@learncard/openid4vc-plugin 0.0.1

package/dist/vp/submit.d.ts

@@ -0,0 +1,175 @@
+import { PresentationSubmission } from './select';
+import { VpToken } from './sign';
+import { type JarmClientMetadata } from './encrypt';
+import type { ProofJwtSigner } from '../vci/types';
+/**
+ * Slice 7c / 7d — **direct_post + direct_post.jwt transport**.
+ *
+ * POST a signed `vp_token` (and, for PEX, a `presentation_submission`)
+ * to the verifier's `response_uri` per OID4VP §8. Pure transport —
+ * no signing, no PEX/DCQL evaluation, no request-object parsing.
+ *
+ * Two response modes are supported:
+ *
+ * - **`direct_post`** (§8.2) — form fields go on the wire as
+ *   cleartext (`vp_token`, `presentation_submission`, `state`,
+ *   `id_token` directly URL-encoded). What every walt.id-class
+ *   verifier accepts today.
+ *
+ * - **`direct_post.jwt`** (§8.3) — the same fields are packed into
+ *   a JSON payload, optionally signed by the wallet, then encrypted
+ *   to the verifier's published encryption key. The single resulting
+ *   compact JOSE string goes on the wire as one form field named
+ *   `response`. What EUDI / EU pilot deployments require for
+ *   production. Encryption is delegated to `./encrypt.ts`; this
+ *   module just dispatches.
+ *
+ * ## PEX vs DCQL submissions
+ *
+ * OID4VP defines two distinct response shapes:
+ *
+ * - **PEX** (Draft 22 and earlier, still used by every walt.id-class
+ *   verifier in the wild) → fields `vp_token` + `presentation_submission`.
+ *   `vp_token` is a single signed VP; `presentation_submission`
+ *   carries the descriptor_map that routes inner credentials.
+ *
+ * - **DCQL** (OID4VP 1.0 §6.4) → field `vp_token` only, valued
+ *   as a JSON-encoded object whose keys are `credential_query_id`
+ *   strings and whose values are signed presentations. NO
+ *   `presentation_submission` field — the keying carries the routing
+ *   implicitly. Callers using the DCQL pipeline (`dcql/respond.ts`)
+ *   pass `submission: undefined` (or omit it) so this transport
+ *   leaves the field off the response body.
+ *
+ * Both query-language splits work in either response mode. JARM
+ * just wraps the same payload in a JOSE blob.
+ *
+ * ## Encoding (cleartext mode)
+ *
+ * OID4VP requires `application/x-www-form-urlencoded`, even though
+ * `vp_token` and `presentation_submission` are structured values.
+ * Stringification rules:
+ *
+ * - `vp_token` as a `string` (jwt_vp_json compact JWS) → used verbatim.
+ * - `vp_token` as an object (ldp_vp signed VP, OR a DCQL vp_token
+ *   object keyed by credential_query_id) → `JSON.stringify`.
+ * - `presentation_submission` → always `JSON.stringify` when present.
+ * - `state` → echoed verbatim if present.
+ *
+ * ## Encoding (JARM mode)
+ *
+ * Single form field: `response=<JOSE blob>`. Same form-urlencoded
+ * content type so verifier servers don't need protocol-aware framing
+ * — the JOSE blob is just one parameter value.
+ *
+ * ## Response handling
+ *
+ * Spec-compliant verifiers respond 200 OK with either an empty body
+ * (success) or `{ "redirect_uri": "…" }` (wallet is asked to deep-link
+ * back). We parse both shapes and surface anything else through
+ * `SubmitResponse.body` unchanged so callers can debug vendor-specific
+ * returns (e.g. walt.id's `{ success: true }`).
+ *
+ * HTTP-level failures become typed `VpSubmitError`s so UIs can render
+ * "connection issue" vs "verifier rejected the VP" correctly.
+ */
+export interface SubmitPresentationOptions {
+    /**
+     * The `response_uri` from the verifier's Authorization Request. We
+     * POST here, form-encoded, per OID4VP §8.
