@ixo/credentials-kit 0.0.0-stage → 0.1.0

package/dist/chunk-AQ3IINHC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/bytes.ts"],"names":[],"mappings":";AAIA,IAAM,EAAA,GAAK,IAAI,WAAA,EAAY;AAC3B,IAAM,KAAK,IAAI,WAAA,CAAY,SAAS,EAAE,KAAA,EAAO,MAAM,CAAA;AAG5C,SAAS,KAAK,CAAA,EAAoC;AACvD,EAAA,OAAO,EAAA,CAAG,OAAO,CAAC,CAAA;AACpB;AAGO,SAAS,SAAS,KAAA,EAA2B;AAClD,EAAA,OAAO,EAAA,CAAG,OAAO,KAAK,CAAA;AACxB;AAEA,IAAM,MAAA,GACJ,kEAAA;AACF,IAAM,iBAAiB,MAAM;AAC3B,EAAA,MAAM,IAAI,IAAI,UAAA,CAAW,GAAG,CAAA,CAAE,KAAK,EAAE,CAAA;AACrC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,EAAA,EAAK,CAAA,CAAE,MAAA,CAAO,UAAA,CAAW,CAAC,CAAC,CAAA,GAAI,CAAA;AAClE,EAAA,OAAO,CAAA;AACT,CAAA,GAAG;AAGI,SAAS,gBAAgB,KAAA,EAA2B;AACzD,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,IAAI,CAAA,GAAI,CAAA;AACR,EAAA,OAAO,CAAA,GAAI,CAAA,GAAI,KAAA,CAAM,MAAA,EAAQ,KAAK,CAAA,EAAG;AACnC,IAAA,MAAM,CAAA,GAAK,KAAA,CAAM,CAAC,CAAA,IAAM,EAAA,GAAO,KAAA,CAAM,CAAA,GAAI,CAAC,CAAA,IAAM,CAAA,GAAK,KAAA,CAAM,CAAA,GAAI,CAAC,CAAA;AAChE,IAAA,GAAA,IACE,OAAQ,CAAA,IAAK,EAAA,GAAM,EAAE,CAAA,GACrB,OAAQ,CAAA,IAAK,EAAA,GAAM,EAAE,CAAA,GACrB,OAAQ,CAAA,IAAK,CAAA,GAAK,EAAE,CAAA,GACpB,MAAA,CAAO,IAAI,EAAE,CAAA;AAAA,EACjB;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,MAAA,GAAS,CAAA;AAC5B,EAAA,IAAI,SAAS,CAAA,EAAG;AACd,IAAA,MAAM,CAAA,GAAI,KAAA,CAAM,CAAC,CAAA,IAAM,EAAA;AACvB,IAAA,GAAA,IAAO,MAAA,CAAQ,KAAK,EAAA,GAAM,EAAE,IAAK,MAAA,CAAQ,CAAA,IAAK,KAAM,EAAE,CAAA;AAAA,EACxD,CAAA,MAAA,IAAW,SAAS,CAAA,EAAG;AACrB,IAAA,MAAM,CAAA,GAAK,MAAM,CAAC,CAAA,IAAM,KAAO,KAAA,CAAM,CAAA,GAAI,CAAC,CAAA,IAAM,CAAA;AAChD,IAAA,GAAA,IACE,MAAA,CAAQ,CAAA,IAAK,EAAA,GAAM,EAAE,CAAA,GACrB,MAAA,CAAQ,CAAA,IAAK,EAAA,GAAM,EAAE,CAAA,GACrB,MAAA,CAAQ,CAAA,IAAK,IAAK,EAAE,CAAA;AAAA,EACxB;AACA,EAAA,OAAO,GAAA;AACT;AAOO,SAAS,gBAAgB,CAAA,EAAoC;AAClE,EAAA,IAAI,EAAE,MAAA,GAAS,CAAA,KAAM,GAAG,MAAM,IAAI,MAAM,mBAAmB,CAAA;AAC3D,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,IAAA,CAAK,MAAO,CAAA,CAAE,MAAA,GAAS,CAAA,GAAK,CAAC,CAAC,CAAA;AACzD,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,IAAI,EAAA,GAAK,CAAA;AACT,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,MAAM,CAAA,GAAI,CAAA,CAAE,UAAA,CAAW,CAAC,CAAA;AACxB,IAAA,MAAM,CAAA,GAAI,CAAA,GAAI,GAAA,GAAM,aAAA,CAAc,CAAC,CAAA,GAAK,EAAA;AACxC,IAAA,IAAI,CAAA,GAAI,CAAA,EAAG,MAAM,IAAI,MAAM,mBAAmB,CAAA;AAC9C,IAAA,MAAA,GAAA,CAAW,MAAA,IAAU,IAAK,CAAA,IAAK,KAAA;AAC/B,IAAA,IAAA,IAAQ,CAAA;AACR,IAAA,IAAI,QAAQ,CAAA,EAAG;AACb,MAAA,IAAA,IAAQ,CAAA;AACR,MAAA,GAAA,CAAI,EAAA,EAAI,CAAA,GAAK,MAAA,IAAU,IAAA,GAAQ,GAAA;AAAA,IACjC;AAAA,EACF;AACA,EAAA,IAAI,OAAO,CAAA,IAAA,CAAM,MAAA,GAAA,CAAW,CAAA,IAAK,IAAA,IAAQ,OAAQ,CAAA,EAAG;AAClD,IAAA,MAAM,IAAI,MAAM,mBAAmB,CAAA;AAAA,EACrC;AACA,EAAA,OAAO,GAAA;AACT;AAGO,SAAS,cAAc,KAAA,EAAwB;AACpD,EAAA,OAAO,gBAAgB,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAC,CAAA;AACpD;AAOO,SAAS,eAAe,KAAA,EAA8C;AAC3E,EAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,CAAC,GAAG,CAAA,KAAM,CAAA,GAAI,CAAA,CAAE,MAAA,EAAQ,CAAC,CAAA;AACnD,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,IAAI,CAAA;AAC/B,EAAA,IAAI,EAAA,GAAK,CAAA;AACT,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,GAAA,CAAI,GAAA,CAAI,GAAG,EAAE,CAAA;AACb,IAAA,EAAA,IAAM,CAAA,CAAE,MAAA;AAAA,EACV;AACA,EAAA,OAAO,GAAA;AACT;AAGO,SAAS,eAAA,CAAgB,GAAe,CAAA,EAAwB;AACrE,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ,OAAO,KAAA;AAClC,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,MAAA,EAAQ,CAAA,EAAA,EAAK,IAAA,IAAQ,CAAA,CAAE,CAAC,CAAA,GAAK,CAAA,CAAE,CAAC,CAAA;AACtD,EAAA,OAAO,IAAA,KAAS,CAAA;AAClB;AAEO,SAAS,WAAW,KAAA,EAA2B;AACpD,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,CAAA,IAAK,OAAO,GAAA,IAAO,CAAA,CAAE,SAAS,EAAE,CAAA,CAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAA;AAC5D,EAAA,OAAO,GAAA;AACT;AAEO,SAAS,WAAW,GAAA,EAAsC;AAC/D,EAAA,IAAI,CAAC,wBAAwB,IAAA,CAAK,GAAG,GAAG,MAAM,IAAI,MAAM,aAAa,CAAA;AACrE,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,GAAA,CAAI,SAAS,CAAC,CAAA;AACzC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,QAAQ,CAAA,EAAA,EAAK;AACnC,IAAA,GAAA,CAAI,CAAC,CAAA,GAAI,MAAA,CAAO,