@learncard/openid4vc-plugin 0.3.5 → 0.3.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/openid4vc-plugin.cjs.development.cjs +8 -8
- package/dist/openid4vc-plugin.cjs.development.cjs.map +2 -2
- package/dist/openid4vc-plugin.cjs.production.min.cjs +1 -1
- package/dist/openid4vc-plugin.cjs.production.min.cjs.map +2 -2
- package/dist/openid4vc-plugin.esm.js +8 -8
- package/dist/openid4vc-plugin.esm.js.map +2 -2
- package/dist/vp/present.d.ts.map +1 -1
- package/package.json +4 -4
- package/src/vp/present.ts +16 -16
|
@@ -160,7 +160,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
|
|
|
160
160
|
${(e.match(/.{1,64}/g)??[e]).join(`
|
|
161
161
|
`)}
|
|
162
162
|
-----END CERTIFICATE-----
|
|
163
|
-
`},"derToPem"),H6e=o(async t=>{let{jws:e,header:r,opts:i}=t;if(!!!i.unsafeAllowSelfSigned)throw new Ce("unsupported_client_id_scheme","client-id prefix=pre-registered without a registry binding requires unsafeAllowSelfSigned=true (signing key cannot be derived from client_id alone)");let u=r.x5c;if(!Array.isArray(u)||u.length===0)throw new Ce("invalid_request_object","client-id prefix=pre-registered requires an x5c header to verify the signature against (no key material available otherwise)");let a=gq(u[0]),p;try{p=await b6(a,gr(r.alg)??"RS256")}catch(v){throw new Ce("request_signer_untrusted",`Failed to import leaf X.509 cert: ${ln(v)}`,{cause:v})}try{await hh(e,p)}catch(v){throw new Ce("request_signature_invalid",`JWS signature verification failed: ${ln(v)}`,{cause:v})}},"verifyWithPreRegistered"),G6e=o(t=>{try{return new URL(t.includes("://")?t:`https://${t}`).hostname}catch{return t}},"hostFromClientId"),hq=o((t=globalThis.fetch)=>async e=>{if(e.startsWith("did:jwk:"))return X6e(e);if(e.startsWith("did:web:"))return Q6e(e,t);throw new Ce("did_resolution_failed",`Built-in resolver does not support ${e.split(":").slice(0,2).join(":")} \u2014 pass a custom didResolver`)},"builtInDidResolver"),X6e=o(t=>{let e=t.replace(/^did:jwk:/,"").split("#")[0],r;try{let n="=".repeat((4-e.length%4)%4),u=e.replace(/-/g,"+").replace(/_/g,"/")+n;r=JSON.parse(Buffer.from(u,"base64").toString("utf8"))}catch(n){throw new Ce("did_resolution_failed",`Failed to decode did:jwk identifier: ${ln(n)}`,{cause:n})}let i=`${t}#0`;return{id:t,verificationMethod:[{id:i,type:"JsonWebKey2020",controller:t,publicKeyJwk:r}],authentication:[i],assertionMethod:[i]}},"resolveDidJwk"),Q6e=o(async(t,e)=>{if(typeof e!="function")throw new Ce("did_resolution_failed","did:web resolution requires a fetch implementation");let i=t.replace(/^did:web:/,"").split(":").map(_=>decodeURIComponent(_)),n=i.shift(),u=i.length===0?"/.well-known/did.json":`/${i.join("/")}/did.json`,a=`https://${n}${u}`,p;try{p=await e(a,{method:"GET"})}catch(_){throw new Ce("did_resolution_failed",`Failed to fetch ${a}: ${ln(_)}`,{cause:_})}if(!p.ok)throw new Ce("did_resolution_failed",`${a} returned ${p.status} ${p.statusText}`);let v;try{v=await p.json()}catch(_){throw new Ce("did_resolution_failed",`${a} response was not JSON: ${ln(_)}`,{cause:_})}if(!v||typeof v!="object"||Array.isArray(v))throw new Ce("did_resolution_failed",`${a} response was not a DID Document object`);return v},"resolveDidWeb"),pq=o((t,e,r)=>{let i=mq(r.presentation_definition)?r.presentation_definition:void 0,n=gr(r.presentation_definition_uri),u;if(r.dcql_query!==void 0&&r.dcql_query!==null){if(i||n)throw new $e("both_pex_and_dcql","Request Object claims carry both PEX (presentation_definition[_uri]) and DCQL (dcql_query); OID4VP 1.0 \xA75.3 forbids this");u=Ca(r.dcql_query)}let a=mq(r.client_metadata)?r.client_metadata:void 0,p=gr(r.nonce);if(!p)throw new $e("missing_nonce","Request Object is missing the required `nonce` claim (OID4VP 1.0 \xA75.2)");let v;if(r.transaction_data!==void 0&&r.transaction_data!==null){if(!Array.isArray(r.transaction_data)||r.transaction_data.length===0||!r.transaction_data.every(S=>typeof S=="string"))throw new $e("invalid_transaction_data","transaction_data MUST be a non-empty array of base64url-encoded strings");v=r.transaction_data}let _=Array.isArray(r.verifier_info)?r.verifier_info:void 0,b=gr(r.request_uri_method),l=b==="get"||b==="post"?b:void 0;return{client_id:t,client_id_scheme:e,response_type:gr(r.response_type)??"vp_token",response_mode:gr(r.response_mode),response_uri:gr(r.response_uri),redirect_uri:gr(r.redirect_uri),nonce:p,state:gr(r.state),presentation_definition:i,presentation_definition_uri:n,dcql_query:u,client_metadata:a,client_metadata_uri:gr(r.client_metadata_uri),scope:gr(r.scope),transaction_data:v,verifier_info:_,request_uri_method:l,wallet_nonce:gr(r.wallet_nonce)}},"buildRequestFromClaims"),gr=o(t=>typeof t=="string"&&t.length>0?t:void 0,"asString"),mq=o(t=>t!==null&&typeof t=="object"&&!Array.isArray(t),"isObject"),mue=o(t=>/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(t),"looksLikeJws"),gue=o(t=>{let e="=".repeat((4-t.length%4)%4),r=t.replace(/-/g,"+").replace(/_/g,"/")+e;return Buffer.from(r,"base64").toString("utf8")},"b64urlDecode"),ln=o(t=>t instanceof Error?t.message:String(t),"describe");var D4=o(t=>{if(typeof t!="string"||t.trim().length===0)throw new $e("invalid_uri","Authorization Request URI must be a non-empty string");let e=eAe(t),r=e.get("request_uri");if(typeof r=="string"&&r.length>0){if(!_ue(r))throw new $e("invalid_uri","request_uri must be an absolute https:// URL");return{kind:"by_reference_request_uri",requestUri:r,rawParams:e}}let i=e.get("request");return typeof i=="string"&&i.length>0?{kind:"by_reference_request_jwt",jwt:i,rawParams:e}:{kind:"by_value",request:tAe(e)}},"parseAuthorizationRequestUri"),yq=o(async(t,e=globalThis.fetch)=>{if(typeof e!="function")throw new $e("presentation_definition_fetch_failed","No fetch implementation available to resolve presentation_definition_uri");if(!_ue(t))throw new $e("invalid_uri","presentation_definition_uri must be an absolute https:// URL");let r;try{r=await e(t,{method:"GET"})}catch(n){throw new $e("presentation_definition_fetch_failed",`Failed to fetch presentation_definition_uri: ${aAe(n)}`,{cause:n})}if(!r.ok)throw new $e("presentation_definition_fetch_failed",`presentation_definition_uri returned ${r.status} ${r.statusText}`);let i;try{i=await r.json()}catch(n){throw new $e("invalid_json","presentation_definition_uri response was not valid JSON",{cause:n})}return yue(i)},"resolvePresentationDefinitionByReference"),I4=o(async(t,e=globalThis.fetch,r={})=>{let i=D4(t),n;if(i.kind==="by_value")n=i.request;else{let u=i.rawParams.get("client_id")??void 0,a=i.rawParams.get("client_id_scheme")??void 0,p=i.kind==="by_reference_request_uri",v=vue(i.rawParams.get("request_uri_method")),_=p&&v==="post"?Y6e():void 0;n=await DC({requestUri:p?i.requestUri:void 0,inlineJwt:i.kind==="by_reference_request_jwt"?i.jwt:void 0,requestUriMethod:v,walletNonce:_,urlClientId:u,urlClientIdScheme:a,fetchImpl:e,didResolver:r.didResolver,trustedX509Roots:r.trustedX509Roots,unsafeAllowSelfSigned:r.unsafeAllowSelfSigned,unsafeSkipRequestObjectSignatureVerification:r.unsafeSkipRequestObjectSignatureVerification})}if(n.presentation_definition)return n;if(n.presentation_definition_uri){let u=await yq(n.presentation_definition_uri,e);return{...n,presentation_definition:u}}return n},"resolveAuthorizationRequest"),Y6e=o(()=>{let t=globalThis.crypto;if(!t)throw new $e("invalid_uri","Web Crypto API not available to generate wallet_nonce");let e=new Uint8Array(16);t.getRandomValues(e);let r="";for(let i=0;i<e.length;i++)r+=e[i].toString(16).padStart(2,"0");return r},"randomWalletNonce"),eAe=o(t=>{let e=t.indexOf("?");if(e!==-1)return new URLSearchParams(t.slice(e+1));if(t.includes("://")||/^[a-z][a-z0-9+.-]*:/i.test(t))throw new $e("invalid_uri","Authorization Request URI has no query string");if(t.includes("="))return new URLSearchParams(t);throw new $e("invalid_uri","Authorization Request URI has no query string")},"extractSearchParams"),tAe=o(t=>{let e=t.get("client_id");if(!e)throw new $e("missing_client_id","Authorization Request is missing client_id");let r=t.get("nonce");if(!r)throw new $e("missing_nonce","Authorization Request is missing nonce");let i=t.get("response_type");if(!i)throw new $e("missing_response_type","Authorization Request is missing response_type");let n=i.split(/\s+/).filter(Boolean),u=new Set(["vp_token","id_token"]);if(!n.some(ke=>u.has(ke)))throw new $e("unsupported_response_type",`Authorization Request response_type "${i}" is not supported (expected vp_token and/or id_token)`);let a=t.get("response_uri")??void 0,p=t.get("redirect_uri")??void 0,v=t.get("response_mode")??void 0;if(!a&&!p)throw new $e("missing_response_target","Authorization Request is missing both response_uri and redirect_uri");let _=t.get("presentation_definition"),b=t.get("presentation_definition_uri"),l=t.get("dcql_query");if(_&&b)throw new $e("both_definition_and_uri","Authorization Request has both presentation_definition and presentation_definition_uri");if(l&&(_||b))throw new $e("both_pex_and_dcql","Authorization Request carries both PEX (presentation_definition[_uri]) and DCQL (dcql_query); OID4VP 1.0 \xA75.3 forbids this");let S;if(_){let ke;try{ke=JSON.parse(_)}catch(Ke){throw new $e("invalid_json","presentation_definition query parameter was not valid JSON",{cause:Ke})}S=yue(ke)}let x;if(l){let ke;try{ke=JSON.parse(l)}catch(Ke){throw new $e("invalid_json","dcql_query query parameter was not valid JSON",{cause:Ke})}x=Ca(ke)}let D=t.get("scope")??void 0;if(n.includes("vp_token")&&!S&&!b&&!x&&!D)throw new $e("missing_presentation_definition","Authorization Request has none of presentation_definition, presentation_definition_uri, dcql_query, or scope");let z=t.get("client_metadata"),G;if(z)try{let ke=JSON.parse(z);if(ke&&typeof ke=="object"&&!Array.isArray(ke))G=ke;else throw new $e("invalid_json","client_metadata query parameter must be a JSON object")}catch(ke){throw ke instanceof $e?ke:new $e("invalid_json","client_metadata query parameter was not valid JSON",{cause:ke})}let De=rAe(t.get("transaction_data")),we=nAe(t.get("verifier_info")),pe=vue(t.get("request_uri_method")),ue=new Set(["client_id","client_id_scheme","response_type","response_mode","response_uri","redirect_uri","nonce","state","presentation_definition","presentation_definition_uri","dcql_query","client_metadata","client_metadata_uri","scope","transaction_data","verifier_info","request_uri_method"]),et={};t.forEach((ke,Ke)=>{ue.has(Ke)||(et[Ke]=ke)});let tt=Ol(e,t.get("client_id_scheme")??void 0),St=oAe(tt,e,{responseUri:a,redirectUri:p});return{client_id:e,client_id_scheme:St,response_type:i,response_mode:v,response_uri:a,redirect_uri:p,nonce:r,state:t.get("state")??void 0,presentation_definition:S,presentation_definition_uri:b??void 0,dcql_query:x,client_metadata:G,client_metadata_uri:t.get("client_metadata_uri")??void 0,scope:D,transaction_data:De,verifier_info:we,request_uri_method:pe,...Object.keys(et).length>0?{extra:et}:{}}},"buildRequestFromParams"),rAe=o(t=>{if(t===null)return;let e;try{e=JSON.parse(t)}catch(r){throw new $e("invalid_transaction_data","transaction_data was not valid JSON",{cause:r})}if(!Array.isArray(e)||e.length===0||!e.every(r=>typeof r=="string"))throw new $e("invalid_transaction_data","transaction_data MUST be a non-empty array of base64url-encoded strings");return e},"parseTransactionData"),nAe=o(t=>{if(t===null)return;let e;try{e=JSON.parse(t)}catch(r){throw new $e("invalid_json","verifier_info was not valid JSON",{cause:r})}if(!Array.isArray(e))throw new $e("invalid_json","verifier_info MUST be a JSON array");return e},"parseVerifierInfo"),vue=o(t=>{if(t!==null){if(t!=="get"&&t!=="post")throw new $e("invalid_request_uri_method",`request_uri_method must be 'get' or 'post' (case-sensitive), got '${t}'`);return t}},"parseRequestUriMethod"),iAe=new Set(["did","x509_san_dns","x509_hash","verifier_attestation","https"]),oAe=o((t,e,r)=>{if(t.prefix==="https"&&t.inferred)return"pre-registered";if(iAe.has(t.prefix))throw new $e("invalid_client_id_scheme",`Unsigned Authorization Request uses client-id prefix "${t.prefix}", which requires a signed Request Object (OID4VP 1.0 \xA75.9); only redirect_uri and pre-registered are valid unsigned`);if(t.prefix==="redirect_uri"){let i=r.responseUri??r.redirectUri;if(e.startsWith("redirect_uri:")){if(t.value!==i)throw new $e("invalid_client_id_scheme",`redirect_uri client-id "${t.value}" does not equal the request's response target "${i}" (OID4VP 1.0 \xA75.9.1)`)}else if(i&&!uAe(t.value,i))throw new $e("invalid_client_id_scheme",`client_id_scheme=redirect_uri client-id "${t.value}" is not same-origin with the request's response target "${i}"`)}return t.prefix},"resolveUnsignedClientIdPrefix"),uAe=o((t,e)=>{try{return new URL(t).origin===new URL(e).origin}catch{return!1}},"isSameOrigin"),yue=o(t=>{if(!t||typeof t!="object"||Array.isArray(t))throw new $e("invalid_presentation_definition","presentation_definition must be a JSON object");let e=t;if(typeof e.id!="string"||e.id.length===0)throw new $e("invalid_presentation_definition","presentation_definition is missing a string `id`");if(!Array.isArray(e.input_descriptors)||e.input_descriptors.length===0)throw new $e("invalid_presentation_definition","presentation_definition must declare a non-empty input_descriptors array");for(let[r,i]of e.input_descriptors.entries()){if(!i||typeof i!="object")throw new $e("invalid_presentation_definition",`input_descriptors[${r}] must be an object`);let n=i;if(typeof n.id!="string"||n.id.length===0)throw new $e("invalid_presentation_definition",`input_descriptors[${r}].id must be a non-empty string`);if(!n.constraints||typeof n.constraints!="object")throw new $e("invalid_presentation_definition",`input_descriptors[${r}].constraints must be an object`)}return e},"validatePresentationDefinition"),_ue=o(t=>{try{return new URL(t).protocol==="https:"}catch{return!1}},"isHttpsUrl"),aAe=o(t=>t instanceof Error?t.message:String(t),"describe");var Mse=rH(Vse(),1);var WEe=512,Xq=o((t,e)=>{if(!Array.isArray(e.path)||e.path.length===0)return{matched:!1,reason:"Field has no `path[]` declared"};for(let r of e.path){let i;try{i=Qq(t,r)}catch(n){return{matched:!1,reason:`JSONPath "${r}" could not be evaluated: ${YEe(n)}`}}if(i.length!==0)for(let n of i){if(!e.filter)return{matched:!0,matchedPath:r,value:n};if(Rm(n,e.filter))return{matched:!0,matchedPath:r,value:n};if(Array.isArray(n)&&GEe(e.filter)){for(let u of n)if(Rm(u,e.filter))return{matched:!0,matchedPath:r,value:u}}}}return e.optional?{matched:!0,reason:"Field is optional and yielded no value"}:{matched:!1,reason:e.filter?`No value from paths ${JSON.stringify(e.path)} satisfied the filter`:`None of paths ${JSON.stringify(e.path)} resolved on the candidate`}},"evaluateField"),XC=o((t,e)=>{let i=e.constraints?.fields??[],n=[];for(let u of i){let a=Xq(t,u);if(n.push(a),!a.matched)return{matched:!1,descriptorId:e.id,fields:n,reason:a.reason}}return{matched:!0,descriptorId:e.id,fields:n}},"matchInputDescriptor"),Qq=o((t,e)=>{if(typeof e!="string"||e.length===0)throw new Error("JSONPath must be a non-empty string");if(e!=="$"&&!e.startsWith("$"))throw new Error(`JSONPath "${e}" must start with "$"`);if(/\[\?