@learncard/openid4vc-plugin 0.1.0 → 0.1.2

package/dist/{index.js → index.cjs}

@@ -1,7 +1,7 @@
 'use strict';
 
 if (process.env.NODE_ENV === 'production') {
-    module.exports = require('./openid4vc-plugin.cjs.production.min.js');
+    module.exports = require('./openid4vc-plugin.cjs.production.min.cjs');
 } else {
-    module.exports = require('./openid4vc-plugin.cjs.development.js');
+    module.exports = require('./openid4vc-plugin.cjs.development.cjs');
 }

package/dist/index.d.cts

@@ -0,0 +1,8 @@
+export { getOpenID4VCPlugin } from './plugin';
+export * from './types';
+export * from './offer';
+export * from './vci';
+export * from './vp';
+export * from './siop';
+export * from './dcql';
+//# sourceMappingURL=index.d.ts.map

package/dist/{openid4vc-plugin.cjs.development.js → openid4vc-plugin.cjs.development.cjs}

@@ -27340,7 +27340,7 @@ var isHttpsUrl2 = /* @__PURE__ */ __name((value) => {
 var describe3 = /* @__PURE__ */ __name((e) => e instanceof Error ? e.message : String(e), "describe");
 
 // src/vp/pex.ts
-var import_safe_regex = __toESM(require_safe_regex());
+var import_safe_regex = __toESM(require_safe_regex(), 1);
 var MAX_PEX_PATTERN_LENGTH = 512;
 var evaluateField = /* @__PURE__ */ __name((candidate, field) => {
   if (!Array.isArray(field.path) || field.path.length === 0) {
@@ -29394,4 +29394,4 @@ tslib/tslib.es6.js:
    * 
    *)
 */
-//# sourceMappingURL=openid4vc-plugin.cjs.development.js.map
+//# sourceMappingURL=openid4vc-plugin.cjs.development.cjs.map

package/dist/{openid4vc-plugin.cjs.production.min.js → openid4vc-plugin.cjs.production.min.cjs}

@@ -26,7 +26,7 @@ ${e.join(`
 ${(e.match(/.{1,64}/g)??[e]).join(`
 `)}
 -----END CERTIFICATE-----
-`},"derToPem"),cE=o(async t=>{let{jws:e,header:r,opts:n}=t;if(!!!n.unsafeAllowSelfSigned)throw new Q("unsupported_client_id_scheme","client-id prefix=pre-registered without a registry binding requires unsafeAllowSelfSigned=true (signing key cannot be derived from client_id alone)");let s=r.x5c;if(!Array.isArray(s)||s.length===0)throw new Q("invalid_request_object","client-id prefix=pre-registered requires an x5c header to verify the signature against (no key material available otherwise)");let u=n1(s[0]),a;try{a=await Od(u,Et(r.alg)??"RS256")}catch(c){throw new Q("request_signer_untrusted",`Failed to import leaf X.509 cert: ${Zt(c)}`,{cause:c})}try{await ac(e,a)}catch(c){throw new Q("request_signature_invalid",`JWS signature verification failed: ${Zt(c)}`,{cause:c})}},"verifyWithPreRegistered"),fE=o(t=>{try{return new URL(t.includes("://")?t:`https://${t}`).hostname}catch{return t}},"hostFromClientId"),i1=o((t=globalThis.fetch)=>async e=>{if(e.startsWith("did:jwk:"))return dE(e);if(e.startsWith("did:web:"))return lE(e,t);throw new Q("did_resolution_failed",`Built-in resolver does not support ${e.split(":").slice(0,2).join(":")} \u2014 pass a custom didResolver`)},"builtInDidResolver"),dE=o(t=>{let e=t.replace(/^did:jwk:/,"").split("#")[0],r;try{let i="=".repeat((4-e.length%4)%4),s=e.replace(/-/g,"+").replace(/_/g,"/")+i;r=JSON.parse(Buffer.from(s,"base64").toString("utf8"))}catch(i){throw new Q("did_resolution_failed",`Failed to decode did:jwk identifier: ${Zt(i)}`,{cause:i})}let n=`${t}#0`;return{id:t,verificationMethod:[{id:n,type:"JsonWebKey2020",controller:t,publicKeyJwk:r}],authentication:[n],assertionMethod:[n]}},"resolveDidJwk"),lE=o(async(t,e)=>{if(typeof e!="function")throw new Q("did_resolution_failed","did:web resolution requires a fetch implementation");let n=t.replace(/^did:web:/,"").split(":").map(d=>decodeURIComponent(d)),i=n.shift(),s=n.length===0?"/.well-known/did.json":`/${n.join("/")}/did.json`,u=`https://${i}${s}`,a;try{a=await e(u,{method:"GET"})}catch(d){throw new Q("did_resolution_failed",`Failed to fetch ${u}: ${Zt(d)}`,{cause:d})}if(!a.ok)throw new Q("did_resolution_failed",`${u} returned ${a.status} ${a.statusText}`);let c;try{c=await a.json()}catch(d){throw new Q("did_resolution_failed",`${u} response was not JSON: ${Zt(d)}`,{cause:d})}if(!c||typeof c!="object"||Array.isArray(c))throw new Q("did_resolution_failed",`${u} response was not a DID Document object`);return c},"resolveDidWeb"),kA=o((t,e,r)=>{let n=CA(r.presentation_definition)?r.presentation_definition:void 0,i=Et(r.presentation_definition_uri),s;if(r.dcql_query!==void 0&&r.dcql_query!==null){if(n||i)throw new re("both_pex_and_dcql","Request Object claims carry both PEX (presentation_definition[_uri]) and DCQL (dcql_query); OID4VP 1.0 \xA75.3 forbids this");s=Ni(r.dcql_query)}let u=CA(r.client_metadata)?r.client_metadata:void 0;return{client_id:t,client_id_scheme:e,response_type:Et(r.response_type)??"vp_token",response_mode:Et(r.response_mode),response_uri:Et(r.response_uri),redirect_uri:Et(r.redirect_uri),nonce:Et(r.nonce)??"",state:Et(r.state),presentation_definition:n,presentation_definition_uri:i,dcql_query:s,client_metadata:u,client_metadata_uri:Et(r.client_metadata_uri),scope:Et(r.scope)}},"buildRequestFromClaims"),Et=o(t=>typeof t=="string"&&t.length>0?t:void 0,"asString"),CA=o(t=>t!==null&&typeof t=="object"&&!Array.isArray(t),"isObject"),EA=o(t=>/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(t),"looksLikeJws"),PA=o(t=>{let e="=".repeat((4-t.length%4)%4),r=t.replace(/-/g,"+").replace(/_/g,"/")+e;return Buffer.from(r,"base64").toString("utf8")},"b64urlDecode"),Zt=o(t=>t instanceof Error?t.message:String(t),"describe");var ud=o(t=>{if(typeof t!="string"||t.trim().length===0)throw new re("invalid_uri","Authorization Request URI must be a non-empty string");let e=pE(t),r=e.get("request_uri");if(typeof r=="string"&&r.length>0){if(!OA(r))throw new re("invalid_uri","request_uri must be an absolute https:// URL");return{kind:"by_reference_request_uri",requestUri:r,rawParams:e}}let n=e.get("request");return typeof n=="string"&&n.length>0?{kind:"by_reference_request_jwt",jwt:n,rawParams:e}:{kind:"by_value",request:hE(e)}},"parseAuthorizationRequestUri"),s1=o(async(t,e=globalThis.fetch)=>{if(typeof e!="function")throw new re("presentation_definition_fetch_failed","No fetch implementation available to resolve presentation_definition_uri");if(!OA(t))throw new re("invalid_uri","presentation_definition_uri must be an absolute https:// URL");let r;try{r=await e(t,{method:"GET"})}catch(i){throw new re("presentation_definition_fetch_failed",`Failed to fetch presentation_definition_uri: ${yE(i)}`,{cause:i})}if(!r.ok)throw new re("presentation_definition_fetch_failed",`presentation_definition_uri returned ${r.status} ${r.statusText}`);let n;try{n=await r.json()}catch(i){throw new re("invalid_json","presentation_definition_uri response was not valid JSON",{cause:i})}return IA(n)},"resolvePresentationDefinitionByReference"),ad=o(async(t,e=globalThis.fetch,r={})=>{let n=ud(t),i;if(n.kind==="by_value")i=n.request;else{let s=n.rawParams.get("client_id")??void 0,u=n.rawParams.get("client_id_scheme")??void 0;i=await jp({requestUri:n.kind==="by_reference_request_uri"?n.requestUri:void 0,inlineJwt:n.kind==="by_reference_request_jwt"?n.jwt:void 0,urlClientId:s,urlClientIdScheme:u,fetchImpl:e,didResolver:r.didResolver,trustedX509Roots:r.trustedX509Roots,unsafeAllowSelfSigned:r.unsafeAllowSelfSigned,unsafeSkipRequestObjectSignatureVerification:r.unsafeSkipRequestObjectSignatureVerification})}if(i.presentation_definition)return i;if(i.presentation_definition_uri){let s=await s1(i.presentation_definition_uri,e);return{...i,presentation_definition:s}}return i},"resolveAuthorizationRequest"),pE=o(t=>{let e=t.indexOf("?");if(e!==-1)return new URLSearchParams(t.slice(e+1));if(t.includes("://")||/^[a-z][a-z0-9+.-]*:/i.test(t))throw new re("invalid_uri","Authorization Request URI has no query string");if(t.includes("="))return new URLSearchParams(t);throw new re("invalid_uri","Authorization Request URI has no query string")},"extractSearchParams"),hE=o(t=>{let e=t.get("client_id");if(!e)throw new re("missing_client_id","Authorization Request is missing client_id");let r=t.get("nonce");if(!r)throw new re("missing_nonce","Authorization Request is missing nonce");let n=t.get("response_type");if(!n)throw new re("missing_response_type","Authorization Request is missing response_type");let i=n.split(/\s+/).filter(Boolean),s=new Set(["vp_token","id_token"]);if(!i.some(ee=>s.has(ee)))throw new re("unsupported_response_type",`Authorization Request response_type "${n}" is not supported (expected vp_token and/or id_token)`);let u=t.get("response_uri")??void 0,a=t.get("redirect_uri")??void 0,c=t.get("response_mode")??void 0;if(!u&&!a)throw new re("missing_response_target","Authorization Request is missing both response_uri and redirect_uri");let d=t.get("presentation_definition"),h=t.get("presentation_definition_uri"),y=t.get("dcql_query");if(d&&h)throw new re("both_definition_and_uri","Authorization Request has both presentation_definition and presentation_definition_uri");if(y&&(d||h))throw new re("both_pex_and_dcql","Authorization Request carries both PEX (presentation_definition[_uri]) and DCQL (dcql_query); OID4VP 1.0 \xA75.3 forbids this");let b;if(d){let ee;try{ee=JSON.parse(d)}catch(ve){throw new re("invalid_json","presentation_definition query parameter was not valid JSON",{cause:ve})}b=IA(ee)}let A;if(y){let ee;try{ee=JSON.parse(y)}catch(ve){throw new re("invalid_json","dcql_query query parameter was not valid JSON",{cause:ve})}A=Ni(ee)}let S=t.get("scope")??void 0;if(i.includes("vp_token")&&!b&&!h&&!A&&!S)throw new re("missing_presentation_definition","Authorization Request has none of presentation_definition, presentation_definition_uri, dcql_query, or scope");let I=t.get("client_metadata"),J;if(I)try{let ee=JSON.parse(I);if(ee&&typeof ee=="object"&&!Array.isArray(ee))J=ee;else throw new re("invalid_json","client_metadata query parameter must be a JSON object")}catch(ee){throw ee instanceof re?ee:new re("invalid_json","client_metadata query parameter was not valid JSON",{cause:ee})}let pe=new Set(["client_id","client_id_scheme","response_type","response_mode","response_uri","redirect_uri","nonce","state","presentation_definition","presentation_definition_uri","dcql_query","client_metadata","client_metadata_uri","scope"]),de={};t.forEach((ee,ve)=>{pe.has(ve)||(de[ve]=ee)});let{prefix:xe}=_p(e,t.get("client_id_scheme")??void 0);return{client_id:e,client_id_scheme:xe,response_type:n,response_mode:c,response_uri:u,redirect_uri:a,nonce:r,state:t.get("state")??void 0,presentation_definition:b,presentation_definition_uri:h??void 0,dcql_query:A,client_metadata:J,client_metadata_uri:t.get("client_metadata_uri")??void 0,scope:S,...Object.keys(de).length>0?{extra:de}:{}}},"buildRequestFromParams"),IA=o(t=>{if(!t||typeof t!="object"||Array.isArray(t))throw new re("invalid_presentation_definition","presentation_definition must be a JSON object");let e=t;if(typeof e.id!="string"||e.id.length===0)throw new re("invalid_presentation_definition","presentation_definition is missing a string `id`");if(!Array.isArray(e.input_descriptors)||e.input_descriptors.length===0)throw new re("invalid_presentation_definition","presentation_definition must declare a non-empty input_descriptors array");for(let[r,n]of e.input_descriptors.entries()){if(!n||typeof n!="object")throw new re("invalid_presentation_definition",`input_descriptors[${r}] must be an object`);let i=n;if(typeof i.id!="string"||i.id.length===0)throw new re("invalid_presentation_definition",`input_descriptors[${r}].id must be a non-empty string`);if(!i.constraints||typeof i.constraints!