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,GAAI,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,EAC1D;AACA,EAAA,OAAO,GAAA;AACT;AAEA,IAAM,GAAA,GAAM,4DAAA;AAGL,SAAS,gBAAgB,KAAA,EAA2B;AACzD,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,OAAO,QAAQ,KAAA,CAAM,MAAA,IAAU,KAAA,CAAM,KAAK,MAAM,CAAA,EAAG,KAAA,EAAA;AACnD,EAAA,MAAM,SAAmB,EAAC;AAC1B,EAAA,KAAA,IAAS,CAAA,GAAI,KAAA,EAAO,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACzC,IAAA,IAAI,KAAA,GAAQ,MAAM,CAAC,CAAA;AACnB,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK;AACtC,MAAA,KAAA,IAAS,MAAA,CAAO,CAAC,CAAA,IAAM,CAAA;AACvB,MAAA,MAAA,CAAO,CAAC,IAAI,KAAA,GAAQ,EAAA;AACpB,MAAA,KAAA,GAAS,QAAQ,EAAA,GAAM,CAAA;AAAA,IACzB;AACA,IAAA,OAAO,QAAQ,CAAA,EAAG;AAChB,MAAA,MAAA,CAAO,IAAA,CAAK,QAAQ,EAAE,CAAA;AACtB,MAAA,KAAA,GAAS,QAAQ,EAAA,GAAM,CAAA;AAAA,IACzB;AAAA,EACF;AACA,EAAA,IAAI,GAAA,GAAM,GAAA,CAAI,MAAA,CAAO,KAAK,CAAA;AAC1B,EAAA,KAAA,IAAS,CAAA,GAAI,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG,CAAA,IAAK,CAAA,EAAG,CAAA,EAAA,EAAK,GAAA,IAAO,GAAA,CAAI,MAAA,CAAO,CAAC,CAAE,CAAA;AAClE,EAAA,OAAO,GAAA;AACT;AAEO,SAAS,gBAAgB,CAAA,EAAoC;AAClE,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,OAAO,QAAQ,CAAA,CAAE,MAAA,IAAU,CAAA,CAAE,KAAK,MAAM,GAAA,EAAK,KAAA,EAAA;AAC7C,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,KAAA,IAAS,CAAA,GAAI,KAAA,EAAO,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,MAAM,CAAA,GAAI,GAAA,CAAI,OAAA,CAAQ,CAAA,CAAE,CAAC,CAAE,CAAA;AAC3B,IAAA,IAAI,CAAA,GAAI,CAAA,EAAG,MAAM,IAAI,MAAM,mBAAmB,CAAA;AAC9C,IAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,MAAA,KAAA,IAAS,KAAA,CAAM,CAAC,CAAA,GAAK,EAAA;AACrB,MAAA,KAAA,CAAM,CAAC,IAAI,KAAA,GAAQ,GAAA;AACnB,MAAA,KAAA,KAAU,CAAA;AAAA,IACZ;AACA,IAAA,OAAO,QAAQ,CAAA,EAAG;AAChB,MAAA,KAAA,CAAM,IAAA,CAAK,QAAQ,GAAI,CAAA;AACvB,MAAA,KAAA,KAAU,CAAA;AAAA,IACZ;AAAA,EACF;AACA,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,KAAA,GAAQ,MAAM,MAAM,CAAA;AAC/C,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,GAAA,CAAI,QAAQ,CAAC,CAAA,GAAI,MAAM,KAAA,CAAM,MAAA,GAAS,IAAI,CAAC,CAAA;AAAA,EAC7C;AACA,EAAA,OAAO,GAAA;AACT;AAGO,SAAS,WAAA,CAAY,QAAQ,EAAA,EAAY;AAC9C,EAAA,OAAO,gBAAgB,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,KAAK,CAAC,CAAC,CAAA;AACtE","file":"chunk-AQ3IINHC.js","sourcesContent":["/**\n * Byte helpers shared by every module. Runtime-neutral: no Buffer, no Node built-ins.\n */\n\nconst te = new TextEncoder();\nconst td = new TextDecoder('utf-8', { fatal: true });\n\n/** UTF-8 bytes of a string. */\nexport function utf8(s: string): Uint8Array<ArrayBuffer> {\n  return te.encode(s);\n}\n\n/** A string from UTF-8 bytes; throws on invalid UTF-8. */\nexport function fromUtf8(bytes: Uint8Array): string {\n  return td.decode(bytes);\n}\n\nconst B64URL =\n  'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';\nconst B64URL_LOOKUP = (() => {\n  const t = new Int16Array(128).fill(-1);\n  for (let i = 0; i < B64URL.length; i++) t[B64URL.charCodeAt(i)] = i;\n  return t;\n})();\n\n/** base64url without padding (RFC 7515 §2). */\nexport function base64urlEncode(bytes: Uint8Array): string {\n  let out = '';\n  let i = 0;\n  for (; i + 2 < bytes.length; i += 3) {\n    const n = (bytes[i]! << 16) | (bytes[i + 1]! << 8) | bytes[i + 2]!;\n    out +=\n      B64URL[(n >> 18) & 63]! +\n      B64URL[(n >> 12) & 63]! +\n      B64URL[(n >> 6) & 63]! +\n      B64URL[n & 63]!;\n  }\n  const rest = bytes.length - i;\n  if (rest === 1) {\n    const n = bytes[i]! << 16;\n    out += B64URL[(n >> 18) & 63]! + B64URL[(n >> 12) & 63]!;\n  } else if (rest === 2) {\n    const n = (bytes[i]! << 16) | (bytes[i + 1]! << 8);\n    out +=\n      B64URL[(n >> 18) & 63]! +\n      B64URL[(n >> 12) & 63]! +\n      B64URL[(n >> 6) & 63]!;\n  }\n  return out;\n}\n\n/**\n * Strict base64url decode: only the URL-safe alphabet, no padding, no whitespace, and the\n * canonical encoding only (unused trailing bits must be zero), so one byte string has exactly\n * one accepted text form. Throws on anything else.