\(/.test(e))throw new Error(`JSONPath filter expressions are not supported yet (found in "${e}")`);if(/\[\s*\d+\s*:/.test(e)||/\[\s*:\s*\d+\s*\]/.test(e))throw new Error(`JSONPath array slicing is not supported yet (found in "${e}")`);let r=HEe(e),i=[t];for(let n of r){let u=[];for(let a of i)switch(n.kind){case"property":{let p=KEe(a,n.name);p!==void 0&&u.push(p);break}case"index":{Array.isArray(a)&&n.index<a.length&&u.push(a[n.index]);break}case"wildcard":{if(Array.isArray(a))for(let p of a)u.push(p);else if(a&&typeof a=="object")for(let p of Object.values(a))u.push(p);break}case"descendant":{Gq(a,n.name,u);break}}i=u}return i},"queryJsonPath"),KEe=o((t,e)=>{if(t!=null&&!Array.isArray(t)&&typeof t=="object")return t[e]},"getProperty"),Gq=o((t,e,r)=>{if(t!=null){if(Array.isArray(t)){for(let i of t)Gq(i,e,r);return}if(typeof t=="object"){let i=t;for(let[n,u]of Object.entries(i))n===e&&r.push(u),Gq(u,e,r)}}},"collectDescendants"),HEe=o(t=>{let e=[],r=t.startsWith("$")?1:0;for(;r<t.length;){let i=t[r];if(i===".")if(t[r+1]==="."){r+=2;let n=qse(t,r);if(!n.text)throw new Error(`Recursive descent ".." at position ${r} must be followed by a property name`);e.push({kind:"descendant",name:n.text}),r=n.next}else{if(r+=1,t[r]==="*"){e.push({kind:"wildcard"}),r+=1;continue}let n=qse(t,r);if(!n.text)throw new Error(`Property accessor "." at position ${r} must be followed by an identifier`);e.push({kind:"property",name:n.text}),r=n.next}else if(i==="["){let n=t.indexOf("]",r+1);if(n===-1)throw new Error(`Unterminated "[" in JSONPath "${t}"`);let u=t.slice(r+1,n).trim();if(u==="*")e.push({kind:"wildcard"});else if(/^-?\d+$/.test(u))e.push({kind:"index",index:parseInt(u,10)});else if(/^'[^']*'$/.test(u)||/^"[^"]*"$/.test(u))e.push({kind:"property",name:u.slice(1,-1)});else throw new Error(`Unsupported bracket expression [${u}] in JSONPath "${t}"`);r=n+1}else throw new Error(`Unexpected character "${i}" at position ${r} in JSONPath "${t}"`)}return e},"tokenizeJsonPath"),qse=o((t,e)=>{let r=e;for(;r<t.length;){let i=t[r];if(!/[A-Za-z0-9_\-@:]/.test(i))break;r+=1}return{text:t.slice(e,r),next:r}},"readIdentifier"),Rm=o((t,e)=>{if("type"in e&&!(Array.isArray(e.type)?e.type:[e.type]).some(n=>QEe(t,n))||"const"in e&&!GC(t,e.const))return!1;if("enum"in e){let r=e.enum;if(!Array.isArray(r)||!r.some(i=>GC(t,i)))return!1}if("pattern"in e){if(typeof t!="string")return!1;let r=e.pattern;if(typeof r!="string"||r.length>WEe||!(0,Mse.default)(r))return!1;let i;try{i=new RegExp(r)}catch{return!1}try{if(!i.test(t))return!1}catch{return!1}}if(typeof t=="number"&&(typeof e.minimum=="number"&&t<e.minimum||typeof e.maximum=="number"&&t>e.maximum||typeof e.exclusiveMinimum=="number"&&t<=e.exclusiveMinimum||typeof e.exclusiveMaximum=="number"&&t>=e.exclusiveMaximum)||typeof t=="string"&&(typeof e.minLength=="number"&&t.length<e.minLength||typeof e.maxLength=="number"&&t.length>e.maxLength))return!1;if(Array.isArray(t)){if(e.contains&&typeof e.contains=="object"){let r=e.contains;if(!t.some(n=>Rm(n,r)))return!1}if(e.items&&typeof e.items=="object"&&!Array.isArray(e.items)){let r=e.items;if(!t.every(n=>Rm(n,r)))return!1}if(typeof e.minItems=="number"&&t.length<e.minItems||typeof e.maxItems=="number"&&t.length>e.maxItems)return!1}return!0},"satisfiesFilter"),GEe=o(t=>{if(Lse(t,["contains","items","minItems","maxItems"]))return!1;if("type"in t){let e=Array.isArray(t.type)?t.type:[t.type];return e.length===0?!1:e.every(r=>typeof r=="string"&&XEe.has(r))}return Lse(t,["pattern","minLength","maxLength","minimum","maximum","exclusiveMinimum","exclusiveMaximum"])||"const"in t&&Zse(t.const)?!0:"enum"in t&&Array.isArray(t.enum)&&t.enum.length>0?t.enum.every(Zse):!1},"expectsPrimitive"),XEe=new Set(["string","number","integer","boolean","null"]),Zse=o(t=>t===null||typeof t=="string"||typeof t=="number"||typeof t=="boolean","isPrimitiveValue"),Lse=o((t,e)=>e.some(r=>r in t),"hasAnyKeyword"),QEe=o((t,e)=>{switch(e){case"string":return typeof t=="string";case"number":return typeof t=="number";case"integer":return typeof t=="number"&&Number.isInteger(t);case"boolean":return typeof t=="boolean";case"null":return t===null;case"array":return Array.isArray(t);case"object":return t!==null&&typeof t=="object"&&!Array.isArray(t);default:return!1}},"matchesType"),GC=o((t,e)=>{if(t===e)return!0;if(t===null||e===null)return t===e;if(typeof t!=typeof e)return!1;if(Array.isArray(t)){if(!Array.isArray(e)||t.length!==e.length)return!1;for(let r=0;r<t.length;r++)if(!GC(t[r],e[r]))return!1;return!0}if(typeof t=="object"){if(typeof e!="object"||Array.isArray(e))return!1;let r=t,i=e,n=Object.keys(r),u=Object.keys(i);if(n.length!==u.length)return!1;for(let a of n)if(!GC(r[a],i[a]))return!1;return!0}return!1},"deepEqual"),YEe=o(t=>t instanceof Error?t.message:String(t),"describe");var QC=o(async(t,e,r={})=>{let i=t.map((v,_)=>({index:_,candidate:{...v,format:v.format??N4(v.credential)}})),n=await Promise.all(i.map(async v=>({...v,decoded:await rSe(v.candidate,r.sdJwtParser)}))),u=e.input_descriptors.map(v=>{let _=[],b=v.format??e.format;for(let l of n){let{candidate:S,index:x,decoded:D}=l;if(b&&!tSe(S.format,b))continue;let E=XC(D,v);E.matched&&_.push({descriptorId:v.id,candidate:S,match:E,candidateIndex:x})}return{descriptorId:v.id,candidates:_,reason:_.length===0?oSe(v,i.length,b):void 0}}),a=new Set(u.filter(v=>v.candidates.length>0).map(v=>v.descriptorId)),p=eSe(e,a);return{descriptors:u,canSatisfy:p.satisfied,reason:p.satisfied?void 0:p.reason}},"selectCredentials"),Kse=o((t,e,r={})=>{let i=r.makeId??uSe;return{id:r.submissionId??i(),definition_id:t.id,descriptor_map:e.map(n=>{let u={id:n.descriptorId,format:n.format,path:n.path};return n.pathNested&&(u.path_nested={id:n.descriptorId,format:n.format,path:n.pathNested}),u})}},"buildPresentationSubmission"),N4=o(t=>{if(typeof t=="string")return/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+~/.test(t)?"dc+sd-jwt":/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(t)?"jwt_vc_json":void 0;if(!t||typeof t!="object")return;let r=t.proof,i=(Array.isArray(r)?r:r?[r]:[]).filter(a=>!!a&&typeof a=="object");if(i.find(a=>a.type==="SdJwtCompactProof"&&typeof a.jwt=="string"))return"dc+sd-jwt";let u=i[0];if(u){if(typeof u.jwt=="string"||u.type==="JwtProof2020")return"jwt_vc_json";if(typeof u.type=="string")return"ldp_vc"}},"inferCredentialFormat"),eSe=o((t,e)=>{let r=t.submission_requirements;if(!r||r.length===0){let i=t.input_descriptors.map(n=>n.id).filter(n=>!e.has(n));return i.length===0?{satisfied:!0}:{satisfied:!1,reason:i.length===1?`Input descriptor "${i[0]}" has no matching credential`:`${i.length} input descriptors have no matching credential: ${i.join(", ")}`}}for(let i of r){let n=Hse(i,t,e);if(!n.satisfied)return n}return{satisfied:!0}},"evaluateSubmissionRequirements"),Hse=o((t,e,r)=>{if(typeof t.from=="string"&&t.from.length>0){let i=e.input_descriptors.filter(u=>u.group?.includes(t.from));if(i.length===0)return{satisfied:!1,reason:`submission_requirement references unknown group "${t.from}"`};let n=i.filter(u=>r.has(u.id));return Jse(t,n.length,i.length)}if(Array.isArray(t.from_nested)&&t.from_nested.length>0){let i=0;for(let n of t.from_nested)Hse(n,e,r).satisfied&&(i+=1);return Jse(t,i,t.from_nested.length)}return{satisfied:!1,reason:"submission_requirement has neither `from` nor `from_nested`"}},"evaluateRequirement"),Jse=o((t,e,r)=>{let i=t.name??t.from??"<anonymous>";return t.rule==="all"?e>=r?{satisfied:!0}:{satisfied:!1,reason:`Requirement "${i}" (rule=all) needs ${r} matches, only ${e} available`}:t.rule==="pick"?typeof t.count=="number"&&e<t.count?{satisfied:!1,reason:`Requirement "${i}" (rule=pick) needs count=${t.count} matches, only ${e} available`}:typeof t.min=="number"&&e<t.min?{satisfied:!1,reason:`Requirement "${i}" (rule=pick) needs min=${t.min} matches, only ${e} available`}:t.count===void 0&&t.min===void 0&&e===0?{satisfied:!1,reason:`Requirement "${i}" (rule=pick) needs at least one match, none available`}:{satisfied:!0}:{satisfied:!1,reason:`Unknown submission_requirement rule "${t.rule}"`}},"applyRule"),tSe=o((t,e)=>t?Object.prototype.hasOwnProperty.call(e,t):!1,"formatIsPermitted"),rSe=o(async(t,e)=>{let{credential:r,format:i}=t;if(i==="jwt_vc_json"){if(typeof r=="string"){let n=Wse(r);if(n)return n}if(r&&typeof r=="object"){let n=r.proof;if(n&&typeof n=="object"){let u=n.jwt;if(typeof u=="string"){let a=Wse(u);if(a)return a}}}}if(i==="dc+sd-jwt"||i==="vc+sd-jwt"){if(!e)return r;let n=nSe(r);if(!n)return r;try{return(await e(n)).claims}catch{return r}}return r},"decodeCandidateForMatching"),nSe=o(t=>{if(typeof t=="string")return/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+~/.test(t)?t:void 0;if(t&&typeof t=="object"){let e=t.proof,i=(Array.isArray(e)?e:e?[e]:[]).find(n=>n&&typeof n=="object"&&n.type==="SdJwtCompactProof"&&typeof n.jwt=="string");if(i)return i.jwt}},"extractSdJwtCompact"),Wse=o(t=>{let e=t.split(".");if(e.length===3)try{return JSON.parse(iSe(e[1]))}catch{return}},"decodeJwtVc"),iSe=o(t=>{let r=(t+"=".repeat((4-t.length%4)%4)).replace(/-/g,"+").replace(/_/g,"/");return typeof atob=="function"?atob(r):Buffer.from(r,"base64").toString("binary")},"base64UrlDecode"),oSe=o((t,e,r)=>{if(e===0)return"You have no credentials in your wallet yet";let i=t.name??t.id;if(r){let n=Object.keys(r).join(", ");return`No credential satisfies "${i}" (required format: ${n})`}return`No credential satisfies "${i}"`},"explainNoMatches"),uSe=o(()=>{let t=typeof globalThis<"u"&&"crypto"in globalThis?globalThis.crypto:void 0;if(t&&typeof t.getRandomValues=="function"){let e=new Uint8Array(8);return t.getRandomValues(e),Array.from(e,r=>r.toString(16).padStart(2,"0")).join("")}return Math.random().toString(36).slice(2,18)},"defaultMakeId");var aSe="https://www.w3.org/2018/credentials/v1",sSe="https://www.w3.org/ns/credentials/v2",YC=o(t=>t.some(r=>{if(!r||typeof r!="object")return!1;let i=r["@context"];return(Array.isArray(i)?i:[i]).some(u=>typeof u=="string"&&u.includes("/ns/credentials/v2"))})?sSe:aSe,"vpBaseContextFor");var Yq=class Yq extends Error{constructor(e,r){super(r),this.name="BuildPresentationError",this.code=e}};o(Yq,"BuildPresentationError");var Ui=Yq,R4=o(t=>{let{pd:e,chosen:r,holder:i}=t;if(!r||r.length===0)throw new Ui("no_selections","buildPresentation requires at least one chosen credential");let n=new Set(e.input_descriptors.map(l=>l.id)),u=r.map((l,S)=>{if(!n.has(l.descriptorId))throw new Ui("unknown_descriptor",`Chosen credential at index ${S} references unknown descriptor "${l.descriptorId}"`);return{descriptorId:l.descriptorId,...lSe(l.candidate,S)}}),a=u.filter(l=>cSe(l.format)).length;if(a>0&&a!==u.length)throw new Ui("unknown_credential_format",`Mixed SD-JWT-VC + W3C-VC selections are not supported in a single PEX submission (got ${a} SD-JWT and ${u.length-a} non-SD-JWT). Submit them as separate presentations or use DCQL.`);if(a>0){if(u.length>1)throw new Ui("unknown_credential_format","PEX submission with multiple SD-JWT-VCs is not yet supported (Slice 3 supports exactly one SD-JWT per PEX submission; multi-credential SD-JWT presentations are a follow-up)");return dSe(t,u[0],i,r[0].disclose)}let p=t.envelopeFormat??mSe(e,u.map(l=>l.format)),v=t.makeId??Gse,_={"@context":[YC(u.map(l=>l.credential))],id:t.presentationId??`urn:uuid:${Xse(v)}`,type:["VerifiablePresentation"],holder:i,verifiableCredential:u.map(l=>l.credential)},b={id:t.submissionId??v(),definition_id:e.id,descriptor_map:u.map((l,S)=>({id:l.descriptorId,format:l.format,path:vSe(S,p)}))};return{unsignedVp:_,submission:b,vpFormat:p,innerFormats:u.map(l=>l.format)}},"buildPresentation"),cSe=o(t=>t==="dc+sd-jwt"||t==="vc+sd-jwt","isSdJwtFormat"),dSe=o((t,e,r,i)=>{let n=typeof e.credential=="string"?e.credential:void 0;if(!n)throw new Ui("invalid_jwt_vc",`SD-JWT-VC candidate for descriptor "${e.descriptorId}" did not normalize to a compact string`);let u=e.format,a=t.makeId??Gse,p={"@context":["https://www.w3.org/2018/credentials/v1"],id:t.presentationId??`urn:uuid:${Xse(a)}`,type:["VerifiablePresentation"],holder:r,verifiableCredential:[]},v={id:t.submissionId??a(),definition_id:t.pd.id,descriptor_map:[{id:e.descriptorId,format:e.format,path:"$"}]};return{unsignedVp:p,submission:v,vpFormat:u,innerFormats:[e.format],sdJwtSource:i?{compact:n,disclose:i}:{compact:n}}},"buildSdJwtPexPassthrough"),lSe=o((t,e)=>{let r=t.format??N4(t.credential);if(!r)throw new Ui("unknown_credential_format",`Chosen credential at index ${e} has no detectable format (provide candidate.format or a shape inferCredentialFormat recognizes)`);if(r==="jwt_vc_json"){let i=pSe(t.credential);if(!i)throw new Ui("invalid_jwt_vc",`Chosen credential at index ${e} is tagged jwt_vc_json but has no compact JWS (expected a string, or an object with string \`proof.jwt\`)`);return{credential:i,format:r}}if(r==="dc+sd-jwt"||r==="vc+sd-jwt"){let i=fSe(t.credential);if(!i)throw new Ui("invalid_jwt_vc",`Chosen credential at index ${e} is tagged ${r} but has no compact SD-JWT form (expected a string with disclosure separators, or an object with proof.type="SdJwtCompactProof" and string proof.jwt)`);return{credential:i,format:r}}return{credential:t.credential,format:r}},"normalizeForEmbedding"),fSe=o(t=>{if(typeof t=="string")return/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+~/.test(t)?t:void 0;if(t&&typeof t=="object"){let e=t.proof,i=(Array.isArray(e)?e:e?[e]:[]).find(n=>n&&typeof n=="object"&&n.type==="SdJwtCompactProof"&&typeof n.jwt=="string");if(i)return i.jwt}},"extractSdJwtCompactFromCandidate"),pSe=o(t=>{if(typeof t=="string")return/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(t)?t:void 0;if(t&&typeof t=="object"){let e=t.proof;if(e&&typeof e=="object"){let r=e.jwt;if(typeof r=="string")return r}}},"extractCompactJws"),mSe=o((t,e)=>{let r=gSe(t.format),i=hSe(e);return r.has("jwt_vp_json")&&!r.has("ldp_vp")?"jwt_vp_json":r.has("ldp_vp")&&!r.has("jwt_vp_json")?"ldp_vp":(r.has("jwt_vp_json")&&r.has("ldp_vp"),i)},"inferEnvelopeFormat"),gSe=o(t=>{let e=new Set;return t&&("jwt_vp_json"in t&&e.add("jwt_vp_json"),"ldp_vp"in t&&e.add("ldp_vp")),e},"vpFormatsFromDesignation"),hSe=o(t=>t.length===0?"ldp_vp":t.every(r=>r==="jwt_vc_json")?"jwt_vp_json":"ldp_vp","homogeneousVpFormatFromInner"),vSe=o((t,e)=>e==="jwt_vp_json"?`$.vp.verifiableCredential[${t}]`:`$.verifiableCredential[${t}]`,"pathForIndex"),Gse=o(()=>{let t=typeof globalThis<"u"&&"crypto"in globalThis?globalThis.crypto:void 0;if(t&&typeof t.getRandomValues=="function"){let e=new Uint8Array(8);return t.getRandomValues(e),Array.from(e,r=>r.toString(16).padStart(2,"0")).join("")}return Math.random().toString(36).slice(2,18)},"defaultMakeId"),Xse=o(t=>{let r=(t().replace(/[^0-9a-f]/gi,"")+"0".repeat(32)).slice(0,32);return[r.slice(0,8),r.slice(8,12),"4"+r.slice(13,16),(parseInt(r.charAt(16),16)&3|8).toString(16)+r.slice(17,20),r.slice(20,32)].join("-")},"makeUuidV4");var eZ=class eZ extends Error{constructor(e,r,i){super(r),this.name="VpSignError",this.code=e,i?.cause!==void 0&&(this.cause=i.cause)}};o(eZ,"VpSignError");var qr=eZ,Lu=o(async(t,e)=>t.vpFormat==="dc+sd-jwt"||t.vpFormat==="vc+sd-jwt"?ySe(t,e):(_Se(t),t.vpFormat==="jwt_vp_json"?bSe(t,e):ASe(t,e)),"signPresentation"),ySe=o(async(t,e)=>{if(typeof t.audience!