+     */
+    responseUri: string;
+    /**
+     * Signed VP token. Three shapes are accepted:
+     *  - PEX `jwt_vp_json` → compact JWS string
+     *  - PEX `ldp_vp`      → signed VP JSON object
+     *  - DCQL response     → JSON object keyed by `credential_query_id`,
+     *                        values are per-query signed presentations
+     */
+    vpToken: VpToken;
+    /**
+     * DIF PEX v2 Presentation Submission. Required for PEX flows;
+     * MUST be omitted (or `undefined`) for DCQL flows — DCQL's
+     * vp_token keying provides the routing implicitly. See the
+     * module-level docstring for the full PEX-vs-DCQL split.
+     */
+    submission?: PresentationSubmission;
+    /**
+     * SIOPv2 ID token (Slice 8). Required when the verifier asked for
+     * `response_type=vp_token id_token` or `response_type=id_token`;
+     * must be omitted otherwise. Encoded as the `id_token` form field
+     * alongside `vp_token`.
+     */
+    idToken?: string;
+    /**
+     * The verifier's `state` parameter (if present in the Auth
+     * Request). Echoed back so the verifier can correlate the
+     * response with the pending session. Omitted when absent.
+     */
+    state?: string;
+    /**
+     * Verifier's `response_mode` from the Authorization Request.
+     * Defaults to `direct_post` (cleartext). Set to `direct_post.jwt`
+     * to send a JARM (encrypted, optionally signed) response. Any
+     * other value is treated as cleartext for forward-compat — the
+     * caller can detect and reject unsupported modes upstream rather
+     * than have the transport silently downgrade.
+     */
+    responseMode?: string;
+    /**
+     * Verifier's `client_metadata` from the Authorization Request.
+     * Required when `responseMode === 'direct_post.jwt'` (carries
+     * the JWE algorithms + verifier's encryption JWKS). Ignored in
+     * cleartext mode.
+     */
+    clientMetadata?: JarmClientMetadata;
+    /**
+     * Verifier's `nonce` from the Authorization Request. Required
+     * when `responseMode === 'direct_post.jwt'` (used as the JWE
+     * `apv` ECDH-ES KDF input per OID4VP §8.3 ¶6). Ignored in
+     * cleartext mode.
+     */
+    nonce?: string;
+    /**
+     * Wallet signer — same shape as VCI proof-of-possession + outer
+     * VP signing. Required when JARM is in use AND the verifier
+     * declared `authorization_signed_response_alg` (the wallet must
+     * sign the response object before encrypting). Ignored otherwise.
+     */
+    signer?: ProofJwtSigner;
+    /** Override fetch — defaults to `globalThis.fetch`. */
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Shape of a successful `direct_post` response. `redirectUri` is
+ * populated when the verifier requested wallet redirect (OID4VP §8.2).
+ */
+export interface SubmitPresentationResult {
+    /** HTTP status (always 2xx for successful submissions; otherwise we throw). */
+    status: number;
+    /**
+     * Redirect URI the wallet should deep-link to. Present when the
+     * verifier wants the wallet to bounce the user back (e.g. to an
+     * in-browser "success" page).
+     */
+    redirectUri?: string;
+    /**
+     * Raw parsed body. `object` when the verifier returned JSON,
+     * `string` for plain text, `undefined` for empty. Preserved so
+     * callers can debug vendor-specific fields.