\n */\nexport function base64urlDecode(s: string): Uint8Array<ArrayBuffer> {\n  if (s.length % 4 === 1) throw new Error('invalid base64url');\n  const out = new Uint8Array(Math.floor((s.length * 3) / 4));\n  let buffer = 0;\n  let bits = 0;\n  let at = 0;\n  for (let i = 0; i < s.length; i++) {\n    const c = s.charCodeAt(i);\n    const v = c < 128 ? B64URL_LOOKUP[c]! : -1;\n    if (v < 0) throw new Error('invalid base64url');\n    buffer = ((buffer << 6) | v) & 0x3fff; // at most 13 live bits\n    bits += 6;\n    if (bits >= 8) {\n      bits -= 8;\n      out[at++] = (buffer >> bits) & 0xff;\n    }\n  }\n  if (bits > 0 && (buffer & ((1 << bits) - 1)) !== 0) {\n    throw new Error('invalid base64url');\n  }\n  return out;\n}\n\n/** base64url of the UTF-8 bytes of a JSON value. */\nexport function base64urlJson(value: unknown): string {\n  return base64urlEncode(utf8(JSON.stringify(value)));\n}\n\n/** Parse base64url-encoded UTF-8 JSON; throws when it is not. */\nexport function parseBase64urlJson(segment: string): unknown {\n  return JSON.parse(fromUtf8(base64urlDecode(segment))) as unknown;\n}\n\nexport function concatBytes(...parts: Uint8Array[]): Uint8Array<ArrayBuffer> {\n  const size = parts.reduce((n, p) => n + p.length, 0);\n  const out = new Uint8Array(size);\n  let at = 0;\n  for (const p of parts) {\n    out.set(p, at);\n    at += p.length;\n  }\n  return out;\n}\n\n/** Constant-time equality for secrets of equal length (length itself is not secret). */\nexport function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {\n  if (a.length !== b.length) return false;\n  let diff = 0;\n  for (let i = 0; i < a.length; i++) diff |= a[i]! ^ b[i]!;\n  return diff === 0;\n}\n\nexport function bytesToHex(bytes: Uint8Array): string {\n  let out = '';\n  for (const b of bytes) out += b.toString(16).padStart(2, '0');\n  return out;\n}\n\nexport function hexToBytes(hex: string): Uint8Array<ArrayBuffer> {\n  if (!/^(?:[0-9a-fA-F]{2})*$/.test(hex)) throw new Error('invalid hex');\n  const out = new Uint8Array(hex.length / 2);\n  for (let i = 0; i < out.length; i++) {\n    out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n  }\n  return out;\n}\n\nconst B58 = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';\n\n/** base58btc (Bitcoin alphabet), as used by did:key, multibase `z` and IXO key ids. */\nexport function base58btcEncode(bytes: Uint8Array): string {\n  let zeros = 0;\n  while (zeros < bytes.length && bytes[zeros] === 0) zeros++;\n  const digits: number[] = [];\n  for (let i = zeros; i < bytes.length; i++) {\n    let carry = bytes[i]!;\n    for (let j = 0; j < digits.length; j++) {\n      carry += digits[j]! << 8;\n      digits[j] = carry % 58;\n      carry = (carry / 58) | 0;\n    }\n    while (carry > 0) {\n      digits.push(carry % 58);\n      carry = (carry / 58) | 0;\n    }\n  }\n  let out = '1'.repeat(zeros);\n  for (let i = digits.length - 1; i >= 0; i--) out += B58[digits[i]!]!;\n  return out;\n}\n\nexport function base58btcDecode(s: string): Uint8Array<ArrayBuffer> {\n  let zeros = 0;\n  while (zeros < s.length && s[zeros] === '1') zeros++;\n  const bytes: number[] = [];\n  for (let i = zeros; i < s.length; i++) {\n    const v = B58.indexOf(s[i]!);\n    if (v < 0) throw new Error('invalid base58btc');\n    let carry = v;\n    for (let j = 0; j < bytes.length; j++) {\n      carry += bytes[j]! * 58;\n      bytes[j] = carry & 0xff;\n      carry >>= 8;\n    }\n    while (carry > 0) {\n      bytes.push(carry & 0xff);\n      carry >>= 8;\n    }\n  }\n  const out = new Uint8Array(zeros + bytes.length);\n  for (let i = 0; i < bytes.length; i++) {\n    out[zeros + i] = bytes[bytes.length - 1 - i]!;\n  }\n  return out;\n}\n\n/** A cryptographically random base64url string of `bytes` random bytes. */\nexport function randomToken(bytes = 32): string {\n  return base64urlEncode(crypto.getRandomValues(new Uint8Array(bytes)));\n}\n"]}

package/dist/chunk-FSKCDHZ7.js

@@ -0,0 +1,613 @@
+import { PRE_AUTHORIZED_CODE_GRANT, PROOF_JWT_TYP } from './chunk-I6GBYFIJ.js';
+import { verifyIssuedCredential } from './chunk-STMMFNVW.js';
