@learncard/openid4vc-plugin 0.0.1

package/dist/vci/types.d.ts

@@ -0,0 +1,156 @@
+/**
+ * Domain types for the OID4VCI pre-authorized_code flow.
+ *
+ * Kept intentionally narrow — we only type the fields the wallet actually
+ * consumes. Issuer metadata carries many optional display/branding fields
+ * that we pass through as `unknown` rather than over-specifying.
+ */
+/**
+ * Minimal Credential Issuer Metadata shape.
+ *
+ * Per Draft 13 §11.2, issuers publish this at
+ * `${credential_issuer}/.well-known/openid-credential-issuer`.
+ */
+export interface CredentialIssuerMetadata {
+    /** MUST match the `credential_issuer` from the offer. */
+    credential_issuer: string;
+    /** Endpoint to POST credential requests to. Required. */
+    credential_endpoint: string;
+    /** Optional endpoint for notification of credential acceptance. */
+    notification_endpoint?: string;
+    /**
+     * Authorization servers delegated for token issuance. If omitted, the
+     * issuer itself is the AS and exposes token/auth endpoints directly.
+     */
+    authorization_servers?: string[];
+    /**
+     * Deferred endpoint — not used in Slice 2; credentials returned
+     * synchronously from the credential endpoint.
+     */
+    deferred_credential_endpoint?: string;
+    /**
+     * Credential configurations keyed by configuration id. Values are left
+     * as `unknown` for now; Slice 5 will narrow the `ldp_vc` + `jwt_vc_json`
+     * shapes when we start honoring `types` and `credential_definition`.
+     */
+    credential_configurations_supported?: Record<string, unknown>;
+    /** Pass-through catch-all for fields we don't consume. */
+    [k: string]: unknown;
+}
+/**
+ * Minimal Authorization Server Metadata (RFC 8414 + OID4VCI extensions).
+ *
+ * Fetched from `${auth_server}/.well-known/oauth-authorization-server`
+ * (preferred) or `/.well-known/openid-configuration` (fallback).
+ */
+export interface AuthorizationServerMetadata {
+    issuer: string;
+    /** Required for pre-authorized_code flow. */
+    token_endpoint: string;
+    authorization_endpoint?: string;
+    /**
+     * OID4VCI extension — if present and `true`, the AS supports
+     * `pre-authorized_code` as a grant type.
+     */
+    'pre-authorized_grant_anonymous_access_supported'?: boolean;
+    grant_types_supported?: string[];
+    [k: string]: unknown;
+}
+/** Successful response from the token endpoint. */
+export interface TokenResponse {
+    access_token: string;
+    token_type: 'Bearer' | 'DPoP' | string;
+    expires_in?: number;
+    /** Nonce the wallet must echo in its proof-of-possession JWT. */
+    c_nonce?: string;
+    c_nonce_expires_in?: number;
+    /**
+     * If the token endpoint returned authorization details, the wallet
+     * should use them to shape the credential request. We pass them
+     * through but do not enforce them in Slice 2.
+     */
+    authorization_details?: unknown;
+    [k: string]: unknown;
+}
+/** RFC 6749 §5.2 error body. */
+export interface OAuthErrorBody {
+    error: string;
+    error_description?: string;
+    error_uri?: string;
+}
+/**
+ * Body of a successful credential request response. Either
+ * - `credential` present (synchronous issuance), or
+ * - `transaction_id` present (deferred issuance — not yet supported).
+ *
+ * Slice 2 only handles synchronous jwt_vc_json; other branches surface
+ * `unsupported_format` for the caller to handle.
+ */
+export interface CredentialResponseBody {
+    credential?: unknown;
+    credentials?: Array<{
+        credential: unknown;
+        [k: string]: unknown;
+    }>;
+    transaction_id?: string;
+    c_nonce?: string;
+    c_nonce_expires_in?: number;
+    notification_id?: string;
+    [k: string]: unknown;
+}
+/** Result of {@link acceptCredentialOffer} — what the caller actually cares about. */
+export interface AcceptedCredentialResult {
+    /** One entry per credential returned by the issuer. */
+    credentials: Array<{
+        /** `jwt_vc_json`, `ldp_vc`, etc. */
+        format: string;
+        /** The raw credential payload — a JWT string for jwt_vc_json, a JSON object for ldp_vc. */
+        credential: unknown;
+        /** The configuration id from the offer that produced this credential. */
+        configuration_id: string;
+    }>;
+    /** Issuer-supplied id the wallet should echo in a notification POST. */
+    notification_id?: string;
+    /** Fresh nonce from the credential response, if rotated. */
+    c_nonce?: string;
+    c_nonce_expires_in?: number;
+}
+/** A signer capable of producing JWS detached / compact signatures. */
+export interface ProofJwtSigner {
+    /** JWS `alg` — e.g. `EdDSA`, `ES256`. */
+    alg: string;
+    /** Verification-method URL for the `kid` header (e.g. `did:key:z6M...#z6M...`). */
+    kid: string;
+    /**
+     * Produce a compact JWS over the given header + payload.
