@openeudi/openid4vp 0.11.1 → 0.12.0

package/dist/index.d.cts

@@ -79,10 +79,49 @@ interface HaipQueryInput {
     claims: string[];
     trustedAuthorities?: TrustedAuthoritiesQuery[];
 }
+/**
+ * Input to `buildCredentialSetQuery` — a DCQL `credential_sets` disjunction
+ * offering the wallet several alternative credentials for the same question.
+ */
+interface CredentialSetQueryInput {
+    /**
+     * The alternatives, **most-preferred first**. Option order is a privacy
+     * signal, not cosmetic: list the credential that discloses least first.
+     * Wallets are not obliged to honour the order.
+     */
+    options: HaipQueryInput[];
+    /** Whether the wallet must satisfy one option. Default: `true`. */
+    required?: boolean;
+}
 
 declare const HAIP_DOCTYPE_NAMESPACES: Record<string, string>;
 declare function buildHaipQuery(input: HaipQueryInput): DcqlQuery;
+/**
+ * Build a DCQL query offering the wallet a choice between several credentials —
+ * a `credential_sets` disjunction.
+ *
+ * The motivating case is a proof-of-age check: ask for a Proof-of-Age
+ * attestation (`mso_mdoc`, `age_over_18` in namespace `eu.europa.ec.av.1`) OR a
+ * PID (`dc+sd-jwt`, `birth_date`), because the PID carries no age attribute and
+ * proof-of-age attestations have almost no issuer coverage yet. The wallet
+ * satisfies ONE option and returns ONE presentation.
+ *
+ * This is deliberately NOT HAIP-minimal: `validateHaipQuery` rejects
+ * `credential_sets`, and `isHaipQuery` returns `false` for what this produces.
+ * That boundary is intentional — use `validateCredentialSetQuery` instead.
+ *
+ * Each option is built through {@link buildHaipQuery}, so per-credential
+ * validation and its `HaipValidationError` codes are identical.
+ */
+declare function buildCredentialSetQuery(input: CredentialSetQueryInput): DcqlQuery;
 declare function validateHaipQuery(query: DcqlQuery): void;
+/**
+ * Validate a DCQL query that offers the wallet a choice — the profile
+ * `buildCredentialSetQuery` produces. Per-credential rules are identical to
+ * HAIP-minimal; the difference is that `credential_sets` is REQUIRED here
+ * rather than forbidden.
+ */
+declare function validateCredentialSetQuery(query: DcqlQuery): void;
 declare function isHaipQuery(query: DcqlQuery): boolean;
 
 interface IssuerInfo {
@@ -574,7 +613,7 @@ declare class MalformedCredentialError extends Error {
 declare class NonceValidationError extends Error {
     constructor(message?: string);
 }
-type HaipValidationCode = 'EMPTY_QUERY' | 'UNSUPPORTED_FORMAT' | 'MISSING_SDJWT_META' | 'MISSING_MDOC_META' | 'NO_CLAIMS' | 'CLAIM_SETS_DISALLOWED' | 'CREDENTIAL_SETS_DISALLOWED';
+type HaipValidationCode = 'EMPTY_QUERY' | 'UNSUPPORTED_FORMAT' | 'MISSING_SDJWT_META' | 'MISSING_MDOC_META' | 'NO_CLAIMS' | 'CLAIM_SETS_DISALLOWED' | 'CREDENTIAL_SETS_DISALLOWED' | 'EMPTY_OPTIONS' | 'DUPLICATE_CREDENTIAL_ID' | 'MISSING_CREDENTIAL_SETS' | 'UNKNOWN_OPTION_REFERENCE';
 declare class HaipValidationError extends Error {
     readonly code: HaipValidationCode;
     readonly credentialId?: string;
@@ -624,6 +663,19 @@ declare class LotlFetchError extends OpenID4VPError {
 declare class LotlSignatureError extends OpenID4VPError {
     readonly code: "lotl_signature_invalid";
 }
+/**
+ * The environment is not configured to verify trusted-list signatures at all —
+ * distinct from a list whose signature did not verify.
+ *
+ * `xmldsigjs` needs a WebCrypto engine registered once per process, and this
+ * library deliberately leaves that to the consumer rather than picking a
+ * provider on their behalf. Without it, no trusted list can ever verify, so
+ * this is raised eagerly instead of degrading per-list: a configuration fault
+ * reported as a trust failure sends people bisecting valid XML.
+ */
+declare class LotlConfigurationError extends OpenID4VPError {
+    readonly code: "lotl_configuration_invalid";
+}
 type SignedRequestBuildErrorCode = 'empty_cert_chain' | 'hostname_cert_mismatch' | 'signing_key_cert_mismatch' | 'missing_encryption_jwk' | 'missing_encryption_alg' | 'missing_vp_formats' | 'unsupported_signing_alg' | 'empty_supported_enc_values' | 'missing_hostname' | 'self_signed_leaf';
 declare class SignedRequestBuildError extends OpenID4VPError {
     readonly code: SignedRequestBuildErrorCode;
@@ -693,6 +745,6 @@ declare class LotlTrustStore implements TrustStore {
     private refresh;
 }
 