="object")throw new re("invalid_presentation_definition",`input_descriptors[${r}].constraints must be an object`)}return e},"validatePresentationDefinition"),OA=o(t=>{try{return new URL(t).protocol==="https:"}catch{return!1}},"isHttpsUrl"),yE=o(t=>t instanceof Error?t.message:String(t),"describe");var n4=Ui(YS());var tT=512,U1=o((t,e)=>{if(!Array.isArray(e.path)||e.path.length===0)return{matched:!1,reason:"Field has no `path[]` declared"};for(let r of e.path){let n;try{n=$1(t,r)}catch(i){return{matched:!1,reason:`JSONPath "${r}" could not be evaluated: ${uT(i)}`}}if(n.length!==0)for(let i of n){if(!e.filter)return{matched:!0,matchedPath:r,value:i};if(Wa(i,e.filter))return{matched:!0,matchedPath:r,value:i};if(Array.isArray(i)&&iT(e.filter)){for(let s of i)if(Wa(s,e.filter))return{matched:!0,matchedPath:r,value:s}}}}return e.optional?{matched:!0,reason:"Field is optional and yielded no value"}:{matched:!1,reason:e.filter?`No value from paths ${JSON.stringify(e.path)} satisfied the filter`:`None of paths ${JSON.stringify(e.path)} resolved on the candidate`}},"evaluateField"),th=o((t,e)=>{let n=e.constraints?.fields??[],i=[];for(let s of n){let u=U1(t,s);if(i.push(u),!u.matched)return{matched:!1,descriptorId:e.id,fields:i,reason:u.reason}}return{matched:!0,descriptorId:e.id,fields:i}},"matchInputDescriptor"),$1=o((t,e)=>{if(typeof e!="string"||e.length===0)throw new Error("JSONPath must be a non-empty string");if(e!=="$"&&!e.startsWith("$"))throw new Error(`JSONPath "${e}" must start with "$"`);if(/\[\?\(/.test(e))throw new Error(`JSONPath filter expressions are not supported yet (found in "${e}")`);if(/\[\s*\d+\s*:/.test(e)||/\[\s*:\s*\d+\s*\]/.test(e))throw new Error(`JSONPath array slicing is not supported yet (found in "${e}")`);let r=nT(e),n=[t];for(let i of r){let s=[];for(let u of n)switch(i.kind){case"property":{let a=rT(u,i.name);a!==void 0&&s.push(a);break}case"index":{Array.isArray(u)&&i.index<u.length&&s.push(u[i.index]);break}case"wildcard":{if(Array.isArray(u))for(let a of u)s.push(a);else if(u&&typeof u=="object")for(let a of Object.values(u))s.push(a);break}case"descendant":{M1(u,i.name,s);break}}n=s}return n},"queryJsonPath"),rT=o((t,e)=>{if(t!=null&&!Array.isArray(t)&&typeof t=="object")return t[e]},"getProperty"),M1=o((t,e,r)=>{if(t!=null){if(Array.isArray(t)){for(let n of t)M1(n,e,r);return}if(typeof t=="object"){let n=t;for(let[i,s]of Object.entries(n))i===e&&r.push(s),M1(s,e,r)}}},"collectDescendants"),nT=o(t=>{let e=[],r=t.startsWith("$")?1:0;for(;r<t.length;){let n=t[r];if(n===".")if(t[r+1]==="."){r+=2;let i=e4(t,r);if(!i.text)throw new Error(`Recursive descent ".." at position ${r} must be followed by a property name`);e.push({kind:"descendant",name:i.text}),r=i.next}else{if(r+=1,t[r]==="*"){e.push({kind:"wildcard"}),r+=1;continue}let i=e4(t,r);if(!i.text)throw new Error(`Property accessor "." at position ${r} must be followed by an identifier`);e.push({kind:"property",name:i.text}),r=i.next}else if(n==="["){let i=t.indexOf("]",r+1);if(i===-1)throw new Error(`Unterminated "[" in JSONPath "${t}"`);let s=t.slice(r+1,i).trim();if(s==="*")e.push({kind:"wildcard"});else if(/^-?\d+$/.test(s))e.push({kind:"index",index:parseInt(s,10)});else if(/^'[^']*'$/.test(s)||/^"[^"]*"$/.test(s))e.push({kind:"property",name:s.slice(1,-1)});else throw new Error(`Unsupported bracket expression [${s}] in JSONPath "${t}"`);r=i+1}else throw new Error(`Unexpected character "${n}" at position ${r} in JSONPath "${t}"`)}return e},"tokenizeJsonPath"),e4=o((t,e)=>{let r=e;for(;r<t.length;){let n=t[r];if(!/[A-Za-z0-9_\-@:]/.test(n))break;r+=1}return{text:t.slice(e,r),next:r}},"readIdentifier"),Wa=o((t,e)=>{if("type"in e&&!(Array.isArray(e.type)?e.type:[e.type]).some(i=>sT(t,i))||"const"in e&&!eh(t,e.const))return!1;if("enum"in e){let r=e.enum;if(!Array.isArray(r)||!r.some(n=>eh(t,n)))return!1}if("pattern"in e){if(typeof t!="string")return!1;let r=e.pattern;if(typeof r!="string"||r.length>tT||!(0,n4.default)(r))return!1;let n;try{n=new RegExp(r)}catch{return!1}try{if(!n.test(t))return!1}catch{return!1}}if(typeof t=="number"&&(typeof e.minimum=="number"&&t<e.minimum||typeof e.maximum=="number"&&t>e.maximum||typeof e.exclusiveMinimum=="number"&&t<=e.exclusiveMinimum||typeof e.exclusiveMaximum=="number"&&t>=e.exclusiveMaximum)||typeof t=="string"&&(typeof e.minLength=="number"&&t.length<e.minLength||typeof e.maxLength=="number"&&t.length>e.maxLength))return!1;if(Array.isArray(t)){if(e.contains&&typeof e.contains=="object"){let r=e.contains;if(!t.some(i=>Wa(i,r)))return!1}if(e.items&&typeof e.items=="object"&&!Array.isArray(e.items)){let r=e.items;if(!t.every(i=>Wa(i,r)))return!1}if(typeof e.minItems=="number"&&t.length<e.minItems||typeof e.maxItems=="number"&&t.length>e.maxItems)return!1}return!0},"satisfiesFilter"),iT=o(t=>{if(r4(t,["contains","items","minItems","maxItems"]))return!1;if("type"in t){let e=Array.isArray(t.type)?t.type:[t.type];return e.length===0?!1:e.every(r=>typeof r=="string"&&oT.has(r))}return r4(t,["pattern","minLength","maxLength","minimum","maximum","exclusiveMinimum","exclusiveMaximum"])||"const"in t&&t4(t.const)?!0:"enum"in t&&Array.isArray(t.enum)&&t.enum.length>0?t.enum.every(t4):!1},"expectsPrimitive"),oT=new Set(["string","number","integer","boolean","null"]),t4=o(t=>t===null||typeof t=="string"||typeof t=="number"||typeof t=="boolean","isPrimitiveValue"),r4=o((t,e)=>e.some(r=>r in t),"hasAnyKeyword"),sT=o((t,e)=>{switch(e){case"string":return typeof t=="string";case"number":return typeof t=="number";case"integer":return typeof t=="number"&&Number.isInteger(t);case"boolean":return typeof t=="boolean";case"null":return t===null;case"array":return Array.isArray(t);case"object":return t!==null&&typeof t=="object"&&!Array.isArray(t);default:return!1}},"matchesType"),eh=o((t,e)=>{if(t===e)return!0;if(t===null||e===null)return t===e;if(typeof t!=typeof e)return!1;if(Array.isArray(t)){if(!Array.isArray(e)||t.length!==e.length)return!1;for(let r=0;r<t.length;r++)if(!eh(t[r],e[r]))return!1;return!0}if(typeof t=="object"){if(typeof e!="object"||Array.isArray(e))return!1;let r=t,n=e,i=Object.keys(r),s=Object.keys(n);if(i.length!==s.length)return!1;for(let u of i)if(!eh(r[u],n[u]))return!1;return!0}return!1},"deepEqual"),uT=o(t=>t instanceof Error?t.message:String(t),"describe");var rh=o((t,e)=>{let r=t.map((u,a)=>({index:a,candidate:{...u,format:u.format??yd(u.credential)}})),n=e.input_descriptors.map(u=>{let a=[],c=u.format??e.format;for(let d of r){let{candidate:h,index:y}=d;if(c&&!cT(h.format,c))continue;let b=fT(h),A=th(b,u);A.matched&&a.push({descriptorId:u.id,candidate:h,match:A,candidateIndex:y})}return{descriptorId:u.id,candidates:a,reason:a.length===0?lT(u,r.length,c):void 0}}),i=new Set(n.filter(u=>u.candidates.length>0).map(u=>u.descriptorId)),s=aT(e,i);return{descriptors:n,canSatisfy:s.satisfied,reason:s.satisfied?void 0:s.reason}},"selectCredentials"),s4=o((t,e,r={})=>{let n=r.makeId??pT;return{id:r.submissionId??n(),definition_id:t.id,descriptor_map:e.map(i=>{let s={id:i.descriptorId,format:i.format,path:i.path};return i.pathNested&&(s.path_nested={id:i.descriptorId,format:i.format,path:i.pathNested}),s})}},"buildPresentationSubmission"),yd=o(t=>{if(typeof t=="string")return/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(t)?"jwt_vc_json":void 0;if(!t||typeof t!="object")return;let r=t.proof;if(r&&typeof r=="object"){if(typeof r.jwt=="string"||r.type==="JwtProof2020")return"jwt_vc_json";if(typeof r.type=="string")return"ldp_vc"}},"inferCredentialFormat"),aT=o((t,e)=>{let r=t.submission_requirements;if(!r||r.length===0){let n=t.input_descriptors.map(i=>i.id).filter(i=>!e.has(i));return n.length===0?{satisfied:!0}:{satisfied:!1,reason:n.length===1?`Input descriptor "${n[0]}" has no matching credential`:`${n.length} input descriptors have no matching credential: ${n.join(", ")}`}}for(let n of r){let i=u4(n,t,e);if(!i.satisfied)return i}return{satisfied:!0}},"evaluateSubmissionRequirements"),u4=o((t,e,r)=>{if(typeof t.from=="string"&&t.from.length>0){let n=e.input_descriptors.filter(s=>s.group?.includes(t.from));if(n.length===0)return{satisfied:!1,reason:`submission_requirement references unknown group "${t.from}"`};let i=n.filter(s=>r.has(s.id));return i4(t,i.length,n.length)}if(Array.isArray(t.from_nested)&&t.from_nested.length>0){let n=0;for(let i of t.from_nested)u4(i,e,r).satisfied&&(n+=1);return i4(t,n,t.from_nested.length)}return{satisfied:!1,reason:"submission_requirement has neither `from` nor `from_nested`"}},"evaluateRequirement"),i4=o((t,e,r)=>{let n=t.name??t.from??"<anonymous>";return t.rule==="all"?e>=r?{satisfied:!0}:{satisfied:!1,reason:`Requirement "${n}" (rule=all) needs ${r} matches, only ${e} available`}:t.rule==="pick"?typeof t.count=="number"&&e<t.count?{satisfied:!1,reason:`Requirement "${n}" (rule=pick) needs count=${t.count} matches, only ${e} available`}:typeof t.min=="number"&&e<t.min?{satisfied:!1,reason:`Requirement "${n}" (rule=pick) needs min=${t.min} matches, only ${e} available`}:t.count===void 0&&t.min===void 0&&e===0?{satisfied:!1,reason:`Requirement "${n}" (rule=pick) needs at least one match, none available`}:{satisfied:!0}:{satisfied:!1,reason:`Unknown submission_requirement rule "${t.rule}"`}},"applyRule"),cT=o((t,e)=>t?Object.prototype.hasOwnProperty.call(e,t):!1,"formatIsPermitted"),fT=o(t=>{let{credential:e,format:r}=t;if(r==="jwt_vc_json"){if(typeof e=="string"){let n=o4(e);if(n)return n}if(e&&typeof e=="object"){let n=e.proof;if(n&&typeof n=="object"){let i=n.jwt;if(typeof i=="string"){let s=o4(i);if(s)return s}}}}return e},"decodeCandidateForMatching"),o4=o(t=>{let e=t.split(".");if(e.length===3)try{return JSON.parse(dT(e[1]))}catch{return}},"decodeJwtVc"),dT=o(t=>{let r=(t+"=".repeat((4-t.length%4)%4)).replace(/-/g,"+").replace(/_/g,"/");return typeof atob=="function"?atob(r):Buffer.from(r,"base64").toString("binary")},"base64UrlDecode"),lT=o((t,e,r)=>{if(e===0)return"You have no credentials in your wallet yet";let n=t.name??t.id;if(r){let i=Object.keys(r).join(", ");return`No credential satisfies "${n}" (required format: ${i})`}return`No credential satisfies "${n}"`},"explainNoMatches"),pT=o(()=>{let t=typeof globalThis<"u"&&"crypto"in globalThis?globalThis.crypto:void 0;if(t&&typeof t.getRandomValues=="function"){let e=new Uint8Array(8);return t.getRandomValues(e),Array.from(e,r=>r.toString(16).padStart(2,"0")).join("")}return Math.random().toString(36).slice(2,18)},"defaultMakeId");var V1=class V1 extends Error{constructor(e,r){super(r),this.name="BuildPresentationError",this.code=e}};o(V1,"BuildPresentationError");var Di=V1,md=o(t=>{let{pd:e,chosen:r,holder:n}=t;if(!r||r.length===0)throw new Di("no_selections","buildPresentation requires at least one chosen credential");let i=new Set(e.input_descriptors.map(h=>h.id)),s=r.map((h,y)=>{if(!i.has(h.descriptorId))throw new Di("unknown_descriptor",`Chosen credential at index ${y} references unknown descriptor "${h.descriptorId}"`);return{descriptorId:h.descriptorId,...hT(h.candidate,y)}}),u=t.envelopeFormat??mT(e,s.map(h=>h.format)),a=t.makeId??wT,c={"@context":["https://www.w3.org/2018/credentials/v1"],id:t.presentationId??