="string"||t.audience.length===0)throw new qr("invalid_input","signPresentation requires a non-empty `audience`");if(typeof t.nonce!="string"||t.nonce.length===0)throw new qr("invalid_input","signPresentation requires a non-empty `nonce`");if(!t.sdJwtSource||typeof t.sdJwtSource.compact!="string")throw new qr("missing_sd_jwt_source",`vpFormat=${t.vpFormat} requires options.sdJwtSource.compact (set by buildPresentation when the chosen credential is an SD-JWT-VC)`);if(!e.sdJwtPresenter)throw new qr("missing_sd_jwt_presenter",`vpFormat=${t.vpFormat} requires helpers.sdJwtPresenter`);let r;try{r=await e.sdJwtPresenter(t.sdJwtSource.compact,{audience:t.audience,nonce:t.nonce,disclose:t.sdJwtSource.disclose})}catch(i){throw new qr("sd_jwt_present_failed",`Failed to build SD-JWT-VC presentation: ${i instanceof Error?i.message:String(i)}`,{cause:i})}return{vpToken:r.compact,vpFormat:t.vpFormat}},"presentSdJwt"),_Se=o(t=>{let{unsignedVp:e,holder:r,audience:i,nonce:n}=t;if(!e||typeof e!="object")throw new qr("invalid_input","signPresentation requires an unsignedVp object");if(typeof i!="string"||i.length===0)throw new qr("invalid_input","signPresentation requires a non-empty `audience`");if(typeof n!="string"||n.length===0)throw new qr("invalid_input","signPresentation requires a non-empty `nonce`");if(typeof r!="string"||r.length===0)throw new qr("invalid_input","signPresentation requires a non-empty `holder`");if(e.holder!==void 0&&e.holder!==r)throw new qr("holder_mismatch",`unsignedVp.holder (${e.holder}) does not match options.holder (${r})`)},"validateInput"),bSe=o(async(t,e)=>{if(!e.jwtSigner)throw new qr("missing_jwt_signer","vpFormat=jwt_vp_json requires helpers.jwtSigner");let r=t.iat??Math.floor(Date.now()/1e3),i={alg:e.jwtSigner.alg,kid:e.jwtSigner.kid,typ:"JWT"},n=t.jti??(typeof t.unsignedVp.id=="string"?t.unsignedVp.id:void 0),u={iss:t.holder,sub:t.holder,aud:t.audience,nonce:t.nonce,iat:r,vp:t.unsignedVp};n&&(u.jti=n);let a;try{a=await e.jwtSigner.sign(i,u)}catch(p){throw new qr("jwt_sign_failed",`Failed to sign jwt_vp_json: ${p instanceof Error?p.message:String(p)}`,{cause:p})}return{vpToken:a,vpFormat:"jwt_vp_json"}},"signJwtVp"),ASe=o(async(t,e)=>{if(!e.ldpVpSigner)throw new qr("missing_ldp_signer","vpFormat=ldp_vp requires helpers.ldpVpSigner");let r;try{r=await e.ldpVpSigner.sign(t.unsignedVp,{domain:t.audience,challenge:t.nonce})}catch(i){throw new qr("ldp_sign_failed",`Failed to sign ldp_vp: ${i instanceof Error?i.message:String(i)}`,{cause:i})}return{vpToken:r,vpFormat:"ldp_vp"}},"signLdpVp");var nZ=class nZ extends Error{constructor(e,r,i={}){super(r),this.name="JarmEncryptError",this.code=e,i.cause!==void 0&&(this.cause=i.cause)}};o(nZ,"JarmEncryptError");var Zr=nZ,tZ="ECDH-ES",rZ="A128GCM",e5=o(async t=>{let{payload:e,clientMetadata:r,verifierNonce:i,walletNonce:n,signer:u}=t,a=SSe(r.encrypted_response_enc_values_supported)??r.authorization_encrypted_response_enc??rZ,p=r.authorization_signed_response_alg,v=await wSe(r,t.fetchImpl),_=r.authorization_encrypted_response_alg,b=xSe(v,_),l=typeof b.alg=="string"&&b.alg.length>0?b.alg:_??tZ,S,x;if(p){if(!u)throw new Zr("missing_signer",`Verifier requires authorization_signed_response_alg=${p} but no wallet signer was supplied`);let G=await CSe(e,p,u);S=new TextEncoder().encode(G),x="JWT"}else S=new TextEncoder().encode(JSON.stringify(e)),x=void 0;let D;try{D=await Mi(b,l)}catch(G){throw new Zr("unsupported_alg",`Failed to import verifier encryption key (alg=${l}, kty=${b.kty}): ${F4(G)}`,{cause:G})}let E={alg:l,enc:a};typeof b.kid=="string"&&b.kid.length>0&&(E.kid=b.kid),x&&(E.cty=x);let z={apv:new TextEncoder().encode(i)};typeof n=="string"&&n.length>0&&(z.apu=new TextEncoder().encode(n));try{return await new vh(S).setProtectedHeader(E).setKeyManagementParameters(z).encrypt(D)}catch(G){throw new Zr("encrypt_failed",`JWE encryption failed (alg=${l}, enc=${a}): ${F4(G)}`,{cause:G})}},"encryptResponseObject"),wSe=o(async(t,e)=>{if(t.jwks&&Array.isArray(t.jwks.keys))return t.jwks.keys;if(typeof t.jwks_uri=="string"&&t.jwks_uri.length>0){let r=e??globalThis.fetch;if(typeof r!="function")throw new Zr("jwks_fetch_failed",`client_metadata.jwks_uri=${t.jwks_uri} but no fetch implementation is available`);let i;try{i=await r(t.jwks_uri,{headers:{Accept:"application/json"}})}catch(u){throw new Zr("jwks_fetch_failed",`Failed to fetch jwks_uri=${t.jwks_uri}: ${F4(u)}`,{cause:u})}if(!i.ok)throw new Zr("jwks_fetch_failed",`jwks_uri returned HTTP ${i.status} for ${t.jwks_uri}`);let n;try{n=await i.json()}catch(u){throw new Zr("invalid_jwks",`jwks_uri body was not valid JSON: ${F4(u)}`,{cause:u})}if(!n||typeof n!="object"||!Array.isArray(n.keys))throw new Zr("invalid_jwks","jwks_uri body must be a JSON object with a `keys` array");return n.keys}throw new Zr("no_encryption_key","client_metadata declares neither inline `jwks` nor `jwks_uri` \u2014 verifier cannot receive encrypted responses")},"resolveVerifierJwks"),ESe=new Set(["A128GCM","A192GCM","A256GCM","A128CBC-HS256","A192CBC-HS384","A256CBC-HS512"]),SSe=o(t=>{if(!Array.isArray(t))return;let e=t.filter(r=>typeof r=="string"&&r.length>0);return e.find(r=>ESe.has(r))??e[0]},"pickSupportedEnc"),xSe=o((t,e)=>{if(t.length===0)throw new Zr("no_encryption_key","Verifier JWKS contained no keys");let r=t.filter(n=>n.use!=="sig");if(r.length===0)throw new Zr("no_encryption_key",'Verifier JWKS contains only `use:"sig"` keys; no encryption-capable key advertised');if(e){let n=r.find(u=>u.alg===e);if(n)return n}let i=r.find(n=>typeof n.alg=="string"&&n.alg.length>0);return i||r[0]},"pickEncryptionKey"),CSe=o(async(t,e,r)=>{try{return await r.sign({alg:e,kid:r.kid,typ:"JWT"},t)}catch(i){throw new Zr("sign_failed",`Wallet signer failed during JARM inner-JWS signing: ${F4(i)}`,{cause:i})}},"signResponse"),F4=o(t=>t instanceof Error?t.message:String(t),"describe");var iZ=class iZ extends Error{constructor(e,r,i={}){super(r),this.name="VpSubmitError",this.code=e,this.status=i.status,this.body=i.body,i.cause!==void 0&&(this.cause=i.cause)}};o(iZ,"VpSubmitError");var yi=iZ,Fm=o(async t=>{let{responseUri:e,vpToken:r,submission:i,state:n}=t;if(typeof e!="string"||e.length===0)throw new yi("invalid_input","`responseUri` must be a non-empty string");if(r==null)throw new yi("invalid_input","`vpToken` is required");if(i!==void 0&&(i===null||typeof i!="object"))throw new yi("invalid_input","`submission` must be a PresentationSubmission object when provided (omit it entirely for DCQL flows)");let u=t.fetchImpl??globalThis.fetch;if(typeof u!="function")throw new yi("no_fetch","No fetch implementation available; pass `fetchImpl` or configure the plugin with one");let p=t.responseMode==="direct_post.jwt"?await DSe({vpToken:r,submission:i,state:n,idToken:t.idToken,clientMetadata:t.clientMetadata,nonce:t.nonce,signer:t.signer,fetchImpl:u}):kSe({vpToken:r,submission:i,state:n,idToken:t.idToken}),v;try{v=await u(e,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json, text/plain;q=0.9, */*;q=0.8"},body:p})}catch(b){throw new yi("network_error",`Failed to POST to ${e}: ${b instanceof Error?b.message:String(b)}`,{cause:b})}let _=await ISe(v);if(!v.ok)throw new yi("server_error",`Verifier returned ${v.status} ${v.statusText||""}`.trim(),{status:v.status,body:_});return{status:v.status,redirectUri:PSe(_),body:_}},"submitPresentation"),kSe=o(t=>{let e=new URLSearchParams;return e.set("vp_token",$Se(t.vpToken)),t.submission&&e.set("presentation_submission",JSON.stringify(t.submission)),typeof t.idToken=="string"&&t.idToken.length>0&&e.set("id_token",t.idToken),typeof t.state=="string"&&t.state.length>0&&e.set("state",t.state),e.toString()},"encodeFormBody"),$Se=o(t=>typeof t=="string"?t:JSON.stringify(t),"stringifyVpToken"),DSe=o(async t=>{if(!t.clientMetadata)throw new yi("invalid_input","response_mode=direct_post.jwt requires `clientMetadata` (verifier's JWKS + JWE algs)");if(typeof t.nonce!="string"||t.nonce.length===0)throw new yi("invalid_input","response_mode=direct_post.jwt requires the verifier `nonce` for the JWE `apv` ECDH-ES KDF input");let e={vp_token:t.vpToken};t.submission&&(e.presentation_submission=t.submission),typeof t.state=="string"&&t.state.length>0&&(e.state=t.state),typeof t.idToken=="string"&&t.idToken.length>0&&(e.id_token=t.idToken);let r;try{r=await e5({payload:e,clientMetadata:t.clientMetadata,verifierNonce:t.nonce,signer:t.signer,fetchImpl:t.fetchImpl})}catch(n){throw n instanceof Zr?new yi("jarm_encrypt_failed",`Failed to build JARM response (${n.code}): ${n.message}`,{cause:n}):n}let i=new URLSearchParams;return i.set("response",r),i.toString()},"encodeJarmBody"),ISe=o(async t=>{let e=await t.text().catch(()=>"");if(!e)return;if((t.headers.get("content-type")??"").includes("application/json"))try{return JSON.parse(e)}catch{return e}try{return JSON.parse(e)}catch{return e}},"parseResponseBody"),PSe=o(t=>{if(t&&typeof t=="object"){let e=t.redirect_uri;if(typeof e=="string"&&e.length>0)return e}},"extractRedirectUri");var uZ=class uZ extends Error{constructor(e,r,i){super(r),this.name="SiopSignError",this.code=e,i?.cause!==void 0&&(this.cause=i.cause)}};o(uZ,"SiopSignError");var Mu=uZ,U4=o(async(t,e)=>{BSe(t,e);let{holder:r,audience:i,nonce:n}=t,u=t.iat??Math.floor(Date.now()/1e3),a=u+(t.lifetimeSeconds??300),p=t.issuerMode??"did",v={alg:e.signer.alg,kid:e.signer.kid,typ:"JWT"},_={iss:p==="did"?r:"https://self-issued.me/v2",sub:r,aud:i,nonce:n,iat:u,exp:a};t.vpTokenHash&&(_._vp_token={vp_token_hash:t.vpTokenHash});let b;try{b=await e.signer.sign(v,_)}catch(l){throw new Mu("id_token_sign_failed",`Failed to sign SIOPv2 id_token: ${l instanceof Error?l.message:String(l)}`,{cause:l})}return{idToken:b}},"signIdToken"),BSe=o((t,e)=>{if(!e.signer)throw new Mu("missing_signer","signIdToken requires helpers.signer");if(typeof t.holder!="string"||t.holder.length===0)throw new Mu("invalid_input","signIdToken requires a non-empty `holder`");if(typeof t.audience!="string"||t.audience.length===0)throw new Mu("invalid_input","signIdToken requires a non-empty `audience`");if(typeof t.nonce!="string"||t.nonce.length===0)throw new Mu("invalid_input","signIdToken requires a non-empty `nonce`")},"validateInput"),oZ=o(t=>t?new Set(t.split(/\s+/).filter(Boolean)):new Set,"responseTypeSet"),t5=o(t=>oZ(t).has("id_token"),"requiresIdToken");var aZ=o(async(t,e={})=>{let r=t.format??FSe(t.credential);if(r==="jwt_vc_json")return OSe(t.credential);if(r==="ldp_vc")return zSe(t.credential);if(r==="dc+sd-jwt"||r==="vc+sd-jwt")return jSe(t.credential,r,e.sdJwtParser)},"adaptCredentialForDcql"),r5=o(async(t,e={})=>(await Promise.all(t.map(async i=>({original:i,adapted:await aZ(i,e)})))).filter(i=>i.adapted!==void 0),"adaptCredentialsForDcql"),jSe=o(async(t,e,r)=>{if(!r)return;let i=TSe(t);if(!i)return;let n;try{n=await r(i)}catch{return}let u=typeof n.vct=="string"&&n.vct.length>0?n.vct:typeof n.claims.vct=="string"?n.claims.vct:void 0;if(u)return{credential_format:e,vct:u,claims:n.claims,cryptographic_holder_binding:!!n.holderPublicKey}},"adaptSdJwt"),TSe=o(t=>{if(typeof t=="string")return/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+~/.test(t)?t:void 0;if(t&&typeof t=="object"){let e=t.proof,i=(Array.isArray(e)?e:e?[e]:[]).find(n=>n&&typeof n=="object"&&n.type==="SdJwtCompactProof"&&typeof n.jwt=="string");if(i)return i.jwt}},"extractSdJwtCompact"),OSe=o(t=>{let e;if(typeof t=="string")e=Qse(t);else if(t&&typeof t=="object"){let u=t.proof;if(u&&typeof u=="object"){let a=u.jwt;typeof a=="string"&&(e=Qse(a))}}if(!e)return;let r=e.vc;if(!r||typeof r!="object"||Array.isArray(r))return;let i=r,n=Yse(i.type);if(n.length!==0)return{credential_format:"jwt_vc_json",type:n,claims:i,cryptographic_holder_binding:!0}},"adaptJwtVc"),zSe=o(t=>{if(!t||typeof t!="object"||Array.isArray(t))return;let e=t,r=Yse(e.type);if(r.length!==0)return{credential_format:"ldp_vc",type:RSe(r),claims:e,cryptographic_holder_binding:!0}},"adaptLdpVc"),Yse=o(t=>Array.isArray(t)?t.filter(e=>typeof e=="string"):typeof t=="string"?[t]:[],"extractTypes"),NSe={VerifiableCredential:"https://www.w3.org/2018/credentials#VerifiableCredential",VerifiablePresentation:"https://www.w3.org/2018/credentials#VerifiablePresentation",OpenBadgeCredential:"https://purl.imsglobal.org/spec/vc/ob/vocab.html#OpenBadgeCredential",AchievementCredential:"https://purl.imsglobal.org/spec/vc/ob/vocab.html#AchievementCredential",ClrCredential:"https://purl.imsglobal.org/spec/vc/clr/vocab.html#ClrCredential"},RSe=o(t=>{let e=t.map(r=>NSe[r]).filter(r=>!!r&&!t.includes(r));return e.length>0?[...t,...e]:t},"withExpandedTypeIris"),FSe=o(t=>{if(typeof t=="string")return/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+~/.test(t)?"dc+sd-jwt":/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(t)?"jwt_vc_json":void 0;if(t&&typeof t=="object"&&!Array.isArray(t)){let e=t.proof,r=(Array.isArray(e)?e:e?[e]:[]).filter(u=>!!u&&typeof u=="object");if(r.find(u=>u.type==="SdJwtCompactProof"))return"dc+sd-jwt";let n=r[0];if(n)return n.type==="JwtProof2020"?"jwt_vc_json":"ldp_vc"}},"inferDcqlFormat"),Qse=o(t=>{let e=t.split(".");if(e.length===3)try{let r=JSON.parse(USe(e[1]));return r&&typeof r=="object"&&!Array.isArray(r)?r:void 0}catch{return}},"decodeJwtPayload"),USe=o(t=>{let r=(t+"=".repeat((4-t.length%4)%4)).replace(/-/g,"+").replace(/_/g,"/");return typeof atob=="function"?atob(r):Buffer.from(r,"base64").toString("binary")},"base64UrlDecode");var n5=o(async(t,e,r={})=>{let i=await r5(t,{sdJwtParser:r.sdJwtParser}),n=i.map(p=>p.adapted),u=Us.query(e,n),a={};for(let[p,v]of Object.entries(u.credential_matches)){if(v.success){let _=v.valid_credentials.map(b=>i[b.input_credential_index]?.original).filter(b=>b!==void 0);a[p]={credentialQueryId:p,candidates:_};continue}a[p]={credentialQueryId:p,candidates:[],reason:`No held credential satisfies query "${p}"`}}return{canSatisfy:u.can_be_satisfied,matches:a,reason:u.can_be_satisfied?void 0:"No combination of held credentials satisfies the verifier's DCQL query",raw:u}},"selectCredentialsForDcql");var sZ=class sZ extends Error{constructor(e,r){super(r),this.name="BuildDcqlPresentationError",this.code=e}};o(sZ,"BuildDcqlPresentationError");var vo=sZ,i5=o(t=>{let{query:e,chosen:r,holder:i}=t;if(r.length===0)throw new vo("no_selections","buildDcqlPresentations requires at least one chosen credential");let n=t.makeId??JSe,u=new Map;for(let v of r){let _=u.get(v.credentialQueryId);_?(_.candidates.push(v.candidate),!_.disclose&&v.disclose&&(_.disclose=v.disclose)):u.set(v.credentialQueryId,{candidates:[v.candidate],disclose:v.disclose})}let a=new Map;for(let v of e.credentials)a.set(v.id,v);let p=[];for(let v of e.credentials){let _=u.get(v.id);_&&(p.push(VSe(v,_.candidates,i,n,_.disclose)),u.delete(v.id))}if(u.size>0){let v=Array.from(u.keys()).join(", ");throw new vo("unknown_credential_query",`chosen credentials reference query ids the DCQL query doesn't declare: ${v}`)}return p},"buildDcqlPresentations"),VSe=o((t,e,r,i,n)=>{if(t.format==="dc+sd-jwt"||t.format==="vc+sd-jwt")return qSe(t,e,n);let u=LSe(t.format,t.id),a=e.map((v,_)=>MSe(v,t.id,_)),p={"@context":[YC(a)],id:`urn:uuid:${WSe(i)}`,type:["VerifiablePresentation"],holder:r,verifiableCredential:a};return{kind:"vp",credentialQueryId:t.id,unsignedVp:p,vpFormat:u,candidates:e}},"buildOnePresentation"),qSe=o((t,e,r)=>{if(e.length!