+import { didFromKid, ResolverUnavailable, findKey } from './chunk-WIEGZFUO.js';
+import { isFetchableUrl, request, HttpError } from './chunk-Q3MZNMCK.js';
+import { CredentialsKitError, isRecord, decodeJws, isEd25519JwsAlg, toSeconds, clockMs, CLOCK_SKEW_S, verifyEd25519, publicJwkFromRaw, signJws } from './chunk-VXKONZK4.js';
+import { utf8 } from './chunk-AQ3IINHC.js';
+
+// src/oid4vci.ts
+var OID4VCI_MESSAGES = {
+  invalid_offer: "The credential offer is not well formed.",
+  unsupported_offer: "The credential offer uses a feature this profile does not support.",
+  invalid_metadata: "The issuer's metadata is missing or not well formed.",
+  issuer_unavailable: "The issuer could not be reached.",
+  tx_code_unsupported: "The offer needs a transaction code, which this wallet does not support.",
+  token_error: "The issuer refused the pre-authorized code.",
+  issuer_error: "The issuer refused the request.",
+  invalid_response: "The issuer's answer is not well formed.",
+  invalid_proof: "The key proof is not valid.",
+  invalid_nonce: "The key proof does not carry a valid nonce.",
+  invalid_credential: "The issuer sent a credential that does not check out, so it was not kept."
+};
+var Oid4vciError = class extends CredentialsKitError {
+  /** The OAuth / OpenID4VCI error code the server answered (sanitised), when there was one. */
+  oauthError;
+  /**
+   * For `invalid_proof` / `invalid_nonce`: a constant cause for logs. For `invalid_credential`:
+   * the `verifyIssuedCredential` failure code (`bad_signature`, `wrong_subject`, …).
+   */
+  reason;
+  constructor(code, extra = {}) {
+    super(code, OID4VCI_MESSAGES[code]);
+    if (extra.oauthError !== void 0) this.oauthError = extra.oauthError;
+    if (extra.reason !== void 0) this.reason = extra.reason;
+  }
+};
+function insertWellKnown(identifier, suffix) {
+  const u = new URL(identifier);
+  const path = u.pathname === "/" ? "" : u.pathname.replace(/\/$/, "");
+  return `${u.origin}/.well-known/${suffix}${path}`;
+}
+function issuerMetadataUrl(credentialIssuer) {
+  return insertWellKnown(credentialIssuer, "openid-credential-issuer");
+}
+function authorizationServerMetadataUrl(issuer) {
+  return insertWellKnown(issuer, "oauth-authorization-server");
+}
+function buildIssuerMetadata(input) {
+  const base = input.credentialIssuer.replace(/\/$/, "");
+  const ep = input.endpoints ?? {};
+  const configurations = {};
+  for (const [id, c] of Object.entries(input.configurations)) {
+    configurations[id] = {
+      format: "dc+sd-jwt",
+      vct: c.vct,
+      ...input.includeScope ? { scope: id } : {},
+      cryptographic_binding_methods_supported: ["did:ixo"],
+      credential_signing_alg_values_supported: ["EdDSA", "Ed25519"],
+      proof_types_supported: {
+        jwt: { proof_signing_alg_values_supported: ["EdDSA", "Ed25519"] }
+      },
+      ...c.display || c.claims ? {
+        credential_metadata: {
+          ...c.display ? { display: c.display } : {},
+          ...c.claims ? { claims: c.claims } : {}
+        }
+      } : {}
+    };
+  }
+  return {
+    credential_issuer: input.credentialIssuer,
+    ...input.authorizationServers ? { authorization_servers: input.authorizationServers } : {},
+    credential_endpoint: ep.credential ?? `${base}/oid4vci/credential`,
+    nonce_endpoint: ep.nonce ?? `${base}/oid4vci/nonce`,
+    ...ep.deferred !== void 0 ? { deferred_credential_endpoint: ep.deferred } : {},
+    notification_endpoint: ep.notification ?? `${base}/oid4vci/notification`,
+    ...input.display ? { display: input.display } : {},
+    credential_configurations_supported: configurations
+  };
+}
+function buildAuthorizationServerMetadata(input) {
+  return {
+    issuer: input.issuer,
+    token_endpoint: input.tokenEndpoint ?? `${input.issuer.replace(/\/$/, "")}/oid4vci/token`,
+    grant_types_supported: [PRE_AUTHORIZED_CODE_GRANT],
+    // No client authentication at the token endpoint (RFC 8414 §2's default would be basic).