+     */
+    body: unknown;
+}
+export type VpSubmitErrorCode = 'invalid_input' | 'no_fetch' | 'network_error' | 'server_error' | 'jarm_encrypt_failed';
+export declare class VpSubmitError extends Error {
+    readonly code: VpSubmitErrorCode;
+    readonly status?: number;
+    readonly body?: unknown;
+    constructor(code: VpSubmitErrorCode, message: string, extra?: {
+        status?: number;
+        body?: unknown;
+        cause?: unknown;
+    });
+}
+export declare const submitPresentation: (options: SubmitPresentationOptions) => Promise<SubmitPresentationResult>;
+//# sourceMappingURL=submit.d.ts.map

package/dist/vp/submit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"submit.d.ts","sourceRoot":"","sources":["../../src/vp/submit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACjC,OAAO,EAGH,KAAK,kBAAkB,EAE1B,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAMH,MAAM,WAAW,yBAAyB;IACtC;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;;;;OAMG;IACH,OAAO,EAAE,OAAO,CAAC;IAEjB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,sBAAsB,CAAC;IAEpC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,kBAAkB,CAAC;IAEpC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;;;OAKG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,uDAAuD;IACvD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACrC,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IAEf;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;OAIG;IACH,IAAI,EAAE,OAAO,CAAC;CACjB;AAMD,MAAM,MAAM,iBAAiB,GACvB,eAAe,GACf,UAAU,GACV,eAAe,GACf,cAAc,GACd,qBAAqB,CAAC;AAE5B,qBAAa,aAAc,SAAQ,KAAK;IACpC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;gBAGpB,IAAI,EAAE,iBAAiB,EACvB,OAAO,EAAE,MAAM,EACf,KAAK,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO;CAWvE;AAMD,eAAO,MAAM,kBAAkB,YAClB,yBAAyB,KACnC,OAAO,CAAC,wBAAwB,CAwFlC,CAAC"}

package/dist/vp/types.d.ts

@@ -0,0 +1,255 @@
+/**
+ * OpenID for Verifiable Presentations (OID4VP) Authorization Request types
+ * plus the DIF Presentation Exchange v2.0 subset the plugin consumes.
+ *
+ * Spec references:
+ * - OpenID4VP Draft 22: https://openid.net/specs/openid-4-verifiable-presentations-1_0.html
+ * - DIF PEX v2.0:       https://identity.foundation/presentation-exchange/spec/v2.0.0/
+ *
+ * We target Draft 22 (`response_uri`) but tolerate legacy `redirect_uri`
+ * when the caller used an older verifier implementation.
+ */
+/**
+ * Stable error codes surfaced to UI layers. Every parse failure maps to
+ * exactly one of these so UI can localize copy without string-matching
+ * `Error.message`.
+ */
+export type VpErrorCode = 'invalid_uri' | 'invalid_json' | 'missing_client_id' | 'missing_nonce' | 'missing_response_type' | 'unsupported_response_type' | 'missing_response_target' | 'missing_presentation_definition' | 'invalid_presentation_definition' | 'both_definition_and_uri' | 'request_object_not_supported' | 'presentation_definition_fetch_failed'
+/**
+ * The Authorization Request carried a `dcql_query` that wasn't a
+ * JSON object, failed `DcqlQuery.parse` (structure), or failed
+ * `DcqlQuery.validate` (content). Distinct from
+ * `invalid_presentation_definition` so UI can localize the two
+ * separately; the underlying `dcql` library error rides along on
+ * `Error.cause` for debug.
+ */
+ | 'invalid_dcql_query'
+/**
+ * The Authorization Request carried BOTH `presentation_definition`
+ * (or `..._uri`) AND `dcql_query`. OID4VP 1.0 §5.3 forbids this:
+ * the verifier picks ONE query language per request. Without this
+ * guard we'd silently route on whichever one we happened to read
+ * first, which would mask verifier-side bugs.
+ */
+ | 'both_pex_and_dcql';
+/**
+ * Thrown by the parser/resolver and by PEX selection helpers. The `code`
+ * field is the stable contract; `message` and `cause` are diagnostic.
+ */
+export declare class VpError extends Error {
+    readonly code: VpErrorCode;
+    constructor(code: VpErrorCode, message: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * Result of parsing an OID4VP Authorization Request URI.
+ *
+ * - `by_value` — every parameter was inline in the URI; the request is
+ *   fully resolved and ready for PEX matching (Slice 6c+).
+ * - `by_reference_request_uri` — the verifier delegated the full request
+ *   to a signed JWT fetched from `request_uri`; deferred to Slice 7.
+ * - `by_reference_request_jwt` — the request was embedded inline as a
+ *   signed JWS via the `request` parameter; deferred to Slice 7.
+ *
+ * The `by_reference_*` variants intentionally don't attempt to decode
+ * the JWS — signature verification requires trust anchors (x5c chain,
+ * registered client metadata, did:web resolution) that belong in Slice 7.
