */
+declare const CLIENT_ID_PREFIX = "decentralized_identifier:";
+/** OAuth grant type of the OpenID4VCI pre-authorized code flow. */
+declare const PRE_AUTHORIZED_CODE_GRANT = "urn:ietf:params:oauth:grant-type:pre-authorized_code";
+/** Webhook signature header (Credentials worker → Hub). */
+declare const WEBHOOK_SIGNATURE_HEADER = "x-ixo-signature";
+declare const HEADERS: {
+    readonly webhookSignature: "x-ixo-signature";
+    readonly authorization: "authorization";
+};
+declare const VAULT_CREDENTIAL_EVENT_TYPE = "ixo.credential";
+declare const VAULT_CREDENTIAL_INDEX_TYPE = "ixo.credential.index";
+declare const VAULT_CREDENTIAL_CONTENT_FIELD = "credential";
+/**
+ * Vault index state keys of the known credential types, by their FULL `vct` (exact match). These
+ * slots are shared with Self's web app (`identitylevel1`) and the portal (`kycamllevel1`).
+ */
+declare const VCT_STATE_KEYS: Readonly<Record<string, string>>;
+/**
+ * The Vault index state key for a `vct`, from the FULL `vct` (exact match, no normalising): a
+ * known type's slot from `VCT_STATE_KEYS` (`IDENTITY_LEVEL1_VCT` → `identitylevel1`,
+ * `KYC_AML_LEVEL1_VCT` → `kycamllevel1`), else `vct-` + the first 32 hex characters of
+ * SHA-256(vct). Two different `vct` values never share a slot, so a foreign issuer's look-alike
+ * type (`https://evil.example/Identity-Level_1.json`) cannot land in a known type's slot. Throws
+ * `TypeError` for an empty or non-string `vct`.
+ */
+declare function stateKeyForVct(vct: string): string;
+/** Self's identity credential type (unchanged in v1). */
+declare const IDENTITY_LEVEL1_VCT = "https://credentials.ixo.world/types/IdentityLevel1";
+/** The portal's KYC/AML credential type (pay-convert-oracle `KYC_VCT`). */
+declare const KYC_AML_LEVEL1_VCT = "https://github.com/ixofoundation/ns/blob/main/protocol/credentials/v1/KYCAMLLevel1.json";
+/** Self's OpenID4VCI credential configuration id. */
+declare const IDENTITY_LEVEL1_CONFIGURATION_ID = "IdentityLevel1";
+/** Derived age claims a credential with a birth date carries, each its own disclosure. */
+declare const AGE_CLAIMS: readonly ["age_over_18", "age_over_21", "age_birth_year"];
+type AgeClaim = (typeof AGE_CLAIMS)[number];
+/** Registered / structural claims that are never selectively disclosable in the profile. */
+declare const REGISTERED_CLAIMS: readonly ["iss", "sub", "iat", "nbf", "exp", "vct", "vct#integrity", "cnf", "status", "_sd", "_sd_alg"];
+type ClaimDisclosure = 'always' | 'allowed' | 'never';
+interface CatalogClaim {
+    name: string;
+    label: string;
+    /** Whether the claim is selectively disclosable. */
+    sd: ClaimDisclosure;
+}
+interface CatalogIssuerType {
+    vct: string;
+    name: string;
+    description?: string;
+    type_metadata_uri?: string;
+    claims: CatalogClaim[];
+    /** The card look for credentials of this type (SPEC §15.1; validated, unknown members dropped). */
+    display?: CardDisplay;
+}
+interface CatalogIssuerEntry {
+    did: string;
+    name: string;
+    description?: string;
+    url?: string;
+    /** The OpenID4VCI Credential Issuer Identifier (https URL). */
+    credential_issuer: string;
+    types: CatalogIssuerType[];
+    /** The issuer's mark (https image URL; png, jpeg or webp). */
+    logo_uri?: string;
+    /** The issuer's mark colour, `#rrggbb`. */
+    color?: string;
+}
+interface CatalogVerifierAccept {
+    purpose: string;
+    vct: string;
+    claims: string[];
+    issuers: string[];
+}
+interface CatalogVerifierEntry {
+    did: string;
+    name: string;
+    description?: string;
+    url?: string;
+    accepts: CatalogVerifierAccept[];
+    /** The verifier's mark (https image URL; png, jpeg or webp). */
+    logo_uri?: string;
+    /** The verifier's mark colour, `#rrggbb`. */
+    color?: string;
+}
+type OfferStatus = 'pending' | 'accepted' | 'declined' | 'retracted' | 'expired';
+type RequestStatus = 'pending' | 'answered' | 'declined' | 'cancelled' | 'expired';
+/**
+ * An offer's `display`: name, type and description only (SPEC §16.1). The card look, the issuer's
+ * name and its logo come only from the issuer's catalog entry (`CatalogIssuerEntry`), so an offer
+ * cannot change them; the worker drops anything else and lists it in `display_dropped`.
+ */
+interface OfferDisplay {
+    name: string;
+    vct: string;
+    description?: string;
+}
+/** An offer as the worker lists it (never the pre-authorized code). */
+interface OfferSummary {
+    id: string;
+    issuer: string;
+    subject: string;
+    ref: string;
+    credential_issuer: string;
+    vct: string;
+    display: OfferDisplay;
+    status: OfferStatus;
+    /** Whether a valid `credentials/offer` delegation from the subject came with the offer. */
+    consent: 'valid' | 'none';
+    /** unix seconds */
+    created_at: number;
+    /** unix seconds */
+    expires_at: number;
+}
+/** One credential query of a request, as `summarizeDcql` reports it. */
+interface DcqlQuerySummary {
+    id: string;
+    vctValues: string[];
+    /** Claim names asked for (never `iss`). */
+    claims: string[];
+    /** The accepted-issuer filter, when the query has one. */
+    issuers?: string[];
+}
+/** A presentation request as the worker lists it. */
+interface RequestSummary {
+    id: string;
+    verifier: string;
+    subject: string;
+    ref: string;
+    /** The verifier's full OpenID4VP client_id (`decentralized_identifier:<did>`). */
+    client_id: string;
+    purpose: string;
+    summary: DcqlQuerySummary[];
+    /** Host of the request's `response_uri`. */
+    response_host: string;
+    status: RequestStatus;
+    /** unix seconds */
+    created_at: number;
+    /** unix seconds */
+    expires_at: number;
+}
+/** One entry of a person's block list (`GET /v1/blocks`). */
+interface SenderBlock {
+    /** The blocked DID, exactly as written: the block covers exactly this DID (SPEC §17.4). */
+    sender: string;
+    /** unix seconds */
+    created_at: number;
+}
+/** `POST /v1/blocks` answer. */
+interface BlockSenderResult extends SenderBlock {
+    /** Waiting offers + requests from this sender for the person, closed as declined by this call. */
+    closed: number;
+}
+/** `POST /v1/blocks/remove` answer. */
+interface UnblockSenderResult {
+    sender: string;
+    /** False when the sender was not blocked. */
+    removed: boolean;
+}
+/** `GET /v1/blocks` answer (newest first). */
+interface SenderBlockList {
+    items: SenderBlock[];
+    next_cursor: string | null;
+}
+/** At most this many blocks per person (`too_many_blocks` above it). */
+declare const MAX_BLOCKS_PER_PERSON = 500;
+/** The worker's error code for a deposit from a sender the person blocked (HTTP 403). */
+declare const BLOCKED_ERROR = "blocked";
+declare const WEBHOOK_EVENT_TYPES: readonly ["offer.created", "request.created", "offer.retracted", "request.cancelled"];
+type WebhookEventType = (typeof WEBHOOK_EVENT_TYPES)[number];
+/** The webhook body. It carries no secret: the Hub fetches details itself. */
+interface WebhookEvent {
+    /** `evt_…` */
+    id: string;
+    type: WebhookEventType;
+    /** The holder DID the offer / request is for. */
+    subject: string;
+    /** The offer or request id (`ofr_…` / `req_…`), NOT the issuer's / verifier's `ref`. */
+    object_id: string;
+    /** unix seconds */
+    created_at: number;
+}
+
+export { ABILITIES, ABILITY_HOLD, ABILITY_ISSUE, ABILITY_OFFER, ABILITY_PRESENT, ABILITY_VERIFY, AGE_CLAIMS, BLOCKED_ERROR, CLIENT_ID_PREFIX, CREDENTIAL_FORMAT, CardDisplay, HEADERS, IDENTITY_LEVEL1_CONFIGURATION_ID, IDENTITY_LEVEL1_VCT, KB_JWT_TYP, KYC_AML_LEVEL1_VCT, MAX_BLOCKS_PER_PERSON, MEDIA_TYPES, PRE_AUTHORIZED_CODE_GRANT, PROOF_JWT_TYP, REGISTERED_CLAIMS, REQUEST_OBJECT_TYP, SD_JWT_TYP, STATUS_LIST_JWT_TYP, UCAN_RESOURCE, VAULT_CREDENTIAL_CONTENT_FIELD, VAULT_CREDENTIAL_EVENT_TYPE, VAULT_CREDENTIAL_INDEX_TYPE, VCT_STATE_KEYS, WEBHOOK_EVENT_TYPES, WEBHOOK_SIGNATURE_HEADER, entityResource, stateKeyForVct };
+export type { Ability, AgeClaim, BlockSenderResult, CatalogClaim, CatalogIssuerEntry, CatalogIssuerType, CatalogVerifierAccept, CatalogVerifierEntry, ClaimDisclosure, DcqlQuerySummary, OfferDisplay, OfferStatus, OfferSummary, RequestStatus, RequestSummary, SenderBlock, SenderBlockList, UnblockSenderResult, WebhookEvent, WebhookEventType };