+    token_endpoint_auth_methods_supported: ["none"],
+    "pre-authorized_grant_anonymous_access_supported": true
+  };
+}
+function buildCredentialOffer(input) {
+  return validateCredentialOffer(
+    {
+      credential_issuer: input.credentialIssuer,
+      credential_configuration_ids: input.configurationIds,
+      grants: {
+        [PRE_AUTHORIZED_CODE_GRANT]: {
+          "pre-authorized_code": input.preAuthorizedCode,
+          ...input.txCode ? { tx_code: input.txCode } : {}
+        }
+      }
+    },
+    { allowHttp: true, allowLocal: true }
+  );
+}
+function validateCredentialOffer(v, opts = {}) {
+  const bad = () => new Oid4vciError("invalid_offer");
+  if (!isRecord(v)) throw bad();
+  const issuer = v.credential_issuer;
+  if (typeof issuer !== "string" || !isFetchableUrl(issuer, opts)) throw bad();
+  if (new URL(issuer).search !== "") throw bad();
+  const ids = v.credential_configuration_ids;
+  if (!Array.isArray(ids) || ids.length === 0 || !ids.every((i) => typeof i === "string" && i.length > 0 && i.length <= 256) || new Set(ids).size !== ids.length) {
+    throw bad();
+  }
+  const grants = isRecord(v.grants) ? v.grants : null;
+  const grant = grants ? grants[PRE_AUTHORIZED_CODE_GRANT] : void 0;
+  if (grant === void 0 && grants && Object.keys(grants).length > 0)
+    throw new Oid4vciError("unsupported_offer");
+  if (!isRecord(grant)) throw bad();
+  const code = grant["pre-authorized_code"];
+  if (typeof code !== "string" || code.length === 0 || code.length > 4096)
+    throw bad();
+  const out = { "pre-authorized_code": code };
+  if (grant.tx_code !== void 0) {
+    const t = grant.tx_code;
+    if (!isRecord(t)) throw bad();
+    const tx = {};
+    if (t.input_mode !== void 0) {
+      if (t.input_mode !== "numeric" && t.input_mode !== "text") throw bad();
+      tx.input_mode = t.input_mode;
+    }
+    if (t.length !== void 0) {
+      if (typeof t.length !== "number" || !Number.isInteger(t.length) || t.length <= 0)
+        throw bad();
+      tx.length = t.length;
+    }
+    if (t.description !== void 0) {
+      if (typeof t.description !== "string" || t.description.length > 300)
+        throw bad();
+      tx.description = t.description;
+    }
+    out.tx_code = tx;
+  }
+  if (grant.authorization_server !== void 0) {
+    if (typeof grant.authorization_server !== "string") throw bad();
+    out.authorization_server = grant.authorization_server;
+  }
+  return {
+    credential_issuer: issuer,
+    credential_configuration_ids: [...ids],
+    grants: { [PRE_AUTHORIZED_CODE_GRANT]: out }
+  };
+}
+async function verifyProofJwt(jwt, opts) {
+  const invalid = (reason) => new Oid4vciError("invalid_proof", { reason });
+  let jws;
+  try {
+    jws = decodeJws(typeof jwt === "string" ? jwt.trim() : "");
+  } catch {
+    throw invalid("malformed");
+  }
+  const { header, payload } = jws;
+  if (header.typ !== PROOF_JWT_TYP) throw invalid("wrong_typ");
+  if (!isEd25519JwsAlg(header.alg)) throw invalid("unsupported_alg");
+  if (header.jwk !== void 0 || header.x5c !== void 0)
+    throw invalid("key_not_by_kid");
+  const kid = header.kid;
+  if (typeof kid !== "string" || !kid.startsWith("did:") || !kid.includes("#")) {
+    throw invalid("kid_not_did_url");
+  }
+  if (payload.aud !== opts.audience) throw invalid("wrong_audience");
+  const nowS = toSeconds(clockMs(opts.now));
+  const maxAge = opts.maxAgeSeconds ?? 300;
+  if (typeof payload.iat !== "number" || payload.iat > nowS + CLOCK_SKEW_S || payload.iat < nowS - maxAge - CLOCK_SKEW_S) {
+    throw invalid("stale");
+  }
+  const nonce = payload.nonce;
+  if (opts.nonce !== void 0) {
+    if (typeof nonce !== "string" || nonce.length === 0) {
+      throw new Oid4vciError("invalid_proof", { reason: "no_nonce" });
+    }
+  } else if (nonce !== void 0 && typeof nonce !== "string") {
+    throw invalid("malformed");
+  }
+  const did = didFromKid(kid);
+  let doc;
+  try {
+    doc = await opts.resolver(did);
+  } catch (e) {
+    if (e instanceof ResolverUnavailable) throw e;
+    throw invalid("unknown_did");
+  }
+  const key = doc ? findKey(doc, kid, "authentication") : null;
+  if (!key) throw invalid("key_not_on_did");
+  if (!verifyEd25519(jws.signature, utf8(jws.signingInput), key.publicKey)) {
+    throw invalid("bad_signature");
+  }
+  if (opts.nonce !== void 0) {
+    const ok = typeof opts.nonce === "string" ? nonce === opts.nonce : await opts.nonce(nonce);
+    if (!ok) throw new Oid4vciError("invalid_nonce", { reason: "wrong_nonce" });
+  }
+  return {
+    did,
+    kid: key.id,
+    publicKey: key.publicKey,
+    jwk: publicJwkFromRaw(key.publicKey),
+    ...typeof nonce === "string" ? { nonce } : {}
+  };
+}
+function createProofJwt(input) {
+  return signJws(
+    { alg: input.alg ?? "EdDSA", typ: PROOF_JWT_TYP, kid: input.signer.kid },
+    {
+      aud: input.audience,
+      iat: toSeconds(clockMs(input.now)),
+      ...input.nonce !== void 0 ? { nonce: input.nonce } : {}
+    },
+    input.signer
+  );
+}
+var MAX_METADATA_BYTES = 256 * 1024;
+var MAX_TOKEN_RESPONSE_BYTES = 64 * 1024;
+var MAX_CREDENTIAL_RESPONSE_BYTES = 256 * 1024;
+var OAUTH_ERROR = /^[\x20-\x21\x23-\x5b\x5d-\x7e]{1,64}$/;
+function httpOf(opts) {
+  return {
+    fetch: opts.fetch,
+    allowHttp: opts.allowHttp ?? false,
+    allowLocal: opts.allowLocal ?? false,
+    ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
+  };
+}
+async function call(http, url, init) {
+  if (!isFetchableUrl(url, http)) throw new Oid4vciError("invalid_metadata");
+  let res;
+  try {
+    res = await request(http.fetch, url, {
+      method: init.method,
+      headers: init.headers,
+      ...init.body !== void 0 ? { body: init.body } : {},
+      maxBytes: init.maxBytes,