==1)throw new vo("invalid_sd_jwt_vc",`DCQL query "${t.id}" (format=${t.format}) received ${e.length} candidates; SD-JWT-VC passthrough currently supports exactly one candidate per query id (DCQL multiple:true for SD-JWT is a follow-up)`);let i=ZSe(e[0]);if(!i)throw new vo("invalid_sd_jwt_vc",`DCQL query "${t.id}" (format=${t.format}) candidate is not a recognizable SD-JWT-VC compact form (expected a string or a W3C-wrapped object with proof.jwt of shape "<header>.<payload>.<sig>~<disclosure>*~<kb>?")`);return{kind:"sd-jwt-vc",credentialQueryId:t.id,compact:i,vpFormat:t.format,candidates:e,...r?{disclose:r}:{}}},"buildSdJwtPassthrough"),ZSe=o(t=>{let e=t.credential;if(typeof e=="string")return ece(e)?e:void 0;if(e&&typeof e=="object"){let r=e.proof,i=Array.isArray(r)?r:r?[r]:[];for(let n of i){if(!n||typeof n!="object")continue;let u=n.jwt;if(typeof u=="string"&&ece(u))return u}}},"extractSdJwtCompact"),ece=o(t=>t.includes("~")&&/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+~/.test(t),"looksLikeSdJwtCompact"),LSe=o((t,e)=>{if(t==="jwt_vc_json")return"jwt_vp_json";if(t==="ldp_vc")return"ldp_vp";throw new vo("unsupported_format",`DCQL query "${e}" requests format "${t}", which the plugin doesn't yet build presentations for (mso_mdoc is tracked for a follow-up slice)`)},"vpFormatForQueryFormat"),MSe=o((t,e,r)=>{let i=t.credential;if(typeof i=="string"){if(/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(i))return i;throw new vo("invalid_jwt_vc",`chosen candidate at index ${r} for query "${e}" is a string but not a compact JWS`)}if(i&&typeof i=="object"){let n=i.proof;if(n&&typeof n=="object"){let u=n.jwt;if(typeof u=="string")return u}return i}throw new vo("invalid_jwt_vc",`chosen candidate at index ${r} for query "${e}" is neither a JWT string nor a JSON object`)},"normalizeForEmbedding"),JSe=o(()=>{let t=typeof globalThis<"u"&&"crypto"in globalThis?globalThis.crypto:void 0;if(t&&typeof t.getRandomValues=="function"){let e=new Uint8Array(8);return t.getRandomValues(e),Array.from(e,r=>r.toString(16).padStart(2,"0")).join("")}return Math.random().toString(36).slice(2,18)},"defaultMakeId"),WSe=o(t=>{let r=(t().replace(/[^0-9a-f]/gi,"")+"0".repeat(32)).slice(0,32);return[r.slice(0,8),r.slice(8,12),"4"+r.slice(13,16),(parseInt(r.slice(16,17),16)&3|8).toString(16)+r.slice(17,20),r.slice(20,32)].join("-")},"makeUuidV4");var lZ=class lZ extends Error{constructor(e,r,i){super(r),this.name="DcqlSignError",this.code=e,i?.cause!==void 0&&(this.cause=i.cause)}};o(lZ,"DcqlSignError");var Um=lZ,cZ=o(async(t,e)=>{let r=[];for(let i of t.built){if(i.kind==="sd-jwt-vc"){r.push(await KSe(i,t,e));continue}let n=await Lu({unsignedVp:i.unsignedVp,vpFormat:i.vpFormat,audience:t.audience,nonce:t.nonce,holder:t.holder,iat:t.iat},e);r.push({credentialQueryId:i.credentialQueryId,vpToken:n.vpToken,vpFormat:i.vpFormat})}return r},"signDcqlPresentations"),KSe=o(async(t,e,r)=>{if(!r.sdJwtPresenter)throw new Um("missing_sd_jwt_presenter",`BuiltDcqlPresentation for query "${t.credentialQueryId}" is kind=sd-jwt-vc but helpers.sdJwtPresenter was not provided`);let i;try{i=await r.sdJwtPresenter(t.compact,{audience:e.audience,nonce:e.nonce,disclose:t.disclose})}catch(n){throw new Um("sd_jwt_present_failed",`SD-JWT-VC presenter failed for query "${t.credentialQueryId}": ${n instanceof Error?n.message:String(n)}`,{cause:n})}return{credentialQueryId:t.credentialQueryId,vpToken:i.compact,vpFormat:t.vpFormat}},"presentSdJwtEntry"),o5=o(async(t,e)=>{let r=await cZ(t,e);return{vpToken:dZ(r),presentations:r}},"buildDcqlResponse"),dZ=o(t=>{var r;let e={};for(let i of t)(e[r=i.credentialQueryId]??(e[r]=[])).push(i.vpToken);return e},"assembleDcqlVpToken");var nce=o((t,e={})=>{let r=e.fetch??globalThis.fetch,i={didResolver:e.didResolver,trustedX509Roots:e.trustedX509Roots,unsafeAllowSelfSigned:e.unsafeAllowSelfSignedRequestObject,unsafeSkipRequestObjectSignatureVerification:e.unsafeSkipRequestObjectSignatureVerification},n=o(async u=>{let a=c6(u);if(a.kind==="by_value")return a.offer;if(typeof r!="function")throw new kt("invalid_uri","No fetch implementation available; pass `config.fetch` to getOpenID4VCPlugin()");let p=await hD(a.uri,r);if(p.kind!=="by_value")throw new kt("invalid_uri","Unexpected by_reference result after resolving credential_offer_uri");return p.offer},"resolveOffer");return{name:"OpenID4VC",displayName:"OpenID4VC",description:"OpenID for Verifiable Credentials holder support \u2014 Credential Offers, VCI, VP, and SIOPv2.",methods:{parseCredentialOffer:o((u,a)=>c6(a),"parseCredentialOffer"),resolveCredentialOffer:o(async(u,a)=>n(a),"resolveCredentialOffer"),acceptCredentialOffer:o(async(u,a,p={})=>{let v=typeof a=="string"?await n(a):a,_=await q4(u,p);return $6({offer:v,signer:_,diVpSigner:V4(u),options:p,fetchImpl:r})},"acceptCredentialOffer"),exchangePreAuthCodeForToken:o(async(u,a,p={})=>{let v=typeof a=="string"?await n(a):a;return i2({offer:v,options:p,fetchImpl:r})},"exchangePreAuthCodeForToken"),requestCredentialsFromPreAuthToken:o(async(u,a)=>{let p=typeof a.input=="string"?await n(a.input):a.input,v=a.signer??await q4(u,{});return o2({offer:p,tokenResponse:a.tokenResponse,signer:v,diVpSigner:V4(u),options:a.options,fetchImpl:r})},"requestCredentialsFromPreAuthToken"),acceptAndStoreCredentialOffer:o(async(u,a,p={})=>{let v=await(async()=>{let b=typeof a=="string"?await n(a):a,l=await q4(u,p);return $6({offer:b,signer:l,diVpSigner:V4(u),options:p,fetchImpl:r})})(),_=await Lj(u,v,YSe(p));return{...v,..._}},"acceptAndStoreCredentialOffer"),beginCredentialOfferAuthCode:o(async(u,a,p)=>{let v=typeof a=="string"?await n(a):a;return l2({offer:v,redirectUri:p.redirectUri,clientId:p.clientId,configurationIds:p.configurationIds,scope:p.scope,fetchImpl:r})},"beginCredentialOfferAuthCode"),completeCredentialOfferAuthCode:o(async(u,a)=>{let p=a.signer??await q4(u,{});return f2({flowHandle:a.flowHandle,code:a.code,state:a.state,signer:p,diVpSigner:V4(u),fetchImpl:r})},"completeCredentialOfferAuthCode"),exchangeAuthCodeForToken:o(async(u,a)=>D6({flowHandle:a.flowHandle,code:a.code,state:a.state,fetchImpl:r}),"exchangeAuthCodeForToken"),requestCredentialsFromAuthCodeToken:o(async(u,a)=>{let p=a.signer??await q4(u,{});return I6({flowHandle:a.flowHandle,tokenResponse:a.tokenResponse,signer:p,diVpSigner:V4(u),fetchImpl:r})},"requestCredentialsFromAuthCodeToken"),parseAuthorizationRequest:o((u,a)=>D4(a),"parseAuthorizationRequest"),resolveAuthorizationRequest:o(async(u,a)=>I4(a,r,i),"resolveAuthorizationRequest"),prepareVerifiablePresentation:o(async(u,a,p)=>{let v=await Vm(a,r,i),_=QSe(u);if(v.dcql_query){let b=await n5(p,v.dcql_query,{sdJwtParser:_});return{request:v,dcqlSelection:b}}if(v.presentation_definition){let b=await QC(p,v.presentation_definition,{sdJwtParser:_});return{request:v,selection:b}}return{request:v,selection:{descriptors:[],canSatisfy:!0,reason:void 0}}},"prepareVerifiablePresentation"),buildPresentation:o(async(u,a,p,v={})=>{let _=await Vm(a,r,i),b=rce(_),l=v.holder??u.id.did(),S=R4({pd:b,chosen:p,holder:l,envelopeFormat:v.envelopeFormat});return{request:_,prepared:S}},"buildPresentation"),signPresentation:o(async(u,a,p,v={})=>{let _=await Vm(a,r,i),b=v.holder??(typeof p.unsignedVp.holder=="string"?p.unsignedVp.holder:u.id.did());if(p.vpFormat==="jwt_vp_json"){let l=v.signer??await u5(u);return Lu({unsignedVp:p.unsignedVp,vpFormat:p.vpFormat,audience:_.client_id,nonce:_.nonce,holder:b},{jwtSigner:l})}return p.vpFormat==="dc+sd-jwt"||p.vpFormat==="vc+sd-jwt"?Lu({unsignedVp:p.unsignedVp,vpFormat:p.vpFormat,audience:_.client_id,nonce:_.nonce,holder:b,sdJwtSource:p.sdJwtSource},{sdJwtPresenter:gZ(u)}):Lu({unsignedVp:p.unsignedVp,vpFormat:p.vpFormat,audience:_.client_id,nonce:_.nonce,holder:b},{ldpVpSigner:mZ(u,_)})},"signPresentation"),submitPresentation:o(async(u,a,p,v,_={})=>{let b=await Vm(a,r,i);tce(b);let l=b.response_uri??b.redirect_uri;if(!l)throw new Error("Authorization Request has no response_uri / redirect_uri \u2014 cannot submitPresentation");return Fm({responseUri:l,vpToken:p.vpToken,submission:v,idToken:_.idToken,state:b.state,fetchImpl:r,...fZ(b,await pZ(u,b))})},"submitPresentation"),signIdToken:o(async(u,a,p={})=>{let v=await Vm(a,r,i),_=p.holder??u.id.did(),b=p.signer??await u5(u);return U4({holder:_,audience:v.client_id,nonce:v.nonce,lifetimeSeconds:p.lifetimeSeconds,issuerMode:p.issuerMode,vpTokenHash:p.vpTokenHash},{signer:b})},"signIdToken"),presentCredentials:o(async(u,a,p,v={})=>{let _=await Vm(a,r,i);tce(_);let b=v.holder??u.id.did(),l=v.signer,S=o(async()=>(l||(l=await u5(u)),l),"ensureSharedJwtSigner"),x=o(async()=>{if(t5(_.response_type))return U4({holder:b,audience:_.client_id,nonce:_.nonce},{signer:await S()})},"signIdTokenIfRequested"),D=_.response_uri??_.redirect_uri;if(!D)throw new Error("Authorization Request has no response_uri / redirect_uri \u2014 cannot presentCredentials");if(_.dcql_query){let et=GSe(p),tt=i5({query:_.dcql_query,chosen:et,holder:b}),St=tt.some(Tt=>Tt.vpFormat==="jwt_vp_json"),ke=tt.some(Tt=>Tt.vpFormat==="ldp_vp"),Ke=tt.some(Tt=>Tt.kind==="sd-jwt-vc"),Nt={...St?{jwtSigner:await S()}:{},...ke?{ldpVpSigner:mZ(u,_)}:{},...Ke?{sdJwtPresenter:gZ(u)}:{}},q=await o5({built:tt,audience:_.client_id,nonce:_.nonce,holder:b},Nt),hr=await x(),dr=await Fm({responseUri:D,vpToken:q.vpToken,idToken:hr?.idToken,state:_.state,fetchImpl:r,...fZ(_,await pZ(u,_))});return{request:_,dcqlBuilt:tt,dcqlSigned:q.presentations,dcqlVpToken:q.vpToken,signedIdToken:hr,submitted:dr}}let E=rce(_),z=HSe(p),G=R4({pd:E,chosen:z,holder:b,envelopeFormat:v.envelopeFormat}),De=G.vpFormat==="jwt_vp_json"?{jwtSigner:await S()}:G.vpFormat==="ldp_vp"?{ldpVpSigner:mZ(u,_)}:{sdJwtPresenter:gZ(u)},we=await Lu({unsignedVp:G.unsignedVp,vpFormat:G.vpFormat,audience:_.client_id,nonce:_.nonce,holder:b,sdJwtSource:G.sdJwtSource},De),pe=await x(),ue=await Fm({responseUri:D,vpToken:we.vpToken,submission:G.submission,idToken:pe?.idToken,state:_.state,fetchImpl:r,...fZ(_,await pZ(u,_))});return{request:_,prepared:G,signed:we,signedIdToken:pe,submitted:ue}},"presentCredentials")}}},"getOpenID4VCPlugin"),Vm=o(async(t,e,r)=>typeof t=="string"?await I4(t,e,r):t,"resolveRequestInput"),tce=o(t=>{if(t.transaction_data&&t.transaction_data.length>0)throw new $e("invalid_transaction_data","Authorization Request includes transaction_data, which this Wallet does not support")},"assertTransactionDataUnsupported"),rce=o(t=>{if(!t.presentation_definition)throw new Error("Authorization Request has no presentation_definition \u2014 cannot build a VP");return t.presentation_definition},"requirePresentationDefinition"),HSe=o(t=>{for(let[e,r]of t.entries())if(!("descriptorId"in r)||typeof r.descriptorId!="string")throw new Error(`chosen[${e}] is missing 'descriptorId' \u2014 PEX requests need ChosenCredential entries (received DCQL-shape entry with credentialQueryId="${r.credentialQueryId}")`);return t},"assertPexChosen"),GSe=o(t=>{for(let[e,r]of t.entries())if(!("credentialQueryId"in r)||typeof r.credentialQueryId!="string")throw new Error(`chosen[${e}] is missing 'credentialQueryId' \u2014 DCQL requests need DcqlChosenCredential entries (received PEX-shape entry with descriptorId="${r.descriptorId}")`);return t},"assertDcqlChosen"),fZ=o((t,e)=>t.response_mode!=="direct_post.jwt"?{}:{responseMode:"direct_post.jwt",clientMetadata:t.client_metadata,nonce:t.nonce,signer:e},"buildJarmOptions"),pZ=o(async(t,e)=>{if(e.response_mode!=="direct_post.jwt")return;let r=e.client_metadata?.authorization_signed_response_alg;if(!(typeof r!="string"||r.length===0))return u5(t)},"maybeJarmSigner"),u5=o(async t=>{let e=hZ(t,"VP signing"),r=t.id.did(),i=await t.invoke.didToVerificationMethod(r);return k6({keypair:e,kid:i})},"ensureVpJwtSigner"),V4=o(t=>({holder:t.id.did(),signPresentation:o(async(e,{domain:r,challenge:i,cryptosuite:n})=>t.invoke.issuePresentation(e,{proofPurpose:"authentication",domain:r,challenge:i,...n?{type:"DataIntegrityProof",cryptosuite:n}:{}}),"signPresentation")}),"buildDiVpSigner"),mZ=o((t,e)=>({sign:o(async(r,{domain:i,challenge:n})=>t.invoke.issuePresentation(r,{domain:i,challenge:n,...XSe(e?.client_metadata)}),"sign")}),"buildLdpVpSigner"),XSe=o(t=>{let r=(t?.vp_formats_supported??t?.vp_formats)?.ldp_vp;if(!r)return{};let i=r.proof_type_values??r.proof_type;if(!Array.isArray(i)||!i.includes("DataIntegrityProof"))return{};let n=Array.isArray(r.cryptosuite_values)?r.cryptosuite_values:[],a=["eddsa-rdfc-2022","eddsa-2022","json-eddsa-2022"].find(p=>n.includes(p))??(n.length===0?"eddsa-rdfc-2022":void 0);return a?{type:"DataIntegrityProof",cryptosuite:a,proofPurpose:"authentication"}:{}},"ldpVpProofOptionsFromClientMetadata"),QSe=o(t=>{let e=t.invoke;if(typeof e?.parseSdJwtVc=="function")return async r=>{let i=await e.parseSdJwtVc(r);return{claims:i.claims,vct:i.vct,issuer:i.issuer,holderPublicKey:i.holderPublicKey}}},"buildSdJwtParser"),gZ=o(t=>{let e=t.invoke;if(typeof e?.presentSdJwtVc=="function")return async(r,{audience:i,nonce:n,disclose:u})=>{let a=hZ(t,"SD-JWT-VC KB-JWT signing"),p=await Mi({kty:a.kty,crv:a.crv,x:a.x,d:a.d},"EdDSA"),v=o(async b=>{let l=b.indexOf(".");if(l<=0||l>=b.length-1)throw new Error("KB-JWT signer received malformed JWS signing input (no dot separator)");let S=b.slice(0,l),x=b.slice(l+1),D=o(we=>{let pe=we.replace(/-/g,"+").replace(/_/g,"/"),ue=pe+"=".repeat((4-pe.length%4)%4),et=typeof Buffer<"u"?Buffer.from(ue,"base64").toString("utf-8"):new TextDecoder().decode(Uint8Array.from(atob(ue),tt=>tt.charCodeAt(0)));return JSON.parse(et)},"decode"),E=D(S),z=D(x),De=(await new Es(z).setProtectedHeader(E).sign(p)).split(".")[2];if(!De)throw new Error("KB-JWT signing produced no signature segment");return De},"kbSigner");return{compact:(await e.presentSdJwtVc(r,{audience:i,nonce:n,kbSigner:v,kbSignAlg:"EdDSA",...u?{disclose:u}:{}})).compact}}},"buildSdJwtPresenter"),q4=o(async(t,e)=>{if(e.signer)return e.signer;let r=hZ(t,"VCI proof-of-possession"),i=t.id.did(),n=await t.invoke.didToVerificationMethod(i);return k6({keypair:r,kid:n})},"ensureSigner"),hZ=o((t,e)=>{let r;try{r=t.id.keypair("ed25519")}catch(i){throw new Error(`OpenID4VC ${e} requires an Ed25519 keypair on the host LearnCard, but \`id.keypair('ed25519')\` threw: ${i instanceof Error?i.message:String(i)}. Pass \`options.signer\` to bring your own signer (HSM / secp256k1 / external backend).`)}if(!r||r.kty!=="OKP"||r.crv!=="Ed25519")throw new Error(`OpenID4VC ${e} requires an Ed25519 keypair, but the host LearnCard returned ${r?`kty=${r.kty} crv=${r.crv??"<none>"}`:"no keypair"}. Pass \`options.signer\` to bring your own signer (HSM / secp256k1 / external backend).`);return r},"requireEd25519Keypair"),YSe=o(t=>({storage:t.storage,encrypt:t.encrypt,category:t.category,title:t.title,imgUrl:t.imgUrl,upload:t.upload,addToIndex:t.addToIndex,makeId:t.makeId}),"splitStoreOptions");var vZ=o(t=>Ca(t),"buildDcqlQuery"),ice=o(t=>{let e=t.format??"jwt_vc_json";if(t.types.length===0)throw new Error("requestW3cVc: `types` must contain at least one type string");let r={id:t.id,format:e,meta:{type_values:[Array.from(t.types)]}};return t.claims&&t.claims.length>0&&(r.claims=t.claims.map(i=>{let n={path:Array.from(i.path)};return i.values&&i.values.length>0&&(n.values=Array.from(i.values)),i.id&&(n.id=i.id),n})),t.requireHolderBinding===!1&&(r.require_cryptographic_holder_binding=!1),vZ({credentials:[r]})},"requestW3cVc");