-declare const VERSION = "0.11.1";
+declare const VERSION = "0.12.0";
 
-export { type AuthorizationRequest, type AuthorizationRequestInput, type AuthorizationResponse, type Cache, CertificateChainError, type ChainErrorReason, CompositeTrustStore, type CredentialClaims, type CredentialFormat, DecryptionFailedError, type EncryptedResponse, ExpiredCredentialError, type Fetcher, HAIP_DOCTYPE_NAMESPACES, type HaipQueryInput, type HaipValidationCode, HaipValidationError, type ICredentialParser, InMemoryCache, InvalidSignatureError, type IssuerInfo, type LotlAnchorMetadata, LotlFetchError, LotlSignatureError, LotlTrustStore, type LotlTrustStoreOptions, MalformedCredentialError, MdocParser, MissingDecryptionKeyError, MissingVerifierEncryptionKeyError, MultipleCredentialsNotSupportedError, NonceValidationError, OpenID4VPError, type ParseOptions, type PresentationResult, RevocationCheckFailedError, RevokedCertificateError, SdJwtParser, type SignedAuthorizationRequest, type SignedAuthorizationRequestInput, SignedRequestBuildError, type SignedRequestBuildErrorCode, StaticTrustStore, type TrustAnchor, TrustAnchorNotFoundError, type TrustStore, type TrustStoreHint, type TrustStoreInput, UnsupportedFormatError, UnsupportedJweError, VERSION, type VerifyAuthorizationResponseOptions, type VerifyOptions, type VerifyResult, buildHaipQuery, buildOid4vpSessionTranscript, buildOpenID4VPHandoverSessionTranscript, createAuthorizationRequest, createSignedAuthorizationRequest, decryptAuthorizationResponse, isHaipQuery, parsePresentation, validateHaipQuery, verifyAuthorizationResponse, verifyPresentation };
+export { type AuthorizationRequest, type AuthorizationRequestInput, type AuthorizationResponse, type Cache, CertificateChainError, type ChainErrorReason, CompositeTrustStore, type CredentialClaims, type CredentialFormat, type CredentialSetQueryInput, DecryptionFailedError, type EncryptedResponse, ExpiredCredentialError, type Fetcher, HAIP_DOCTYPE_NAMESPACES, type HaipQueryInput, type HaipValidationCode, HaipValidationError, type ICredentialParser, InMemoryCache, InvalidSignatureError, type IssuerInfo, type LotlAnchorMetadata, LotlConfigurationError, LotlFetchError, LotlSignatureError, LotlTrustStore, type LotlTrustStoreOptions, MalformedCredentialError, MdocParser, MissingDecryptionKeyError, MissingVerifierEncryptionKeyError, MultipleCredentialsNotSupportedError, NonceValidationError, OpenID4VPError, type ParseOptions, type PresentationResult, RevocationCheckFailedError, RevokedCertificateError, SdJwtParser, type SignedAuthorizationRequest, type SignedAuthorizationRequestInput, SignedRequestBuildError, type SignedRequestBuildErrorCode, StaticTrustStore, type TrustAnchor, TrustAnchorNotFoundError, type TrustStore, type TrustStoreHint, type TrustStoreInput, UnsupportedFormatError, UnsupportedJweError, VERSION, type VerifyAuthorizationResponseOptions, type VerifyOptions, type VerifyResult, buildCredentialSetQuery, buildHaipQuery, buildOid4vpSessionTranscript, buildOpenID4VPHandoverSessionTranscript, createAuthorizationRequest, createSignedAuthorizationRequest, decryptAuthorizationResponse, isHaipQuery, parsePresentation, validateCredentialSetQuery, validateHaipQuery, verifyAuthorizationResponse, verifyPresentation };

