@learncard/openid4vc-plugin 0.0.1

package/dist/dcql/adapt.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Credential-shape adapter: held credentials → DCQL `DcqlCredential`.
+ *
+ * The `dcql` library matches credentials via a normalized representation
+ * (`DcqlCredential`, a discriminated union over `credential_format`).
+ * Our plugin holds credentials in their wire shape — JWT-VC compact
+ * strings, JSON-LD VC objects, sometimes a JWT-VC nested inside an
+ * LDP envelope's `proof.jwt`. Before DCQL's `query()` matcher can run,
+ * we have to translate.
+ *
+ * # Why this lives in `dcql/` and not in `vp/select.ts`
+ *
+ * The PEX selector (`vp/select.ts`) decodes credentials internally for
+ * its own JSONPath matcher, but its decoded shape (the raw JWT payload
+ * verbatim) is not the same as what DCQL wants (a normalized
+ * `{ credential_format, type, claims, cryptographic_holder_binding }`).
+ * Sharing a single decoder leaks PEX assumptions into DCQL — which is
+ * the whole reason DCQL exists as a separate query language. They get
+ * separate adapters.
+ *
+ * # In scope today
+ *
+ * - `jwt_vc_json` (compact JWT, VCDM §6.3.1 payload).
+ * - `ldp_vc`     (JSON-LD VC object with a Data Integrity proof or the
+ *                 `proof.type === 'JwtProof2020'` legacy envelope).
+ *
+ * # Out of scope (deferred)
+ *
+ * - `vc+sd-jwt` — supported by the `dcql` library but the plugin
+ *   doesn't yet build SD-JWT *presentations* (KB-JWT signing path
+ *   is its own slice). Adapter returns `undefined` for these for now
+ *   so they're transparently skipped during DCQL matching.
+ * - `mso_mdoc` — we don't issue or hold mDL credentials yet; the
+ *   `DcqlMdocCredential` shape requires a CBOR-decoded namespace
+ *   tree we don't compute.
+ */
+import type { DcqlW3cVcCredential } from './types';
+/** Subset of {@link CandidateCredential} this adapter consumes. */
+export interface AdaptableCredential {
+    /** Wire-shape credential — string for JWT-VCs, object for LD-VCs. */
+    credential: unknown;
+    /**
+     * Optional explicit format hint. When omitted the adapter infers
+     * via the same heuristics PEX selector uses (`inferCredentialFormat`).
+     * Provide explicitly when the wire shape is ambiguous (e.g. a
+     * compact JWS that the caller has reason to believe is SD-JWT, not
+     * jwt_vc_json).
+     */
+    format?: string;
+}
+/**
+ * Convert a single held credential into a `DcqlW3cVcCredential` ready
+ * for `DcqlQuery.query()` to evaluate.
+ *
+ * Returns `undefined` when:
+ *   - format is unrecognized / unsupported (sd-jwt-vc, mdoc, raw JSON
+ *     without VC shape)
+ *   - JWT decoding fails (malformed compact JWS, non-JSON payload)
+ *   - decoded payload has no `vc` claim or `type` array
+ *
+ * `undefined` results are silently dropped from the candidate pool by
+ * downstream selector code — same convention as `vp/select.ts`'s
+ * `decodeCandidateForMatching`. Throwing here would force every
+ * caller to wrap in try/catch and degrade UX for "I have a weird
+ * credential" cases that are otherwise harmless.
+ */
+export declare const adaptCredentialForDcql: (candidate: AdaptableCredential) => DcqlW3cVcCredential | undefined;
+/**
+ * Batch adapter — runs {@link adaptCredentialForDcql} over a candidate
+ * pool, dropping any that don't normalize. Returns the filtered list
+ * pair-wise with the original candidate so callers can reconnect a
+ * DCQL match back to the wire-shape credential they actually want to
+ * present (the matcher only sees the normalized shape; submission
+ * needs the original).
+ */
+export declare const adaptCredentialsForDcql: (candidates: readonly AdaptableCredential[]) => Array<{
+    original: AdaptableCredential;
+    adapted: DcqlW3cVcCredential;
+}>;
+//# sourceMappingURL=adapt.d.ts.map

package/dist/dcql/adapt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapt.d.ts","sourceRoot":"","sources":["../../src/dcql/adapt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAEnD,mEAAmE;AACnE,MAAM,WAAW,mBAAmB;IAChC,qEAAqE;IACrE,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,cACpB,mBAAmB,KAC/B,mBAAmB,GAAG,SAaxB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,eACpB,SAAS,mBAAmB,EAAE,KAC3C,KAAK,CAAC;IAAE,QAAQ,EAAE,mBAAmB,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,CASvE,CAAC"}