+     *
+     * Implementations MUST merge `alg` and `kid` / other header members
+     * the caller supplies (e.g. `typ: openid4vci-proof+jwt`).
+     */
+    sign: (header: Record<string, unknown>, payload: Record<string, unknown>) => Promise<string>;
+}
+/** Options for accepting a credential offer via the pre-authorized code grant. */
+export interface AcceptCredentialOfferOptions {
+    /**
+     * Transaction code the user entered, if the offer required one
+     * (offer's `tx_code` field is present).
+     */
+    txCode?: string;
+    /**
+     * Optional override of the signer. Defaults to a signer backed by the
+     * LearnCard's Ed25519 keypair.
+     */
+    signer?: ProofJwtSigner;
+    /**
+     * Client identifier presented to the authorization server. Most
+     * pre-authorized flows accept anonymous clients, but some AS's
+     * require one.
+     */
+    clientId?: string;
+    /**
+     * Subset of `credential_configuration_ids` from the offer to actually
+     * request. Defaults to all of them.
+     */
+    configurationIds?: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/vci/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/vci/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACrC,yDAAyD;IACzD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mEAAmE;IACnE,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC;;;OAGG;IACH,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC;;;;OAIG;IACH,mCAAmC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9D,0DAA0D;IAC1D,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,2BAA2B;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,cAAc,EAAE,MAAM,CAAC;IACvB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,iDAAiD,CAAC,EAAE,OAAO,CAAC;IAC5D,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,mDAAmD;AACnD,MAAM,WAAW,aAAa;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,gCAAgC;AAChC,MAAM,WAAW,cAAc;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACnC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC,CAAC;IACnE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,sFAAsF;AACtF,MAAM,WAAW,wBAAwB;IACrC,uDAAuD;IACvD,WAAW,EAAE,KAAK,CAAC;QACf,oCAAoC;QACpC,MAAM,EAAE,MAAM,CAAC;QACf,2FAA2F;QAC3F,UAAU,EAAE,OAAO,CAAC;QACpB,yEAAyE;QACzE,gBAAgB,EAAE,MAAM,CAAC;KAC5B,CAAC,CAAC;IACH,wEAAwE;IACxE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC3B,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,mFAAmF;IACnF,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAChG;AAED,kFAAkF;AAClF,MAAM,WAAW,4BAA4B;IACzC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B"}

package/dist/vp/client-id-prefix.d.ts

@@ -0,0 +1,115 @@
+/**
+ * **OID4VP 1.0 §5.10 — Client Identifier Prefix derivation.**
+ *
+ * The prefix tells the wallet *how to verify* a verifier's identity:
+ *
+ *   - `pre-registered` — the verifier is in the wallet's local registry;
+ *     `client_id` is whatever ID the registration agreed on (an opaque
+ *     string, often a slug).
+ *   - `redirect_uri` — the verifier's identity IS its redirect URL;
+ *     no signed Request Object permitted (no key to verify against).
+ *   - `https` — `client_id` is the verifier's HTTPS URL; verifier
+ *     metadata (and its signing key) is fetched from
+ *     `<client_id>/.well-known/openid-federation`.
+ *   - `did` — `client_id` is a DID URL; signing key resolves through
+ *     the DID document.
+ *   - `verifier_attestation` — the verifier carries a self-attesting
+ *     JWT in the JWS header (cnf claim).
+ *   - `x509_san_dns` — the JWS `x5c` chain's leaf cert binds to the
+ *     hostname half of `client_id` via DNS SAN.
+ *   - `x509_hash` — same as above but the binding is a hash match
+ *     against `client_id` rather than a DNS name.