+      ...http.timeoutMs !== void 0 ? { timeoutMs: http.timeoutMs } : {}
+    });
+  } catch (e) {
+    if (e instanceof HttpError && e.kind === "too_large") {
+      throw new Oid4vciError("invalid_response");
+    }
+    throw new Oid4vciError("issuer_unavailable");
+  }
+  if (res.status >= 500) throw new Oid4vciError("issuer_unavailable");
+  if (res.text.length === 0) return { status: res.status, json: null };
+  try {
+    return { status: res.status, json: JSON.parse(res.text) };
+  } catch {
+    if (res.status >= 200 && res.status < 300)
+      throw new Oid4vciError("invalid_response");
+    return { status: res.status, json: null };
+  }
+}
+function oauthErrorOf(json) {
+  if (isRecord(json) && typeof json.error === "string" && OAUTH_ERROR.test(json.error)) {
+    return json.error;
+  }
+  return void 0;
+}
+function refused(code, json) {
+  const oauthError = oauthErrorOf(json);
+  return new Oid4vciError(code, oauthError !== void 0 ? { oauthError } : {});
+}
+async function fetchIssuerMetadata(credentialIssuer, opts) {
+  const http = httpOf(opts);
+  const { status, json } = await call(
+    http,
+    issuerMetadataUrl(credentialIssuer),
+    {
+      method: "GET",
+      headers: { accept: "application/json" },
+      maxBytes: MAX_METADATA_BYTES
+    }
+  );
+  if (status !== 200 || !isRecord(json))
+    throw new Oid4vciError("invalid_metadata");
+  if (json.credential_issuer !== credentialIssuer)
+    throw new Oid4vciError("invalid_metadata");
+  const endpointOk = (v) => v === void 0 || typeof v === "string" && isFetchableUrl(v, http);
+  if (typeof json.credential_endpoint !== "string" || !endpointOk(json.credential_endpoint) || !endpointOk(json.nonce_endpoint) || !endpointOk(json.deferred_credential_endpoint) || !endpointOk(json.notification_endpoint) || !isRecord(json.credential_configurations_supported)) {
+    throw new Oid4vciError("invalid_metadata");
+  }
+  if (json.authorization_servers !== void 0 && (!Array.isArray(json.authorization_servers) || json.authorization_servers.length === 0 || !json.authorization_servers.every((a) => typeof a === "string"))) {
+    throw new Oid4vciError("invalid_metadata");
+  }
+  return json;
+}
+async function tokenEndpointOf(http, metadata, grant) {
+  const servers = metadata.authorization_servers;
+  let as;
+  if (grant.authorization_server !== void 0) {
+    if (!servers?.includes(grant.authorization_server))
+      throw new Oid4vciError("invalid_offer");
+    as = grant.authorization_server;
+  } else if (servers) {
+    if (servers.length !== 1) throw new Oid4vciError("unsupported_offer");
+    as = servers[0];
+  } else {
+    as = metadata.credential_issuer;
+  }
+  if (!isFetchableUrl(as, http)) throw new Oid4vciError("invalid_metadata");
+  const { status, json } = await call(
+    http,
+    authorizationServerMetadataUrl(as),
+    {
+      method: "GET",
+      headers: { accept: "application/json" },
+      maxBytes: MAX_METADATA_BYTES
+    }
+  );
+  if (status !== 200 || !isRecord(json) || json.issuer !== as || typeof json.token_endpoint !== "string" || !isFetchableUrl(json.token_endpoint, http)) {
+    throw new Oid4vciError("invalid_metadata");
+  }
+  return json.token_endpoint;
+}
+function readCredentialResponse(json) {
+  if (!isRecord(json) || !Array.isArray(json.credentials) || json.credentials.length !== 1) {
+    throw new Oid4vciError("invalid_response");
+  }
+  const first = json.credentials[0];
+  if (!isRecord(first) || typeof first.credential !== "string" || first.credential.length === 0) {
+    throw new Oid4vciError("invalid_response");
+  }
+  if (json.notification_id !== void 0 && typeof json.notification_id !== "string") {
+    throw new Oid4vciError("invalid_response");
+  }
+  return {
+    credential: first.credential,
+    ...typeof json.notification_id === "string" ? { notificationId: json.notification_id } : {}
+  };
+}
+function readDeferredResponse(json) {
+  if (!isRecord(json) || typeof json.transaction_id !== "string" || json.transaction_id.length === 0 || typeof json.interval !== "number" || !(json.interval > 0)) {
+    throw new Oid4vciError("invalid_response");
+  }
+  return { transactionId: json.transaction_id, interval: json.interval };
+}
+var MAX_OFFER_BYTES = 64 * 1024;
+async function fetchCredentialOffer(credentialOfferUri, opts) {
+  const http = httpOf(opts);
+  if (!isFetchableUrl(credentialOfferUri, http)) {
+    throw new Oid4vciError("invalid_offer");
+  }
+  const res = await call(http, credentialOfferUri, {
+    method: "GET",
+    headers: { accept: "application/json", "cache-control": "no-store" },
+    maxBytes: MAX_OFFER_BYTES
+  });
+  if (res.status !== 200) throw refused("issuer_error", res.json);
+  return validateCredentialOffer(res.json, http);
+}
+async function holderKeyOf(signer, resolver) {
+  if (signer.publicKey instanceof Uint8Array && signer.publicKey.length === 32)
+    return signer.publicKey;
+  const doc = await resolver(didFromKid(signer.kid));
+  const key = doc ? findKey(doc, signer.kid, "authentication") : null;
+  if (!key)
+    throw new Oid4vciError("invalid_proof", { reason: "key_not_on_did" });
+  return key.publicKey;
+}
+async function checkCredential(credential, verification, now, onFailure) {
+  const result = await verifyIssuedCredential(credential, {
+    ...verification,
+    ...now !== void 0 ? { now } : {}
+  });
+  if (result.ok) return result;
+  await onFailure().catch(() => void 0);
+  throw new Oid4vciError("invalid_credential", { reason: result.code });
+}
+async function redeemOffer(input) {
+  const http = httpOf(input);
+  const verify = input.verify ?? true;
+  if (verify && input.resolver === void 0) {
+    throw new TypeError(
+      "redeemOffer needs a resolver to check the credential (or verify: false)."