|
|
163
|
+
`},"derToPem"),H6e=o(async t=>{let{jws:e,header:r,opts:i}=t;if(!!!i.unsafeAllowSelfSigned)throw new Ce("unsupported_client_id_scheme","client-id prefix=pre-registered without a registry binding requires unsafeAllowSelfSigned=true (signing key cannot be derived from client_id alone)");let u=r.x5c;if(!Array.isArray(u)||u.length===0)throw new Ce("invalid_request_object","client-id prefix=pre-registered requires an x5c header to verify the signature against (no key material available otherwise)");let a=gq(u[0]),p;try{p=await b6(a,gr(r.alg)??"RS256")}catch(v){throw new Ce("request_signer_untrusted",`Failed to import leaf X.509 cert: ${ln(v)}`,{cause:v})}try{await hh(e,p)}catch(v){throw new Ce("request_signature_invalid",`JWS signature verification failed: ${ln(v)}`,{cause:v})}},"verifyWithPreRegistered"),G6e=o(t=>{try{return new URL(t.includes("://")?t:`https://${t}`).hostname}catch{return t}},"hostFromClientId"),hq=o((t=globalThis.fetch)=>async e=>{if(e.startsWith("did:jwk:"))return X6e(e);if(e.startsWith("did:web:"))return Q6e(e,t);throw new Ce("did_resolution_failed",`Built-in resolver does not support ${e.split(":").slice(0,2).join(":")} \u2014 pass a custom didResolver`)},"builtInDidResolver"),X6e=o(t=>{let e=t.replace(/^did:jwk:/,"").split("#")[0],r;try{let n="=".repeat((4-e.length%4)%4),u=e.replace(/-/g,"+").replace(/_/g,"/")+n;r=JSON.parse(Buffer.from(u,"base64").toString("utf8"))}catch(n){throw new Ce("did_resolution_failed",`Failed to decode did:jwk identifier: ${ln(n)}`,{cause:n})}let i=`${t}#0`;return{id:t,verificationMethod:[{id:i,type:"JsonWebKey2020",controller:t,publicKeyJwk:r}],authentication:[i],assertionMethod:[i]}},"resolveDidJwk"),Q6e=o(async(t,e)=>{if(typeof e!="function")throw new Ce("did_resolution_failed","did:web resolution requires a fetch implementation");let i=t.replace(/^did:web:/,"").split(":").map(_=>decodeURIComponent(_)),n=i.shift(),u=i.length===0?"/.well-known/did.json":`/${i.join("/")}/did.json`,a=`https://${n}${u}`,p;try{p=await e(a,{method:"GET"})}catch(_){throw new Ce("did_resolution_failed",`Failed to fetch ${a}: ${ln(_)}`,{cause:_})}if(!p.ok)throw new Ce("did_resolution_failed",`${a} returned ${p.status} ${p.statusText}`);let v;try{v=await p.json()}catch(_){throw new Ce("did_resolution_failed",`${a} response was not JSON: ${ln(_)}`,{cause:_})}if(!v||typeof v!="object"||Array.isArray(v))throw new Ce("did_resolution_failed",`${a} response was not a DID Document object`);return v},"resolveDidWeb"),pq=o((t,e,r)=>{let i=mq(r.presentation_definition)?r.presentation_definition:void 0,n=gr(r.presentation_definition_uri),u;if(r.dcql_query!==void 0&&r.dcql_query!==null){if(i||n)throw new $e("both_pex_and_dcql","Request Object claims carry both PEX (presentation_definition[_uri]) and DCQL (dcql_query); OID4VP 1.0 \xA75.3 forbids this");u=Ca(r.dcql_query)}let a=mq(r.client_metadata)?r.client_metadata:void 0,p=gr(r.nonce);if(!p)throw new $e("missing_nonce","Request Object is missing the required `nonce` claim (OID4VP 1.0 \xA75.2)");let v;if(r.transaction_data!==void 0&&r.transaction_data!==null){if(!Array.isArray(r.transaction_data)||r.transaction_data.length===0||!r.transaction_data.every(S=>typeof S=="string"))throw new $e("invalid_transaction_data","transaction_data MUST be a non-empty array of base64url-encoded strings");v=r.transaction_data}let _=Array.isArray(r.verifier_info)?r.verifier_info:void 0,b=gr(r.request_uri_method),l=b==="get"||b==="post"?b:void 0;return{client_id:t,client_id_scheme:e,response_type:gr(r.response_type)??"vp_token",response_mode:gr(r.response_mode),response_uri:gr(r.response_uri),redirect_uri:gr(r.redirect_uri),nonce:p,state:gr(r.state),presentation_definition:i,presentation_definition_uri:n,dcql_query:u,client_metadata:a,client_metadata_uri:gr(r.client_metadata_uri),scope:gr(r.scope),transaction_data:v,verifier_info:_,request_uri_method:l,wallet_nonce:gr(r.wallet_nonce)}},"buildRequestFromClaims"),gr=o(t=>typeof t=="string"&&t.length>0?t:void 0,"asString"),mq=o(t=>t!==null&&typeof t=="object"&&!Array.isArray(t),"isObject"),mue=o(t=>/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(t),"looksLikeJws"),gue=o(t=>{let e="=".repeat((4-t.length%4)%4),r=t.replace(/-/g,"+").replace(/_/g,"/")+e;return Buffer.from(r,"base64").toString("utf8")},"b64urlDecode"),ln=o(t=>t instanceof Error?t.message:String(t),"describe");var D4=o(t=>{if(typeof t!="string"||t.trim().length===0)throw new $e("invalid_uri","Authorization Request URI must be a non-empty string");let e=eAe(t),r=e.get("request_uri");if(typeof r=="string"&&r.length>0){if(!_ue(r))throw new $e("invalid_uri","request_uri must be an absolute https:// URL");return{kind:"by_reference_request_uri",requestUri:r,rawParams:e}}let i=e.get("request");return typeof i=="string"&&i.length>0?{kind:"by_reference_request_jwt",jwt:i,rawParams:e}:{kind:"by_value",request:tAe(e)}},"parseAuthorizationRequestUri"),yq=o(async(t,e=globalThis.fetch)=>{if(typeof e!="function")throw new $e("presentation_definition_fetch_failed","No fetch implementation available to resolve presentation_definition_uri");if(!_ue(t))throw new $e("invalid_uri","presentation_definition_uri must be an absolute https:// URL");let r;try{r=await e(t,{method:"GET"})}catch(n){throw new $e("presentation_definition_fetch_failed",`Failed to fetch presentation_definition_uri: ${aAe(n)}`,{cause:n})}if(!r.ok)throw new $e("presentation_definition_fetch_failed",`presentation_definition_uri returned ${r.status} ${r.statusText}`);let i;try{i=await r.json()}catch(n){throw new $e("invalid_json","presentation_definition_uri response was not valid JSON",{cause:n})}return yue(i)},"resolvePresentationDefinitionByReference"),I4=o(async(t,e=globalThis.fetch,r={})=>{let i=D4(t),n;if(i.kind==="by_value")n=i.request;else{let u=i.rawParams.get("client_id")??void 0,a=i.rawParams.get("client_id_scheme")??void 0,p=i.kind==="by_reference_request_uri",v=vue(i.rawParams.get("request_uri_method")),_=p&&v==="post"?Y6e():void 0;n=await DC({requestUri:p?i.requestUri:void 0,inlineJwt:i.kind==="by_reference_request_jwt"?i.jwt:void 0,requestUriMethod:v,walletNonce:_,urlClientId:u,urlClientIdScheme:a,fetchImpl:e,didResolver:r.didResolver,trustedX509Roots:r.trustedX509Roots,unsafeAllowSelfSigned:r.unsafeAllowSelfSigned,unsafeSkipRequestObjectSignatureVerification:r.unsafeSkipRequestObjectSignatureVerification})}if(n.presentation_definition)return n;if(n.presentation_definition_uri){let u=await yq(n.presentation_definition_uri,e);return{...n,presentation_definition:u}}return n},"resolveAuthorizationRequest"),Y6e=o(()=>{let t=globalThis.crypto;if(!t)throw new $e("invalid_uri","Web Crypto API not available to generate wallet_nonce");let e=new Uint8Array(16);t.getRandomValues(e);let r="";for(let i=0;i<e.length;i++)r+=e[i].toString(16).padStart(2,"0");return r},"randomWalletNonce"),eAe=o(t=>{let e=t.indexOf("?");if(e!==-1)return new URLSearchParams(t.slice(e+1));if(t.includes("://")||/^[a-z][a-z0-9+.-]*:/i.test(t))throw new $e("invalid_uri","Authorization Request URI has no query string");if(t.includes("="))return new URLSearchParams(t);throw new $e("invalid_uri","Authorization Request URI has no query string")},"extractSearchParams"),tAe=o(t=>{let e=t.get("client_id");if(!e)throw new $e("missing_client_id","Authorization Request is missing client_id");let r=t.get("nonce");if(!r)throw new $e("missing_nonce","Authorization Request is missing nonce");let i=t.get("response_type");if(!i)throw new $e("missing_response_type","Authorization Request is missing response_type");let n=i.split(/\s+/).filter(Boolean),u=new Set(["vp_token","id_token"]);if(!n.some(ke=>u.has(ke)))throw new $e("unsupported_response_type",`Authorization Request response_type "${i}" is not supported (expected vp_token and/or id_token)`);let a=t.get("response_uri")??void 0,p=t.get("redirect_uri")??void 0,v=t.get("response_mode")??void 0;if(!a&&!p)throw new $e("missing_response_target","Authorization Request is missing both response_uri and redirect_uri");let _=t.get("presentation_definition"),b=t.get("presentation_definition_uri"),l=t.get("dcql_query");if(_&&b)throw new $e("both_definition_and_uri","Authorization Request has both presentation_definition and presentation_definition_uri");if(l&&(_||b))throw new $e("both_pex_and_dcql","Authorization Request carries both PEX (presentation_definition[_uri]) and DCQL (dcql_query); OID4VP 1.0 \xA75.3 forbids this");let S;if(_){let ke;try{ke=JSON.parse(_)}catch(Ke){throw new $e("invalid_json","presentation_definition query parameter was not valid JSON",{cause:Ke})}S=yue(ke)}let x;if(l){let ke;try{ke=JSON.parse(l)}catch(Ke){throw new $e("invalid_json","dcql_query query parameter was not valid JSON",{cause:Ke})}x=Ca(ke)}let D=t.get("scope")??void 0;if(n.includes("vp_token")&&!S&&!b&&!x&&!D)throw new $e("missing_presentation_definition","Authorization Request has none of presentation_definition, presentation_definition_uri, dcql_query, or scope");let z=t.get("client_metadata"),G;if(z)try{let ke=JSON.parse(z);if(ke&&typeof ke=="object"&&!Array.isArray(ke))G=ke;else throw new $e("invalid_json","client_metadata query parameter must be a JSON object")}catch(ke){throw ke instanceof $e?ke:new $e("invalid_json","client_metadata query parameter was not valid JSON",{cause:ke})}let De=rAe(t.get("transaction_data")),we=nAe(t.get("verifier_info")),pe=vue(t.get("request_uri_method")),ue=new Set(["client_id","client_id_scheme","response_type","response_mode","response_uri","redirect_uri","nonce","state","presentation_definition","presentation_definition_uri","dcql_query","client_metadata","client_metadata_uri","scope","transaction_data","verifier_info","request_uri_method"]),et={};t.forEach((ke,Ke)=>{ue.has(Ke)||(et[Ke]=ke)});let tt=Ol(e,t.get("client_id_scheme")??void 0),St=oAe(tt,e,{responseUri:a,redirectUri:p});return{client_id:e,client_id_scheme:St,response_type:i,response_mode:v,response_uri:a,redirect_uri:p,nonce:r,state:t.get("state")??void 0,presentation_definition:S,presentation_definition_uri:b??void 0,dcql_query:x,client_metadata:G,client_metadata_uri:t.get("client_metadata_uri")??void 0,scope:D,transaction_data:De,verifier_info:we,request_uri_method:pe,...Object.keys(et).length>0?{extra:et}:{}}},"buildRequestFromParams"),rAe=o(t=>{if(t===null)return;let e;try{e=JSON.parse(t)}catch(r){throw new $e("invalid_transaction_data","transaction_data was not valid JSON",{cause:r})}if(!Array.isArray(e)||e.length===0||!e.every(r=>typeof r=="string"))throw new $e("invalid_transaction_data","transaction_data MUST be a non-empty array of base64url-encoded strings");return e},"parseTransactionData"),nAe=o(t=>{if(t===null)return;let e;try{e=JSON.parse(t)}catch(r){throw new $e("invalid_json","verifier_info was not valid JSON",{cause:r})}if(!Array.isArray(e))throw new $e("invalid_json","verifier_info MUST be a JSON array");return e},"parseVerifierInfo"),vue=o(t=>{if(t!==null){if(t!=="get"&&t!=="post")throw new $e("invalid_request_uri_method",`request_uri_method must be 'get' or 'post' (case-sensitive), got '${t}'`);return t}},"parseRequestUriMethod"),iAe=new Set(["did","x509_san_dns","x509_hash","verifier_attestation","https"]),oAe=o((t,e,r)=>{if(t.prefix==="https"&&t.inferred)return"pre-registered";if(iAe.has(t.prefix))throw new $e("invalid_client_id_scheme",`Unsigned Authorization Request uses client-id prefix "${t.prefix}", which requires a signed Request Object (OID4VP 1.0 \xA75.9); only redirect_uri and pre-registered are valid unsigned`);if(t.prefix==="redirect_uri"){let i=r.responseUri??r.redirectUri;if(e.startsWith("redirect_uri:")){if(t.value!==i)throw new $e("invalid_client_id_scheme",`redirect_uri client-id "${t.value}" does not equal the request's response target "${i}" (OID4VP 1.0 \xA75.9.1)`)}else if(i&&!uAe(t.value,i))throw new $e("invalid_client_id_scheme",`client_id_scheme=redirect_uri client-id "${t.value}" is not same-origin with the request's response target "${i}"`)}return t.prefix},"resolveUnsignedClientIdPrefix"),uAe=o((t,e)=>{try{return new URL(t).origin===new URL(e).origin}catch{return!1}},"isSameOrigin"),yue=o(t=>{if(!t||typeof t!="object"||Array.isArray(t))throw new $e("invalid_presentation_definition","presentation_definition must be a JSON object");let e=t;if(typeof e.id!="string"||e.id.length===0)throw new $e("invalid_presentation_definition","presentation_definition is missing a string `id`");if(!Array.isArray(e.input_descriptors)||e.input_descriptors.length===0)throw new $e("invalid_presentation_definition","presentation_definition must declare a non-empty input_descriptors array");for(let[r,i]of e.input_descriptors.entries()){if(!i||typeof i!="object")throw new $e("invalid_presentation_definition",`input_descriptors[${r}] must be an object`);let n=i;if(typeof n.id!="string"||n.id.length===0)throw new $e("invalid_presentation_definition",`input_descriptors[${r}].id must be a non-empty string`);if(!n.constraints||typeof n.constraints!="object")throw new $e("invalid_presentation_definition",`input_descriptors[${r}].constraints must be an object`)}return e},"validatePresentationDefinition"),_ue=o(t=>{try{return new URL(t).protocol==="https:"}catch{return!1}},"isHttpsUrl"),aAe=o(t=>t instanceof Error?t.message:String(t),"describe");var Mse=rH(Vse(),1);var WEe=512,Xq=o((t,e)=>{if(!Array.isArray(e.path)||e.path.length===0)return{matched:!1,reason:"Field has no `path[]` declared"};for(let r of e.path){let i;try{i=Qq(t,r)}catch(n){return{matched:!1,reason:`JSONPath "${r}" could not be evaluated: ${YEe(n)}`}}if(i.length!==0)for(let n of i){if(!e.filter)return{matched:!0,matchedPath:r,value:n};if(Rm(n,e.filter))return{matched:!0,matchedPath:r,value:n};if(Array.isArray(n)&&GEe(e.filter)){for(let u of n)if(Rm(u,e.filter))return{matched:!0,matchedPath:r,value:u}}}}return e.optional?{matched:!0,reason:"Field is optional and yielded no value"}:{matched:!1,reason:e.filter?`No value from paths ${JSON.stringify(e.path)} satisfied the filter`:`None of paths ${JSON.stringify(e.path)} resolved on the candidate`}},"evaluateField"),XC=o((t,e)=>{let i=e.constraints?.fields??[],n=[];for(let u of i){let a=Xq(t,u);if(n.push(a),!a.matched)return{matched:!1,descriptorId:e.id,fields:n,reason:a.reason}}return{matched:!0,descriptorId:e.id,fields:n}},"matchInputDescriptor"),Qq=o((t,e)=>{if(typeof e!="string"||e.length===0)throw new Error("JSONPath must be a non-empty string");if(e!=="$"&&!e.startsWith("$"))throw new Error(`JSONPath "${e}" must start with "$"`);if(/\[\?\(/.test(e))throw new Error(`JSONPath filter expressions are not supported yet (found in "${e}")`);if(/\[\s*\d+\s*:/.test(e)||/\[\s*:\s*\d+\s*\]/.test(e))throw new Error(`JSONPath array slicing is not supported yet (found in "${e}")`);let r=HEe(e),i=[t];for(let n of r){let u=[];for(let a of i)switch(n.kind){case"property":{let p=KEe(a,n.name);p!