+ *
+ * # Two encoding styles to handle
+ *
+ * Wallets see both forms in the wild:
+ *
+ *   - **Draft 22 / earlier** ships `client_id_scheme` as a *separate*
+ *     parameter (URL or signed claim) and `client_id` is the bare
+ *     identifier:
+ *
+ *         client_id=did:jwk:eyJhbGc...
+ *         client_id_scheme=did
+ *
+ *   - **OID4VP 1.0** packs the prefix *inline* in `client_id` as
+ *     `<prefix>:<value>`:
+ *
+ *         client_id=x509_san_dns:verifier.example.com
+ *         client_id=did:jwk:eyJhbGc...           (prefix `did` is
+ *                                                  implicit; the DID
+ *                                                  URI scheme IS the
+ *                                                  prefix)
+ *         client_id=Verifier                     (no prefix → defaults
+ *                                                  to pre-registered)
+ *
+ * `deriveClientIdPrefix` accepts both styles and returns a normalized
+ * `{ prefix, value }` so downstream verification code doesn't care
+ * which encoding the verifier picked.
+ *
+ * # Why this lives in its own module
+ *
+ * This logic is **the security perimeter** for verifier identity:
+ * every signed Request Object's trust binding chains off the prefix
+ * we derive here. Keeping it in one tested module (rather than
+ * inlining the string-munging in `request-object.ts`) means:
+ *
+ *   1. The test surface is one cohesive matrix instead of being
+ *      smeared across the JAR verifier's tests.
+ *   2. URI-mode (`by_value`) and Request-Object-mode (`by_reference`)
+ *      share exactly the same derivation, so we can't drift between
+ *      them.
+ *   3. Adding a new prefix in the future (e.g. `web_origin` from a
+ *      future spec rev) is a one-line addition here, not a sweep.
+ */
+/**
+ * The OID4VP 1.0 client-identifier prefixes the plugin recognizes.
+ * `did` includes the legacy `decentralized_identifier` synonym some
+ * implementations emit; both normalize to `did`.
+ */
+export type ClientIdPrefix = 'pre-registered' | 'redirect_uri' | 'https' | 'did' | 'verifier_attestation' | 'x509_san_dns' | 'x509_hash';
+export declare const KNOWN_CLIENT_ID_PREFIXES: readonly ClientIdPrefix[];
+export interface DerivedClientId {
+    /** Normalized prefix that downstream verification keys off. */
+    prefix: ClientIdPrefix;
+    /**
+     * The post-prefix portion of `client_id` — the actual verifier
+     * identifier (DNS name, DID, URL, registered slug, …). Equal to
+     * `clientId` when no prefix was inline (e.g. `pre-registered`).
+     */
+    value: string;
+    /**
+     * `true` when the prefix was inferred (legacy draft-22 form, OR
+     * a DID URI encoding the `did` prefix implicitly, OR the
+     * `pre-registered` default for a bare client_id). Useful for
+     * logging / interop diagnostics; verification logic shouldn't
+     * branch on it.
+     */
+    inferred: boolean;
+}
+/**
+ * Derive the client-id prefix from a verifier's `client_id` plus an
+ * optional legacy `client_id_scheme` parameter.
+ *
+ * Resolution order:
+ *
+ *   1. **Legacy `client_id_scheme` wins** when supplied (draft-22
+ *      semantics). The full `client_id` is the value. Validates that
+ *      the supplied scheme is one we recognize.
+ *   2. **Explicit prefix in `client_id`**: if `client_id` starts with
+ *      `<prefix>:` for any prefix that requires explicit encoding
+ *      (everything except `pre-registered`, `did`, and `https`,
+ *      which have implicit forms), strip and use it.
+ *   3. **`https://` URL** → prefix `https`, value = full URL.
+ *   4. **`did:` URI** → prefix `did`, value = full DID (the DID's
+ *      own colon-delimited form encodes the prefix implicitly).
+ *   5. **Fallback** → `pre-registered`, value = `client_id` verbatim.
+ *
+ * Throws nothing — returns a value for every input. Spec violations
+ * (e.g. caller-supplied `client_id_scheme=garbage`) bubble up as
+ * `prefix: pre-registered` with a `legacySchemeIgnored` diagnostic
+ * the caller can surface; this keeps the function pure and lets the
+ * security-critical "is this prefix one I know how to verify"
+ * decision happen at the JAR verifier where the trust context lives.