`urn:uuid:${_T(a)}`,type:["VerifiablePresentation"],holder:n,verifiableCredential:s.map(h=>h.credential)},d={id:t.submissionId??a(),definition_id:e.id,descriptor_map:s.map((h,y)=>({id:h.descriptorId,format:h.format,path:bT(y,u)}))};return{unsignedVp:c,submission:d,vpFormat:u,innerFormats:s.map(h=>h.format)}},"buildPresentation"),hT=o((t,e)=>{let r=t.format??yd(t.credential);if(!r)throw new Di("unknown_credential_format",`Chosen credential at index ${e} has no detectable format (provide candidate.format or a shape inferCredentialFormat recognizes)`);if(r==="jwt_vc_json"){let n=yT(t.credential);if(!n)throw new Di("invalid_jwt_vc",`Chosen credential at index ${e} is tagged jwt_vc_json but has no compact JWS (expected a string, or an object with string \`proof.jwt\`)`);return{credential:n,format:r}}return{credential:t.credential,format:r}},"normalizeForEmbedding"),yT=o(t=>{if(typeof t=="string")return/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(t)?t:void 0;if(t&&typeof t=="object"){let e=t.proof;if(e&&typeof e=="object"){let r=e.jwt;if(typeof r=="string")return r}}},"extractCompactJws"),mT=o((t,e)=>{let r=gT(t.format),n=vT(e);return r.has("jwt_vp_json")&&!r.has("ldp_vp")?"jwt_vp_json":r.has("ldp_vp")&&!r.has("jwt_vp_json")?"ldp_vp":(r.has("jwt_vp_json")&&r.has("ldp_vp"),n)},"inferEnvelopeFormat"),gT=o(t=>{let e=new Set;return t&&("jwt_vp_json"in t&&e.add("jwt_vp_json"),"ldp_vp"in t&&e.add("ldp_vp")),e},"vpFormatsFromDesignation"),vT=o(t=>t.length===0?"ldp_vp":t.every(r=>r==="jwt_vc_json")?"jwt_vp_json":"ldp_vp","homogeneousVpFormatFromInner"),bT=o((t,e)=>e==="jwt_vp_json"?`$.vp.verifiableCredential[${t}]`:`$.verifiableCredential[${t}]`,"pathForIndex"),wT=o(()=>{let t=typeof globalThis<"u"&&"crypto"in globalThis?globalThis.crypto:void 0;if(t&&typeof t.getRandomValues=="function"){let e=new Uint8Array(8);return t.getRandomValues(e),Array.from(e,r=>r.toString(16).padStart(2,"0")).join("")}return Math.random().toString(36).slice(2,18)},"defaultMakeId"),_T=o(t=>{let r=(t().replace(/[^0-9a-f]/gi,"")+"0".repeat(32)).slice(0,32);return[r.slice(0,8),r.slice(8,12),"4"+r.slice(13,16),(parseInt(r.charAt(16),16)&3|8).toString(16)+r.slice(17,20),r.slice(20,32)].join("-")},"makeUuidV4");var L1=class L1 extends Error{constructor(e,r,n){super(r),this.name="VpSignError",this.code=e,n?.cause!==void 0&&(this.cause=n.cause)}};o(L1,"VpSignError");var er=L1,qi=o(async(t,e)=>(xT(t),t.vpFormat==="jwt_vp_json"?AT(t,e):ST(t,e)),"signPresentation"),xT=o(t=>{let{unsignedVp:e,holder:r,audience:n,nonce:i}=t;if(!e||typeof e!="object")throw new er("invalid_input","signPresentation requires an unsignedVp object");if(typeof n!="string"||n.length===0)throw new er("invalid_input","signPresentation requires a non-empty `audience`");if(typeof i!="string"||i.length===0)throw new er("invalid_input","signPresentation requires a non-empty `nonce`");if(typeof r!="string"||r.length===0)throw new er("invalid_input","signPresentation requires a non-empty `holder`");if(e.holder!==void 0&&e.holder!==r)throw new er("holder_mismatch",`unsignedVp.holder (${e.holder}) does not match options.holder (${r})`)},"validateInput"),AT=o(async(t,e)=>{if(!e.jwtSigner)throw new er("missing_jwt_signer","vpFormat=jwt_vp_json requires helpers.jwtSigner");let r=t.iat??Math.floor(Date.now()/1e3),n={alg:e.jwtSigner.alg,kid:e.jwtSigner.kid,typ:"JWT"},i=t.jti??(typeof t.unsignedVp.id=="string"?t.unsignedVp.id:void 0),s={iss:t.holder,sub:t.holder,aud:t.audience,nonce:t.nonce,iat:r,vp:t.unsignedVp};i&&(s.jti=i);let u;try{u=await e.jwtSigner.sign(n,s)}catch(a){throw new er("jwt_sign_failed",`Failed to sign jwt_vp_json: ${a instanceof Error?a.message:String(a)}`,{cause:a})}return{vpToken:u,vpFormat:"jwt_vp_json"}},"signJwtVp"),ST=o(async(t,e)=>{if(!e.ldpVpSigner)throw new er("missing_ldp_signer","vpFormat=ldp_vp requires helpers.ldpVpSigner");let r;try{r=await e.ldpVpSigner.sign(t.unsignedVp,{domain:t.audience,challenge:t.nonce})}catch(n){throw new er("ldp_sign_failed",`Failed to sign ldp_vp: ${n instanceof Error?n.message:String(n)}`,{cause:n})}return{vpToken:r,vpFormat:"ldp_vp"}},"signLdpVp");var F1=class F1 extends Error{constructor(e,r,n={}){super(r),this.name="JarmEncryptError",this.code=e,n.cause!==void 0&&(this.cause=n.cause)}};o(F1,"JarmEncryptError");var tt=F1,H1="ECDH-ES",W1="A256GCM",nh=o(async t=>{let{payload:e,clientMetadata:r,verifierNonce:n,walletNonce:i,signer:s}=t,u=r.authorization_encrypted_response_alg??H1,a=r.authorization_encrypted_response_enc??W1,c=r.authorization_signed_response_alg,d=await kT(r,t.fetchImpl),h=CT(d,u),y,b;if(c){if(!s)throw new tt("missing_signer",`Verifier requires authorization_signed_response_alg=${c} but no wallet signer was supplied`);let I=await ET(e,c,s);y=new TextEncoder().encode(I),b="JWT"}else y=new TextEncoder().encode(JSON.stringify(e)),b=void 0;let A;try{A=await dn(h,u)}catch(I){throw new tt("unsupported_alg",`Failed to import verifier encryption key (alg=${u}, kty=${h.kty}): ${gd(I)}`,{cause:I})}let S={alg:u,enc:a};typeof h.kid=="string"&&h.kid.length>0&&(S.kid=h.kid),b&&(S.cty=b);let D={apv:new TextEncoder().encode(n)};typeof i=="string"&&i.length>0&&(D.apu=new TextEncoder().encode(i));try{return await new cc(y).setProtectedHeader(S).setKeyManagementParameters(D).encrypt(A)}catch(I){throw new tt("encrypt_failed",`JWE encryption failed (alg=${u}, enc=${a}): ${gd(I)}`,{cause:I})}},"encryptResponseObject"),kT=o(async(t,e)=>{if(t.jwks&&Array.isArray(t.jwks.keys))return t.jwks.keys;if(typeof t.jwks_uri=="string"&&t.jwks_uri.length>0){let r=e??globalThis.fetch;if(typeof r!="function")throw new tt("jwks_fetch_failed",`client_metadata.jwks_uri=${t.jwks_uri} but no fetch implementation is available`);let n;try{n=await r(t.jwks_uri,{headers:{Accept:"application/json"}})}catch(s){throw new tt("jwks_fetch_failed",`Failed to fetch jwks_uri=${t.jwks_uri}: ${gd(s)}`,{cause:s})}if(!n.ok)throw new tt("jwks_fetch_failed",`jwks_uri returned HTTP ${n.status} for ${t.jwks_uri}`);let i;try{i=await n.json()}catch(s){throw new tt("invalid_jwks",`jwks_uri body was not valid JSON: ${gd(s)}`,{cause:s})}if(!i||typeof i!="object"||!Array.isArray(i.keys))throw new tt("invalid_jwks","jwks_uri body must be a JSON object with a `keys` array");return i.keys}throw new tt("no_encryption_key","client_metadata declares neither inline `jwks` nor `jwks_uri` \u2014 verifier cannot receive encrypted responses")},"resolveVerifierJwks"),CT=o((t,e)=>{if(t.length===0)throw new tt("no_encryption_key","Verifier JWKS contained no keys");let r=t.filter(s=>s.use!=="sig");if(r.length===0)throw new tt("no_encryption_key",'Verifier JWKS contains only `use:"sig"` keys; no encryption-capable key advertised');let n=r.find(s=>s.alg===e);if(n)return n;let i=r.find(s=>!s.alg);return i||r[0]},"pickEncryptionKey"),ET=o(async(t,e,r)=>{try{return await r.sign({alg:e,kid:r.kid,typ:"JWT"},t)}catch(n){throw new tt("sign_failed",`Wallet signer failed during JARM inner-JWS signing: ${gd(n)}`,{cause:n})}},"signResponse"),gd=o(t=>t instanceof Error?t.message:String(t),"describe");var z1=class z1 extends Error{constructor(e,r,n={}){super(r),this.name="VpSubmitError",this.code=e,this.status=n.status,this.body=n.body,n.cause!==void 0&&(this.cause=n.cause)}};o(z1,"VpSubmitError");var tr=z1,Fa=o(async t=>{let{responseUri:e,vpToken:r,submission:n,state:i}=t;if(typeof e!="string"||e.length===0)throw new tr("invalid_input","`responseUri` must be a non-empty string");if(r==null)throw new tr("invalid_input","`vpToken` is required");if(n!==void 0&&(n===null||typeof n!="object"))throw new tr("invalid_input","`submission` must be a PresentationSubmission object when provided (omit it entirely for DCQL flows)");let s=t.fetchImpl??globalThis.fetch;if(typeof s!="function")throw new tr("no_fetch","No fetch implementation available; pass `fetchImpl` or configure the plugin with one");let a=t.responseMode==="direct_post.jwt"?await IT({vpToken:r,submission:n,state:i,idToken:t.idToken,clientMetadata:t.clientMetadata,nonce:t.nonce,signer:t.signer,fetchImpl:s}):PT({vpToken:r,submission:n,state:i,idToken:t.idToken}),c;try{c=await s(e,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json, text/plain;q=0.9, */*;q=0.8"},body:a})}catch(h){throw new tr("network_error",`Failed to POST to ${e}: ${h instanceof Error?h.message:String(h)}`,{cause:h})}let d=await OT(c);if(!c.ok)throw new tr("server_error",`Verifier returned ${c.status} ${c.statusText||""}`.trim(),{status:c.status,body:d});return{status:c.status,redirectUri:RT(d),body:d}},"submitPresentation"),PT=o(t=>{let e=new URLSearchParams;return e.set("vp_token",TT(t.vpToken)),t.submission&&e.set("presentation_submission",JSON.stringify(t.submission)),typeof t.idToken=="string"&&t.idToken.length>0&&e.set("id_token",t.idToken),typeof t.state=="string"&&t.state.length>0&&e.set("state",t.state),e.toString()},"encodeFormBody"),TT=o(t=>typeof t=="string"?t:JSON.stringify(t),"stringifyVpToken"),IT=o(async t=>{if(!t.clientMetadata)throw new tr("invalid_input","response_mode=direct_post.jwt requires `clientMetadata` (verifier's JWKS + JWE algs)");if(typeof t.nonce!="string"||t.nonce.length===0)throw new tr("invalid_input","response_mode=direct_post.jwt requires the verifier `nonce` for the JWE `apv` ECDH-ES KDF input");let e={vp_token:t.vpToken};t.submission&&(e.presentation_submission=t.submission),typeof t.state=="string"&&t.state.length>0&&(e.state=t.state),typeof t.idToken=="string"&&t.idToken.length>0&&(e.id_token=t.idToken);let r;try{r=await nh({payload:e,clientMetadata:t.clientMetadata,verifierNonce:t.nonce,signer:t.signer,fetchImpl:t.fetchImpl})}catch(i){throw i instanceof tt?new tr("jarm_encrypt_failed",`Failed to build JARM response (${i.code}): ${i.message}`,{cause:i}):i}let n=new URLSearchParams;return n.set("response",r),n.toString()},"encodeJarmBody"),OT=o(async t=>{let e=await t.text().catch(()=>"");if(!e)return;if((t.headers.get("content-type")??"").includes("application/json"))try{return JSON.parse(e)}catch{return e}try{return JSON.parse(e)}catch{return e}},"parseResponseBody"),RT=o(t=>{if(t&&typeof t=="object"){let e=t.redirect_uri;if(typeof e=="string"&&e.length>0)return e}},"extractRedirectUri");var J1=class J1 extends Error{constructor(e,r,n){super(r),this.name="SiopSignError",this.code=e,n?.cause!==void 0&&(this.cause=n.cause)}};o(J1,"SiopSignError");var Jn=J1,vd=o(async(t,e)=>{jT(t,e);let{holder:r,audience:n,nonce:i}=t,s=t.iat??Math.floor(Date.now()/1e3),u=s+(t.lifetimeSeconds??300),a=t.issuerMode??"did",c={alg:e.signer.alg,kid:e.signer.kid,typ:"JWT"},d={iss:a==="did"?r:"https://self-issued.me/v2",sub:r,aud:n,nonce:i,iat:s,exp:u};t.vpTokenHash&&(d._vp_token={vp_token_hash:t.vpTokenHash});let h;try{h=await e.signer.sign(c,d)}catch(y){throw new Jn("id_token_sign_failed",`Failed to sign SIOPv2 id_token: ${y instanceof Error?y.message:String(y)}`,{cause:y})}return{idToken:h}},"signIdToken"),jT=o((t,e)=>{if(!e.signer)throw new Jn("missing_signer","signIdToken requires helpers.signer");if(typeof t.holder!="string"||t.holder.length===0)throw new Jn("invalid_input","signIdToken requires a non-empty `holder`");if(typeof t.audience!="string"||t.audience.length===0)throw new Jn("invalid_input","signIdToken requires a non-empty `audience`");if(typeof t.nonce!="string"||t.nonce.length===0)throw new Jn("invalid_input","signIdToken requires a non-empty `nonce`")},"validateInput"),K1=o(t=>t?new Set(t.split(/\s+/).filter(Boolean)):new Set,"responseTypeSet"),ih=o(t=>K1(t).has("id_token"),"requiresIdToken");var G1=o(t=>{let e=t.format??DT(t.credential);if(e==="jwt_vc_json")return NT(t.credential);if(e==="ldp_vc")return BT(t.credential)},"adaptCredentialForDcql"),oh=o(t=>{let e=[];for(let r of t){let n=G1(r);n&&e.push({original:r,adapted:n})}return e},"adaptCredentialsForDcql"),NT=o(t=>{let e;if(typeof t=="string")e=a4(t);else if(t&&typeof t=="object"){let s=t.proof;if(s&&typeof s=="object"){let u=s.jwt;typeof u=="string"&&(e=a4(u))}}if(!e)return;let r=e.vc;if(!r||typeof r!="object"||Array.isArray(r))return;let n=r,i=c4(n.type);if(i.length!==0)return{credential_format:"jwt_vc_json",type:i,claims:n,cryptographic_holder_binding:!0}},"adaptJwtVc"),BT=o(t=>{if(!t||typeof t!="object"||Array.isArray(t))return;let e=t,r=c4(e.type);if(r.length!==0)return{credential_format:"ldp_vc",type:r,claims:e,cryptographic_holder_binding:!0}},"adaptLdpVc"),c4=o(t=>Array.isArray(t)?t.filter(e=>typeof e=="string"):typeof t=="string"?