package/dist/index.d.ts

@@ -79,10 +79,49 @@ interface HaipQueryInput {
     claims: string[];
     trustedAuthorities?: TrustedAuthoritiesQuery[];
 }
+/**
+ * Input to `buildCredentialSetQuery` — a DCQL `credential_sets` disjunction
+ * offering the wallet several alternative credentials for the same question.
+ */
+interface CredentialSetQueryInput {
+    /**
+     * The alternatives, **most-preferred first**. Option order is a privacy
+     * signal, not cosmetic: list the credential that discloses least first.
+     * Wallets are not obliged to honour the order.
+     */
+    options: HaipQueryInput[];
+    /** Whether the wallet must satisfy one option. Default: `true`. */
+    required?: boolean;
+}
 
 declare const HAIP_DOCTYPE_NAMESPACES: Record<string, string>;
 declare function buildHaipQuery(input: HaipQueryInput): DcqlQuery;
+/**
+ * Build a DCQL query offering the wallet a choice between several credentials —
+ * a `credential_sets` disjunction.
+ *
+ * The motivating case is a proof-of-age check: ask for a Proof-of-Age
+ * attestation (`mso_mdoc`, `age_over_18` in namespace `eu.europa.ec.av.1`) OR a
+ * PID (`dc+sd-jwt`, `birth_date`), because the PID carries no age attribute and
+ * proof-of-age attestations have almost no issuer coverage yet. The wallet
+ * satisfies ONE option and returns ONE presentation.
+ *
+ * This is deliberately NOT HAIP-minimal: `validateHaipQuery` rejects
+ * `credential_sets`, and `isHaipQuery` returns `false` for what this produces.
+ * That boundary is intentional — use `validateCredentialSetQuery` instead.
+ *
+ * Each option is built through {@link buildHaipQuery}, so per-credential
+ * validation and its `HaipValidationError` codes are identical.
+ */
+declare function buildCredentialSetQuery(input: CredentialSetQueryInput): DcqlQuery;
 declare function validateHaipQuery(query: DcqlQuery): void;
+/**
+ * Validate a DCQL query that offers the wallet a choice — the profile
+ * `buildCredentialSetQuery` produces. Per-credential rules are identical to
+ * HAIP-minimal; the difference is that `credential_sets` is REQUIRED here
+ * rather than forbidden.
+ */
+declare function validateCredentialSetQuery(query: DcqlQuery): void;
 declare function isHaipQuery(query: DcqlQuery): boolean;
 
 interface IssuerInfo {
@@ -574,7 +613,7 @@ declare class MalformedCredentialError extends Error {
 declare class NonceValidationError extends Error {
     constructor(message?: string);
 }
-type HaipValidationCode = 'EMPTY_QUERY' | 'UNSUPPORTED_FORMAT' | 'MISSING_SDJWT_META' | 'MISSING_MDOC_META' | 'NO_CLAIMS' | 'CLAIM_SETS_DISALLOWED' | 'CREDENTIAL_SETS_DISALLOWED';
+type HaipValidationCode = 'EMPTY_QUERY' | 'UNSUPPORTED_FORMAT' | 'MISSING_SDJWT_META' | 'MISSING_MDOC_META' | 'NO_CLAIMS' | 'CLAIM_SETS_DISALLOWED' | 'CREDENTIAL_SETS_DISALLOWED' | 'EMPTY_OPTIONS' | 'DUPLICATE_CREDENTIAL_ID' | 'MISSING_CREDENTIAL_SETS' | 'UNKNOWN_OPTION_REFERENCE';
 declare class HaipValidationError extends Error {
     readonly code: HaipValidationCode;
     readonly credentialId?: string;
@@ -624,6 +663,19 @@ declare class LotlFetchError extends OpenID4VPError {
 declare class LotlSignatureError extends OpenID4VPError {
     readonly code: "lotl_signature_invalid";
 }
+/**
+ * The environment is not configured to verify trusted-list signatures at all —
+ * distinct from a list whose signature did not verify.
+ *
+ * `xmldsigjs` needs a WebCrypto engine registered once per process, and this
+ * library deliberately leaves that to the consumer rather than picking a
+ * provider on their behalf. Without it, no trusted list can ever verify, so
+ * this is raised eagerly instead of degrading per-list: a configuration fault
+ * reported as a trust failure sends people bisecting valid XML.
+ */
+declare class LotlConfigurationError extends OpenID4VPError {
+    readonly code: "lotl_configuration_invalid";
+}
 type SignedRequestBuildErrorCode = 'empty_cert_chain' | 'hostname_cert_mismatch' | 'signing_key_cert_mismatch' | 'missing_encryption_jwk' | 'missing_encryption_alg' | 'missing_vp_formats' | 'unsupported_signing_alg' | 'empty_supported_enc_values' | 'missing_hostname' | 'self_signed_leaf';
 declare class SignedRequestBuildError extends OpenID4VPError {
     readonly code: SignedRequestBuildErrorCode;
@@ -693,6 +745,6 @@ declare class LotlTrustStore implements TrustStore {
     private refresh;
 }
 