+ */
+export declare const deriveClientIdPrefix: (clientId: string, legacyScheme?: string) => DerivedClientId;
+//# sourceMappingURL=client-id-prefix.d.ts.map

package/dist/vp/client-id-prefix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-id-prefix.d.ts","sourceRoot":"","sources":["../../src/vp/client-id-prefix.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAEH;;;;GAIG;AACH,MAAM,MAAM,cAAc,GACpB,gBAAgB,GAChB,cAAc,GACd,OAAO,GACP,KAAK,GACL,sBAAsB,GACtB,cAAc,GACd,WAAW,CAAC;AAElB,eAAO,MAAM,wBAAwB,EAAE,SAAS,cAAc,EAQ7D,CAAC;AAEF,MAAM,WAAW,eAAe;IAC5B,+DAA+D;IAC/D,MAAM,EAAE,cAAc,CAAC;IAEvB;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;;;;;OAMG;IACH,QAAQ,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,oBAAoB,aACnB,MAAM,iBACD,MAAM,KACtB,eAgFF,CAAC"}

package/dist/vp/encrypt.d.ts

@@ -0,0 +1,221 @@
+/**
+ * Slice 7d — **`direct_post.jwt` response encryption (JARM)**.
+ *
+ * OID4VP §8.3 lets the verifier ask the wallet to send the
+ * Authorization Response as a single signed-and/or-encrypted JOSE
+ * blob (JARM) instead of as cleartext form fields. The wire shape:
+ *
+ *     POST {response_uri}
+ *     Content-Type: application/x-www-form-urlencoded
+ *
+ *     response={JOSE blob}
+ *
+ * where `{JOSE blob}` is one of:
+ *
+ *   - **JWE only** — the response object packed as a compact JWE.
+ *   - **JWS only** — the response object signed as a compact JWS.
+ *     Rare in practice; OID4VP §8.3 mandates encryption when the
+ *     verifier publishes encryption keys.
+ *   - **Nested JWS-in-JWE** — the response object is signed by the
+ *     wallet (outer authorship binding), then the JWS is encrypted
+ *     to the verifier's enc key (transport confidentiality). This
+ *     is the EUDI-flavored production shape.
+ *
+ * The plaintext payload (whether the JWE plaintext or the JWS
+ * payload) is a JSON object carrying the same fields that
+ * `direct_post` cleartext would send as form parameters:
+ *
+ *     {
+ *       "vp_token": "<jws>" | { "<query_id>": "..." },
+ *       "presentation_submission": { ... },   // PEX only
+ *       "state": "...",                        // when Auth Request had it
+ *       "id_token": "..."                      // SIOPv2 only
+ *     }
+ *
+ * # What this module does
+ *
+ * `encryptResponseObject` takes the plaintext payload + the
+ * verifier's `client_metadata` and returns the compact JOSE string
+ * suitable to put in the `response` form field.
+ *
+ *   - Picks an encryption key from `client_metadata.jwks` (or fetches
+ *     `client_metadata.jwks_uri` when only the URL is supplied) per
+ *     OID4VP §8.3 paragraphs 2-4: a key with `use: "enc"` (or no
+ *     `use` claim) whose `alg` (or none) matches the verifier's
+ *     `authorization_encrypted_response_alg`.
+ *   - Negotiates the JWE algorithms from
+ *     `authorization_encrypted_response_alg` (key wrap) and
+ *     `authorization_encrypted_response_enc` (content encryption).
+ *     Falls back to the spec-recommended `ECDH-ES` + `A256GCM` if the
+ *     verifier didn't declare specific algorithms.
+ *   - Sets the `apv` JWE protected header to the base64url-encoding
+ *     of the verifier's `nonce` from the Authorization Request, per
+ *     OID4VP §8.3 paragraph 6 (mandatory for ECDH-ES KDFs to bind
+ *     the encryption to the session). Optionally sets `apu` if the
+ *     caller provides a wallet-side nonce.
+ *   - When the verifier ALSO declared
+ *     `authorization_signed_response_alg`, signs the payload first
+ *     with the wallet's signing key and encrypts the resulting JWS
+ *     instead of the raw JSON. The inner JWS protected header
+ *     carries the wallet's `kid`/`alg` so the verifier can identify
+ *     who authored the response.
+ *
+ * # What this module does NOT do
+ *
+ *   - **Network I/O is injected.** When the verifier publishes its
+ *     keys via `jwks_uri` (instead of inline `jwks`), the caller
+ *     passes a `fetchImpl` so the module stays testable.