==void 0&&u.push(p);break}case"index":{Array.isArray(a)&&n.index<a.length&&u.push(a[n.index]);break}case"wildcard":{if(Array.isArray(a))for(let p of a)u.push(p);else if(a&&typeof a=="object")for(let p of Object.values(a))u.push(p);break}case"descendant":{Gq(a,n.name,u);break}}i=u}return i},"queryJsonPath"),KEe=o((t,e)=>{if(t!=null&&!Array.isArray(t)&&typeof t=="object")return t[e]},"getProperty"),Gq=o((t,e,r)=>{if(t!=null){if(Array.isArray(t)){for(let i of t)Gq(i,e,r);return}if(typeof t=="object"){let i=t;for(let[n,u]of Object.entries(i))n===e&&r.push(u),Gq(u,e,r)}}},"collectDescendants"),HEe=o(t=>{let e=[],r=t.startsWith("$")?1:0;for(;r<t.length;){let i=t[r];if(i===".")if(t[r+1]==="."){r+=2;let n=qse(t,r);if(!n.text)throw new Error(`Recursive descent ".." at position ${r} must be followed by a property name`);e.push({kind:"descendant",name:n.text}),r=n.next}else{if(r+=1,t[r]==="*"){e.push({kind:"wildcard"}),r+=1;continue}let n=qse(t,r);if(!n.text)throw new Error(`Property accessor "." at position ${r} must be followed by an identifier`);e.push({kind:"property",name:n.text}),r=n.next}else if(i==="["){let n=t.indexOf("]",r+1);if(n===-1)throw new Error(`Unterminated "[" in JSONPath "${t}"`);let u=t.slice(r+1,n).trim();if(u==="*")e.push({kind:"wildcard"});else if(/^-?\d+$/.test(u))e.push({kind:"index",index:parseInt(u,10)});else if(/^'[^']*'$/.test(u)||/^"[^"]*"$/.test(u))e.push({kind:"property",name:u.slice(1,-1)});else throw new Error(`Unsupported bracket expression [${u}] in JSONPath "${t}"`);r=n+1}else throw new Error(`Unexpected character "${i}" at position ${r} in JSONPath "${t}"`)}return e},"tokenizeJsonPath"),qse=o((t,e)=>{let r=e;for(;r<t.length;){let i=t[r];if(!/[A-Za-z0-9_\-@:]/.test(i))break;r+=1}return{text:t.slice(e,r),next:r}},"readIdentifier"),Rm=o((t,e)=>{if("type"in e&&!(Array.isArray(e.type)?e.type:[e.type]).some(n=>QEe(t,n))||"const"in e&&!GC(t,e.const))return!1;if("enum"in e){let r=e.enum;if(!Array.isArray(r)||!r.some(i=>GC(t,i)))return!1}if("pattern"in e){if(typeof t!="string")return!1;let r=e.pattern;if(typeof r!="string"||r.length>WEe||!(0,Mse.default)(r))return!1;let i;try{i=new RegExp(r)}catch{return!1}try{if(!i.test(t))return!1}catch{return!1}}if(typeof t=="number"&&(typeof e.minimum=="number"&&t<e.minimum||typeof e.maximum=="number"&&t>e.maximum||typeof e.exclusiveMinimum=="number"&&t<=e.exclusiveMinimum||typeof e.exclusiveMaximum=="number"&&t>=e.exclusiveMaximum)||typeof t=="string"&&(typeof e.minLength=="number"&&t.length<e.minLength||typeof e.maxLength=="number"&&t.length>e.maxLength))return!1;if(Array.isArray(t)){if(e.contains&&typeof e.contains=="object"){let r=e.contains;if(!t.some(n=>Rm(n,r)))return!1}if(e.items&&typeof e.items=="object"&&!Array.isArray(e.items)){let r=e.items;if(!t.every(n=>Rm(n,r)))return!1}if(typeof e.minItems=="number"&&t.length<e.minItems||typeof e.maxItems=="number"&&t.length>e.maxItems)return!1}return!0},"satisfiesFilter"),GEe=o(t=>{if(Lse(t,["contains","items","minItems","maxItems"]))return!1;if("type"in t){let e=Array.isArray(t.type)?t.type:[t.type];return e.length===0?!1:e.every(r=>typeof r=="string"&&XEe.has(r))}return Lse(t,["pattern","minLength","maxLength","minimum","maximum","exclusiveMinimum","exclusiveMaximum"])||"const"in t&&Zse(t.const)?!0:"enum"in t&&Array.isArray(t.enum)&&t.enum.length>0?t.enum.every(Zse):!1},"expectsPrimitive"),XEe=new Set(["string","number","integer","boolean","null"]),Zse=o(t=>t===null||typeof t=="string"||typeof t=="number"||typeof t=="boolean","isPrimitiveValue"),Lse=o((t,e)=>e.some(r=>r in t),"hasAnyKeyword"),QEe=o((t,e)=>{switch(e){case"string":return typeof t=="string";case"number":return typeof t=="number";case"integer":return typeof t=="number"&&Number.isInteger(t);case"boolean":return typeof t=="boolean";case"null":return t===null;case"array":return Array.isArray(t);case"object":return t!==null&&typeof t=="object"&&!Array.isArray(t);default:return!1}},"matchesType"),GC=o((t,e)=>{if(t===e)return!0;if(t===null||e===null)return t===e;if(typeof t!=typeof e)return!1;if(Array.isArray(t)){if(!Array.isArray(e)||t.length!==e.length)return!1;for(let r=0;r<t.length;r++)if(!GC(t[r],e[r]))return!1;return!0}if(typeof t=="object"){if(typeof e!="object"||Array.isArray(e))return!1;let r=t,i=e,n=Object.keys(r),u=Object.keys(i);if(n.length!==u.length)return!1;for(let a of n)if(!GC(r[a],i[a]))return!1;return!0}return!1},"deepEqual"),YEe=o(t=>t instanceof Error?t.message:String(t),"describe");var QC=o(async(t,e,r={})=>{let i=t.map((v,_)=>({index:_,candidate:{...v,format:v.format??N4(v.credential)}})),n=await Promise.all(i.map(async v=>({...v,decoded:await rSe(v.candidate,r.sdJwtParser)}))),u=e.input_descriptors.map(v=>{let _=[],b=v.format??e.format;for(let l of n){let{candidate:S,index:x,decoded:D}=l;if(b&&!tSe(S.format,b))continue;let E=XC(D,v);E.matched&&_.push({descriptorId:v.id,candidate:S,match:E,candidateIndex:x})}return{descriptorId:v.id,candidates:_,reason:_.length===0?oSe(v,i.length,b):void 0}}),a=new Set(u.filter(v=>v.candidates.length>0).map(v=>v.descriptorId)),p=eSe(e,a);return{descriptors:u,canSatisfy:p.satisfied,reason:p.satisfied?void 0:p.reason}},"selectCredentials"),Kse=o((t,e,r={})=>{let i=r.makeId??uSe;return{id:r.submissionId??i(),definition_id:t.id,descriptor_map:e.map(n=>{let u={id:n.descriptorId,format:n.format,path:n.path};return n.pathNested&&(u.path_nested={id:n.descriptorId,format:n.format,path:n.pathNested}),u})}},"buildPresentationSubmission"),N4=o(t=>{if(typeof t=="string")return/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+~/.test(t)?"dc+sd-jwt":/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(t)?"jwt_vc_json":void 0;if(!t||typeof t!="object")return;let r=t.proof,i=(Array.isArray(r)?r:r?[r]:[]).filter(a=>!!a&&typeof a=="object");if(i.find(a=>a.type==="SdJwtCompactProof"&&typeof a.jwt=="string"))return"dc+sd-jwt";let u=i[0];if(u){if(typeof u.jwt=="string"||u.type==="JwtProof2020")return"jwt_vc_json";if(typeof u.type=="string")return"ldp_vc"}},"inferCredentialFormat"),eSe=o((t,e)=>{let r=t.submission_requirements;if(!r||r.length===0){let i=t.input_descriptors.map(n=>n.id).filter(n=>!e.has(n));return i.length===0?{satisfied:!0}:{satisfied:!1,reason:i.length===1?`Input descriptor "${i[0]}" has no matching credential`:`${i.length} input descriptors have no matching credential: ${i.join(", ")}`}}for(let i of r){let n=Hse(i,t,e);if(!n.satisfied)return n}return{satisfied:!0}},"evaluateSubmissionRequirements"),Hse=o((t,e,r)=>{if(typeof t.from=="string"&&t.from.length>0){let i=e.input_descriptors.filter(u=>u.group?.includes(t.from));if(i.length===0)return{satisfied:!1,reason:`submission_requirement references unknown group "${t.from}"`};let n=i.filter(u=>r.has(u.id));return Jse(t,n.length,i.length)}if(Array.isArray(t.from_nested)&&t.from_nested.length>0){let i=0;for(let n of t.from_nested)Hse(n,e,r).satisfied&&(i+=1);return Jse(t,i,t.from_nested.length)}return{satisfied:!1,reason:"submission_requirement has neither `from` nor `from_nested`"}},"evaluateRequirement"),Jse=o((t,e,r)=>{let i=t.name??t.from??"<anonymous>";return t.rule==="all"?e>=r?{satisfied:!0}:{satisfied:!1,reason:`Requirement "${i}" (rule=all) needs ${r} matches, only ${e} available`}:t.rule==="pick"?typeof t.count=="number"&&e<t.count?{satisfied:!1,reason:`Requirement "${i}" (rule=pick) needs count=${t.count} matches, only ${e} available`}:typeof t.min=="number"&&e<t.min?{satisfied:!1,reason:`Requirement "${i}" (rule=pick) needs min=${t.min} matches, only ${e} available`}:t.count===void 0&&t.min===void 0&&e===0?{satisfied:!1,reason:`Requirement "${i}" (rule=pick) needs at least one match, none available`}:{satisfied:!0}:{satisfied:!1,reason:`Unknown submission_requirement rule "${t.rule}"`}},"applyRule"),tSe=o((t,e)=>t?Object.prototype.hasOwnProperty.call(e,t):!1,"formatIsPermitted"),rSe=o(async(t,e)=>{let{credential:r,format:i}=t;if(i==="jwt_vc_json"){if(typeof r=="string"){let n=Wse(r);if(n)return n}if(r&&typeof r=="object"){let n=r.proof;if(n&&typeof n=="object"){let u=n.jwt;if(typeof u=="string"){let a=Wse(u);if(a)return a}}}}if(i==="dc+sd-jwt"||i==="vc+sd-jwt"){if(!e)return r;let n=nSe(r);if(!n)return r;try{return(await e(n)).claims}catch{return r}}return r},"decodeCandidateForMatching"),nSe=o(t=>{if(typeof t=="string")return/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+~/.test(t)?t:void 0;if(t&&typeof t=="object"){let e=t.proof,i=(Array.isArray(e)?e:e?[e]:[]).find(n=>n&&typeof n=="object"&&n.type==="SdJwtCompactProof"&&typeof n.jwt=="string");if(i)return i.jwt}},"extractSdJwtCompact"),Wse=o(t=>{let e=t.split(".");if(e.length===3)try{return JSON.parse(iSe(e[1]))}catch{return}},"decodeJwtVc"),iSe=o(t=>{let r=(t+"=".repeat((4-t.length%4)%4)).replace(/-/g,"+").replace(/_/g,"/");return typeof atob=="function"?atob(r):Buffer.from(r,"base64").toString("binary")},"base64UrlDecode"),oSe=o((t,e,r)=>{if(e===0)return"You have no credentials in your wallet yet";let i=t.name??t.id;if(r){let n=Object.keys(r).join(", ");return`No credential satisfies "${i}" (required format: ${n})`}return`No credential satisfies "${i}"`},"explainNoMatches"),uSe=o(()=>{let t=typeof globalThis<"u"&&"crypto"in globalThis?globalThis.crypto:void 0;if(t&&typeof t.getRandomValues=="function"){let e=new Uint8Array(8);return t.getRandomValues(e),Array.from(e,r=>r.toString(16).padStart(2,"0")).join("")}return Math.random().toString(36).slice(2,18)},"defaultMakeId");var aSe="https://www.w3.org/2018/credentials/v1",sSe="https://www.w3.org/ns/credentials/v2",YC=o(t=>t.some(r=>{if(!r||typeof r!="object")return!1;let i=r["@context"];return(Array.isArray(i)?i:[i]).some(u=>typeof u=="string"&&u.includes("/ns/credentials/v2"))})?sSe:aSe,"vpBaseContextFor");var Yq=class Yq extends Error{constructor(e,r){super(r),this.name="BuildPresentationError",this.code=e}};o(Yq,"BuildPresentationError");var Ui=Yq,R4=o(t=>{let{pd:e,chosen:r,holder:i}=t;if(!r||r.length===0)throw new Ui("no_selections","buildPresentation requires at least one chosen credential");let n=new Set(e.input_descriptors.map(l=>l.id)),u=r.map((l,S)=>{if(!n.has(l.descriptorId))throw new Ui("unknown_descriptor",`Chosen credential at index ${S} references unknown descriptor "${l.descriptorId}"`);return{descriptorId:l.descriptorId,...lSe(l.candidate,S)}}),a=u.filter(l=>cSe(l.format)).length;if(a>0&&a!==u.length)throw new Ui("unknown_credential_format",`Mixed SD-JWT-VC + W3C-VC selections are not supported in a single PEX submission (got ${a} SD-JWT and ${u.length-a} non-SD-JWT). Submit them as separate presentations or use DCQL.`);if(a>0){if(u.length>1)throw new Ui("unknown_credential_format","PEX submission with multiple SD-JWT-VCs is not yet supported (Slice 3 supports exactly one SD-JWT per PEX submission; multi-credential SD-JWT presentations are a follow-up)");return dSe(t,u[0],i,r[0].disclose)}let p=t.envelopeFormat??mSe(e,u.map(l=>l.format)),v=t.makeId??Gse,_={"@context":[YC(u.map(l=>l.credential))],id:t.presentationId??`urn:uuid:${Xse(v)}`,type:["VerifiablePresentation"],holder:i,verifiableCredential:u.map(l=>l.credential)},b={id:t.submissionId??v(),definition_id:e.id,descriptor_map:u.map((l,S)=>({id:l.descriptorId,format:l.format,path:vSe(S,p)}))};return{unsignedVp:_,submission:b,vpFormat:p,innerFormats:u.map(l=>l.format)}},"buildPresentation"),cSe=o(t=>t==="dc+sd-jwt"||t==="vc+sd-jwt","isSdJwtFormat"),dSe=o((t,e,r,i)=>{let n=typeof e.credential=="string"?e.credential:void 0;if(!n)throw new Ui("invalid_jwt_vc",`SD-JWT-VC candidate for descriptor "${e.descriptorId}" did not normalize to a compact string`);let u=e.format,a=t.makeId??Gse,p={"@context":["https://www.w3.org/2018/credentials/v1"],id:t.presentationId??`urn:uuid:${Xse(a)}`,type:["VerifiablePresentation"],holder:r,verifiableCredential:[]},v={id:t.submissionId??a(),definition_id:t.pd.id,descriptor_map:[{id:e.descriptorId,format:e.format,path:"$"}]};return{unsignedVp:p,submission:v,vpFormat:u,innerFormats:[e.format],sdJwtSource:i?{compact:n,disclose:i}:{compact:n}}},"buildSdJwtPexPassthrough"),lSe=o((t,e)=>{let r=t.format??N4(t.credential);if(!r)throw new Ui("unknown_credential_format",`Chosen credential at index ${e} has no detectable format (provide candidate.format or a shape inferCredentialFormat recognizes)`);if(r==="jwt_vc_json"){let i=pSe(t.credential);if(!i)throw new Ui("invalid_jwt_vc",`Chosen credential at index ${e} is tagged jwt_vc_json but has no compact JWS (expected a string, or an object with string \`proof.jwt\`)`);return{credential:i,format:r}}if(r==="dc+sd-jwt"||r==="vc+sd-jwt"){let i=fSe(t.credential);if(!i)throw new Ui("invalid_jwt_vc",`Chosen credential at index ${e} is tagged ${r} but has no compact SD-JWT form (expected a string with disclosure separators, or an object with proof.type="SdJwtCompactProof" and string proof.jwt)`);return{credential:i,format:r}}return{credential:t.credential,format:r}},"normalizeForEmbedding"),fSe=o(t=>{if(typeof t=="string")return/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+~/.test(t)?t:void 0;if(t&&typeof t=="object"){let e=t.proof,i=(Array.isArray(e)?e:e?[e]:[]).find(n=>n&&typeof n=="object"&&n.type==="SdJwtCompactProof"&&typeof n.jwt=="string");if(i)return i.jwt}},"extractSdJwtCompactFromCandidate"),pSe=o(t=>{if(typeof t=="string")return/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(t)?t:void 0;if(t&&typeof t=="object"){let e=t.proof;if(e&&typeof e=="object"){let r=e.jwt;if(typeof r=="string")return r}}},"extractCompactJws"),mSe=o((t,e)=>{let r=gSe(t.format),i=hSe(e);return r.has("jwt_vp_json")&&!r.has("ldp_vp")?"jwt_vp_json":r.has("ldp_vp")&&!r.has("jwt_vp_json")?"ldp_vp":(r.has("jwt_vp_json")&&r.has("ldp_vp"),i)},"inferEnvelopeFormat"),gSe=o(t=>{let e=new Set;return t&&("jwt_vp_json"in t&&e.add("jwt_vp_json"),"ldp_vp"in t&&e.add("ldp_vp")),e},"vpFormatsFromDesignation"),hSe=o(t=>t.length===0?"ldp_vp":t.every(r=>r==="jwt_vc_json")?"jwt_vp_json":"ldp_vp","homogeneousVpFormatFromInner"),vSe=o((t,e)=>e==="jwt_vp_json"?`$.vp.verifiableCredential[${t}]`:`$.verifiableCredential[${t}]`,"pathForIndex"),Gse=o(()=>{let t=typeof globalThis<"u"&&"crypto"in globalThis?globalThis.crypto:void 0;if(t&&typeof t.getRandomValues=="function"){let e=new Uint8Array(8);return t.getRandomValues(e),Array.from(e,r=>r.toString(16).padStart(2,"0")).join("")}throw new Error("crypto.getRandomValues is required but not available. Ensure you are running in a modern browser or Node.js environment.")},"defaultMakeId"),Xse=o(t=>{let r=(t().replace(/[^0-9a-f]/gi,"")+"0".repeat(32)).slice(0,32);return[r.slice(0,8),r.slice(8,12),"4"+r.slice(13,16),(parseInt(r.charAt(16),16)&3|8).toString(16)+r.slice(17,20),r.slice(20,32)].join("-")},"makeUuidV4");var eZ=class eZ extends Error{constructor(e,r,i){super(r),this.name="VpSignError",this.code=e,i?.cause!==void 0&&(this.cause=i.cause)}};o(eZ,"VpSignError");var qr=eZ,Lu=o(async(t,e)=>t.vpFormat==="dc+sd-jwt"||t.vpFormat==="vc+sd-jwt"?ySe(t,e):(_Se(t),t.vpFormat==="jwt_vp_json"?bSe(t,e):ASe(t,e)),"signPresentation"),ySe=o(async(t,e)=>{if(typeof t.audience!="string"||t.audience.length===0)throw new qr("invalid_input","signPresentation requires a non-empty `audience`");if(typeof t.nonce!="string"||t.nonce.length===0)throw new qr("invalid_input","signPresentation requires a non-empty `nonce`");if(!t.sdJwtSource||typeof t.sdJwtSource.compact!