package/dist/dcql/build.d.ts

@@ -0,0 +1,122 @@
+/**
+ * Build per-credential-query unsigned VPs from a holder's chosen
+ * credentials.
+ *
+ * # Why this exists in addition to `vp/present.ts:buildPresentation`
+ *
+ * The PEX builder produces ONE VP that wraps every chosen credential
+ * (descriptor_map paths thread through it), plus a companion
+ * `presentation_submission`. DCQL's response model is fundamentally
+ * different per OID4VP 1.0 §6.4:
+ *
+ *   - `vp_token` is an OBJECT keyed by `credential_query_id`.
+ *   - Each value is its own presentation (one VP per query entry, or
+ *     an array when the query has `multiple: true`).
+ *   - There is NO `presentation_submission` field — the keying does
+ *     the descriptor-map's job implicitly.
+ *
+ * So this builder takes the same chosen-candidate inputs but returns
+ * a per-query collection of `{ credentialQueryId, unsignedVp,
+ * vpFormat, candidates }` entries. The signing layer (`./respond.ts`,
+ * landing in the next step of this slice) loops over the result and
+ * signs each VP individually before assembling the final vp_token
+ * object.
+ *
+ * # Envelope format choice
+ *
+ * Pure inference from the corresponding query entry's `format`:
+ *
+ *   - `jwt_vc_json` → `jwt_vp_json` envelope
+ *   - `ldp_vc`      → `ldp_vp` envelope
+ *
+ * No PD-style tie-breaking needed because DCQL queries pin a single
+ * format per `credentials[]` entry. SD-JWT and mDoc formats throw
+ * — they're tracked for a later slice (different signing pipeline).
+ *
+ * # Multiple candidates per query
+ *
+ * DCQL's `multiple: true` lets a single query entry pull more than one
+ * credential. We honor this by packing all the candidates with the
+ * same `credentialQueryId` into the SAME unsigned VP's
+ * `verifiableCredential[]` array — the wallet returns one
+ * presentation per query, period. Some verifiers may interpret
+ * `multiple: true` as "return an array of presentations", but the
+ * spec wording in §6.4 is "an array of one or more presentations" per
+ * id, which a single VP carrying multiple VCs satisfies cleanly.
+ * Re-visit if a real verifier proves otherwise.
+ */
+import type { UnsignedVP } from '@learncard/types';
+import type { AdaptableCredential } from './adapt';
+import type { DcqlQuery } from './types';
+/** Outer presentation envelope format produced for a DCQL response. */
+export type DcqlVpFormat = 'jwt_vp_json' | 'ldp_vp';
+/**
+ * One holder pick: "this candidate satisfies this credential query."
+ *
+ * Direct analog of `vp/present.ts:ChosenCredential` but keyed by DCQL
+ * `credential_query_id` instead of PEX `descriptorId`.
+ */
+export interface DcqlChosenCredential {
+    /** Matches `DcqlQuery.credentials[N].id` from the verifier's query. */
+    credentialQueryId: string;
+    /** Wire-shape credential (JWT-VC string or LD-VC object). */
+    candidate: AdaptableCredential;
+}
+export interface BuildDcqlPresentationsInput {
+    /**
+     * Parsed + validated DCQL query (the one the verifier sent). Used
+     * to map `credentialQueryId` → declared format, validate that
+     * every chosen entry references a known query id, and to detect
+     * `multiple: true`.
+     */
+    query: DcqlQuery;
+    /** Holder picks. At least one entry per query id MUST be present. */
+    chosen: readonly DcqlChosenCredential[];
+    /** Holder DID — emitted as `unsignedVp.holder` for VCDM §4.1.1 conformance. */
+    holder: string;
+    /**
+     * Optional presentation id factory — used in tests for
+     * deterministic UUIDs. Defaults to a crypto-random hex generator
+     * mirroring `vp/present.ts`.
+     */
+    makeId?: () => string;
+}
+/** One unsigned VP, ready for the signing layer. */
+export interface BuiltDcqlPresentation {
+    /** Matches `DcqlQuery.credentials[N].id`. */
+    credentialQueryId: string;
+    /** Unsigned VP wrapping the chosen credentials for this query. */
+    unsignedVp: UnsignedVP;
+    /** Envelope format the signing layer should use. */
+    vpFormat: DcqlVpFormat;
+    /**
+     * Original wire-shape candidates packed into this VP, in the
+     * order they appear in `unsignedVp.verifiableCredential`. The
+     * submission layer doesn't need this directly, but tests + the
+     * future "what was actually presented?" inspection API do.
+     */
+    candidates: AdaptableCredential[];
+}
+export type BuildDcqlPresentationErrorCode = 'no_selections' | 'unknown_credential_query' | 'unsupported_format' | 'invalid_jwt_vc';
+export declare class BuildDcqlPresentationError extends Error {
+    readonly code: BuildDcqlPresentationErrorCode;
+    constructor(code: BuildDcqlPresentationErrorCode, message: string);
+}
+/**
+ * Build one unsigned VP per `credential_query_id` referenced in
+ * `chosen`. The order of returned entries follows the DCQL query's
+ * own `credentials[]` order, so the eventual `vp_token` object's key
+ * insertion order matches verifier expectations (most verifiers
+ * iterate query entries in declared order when validating).
+ *
+ * Throws `BuildDcqlPresentationError` on:
+ *   - empty `chosen`
+ *   - a chosen entry referencing an id NOT in `query.credentials[]`
+ *   - a chosen entry whose query format is sd-jwt-vc / mso_mdoc
+ *     (out-of-scope for this slice; tracked for later)
+ *   - a `jwt_vc_json` candidate that's neither a compact JWS string
+ *     nor an object with a string `proof.jwt` (matches the PEX
+ *     builder's `invalid_jwt_vc` branch)
+ */
+export declare const buildDcqlPresentations: (input: BuildDcqlPresentationsInput) => BuiltDcqlPresentation[];
+//# sourceMappingURL=build.d.ts.map