[t]:[],"extractTypes"),DT=o(t=>{if(typeof t=="string")return/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(t)?"jwt_vc_json":void 0;if(t&&typeof t=="object"&&!Array.isArray(t)){let e=t.proof;if(e&&typeof e=="object")return e.type==="JwtProof2020"?"jwt_vc_json":"ldp_vc"}},"inferDcqlFormat"),a4=o(t=>{let e=t.split(".");if(e.length===3)try{let r=JSON.parse(qT(e[1]));return r&&typeof r=="object"&&!Array.isArray(r)?r:void 0}catch{return}},"decodeJwtPayload"),qT=o(t=>{let r=(t+"=".repeat((4-t.length%4)%4)).replace(/-/g,"+").replace(/_/g,"/");return typeof atob=="function"?atob(r):Buffer.from(r,"base64").toString("binary")},"base64UrlDecode");var sh=o((t,e)=>{let r=oh(t),n=r.map(u=>u.adapted),i=To.query(e,n),s={};for(let[u,a]of Object.entries(i.credential_matches)){if(a.success){let c=a.valid_credentials.map(d=>r[d.input_credential_index]?.original).filter(d=>d!==void 0);s[u]={credentialQueryId:u,candidates:c};continue}s[u]={credentialQueryId:u,candidates:[],reason:`No held credential satisfies query "${u}"`}}return{canSatisfy:i.can_be_satisfied,matches:s,reason:i.can_be_satisfied?void 0:"No combination of held credentials satisfies the verifier's DCQL query",raw:i}},"selectCredentialsForDcql");var X1=class X1 extends Error{constructor(e,r){super(r),this.name="BuildDcqlPresentationError",this.code=e}};o(X1,"BuildDcqlPresentationError");var Gn=X1,uh=o(t=>{let{query:e,chosen:r,holder:n}=t;if(r.length===0)throw new Gn("no_selections","buildDcqlPresentations requires at least one chosen credential");let i=t.makeId??VT,s=new Map;for(let c of r){let d=s.get(c.credentialQueryId);d?d.push(c.candidate):s.set(c.credentialQueryId,[c.candidate])}let u=new Map;for(let c of e.credentials)u.set(c.id,c);let a=[];for(let c of e.credentials){let d=s.get(c.id);d&&(a.push(MT(c,d,n,i)),s.delete(c.id))}if(s.size>0){let c=Array.from(s.keys()).join(", ");throw new Gn("unknown_credential_query",`chosen credentials reference query ids the DCQL query doesn't declare: ${c}`)}return a},"buildDcqlPresentations"),MT=o((t,e,r,n)=>{let i=UT(t.format,t.id),s=e.map((a,c)=>$T(a,t.id,c)),u={"@context":["https://www.w3.org/2018/credentials/v1"],id:`urn:uuid:${LT(n)}`,type:["VerifiablePresentation"],holder:r,verifiableCredential:s};return{credentialQueryId:t.id,unsignedVp:u,vpFormat:i,candidates:e}},"buildOnePresentation"),UT=o((t,e)=>{if(t==="jwt_vc_json")return"jwt_vp_json";if(t==="ldp_vc")return"ldp_vp";throw new Gn("unsupported_format",`DCQL query "${e}" requests format "${t}", which the plugin doesn't yet build presentations for (sd-jwt-vc and mso_mdoc are tracked for follow-up slices)`)},"vpFormatForQueryFormat"),$T=o((t,e,r)=>{let n=t.credential;if(typeof n=="string"){if(/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(n))return n;throw new Gn("invalid_jwt_vc",`chosen candidate at index ${r} for query "${e}" is a string but not a compact JWS`)}if(n&&typeof n=="object"){let i=n.proof;if(i&&typeof i=="object"){let s=i.jwt;if(typeof s=="string")return s}return n}throw new Gn("invalid_jwt_vc",`chosen candidate at index ${r} for query "${e}" is neither a JWT string nor a JSON object`)},"normalizeForEmbedding"),VT=o(()=>{let t=typeof globalThis<"u"&&"crypto"in globalThis?globalThis.crypto:void 0;if(t&&typeof t.getRandomValues=="function"){let e=new Uint8Array(8);return t.getRandomValues(e),Array.from(e,r=>r.toString(16).padStart(2,"0")).join("")}return Math.random().toString(36).slice(2,18)},"defaultMakeId"),LT=o(t=>{let r=(t().replace(/[^0-9a-f]/gi,"")+"0".repeat(32)).slice(0,32);return[r.slice(0,8),r.slice(8,12),"4"+r.slice(13,16),(parseInt(r.slice(16,17),16)&3|8).toString(16)+r.slice(17,20),r.slice(20,32)].join("-")},"makeUuidV4");var Z1=o(async(t,e)=>{let r=[];for(let n of t.built){let i=await qi({unsignedVp:n.unsignedVp,vpFormat:n.vpFormat,audience:t.audience,nonce:t.nonce,holder:t.holder,iat:t.iat},e);r.push({credentialQueryId:n.credentialQueryId,vpToken:i.vpToken,vpFormat:n.vpFormat})}return r},"signDcqlPresentations"),ah=o(async(t,e)=>{let r=await Z1(t,e);return{vpToken:Q1(r),presentations:r}},"buildDcqlResponse"),Q1=o(t=>{let e={};for(let r of t)e[r.credentialQueryId]=r.vpToken;return e},"assembleDcqlVpToken");var d4=o((t,e={})=>{let r=e.fetch??globalThis.fetch,n={didResolver:e.didResolver,trustedX509Roots:e.trustedX509Roots,unsafeAllowSelfSigned:e.unsafeAllowSelfSignedRequestObject,unsafeSkipRequestObjectSignatureVerification:e.unsafeSkipRequestObjectSignatureVerification},i=o(async s=>{let u=xd(s);if(u.kind==="by_value")return u.offer;if(typeof r!="function")throw new we("invalid_uri","No fetch implementation available; pass `config.fetch` to getOpenID4VCPlugin()");let a=await hh(u.uri,r);if(a.kind!=="by_value")throw new we("invalid_uri","Unexpected by_reference result after resolving credential_offer_uri");return a.offer},"resolveOffer");return{name:"OpenID4VC",displayName:"OpenID4VC",description:"OpenID for Verifiable Credentials holder support \u2014 Credential Offers, VCI, VP, and SIOPv2.",methods:{parseCredentialOffer:o((s,u)=>xd(u),"parseCredentialOffer"),resolveCredentialOffer:o(async(s,u)=>i(u),"resolveCredentialOffer"),acceptCredentialOffer:o(async(s,u,a={})=>{let c=typeof u=="string"?await i(u):u,d=await rw(s,a);return Ud({offer:c,signer:d,options:a,fetchImpl:r})},"acceptCredentialOffer"),acceptAndStoreCredentialOffer:o(async(s,u,a={})=>{let c=await(async()=>{let h=typeof u=="string"?await i(u):u,y=await rw(s,a);return Ud({offer:h,signer:y,options:a,fetchImpl:r})})(),d=await fy(s,c,FT(a));return{...c,...d}},"acceptAndStoreCredentialOffer"),beginCredentialOfferAuthCode:o(async(s,u,a)=>{let c=typeof u=="string"?await i(u):u;return uy({offer:c,redirectUri:a.redirectUri,clientId:a.clientId,configurationIds:a.configurationIds,scope:a.scope,fetchImpl:r})},"beginCredentialOfferAuthCode"),completeCredentialOfferAuthCode:o(async(s,u)=>{let a=u.signer??await rw(s,{});return ay({flowHandle:u.flowHandle,code:u.code,state:u.state,signer:a,fetchImpl:r})},"completeCredentialOfferAuthCode"),parseAuthorizationRequest:o((s,u)=>ud(u),"parseAuthorizationRequest"),resolveAuthorizationRequest:o(async(s,u)=>ad(u,r,n),"resolveAuthorizationRequest"),prepareVerifiablePresentation:o(async(s,u,a)=>{let c=await za(u,r,n);if(c.dcql_query){let d=sh(a,c.dcql_query);return{request:c,dcqlSelection:d}}if(c.presentation_definition){let d=rh(a,c.presentation_definition);return{request:c,selection:d}}return{request:c,selection:{descriptors:[],canSatisfy:!0,reason:void 0}}},"prepareVerifiablePresentation"),buildPresentation:o(async(s,u,a,c={})=>{let d=await za(u,r,n),h=f4(d),y=c.holder??s.id.did(),b=md({pd:h,chosen:a,holder:y,envelopeFormat:c.envelopeFormat});return{request:d,prepared:b}},"buildPresentation"),signPresentation:o(async(s,u,a,c={})=>{let d=await za(u,r,n),h=c.holder??(typeof a.unsignedVp.holder=="string"?a.unsignedVp.holder:s.id.did());if(a.vpFormat==="jwt_vp_json"){let y=c.signer??await ch(s);return qi({unsignedVp:a.unsignedVp,vpFormat:a.vpFormat,audience:d.client_id,nonce:d.nonce,holder:h},{jwtSigner:y})}return qi({unsignedVp:a.unsignedVp,vpFormat:a.vpFormat,audience:d.client_id,nonce:d.nonce,holder:h},{ldpVpSigner:tw(s)})},"signPresentation"),submitPresentation:o(async(s,u,a,c,d={})=>{let h=await za(u,r,n),y=h.response_uri??h.redirect_uri;if(!y)throw new Error("Authorization Request has no response_uri / redirect_uri \u2014 cannot submitPresentation");return Fa({responseUri:y,vpToken:a.vpToken,submission:c,idToken:d.idToken,state:h.state,fetchImpl:r,...Y1(h,await ew(s,h))})},"submitPresentation"),signIdToken:o(async(s,u,a={})=>{let c=await za(u,r,n),d=a.holder??s.id.did(),h=a.signer??await ch(s);return vd({holder:d,audience:c.client_id,nonce:c.nonce,lifetimeSeconds:a.lifetimeSeconds,issuerMode:a.issuerMode,vpTokenHash:a.vpTokenHash},{signer:h})},"signIdToken"),presentCredentials:o(async(s,u,a,c={})=>{let d=await za(u,r,n),h=c.holder??s.id.did(),y=c.signer,b=o(async()=>(y||(y=await ch(s)),y),"ensureSharedJwtSigner"),A=o(async()=>{if(ih(d.response_type))return vd({holder:h,audience:d.client_id,nonce:d.nonce},{signer:await b()})},"signIdTokenIfRequested"),S=d.response_uri??d.redirect_uri;if(!S)throw new Error("Authorization Request has no response_uri / redirect_uri \u2014 cannot presentCredentials");if(d.dcql_query){let ve=WT(a),ce=uh({query:d.dcql_query,chosen:ve,holder:h}),Ve=ce.some(gt=>gt.vpFormat==="jwt_vp_json"),It=ce.some(gt=>gt.vpFormat==="ldp_vp"),mt={...Ve?{jwtSigner:await b()}:{},...It?{ldpVpSigner:tw(s)}:{}},Ft=await ah({built:ce,audience:d.client_id,nonce:d.nonce,holder:h},mt),Dr=await A(),sn=await Fa({responseUri:S,vpToken:Ft.vpToken,idToken:Dr?.idToken,state:d.state,fetchImpl:r,...Y1(d,await ew(s,d))});return{request:d,dcqlBuilt:ce,dcqlSigned:Ft.presentations,dcqlVpToken:Ft.vpToken,signedIdToken:Dr,submitted:sn}}let D=f4(d),I=HT(a),J=md({pd:D,chosen:I,holder:h,envelopeFormat:c.envelopeFormat}),pe=J.vpFormat==="jwt_vp_json"?{jwtSigner:await b()}:{ldpVpSigner:tw(s)},de=await qi({unsignedVp:J.unsignedVp,vpFormat:J.vpFormat,audience:d.client_id,nonce:d.nonce,holder:h},pe),xe=await A(),ee=await Fa({responseUri:S,vpToken:de.vpToken,submission:J.submission,idToken:xe?.idToken,state:d.state,fetchImpl:r,...Y1(d,await ew(s,d))});return{request:d,prepared:J,signed:de,signedIdToken:xe,submitted:ee}},"presentCredentials")}}},"getOpenID4VCPlugin"),za=o(async(t,e,r)=>typeof t=="string"?await ad(t,e,r):t,"resolveRequestInput"),f4=o(t=>{if(!t.presentation_definition)throw new Error("Authorization Request has no presentation_definition \u2014 cannot build a VP");return t.presentation_definition},"requirePresentationDefinition"),HT=o(t=>{for(let[e,r]of t.entries())if(!("descriptorId"in r)||typeof r.descriptorId!="string")throw new Error(`chosen[${e}] is missing 'descriptorId' \u2014 PEX requests need ChosenCredential entries (received DCQL-shape entry with credentialQueryId="${r.credentialQueryId}")`);return t},"assertPexChosen"),WT=o(t=>{for(let[e,r]of t.entries())if(!("credentialQueryId"in r)||typeof r.credentialQueryId!="string")throw new Error(`chosen[${e}] is missing 'credentialQueryId' \u2014 DCQL requests need DcqlChosenCredential entries (received PEX-shape entry with descriptorId="${r.descriptorId}")`);return t},"assertDcqlChosen"),Y1=o((t,e)=>t.response_mode!=="direct_post.jwt"?{}:{responseMode:"direct_post.jwt",clientMetadata:t.client_metadata,nonce:t.nonce,signer:e},"buildJarmOptions"),ew=o(async(t,e)=>{if(e.response_mode!=="direct_post.jwt")return;let r=e.client_metadata?.authorization_signed_response_alg;if(!(typeof r!="string"||r.length===0))return ch(t)},"maybeJarmSigner"),ch=o(async t=>{let e=l4(t,"VP signing"),r=t.id.did(),n=await t.invoke.didToVerificationMethod(r);return Md({keypair:e,kid:n})},"ensureVpJwtSigner"),tw=o(t=>({sign:o(async(e,{domain:r,challenge:n})=>t.invoke.issuePresentation(e,{domain:r,challenge:n}),"sign")}),"buildLdpVpSigner"),rw=o(async(t,e)=>{if(e.signer)return e.signer;let r=l4(t,"VCI proof-of-possession"),n=t.id.did(),i=await t.invoke.didToVerificationMethod(n);return Md({keypair:r,kid:i})},"ensureSigner"),l4=o((t,e)=>{let r;try{r=t.id.keypair("ed25519")}catch(n){throw new Error(`OpenID4VC ${e} requires an Ed25519 keypair on the host LearnCard, but \`id.keypair('ed25519')\` threw: ${n instanceof Error?n.message:String(n)}. Pass \`options.signer\` to bring your own signer (HSM / secp256k1 / external backend).`)}if(!r||r.kty!=="OKP"||r.crv!=="Ed25519")throw new Error(`OpenID4VC ${e} requires an Ed25519 keypair, but the host LearnCard returned ${r?`kty=${r.kty} crv=${r.crv??"<none>"}`:"no keypair"}. Pass \`options.signer\` to bring your own signer (HSM / secp256k1 / external backend).`);return r},"requireEd25519Keypair"),FT=o(t=>({storage:t.storage,encrypt:t.encrypt,category:t.category,title:t.title,imgUrl:t.imgUrl,upload:t.upload,addToIndex:t.addToIndex,makeId:t.makeId}),"splitStoreOptions");var nw=o(t=>Ni(t),"buildDcqlQuery"),p4=o(t=>{let e=t.format??"jwt_vc_json";if(t.types.length===0)throw new Error("requestW3cVc: `types` must contain at least one type string");let r={id:t.id,format:e,meta:{type_values:[Array.from(t.types)]}};return t.claims&&t.claims.length>0&&(r.claims=t.claims.map(n=>{let i={path:Array.from(n.path)};return n.values&&n.values.length>0&&(i.values=Array.from(n.values)),n.id&&(i.id=n.id),i})),t.requireHolderBinding===!1&&(r.require_cryptographic_holder_binding=!1),nw({credentials:[r]})},"requestW3cVc");