-declare const VERSION = "0.11.1";
+declare const VERSION = "0.12.0";
 
-export { type AuthorizationRequest, type AuthorizationRequestInput, type AuthorizationResponse, type Cache, CertificateChainError, type ChainErrorReason, CompositeTrustStore, type CredentialClaims, type CredentialFormat, DecryptionFailedError, type EncryptedResponse, ExpiredCredentialError, type Fetcher, HAIP_DOCTYPE_NAMESPACES, type HaipQueryInput, type HaipValidationCode, HaipValidationError, type ICredentialParser, InMemoryCache, InvalidSignatureError, type IssuerInfo, type LotlAnchorMetadata, LotlFetchError, LotlSignatureError, LotlTrustStore, type LotlTrustStoreOptions, MalformedCredentialError, MdocParser, MissingDecryptionKeyError, MissingVerifierEncryptionKeyError, MultipleCredentialsNotSupportedError, NonceValidationError, OpenID4VPError, type ParseOptions, type PresentationResult, RevocationCheckFailedError, RevokedCertificateError, SdJwtParser, type SignedAuthorizationRequest, type SignedAuthorizationRequestInput, SignedRequestBuildError, type SignedRequestBuildErrorCode, StaticTrustStore, type TrustAnchor, TrustAnchorNotFoundError, type TrustStore, type TrustStoreHint, type TrustStoreInput, UnsupportedFormatError, UnsupportedJweError, VERSION, type VerifyAuthorizationResponseOptions, type VerifyOptions, type VerifyResult, buildHaipQuery, buildOid4vpSessionTranscript, buildOpenID4VPHandoverSessionTranscript, createAuthorizationRequest, createSignedAuthorizationRequest, decryptAuthorizationResponse, isHaipQuery, parsePresentation, validateHaipQuery, verifyAuthorizationResponse, verifyPresentation };
+export { type AuthorizationRequest, type AuthorizationRequestInput, type AuthorizationResponse, type Cache, CertificateChainError, type ChainErrorReason, CompositeTrustStore, type CredentialClaims, type CredentialFormat, type CredentialSetQueryInput, DecryptionFailedError, type EncryptedResponse, ExpiredCredentialError, type Fetcher, HAIP_DOCTYPE_NAMESPACES, type HaipQueryInput, type HaipValidationCode, HaipValidationError, type ICredentialParser, InMemoryCache, InvalidSignatureError, type IssuerInfo, type LotlAnchorMetadata, LotlConfigurationError, LotlFetchError, LotlSignatureError, LotlTrustStore, type LotlTrustStoreOptions, MalformedCredentialError, MdocParser, MissingDecryptionKeyError, MissingVerifierEncryptionKeyError, MultipleCredentialsNotSupportedError, NonceValidationError, OpenID4VPError, type ParseOptions, type PresentationResult, RevocationCheckFailedError, RevokedCertificateError, SdJwtParser, type SignedAuthorizationRequest, type SignedAuthorizationRequestInput, SignedRequestBuildError, type SignedRequestBuildErrorCode, StaticTrustStore, type TrustAnchor, TrustAnchorNotFoundError, type TrustStore, type TrustStoreHint, type TrustStoreInput, UnsupportedFormatError, UnsupportedJweError, VERSION, type VerifyAuthorizationResponseOptions, type VerifyOptions, type VerifyResult, buildCredentialSetQuery, buildHaipQuery, buildOid4vpSessionTranscript, buildOpenID4VPHandoverSessionTranscript, createAuthorizationRequest, createSignedAuthorizationRequest, decryptAuthorizationResponse, isHaipQuery, parsePresentation, validateCredentialSetQuery, validateHaipQuery, verifyAuthorizationResponse, verifyPresentation };

package/dist/index.js

@@ -24,7 +24,7 @@ var init_reflect_polyfill = __esm({
 });
 