+ *   - **Wallet signing is injected.** The optional inner JWS uses a
+ *     caller-supplied signer (the same one that signs vp_token JWTs);
+ *     this module never touches the wallet's keystore directly.
+ *   - **Decryption.** Wallets only encrypt outbound responses; the
+ *     verifier handles decryption. The Sphereon test harness has its
+ *     own decryption shim mirroring this module's encrypt shape so
+ *     interop tests can round-trip.
+ *
+ * # Why this is its own module
+ *
+ * Encryption is the security perimeter for response confidentiality —
+ * a bug here leaks every claim the wallet ever discloses. Keeping it
+ * in one tested module (rather than inlining JWE building inside
+ * `submit.ts`) means:
+ *
+ *   1. The unit-test surface is one cohesive matrix of algorithm
+ *      negotiations, key-selection edge cases, and nonce-binding
+ *      assertions, not smeared across the transport's tests.
+ *   2. The transport (`submit.ts`) stays a pure HTTP layer; whether
+ *      the response is cleartext or JOSE is a one-line dispatch
+ *      based on `response_mode`.
+ *   3. Future work (e.g. signed-only JARM responses for low-privacy
+ *      use cases, or post-quantum KEM algorithms) lands here without
+ *      touching the wire layer.
+ */
+import { type JWK } from 'jose';
+import type { ProofJwtSigner } from '../vci/types';
+/**
+ * The plaintext response object — same fields the cleartext
+ * `direct_post` mode sends as form parameters, packed into a single
+ * JSON object that becomes the JWE plaintext (or the JWS payload
+ * when nested signing is in use).
+ */
+export interface ResponseObjectPayload {
+    /**
+     * Signed VP token. Three shapes are accepted (mirrors the
+     * `submit.ts` `VpToken` discriminator):
+     *  - PEX `jwt_vp_json` → compact JWS string
+     *  - PEX `ldp_vp`      → signed VP JSON object
+     *  - DCQL response     → JSON object keyed by credential_query_id
+     */
+    vp_token: string | Record<string, unknown>;
+    /**
+     * DIF PEX v2 Presentation Submission. Required for PEX flows;
+     * MUST be omitted for DCQL flows (which embed routing in the
+     * vp_token keying).
+     */
+    presentation_submission?: Record<string, unknown>;
+    /**
+     * Verifier's `state` echoed back so it can correlate the response
+     * with the pending session. Omitted when the Auth Request didn't
+     * carry one.
+     */
+    state?: string;
+    /**
+     * SIOPv2 ID token. Required when the verifier asked for
+     * `response_type=vp_token id_token`; must be omitted otherwise.
+     */
+    id_token?: string;
+    /**
+     * Pass-through for any extension fields a future spec rev (or a
+     * vendor-specific deployment) requires the wallet to echo. Kept
+     * as `unknown` so we don't silently corrupt unfamiliar shapes.
+     */
+    [extra: string]: unknown;
+}
+/**
+ * Subset of `client_metadata` (OID4VP §5.6) that JARM cares about.
+ * Loose by design — the spec lets verifiers add fields, and we only
+ * validate the ones that drive cryptographic decisions.
+ */
+export interface JarmClientMetadata {
+    /** Inline JWKS — preferred over `jwks_uri` when both are present. */
+    jwks?: {
+        keys: JWK[];
+    };
+    /** URL form of `jwks` — fetched lazily when no inline jwks is set. */
+    jwks_uri?: string;
+    /**
+     * JWE key-wrap algorithm the verifier expects. Common values:
+     * `ECDH-ES`, `ECDH-ES+A256KW`, `RSA-OAEP-256`. When omitted the
+     * spec recommends `ECDH-ES` (§8.3 paragraph 4).
+     */
+    authorization_encrypted_response_alg?: string;
+    /**
+     * JWE content-encryption algorithm. Common values: `A256GCM`,
+     * `A128CBC-HS256`. Spec default: `A256GCM`.
+     */
+    authorization_encrypted_response_enc?: string;
+    /**
+     * Optional outer-JWS algorithm. When set, the wallet MUST sign
+     * the payload first with this alg before encrypting. When unset,
+     * the JWE plaintext is the raw JSON payload (no nested signing).
+     */
+    authorization_signed_response_alg?: string;
+}
+export interface EncryptResponseObjectOptions {
+    /**
+     * Plaintext response-object payload. Stringified (JSON) and
+     * either signed-then-encrypted or encrypted directly depending
+     * on `clientMetadata.authorization_signed_response_alg`.