package/dist/dcql/build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/dcql/build.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAMzC,uEAAuE;AACvE,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,QAAQ,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACjC,uEAAuE;IACvE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,SAAS,EAAE,mBAAmB,CAAC;CAClC;AAED,MAAM,WAAW,2BAA2B;IACxC;;;;;OAKG;IACH,KAAK,EAAE,SAAS,CAAC;IAEjB,qEAAqE;IACrE,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAExC,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IAEf;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACzB;AAED,oDAAoD;AACpD,MAAM,WAAW,qBAAqB;IAClC,6CAA6C;IAC7C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kEAAkE;IAClE,UAAU,EAAE,UAAU,CAAC;IACvB,oDAAoD;IACpD,QAAQ,EAAE,YAAY,CAAC;IACvB;;;;;OAKG;IACH,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACrC;AAMD,MAAM,MAAM,8BAA8B,GACpC,eAAe,GACf,0BAA0B,GAC1B,oBAAoB,GACpB,gBAAgB,CAAC;AAEvB,qBAAa,0BAA2B,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAE,8BAA8B,CAAC;gBAElC,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,MAAM;CAKpE;AAMD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,UACxB,2BAA2B,KACnC,qBAAqB,EAwDvB,CAAC"}

package/dist/dcql/compose.d.ts

@@ -0,0 +1,78 @@
+import type { DcqlQuery } from './types';
+/**
+ * Validate + parse a hand-rolled DCQL query input. Lightweight wrapper
+ * over {@link parseDcqlQuery} — same throw semantics
+ * (`VpError('invalid_dcql_query', ...)` on any structural / content
+ * issue), different name to read naturally on the verifier side.
+ */
+export declare const buildDcqlQuery: (input: unknown) => DcqlQuery;
+/**
+ * Domain-shaped input for {@link requestW3cVc}. Keeps the common case
+ * legible without reaching into the spec-typed schema.
+ */
+export interface RequestW3cVcSpec {
+    /**
+     * Stable identifier the wallet echoes back as the
+     * `credential_query_id` in the response's `vp_token` object.
+     * Required and must be unique within a query.
+     */
+    id: string;
+    /**
+     * VC types the credential must declare (in addition to
+     * `VerifiableCredential`). Becomes a single AND-clause inside
+     * `meta.type_values`. Pass an array of arrays via
+     * {@link buildDcqlQuery} directly if you need OR semantics.
+     */
+    types: readonly string[];
+    /**
+     * Wire format. Defaults to `jwt_vc_json` — what walt.id, EUDI, and
+     * every learn-card ecosystem issuer emits today.
+     */
+    format?: 'jwt_vc_json' | 'ldp_vc';
+    /**
+     * Optional claim filters. Each entry is a JSON-path-array
+     * (`['credentialSubject', 'degreeName']`) and an optional list of
+     * acceptable values. The wallet only returns credentials whose
+     * actual claim value matches at least one of the listed values
+     * (or any value when omitted).
+     */
+    claims?: readonly RequestW3cVcClaim[];
+    /**
+     * Whether the wallet's response MUST carry cryptographic holder
+     * binding (i.e. the VP was signed by a key the holder controls).
+     * Defaults to `true` — the conservative choice for any flow
+     * sensitive to credential theft.
+     */
+    requireHolderBinding?: boolean;
+}
+export interface RequestW3cVcClaim {
+    /** JSON path through the credential body, e.g. `['credentialSubject', 'name']`. */
+    path: readonly (string | number)[];
+    /**
+     * Optional list of acceptable values. The wallet may only return
+     * credentials whose claim matches at least one entry. Omit for a
+     * "must-be-present" filter.
+     */
+    values?: readonly (string | number | boolean)[];
+    /** Optional id for the claim, used when expressing claim_sets. */
+    id?: string;
+}
+/**
+ * Build a single-credential DCQL query for a W3C VC. The most common
+ * verifier intent collapses to:
+ *
+ * ```ts
+ * const query = requestW3cVc({
+ *   id: 'degree',
+ *   types: ['VerifiableCredential', 'UniversityDegree'],
+ *   claims: [{ path: ['credentialSubject', 'degreeName'] }],
+ * });
+ * // attach `query` to an Authorization Request as `dcql_query`
+ * ```
+ *
+ * Output is a parsed + validated {@link DcqlQuery} — embed it directly
+ * in the Authorization Request URI's `dcql_query` parameter (after
+ * `JSON.stringify`+`encodeURIComponent`).
+ */
+export declare const requestW3cVc: (spec: RequestW3cVcSpec) => DcqlQuery;
+//# sourceMappingURL=compose.d.ts.map