package/dist/profile.js

@@ -0,0 +1,4 @@
+export { ABILITIES, ABILITY_HOLD, ABILITY_ISSUE, ABILITY_OFFER, ABILITY_PRESENT, ABILITY_VERIFY, AGE_CLAIMS, BLOCKED_ERROR, CLIENT_ID_PREFIX, CREDENTIAL_FORMAT, HEADERS, IDENTITY_LEVEL1_CONFIGURATION_ID, IDENTITY_LEVEL1_VCT, KB_JWT_TYP, KYC_AML_LEVEL1_VCT, MAX_BLOCKS_PER_PERSON, MEDIA_TYPES, PRE_AUTHORIZED_CODE_GRANT, PROOF_JWT_TYP, REGISTERED_CLAIMS, REQUEST_OBJECT_TYP, SD_JWT_TYP, STATUS_LIST_JWT_TYP, UCAN_RESOURCE, VAULT_CREDENTIAL_CONTENT_FIELD, VAULT_CREDENTIAL_EVENT_TYPE, VAULT_CREDENTIAL_INDEX_TYPE, VCT_STATE_KEYS, WEBHOOK_EVENT_TYPES, WEBHOOK_SIGNATURE_HEADER, entityResource, stateKeyForVct } from './chunk-I6GBYFIJ.js';
+import './chunk-AQ3IINHC.js';
+//# sourceMappingURL=profile.js.map
+//# sourceMappingURL=profile.js.map

package/dist/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"profile.js"}