+     */
+    payload: ResponseObjectPayload;
+    /** Verifier's `client_metadata` from the Authorization Request. */
+    clientMetadata: JarmClientMetadata;
+    /**
+     * Verifier's `nonce` from the Authorization Request — base64url-
+     * encoded and placed in the JWE protected header's `apv` field
+     * per OID4VP §8.3 paragraph 6. Required: omitting it produces a
+     * JWE the verifier MUST reject for ECDH-ES key wrap.
+     */
+    verifierNonce: string;
+    /**
+     * Optional wallet-side nonce, base64url-encoded into the JWE's
+     * `apu` field. Useful for ECDH-1PU flows where the wallet binds
+     * its own key to the session; OID4VP doesn't mandate it.
+     */
+    walletNonce?: string;
+    /**
+     * Wallet's signer — reuses the same `ProofJwtSigner` shape used
+     * by VCI proof-of-possession and outer VP signing, so callers can
+     * thread their existing signer through unchanged. Required only
+     * when `clientMetadata.authorization_signed_response_alg` is set
+     * (nested JWS-in-JWE mode); ignored otherwise.
+     */
+    signer?: ProofJwtSigner;
+    /**
+     * Override fetch — defaults to `globalThis.fetch`. Only consulted
+     * when the verifier supplied `jwks_uri` instead of inline `jwks`.
+     */
+    fetchImpl?: typeof fetch;
+}
+export type JarmEncryptErrorCode = 'no_encryption_key' | 'invalid_jwks' | 'jwks_fetch_failed' | 'unsupported_alg' | 'missing_signer' | 'sign_failed' | 'encrypt_failed';
+export declare class JarmEncryptError extends Error {
+    readonly code: JarmEncryptErrorCode;
+    constructor(code: JarmEncryptErrorCode, message: string, extra?: {
+        cause?: unknown;
+    });
+}
+/**
+ * Default JWE algorithms when the verifier didn't declare any. The
+ * spec leaves the choice to the verifier; we pick the
+ * spec-recommended pair so a verifier that fails to advertise
+ * algorithms still gets something it's likely to accept.
+ */
+export declare const DEFAULT_JWE_ALG = "ECDH-ES";
+export declare const DEFAULT_JWE_ENC = "A256GCM";
+/**
+ * Build the JOSE blob to put in the `response` form field for a
+ * `direct_post.jwt` submission. See the module docstring for the
+ * full algorithm + edge-case matrix.
+ */
+export declare const encryptResponseObject: (options: EncryptResponseObjectOptions) => Promise<string>;
+//# sourceMappingURL=encrypt.d.ts.map

package/dist/vp/encrypt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypt.d.ts","sourceRoot":"","sources":["../../src/vp/encrypt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2FG;AACH,OAAO,EAA6B,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAE3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAMnD;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IAClC;;;;;;OAMG;IACH,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE3C;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAElD;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IAC/B,qEAAqE;IACrE,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,CAAC;IAEvB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,oCAAoC,CAAC,EAAE,MAAM,CAAC;IAE9C;;;OAGG;IACH,oCAAoC,CAAC,EAAE,MAAM,CAAC;IAE9C;;;;OAIG;IACH,iCAAiC,CAAC,EAAE,MAAM,CAAC;CAC9C;AAED,MAAM,WAAW,4BAA4B;IACzC;;;;OAIG;IACH,OAAO,EAAE,qBAAqB,CAAC;IAE/B,mEAAmE;IACnE,cAAc,EAAE,kBAAkB,CAAC;IAEnC;;;;;OAKG;IACH,aAAa,EAAE,MAAM,CAAC;IAEtB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC5B;AAMD,MAAM,MAAM,oBAAoB,GAC1B,mBAAmB,GACnB,cAAc,GACd,mBAAmB,GACnB,iBAAiB,GACjB,gBAAgB,GAChB,aAAa,GACb,gBAAgB,CAAC;AAEvB,qBAAa,gBAAiB,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;gBAGhC,IAAI,EAAE,oBAAoB,EAC1B,OAAO,EAAE,MAAM,EACf,KAAK,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO;CAStC;AAMD;;;;;GAKG;AACH,eAAO,MAAM,eAAe,YAAY,CAAC;AACzC,eAAO,MAAM,eAAe,YAAY,CAAC;AAEzC;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,YACrB,4BAA4B,KACtC,OAAO,CAAC,MAAM,CA8GhB,CAAC"}

package/dist/vp/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * OpenID4VP (Verifier-side → Wallet holder) surface.