package/dist/dcql/compose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../src/dcql/compose.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAMzC;;;;;GAKG;AACH,eAAO,MAAM,cAAc,UAAW,OAAO,KAAG,SAAkC,CAAC;AAEnF;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC7B;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAC;IAEX;;;;;OAKG;IACH,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAEzB;;;OAGG;IACH,MAAM,CAAC,EAAE,aAAa,GAAG,QAAQ,CAAC;IAElC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAEtC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAC9B,mFAAmF;IACnF,IAAI,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IAEnC;;;;OAIG;IACH,MAAM,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;IAEhD,kEAAkE;IAClE,EAAE,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,YAAY,SAAU,gBAAgB,KAAG,SAsCrD,CAAC"}

package/dist/dcql/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Public DCQL surface — what the plugin exposes to the host LearnCard
+ * (and, transitively, to apps consuming `@learncard/openid4vc-plugin`).
+ *
+ * Holder-side primitives are auto-wired into `presentCredentials` and
+ * `prepareVerifiablePresentation` — most app code never imports from
+ * here. The export surface exists for advanced callers building their
+ * own UI flows or LearnCard apps acting as **verifiers** (in which
+ * case `compose` is the entry point).
+ */
+export type { DcqlQuery, DcqlQueryResult, DcqlCredential, DcqlW3cVcCredential, DcqlSdJwtVcCredential, DcqlMdocCredential, DcqlPresentation, DcqlPresentationResult, DcqlPresentationEntry, } from './types';
+export { parseDcqlQuery } from './parse';
+export { adaptCredentialForDcql, adaptCredentialsForDcql, type AdaptableCredential, } from './adapt';
+export { selectCredentialsForDcql, type DcqlSelectionResult, type DcqlCredentialMatch, } from './select';
+export { buildDcqlPresentations, BuildDcqlPresentationError, type BuildDcqlPresentationsInput, type BuiltDcqlPresentation, type DcqlChosenCredential, type DcqlVpFormat, type BuildDcqlPresentationErrorCode, } from './build';
+export { signDcqlPresentations, buildDcqlResponse, assembleDcqlVpToken, type DcqlSignedPresentation, type DcqlInnerVpToken, type DcqlResponse, type SignDcqlPresentationsInput, type SignDcqlPresentationsHelpers, } from './respond';
+export { buildDcqlQuery, requestW3cVc, type RequestW3cVcSpec, type RequestW3cVcClaim, } from './compose';
+//# sourceMappingURL=index.d.ts.map

package/dist/dcql/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dcql/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,YAAY,EACR,SAAS,EACT,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,GACxB,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC,OAAO,EACH,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,mBAAmB,GAC3B,MAAM,SAAS,CAAC;AAEjB,OAAO,EACH,wBAAwB,EACxB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GAC3B,MAAM,UAAU,CAAC;AAElB,OAAO,EACH,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,2BAA2B,EAChC,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,8BAA8B,GACtC,MAAM,SAAS,CAAC;AAEjB,OAAO,EACH,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,GACpC,MAAM,WAAW,CAAC;AAGnB,OAAO,EACH,cAAc,EACd,YAAY,EACZ,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,GACzB,MAAM,WAAW,CAAC"}