+`},"derToPem"),cE=o(async t=>{let{jws:e,header:r,opts:n}=t;if(!!!n.unsafeAllowSelfSigned)throw new Q("unsupported_client_id_scheme","client-id prefix=pre-registered without a registry binding requires unsafeAllowSelfSigned=true (signing key cannot be derived from client_id alone)");let s=r.x5c;if(!Array.isArray(s)||s.length===0)throw new Q("invalid_request_object","client-id prefix=pre-registered requires an x5c header to verify the signature against (no key material available otherwise)");let u=n1(s[0]),a;try{a=await Od(u,Et(r.alg)??"RS256")}catch(c){throw new Q("request_signer_untrusted",`Failed to import leaf X.509 cert: ${Zt(c)}`,{cause:c})}try{await ac(e,a)}catch(c){throw new Q("request_signature_invalid",`JWS signature verification failed: ${Zt(c)}`,{cause:c})}},"verifyWithPreRegistered"),fE=o(t=>{try{return new URL(t.includes("://")?t:`https://${t}`).hostname}catch{return t}},"hostFromClientId"),i1=o((t=globalThis.fetch)=>async e=>{if(e.startsWith("did:jwk:"))return dE(e);if(e.startsWith("did:web:"))return lE(e,t);throw new Q("did_resolution_failed",`Built-in resolver does not support ${e.split(":").slice(0,2).join(":")} \u2014 pass a custom didResolver`)},"builtInDidResolver"),dE=o(t=>{let e=t.replace(/^did:jwk:/,"").split("#")[0],r;try{let i="=".repeat((4-e.length%4)%4),s=e.replace(/-/g,"+").replace(/_/g,"/")+i;r=JSON.parse(Buffer.from(s,"base64").toString("utf8"))}catch(i){throw new Q("did_resolution_failed",`Failed to decode did:jwk identifier: ${Zt(i)}`,{cause:i})}let n=`${t}#0`;return{id:t,verificationMethod:[{id:n,type:"JsonWebKey2020",controller:t,publicKeyJwk:r}],authentication:[n],assertionMethod:[n]}},"resolveDidJwk"),lE=o(async(t,e)=>{if(typeof e!="function")throw new Q("did_resolution_failed","did:web resolution requires a fetch implementation");let n=t.replace(/^did:web:/,"").split(":").map(d=>decodeURIComponent(d)),i=n.shift(),s=n.length===0?"/.well-known/did.json":`/${n.join("/")}/did.json`,u=`https://${i}${s}`,a;try{a=await e(u,{method:"GET"})}catch(d){throw new Q("did_resolution_failed",`Failed to fetch ${u}: ${Zt(d)}`,{cause:d})}if(!a.ok)throw new Q("did_resolution_failed",`${u} returned ${a.status} ${a.statusText}`);let c;try{c=await a.json()}catch(d){throw new Q("did_resolution_failed",`${u} response was not JSON: ${Zt(d)}`,{cause:d})}if(!c||typeof c!="object"||Array.isArray(c))throw new Q("did_resolution_failed",`${u} response was not a DID Document object`);return c},"resolveDidWeb"),kA=o((t,e,r)=>{let n=CA(r.presentation_definition)?r.presentation_definition:void 0,i=Et(r.presentation_definition_uri),s;if(r.dcql_query!==void 0&&r.dcql_query!==null){if(n||i)throw new re("both_pex_and_dcql","Request Object claims carry both PEX (presentation_definition[_uri]) and DCQL (dcql_query); OID4VP 1.0 \xA75.3 forbids this");s=Ni(r.dcql_query)}let u=CA(r.client_metadata)?r.client_metadata:void 0;return{client_id:t,client_id_scheme:e,response_type:Et(r.response_type)??"vp_token",response_mode:Et(r.response_mode),response_uri:Et(r.response_uri),redirect_uri:Et(r.redirect_uri),nonce:Et(r.nonce)??"",state:Et(r.state),presentation_definition:n,presentation_definition_uri:i,dcql_query:s,client_metadata:u,client_metadata_uri:Et(r.client_metadata_uri),scope:Et(r.scope)}},"buildRequestFromClaims"),Et=o(t=>typeof t=="string"&&t.length>0?t:void 0,"asString"),CA=o(t=>t!==null&&typeof t=="object"&&!Array.isArray(t),"isObject"),EA=o(t=>/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(t),"looksLikeJws"),PA=o(t=>{let e="=".repeat((4-t.length%4)%4),r=t.replace(/-/g,"+").replace(/_/g,"/")+e;return Buffer.from(r,"base64").toString("utf8")},"b64urlDecode"),Zt=o(t=>t instanceof Error?t.message:String(t),"describe");var ud=o(t=>{if(typeof t!="string"||t.trim().length===0)throw new re("invalid_uri","Authorization Request URI must be a non-empty string");let e=pE(t),r=e.get("request_uri");if(typeof r=="string"&&r.length>0){if(!OA(r))throw new re("invalid_uri","request_uri must be an absolute https:// URL");return{kind:"by_reference_request_uri",requestUri:r,rawParams:e}}let n=e.get("request");return typeof n=="string"&&n.length>0?{kind:"by_reference_request_jwt",jwt:n,rawParams:e}:{kind:"by_value",request:hE(e)}},"parseAuthorizationRequestUri"),s1=o(async(t,e=globalThis.fetch)=>{if(typeof e!="function")throw new re("presentation_definition_fetch_failed","No fetch implementation available to resolve presentation_definition_uri");if(!OA(t))throw new re("invalid_uri","presentation_definition_uri must be an absolute https:// URL");let r;try{r=await e(t,{method:"GET"})}catch(i){throw new re("presentation_definition_fetch_failed",`Failed to fetch presentation_definition_uri: ${yE(i)}`,{cause:i})}if(!r.ok)throw new re("presentation_definition_fetch_failed",`presentation_definition_uri returned ${r.status} ${r.statusText}`);let n;try{n=await r.json()}catch(i){throw new re("invalid_json","presentation_definition_uri response was not valid JSON",{cause:i})}return IA(n)},"resolvePresentationDefinitionByReference"),ad=o(async(t,e=globalThis.fetch,r={})=>{let n=ud(t),i;if(n.kind==="by_value")i=n.request;else{let s=n.rawParams.get("client_id")??void 0,u=n.rawParams.get("client_id_scheme")??void 0;i=await jp({requestUri:n.kind==="by_reference_request_uri"?n.requestUri:void 0,inlineJwt:n.kind==="by_reference_request_jwt"?n.jwt:void 0,urlClientId:s,urlClientIdScheme:u,fetchImpl:e,didResolver:r.didResolver,trustedX509Roots:r.trustedX509Roots,unsafeAllowSelfSigned:r.unsafeAllowSelfSigned,unsafeSkipRequestObjectSignatureVerification:r.unsafeSkipRequestObjectSignatureVerification})}if(i.presentation_definition)return i;if(i.presentation_definition_uri){let s=await s1(i.presentation_definition_uri,e);return{...i,presentation_definition:s}}return i},"resolveAuthorizationRequest"),pE=o(t=>{let e=t.indexOf("?");if(e!==-1)return new URLSearchParams(t.slice(e+1));if(t.includes("://")||/^[a-z][a-z0-9+.-]*:/i.test(t))throw new re("invalid_uri","Authorization Request URI has no query string");if(t.includes("="))return new URLSearchParams(t);throw new re("invalid_uri","Authorization Request URI has no query string")},"extractSearchParams"),hE=o(t=>{let e=t.get("client_id");if(!e)throw new re("missing_client_id","Authorization Request is missing client_id");let r=t.get("nonce");if(!r)throw new re("missing_nonce","Authorization Request is missing nonce");let n=t.get("response_type");if(!n)throw new re("missing_response_type","Authorization Request is missing response_type");let i=n.split(/\s+/).filter(Boolean),s=new Set(["vp_token","id_token"]);if(!i.some(ee=>s.has(ee)))throw new re("unsupported_response_type",`Authorization Request response_type "${n}" is not supported (expected vp_token and/or id_token)`);let u=t.get("response_uri")??void 0,a=t.get("redirect_uri")??void 0,c=t.get("response_mode")??void 0;if(!u&&!a)throw new re("missing_response_target","Authorization Request is missing both response_uri and redirect_uri");let d=t.get("presentation_definition"),h=t.get("presentation_definition_uri"),y=t.get("dcql_query");if(d&&h)throw new re("both_definition_and_uri","Authorization Request has both presentation_definition and presentation_definition_uri");if(y&&(d||h))throw new re("both_pex_and_dcql","Authorization Request carries both PEX (presentation_definition[_uri]) and DCQL (dcql_query); OID4VP 1.0 \xA75.3 forbids this");let b;if(d){let ee;try{ee=JSON.parse(d)}catch(ve){throw new re("invalid_json","presentation_definition query parameter was not valid JSON",{cause:ve})}b=IA(ee)}let A;if(y){let ee;try{ee=JSON.parse(y)}catch(ve){throw new re("invalid_json","dcql_query query parameter was not valid JSON",{cause:ve})}A=Ni(ee)}let S=t.get("scope")??void 0;if(i.includes("vp_token")&&!b&&!h&&!A&&!S)throw new re("missing_presentation_definition","Authorization Request has none of presentation_definition, presentation_definition_uri, dcql_query, or scope");let I=t.get("client_metadata"),J;if(I)try{let ee=JSON.parse(I);if(ee&&typeof ee=="object"&&!Array.isArray(ee))J=ee;else throw new re("invalid_json","client_metadata query parameter must be a JSON object")}catch(ee){throw ee instanceof re?ee:new re("invalid_json","client_metadata query parameter was not valid JSON",{cause:ee})}let pe=new Set(["client_id","client_id_scheme","response_type","response_mode","response_uri","redirect_uri","nonce","state","presentation_definition","presentation_definition_uri","dcql_query","client_metadata","client_metadata_uri","scope"]),de={};t.forEach((ee,ve)=>{pe.has(ve)||(de[ve]=ee)});let{prefix:xe}=_p(e,t.get("client_id_scheme")??void 0);return{client_id:e,client_id_scheme:xe,response_type:n,response_mode:c,response_uri:u,redirect_uri:a,nonce:r,state:t.get("state")??void 0,presentation_definition:b,presentation_definition_uri:h??void 0,dcql_query:A,client_metadata:J,client_metadata_uri:t.get("client_metadata_uri")??void 0,scope:S,...Object.keys(de).length>0?{extra:de}:{}}},"buildRequestFromParams"),IA=o(t=>{if(!t||typeof t!="object"||Array.isArray(t))throw new re("invalid_presentation_definition","presentation_definition must be a JSON object");let e=t;if(typeof e.id!="string"||e.id.length===0)throw new re("invalid_presentation_definition","presentation_definition is missing a string `id`");if(!Array.isArray(e.input_descriptors)||e.input_descriptors.length===0)throw new re("invalid_presentation_definition","presentation_definition must declare a non-empty input_descriptors array");for(let[r,n]of e.input_descriptors.entries()){if(!n||typeof n!="object")throw new re("invalid_presentation_definition",`input_descriptors[${r}] must be an object`);let i=n;if(typeof i.id!="string"||i.id.length===0)throw new re("invalid_presentation_definition",`input_descriptors[${r}].id must be a non-empty string`);if(!i.constraints||typeof i.constraints!="object")throw new re("invalid_presentation_definition",`input_descriptors[${r}].constraints must be an object`)}return e},"validatePresentationDefinition"),OA=o(t=>{try{return new URL(t).protocol==="https:"}catch{return!1}},"isHttpsUrl"),yE=o(t=>t instanceof Error?t.message:String(t),"describe");var n4=Ui(YS(),1);var tT=512,U1=o((t,e)=>{if(!Array.isArray(e.path)||e.path.length===0)return{matched:!1,reason:"Field has no `path[]` declared"};for(let r of e.path){let n;try{n=$1(t,r)}catch(i){return{matched:!1,reason:`JSONPath "${r}" could not be evaluated: ${uT(i)}`}}if(n.length!==0)for(let i of n){if(!e.filter)return{matched:!0,matchedPath:r,value:i};if(Wa(i,e.filter))return{matched:!0,matchedPath:r,value:i};if(Array.isArray(i)&&iT(e.filter)){for(let s of i)if(Wa(s,e.filter))return{matched:!0,matchedPath:r,value:s}}}}return e.optional?{matched:!0,reason:"Field is optional and yielded no value"}:{matched:!1,reason:e.filter?`No value from paths ${JSON.stringify(e.path)} satisfied the filter`:`None of paths ${JSON.stringify(e.path)} resolved on the candidate`}},"evaluateField"),th=o((t,e)=>{let n=e.constraints?.fields??