+ *
+ * The verify / present half of OpenID4VC: parse Authorization Requests,
+ * match the holder's credentials against DIF PEX v2 Presentation
+ * Definitions, and build the DIF PEX Presentation Submission. Signing
+ * the resulting vp_token and posting it to the verifier lives in Slice 7.
+ */
+export { parseAuthorizationRequestUri, resolvePresentationDefinitionByReference, resolveAuthorizationRequest, } from './parse';
+export type { ResolveAuthorizationRequestOptions } from './parse';
+export { verifyAndDecodeRequestObject, RequestObjectError, builtInDidResolver, } from './request-object';
+export type { RequestObjectErrorCode, VerifyRequestObjectOptions, DidResolver, DidDocument, VerificationMethod, } from './request-object';
+export { selectCredentials, buildPresentationSubmission, inferCredentialFormat, } from './select';
+export { evaluateField, matchInputDescriptor, queryJsonPath, satisfiesFilter, } from './pex';
+export type { AuthorizationRequest, ParsedAuthorizationRequest, PresentationDefinition, InputDescriptor, Constraints, Field, SubmissionRequirement, ClaimFormatDesignation, VpErrorCode, } from './types';
+export { VpError } from './types';
+export type { CandidateCredential, DescriptorCandidate, DescriptorSelection, SelectionResult, SelectedDescriptor, PresentationSubmission, PresentationSubmissionDescriptor, } from './select';
+export type { DescriptorMatch, FieldMatch } from './pex';
+export { buildPresentation, BuildPresentationError } from './present';
+export type { VpFormat, ChosenCredential, BuildPresentationOptions, PreparedPresentation, BuildPresentationErrorCode, } from './present';
+export { signPresentation, VpSignError } from './sign';
+export type { VpToken, LdpVpSigner, SignPresentationOptions, SignPresentationHelpers, SignPresentationResult, VpSignErrorCode, } from './sign';
+export { submitPresentation, VpSubmitError } from './submit';
+export type { SubmitPresentationOptions, SubmitPresentationResult, VpSubmitErrorCode, } from './submit';
+export { encryptResponseObject, JarmEncryptError, DEFAULT_JWE_ALG, DEFAULT_JWE_ENC, } from './encrypt';
+export type { EncryptResponseObjectOptions, JarmClientMetadata, JarmEncryptErrorCode, ResponseObjectPayload, } from './encrypt';
+//# sourceMappingURL=index.d.ts.map

package/dist/vp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACH,4BAA4B,EAC5B,wCAAwC,EACxC,2BAA2B,GAC9B,MAAM,SAAS,CAAC;AAEjB,YAAY,EAAE,kCAAkC,EAAE,MAAM,SAAS,CAAC;AAElE,OAAO,EACH,4BAA4B,EAC5B,kBAAkB,EAClB,kBAAkB,GACrB,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EACR,sBAAsB,EACtB,0BAA0B,EAC1B,WAAW,EACX,WAAW,EACX,kBAAkB,GACrB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACH,iBAAiB,EACjB,2BAA2B,EAC3B,qBAAqB,GACxB,MAAM,UAAU,CAAC;AAElB,OAAO,EACH,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,eAAe,GAClB,MAAM,OAAO,CAAC;AAEf,YAAY,EACR,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,eAAe,EACf,WAAW,EACX,KAAK,EACL,qBAAqB,EACrB,sBAAsB,EACtB,WAAW,GACd,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,YAAY,EACR,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,gCAAgC,GACnC,MAAM,UAAU,CAAC;AAElB,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAEzD,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAEtE,YAAY,EACR,QAAQ,EACR,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,0BAA0B,GAC7B,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAEvD,YAAY,EACR,OAAO,EACP,WAAW,EACX,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,eAAe,GAClB,MAAM,QAAQ,CAAC;AAEhB,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAE7D,YAAY,EACR,yBAAyB,EACzB,wBAAwB,EACxB,iBAAiB,GACpB,MAAM,UAAU,CAAC;AAElB,OAAO,EACH,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,EACf,eAAe,GAClB,MAAM,WAAW,CAAC;AAEnB,YAAY,EACR,4BAA4B,EAC5B,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,GACxB,MAAM,WAAW,CAAC"}

package/dist/vp/parse.d.ts

@@ -0,0 +1,60 @@
+import { AuthorizationRequest, ParsedAuthorizationRequest, PresentationDefinition } from './types';
+import { DidResolver } from './request-object';
+/**
+ * Parse an OpenID4VP Authorization Request URI without hitting the network.