package/dist/dcql/parse.d.ts

@@ -0,0 +1,16 @@
+import type { DcqlQuery as DcqlQueryType } from './types';
+/**
+ * Parse + validate an arbitrary value as a DCQL query. Returns the
+ * fully-typed `DcqlQuery` (a.k.a. `DcqlQuery.Output`) ready for
+ * `DcqlQuery.query(...)` to consume.
+ *
+ * Throws `VpError('invalid_dcql_query', ...)` on:
+ *  - non-object inputs
+ *  - structural parse errors from `DcqlQuery.parse`
+ *  - content validation errors from `DcqlQuery.validate`
+ *
+ * The original `dcql` error is attached as `cause` so debug code can
+ * still inspect the precise `valibot` issue tree if needed.
+ */
+export declare const parseDcqlQuery: (raw: unknown) => DcqlQueryType;
+//# sourceMappingURL=parse.d.ts.map

package/dist/dcql/parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/dcql/parse.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,SAAS,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,QAAS,OAAO,KAAG,aAkC7C,CAAC"}

package/dist/dcql/respond.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Sign the per-query unsigned VPs from `./build.ts` and assemble the
+ * OID4VP §6.4 DCQL `vp_token` object.
+ *
+ * # Why this is a separate module from `./build.ts`
+ *
+ * `./build.ts` is pure / synchronous (just data shaping). Signing
+ * touches keys, can be async, and routes through the LearnCard host's
+ * crypto plumbing (Ed25519 JWT signer for `jwt_vp_json`,
+ * `learnCard.invoke.issuePresentation` for `ldp_vp`). Keeping signing
+ * isolated lets tests exercise build without keys, and lets the
+ * eventual plugin-level routing call `buildDcqlPresentations →
+ * signDcqlPresentations → submitDcqlPresentation` as separate phases.
+ *
+ * # Wire shape produced
+ *
+ * Per OID4VP 1.0 §6.4 Wallet response with DCQL:
+ *
+ * ```jsonc
+ * {
+ *   "vp_token": {
+ *     "<credentialQueryId>": "<JWT-VP compact JWS>",   // jwt_vp_json
+ *     "<credentialQueryId>": { ...VP json... },        // ldp_vp
+ *     // ...one entry per `DcqlQuery.credentials[].id` the wallet
+ *     // chose to fulfill
+ *   },
+ *   "state": "<request.state>"
+ *   // No `presentation_submission` — DCQL keys carry the routing.
+ * }
+ * ```
+ *
+ * Submission to `response_uri` happens in the next slice via an
+ * extension to `vp/submit.ts` that takes an object-form `vp_token`.
+ */
+import { type LdpVpSigner } from '../vp/sign';
+import type { ProofJwtSigner } from '../vci/types';
+import type { BuiltDcqlPresentation } from './build';
+export interface SignDcqlPresentationsInput {
+    /** Output of `buildDcqlPresentations(...)`. */
+    built: readonly BuiltDcqlPresentation[];
+    /** Audience for every signed VP — typically `request.client_id`. */
+    audience: string;
+    /** Nonce for every signed VP — `request.nonce` from the auth request. */
+    nonce: string;
+    /** Holder DID for every VP. */
+    holder: string;
+    /** Optional fixed `iat` (test determinism). Defaults to `now`. */
+    iat?: number;
+}
+export interface SignDcqlPresentationsHelpers {
+    /** Required when any `built[].vpFormat === 'jwt_vp_json'`. */