[],i=[];for(let s of n){let u=U1(t,s);if(i.push(u),!u.matched)return{matched:!1,descriptorId:e.id,fields:i,reason:u.reason}}return{matched:!0,descriptorId:e.id,fields:i}},"matchInputDescriptor"),$1=o((t,e)=>{if(typeof e!="string"||e.length===0)throw new Error("JSONPath must be a non-empty string");if(e!=="$"&&!e.startsWith("$"))throw new Error(`JSONPath "${e}" must start with "$"`);if(/\[\?\(/.test(e))throw new Error(`JSONPath filter expressions are not supported yet (found in "${e}")`);if(/\[\s*\d+\s*:/.test(e)||/\[\s*:\s*\d+\s*\]/.test(e))throw new Error(`JSONPath array slicing is not supported yet (found in "${e}")`);let r=nT(e),n=[t];for(let i of r){let s=[];for(let u of n)switch(i.kind){case"property":{let a=rT(u,i.name);a!==void 0&&s.push(a);break}case"index":{Array.isArray(u)&&i.index<u.length&&s.push(u[i.index]);break}case"wildcard":{if(Array.isArray(u))for(let a of u)s.push(a);else if(u&&typeof u=="object")for(let a of Object.values(u))s.push(a);break}case"descendant":{M1(u,i.name,s);break}}n=s}return n},"queryJsonPath"),rT=o((t,e)=>{if(t!=null&&!Array.isArray(t)&&typeof t=="object")return t[e]},"getProperty"),M1=o((t,e,r)=>{if(t!=null){if(Array.isArray(t)){for(let n of t)M1(n,e,r);return}if(typeof t=="object"){let n=t;for(let[i,s]of Object.entries(n))i===e&&r.push(s),M1(s,e,r)}}},"collectDescendants"),nT=o(t=>{let e=[],r=t.startsWith("$")?1:0;for(;r<t.length;){let n=t[r];if(n===".")if(t[r+1]==="."){r+=2;let i=e4(t,r);if(!i.text)throw new Error(`Recursive descent ".." at position ${r} must be followed by a property name`);e.push({kind:"descendant",name:i.text}),r=i.next}else{if(r+=1,t[r]==="*"){e.push({kind:"wildcard"}),r+=1;continue}let i=e4(t,r);if(!i.text)throw new Error(`Property accessor "." at position ${r} must be followed by an identifier`);e.push({kind:"property",name:i.text}),r=i.next}else if(n==="["){let i=t.indexOf("]",r+1);if(i===-1)throw new Error(`Unterminated "[" in JSONPath "${t}"`);let s=t.slice(r+1,i).trim();if(s==="*")e.push({kind:"wildcard"});else if(/^-?\d+$/.test(s))e.push({kind:"index",index:parseInt(s,10)});else if(/^'[^']*'$/.test(s)||/^"[^"]*"$/.test(s))e.push({kind:"property",name:s.slice(1,-1)});else throw new Error(`Unsupported bracket expression [${s}] in JSONPath "${t}"`);r=i+1}else throw new Error(`Unexpected character "${n}" at position ${r} in JSONPath "${t}"`)}return e},"tokenizeJsonPath"),e4=o((t,e)=>{let r=e;for(;r<t.length;){let n=t[r];if(!/[A-Za-z0-9_\-@:]/.test(n))break;r+=1}return{text:t.slice(e,r),next:r}},"readIdentifier"),Wa=o((t,e)=>{if("type"in e&&!(Array.isArray(e.type)?e.type:[e.type]).some(i=>sT(t,i))||"const"in e&&!eh(t,e.const))return!1;if("enum"in e){let r=e.enum;if(!Array.isArray(r)||!r.some(n=>eh(t,n)))return!1}if("pattern"in e){if(typeof t!="string")return!1;let r=e.pattern;if(typeof r!="string"||r.length>tT||!(0,n4.default)(r))return!1;let n;try{n=new RegExp(r)}catch{return!1}try{if(!n.test(t))return!1}catch{return!1}}if(typeof t=="number"&&(typeof e.minimum=="number"&&t<e.minimum||typeof e.maximum=="number"&&t>e.maximum||typeof e.exclusiveMinimum=="number"&&t<=e.exclusiveMinimum||typeof e.exclusiveMaximum=="number"&&t>=e.exclusiveMaximum)||typeof t=="string"&&(typeof e.minLength=="number"&&t.length<e.minLength||typeof e.maxLength=="number"&&t.length>e.maxLength))return!1;if(Array.isArray(t)){if(e.contains&&typeof e.contains=="object"){let r=e.contains;if(!t.some(i=>Wa(i,r)))return!1}if(e.items&&typeof e.items=="object"&&!Array.isArray(e.items)){let r=e.items;if(!t.every(i=>Wa(i,r)))return!1}if(typeof e.minItems=="number"&&t.length<e.minItems||typeof e.maxItems=="number"&&t.length>e.maxItems)return!1}return!0},"satisfiesFilter"),iT=o(t=>{if(r4(t,["contains","items","minItems","maxItems"]))return!1;if("type"in t){let e=Array.isArray(t.type)?t.type:[t.type];return e.length===0?!1:e.every(r=>typeof r=="string"&&oT.has(r))}return r4(t,["pattern","minLength","maxLength","minimum","maximum","exclusiveMinimum","exclusiveMaximum"])||"const"in t&&t4(t.const)?!0:"enum"in t&&Array.isArray(t.enum)&&t.enum.length>0?t.enum.every(t4):!1},"expectsPrimitive"),oT=new Set(["string","number","integer","boolean","null"]),t4=o(t=>t===null||typeof t=="string"||typeof t=="number"||typeof t=="boolean","isPrimitiveValue"),r4=o((t,e)=>e.some(r=>r in t),"hasAnyKeyword"),sT=o((t,e)=>{switch(e){case"string":return typeof t=="string";case"number":return typeof t=="number";case"integer":return typeof t=="number"&&Number.isInteger(t);case"boolean":return typeof t=="boolean";case"null":return t===null;case"array":return Array.isArray(t);case"object":return t!==null&&typeof t=="object"&&!Array.isArray(t);default:return!1}},"matchesType"),eh=o((t,e)=>{if(t===e)return!0;if(t===null||e===null)return t===e;if(typeof t!=typeof e)return!1;if(Array.isArray(t)){if(!Array.isArray(e)||t.length!==e.length)return!1;for(let r=0;r<t.length;r++)if(!eh(t[r],e[r]))return!1;return!0}if(typeof t=="object"){if(typeof e!="object"||Array.isArray(e))return!1;let r=t,n=e,i=Object.keys(r),s=Object.keys(n);if(i.length!==s.length)return!1;for(let u of i)if(!eh(r[u],n[u]))return!1;return!0}return!1},"deepEqual"),uT=o(t=>t instanceof Error?t.message:String(t),"describe");var rh=o((t,e)=>{let r=t.map((u,a)=>({index:a,candidate:{...u,format:u.format??yd(u.credential)}})),n=e.input_descriptors.map(u=>{let a=[],c=u.format??e.format;for(let d of r){let{candidate:h,index:y}=d;if(c&&!cT(h.format,c))continue;let b=fT(h),A=th(b,u);A.matched&&a.push({descriptorId:u.id,candidate:h,match:A,candidateIndex:y})}return{descriptorId:u.id,candidates:a,reason:a.length===0?lT(u,r.length,c):void 0}}),i=new Set(n.filter(u=>u.candidates.length>0).map(u=>u.descriptorId)),s=aT(e,i);return{descriptors:n,canSatisfy:s.satisfied,reason:s.satisfied?void 0:s.reason}},"selectCredentials"),s4=o((t,e,r={})=>{let n=r.makeId??pT;return{id:r.submissionId??n(),definition_id:t.id,descriptor_map:e.map(i=>{let s={id:i.descriptorId,format:i.format,path:i.path};return i.pathNested&&(s.path_nested={id:i.descriptorId,format:i.format,path:i.pathNested}),s})}},"buildPresentationSubmission"),yd=o(t=>{if(typeof t=="string")return/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(t)?"jwt_vc_json":void 0;if(!t||typeof t!="object")return;let r=t.proof;if(r&&typeof r=="object"){if(typeof r.jwt=="string"||r.type==="JwtProof2020")return"jwt_vc_json";if(typeof r.type=="string")return"ldp_vc"}},"inferCredentialFormat"),aT=o((t,e)=>{let r=t.submission_requirements;if(!r||r.length===0){let n=t.input_descriptors.map(i=>i.id).filter(i=>!e.has(i));return n.length===0?{satisfied:!0}:{satisfied:!1,reason:n.length===1?`Input descriptor "${n[0]}" has no matching credential`:`${n.length} input descriptors have no matching credential: ${n.join(", ")}`}}for(let n of r){let i=u4(n,t,e);if(!i.satisfied)return i}return{satisfied:!0}},"evaluateSubmissionRequirements"),u4=o((t,e,r)=>{if(typeof t.from=="string"&&t.from.length>0){let n=e.input_descriptors.filter(s=>s.group?.includes(t.from));if(n.length===0)return{satisfied:!1,reason:`submission_requirement references unknown group "${t.from}"`};let i=n.filter(s=>r.has(s.id));return i4(t,i.length,n.length)}if(Array.isArray(t.from_nested)&&t.from_nested.length>0){let n=0;for(let i of t.from_nested)u4(i,e,r).satisfied&&(n+=1);return i4(t,n,t.from_nested.length)}return{satisfied:!1,reason:"submission_requirement has neither `from` nor `from_nested`"}},"evaluateRequirement"),i4=o((t,e,r)=>{let n=t.name??t.from??"<anonymous>";return t.rule==="all"?e>=r?{satisfied:!0}:{satisfied:!1,reason:`Requirement "${n}" (rule=all) needs ${r} matches, only ${e} available`}:t.rule==="pick"?typeof t.count=="number"&&e<t.count?{satisfied:!1,reason:`Requirement "${n}" (rule=pick) needs count=${t.count} matches, only ${e} available`}:typeof t.min=="number"&&e<t.min?{satisfied:!1,reason:`Requirement "${n}" (rule=pick) needs min=${t.min} matches, only ${e} available`}:t.count===void 0&&t.min===void 0&&e===0?{satisfied:!1,reason:`Requirement "${n}" (rule=pick) needs at least one match, none available`}:{satisfied:!0}:{satisfied:!1,reason:`Unknown submission_requirement rule "${t.rule}"`}},"applyRule"),cT=o((t,e)=>t?Object.prototype.hasOwnProperty.call(e,t):!1,"formatIsPermitted"),fT=o(t=>{let{credential:e,format:r}=t;if(r==="jwt_vc_json"){if(typeof e=="string"){let n=o4(e);if(n)return n}if(e&&typeof e=="object"){let n=e.proof;if(n&&typeof n=="object"){let i=n.jwt;if(typeof i=="string"){let s=o4(i);if(s)return s}}}}return e},"decodeCandidateForMatching"),o4=o(t=>{let e=t.split(".");if(e.length===3)try{return JSON.parse(dT(e[1]))}catch{return}},"decodeJwtVc"),dT=o(t=>{let r=(t+"=".repeat((4-t.length%4)%4)).replace(/-/g,"+").replace(/_/g,"/");return typeof atob=="function"?atob(r):Buffer.from(r,"base64").toString("binary")},"base64UrlDecode"),lT=o((t,e,r)=>{if(e===0)return"You have no credentials in your wallet yet";let n=t.name??t.id;if(r){let i=Object.keys(r).join(", ");return`No credential satisfies "${n}" (required format: ${i})`}return`No credential satisfies "${n}"`},"explainNoMatches"),pT=o(()=>{let t=typeof globalThis<"u"&&"crypto"in globalThis?globalThis.crypto:void 0;if(t&&typeof t.getRandomValues=="function"){let e=new Uint8Array(8);return t.getRandomValues(e),Array.from(e,r=>r.toString(16).padStart(2,"0")).join("")}return Math.random().toString(36).slice(2,18)},"defaultMakeId");var V1=class V1 extends Error{constructor(e,r){super(r),this.name="BuildPresentationError",this.code=e}};o(V1,"BuildPresentationError");var Di=V1,md=o(t=>{let{pd:e,chosen:r,holder:n}=t;if(!r||r.length===0)throw new Di("no_selections","buildPresentation requires at least one chosen credential");let i=new Set(e.input_descriptors.map(h=>h.id)),s=r.map((h,y)=>{if(!i.has(h.descriptorId))throw new Di("unknown_descriptor",`Chosen credential at index ${y} references unknown descriptor "${h.descriptorId}"`);return{descriptorId:h.descriptorId,...hT(h.candidate,y)}}),u=t.envelopeFormat??mT(e,s.map(h=>h.format)),a=t.makeId??wT,c={"@context":["https://www.w3.org/2018/credentials/v1"],id:t.presentationId??`urn:uuid:${_T(a)}`,type:["VerifiablePresentation"],holder:n,verifiableCredential:s.map(h=>h.credential)},d={id:t.submissionId??a(),definition_id:e.id,descriptor_map:s.map((h,y)=>({id:h.descriptorId,format:h.format,path:bT(y,u)}))};return{unsignedVp:c,submission:d,vpFormat:u,innerFormats:s.map(h=>h.format)}},"buildPresentation"),hT=o((t,e)=>{let r=t.format??yd(t.credential);if(!r)throw new Di("unknown_credential_format",`Chosen credential at index ${e} has no detectable format (provide candidate.format or a shape inferCredentialFormat recognizes)`);if(r==="jwt_vc_json"){let n=yT(t.credential);if(!n)throw new Di("invalid_jwt_vc",`Chosen credential at index ${e} is tagged jwt_vc_json but has no compact JWS (expected a string, or an object with string \`proof.jwt\`)`);return{credential:n,format:r}}return{credential:t.credential,format:r}},"normalizeForEmbedding"),yT=o(t=>{if(typeof t=="string")return/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(t)?t:void 0;if(t&&typeof t=="object"){let e=t.proof;if(e&&typeof e=="object"){let r=e.jwt;if(typeof r=="string")return r}}},"extractCompactJws"),mT=o((t,e)=>{let r=gT(t.format),n=vT(e);return r.has("jwt_vp_json")&&!r.has("ldp_vp")?"jwt_vp_json":r.has("ldp_vp")&&!r.has("jwt_vp_json")?"ldp_vp":(r.has("jwt_vp_json")&&r.has("ldp_vp"),n)},"inferEnvelopeFormat"),gT=o(t=>{let e=new Set;return t&&("jwt_vp_json"in t&&e.add("jwt_vp_json"),"ldp_vp"in t&&e.add("ldp_vp")),e},"vpFormatsFromDesignation"),vT=o(t=>t.length===0?"ldp_vp":t.every(r=>r==="jwt_vc_json")?"jwt_vp_json":"ldp_vp","homogeneousVpFormatFromInner"),bT=o((t,e)=>e==="jwt_vp_json"?