+ *
+ * Accepts every shape wallets see in the wild:
+ * - `openid4vp://?client_id=...&presentation_definition=...`
+ * - `haip://?client_id=...` (EUDI-flavored deeplinks)
+ * - `openid-vc://?client_id=...` (Draft 11/13 legacy scheme)
+ * - `https://verifier.example/authorize?client_id=...` (web flow)
+ * - Signed Request Objects via `request=<JWS>` or `request_uri=<https url>`
+ *   — both are returned as a `by_reference_*` variant for Slice 7 to
+ *   verify + decode.
+ *
+ * When the request arrives with a signed Request Object, every other
+ * parameter in the URI is spec-mandated to be ignored in favor of the
+ * JWS claims, so we punt immediately without validating them here.
+ */
+export declare const parseAuthorizationRequestUri: (input: string) => ParsedAuthorizationRequest;
+/**
+ * Fetch a `presentation_definition_uri` and parse it as a DIF PEX v2
+ * Presentation Definition. Caller is responsible for validating the
+ * returned shape against their own trust policy (allow-listed hosts,
+ * size limits, etc.).
+ */
+export declare const resolvePresentationDefinitionByReference: (uri: string, fetchImpl?: typeof fetch) => Promise<PresentationDefinition>;
+/**
+ * Options consumed by {@link resolveAuthorizationRequest} for signed
+ * Request Object verification (Slice 7.5). The caller (typically the
+ * plugin) wires DID resolver + X.509 roots from plugin config.
+ */
+export interface ResolveAuthorizationRequestOptions {
+    /** DID resolver for `client_id_scheme=did`. Defaults to built-in did:jwk + did:web. */
+    didResolver?: DidResolver;
+    /** Trust anchors for `client_id_scheme=x509_san_dns`. PEM-encoded. */
+    trustedX509Roots?: readonly string[];
+    /** **Dev-only.** Accept x509 chains without a trusted root. */
+    unsafeAllowSelfSigned?: boolean;
+    /**
+     * **Dev-only escape hatch.** Skip JWS signature verification on
+     * the Request Object entirely (still parses claims). For
+     * interop testing against verifiers whose signing keys are
+     * pre-shared out-of-band — production wallets MUST leave this
+     * off. See `request-object.ts` for the full warning.
+     */
+    unsafeSkipRequestObjectSignatureVerification?: boolean;
+}
+/**
+ * End-to-end: parse the URI, resolve signed Request Objects (per
+ * Slice 7.5), and inline `presentation_definition_uri` if needed, so
+ * the caller gets a single fully-resolved {@link AuthorizationRequest}.
+ *
+ * Signed Request Objects are verified according to their
+ * `client_id_scheme` (`did`, `x509_san_dns`). Schemes we don't support
+ * — or a `redirect_uri` scheme that illegitimately carries a signed
+ * Request Object — bubble up as {@link RequestObjectError} with a
+ * typed code.
+ */
+export declare const resolveAuthorizationRequest: (input: string, fetchImpl?: typeof fetch, options?: ResolveAuthorizationRequestOptions) => Promise<AuthorizationRequest>;
+//# sourceMappingURL=parse.d.ts.map

package/dist/vp/parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/vp/parse.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EAEzB,MAAM,SAAS,CAAC;AACjB,OAAO,EAEH,WAAW,EACd,MAAM,kBAAkB,CAAC;AAK1B;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,UAC9B,MAAM,KACd,0BA+BF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,QAC5C,MAAM,cACA,OAAO,KAAK,KACxB,OAAO,CAAC,sBAAsB,CA+ChC,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,kCAAkC;IAC/C,uFAAuF;IACvF,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,+DAA+D;IAC/D,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;;;OAMG;IACH,4CAA4C,CAAC,EAAE,OAAO,CAAC;CAC1D;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B,UAC7B,MAAM,cACF,OAAO,KAAK,YACd,kCAAkC,KAC5C,OAAO,CAAC,oBAAoB,CA2C9B,CAAC"}