="string")throw new qr("missing_sd_jwt_source",`vpFormat=${t.vpFormat} requires options.sdJwtSource.compact (set by buildPresentation when the chosen credential is an SD-JWT-VC)`);if(!e.sdJwtPresenter)throw new qr("missing_sd_jwt_presenter",`vpFormat=${t.vpFormat} requires helpers.sdJwtPresenter`);let r;try{r=await e.sdJwtPresenter(t.sdJwtSource.compact,{audience:t.audience,nonce:t.nonce,disclose:t.sdJwtSource.disclose})}catch(i){throw new qr("sd_jwt_present_failed",`Failed to build SD-JWT-VC presentation: ${i instanceof Error?i.message:String(i)}`,{cause:i})}return{vpToken:r.compact,vpFormat:t.vpFormat}},"presentSdJwt"),_Se=o(t=>{let{unsignedVp:e,holder:r,audience:i,nonce:n}=t;if(!e||typeof e!="object")throw new qr("invalid_input","signPresentation requires an unsignedVp object");if(typeof i!="string"||i.length===0)throw new qr("invalid_input","signPresentation requires a non-empty `audience`");if(typeof n!="string"||n.length===0)throw new qr("invalid_input","signPresentation requires a non-empty `nonce`");if(typeof r!="string"||r.length===0)throw new qr("invalid_input","signPresentation requires a non-empty `holder`");if(e.holder!==void 0&&e.holder!==r)throw new qr("holder_mismatch",`unsignedVp.holder (${e.holder}) does not match options.holder (${r})`)},"validateInput"),bSe=o(async(t,e)=>{if(!e.jwtSigner)throw new qr("missing_jwt_signer","vpFormat=jwt_vp_json requires helpers.jwtSigner");let r=t.iat??Math.floor(Date.now()/1e3),i={alg:e.jwtSigner.alg,kid:e.jwtSigner.kid,typ:"JWT"},n=t.jti??(typeof t.unsignedVp.id=="string"?t.unsignedVp.id:void 0),u={iss:t.holder,sub:t.holder,aud:t.audience,nonce:t.nonce,iat:r,vp:t.unsignedVp};n&&(u.jti=n);let a;try{a=await e.jwtSigner.sign(i,u)}catch(p){throw new qr("jwt_sign_failed",`Failed to sign jwt_vp_json: ${p instanceof Error?p.message:String(p)}`,{cause:p})}return{vpToken:a,vpFormat:"jwt_vp_json"}},"signJwtVp"),ASe=o(async(t,e)=>{if(!e.ldpVpSigner)throw new qr("missing_ldp_signer","vpFormat=ldp_vp requires helpers.ldpVpSigner");let r;try{r=await e.ldpVpSigner.sign(t.unsignedVp,{domain:t.audience,challenge:t.nonce})}catch(i){throw new qr("ldp_sign_failed",`Failed to sign ldp_vp: ${i instanceof Error?i.message:String(i)}`,{cause:i})}return{vpToken:r,vpFormat:"ldp_vp"}},"signLdpVp");var nZ=class nZ extends Error{constructor(e,r,i={}){super(r),this.name="JarmEncryptError",this.code=e,i.cause!==void 0&&(this.cause=i.cause)}};o(nZ,"JarmEncryptError");var Zr=nZ,tZ="ECDH-ES",rZ="A128GCM",e5=o(async t=>{let{payload:e,clientMetadata:r,verifierNonce:i,walletNonce:n,signer:u}=t,a=SSe(r.encrypted_response_enc_values_supported)??r.authorization_encrypted_response_enc??rZ,p=r.authorization_signed_response_alg,v=await wSe(r,t.fetchImpl),_=r.authorization_encrypted_response_alg,b=xSe(v,_),l=typeof b.alg=="string"&&b.alg.length>0?b.alg:_??tZ,S,x;if(p){if(!u)throw new Zr("missing_signer",`Verifier requires authorization_signed_response_alg=${p} but no wallet signer was supplied`);let G=await CSe(e,p,u);S=new TextEncoder().encode(G),x="JWT"}else S=new TextEncoder().encode(JSON.stringify(e)),x=void 0;let D;try{D=await Mi(b,l)}catch(G){throw new Zr("unsupported_alg",`Failed to import verifier encryption key (alg=${l}, kty=${b.kty}): ${F4(G)}`,{cause:G})}let E={alg:l,enc:a};typeof b.kid=="string"&&b.kid.length>0&&(E.kid=b.kid),x&&(E.cty=x);let z={apv:new TextEncoder().encode(i)};typeof n=="string"&&n.length>0&&(z.apu=new TextEncoder().encode(n));try{return await new vh(S).setProtectedHeader(E).setKeyManagementParameters(z).encrypt(D)}catch(G){throw new Zr("encrypt_failed",`JWE encryption failed (alg=${l}, enc=${a}): ${F4(G)}`,{cause:G})}},"encryptResponseObject"),wSe=o(async(t,e)=>{if(t.jwks&&Array.isArray(t.jwks.keys))return t.jwks.keys;if(typeof t.jwks_uri=="string"&&t.jwks_uri.length>0){let r=e??globalThis.fetch;if(typeof r!="function")throw new Zr("jwks_fetch_failed",`client_metadata.jwks_uri=${t.jwks_uri} but no fetch implementation is available`);let i;try{i=await r(t.jwks_uri,{headers:{Accept:"application/json"}})}catch(u){throw new Zr("jwks_fetch_failed",`Failed to fetch jwks_uri=${t.jwks_uri}: ${F4(u)}`,{cause:u})}if(!i.ok)throw new Zr("jwks_fetch_failed",`jwks_uri returned HTTP ${i.status} for ${t.jwks_uri}`);let n;try{n=await i.json()}catch(u){throw new Zr("invalid_jwks",`jwks_uri body was not valid JSON: ${F4(u)}`,{cause:u})}if(!n||typeof n!="object"||!Array.isArray(n.keys))throw new Zr("invalid_jwks","jwks_uri body must be a JSON object with a `keys` array");return n.keys}throw new Zr("no_encryption_key","client_metadata declares neither inline `jwks` nor `jwks_uri` \u2014 verifier cannot receive encrypted responses")},"resolveVerifierJwks"),ESe=new Set(["A128GCM","A192GCM","A256GCM","A128CBC-HS256","A192CBC-HS384","A256CBC-HS512"]),SSe=o(t=>{if(!Array.isArray(t))return;let e=t.filter(r=>typeof r=="string"&&r.length>0);return e.find(r=>ESe.has(r))??e[0]},"pickSupportedEnc"),xSe=o((t,e)=>{if(t.length===0)throw new Zr("no_encryption_key","Verifier JWKS contained no keys");let r=t.filter(n=>n.use!=="sig");if(r.length===0)throw new Zr("no_encryption_key",'Verifier JWKS contains only `use:"sig"` keys; no encryption-capable key advertised');if(e){let n=r.find(u=>u.alg===e);if(n)return n}let i=r.find(n=>typeof n.alg=="string"&&n.alg.length>0);return i||r[0]},"pickEncryptionKey"),CSe=o(async(t,e,r)=>{try{return await r.sign({alg:e,kid:r.kid,typ:"JWT"},t)}catch(i){throw new Zr("sign_failed",`Wallet signer failed during JARM inner-JWS signing: ${F4(i)}`,{cause:i})}},"signResponse"),F4=o(t=>t instanceof Error?t.message:String(t),"describe");var iZ=class iZ extends Error{constructor(e,r,i={}){super(r),this.name="VpSubmitError",this.code=e,this.status=i.status,this.body=i.body,i.cause!==void 0&&(this.cause=i.cause)}};o(iZ,"VpSubmitError");var yi=iZ,Fm=o(async t=>{let{responseUri:e,vpToken:r,submission:i,state:n}=t;if(typeof e!="string"||e.length===0)throw new yi("invalid_input","`responseUri` must be a non-empty string");if(r==null)throw new yi("invalid_input","`vpToken` is required");if(i!==void 0&&(i===null||typeof i!="object"))throw new yi("invalid_input","`submission` must be a PresentationSubmission object when provided (omit it entirely for DCQL flows)");let u=t.fetchImpl??globalThis.fetch;if(typeof u!="function")throw new yi("no_fetch","No fetch implementation available; pass `fetchImpl` or configure the plugin with one");let p=t.responseMode==="direct_post.jwt"?await DSe({vpToken:r,submission:i,state:n,idToken:t.idToken,clientMetadata:t.clientMetadata,nonce:t.nonce,signer:t.signer,fetchImpl:u}):kSe({vpToken:r,submission:i,state:n,idToken:t.idToken}),v;try{v=await u(e,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json, text/plain;q=0.9, */*;q=0.8"},body:p})}catch(b){throw new yi("network_error",`Failed to POST to ${e}: ${b instanceof Error?b.message:String(b)}`,{cause:b})}let _=await ISe(v);if(!v.ok)throw new yi("server_error",`Verifier returned ${v.status} ${v.statusText||""}`.trim(),{status:v.status,body:_});return{status:v.status,redirectUri:PSe(_),body:_}},"submitPresentation"),kSe=o(t=>{let e=new URLSearchParams;return e.set("vp_token",$Se(t.vpToken)),t.submission&&e.set("presentation_submission",JSON.stringify(t.submission)),typeof t.idToken=="string"&&t.idToken.length>0&&e.set("id_token",t.idToken),typeof t.state=="string"&&t.state.length>0&&e.set("state",t.state),e.toString()},"encodeFormBody"),$Se=o(t=>typeof t=="string"?t:JSON.stringify(t),"stringifyVpToken"),DSe=o(async t=>{if(!t.clientMetadata)throw new yi("invalid_input","response_mode=direct_post.jwt requires `clientMetadata` (verifier's JWKS + JWE algs)");if(typeof t.nonce!="string"||t.nonce.length===0)throw new yi("invalid_input","response_mode=direct_post.jwt requires the verifier `nonce` for the JWE `apv` ECDH-ES KDF input");let e={vp_token:t.vpToken};t.submission&&(e.presentation_submission=t.submission),typeof t.state=="string"&&t.state.length>0&&(e.state=t.state),typeof t.idToken=="string"&&t.idToken.length>0&&(e.id_token=t.idToken);let r;try{r=await e5({payload:e,clientMetadata:t.clientMetadata,verifierNonce:t.nonce,signer:t.signer,fetchImpl:t.fetchImpl})}catch(n){throw n instanceof Zr?new yi("jarm_encrypt_failed",`Failed to build JARM response (${n.code}): ${n.message}`,{cause:n}):n}let i=new URLSearchParams;return i.set("response",r),i.toString()},"encodeJarmBody"),ISe=o(async t=>{let e=await t.text().catch(()=>"");if(!e)return;if((t.headers.get("content-type")??"").includes("application/json"))try{return JSON.parse(e)}catch{return e}try{return JSON.parse(e)}catch{return e}},"parseResponseBody"),PSe=o(t=>{if(t&&typeof t=="object"){let e=t.redirect_uri;if(typeof e=="string"&&e.length>0)return e}},"extractRedirectUri");var uZ=class uZ extends Error{constructor(e,r,i){super(r),this.name="SiopSignError",this.code=e,i?.cause!==void 0&&(this.cause=i.cause)}};o(uZ,"SiopSignError");var Mu=uZ,U4=o(async(t,e)=>{BSe(t,e);let{holder:r,audience:i,nonce:n}=t,u=t.iat??Math.floor(Date.now()/1e3),a=u+(t.lifetimeSeconds??300),p=t.issuerMode??"did",v={alg:e.signer.alg,kid:e.signer.kid,typ:"JWT"},_={iss:p==="did"?r:"https://self-issued.me/v2",sub:r,aud:i,nonce:n,iat:u,exp:a};t.vpTokenHash&&(_._vp_token={vp_token_hash:t.vpTokenHash});let b;try{b=await e.signer.sign(v,_)}catch(l){throw new Mu("id_token_sign_failed",`Failed to sign SIOPv2 id_token: ${l instanceof Error?l.message:String(l)}`,{cause:l})}return{idToken:b}},"signIdToken"),BSe=o((t,e)=>{if(!e.signer)throw new Mu("missing_signer","signIdToken requires helpers.signer");if(typeof t.holder!="string"||t.holder.length===0)throw new Mu("invalid_input","signIdToken requires a non-empty `holder`");if(typeof t.audience!="string"||t.audience.length===0)throw new Mu("invalid_input","signIdToken requires a non-empty `audience`");if(typeof t.nonce!="string"||t.nonce.length===0)throw new Mu("invalid_input","signIdToken requires a non-empty `nonce`")},"validateInput"),oZ=o(t=>t?new Set(t.split(/\s+/).filter(Boolean)):new Set,"responseTypeSet"),t5=o(t=>oZ(t).has("id_token"),"requiresIdToken");var aZ=o(async(t,e={})=>{let r=t.format??FSe(t.credential);if(r==="jwt_vc_json")return OSe(t.credential);if(r==="ldp_vc")return zSe(t.credential);if(r==="dc+sd-jwt"||r==="vc+sd-jwt")return jSe(t.credential,r,e.sdJwtParser)},"adaptCredentialForDcql"),r5=o(async(t,e={})=>(await Promise.all(t.map(async i=>({original:i,adapted:await aZ(i,e)})))).filter(i=>i.adapted!==void 0),"adaptCredentialsForDcql"),jSe=o(async(t,e,r)=>{if(!r)return;let i=TSe(t);if(!i)return;let n;try{n=await r(i)}catch{return}let u=typeof n.vct=="string"&&n.vct.length>0?n.vct:typeof n.claims.vct=="string"?n.claims.vct:void 0;if(u)return{credential_format:e,vct:u,claims:n.claims,cryptographic_holder_binding:!!n.holderPublicKey}},"adaptSdJwt"),TSe=o(t=>{if(typeof t=="string")return/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+~/.test(t)?t:void 0;if(t&&typeof t=="object"){let e=t.proof,i=(Array.isArray(e)?e:e?[e]:[]).find(n=>n&&typeof n=="object"&&n.type==="SdJwtCompactProof"&&typeof n.jwt=="string");if(i)return i.jwt}},"extractSdJwtCompact"),OSe=o(t=>{let e;if(typeof t=="string")e=Qse(t);else if(t&&typeof t=="object"){let u=t.proof;if(u&&typeof u=="object"){let a=u.jwt;typeof a=="string"&&(e=Qse(a))}}if(!e)return;let r=e.vc;if(!r||typeof r!="object"||Array.isArray(r))return;let i=r,n=Yse(i.type);if(n.length!==0)return{credential_format:"jwt_vc_json",type:n,claims:i,cryptographic_holder_binding:!0}},"adaptJwtVc"),zSe=o(t=>{if(!t||typeof t!="object"||Array.isArray(t))return;let e=t,r=Yse(e.type);if(r.length!==0)return{credential_format:"ldp_vc",type:RSe(r),claims:e,cryptographic_holder_binding:!0}},"adaptLdpVc"),Yse=o(t=>Array.isArray(t)?t.filter(e=>typeof e=="string"):typeof t=="string"?[t]:[],"extractTypes"),NSe={VerifiableCredential:"https://www.w3.org/2018/credentials#VerifiableCredential",VerifiablePresentation:"https://www.w3.org/2018/credentials#VerifiablePresentation",OpenBadgeCredential:"https://purl.imsglobal.org/spec/vc/ob/vocab.html#OpenBadgeCredential",AchievementCredential:"https://purl.imsglobal.org/spec/vc/ob/vocab.html#AchievementCredential",ClrCredential:"https://purl.imsglobal.org/spec/vc/clr/vocab.html#ClrCredential"},RSe=o(t=>{let e=t.map(r=>NSe[r]).filter(r=>!!r&&!t.includes(r));return e.length>0?[...t,...e]:t},"withExpandedTypeIris"),FSe=o(t=>{if(typeof t=="string")return/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+~/.test(t)?"dc+sd-jwt":/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(t)?"jwt_vc_json":void 0;if(t&&typeof t=="object"&&!Array.isArray(t)){let e=t.proof,r=(Array.isArray(e)?e:e?[e]:[]).filter(u=>!!u&&typeof u=="object");if(r.find(u=>u.type==="SdJwtCompactProof"))return"dc+sd-jwt";let n=r[0];if(n)return n.type==="JwtProof2020"?"jwt_vc_json":"ldp_vc"}},"inferDcqlFormat"),Qse=o(t=>{let e=t.split(".");if(e.length===3)try{let r=JSON.parse(USe(e[1]));return r&&typeof r=="object"&&!Array.isArray(r)?r:void 0}catch{return}},"decodeJwtPayload"),USe=o(t=>{let r=(t+"=".repeat((4-t.length%4)%4)).replace(/-/g,"+").replace(/_/g,"/");return typeof atob=="function"?atob(r):Buffer.from(r,"base64").toString("binary")},"base64UrlDecode");var n5=o(async(t,e,r={})=>{let i=await r5(t,{sdJwtParser:r.sdJwtParser}),n=i.map(p=>p.adapted),u=Us.query(e,n),a={};for(let[p,v]of Object.entries(u.credential_matches)){if(v.success){let _=v.valid_credentials.map(b=>i[b.input_credential_index]?.original).filter(b=>b!==void 0);a[p]={credentialQueryId:p,candidates:_};continue}a[p]={credentialQueryId:p,candidates:[],reason:`No held credential satisfies query "${p}"`}}return{canSatisfy:u.can_be_satisfied,matches:a,reason:u.can_be_satisfied?void 0:"No combination of held credentials satisfies the verifier's DCQL query",raw:u}},"selectCredentialsForDcql");var sZ=class sZ extends Error{constructor(e,r){super(r),this.name="BuildDcqlPresentationError",this.code=e}};o(sZ,"BuildDcqlPresentationError");var vo=sZ,i5=o(t=>{let{query:e,chosen:r,holder:i}=t;if(r.length===0)throw new vo("no_selections","buildDcqlPresentations requires at least one chosen credential");let n=t.makeId??JSe,u=new Map;for(let v of r){let _=u.get(v.credentialQueryId);_?(_.candidates.push(v.candidate),!_.disclose&&v.disclose&&(_.disclose=v.disclose)):u.set(v.credentialQueryId,{candidates:[v.candidate],disclose:v.disclose})}let a=new Map;for(let v of e.credentials)a.set(v.id,v);let p=[];for(let v of e.credentials){let _=u.get(v.id);_&&(p.push(VSe(v,_.candidates,i,n,_.disclose)),u.delete(v.id))}if(u.size>0){let v=Array.from(u.keys()).join(", ");throw new vo("unknown_credential_query",`chosen credentials reference query ids the DCQL query doesn't declare: ${v}`)}return p},"buildDcqlPresentations"),VSe=o((t,e,r,i,n)=>{if(t.format==="dc+sd-jwt"||t.format==="vc+sd-jwt")return qSe(t,e,n);let u=LSe(t.format,t.id),a=e.map((v,_)=>MSe(v,t.id,_)),p={"@context":[YC(a)],id:`urn:uuid:${WSe(i)}`,type:["VerifiablePresentation"],holder:r,verifiableCredential:a};return{kind:"vp",credentialQueryId:t.id,unsignedVp:p,vpFormat:u,candidates:e}},"buildOnePresentation"),qSe=o((t,e,r)=>{if(e.length!==1)throw new vo("invalid_sd_jwt_vc",`DCQL query "${t.id}" (format=${t.format}) received ${e.length} candidates; SD-JWT-VC passthrough currently supports exactly one candidate per query id (DCQL multiple:true for SD-JWT is a follow-up)`);let i=ZSe(e[0]);if(!i)throw new vo("invalid_sd_jwt_vc",`DCQL query "${t.id}" (format=${t.format}) candidate is not a recognizable SD-JWT-VC compact form (expected a string or a W3C-wrapped object with proof.jwt of shape "<header>.