 // src/errors.ts
-var InvalidSignatureError, ExpiredCredentialError, UnsupportedFormatError, MalformedCredentialError, NonceValidationError, HaipValidationError, OpenID4VPError, TrustAnchorNotFoundError, CertificateChainError, RevokedCertificateError, RevocationCheckFailedError, LotlFetchError, LotlSignatureError, SignedRequestBuildError, UnsupportedJweError, DecryptionFailedError, MissingDecryptionKeyError, MissingVerifierEncryptionKeyError, MultipleCredentialsNotSupportedError;
+var InvalidSignatureError, ExpiredCredentialError, UnsupportedFormatError, MalformedCredentialError, NonceValidationError, HaipValidationError, OpenID4VPError, TrustAnchorNotFoundError, CertificateChainError, RevokedCertificateError, RevocationCheckFailedError, LotlFetchError, LotlSignatureError, LotlConfigurationError, SignedRequestBuildError, UnsupportedJweError, DecryptionFailedError, MissingDecryptionKeyError, MissingVerifierEncryptionKeyError, MultipleCredentialsNotSupportedError;
 var init_errors = __esm({
   "src/errors.ts"() {
     init_reflect_polyfill();
@@ -121,6 +121,9 @@ var init_errors = __esm({
     LotlSignatureError = class extends OpenID4VPError {
       code = "lotl_signature_invalid";
     };
+    LotlConfigurationError = class extends OpenID4VPError {
+      code = "lotl_configuration_invalid";
+    };
     SignedRequestBuildError = class extends OpenID4VPError {
       code;
       constructor(code, message) {
@@ -8422,6 +8425,33 @@ function buildHaipQuery(input) {
   }
   return { credentials: [credential] };
 }
+function buildCredentialSetQuery(input) {
+  if (input.options.length === 0) {
+    throw new HaipValidationError(
+      "EMPTY_OPTIONS",
+      "a credential set must offer at least one option"
+    );
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const option of input.options) {
+    if (seen.has(option.credentialId)) {
+      throw new HaipValidationError(
+        "DUPLICATE_CREDENTIAL_ID",
+        `credential '${option.credentialId}' is declared by more than one option; credential ids must be unique for credential_sets to reference them`,
+        option.credentialId
+      );
+    }
+    seen.add(option.credentialId);
+  }
+  const credentials = input.options.map((option) => buildHaipQuery(option).credentials[0]);
+  const credentialSet = {
+    options: input.options.map((option) => [option.credentialId])
+  };
+  if (input.required === false) {
+    credentialSet.required = false;
+  }
+  return { credentials, credential_sets: [credentialSet] };
+}
 var HAIP_FORMATS = /* @__PURE__ */ new Set(["dc+sd-jwt", "mso_mdoc"]);
 function validateHaipQuery(query) {
   if (!query.credentials || query.credentials.length === 0) {
@@ -8437,46 +8467,86 @@ function validateHaipQuery(query) {
     );
   }
   for (const credential of query.credentials) {
-    if (!HAIP_FORMATS.has(credential.format)) {
+    validateCredential(credential);
+  }
+}
+function validateCredential(credential) {
+  if (!HAIP_FORMATS.has(credential.format)) {
+    throw new HaipValidationError(
+      "UNSUPPORTED_FORMAT",
+      `credential '${credential.id}' uses unsupported format '${credential.format}' (allowed: dc+sd-jwt, mso_mdoc)`,
+      credential.id
+    );
+  }
+  if (credential.format === "dc+sd-jwt") {
+    const vctValues = credential.meta?.vct_values;
+    if (!vctValues || vctValues.length === 0) {
       throw new HaipValidationError(
-        "UNSUPPORTED_FORMAT",