+ */
+export type ParsedAuthorizationRequest = {
+    kind: 'by_value';
+    request: AuthorizationRequest;
+} | {
+    kind: 'by_reference_request_uri';
+    requestUri: string;
+    rawParams: URLSearchParams;
+} | {
+    kind: 'by_reference_request_jwt';
+    jwt: string;
+    rawParams: URLSearchParams;
+};
+/**
+ * Canonical Authorization Request shape the plugin operates on. Values
+ * come from either the inline URI params or the decoded signed Request
+ * Object (Slice 7). Field names match the OID4VP spec so they round-trip
+ * cleanly back into the `direct_post` response.
+ */
+export interface AuthorizationRequest {
+    /**
+     * Verifier identifier. Shape depends on `client_id_scheme`:
+     * - `did`        → a DID URL
+     * - `x509_san_dns` / `x509_san_uri` → a hostname/URL backed by the
+     *                  signing cert's SAN
+     * - `redirect_uri` → the verifier's response_uri host
+     * - `pre-registered` → an opaque string registered out-of-band
+     */
+    client_id: string;
+    client_id_scheme?: string;
+    /**
+     * Space-separated list — typically `vp_token` alone, or
+     * `vp_token id_token` for SIOPv2 + VP combined.
+     */
+    response_type: string;
+    /**
+     * `direct_post` — POST the VP token to `response_uri` as a form body.
+     * `direct_post.jwt` — same, but the body is a JWE.
+     * `fragment` / `query` — legacy browser-redirect modes.
+     *
+     * When omitted for a `vp_token` response_type, the spec's default is
+     * `fragment`, but every real-world wallet assumes `direct_post`.
+     */
+    response_mode?: string;
+    /**
+     * Draft 22+: destination for the VP token when `response_mode` is
+     * `direct_post*`. Mutually exclusive with legacy `redirect_uri` for
+     * direct-post flows, though older verifiers may still send
+     * `redirect_uri` here.
+     */
+    response_uri?: string;
+    /**
+     * Legacy (Draft ≤ 17): combined redirect + response destination.
+     * Still used by some verifiers in the wild. The resolver surfaces
+     * whichever one arrived under `response_uri` for consistency.
+     */
+    redirect_uri?: string;
+    nonce: string;
+    state?: string;
+    /**
+     * Inline DIF PEX v2 Presentation Definition. Mutually exclusive
+     * with `dcql_query` per OID4VP 1.0 §5.3 — a verifier expresses
+     * its credential ask in EITHER PEX OR DCQL, never both.
+     *
+     * Exactly one of `presentation_definition` /
+     * `presentation_definition_uri` / `dcql_query` /
+     * `scope` (with a well-known scope→PD mapping) is expected.
+     *
+     * The plugin auto-routes on whichever is present; PEX is the legacy
+     * path (every pre-1.0 verifier), DCQL is the OID4VP 1.0+ path.
+     */
+    presentation_definition?: PresentationDefinition;
+    /**
+     * URL returning the inline `presentation_definition` JSON. Resolved
+     * by {@link resolvePresentationDefinitionByReference}.
+     */
+    presentation_definition_uri?: string;
+    /**
+     * **OID4VP 1.0 §6** Digital Credentials Query Language query.
+     *
+     * Mutually exclusive with `presentation_definition` —
+     * verifiers using DCQL set this and omit PEX, and vice versa.
+     * Coexistence is at the plugin level (we accept either),
+     * NOT at the wire level (a single auth request never carries both).
+     *
+     * Stored as a parsed-and-validated value of the `dcql` library's
+     * `DcqlQuery` type so downstream selector code can run
+     * `DcqlQuery.query(...)` without re-parsing. The plugin's
+     * resolver (in `./parse.ts`) calls `DcqlQuery.parse(rawJson)`
+     * before populating this field — by the time it lands here, it's
+     * already been structurally + semantically validated.
+     *
+     * Unlike `presentation_definition_uri`, DCQL is **always inline**;
+     * the spec doesn't define a `dcql_query_uri` mechanism.