+    );
+  }
+  const expectedIssuer = input.expectedIssuer;
+  if (verify && expectedIssuer !== false && (typeof expectedIssuer !== "string" || expectedIssuer.length === 0)) {
+    throw new TypeError(
+      "redeemOffer needs expectedIssuer (the DID that should have issued the credential), or expectedIssuer: false to accept any issuer."
+    );
+  }
+  if (input.offer === void 0 === (input.credentialOfferUri === void 0)) {
+    throw new TypeError("Give exactly one of offer and credentialOfferUri.");
+  }
+  const offer = input.credentialOfferUri !== void 0 ? await fetchCredentialOffer(input.credentialOfferUri, http) : validateCredentialOffer(input.offer, http);
+  if (offer.credential_configuration_ids.length !== 1) {
+    throw new Oid4vciError("unsupported_offer");
+  }
+  const configurationId = offer.credential_configuration_ids[0];
+  const grant = offer.grants[PRE_AUTHORIZED_CODE_GRANT];
+  if (grant.tx_code !== void 0)
+    throw new Oid4vciError("tx_code_unsupported");
+  const metadata = await fetchIssuerMetadata(offer.credential_issuer, http);
+  const configuration = metadata.credential_configurations_supported[configurationId];
+  if (!isRecord(configuration) || configuration.format !== "dc+sd-jwt") {
+    throw new Oid4vciError("unsupported_offer");
+  }
+  const holderDid = didFromKid(input.signer.kid);
+  const bindingMethods = configuration.cryptographic_binding_methods_supported;
+  if (bindingMethods !== void 0) {
+    const method = /^did:[a-z0-9]+/.exec(holderDid)?.[0];
+    if (!Array.isArray(bindingMethods) || method === void 0 || !bindingMethods.includes(method))
+      throw new Oid4vciError("unsupported_offer");
+  }
+  let proofAlg = "EdDSA";
+  const proofTypes = configuration.proof_types_supported;
+  if (proofTypes !== void 0) {
+    const jwtProof = isRecord(proofTypes) ? proofTypes.jwt : void 0;
+    const algs = isRecord(jwtProof) ? jwtProof.proof_signing_alg_values_supported : void 0;
+    if (!Array.isArray(algs)) throw new Oid4vciError("unsupported_offer");
+    if (algs.includes("EdDSA")) proofAlg = "EdDSA";
+    else if (algs.includes("Ed25519")) proofAlg = "Ed25519";
+    else throw new Oid4vciError("unsupported_offer");
+  }
+  if (typeof configuration.vct !== "string" || configuration.vct.length === 0)
+    throw new Oid4vciError("invalid_metadata");
+  const verification = verify && input.resolver ? {
+    subject: holderDid,
+    holderKey: await holderKeyOf(input.signer, input.resolver),
+    vct: configuration.vct,
+    resolver: input.resolver,
+    issuer: typeof expectedIssuer === "string" ? expectedIssuer : false
+  } : null;
+  const tokenEndpoint = await tokenEndpointOf(http, metadata, grant);
+  const form = new URLSearchParams({
+    grant_type: PRE_AUTHORIZED_CODE_GRANT,
+    "pre-authorized_code": grant["pre-authorized_code"]
+  });
+  const token = await call(http, tokenEndpoint, {
+    method: "POST",
+    headers: {
+      "content-type": "application/x-www-form-urlencoded",
+      accept: "application/json"
+    },
+    body: form.toString(),
+    maxBytes: MAX_TOKEN_RESPONSE_BYTES
+  });
+  if (token.status !== 200) throw refused("token_error", token.json);
+  const tj = token.json;
+  if (!isRecord(tj) || typeof tj.access_token !== "string" || tj.access_token.length === 0 || typeof tj.token_type !== "string" || tj.token_type.toLowerCase() !== "bearer") {
+    throw new Oid4vciError("invalid_response");
+  }
+  const accessToken = tj.access_token;
+  let credentialIdentifier;
+  if (Array.isArray(tj.authorization_details)) {
+    const detail = tj.authorization_details.find(
+      (d) => isRecord(d) && d.type === "openid_credential" && d.credential_configuration_id === configurationId
+    );
+    if (isRecord(detail) && Array.isArray(detail.credential_identifiers)) {
+      const first = detail.credential_identifiers[0];
+      if (typeof first !== "string") throw new Oid4vciError("invalid_response");
+      credentialIdentifier = first;
+    }
+  }
+  const getNonce = async () => {
+    if (metadata.nonce_endpoint === void 0) return void 0;
+    const res2 = await call(http, metadata.nonce_endpoint, {
+      method: "POST",
+      headers: { accept: "application/json" },
+      maxBytes: MAX_TOKEN_RESPONSE_BYTES
+    });
+    if (res2.status !== 200 || !isRecord(res2.json) || typeof res2.json.c_nonce !== "string") {
+      throw new Oid4vciError("invalid_response");
+    }
+    return res2.json.c_nonce;
+  };
+  const requestCredential = async (nonce) => {
+    const proof = await createProofJwt({
+      signer: input.signer,
+      audience: metadata.credential_issuer,
+      alg: proofAlg,