`$.vp.verifiableCredential[${t}]`:`$.verifiableCredential[${t}]`,"pathForIndex"),wT=o(()=>{let t=typeof globalThis<"u"&&"crypto"in globalThis?globalThis.crypto:void 0;if(t&&typeof t.getRandomValues=="function"){let e=new Uint8Array(8);return t.getRandomValues(e),Array.from(e,r=>r.toString(16).padStart(2,"0")).join("")}return Math.random().toString(36).slice(2,18)},"defaultMakeId"),_T=o(t=>{let r=(t().replace(/[^0-9a-f]/gi,"")+"0".repeat(32)).slice(0,32);return[r.slice(0,8),r.slice(8,12),"4"+r.slice(13,16),(parseInt(r.charAt(16),16)&3|8).toString(16)+r.slice(17,20),r.slice(20,32)].join("-")},"makeUuidV4");var L1=class L1 extends Error{constructor(e,r,n){super(r),this.name="VpSignError",this.code=e,n?.cause!==void 0&&(this.cause=n.cause)}};o(L1,"VpSignError");var er=L1,qi=o(async(t,e)=>(xT(t),t.vpFormat==="jwt_vp_json"?AT(t,e):ST(t,e)),"signPresentation"),xT=o(t=>{let{unsignedVp:e,holder:r,audience:n,nonce:i}=t;if(!e||typeof e!="object")throw new er("invalid_input","signPresentation requires an unsignedVp object");if(typeof n!="string"||n.length===0)throw new er("invalid_input","signPresentation requires a non-empty `audience`");if(typeof i!="string"||i.length===0)throw new er("invalid_input","signPresentation requires a non-empty `nonce`");if(typeof r!="string"||r.length===0)throw new er("invalid_input","signPresentation requires a non-empty `holder`");if(e.holder!==void 0&&e.holder!==r)throw new er("holder_mismatch",`unsignedVp.holder (${e.holder}) does not match options.holder (${r})`)},"validateInput"),AT=o(async(t,e)=>{if(!e.jwtSigner)throw new er("missing_jwt_signer","vpFormat=jwt_vp_json requires helpers.jwtSigner");let r=t.iat??Math.floor(Date.now()/1e3),n={alg:e.jwtSigner.alg,kid:e.jwtSigner.kid,typ:"JWT"},i=t.jti??(typeof t.unsignedVp.id=="string"?t.unsignedVp.id:void 0),s={iss:t.holder,sub:t.holder,aud:t.audience,nonce:t.nonce,iat:r,vp:t.unsignedVp};i&&(s.jti=i);let u;try{u=await e.jwtSigner.sign(n,s)}catch(a){throw new er("jwt_sign_failed",`Failed to sign jwt_vp_json: ${a instanceof Error?a.message:String(a)}`,{cause:a})}return{vpToken:u,vpFormat:"jwt_vp_json"}},"signJwtVp"),ST=o(async(t,e)=>{if(!e.ldpVpSigner)throw new er("missing_ldp_signer","vpFormat=ldp_vp requires helpers.ldpVpSigner");let r;try{r=await e.ldpVpSigner.sign(t.unsignedVp,{domain:t.audience,challenge:t.nonce})}catch(n){throw new er("ldp_sign_failed",`Failed to sign ldp_vp: ${n instanceof Error?n.message:String(n)}`,{cause:n})}return{vpToken:r,vpFormat:"ldp_vp"}},"signLdpVp");var F1=class F1 extends Error{constructor(e,r,n={}){super(r),this.name="JarmEncryptError",this.code=e,n.cause!==void 0&&(this.cause=n.cause)}};o(F1,"JarmEncryptError");var tt=F1,H1="ECDH-ES",W1="A256GCM",nh=o(async t=>{let{payload:e,clientMetadata:r,verifierNonce:n,walletNonce:i,signer:s}=t,u=r.authorization_encrypted_response_alg??H1,a=r.authorization_encrypted_response_enc??W1,c=r.authorization_signed_response_alg,d=await kT(r,t.fetchImpl),h=CT(d,u),y,b;if(c){if(!s)throw new tt("missing_signer",`Verifier requires authorization_signed_response_alg=${c} but no wallet signer was supplied`);let I=await ET(e,c,s);y=new TextEncoder().encode(I),b="JWT"}else y=new TextEncoder().encode(JSON.stringify(e)),b=void 0;let A;try{A=await dn(h,u)}catch(I){throw new tt("unsupported_alg",`Failed to import verifier encryption key (alg=${u}, kty=${h.kty}): ${gd(I)}`,{cause:I})}let S={alg:u,enc:a};typeof h.kid=="string"&&h.kid.length>0&&(S.kid=h.kid),b&&(S.cty=b);let D={apv:new TextEncoder().encode(n)};typeof i=="string"&&i.length>0&&(D.apu=new TextEncoder().encode(i));try{return await new cc(y).setProtectedHeader(S).setKeyManagementParameters(D).encrypt(A)}catch(I){throw new tt("encrypt_failed",`JWE encryption failed (alg=${u}, enc=${a}): ${gd(I)}`,{cause:I})}},"encryptResponseObject"),kT=o(async(t,e)=>{if(t.jwks&&Array.isArray(t.jwks.keys))return t.jwks.keys;if(typeof t.jwks_uri=="string"&&t.jwks_uri.length>0){let r=e??globalThis.fetch;if(typeof r!="function")throw new tt("jwks_fetch_failed",`client_metadata.jwks_uri=${t.jwks_uri} but no fetch implementation is available`);let n;try{n=await r(t.jwks_uri,{headers:{Accept:"application/json"}})}catch(s){throw new tt("jwks_fetch_failed",`Failed to fetch jwks_uri=${t.jwks_uri}: ${gd(s)}`,{cause:s})}if(!n.ok)throw new tt("jwks_fetch_failed",`jwks_uri returned HTTP ${n.status} for ${t.jwks_uri}`);let i;try{i=await n.json()}catch(s){throw new tt("invalid_jwks",`jwks_uri body was not valid JSON: ${gd(s)}`,{cause:s})}if(!i||typeof i!="object"||!Array.isArray(i.keys))throw new tt("invalid_jwks","jwks_uri body must be a JSON object with a `keys` array");return i.keys}throw new tt("no_encryption_key","client_metadata declares neither inline `jwks` nor `jwks_uri` \u2014 verifier cannot receive encrypted responses")},"resolveVerifierJwks"),CT=o((t,e)=>{if(t.length===0)throw new tt("no_encryption_key","Verifier JWKS contained no keys");let r=t.filter(s=>s.use!=="sig");if(r.length===0)throw new tt("no_encryption_key",'Verifier JWKS contains only `use:"sig"` keys; no encryption-capable key advertised');let n=r.find(s=>s.alg===e);if(n)return n;let i=r.find(s=>!s.alg);return i||r[0]},"pickEncryptionKey"),ET=o(async(t,e,r)=>{try{return await r.sign({alg:e,kid:r.kid,typ:"JWT"},t)}catch(n){throw new tt("sign_failed",`Wallet signer failed during JARM inner-JWS signing: ${gd(n)}`,{cause:n})}},"signResponse"),gd=o(t=>t instanceof Error?t.message:String(t),"describe");var z1=class z1 extends Error{constructor(e,r,n={}){super(r),this.name="VpSubmitError",this.code=e,this.status=n.status,this.body=n.body,n.cause!==void 0&&(this.cause=n.cause)}};o(z1,"VpSubmitError");var tr=z1,Fa=o(async t=>{let{responseUri:e,vpToken:r,submission:n,state:i}=t;if(typeof e!="string"||e.length===0)throw new tr("invalid_input","`responseUri` must be a non-empty string");if(r==null)throw new tr("invalid_input","`vpToken` is required");if(n!==void 0&&(n===null||typeof n!="object"))throw new tr("invalid_input","`submission` must be a PresentationSubmission object when provided (omit it entirely for DCQL flows)");let s=t.fetchImpl??globalThis.fetch;if(typeof s!="function")throw new tr("no_fetch","No fetch implementation available; pass `fetchImpl` or configure the plugin with one");let a=t.responseMode==="direct_post.jwt"?await IT({vpToken:r,submission:n,state:i,idToken:t.idToken,clientMetadata:t.clientMetadata,nonce:t.nonce,signer:t.signer,fetchImpl:s}):PT({vpToken:r,submission:n,state:i,idToken:t.idToken}),c;try{c=await s(e,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json, text/plain;q=0.9, */*;q=0.8"},body:a})}catch(h){throw new tr("network_error",`Failed to POST to ${e}: ${h instanceof Error?h.message:String(h)}`,{cause:h})}let d=await OT(c);if(!c.ok)throw new tr("server_error",`Verifier returned ${c.status} ${c.statusText||""}`.trim(),{status:c.status,body:d});return{status:c.status,redirectUri:RT(d),body:d}},"submitPresentation"),PT=o(t=>{let e=new URLSearchParams;return e.set("vp_token",TT(t.vpToken)),t.submission&&e.set("presentation_submission",JSON.stringify(t.submission)),typeof t.idToken=="string"&&t.idToken.length>0&&e.set("id_token",t.idToken),typeof t.state=="string"&&t.state.length>0&&e.set("state",t.state),e.toString()},"encodeFormBody"),TT=o(t=>typeof t=="string"?t:JSON.stringify(t),"stringifyVpToken"),IT=o(async t=>{if(!t.clientMetadata)throw new tr("invalid_input","response_mode=direct_post.jwt requires `clientMetadata` (verifier's JWKS + JWE algs)");if(typeof t.nonce!="string"||t.nonce.length===0)throw new tr("invalid_input","response_mode=direct_post.jwt requires the verifier `nonce` for the JWE `apv` ECDH-ES KDF input");let e={vp_token:t.vpToken};t.submission&&(e.presentation_submission=t.submission),typeof t.state=="string"&&t.state.length>0&&(e.state=t.state),typeof t.idToken=="string"&&t.idToken.length>0&&(e.id_token=t.idToken);let r;try{r=await nh({payload:e,clientMetadata:t.clientMetadata,verifierNonce:t.nonce,signer:t.signer,fetchImpl:t.fetchImpl})}catch(i){throw i instanceof tt?new tr("jarm_encrypt_failed",`Failed to build JARM response (${i.code}): ${i.message}`,{cause:i}):i}let n=new URLSearchParams;return n.set("response",r),n.toString()},"encodeJarmBody"),OT=o(async t=>{let e=await t.text().catch(()=>"");if(!e)return;if((t.headers.get("content-type")??"").includes("application/json"))try{return JSON.parse(e)}catch{return e}try{return JSON.parse(e)}catch{return e}},"parseResponseBody"),RT=o(t=>{if(t&&typeof t=="object"){let e=t.redirect_uri;if(typeof e=="string"&&e.length>0)return e}},"extractRedirectUri");var J1=class J1 extends Error{constructor(e,r,n){super(r),this.name="SiopSignError",this.code=e,n?.cause!==void 0&&(this.cause=n.cause)}};o(J1,"SiopSignError");var Jn=J1,vd=o(async(t,e)=>{jT(t,e);let{holder:r,audience:n,nonce:i}=t,s=t.iat??Math.floor(Date.now()/1e3),u=s+(t.lifetimeSeconds??300),a=t.issuerMode??"did",c={alg:e.signer.alg,kid:e.signer.kid,typ:"JWT"},d={iss:a==="did"?r:"https://self-issued.me/v2",sub:r,aud:n,nonce:i,iat:s,exp:u};t.vpTokenHash&&(d._vp_token={vp_token_hash:t.vpTokenHash});let h;try{h=await e.signer.sign(c,d)}catch(y){throw new Jn("id_token_sign_failed",`Failed to sign SIOPv2 id_token: ${y instanceof Error?y.message:String(y)}`,{cause:y})}return{idToken:h}},"signIdToken"),jT=o((t,e)=>{if(!e.signer)throw new Jn("missing_signer","signIdToken requires helpers.signer");if(typeof t.holder!="string"||t.holder.length===0)throw new Jn("invalid_input","signIdToken requires a non-empty `holder`");if(typeof t.audience!="string"||t.audience.length===0)throw new Jn("invalid_input","signIdToken requires a non-empty `audience`");if(typeof t.nonce!="string"||t.nonce.length===0)throw new Jn("invalid_input","signIdToken requires a non-empty `nonce`")},"validateInput"),K1=o(t=>t?new Set(t.split(/\s+/).filter(Boolean)):new Set,"responseTypeSet"),ih=o(t=>K1(t).has("id_token"),"requiresIdToken");var G1=o(t=>{let e=t.format??DT(t.credential);if(e==="jwt_vc_json")return NT(t.credential);if(e==="ldp_vc")return BT(t.credential)},"adaptCredentialForDcql"),oh=o(t=>{let e=[];for(let r of t){let n=G1(r);n&&e.push({original:r,adapted:n})}return e},"adaptCredentialsForDcql"),NT=o(t=>{let e;if(typeof t=="string")e=a4(t);else if(t&&typeof t=="object"){let s=t.proof;if(s&&typeof s=="object"){let u=s.jwt;typeof u=="string"&&(e=a4(u))}}if(!e)return;let r=e.vc;if(!r||typeof r!="object"||Array.isArray(r))return;let n=r,i=c4(n.type);if(i.length!==0)return{credential_format:"jwt_vc_json",type:i,claims:n,cryptographic_holder_binding:!0}},"adaptJwtVc"),BT=o(t=>{if(!t||typeof t!="object"||Array.isArray(t))return;let e=t,r=c4(e.type);if(r.length!==0)return{credential_format:"ldp_vc",type:r,claims:e,cryptographic_holder_binding:!0}},"adaptLdpVc"),c4=o(t=>Array.isArray(t)?t.filter(e=>typeof e=="string"):typeof t=="string"?[t]:[],"extractTypes"),DT=o(t=>{if(typeof t=="string")return/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(t)?"jwt_vc_json":void 0;if(t&&typeof t=="object"&&!Array.isArray(t)){let e=t.proof;if(e&&typeof e=="object")return e.type==="JwtProof2020"?"jwt_vc_json":"ldp_vc"}},"inferDcqlFormat"),a4=o(t=>{let e=t.split(".");if(e.length===3)try{let r=JSON.parse(qT(e[1]));return r&&typeof r=="object"&&!Array.isArray(r)?r:void 0}catch{return}},"decodeJwtPayload"),qT=o(t=>{let r=(t+"=".repeat((4-t.length%4)%4)).replace(/-/g,"+").replace(/_/g,"/");return typeof atob=="function"?atob(r):Buffer.from(r,"base64").toString("binary")},"base64UrlDecode");var sh=o((t,e)=>{let r=oh(t),n=r.map(u=>u.adapted),i=To.query(e,n),s={};for(let[u,a]of Object.entries(i.credential_matches)){if(a.success){let c=a.valid_credentials.map(d=>r[d.input_credential_index]?.original).filter(d=>d!