-        `credential '${credential.id}' uses unsupported format '${credential.format}' (allowed: dc+sd-jwt, mso_mdoc)`,
+        "MISSING_SDJWT_META",
+        `credential '${credential.id}' with format 'dc+sd-jwt' must set meta.vct_values`,
         credential.id
       );
     }
-    if (credential.format === "dc+sd-jwt") {
-      const vctValues = credential.meta?.vct_values;
-      if (!vctValues || vctValues.length === 0) {
-        throw new HaipValidationError(
-          "MISSING_SDJWT_META",
-          `credential '${credential.id}' with format 'dc+sd-jwt' must set meta.vct_values`,
-          credential.id
-        );
-      }
-    }
-    if (credential.format === "mso_mdoc") {
-      if (typeof credential.meta?.doctype_value !== "string") {
-        throw new HaipValidationError(
-          "MISSING_MDOC_META",
-          `credential '${credential.id}' with format 'mso_mdoc' must set meta.doctype_value`,
-          credential.id
-        );
-      }
-    }
-    if (!credential.claims || credential.claims.length === 0) {
+  }
+  if (credential.format === "mso_mdoc") {
+    if (typeof credential.meta?.doctype_value !== "string") {
       throw new HaipValidationError(
-        "NO_CLAIMS",
-        `credential '${credential.id}' must declare at least one claim`,
+        "MISSING_MDOC_META",
+        `credential '${credential.id}' with format 'mso_mdoc' must set meta.doctype_value`,
         credential.id
       );
     }
-    if (credential.claim_sets !== void 0) {
+  }
+  if (!credential.claims || credential.claims.length === 0) {
+    throw new HaipValidationError(
+      "NO_CLAIMS",
+      `credential '${credential.id}' must declare at least one claim`,
+      credential.id
+    );
+  }
+  if (credential.claim_sets !== void 0) {
+    throw new HaipValidationError(
+      "CLAIM_SETS_DISALLOWED",
+      `credential '${credential.id}' uses claim_sets, not permitted in HAIP-minimal`,
+      credential.id
+    );
+  }
+}
+function validateCredentialSetQuery(query) {
+  if (!query.credentials || query.credentials.length === 0) {
+    throw new HaipValidationError(
+      "EMPTY_QUERY",
+      "query.credentials must have at least one entry"
+    );
+  }
+  if (!query.credential_sets || query.credential_sets.length === 0) {
+    throw new HaipValidationError(
+      "MISSING_CREDENTIAL_SETS",
+      "a credential-set query must declare at least one credential_sets entry"
+    );
+  }
+  for (const credential of query.credentials) {
+    validateCredential(credential);
+  }
+  const declaredIds = new Set(query.credentials.map((c) => c.id));
+  for (const credentialSet of query.credential_sets) {
+    if (!credentialSet.options || credentialSet.options.length === 0) {
       throw new HaipValidationError(
-        "CLAIM_SETS_DISALLOWED",
-        `credential '${credential.id}' uses claim_sets, not permitted in HAIP-minimal`,
-        credential.id
+        "EMPTY_OPTIONS",
+        "a credential set must offer at least one option"
       );
     }
+    for (const option of credentialSet.options) {
+      for (const id of option) {
+        if (!declaredIds.has(id)) {
+          throw new HaipValidationError(
+            "UNKNOWN_OPTION_REFERENCE",
+            `credential_sets option references '${id}', which is not declared in query.credentials`,
+            id
+          );
+        }
+      }
+    }
   }
 }
 function isHaipQuery(query) {
@@ -9946,6 +10016,7 @@ function bytesToHex3(bytes) {
 