+     */
+    dcql_query?: import('../dcql/types').DcqlQuery;
+    /**
+     * Verifier metadata (supported formats, response-encryption JWKS,
+     * etc.). Consumed by Slice 7 when building the direct_post.jwt
+     * response.
+     */
+    client_metadata?: Record<string, unknown>;
+    /** URL variant of {@link client_metadata}. */
+    client_metadata_uri?: string;
+    /**
+     * Space-separated OAuth scopes. Mainly used by SIOPv2 (`openid`) and
+     * by verifiers that pre-register scope→presentation_definition
+     * mappings. Passed through verbatim for Slice 8.
+     */
+    scope?: string;
+    /**
+     * Any additional parameters the verifier included. Kept so callers
+     * writing to the direct_post response can echo `state`, custom
+     * extensions, etc. without losing fidelity.
+     */
+    extra?: Record<string, string>;
+}
+/**
+ * DIF PEX v2 Presentation Definition. The minimum fields the plugin
+ * inspects for matching; forward-compatible extensions are preserved in
+ * `extra` so they can round-trip into the Presentation Submission.
+ */
+export interface PresentationDefinition {
+    id: string;
+    name?: string;
+    purpose?: string;
+    format?: Record<string, ClaimFormatDesignation>;
+    submission_requirements?: SubmissionRequirement[];
+    input_descriptors: InputDescriptor[];
+}
+export interface InputDescriptor {
+    id: string;
+    name?: string;
+    purpose?: string;
+    group?: string[];
+    format?: Record<string, ClaimFormatDesignation>;
+    constraints: Constraints;
+}
+export interface Constraints {
+    /**
+     * `required` — wallet MUST strip every field not listed in `fields[]`
+     *              before presenting (selective disclosure).
+     * `preferred` — wallet SHOULD, but isn't required to.
+     *
+     * Slice 6 ignores limit_disclosure for VC 1.1 JSON-LD / JWT-VC since
+     * neither format supports field-level redaction cleanly. SD-JWT-VC
+     * support lives in a separate plugin.
+     */
+    limit_disclosure?: 'required' | 'preferred';
+    fields?: Field[];
+}
+export interface Field {
+    /**
+     * JSONPath expressions evaluated (in order) against each candidate VC.
+     * The first path that yields a non-empty match wins; that match is
+     * then tested against `filter` (when present).
+     */
+    path: string[];
+    id?: string;
+    name?: string;
+    purpose?: string;
+    /**
+     * JSON Schema (Draft 7 subset) applied to the resolved value. Slice 6
+     * supports `type`, `const`, `enum`, `pattern`, `contains`, plus the
+     * numeric/string bound keywords — which covers every filter seen in
+     * the PEX test vectors and real verifier payloads we've inspected.
+     */
+    filter?: Record<string, unknown>;
+    /**
+     * When `true`, the field doesn't need to match for the input
+     * descriptor to be satisfied. Useful for "nice-to-have" claims.
+     */
+    optional?: boolean;
+    /**
+     * `required` — the VC must literally contain the claim (default).
+     * `preferred` — the wallet should supply the claim if available, but
+     *               may substitute a predicate proof (ZKP). We treat
+     *               both as `required` until a ZKP-capable backend lands.