+    jwtSigner?: ProofJwtSigner;
+    /** Required when any `built[].vpFormat === 'ldp_vp'`. */
+    ldpVpSigner?: LdpVpSigner;
+}
+/**
+ * One signed presentation in a DCQL response. The value type is the
+ * inner-VP shape (`string` for jwt_vp_json, `VP` for ldp_vp) — not
+ * the full {@link VpToken} union, because DCQL responses never nest
+ * (you can't have a DCQL object as a value inside another DCQL object).
+ */
+export type DcqlInnerVpToken = string | import('@learncard/types').VP;
+export interface DcqlSignedPresentation {
+    credentialQueryId: string;
+    vpToken: DcqlInnerVpToken;
+    vpFormat: BuiltDcqlPresentation['vpFormat'];
+}
+export interface DcqlResponse {
+    /**
+     * The OID4VP §6.4 `vp_token` object — keys are `credential_query_id`
+     * strings, values are signed presentations. Submission code POSTs
+     * this verbatim. Compatible with {@link VpToken}'s
+     * `Record<string, string | VP>` arm.
+     */
+    vpToken: Record<string, DcqlInnerVpToken>;
+    /**
+     * Per-query signed-presentation breakdown. Same data as `vpToken`
+     * but in array form so callers can iterate / inspect / log
+     * without `Object.entries(...)` boilerplate.
+     */
+    presentations: DcqlSignedPresentation[];
+}
+/**
+ * Sign each unsigned VP from {@link buildDcqlPresentations} using the
+ * appropriate signer (jwt for jwt_vp_json, ldp for ldp_vp), preserving
+ * the per-query `credentialQueryId` association.
+ *
+ * Throws `VpSignError` (the same code path as PEX signing) on signer
+ * misconfiguration; the per-query signing is sequential rather than
+ * parallel both because Ed25519 signing is fast (sub-ms per VP) and
+ * because some host signers maintain ordered nonce state.
+ */
+export declare const signDcqlPresentations: (input: SignDcqlPresentationsInput, helpers: SignDcqlPresentationsHelpers) => Promise<DcqlSignedPresentation[]>;
+/**
+ * Convenience: combine signing + vp_token-object assembly. Use this
+ * from plugin-level `presentCredentials` when the route is DCQL;
+ * direct callers who want to inspect per-query signing details can
+ * call `signDcqlPresentations` and then `assembleDcqlVpToken`
+ * themselves.
+ */
+export declare const buildDcqlResponse: (input: SignDcqlPresentationsInput, helpers: SignDcqlPresentationsHelpers) => Promise<DcqlResponse>;
+/**
+ * Pure aggregator: per-query signed presentations → vp_token object.
+ *
+ * Object key order follows the input array order, which the build
+ * layer guarantees mirrors the verifier's DCQL `credentials[]`
+ * declaration order. Some verifiers iterate query entries in declared
+ * order during validation, so this preserves that locality.
+ *
+ * `multiple: true` queries are not supported in this slice — each
+ * query id maps to a single VP. When we add support, the value type
+ * widens to `VpToken | VpToken[]`.
+ */
+export declare const assembleDcqlVpToken: (presentations: readonly DcqlSignedPresentation[]) => Record<string, DcqlInnerVpToken>;
+//# sourceMappingURL=respond.d.ts.map