 // src/trust/LotlTrustStore.ts
 init_reflect_polyfill();
+init_errors();
 
 // src/trust/lotl-signing-anchors.ts
 init_reflect_polyfill();
@@ -10014,6 +10085,7 @@ var LotlFetcher = class {
     this.fetcher = opts.fetcher ?? globalThis.fetch.bind(globalThis);
   }
   async fetchSigned(url, signingAnchors) {
+    assertCryptoEngineRegistered();
     let xmlText;
     try {
       const response = await this.fetcher(url, { method: "GET" });
@@ -10066,6 +10138,22 @@ var LotlFetcher = class {
     );
   }
 };
+function assertCryptoEngineRegistered() {
+  let engine;
+  try {
+    engine = xmldsig.Application.crypto;
+  } catch (err) {
+    throw new LotlConfigurationError(
+      `no xmldsigjs crypto engine registered \u2014 trusted-list signatures cannot be verified. Call xmldsig.Application.setEngine('NodeJS', new Crypto()) (e.g. from @peculiar/webcrypto) once at startup, before using LotlTrustStore. Underlying error: ${err instanceof Error ? err.message : String(err)}`,
+      { cause: err instanceof Error ? err : void 0 }
+    );
+  }
+  if (!engine) {
+    throw new LotlConfigurationError(
+      "no xmldsigjs crypto engine registered \u2014 trusted-list signatures cannot be verified. Call xmldsig.Application.setEngine('NodeJS', new Crypto()) (e.g. from @peculiar/webcrypto) once at startup, before using LotlTrustStore."
+    );
+  }
+}
 async function verifyAgainst(doc, sigEl, anchor) {
   try {
     const signed = new xmldsig.SignedXml(doc);
@@ -10213,6 +10301,7 @@ function parsePointer(el) {
 
 // src/trust/NationalTlResolver.ts
 init_reflect_polyfill();
+init_errors();
 var TSL_NS2 = "http://uri.etsi.org/02231/v2#";
 var NationalTlResolver = class {
   constructor(opts) {
@@ -10228,6 +10317,7 @@ var NationalTlResolver = class {
         );
         return parseNationalTl(doc, pointer.country);
       } catch (err) {
+        if (err instanceof LotlConfigurationError) throw err;
         console.warn(
           `[openid4vp] national TL for ${pointer.country} failed: ${err.message}`
         );
@@ -10406,6 +10496,7 @@ var LotlTrustStore = class {
         };
         return this.snapshot;
       } catch (err) {
+        if (err instanceof LotlConfigurationError) throw err;
         if (this.snapshot) {
           console.warn(
             `[openid4vp] LOTL refresh failed; serving cached snapshot (${err.message})`
@@ -10453,7 +10544,7 @@ function equalBytes(a, b) {
 
 // src/index.ts
 init_errors();
-var VERSION = "0.11.1";
+var VERSION = "0.12.0";
 /*! Bundled license information:
 
 pvtsutils/build/index.es.js:
@@ -10523,6 +10614,6 @@ asn1js/build/index.es.js:
    *)
 */
 
-export { CertificateChainError, CompositeTrustStore, DecryptionFailedError, ExpiredCredentialError, HAIP_DOCTYPE_NAMESPACES, HaipValidationError, InMemoryCache, InvalidSignatureError, LotlFetchError, LotlSignatureError, LotlTrustStore, MalformedCredentialError, MdocParser, MissingDecryptionKeyError, MissingVerifierEncryptionKeyError, MultipleCredentialsNotSupportedError, NonceValidationError, OpenID4VPError, RevocationCheckFailedError, RevokedCertificateError, SdJwtParser, SignedRequestBuildError, StaticTrustStore, TrustAnchorNotFoundError, UnsupportedFormatError, UnsupportedJweError, VERSION, buildHaipQuery, buildOid4vpSessionTranscript, buildOpenID4VPHandoverSessionTranscript, createAuthorizationRequest, createSignedAuthorizationRequest, decryptAuthorizationResponse, isHaipQuery, parsePresentation, validateHaipQuery, verifyAuthorizationResponse, verifyPresentation };
+export { CertificateChainError, CompositeTrustStore, DecryptionFailedError, ExpiredCredentialError, HAIP_DOCTYPE_NAMESPACES, HaipValidationError, InMemoryCache, InvalidSignatureError, LotlConfigurationError, LotlFetchError, LotlSignatureError, LotlTrustStore, MalformedCredentialError, MdocParser, MissingDecryptionKeyError, MissingVerifierEncryptionKeyError, MultipleCredentialsNotSupportedError, NonceValidationError, OpenID4VPError, RevocationCheckFailedError, RevokedCertificateError, SdJwtParser, SignedRequestBuildError, StaticTrustStore, TrustAnchorNotFoundError, UnsupportedFormatError, UnsupportedJweError, VERSION, buildCredentialSetQuery, buildHaipQuery, buildOid4vpSessionTranscript, buildOpenID4VPHandoverSessionTranscript, createAuthorizationRequest, createSignedAuthorizationRequest, decryptAuthorizationResponse, isHaipQuery, parsePresentation, validateCredentialSetQuery, validateHaipQuery, verifyAuthorizationResponse, verifyPresentation };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map