@learncard/openid4vc-plugin 0.3.5 → 0.3.6

package/dist/vp/present.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"present.d.ts","sourceRoot":"","sources":["../../src/vp/present.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAI9C,OAAO,KAAK,EACR,mBAAmB,EACnB,sBAAsB,EAEzB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAMH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,aAAa,GAAG,WAAW,GAAG,WAAW,CAAC;AAE5E;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,mBAAmB,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CACjC;AAED,MAAM,WAAW,wBAAwB;IACrC,wFAAwF;IACxF,EAAE,EAAE,sBAAsB,CAAC;IAE3B;;;;OAIG;IACH,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAE3B,uFAAuF;IACvF,MAAM,EAAE,MAAM,CAAC;IAEf;;;;OAIG;IACH,cAAc,CAAC,EAAE,QAAQ,CAAC;IAE1B,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,uDAAuD;IACvD,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACjC;;;;;;;;;;;;OAYG;IACH,UAAU,EAAE,UAAU,CAAC;IAEvB,0DAA0D;IAC1D,UAAU,EAAE,sBAAsB,CAAC;IAEnC,gCAAgC;IAChC,QAAQ,EAAE,QAAQ,CAAC;IAEnB;;;;OAIG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;IAEvB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE;QACV,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,kBAAkB,CAAC;KACjC,CAAC;CACL;AAMD,MAAM,MAAM,0BAA0B,GAChC,eAAe,GACf,oBAAoB,GACpB,2BAA2B,GAC3B,gBAAgB,CAAC;AAEvB,qBAAa,sBAAuB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;gBAE9B,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,MAAM;CAKhE;AAMD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iBAAiB,GAAI,SAAS,wBAAwB,KAAG,oBAmFrE,CAAC"}
+{"version":3,"file":"present.d.ts","sourceRoot":"","sources":["../../src/vp/present.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAI9C,OAAO,KAAK,EACR,mBAAmB,EACnB,sBAAsB,EAEzB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAMH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,aAAa,GAAG,WAAW,GAAG,WAAW,CAAC;AAE5E;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,mBAAmB,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CACjC;AAED,MAAM,WAAW,wBAAwB;IACrC,wFAAwF;IACxF,EAAE,EAAE,sBAAsB,CAAC;IAE3B;;;;OAIG;IACH,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAE3B,uFAAuF;IACvF,MAAM,EAAE,MAAM,CAAC;IAEf;;;;OAIG;IACH,cAAc,CAAC,EAAE,QAAQ,CAAC;IAE1B,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,uDAAuD;IACvD,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACjC;;;;;;;;;;;;OAYG;IACH,UAAU,EAAE,UAAU,CAAC;IAEvB,0DAA0D;IAC1D,UAAU,EAAE,sBAAsB,CAAC;IAEnC,gCAAgC;IAChC,QAAQ,EAAE,QAAQ,CAAC;IAEnB;;;;OAIG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;IAEvB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE;QACV,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,kBAAkB,CAAC;KACjC,CAAC;CACL;AAMD,MAAM,MAAM,0BAA0B,GAClC,eAAe,GAAG,oBAAoB,GAAG,2BAA2B,GAAG,gBAAgB,CAAC;AAE5F,qBAAa,sBAAuB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;gBAE9B,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,MAAM;CAKhE;AAMD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iBAAiB,GAAI,SAAS,wBAAwB,KAAG,oBAiFrE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@learncard/openid4vc-plugin",
-    "version": "0.3.5",
+    "version": "0.3.6",
     "description": "OpenID for Verifiable Credentials (OID4VCI + OID4VP + SIOPv2) holder support for LearnCard",
     "type": "module",
     "main": "./dist/index.cjs",
@@ -51,9 +51,9 @@
     },
     "types": "./dist/index.d.ts",
     "dependencies": {
-        "@learncard/core": "9.4.32",
-        "@learncard/didkit-plugin": "^1.9.12",
-        "@learncard/vc-plugin": "^1.5.12",
+        "@learncard/core": "9.4.33",
+        "@learncard/didkit-plugin": "^1.9.13",
+        "@learncard/vc-plugin": "^1.5.13",
         "@peculiar/x509": "^1.12.0",
         "dcql": "^3.0.0",
         "jose": "^5.9.6",

package/src/vp/present.ts

@@ -164,10 +164,7 @@ export interface PreparedPresentation {
 /* -------------------------------------------------------------------------- */
 
 export type BuildPresentationErrorCode =
-    | 'no_selections'
-    | 'unknown_descriptor'
-    | 'unknown_credential_format'
-    | 'invalid_jwt_vc';
+    'no_selections' | 'unknown_descriptor' | 'unknown_credential_format' | 'invalid_jwt_vc';
 
 export class BuildPresentationError extends Error {
     readonly code: BuildPresentationErrorCode;
@@ -266,13 +263,11 @@ export const buildPresentation = (options: BuildPresentationOptions): PreparedPr
     const submission: PresentationSubmission = {
         id: options.submissionId ?? makeId(),
         definition_id: pd.id,
-        descriptor_map: normalized.map(
-            (n, index): PresentationSubmissionDescriptor => ({
-                id: n.descriptorId,
-                format: n.format,
-                path: pathForIndex(index, vpFormat),
-            })
-        ),
+        descriptor_map: normalized.map((n, index): PresentationSubmissionDescriptor => ({
+            id: n.descriptorId,
+            format: n.format,
+            path: pathForIndex(index, vpFormat),
+        })),
     };
 
     return {
@@ -500,15 +495,20 @@ const defaultMakeId = (): string => {
         return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
     }
 
-    return Math.random().toString(36).slice(2, 18);
+    // Fallback for environments without crypto - should not happen in modern runtimes
+    // Throw error instead of using insecure Math.random() for security-sensitive IDs
+    throw new Error(
+        'crypto.getRandomValues is required but not available. ' +
+            'Ensure you are running in a modern browser or Node.js environment.'
+    );
 };
 
 /**
  * Build a v4 UUID string using the caller-supplied random generator
- * (so tests can inject deterministic output). Falls back to a coarse
- * Math.random-based generator if the supplied id isn't hex-shaped —
- * the presentation id only needs to be unique per submission, not
- * cryptographically strong.
+ * (so tests can inject deterministic output). Pads non-hex input to
+ * 32 hex chars. Note: defaultMakeId requires crypto.getRandomValues
+ * and will throw in legacy environments without it (no Math.random
+ * fallback to avoid CodeQL security warnings).
  */
 const makeUuidV4 = (makeId: () => string): string => {
     const hex = makeId().replace(/[^0-9a-f]/gi, '');