package/dist/dcql/respond.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"respond.d.ts","sourceRoot":"","sources":["../../src/dcql/respond.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAEH,KAAK,WAAW,EACnB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAMrD,MAAM,WAAW,0BAA0B;IACvC,+CAA+C;IAC/C,KAAK,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACxC,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;IACd,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,GAAG,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,4BAA4B;IACzC,8DAA8D;IAC9D,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,yDAAyD;IACzD,WAAW,CAAC,EAAE,WAAW,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,OAAO,kBAAkB,EAAE,EAAE,CAAC;AAEtE,MAAM,WAAW,sBAAsB;IACnC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,EAAE,qBAAqB,CAAC,UAAU,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,YAAY;IACzB;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAE1C;;;;OAIG;IACH,aAAa,EAAE,sBAAsB,EAAE,CAAC;CAC3C;AAMD;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,UACvB,0BAA0B,WACxB,4BAA4B,KACtC,OAAO,CAAC,sBAAsB,EAAE,CA8BlC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,UACnB,0BAA0B,WACxB,4BAA4B,KACtC,OAAO,CAAC,YAAY,CAMtB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,kBACb,SAAS,sBAAsB,EAAE,KACjD,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAMjC,CAAC"}

package/dist/dcql/select.d.ts

@@ -0,0 +1,63 @@
+import { type AdaptableCredential } from './adapt';
+import type { DcqlQueryResult } from './types';
+/**
+ * Per-credential-query result. Each `DcqlQuery.credentials[]` entry
+ * gets exactly one of these in `DcqlSelectionResult.matches[]`,
+ * keyed by its `id`.
+ *
+ * Mirrors `DescriptorSelection` from the PEX selector so UI code can
+ * render PEX and DCQL flows identically (a list of "what was asked
+ * for" + "which credentials satisfy it" panels).
+ */
+export interface DcqlCredentialMatch {
+    /** Matches `DcqlQuery.credentials[N].id` from the verifier's query. */
+    credentialQueryId: string;
+    /**
+     * Wire-shape credentials the matcher accepted for this query
+     * entry. Empty when no held credential satisfies the query —
+     * see `reason` for the failure summary.
+     */
+    candidates: AdaptableCredential[];
+    /** Why no candidate matched. Set when `candidates.length === 0`. */
+    reason?: string;
+}
+/**
+ * Selector result. Mirrors `SelectionResult` (PEX) field-for-field,
+ * with `descriptors` renamed to `matches` to reflect DCQL's keying
+ * by `credential_query_id`.
+ */
+export interface DcqlSelectionResult {
+    /**
+     * `true` when the verifier's `credential_sets` (or the implicit
+     * "all credentials match" rule when none are declared) can be
+     * satisfied by the supplied candidate pool. Drives the "submit"
+     * button enablement in UIs.
+     */
+    canSatisfy: boolean;
+    /** Per-credential-query matches, keyed by `credential_query_id`. */
+    matches: Record<string, DcqlCredentialMatch>;
+    /** Overall failure reason when `canSatisfy === false`. */
+    reason?: string;
+    /**
+     * Full `dcql` library result. Exposed so advanced callers can
+     * drill into trusted-authority validation details, claim-set
+     * results, and other DCQL features the simplified plugin shape
+     * doesn't surface. Stable as long as `dcql` keeps it stable.
+     */
+    raw: DcqlQueryResult;
+}
+/**
+ * Run the holder's candidate pool against a parsed DCQL query.
+ *
+ * The supplied `query` MUST already be a `DcqlQuery` (i.e., have
+ * passed `DcqlQuery.parse(...) + validate(...)`). The plugin's
+ * resolver populates `AuthorizationRequest.dcql_query` exactly that
+ * way; callers driving the selector directly should use
+ * `parseDcqlQuery` from `./parse.ts` first.
+ *
+ * Drops candidates whose format the adapter doesn't support
+ * (sd-jwt-vc, mso_mdoc — see `./adapt.ts`) without erroring; those
+ * simply don't appear in `matches[*].candidates`.
+ */
+export declare const selectCredentialsForDcql: (candidates: readonly AdaptableCredential[], query: import("./types").DcqlQuery) => DcqlSelectionResult;
+//# sourceMappingURL=select.d.ts.map

package/dist/dcql/select.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"select.d.ts","sourceRoot":"","sources":["../../src/dcql/select.ts"],"names":[],"mappings":"AAiCA,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,KAAK,EAAa,eAAe,EAAE,MAAM,SAAS,CAAC;AAM1D;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAChC,uEAAuE;IACvE,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;OAIG;IACH,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAElC,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAChC;;;;;OAKG;IACH,UAAU,EAAE,OAAO,CAAC;IAEpB,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAE7C,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;;OAKG;IACH,GAAG,EAAE,eAAe,CAAC;CACxB;AAMD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB,eACrB,SAAS,mBAAmB,EAAE,SACnC,OAAO,SAAS,EAAE,SAAS,KACnC,mBAmDF,CAAC"}