+      ...nonce !== void 0 ? { nonce } : {},
+      ...input.now !== void 0 ? { now: input.now } : {}
+    });
+    const body = credentialIdentifier !== void 0 ? {
+      credential_identifier: credentialIdentifier,
+      proofs: { jwt: [proof] }
+    } : {
+      credential_configuration_id: configurationId,
+      proofs: { jwt: [proof] }
+    };
+    return call(http, metadata.credential_endpoint, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${accessToken}`,
+        "content-type": "application/json",
+        accept: "application/json"
+      },
+      body: JSON.stringify(body),
+      maxBytes: MAX_CREDENTIAL_RESPONSE_BYTES
+    });
+  };
+  let res = await requestCredential(await getNonce());
+  if (res.status === 400 && oauthErrorOf(res.json) === "invalid_nonce") {
+    res = await requestCredential(await getNonce());
+  }
+  const notificationEndpoint = metadata.notification_endpoint;
+  if (res.status === 200) {
+    const issued = readCredentialResponse(res.json);
+    let verified;
+    if (verification) {
+      verified = await checkCredential(
+        issued.credential,
+        verification,
+        input.now,
+        async () => {
+          if (notificationEndpoint && issued.notificationId)
+            await sendNotification({
+              notificationEndpoint,
+              accessToken,
+              notificationId: issued.notificationId,
+              event: "credential_failure",
+              eventDescription: "credential did not verify",
+              ...http
+            });
+        }
+      );
+    }
+    return {
+      status: "issued",
+      ...issued,
+      accessToken,
+      ...notificationEndpoint !== void 0 ? { notificationEndpoint } : {},
+      ...verified ? { verified } : {}
+    };
+  }
+  if (res.status === 202) {
+    const deferredEndpoint = metadata.deferred_credential_endpoint;
+    if (deferredEndpoint === void 0)
+      throw new Oid4vciError("invalid_metadata");
+    return {
+      status: "deferred",
+      ...readDeferredResponse(res.json),
+      accessToken,
+      deferredEndpoint,
+      ...notificationEndpoint !== void 0 ? { notificationEndpoint } : {},
+      verification
+    };
+  }
+  throw refused("issuer_error", res.json);
+}
+async function pollDeferred(input) {
+  if (input.verification === void 0 || input.verification === null)
+    throw new TypeError(
+      "pollDeferred needs the verification from redeemOffer (or false)."
+    );
+  const http = httpOf(input);
+  const body = {
+    transaction_id: input.transactionId
+  };
+  const res = await call(http, input.deferredEndpoint, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${input.accessToken}`,
+      "content-type": "application/json",
+      accept: "application/json"
+    },
+    body: JSON.stringify(body),
+    maxBytes: MAX_CREDENTIAL_RESPONSE_BYTES
+  });
+  if (res.status === 200) {
+    const issued = readCredentialResponse(res.json);
+    if (input.verification === false) return { status: "issued", ...issued };
+    const verified = await checkCredential(
+      issued.credential,
+      input.verification,
+      input.now,
+      () => Promise.resolve()
+    );
+    return { status: "issued", ...issued, verified };
+  }
+  if (res.status === 202)
+    return { status: "deferred", ...readDeferredResponse(res.json) };
+  throw refused("issuer_error", res.json);
+}
+var EVENT_DESCRIPTION = /^[\x20-\x21\x23-\x5b\x5d-\x7e]*$/;
+async function sendNotification(input) {
+  if (input.eventDescription !== void 0 && !EVENT_DESCRIPTION.test(input.eventDescription)) {
+    throw new TypeError(
+      'eventDescription must be printable ASCII without " and \\'
+    );
+  }
+  const http = httpOf(input);
+  const body = {
+    notification_id: input.notificationId,
+    event: input.event,
+    ...input.eventDescription !== void 0 ? { event_description: input.eventDescription } : {}
+  };
+  const res = await call(http, input.notificationEndpoint, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${input.accessToken}`,
+      "content-type": "application/json",
+      accept: "application/json"
+    },
+    body: JSON.stringify(body),
+    maxBytes: MAX_TOKEN_RESPONSE_BYTES
+  });
+  if (res.status < 200 || res.status >= 300)
+    throw refused("issuer_error", res.json);
+}
+
+export { Oid4vciError, authorizationServerMetadataUrl, buildAuthorizationServerMetadata, buildCredentialOffer, buildIssuerMetadata, createProofJwt, fetchCredentialOffer, fetchIssuerMetadata, issuerMetadataUrl, pollDeferred, redeemOffer, sendNotification, validateCredentialOffer, verifyProofJwt };
+//# sourceMappingURL=chunk-FSKCDHZ7.js.map
+//# sourceMappingURL=chunk-FSKCDHZ7.js.map