<payload>.<sig>~<disclosure>*~<kb>?")`);return{kind:"sd-jwt-vc",credentialQueryId:t.id,compact:i,vpFormat:t.format,candidates:e,...r?{disclose:r}:{}}},"buildSdJwtPassthrough"),ZSe=o(t=>{let e=t.credential;if(typeof e=="string")return ece(e)?e:void 0;if(e&&typeof e=="object"){let r=e.proof,i=Array.isArray(r)?r:r?[r]:[];for(let n of i){if(!n||typeof n!="object")continue;let u=n.jwt;if(typeof u=="string"&&ece(u))return u}}},"extractSdJwtCompact"),ece=o(t=>t.includes("~")&&/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+~/.test(t),"looksLikeSdJwtCompact"),LSe=o((t,e)=>{if(t==="jwt_vc_json")return"jwt_vp_json";if(t==="ldp_vc")return"ldp_vp";throw new vo("unsupported_format",`DCQL query "${e}" requests format "${t}", which the plugin doesn't yet build presentations for (mso_mdoc is tracked for a follow-up slice)`)},"vpFormatForQueryFormat"),MSe=o((t,e,r)=>{let i=t.credential;if(typeof i=="string"){if(/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(i))return i;throw new vo("invalid_jwt_vc",`chosen candidate at index ${r} for query "${e}" is a string but not a compact JWS`)}if(i&&typeof i=="object"){let n=i.proof;if(n&&typeof n=="object"){let u=n.jwt;if(typeof u=="string")return u}return i}throw new vo("invalid_jwt_vc",`chosen candidate at index ${r} for query "${e}" is neither a JWT string nor a JSON object`)},"normalizeForEmbedding"),JSe=o(()=>{let t=typeof globalThis<"u"&&"crypto"in globalThis?globalThis.crypto:void 0;if(t&&typeof t.getRandomValues=="function"){let e=new Uint8Array(8);return t.getRandomValues(e),Array.from(e,r=>r.toString(16).padStart(2,"0")).join("")}return Math.random().toString(36).slice(2,18)},"defaultMakeId"),WSe=o(t=>{let r=(t().replace(/[^0-9a-f]/gi,"")+"0".repeat(32)).slice(0,32);return[r.slice(0,8),r.slice(8,12),"4"+r.slice(13,16),(parseInt(r.slice(16,17),16)&3|8).toString(16)+r.slice(17,20),r.slice(20,32)].join("-")},"makeUuidV4");var lZ=class lZ extends Error{constructor(e,r,i){super(r),this.name="DcqlSignError",this.code=e,i?.cause!==void 0&&(this.cause=i.cause)}};o(lZ,"DcqlSignError");var Um=lZ,cZ=o(async(t,e)=>{let r=[];for(let i of t.built){if(i.kind==="sd-jwt-vc"){r.push(await KSe(i,t,e));continue}let n=await Lu({unsignedVp:i.unsignedVp,vpFormat:i.vpFormat,audience:t.audience,nonce:t.nonce,holder:t.holder,iat:t.iat},e);r.push({credentialQueryId:i.credentialQueryId,vpToken:n.vpToken,vpFormat:i.vpFormat})}return r},"signDcqlPresentations"),KSe=o(async(t,e,r)=>{if(!r.sdJwtPresenter)throw new Um("missing_sd_jwt_presenter",`BuiltDcqlPresentation for query "${t.credentialQueryId}" is kind=sd-jwt-vc but helpers.sdJwtPresenter was not provided`);let i;try{i=await r.sdJwtPresenter(t.compact,{audience:e.audience,nonce:e.nonce,disclose:t.disclose})}catch(n){throw new Um("sd_jwt_present_failed",`SD-JWT-VC presenter failed for query "${t.credentialQueryId}": ${n instanceof Error?n.message:String(n)}`,{cause:n})}return{credentialQueryId:t.credentialQueryId,vpToken:i.compact,vpFormat:t.vpFormat}},"presentSdJwtEntry"),o5=o(async(t,e)=>{let r=await cZ(t,e);return{vpToken:dZ(r),presentations:r}},"buildDcqlResponse"),dZ=o(t=>{var r;let e={};for(let i of t)(e[r=i.credentialQueryId]??(e[r]=[])).push(i.vpToken);return e},"assembleDcqlVpToken");var nce=o((t,e={})=>{let r=e.fetch??globalThis.fetch,i={didResolver:e.didResolver,trustedX509Roots:e.trustedX509Roots,unsafeAllowSelfSigned:e.unsafeAllowSelfSignedRequestObject,unsafeSkipRequestObjectSignatureVerification:e.unsafeSkipRequestObjectSignatureVerification},n=o(async u=>{let a=c6(u);if(a.kind==="by_value")return a.offer;if(typeof r!="function")throw new kt("invalid_uri","No fetch implementation available; pass `config.fetch` to getOpenID4VCPlugin()");let p=await hD(a.uri,r);if(p.kind!=="by_value")throw new kt("invalid_uri","Unexpected by_reference result after resolving credential_offer_uri");return p.offer},"resolveOffer");return{name:"OpenID4VC",displayName:"OpenID4VC",description:"OpenID for Verifiable Credentials holder support \u2014 Credential Offers, VCI, VP, and SIOPv2.",methods:{parseCredentialOffer:o((u,a)=>c6(a),"parseCredentialOffer"),resolveCredentialOffer:o(async(u,a)=>n(a),"resolveCredentialOffer"),acceptCredentialOffer:o(async(u,a,p={})=>{let v=typeof a=="string"?await n(a):a,_=await q4(u,p);return $6({offer:v,signer:_,diVpSigner:V4(u),options:p,fetchImpl:r})},"acceptCredentialOffer"),exchangePreAuthCodeForToken:o(async(u,a,p={})=>{let v=typeof a=="string"?await n(a):a;return i2({offer:v,options:p,fetchImpl:r})},"exchangePreAuthCodeForToken"),requestCredentialsFromPreAuthToken:o(async(u,a)=>{let p=typeof a.input=="string"?await n(a.input):a.input,v=a.signer??await q4(u,{});return o2({offer:p,tokenResponse:a.tokenResponse,signer:v,diVpSigner:V4(u),options:a.options,fetchImpl:r})},"requestCredentialsFromPreAuthToken"),acceptAndStoreCredentialOffer:o(async(u,a,p={})=>{let v=await(async()=>{let b=typeof a=="string"?await n(a):a,l=await q4(u,p);return $6({offer:b,signer:l,diVpSigner:V4(u),options:p,fetchImpl:r})})(),_=await Lj(u,v,YSe(p));return{...v,..._}},"acceptAndStoreCredentialOffer"),beginCredentialOfferAuthCode:o(async(u,a,p)=>{let v=typeof a=="string"?await n(a):a;return l2({offer:v,redirectUri:p.redirectUri,clientId:p.clientId,configurationIds:p.configurationIds,scope:p.scope,fetchImpl:r})},"beginCredentialOfferAuthCode"),completeCredentialOfferAuthCode:o(async(u,a)=>{let p=a.signer??await q4(u,{});return f2({flowHandle:a.flowHandle,code:a.code,state:a.state,signer:p,diVpSigner:V4(u),fetchImpl:r})},"completeCredentialOfferAuthCode"),exchangeAuthCodeForToken:o(async(u,a)=>D6({flowHandle:a.flowHandle,code:a.code,state:a.state,fetchImpl:r}),"exchangeAuthCodeForToken"),requestCredentialsFromAuthCodeToken:o(async(u,a)=>{let p=a.signer??await q4(u,{});return I6({flowHandle:a.flowHandle,tokenResponse:a.tokenResponse,signer:p,diVpSigner:V4(u),fetchImpl:r})},"requestCredentialsFromAuthCodeToken"),parseAuthorizationRequest:o((u,a)=>D4(a),"parseAuthorizationRequest"),resolveAuthorizationRequest:o(async(u,a)=>I4(a,r,i),"resolveAuthorizationRequest"),prepareVerifiablePresentation:o(async(u,a,p)=>{let v=await Vm(a,r,i),_=QSe(u);if(v.dcql_query){let b=await n5(p,v.dcql_query,{sdJwtParser:_});return{request:v,dcqlSelection:b}}if(v.presentation_definition){let b=await QC(p,v.presentation_definition,{sdJwtParser:_});return{request:v,selection:b}}return{request:v,selection:{descriptors:[],canSatisfy:!0,reason:void 0}}},"prepareVerifiablePresentation"),buildPresentation:o(async(u,a,p,v={})=>{let _=await Vm(a,r,i),b=rce(_),l=v.holder??u.id.did(),S=R4({pd:b,chosen:p,holder:l,envelopeFormat:v.envelopeFormat});return{request:_,prepared:S}},"buildPresentation"),signPresentation:o(async(u,a,p,v={})=>{let _=await Vm(a,r,i),b=v.holder??(typeof p.unsignedVp.holder=="string"?p.unsignedVp.holder:u.id.did());if(p.vpFormat==="jwt_vp_json"){let l=v.signer??await u5(u);return Lu({unsignedVp:p.unsignedVp,vpFormat:p.vpFormat,audience:_.client_id,nonce:_.nonce,holder:b},{jwtSigner:l})}return p.vpFormat==="dc+sd-jwt"||p.vpFormat==="vc+sd-jwt"?Lu({unsignedVp:p.unsignedVp,vpFormat:p.vpFormat,audience:_.client_id,nonce:_.nonce,holder:b,sdJwtSource:p.sdJwtSource},{sdJwtPresenter:gZ(u)}):Lu({unsignedVp:p.unsignedVp,vpFormat:p.vpFormat,audience:_.client_id,nonce:_.nonce,holder:b},{ldpVpSigner:mZ(u,_)})},"signPresentation"),submitPresentation:o(async(u,a,p,v,_={})=>{let b=await Vm(a,r,i);tce(b);let l=b.response_uri??b.redirect_uri;if(!l)throw new Error("Authorization Request has no response_uri / redirect_uri \u2014 cannot submitPresentation");return Fm({responseUri:l,vpToken:p.vpToken,submission:v,idToken:_.idToken,state:b.state,fetchImpl:r,...fZ(b,await pZ(u,b))})},"submitPresentation"),signIdToken:o(async(u,a,p={})=>{let v=await Vm(a,r,i),_=p.holder??u.id.did(),b=p.signer??await u5(u);return U4({holder:_,audience:v.client_id,nonce:v.nonce,lifetimeSeconds:p.lifetimeSeconds,issuerMode:p.issuerMode,vpTokenHash:p.vpTokenHash},{signer:b})},"signIdToken"),presentCredentials:o(async(u,a,p,v={})=>{let _=await Vm(a,r,i);tce(_);let b=v.holder??u.id.did(),l=v.signer,S=o(async()=>(l||(l=await u5(u)),l),"ensureSharedJwtSigner"),x=o(async()=>{if(t5(_.response_type))return U4({holder:b,audience:_.client_id,nonce:_.nonce},{signer:await S()})},"signIdTokenIfRequested"),D=_.response_uri??_.redirect_uri;if(!D)throw new Error("Authorization Request has no response_uri / redirect_uri \u2014 cannot presentCredentials");if(_.dcql_query){let et=GSe(p),tt=i5({query:_.dcql_query,chosen:et,holder:b}),St=tt.some(Tt=>Tt.vpFormat==="jwt_vp_json"),ke=tt.some(Tt=>Tt.vpFormat==="ldp_vp"),Ke=tt.some(Tt=>Tt.kind==="sd-jwt-vc"),Nt={...St?{jwtSigner:await S()}:{},...ke?{ldpVpSigner:mZ(u,_)}:{},...Ke?{sdJwtPresenter:gZ(u)}:{}},q=await o5({built:tt,audience:_.client_id,nonce:_.nonce,holder:b},Nt),hr=await x(),dr=await Fm({responseUri:D,vpToken:q.vpToken,idToken:hr?.idToken,state:_.state,fetchImpl:r,...fZ(_,await pZ(u,_))});return{request:_,dcqlBuilt:tt,dcqlSigned:q.presentations,dcqlVpToken:q.vpToken,signedIdToken:hr,submitted:dr}}let E=rce(_),z=HSe(p),G=R4({pd:E,chosen:z,holder:b,envelopeFormat:v.envelopeFormat}),De=G.vpFormat==="jwt_vp_json"?{jwtSigner:await S()}:G.vpFormat==="ldp_vp"?{ldpVpSigner:mZ(u,_)}:{sdJwtPresenter:gZ(u)},we=await Lu({unsignedVp:G.unsignedVp,vpFormat:G.vpFormat,audience:_.client_id,nonce:_.nonce,holder:b,sdJwtSource:G.sdJwtSource},De),pe=await x(),ue=await Fm({responseUri:D,vpToken:we.vpToken,submission:G.submission,idToken:pe?.idToken,state:_.state,fetchImpl:r,...fZ(_,await pZ(u,_))});return{request:_,prepared:G,signed:we,signedIdToken:pe,submitted:ue}},"presentCredentials")}}},"getOpenID4VCPlugin"),Vm=o(async(t,e,r)=>typeof t=="string"?await I4(t,e,r):t,"resolveRequestInput"),tce=o(t=>{if(t.transaction_data&&t.transaction_data.length>0)throw new $e("invalid_transaction_data","Authorization Request includes transaction_data, which this Wallet does not support")},"assertTransactionDataUnsupported"),rce=o(t=>{if(!t.presentation_definition)throw new Error("Authorization Request has no presentation_definition \u2014 cannot build a VP");return t.presentation_definition},"requirePresentationDefinition"),HSe=o(t=>{for(let[e,r]of t.entries())if(!("descriptorId"in r)||typeof r.descriptorId!="string")throw new Error(`chosen[${e}] is missing 'descriptorId' \u2014 PEX requests need ChosenCredential entries (received DCQL-shape entry with credentialQueryId="${r.credentialQueryId}")`);return t},"assertPexChosen"),GSe=o(t=>{for(let[e,r]of t.entries())if(!("credentialQueryId"in r)||typeof r.credentialQueryId!="string")throw new Error(`chosen[${e}] is missing 'credentialQueryId' \u2014 DCQL requests need DcqlChosenCredential entries (received PEX-shape entry with descriptorId="${r.descriptorId}")`);return t},"assertDcqlChosen"),fZ=o((t,e)=>t.response_mode!=="direct_post.jwt"?{}:{responseMode:"direct_post.jwt",clientMetadata:t.client_metadata,nonce:t.nonce,signer:e},"buildJarmOptions"),pZ=o(async(t,e)=>{if(e.response_mode!=="direct_post.jwt")return;let r=e.client_metadata?.authorization_signed_response_alg;if(!(typeof r!="string"||r.length===0))return u5(t)},"maybeJarmSigner"),u5=o(async t=>{let e=hZ(t,"VP signing"),r=t.id.did(),i=await t.invoke.didToVerificationMethod(r);return k6({keypair:e,kid:i})},"ensureVpJwtSigner"),V4=o(t=>({holder:t.id.did(),signPresentation:o(async(e,{domain:r,challenge:i,cryptosuite:n})=>t.invoke.issuePresentation(e,{proofPurpose:"authentication",domain:r,challenge:i,...n?{type:"DataIntegrityProof",cryptosuite:n}:{}}),"signPresentation")}),"buildDiVpSigner"),mZ=o((t,e)=>({sign:o(async(r,{domain:i,challenge:n})=>t.invoke.issuePresentation(r,{domain:i,challenge:n,...XSe(e?.client_metadata)}),"sign")}),"buildLdpVpSigner"),XSe=o(t=>{let r=(t?.vp_formats_supported??t?.vp_formats)?.ldp_vp;if(!r)return{};let i=r.proof_type_values??r.proof_type;if(!Array.isArray(i)||!i.includes("DataIntegrityProof"))return{};let n=Array.isArray(r.cryptosuite_values)?r.cryptosuite_values:[],a=["eddsa-rdfc-2022","eddsa-2022","json-eddsa-2022"].find(p=>n.includes(p))??(n.length===0?"eddsa-rdfc-2022":void 0);return a?{type:"DataIntegrityProof",cryptosuite:a,proofPurpose:"authentication"}:{}},"ldpVpProofOptionsFromClientMetadata"),QSe=o(t=>{let e=t.invoke;if(typeof e?.parseSdJwtVc=="function")return async r=>{let i=await e.parseSdJwtVc(r);return{claims:i.claims,vct:i.vct,issuer:i.issuer,holderPublicKey:i.holderPublicKey}}},"buildSdJwtParser"),gZ=o(t=>{let e=t.invoke;if(typeof e?.presentSdJwtVc=="function")return async(r,{audience:i,nonce:n,disclose:u})=>{let a=hZ(t,"SD-JWT-VC KB-JWT signing"),p=await Mi({kty:a.kty,crv:a.crv,x:a.x,d:a.d},"EdDSA"),v=o(async b=>{let l=b.indexOf(".");if(l<=0||l>=b.length-1)throw new Error("KB-JWT signer received malformed JWS signing input (no dot separator)");let S=b.slice(0,l),x=b.slice(l+1),D=o(we=>{let pe=we.replace(/-/g,"+").replace(/_/g,"/"),ue=pe+"=".repeat((4-pe.length%4)%4),et=typeof Buffer<"u"?Buffer.from(ue,"base64").toString("utf-8"):new TextDecoder().decode(Uint8Array.from(atob(ue),tt=>tt.charCodeAt(0)));return JSON.parse(et)},"decode"),E=D(S),z=D(x),De=(await new Es(z).setProtectedHeader(E).sign(p)).split(".")[2];if(!De)throw new Error("KB-JWT signing produced no signature segment");return De},"kbSigner");return{compact:(await e.presentSdJwtVc(r,{audience:i,nonce:n,kbSigner:v,kbSignAlg:"EdDSA",...u?{disclose:u}:{}})).compact}}},"buildSdJwtPresenter"),q4=o(async(t,e)=>{if(e.signer)return e.signer;let r=hZ(t,"VCI proof-of-possession"),i=t.id.did(),n=await t.invoke.didToVerificationMethod(i);return k6({keypair:r,kid:n})},"ensureSigner"),hZ=o((t,e)=>{let r;try{r=t.id.keypair("ed25519")}catch(i){throw new Error(`OpenID4VC ${e} requires an Ed25519 keypair on the host LearnCard, but \`id.keypair('ed25519')\` threw: ${i instanceof Error?i.message:String(i)}. Pass \`options.signer\` to bring your own signer (HSM / secp256k1 / external backend).`)}if(!r||r.kty!=="OKP"||r.crv!=="Ed25519")throw new Error(`OpenID4VC ${e} requires an Ed25519 keypair, but the host LearnCard returned ${r?`kty=${r.kty} crv=${r.crv??"<none>"}`:"no keypair"}. Pass \`options.signer\` to bring your own signer (HSM / secp256k1 / external backend).`);return r},"requireEd25519Keypair"),YSe=o(t=>({storage:t.storage,encrypt:t.encrypt,category:t.category,title:t.title,imgUrl:t.imgUrl,upload:t.upload,addToIndex:t.addToIndex,makeId:t.makeId}),"splitStoreOptions");var vZ=o(t=>Ca(t),"buildDcqlQuery"),ice=o(t=>{let e=t.format??"jwt_vc_json";if(t.types.length===0)throw new Error("requestW3cVc: `types` must contain at least one type string");let r={id:t.id,format:e,meta:{type_values:[Array.from(t.types)]}};return t.claims&&t.claims.length>0&&(r.claims=t.claims.map(i=>{let n={path:Array.from(i.path)};return i.values&&i.values.length>0&&(n.values=Array.from(i.values)),i.id&&(n.id=i.id),n})),t.requireHolderBinding===!1&&(r.require_cryptographic_holder_binding=!1),vZ({credentials:[r]})},"requestW3cVc");
|
|
164
164
|
/*! Bundled license information:
|
|
165
165
|
|
|
166
166
|
reflect-metadata/Reflect.js:
|