package/dist/dcql/types.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Plugin-side type bridge to the [`dcql`](https://github.com/openwallet-foundation-labs/dcql-ts)
+ * library — Open Wallet Foundation's reference TypeScript implementation
+ * of the **Digital Credentials Query Language** (DCQL, OID4VP 1.0 §6).
+ *
+ * # Why a separate types module
+ *
+ * `dcql` is the canonical spec-compliant query parser/matcher (authored
+ * by Martin Auer, the spec's editor). Re-implementing it would buy us
+ * spec drift and nothing else, so the plugin uses it directly. This
+ * module exists for two reasons:
+ *
+ *   1. **Surface curation.** `dcql` exports ~25 type symbols. The
+ *      plugin only consumes a handful. Re-exporting just those keeps
+ *      our public API tractable and prevents "leaky transitive types"
+ *      from creeping into LearnCard's downstream surface.
+ *
+ *   2. **Plugin-specific ergonomic aliases.** A few `dcql` types want
+ *      shorter or more domain-specific names when used in the plugin's
+ *      AuthorizationRequest, selector, and presentation layers.
+ *
+ * # Coexistence with PEX
+ *
+ * DCQL is the query language introduced in OID4VP draft 23+ and
+ * mandated in OID4VP 1.0. PEX (DIF Presentation Exchange v2, here as
+ * `presentation_definition`) is the legacy mechanism used by every
+ * pre-1.0 verifier in the wild. The plugin supports BOTH: an incoming
+ * AuthorizationRequest may carry either `presentation_definition` or
+ * `dcql_query`, and the plugin auto-routes through the corresponding
+ * select/build/submit pipeline. See `AuthorizationRequest.dcql_query`
+ * (in `../vp/types.ts`) for the discriminator field.
+ *
+ * # What's in scope
+ *
+ * The plugin is a **wallet/holder**. Most DCQL surface area is
+ * holder-side (parse the verifier's query, match held credentials,
+ * emit a DCQL-shaped wallet response). Verifier-side helpers
+ * (`buildDcqlQuery`, `validateDcqlPresentation`) are exposed too so
+ * LearnCard apps that play the verifier role have ergonomic builders,
+ * but the heavy lifting lives in `dcql` itself.
+ */
+import type { DcqlCredential, DcqlMdocCredential, DcqlPresentation, DcqlPresentationResult, DcqlQuery, DcqlQueryResult, DcqlSdJwtVcCredential, DcqlW3cVcCredential } from 'dcql';
+/**
+ * The verifier's DCQL query, post-validation. Matches OID4VP 1.0 §6.1.
+ *
+ * Use `dcql`'s `DcqlQuery.parse(input)` to obtain a value of this type
+ * from raw JSON; the plugin's auth-request resolver does that
+ * automatically when it sees a `dcql_query` field on an incoming
+ * Authorization Request.
+ */
+export type { DcqlQuery, DcqlQueryResult };
+/**
+ * Normalized credential shape consumed by `DcqlQuery.query()` (the
+ * holder-side matcher). Discriminated by `credential_format`. The
+ * adapter at `./adapt.ts` (Slice 2) converts the plugin's wire-format
+ * credentials (JWT-VC strings, LD-VC objects, etc.) into this shape.
+ */
+export type { DcqlCredential, DcqlW3cVcCredential, DcqlSdJwtVcCredential, DcqlMdocCredential, };
+/**
+ * Wallet's response to a DCQL query — an object keyed by the verifier's
+ * `credential_query_id`s, each value being a serialized presentation
+ * (JWT-VP for `jwt_vc_json`, compact SD-JWT for `vc+sd-jwt`, etc.).
+ *
+ * Distinct from PEX's response shape: there's no companion
+ * `presentation_submission` because DCQL embeds the routing implicitly
+ * in the keying.
+ */
+export type { DcqlPresentation, DcqlPresentationResult };
+/**
+ * Single entry in the wallet's DCQL response: a credential-query ID
+ * paired with its serialized presentation.
+ *
+ * Convenience type used by the build/submit layers to keep the per-id
+ * loop body legible. The on-the-wire shape is a plain object whose
+ * keys are these ids; this type just gives the loop iterator a name.
+ */
+export interface DcqlPresentationEntry {
+    /** Matches `credentials[].id` from the verifier's DCQL query. */
+    credentialQueryId: string;
+    /**
+     * Serialized presentation in the format the corresponding query
+     * entry asked for:
+     *   - `jwt_vc_json` → compact JWT-VP string
+     *   - `ldp_vc`      → JSON object (an unsigned VP wrapped with an LD proof)
+     *   - `vc+sd-jwt`   → compact SD-JWT(+KB-JWT) string
+     *
+     * The plugin currently only emits jwt_vc_json + ldp_vc; sd-jwt-vc
+     * presentation is tracked separately (sd-jwt KB-JWT is a different
+     * signing path).
+     */
+    presentation: string | Record<string, unknown>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/dcql/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/dcql/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,KAAK,EACR,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,SAAS,EACT,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACtB,MAAM,MAAM,CAAC;AAMd;;;;;;;GAOG;AACH,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;AAE3C;;;;;GAKG;AACH,YAAY,EACR,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,GACrB,CAAC;AAEF;;;;;;;;GAQG;AACH,YAAY,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,CAAC;AAMzD;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IAClC,iEAAiE;IACjE,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;OAUG;IACH,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClD"}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export { getOpenID4VCPlugin } from './plugin';
+export * from './types';
+export * from './offer';
+export * from './vci';
+export * from './vp';
+export * from './siop';
+export * from './dcql';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,cAAc,SAAS,CAAC;AACxB,cAAc,SAAS,CAAC;AACxB,cAAc,OAAO,CAAC;AACtB,cAAc,MAAM,CAAC;AACrB,cAAc,QAAQ,CAAC;AACvB,cAAc,QAAQ,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+'use strict';
+
+if (process.env.NODE_ENV === 'production') {
+    module.exports = require('./openid4vc-plugin.cjs.production.min.js');
+} else {
+    module.exports = require('./openid4vc-plugin.cjs.development.js');
+}

package/dist/offer/index.d.ts

@@ -0,0 +1,4 @@
+export * from './types';
+export * from './parse';
+export * from './normalize';
+//# sourceMappingURL=index.d.ts.map

package/dist/offer/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/offer/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,SAAS,CAAC;AACxB,cAAc,aAAa,CAAC"}