+     */
+    predicate?: 'required' | 'preferred';
+}
+export interface SubmissionRequirement {
+    name?: string;
+    purpose?: string;
+    rule: 'all' | 'pick';
+    count?: number;
+    min?: number;
+    max?: number;
+    /** Reference to an `input_descriptor.group` value. */
+    from?: string;
+    /** Nested submission requirements for composite rules. */
+    from_nested?: SubmissionRequirement[];
+}
+export interface ClaimFormatDesignation {
+    alg?: string[];
+    proof_type?: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/vp/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/vp/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;GAIG;AACH,MAAM,MAAM,WAAW,GACjB,aAAa,GACb,cAAc,GACd,mBAAmB,GACnB,eAAe,GACf,uBAAuB,GACvB,2BAA2B,GAC3B,yBAAyB,GACzB,iCAAiC,GACjC,iCAAiC,GACjC,yBAAyB,GACzB,8BAA8B,GAC9B,sCAAsC;AACxC;;;;;;;GAOG;GACD,oBAAoB;AACtB;;;;;;GAMG;GACD,mBAAmB,CAAC;AAE1B;;;GAGG;AACH,qBAAa,OAAQ,SAAQ,KAAK;IAC9B,SAAgB,IAAI,EAAE,WAAW,CAAC;gBAEtB,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAMhF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,0BAA0B,GAChC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,0BAA0B,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,GACpF;IAAE,IAAI,EAAE,0BAA0B,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,CAAC;AAEpF;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACjC;;;;;;;OAOG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IAEtB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,KAAK,EAAE,MAAM,CAAC;IAEd,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;;;;;;;;;OAWG;IACH,uBAAuB,CAAC,EAAE,sBAAsB,CAAC;IAEjD;;;OAGG;IACH,2BAA2B,CAAC,EAAE,MAAM,CAAC;IAErC;;;;;;;;;;;;;;;;;OAiBG;IACH,UAAU,CAAC,EAAE,OAAO,eAAe,EAAE,SAAS,CAAC;IAE/C;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE1C,8CAA8C;IAC9C,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAMD;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAChD,uBAAuB,CAAC,EAAE,qBAAqB,EAAE,CAAC;IAClD,iBAAiB,EAAE,eAAe,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,eAAe;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAChD,WAAW,EAAE,WAAW,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IACxB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,UAAU,GAAG,WAAW,CAAC;IAE5C,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,KAAK;IAClB;;;;OAIG;IACH,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEjC;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,UAAU,GAAG,WAAW,CAAC;CACxC;AAED,MAAM,WAAW,qBAAqB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0DAA0D;IAC1D,WAAW,CAAC,EAAE,qBAAqB,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,sBAAsB;IACnC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB"}

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@learncard/openid4vc-plugin",
+  "version": "0.0.1",
+  "description": "OpenID for Verifiable Credentials (OID4VCI + OID4VP + SIOPv2) holder support for LearnCard",
+  "main": "./dist/index.js",
+  "module": "./dist/openid4vc-plugin.esm.js",
+  "files": [
+    "dist"
+  ],
+  "author": "Learning Economy Foundation (www.learningeconomy.io)",
+  "license": "MIT",
+  "homepage": "https://github.com/learningeconomy/LearnCard/tree/main/packages/plugins/openid4vc/README.md",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/learningeconomy/LearnCard"
+  },
+  "bugs": {
+    "url": "https://github.com/learningeconomy/LearnCard/issues"
+  },
+  "devDependencies": {
+    "@types/jest": "^29.2.2",
+    "@types/node": "^17.0.31",
+    "aqu": "0.4.3",
+    "esbuild": "^0.27.1",
+    "esbuild-jest": "^0.5.0",
+    "esbuild-plugin-copy": "^1.3.0",
+    "jest": "^29.3.0",
+    "shx": "^0.3.4",
+    "ts-jest": "^29.0.3",
+    "tsx": "^4.20.6",
+    "@learncard/types": "5.15.0"
+  },
+  "types": "./dist/index.d.ts",
+  "dependencies": {
+    "@peculiar/x509": "^1.12.0",
+    "dcql": "^3.0.0",
+    "jose": "^5.9.6",
+    "safe-regex": "^2.1.1",
+    "@learncard/core": "9.4.18",
+    "@learncard/didkit-plugin": "^1.8.9",
+    "@learncard/vc-plugin": "^1.4.14"
+  },
+  "sideEffects": false,
+  "scripts": {
+    "build": "node ./scripts/build.mjs && shx cp ./scripts/mixedEntypoint.js ./dist/index.js && tsc --p tsconfig.json",
+    "test": "jest --passWithNoTests",
+    "test:watch": "jest --watch",
+    "test:coverage": "jest --silent --ci --coverage --coverageReporters=\"text\" --coverageReporters=\"text-summary\"",
+    "try-offer": "tsx ./scripts/try-offer.ts",
+    "try-verify": "tsx ./scripts/try-verify.ts"
+  }
+}