==void 0);s[u]={credentialQueryId:u,candidates:c};continue}s[u]={credentialQueryId:u,candidates:[],reason:`No held credential satisfies query "${u}"`}}return{canSatisfy:i.can_be_satisfied,matches:s,reason:i.can_be_satisfied?void 0:"No combination of held credentials satisfies the verifier's DCQL query",raw:i}},"selectCredentialsForDcql");var X1=class X1 extends Error{constructor(e,r){super(r),this.name="BuildDcqlPresentationError",this.code=e}};o(X1,"BuildDcqlPresentationError");var Gn=X1,uh=o(t=>{let{query:e,chosen:r,holder:n}=t;if(r.length===0)throw new Gn("no_selections","buildDcqlPresentations requires at least one chosen credential");let i=t.makeId??VT,s=new Map;for(let c of r){let d=s.get(c.credentialQueryId);d?d.push(c.candidate):s.set(c.credentialQueryId,[c.candidate])}let u=new Map;for(let c of e.credentials)u.set(c.id,c);let a=[];for(let c of e.credentials){let d=s.get(c.id);d&&(a.push(MT(c,d,n,i)),s.delete(c.id))}if(s.size>0){let c=Array.from(s.keys()).join(", ");throw new Gn("unknown_credential_query",`chosen credentials reference query ids the DCQL query doesn't declare: ${c}`)}return a},"buildDcqlPresentations"),MT=o((t,e,r,n)=>{let i=UT(t.format,t.id),s=e.map((a,c)=>$T(a,t.id,c)),u={"@context":["https://www.w3.org/2018/credentials/v1"],id:`urn:uuid:${LT(n)}`,type:["VerifiablePresentation"],holder:r,verifiableCredential:s};return{credentialQueryId:t.id,unsignedVp:u,vpFormat:i,candidates:e}},"buildOnePresentation"),UT=o((t,e)=>{if(t==="jwt_vc_json")return"jwt_vp_json";if(t==="ldp_vc")return"ldp_vp";throw new Gn("unsupported_format",`DCQL query "${e}" requests format "${t}", which the plugin doesn't yet build presentations for (sd-jwt-vc and mso_mdoc are tracked for follow-up slices)`)},"vpFormatForQueryFormat"),$T=o((t,e,r)=>{let n=t.credential;if(typeof n=="string"){if(/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(n))return n;throw new Gn("invalid_jwt_vc",`chosen candidate at index ${r} for query "${e}" is a string but not a compact JWS`)}if(n&&typeof n=="object"){let i=n.proof;if(i&&typeof i=="object"){let s=i.jwt;if(typeof s=="string")return s}return n}throw new Gn("invalid_jwt_vc",`chosen candidate at index ${r} for query "${e}" is neither a JWT string nor a JSON object`)},"normalizeForEmbedding"),VT=o(()=>{let t=typeof globalThis<"u"&&"crypto"in globalThis?globalThis.crypto:void 0;if(t&&typeof t.getRandomValues=="function"){let e=new Uint8Array(8);return t.getRandomValues(e),Array.from(e,r=>r.toString(16).padStart(2,"0")).join("")}return Math.random().toString(36).slice(2,18)},"defaultMakeId"),LT=o(t=>{let r=(t().replace(/[^0-9a-f]/gi,"")+"0".repeat(32)).slice(0,32);return[r.slice(0,8),r.slice(8,12),"4"+r.slice(13,16),(parseInt(r.slice(16,17),16)&3|8).toString(16)+r.slice(17,20),r.slice(20,32)].join("-")},"makeUuidV4");var Z1=o(async(t,e)=>{let r=[];for(let n of t.built){let i=await qi({unsignedVp:n.unsignedVp,vpFormat:n.vpFormat,audience:t.audience,nonce:t.nonce,holder:t.holder,iat:t.iat},e);r.push({credentialQueryId:n.credentialQueryId,vpToken:i.vpToken,vpFormat:n.vpFormat})}return r},"signDcqlPresentations"),ah=o(async(t,e)=>{let r=await Z1(t,e);return{vpToken:Q1(r),presentations:r}},"buildDcqlResponse"),Q1=o(t=>{let e={};for(let r of t)e[r.credentialQueryId]=r.vpToken;return e},"assembleDcqlVpToken");var d4=o((t,e={})=>{let r=e.fetch??globalThis.fetch,n={didResolver:e.didResolver,trustedX509Roots:e.trustedX509Roots,unsafeAllowSelfSigned:e.unsafeAllowSelfSignedRequestObject,unsafeSkipRequestObjectSignatureVerification:e.unsafeSkipRequestObjectSignatureVerification},i=o(async s=>{let u=xd(s);if(u.kind==="by_value")return u.offer;if(typeof r!="function")throw new we("invalid_uri","No fetch implementation available; pass `config.fetch` to getOpenID4VCPlugin()");let a=await hh(u.uri,r);if(a.kind!=="by_value")throw new we("invalid_uri","Unexpected by_reference result after resolving credential_offer_uri");return a.offer},"resolveOffer");return{name:"OpenID4VC",displayName:"OpenID4VC",description:"OpenID for Verifiable Credentials holder support \u2014 Credential Offers, VCI, VP, and SIOPv2.",methods:{parseCredentialOffer:o((s,u)=>xd(u),"parseCredentialOffer"),resolveCredentialOffer:o(async(s,u)=>i(u),"resolveCredentialOffer"),acceptCredentialOffer:o(async(s,u,a={})=>{let c=typeof u=="string"?await i(u):u,d=await rw(s,a);return Ud({offer:c,signer:d,options:a,fetchImpl:r})},"acceptCredentialOffer"),acceptAndStoreCredentialOffer:o(async(s,u,a={})=>{let c=await(async()=>{let h=typeof u=="string"?await i(u):u,y=await rw(s,a);return Ud({offer:h,signer:y,options:a,fetchImpl:r})})(),d=await fy(s,c,FT(a));return{...c,...d}},"acceptAndStoreCredentialOffer"),beginCredentialOfferAuthCode:o(async(s,u,a)=>{let c=typeof u=="string"?await i(u):u;return uy({offer:c,redirectUri:a.redirectUri,clientId:a.clientId,configurationIds:a.configurationIds,scope:a.scope,fetchImpl:r})},"beginCredentialOfferAuthCode"),completeCredentialOfferAuthCode:o(async(s,u)=>{let a=u.signer??await rw(s,{});return ay({flowHandle:u.flowHandle,code:u.code,state:u.state,signer:a,fetchImpl:r})},"completeCredentialOfferAuthCode"),parseAuthorizationRequest:o((s,u)=>ud(u),"parseAuthorizationRequest"),resolveAuthorizationRequest:o(async(s,u)=>ad(u,r,n),"resolveAuthorizationRequest"),prepareVerifiablePresentation:o(async(s,u,a)=>{let c=await za(u,r,n);if(c.dcql_query){let d=sh(a,c.dcql_query);return{request:c,dcqlSelection:d}}if(c.presentation_definition){let d=rh(a,c.presentation_definition);return{request:c,selection:d}}return{request:c,selection:{descriptors:[],canSatisfy:!0,reason:void 0}}},"prepareVerifiablePresentation"),buildPresentation:o(async(s,u,a,c={})=>{let d=await za(u,r,n),h=f4(d),y=c.holder??s.id.did(),b=md({pd:h,chosen:a,holder:y,envelopeFormat:c.envelopeFormat});return{request:d,prepared:b}},"buildPresentation"),signPresentation:o(async(s,u,a,c={})=>{let d=await za(u,r,n),h=c.holder??(typeof a.unsignedVp.holder=="string"?a.unsignedVp.holder:s.id.did());if(a.vpFormat==="jwt_vp_json"){let y=c.signer??await ch(s);return qi({unsignedVp:a.unsignedVp,vpFormat:a.vpFormat,audience:d.client_id,nonce:d.nonce,holder:h},{jwtSigner:y})}return qi({unsignedVp:a.unsignedVp,vpFormat:a.vpFormat,audience:d.client_id,nonce:d.nonce,holder:h},{ldpVpSigner:tw(s)})},"signPresentation"),submitPresentation:o(async(s,u,a,c,d={})=>{let h=await za(u,r,n),y=h.response_uri??h.redirect_uri;if(!y)throw new Error("Authorization Request has no response_uri / redirect_uri \u2014 cannot submitPresentation");return Fa({responseUri:y,vpToken:a.vpToken,submission:c,idToken:d.idToken,state:h.state,fetchImpl:r,...Y1(h,await ew(s,h))})},"submitPresentation"),signIdToken:o(async(s,u,a={})=>{let c=await za(u,r,n),d=a.holder??s.id.did(),h=a.signer??await ch(s);return vd({holder:d,audience:c.client_id,nonce:c.nonce,lifetimeSeconds:a.lifetimeSeconds,issuerMode:a.issuerMode,vpTokenHash:a.vpTokenHash},{signer:h})},"signIdToken"),presentCredentials:o(async(s,u,a,c={})=>{let d=await za(u,r,n),h=c.holder??s.id.did(),y=c.signer,b=o(async()=>(y||(y=await ch(s)),y),"ensureSharedJwtSigner"),A=o(async()=>{if(ih(d.response_type))return vd({holder:h,audience:d.client_id,nonce:d.nonce},{signer:await b()})},"signIdTokenIfRequested"),S=d.response_uri??d.redirect_uri;if(!S)throw new Error("Authorization Request has no response_uri / redirect_uri \u2014 cannot presentCredentials");if(d.dcql_query){let ve=WT(a),ce=uh({query:d.dcql_query,chosen:ve,holder:h}),Ve=ce.some(gt=>gt.vpFormat==="jwt_vp_json"),It=ce.some(gt=>gt.vpFormat==="ldp_vp"),mt={...Ve?{jwtSigner:await b()}:{},...It?{ldpVpSigner:tw(s)}:{}},Ft=await ah({built:ce,audience:d.client_id,nonce:d.nonce,holder:h},mt),Dr=await A(),sn=await Fa({responseUri:S,vpToken:Ft.vpToken,idToken:Dr?.idToken,state:d.state,fetchImpl:r,...Y1(d,await ew(s,d))});return{request:d,dcqlBuilt:ce,dcqlSigned:Ft.presentations,dcqlVpToken:Ft.vpToken,signedIdToken:Dr,submitted:sn}}let D=f4(d),I=HT(a),J=md({pd:D,chosen:I,holder:h,envelopeFormat:c.envelopeFormat}),pe=J.vpFormat==="jwt_vp_json"?{jwtSigner:await b()}:{ldpVpSigner:tw(s)},de=await qi({unsignedVp:J.unsignedVp,vpFormat:J.vpFormat,audience:d.client_id,nonce:d.nonce,holder:h},pe),xe=await A(),ee=await Fa({responseUri:S,vpToken:de.vpToken,submission:J.submission,idToken:xe?.idToken,state:d.state,fetchImpl:r,...Y1(d,await ew(s,d))});return{request:d,prepared:J,signed:de,signedIdToken:xe,submitted:ee}},"presentCredentials")}}},"getOpenID4VCPlugin"),za=o(async(t,e,r)=>typeof t=="string"?await ad(t,e,r):t,"resolveRequestInput"),f4=o(t=>{if(!t.presentation_definition)throw new Error("Authorization Request has no presentation_definition \u2014 cannot build a VP");return t.presentation_definition},"requirePresentationDefinition"),HT=o(t=>{for(let[e,r]of t.entries())if(!("descriptorId"in r)||typeof r.descriptorId!="string")throw new Error(`chosen[${e}] is missing 'descriptorId' \u2014 PEX requests need ChosenCredential entries (received DCQL-shape entry with credentialQueryId="${r.credentialQueryId}")`);return t},"assertPexChosen"),WT=o(t=>{for(let[e,r]of t.entries())if(!("credentialQueryId"in r)||typeof r.credentialQueryId!="string")throw new Error(`chosen[${e}] is missing 'credentialQueryId' \u2014 DCQL requests need DcqlChosenCredential entries (received PEX-shape entry with descriptorId="${r.descriptorId}")`);return t},"assertDcqlChosen"),Y1=o((t,e)=>t.response_mode!=="direct_post.jwt"?{}:{responseMode:"direct_post.jwt",clientMetadata:t.client_metadata,nonce:t.nonce,signer:e},"buildJarmOptions"),ew=o(async(t,e)=>{if(e.response_mode!=="direct_post.jwt")return;let r=e.client_metadata?.authorization_signed_response_alg;if(!(typeof r!="string"||r.length===0))return ch(t)},"maybeJarmSigner"),ch=o(async t=>{let e=l4(t,"VP signing"),r=t.id.did(),n=await t.invoke.didToVerificationMethod(r);return Md({keypair:e,kid:n})},"ensureVpJwtSigner"),tw=o(t=>({sign:o(async(e,{domain:r,challenge:n})=>t.invoke.issuePresentation(e,{domain:r,challenge:n}),"sign")}),"buildLdpVpSigner"),rw=o(async(t,e)=>{if(e.signer)return e.signer;let r=l4(t,"VCI proof-of-possession"),n=t.id.did(),i=await t.invoke.didToVerificationMethod(n);return Md({keypair:r,kid:i})},"ensureSigner"),l4=o((t,e)=>{let r;try{r=t.id.keypair("ed25519")}catch(n){throw new Error(`OpenID4VC ${e} requires an Ed25519 keypair on the host LearnCard, but \`id.keypair('ed25519')\` threw: ${n instanceof Error?n.message:String(n)}. Pass \`options.signer\` to bring your own signer (HSM / secp256k1 / external backend).`)}if(!r||r.kty!=="OKP"||r.crv!=="Ed25519")throw new Error(`OpenID4VC ${e} requires an Ed25519 keypair, but the host LearnCard returned ${r?`kty=${r.kty} crv=${r.crv??"<none>"}`:"no keypair"}. Pass \`options.signer\` to bring your own signer (HSM / secp256k1 / external backend).`);return r},"requireEd25519Keypair"),FT=o(t=>({storage:t.storage,encrypt:t.encrypt,category:t.category,title:t.title,imgUrl:t.imgUrl,upload:t.upload,addToIndex:t.addToIndex,makeId:t.makeId}),"splitStoreOptions");var nw=o(t=>Ni(t),"buildDcqlQuery"),p4=o(t=>{let e=t.format??"jwt_vc_json";if(t.types.length===0)throw new Error("requestW3cVc: `types` must contain at least one type string");let r={id:t.id,format:e,meta:{type_values:[Array.from(t.types)]}};return t.claims&&t.claims.length>0&&(r.claims=t.claims.map(n=>{let i={path:Array.from(n.path)};return n.values&&n.values.length>0&&(i.values=Array.from(n.values)),n.id&&(i.id=n.id),i})),t.requireHolderBinding===!1&&(r.require_cryptographic_holder_binding=!1),nw({credentials:[r]})},"requestW3cVc");
 /*! Bundled license information:
 
 reflect-metadata/Reflect.js:
@@ -148,4 +148,4 @@ tslib/tslib.es6.js:
    * 
    *)
 */
-//# sourceMappingURL=openid4vc-plugin.cjs.production.min.js.map
+//# sourceMappingURL=openid4vc-plugin.cjs.production.min.cjs.map