@openeudi/openid4vp 0.2.1 → 0.4.0

package/dist/index.d.ts

@@ -1,3 +1,36 @@
+import { DcqlQuery, TrustedAuthoritiesQuery, DcqlMatchResult, DcqlSubmission } from '@openeudi/dcql';
+export { DcqlMatchError, DcqlMatchResult, DcqlQuery, DcqlSubmission, DcqlValidationError, DcqlValidationErrorCode } from '@openeudi/dcql';
+
+interface AuthorizationRequestInput {
+    clientId: string;
+    responseUri: string;
+    nonce: string;
+    state?: string;
+    responseMode?: 'direct_post' | 'direct_post.jwt';
+}
+interface AuthorizationRequest {
+    uri: string;
+    dcqlQuery: DcqlQuery;
+    nonce: string;
+    state: string;
+}
+
+declare function createAuthorizationRequest(input: AuthorizationRequestInput, query: DcqlQuery): AuthorizationRequest;
+
+interface HaipQueryInput {
+    credentialId: string;
+    format: 'dc+sd-jwt' | 'mso_mdoc';
+    vctValues?: string[];
+    doctypeValue?: string;
+    claims: string[];
+    trustedAuthorities?: TrustedAuthoritiesQuery[];
+}
+
+declare const HAIP_DOCTYPE_NAMESPACES: Record<string, string>;
+declare function buildHaipQuery(input: HaipQueryInput): DcqlQuery;
+declare function validateHaipQuery(query: DcqlQuery): void;
+declare function isHaipQuery(query: DcqlQuery): boolean;
+
 interface IssuerInfo {
     certificate: Uint8Array;
     country: string;
@@ -20,21 +53,15 @@ interface PresentationResult {
     claims: CredentialClaims;
     issuer: IssuerInfo;
     error?: string;
-}
-
-interface AuthorizationRequestInput {
-    requestedAttributes: string[];
-    acceptedFormats: CredentialFormat[];
-    responseUri: string;
-    nonce: string;
-    clientId: string;
-    state?: string;
-}
-interface AuthorizationRequest {
-    uri: string;
-    presentationDefinition: object;
-    nonce: string;
-    state: string;
+    /** SD-JWT type (Verifiable Credential Type URI). Populated for `sd-jwt-vc` format. */
+    vct?: string;
+    /** mDOC docType (ISO 18013-5). Populated for `mdoc` format. */
+    docType?: string;
+    /**
+     * mDOC claims grouped by namespace. Populated for `mdoc` format.
+     * DCQL claim paths address this shape: `['org.iso.18013.5.1', 'age_over_18']`.
+     */
+    namespacedClaims?: Record<string, Record<string, unknown>>;
 }
 
 interface ParseOptions {
@@ -51,6 +78,13 @@ interface ParseOptions {
      * where no trusted issuer set is available.
      */
     skipTrustCheck?: boolean;
+    /**
+     * When set, the parsed credential's `docType` (mDOC) or `vct` (SD-JWT)
+     * must equal this value — otherwise parsing throws `MalformedCredentialError`.
+     * Defends against doc-type confusion attacks when the verifier expects a
+     * specific credential class (e.g. `'eu.europa.ec.eudi.pid.1'`).
+     */
+    expectedDocType?: string;
 }
 interface ICredentialParser {
     readonly format: CredentialFormat;
@@ -58,6 +92,29 @@ interface ICredentialParser {
     parse(vpToken: unknown, options: ParseOptions): Promise<PresentationResult>;
 }
 
+declare function parsePresentation(vpToken: unknown, options: ParseOptions): Promise<PresentationResult>;
+
+type VerifyOptions = ParseOptions;
+interface VerifyResult {
+    parsed: PresentationResult;
+    match: DcqlMatchResult;
+    submission: DcqlSubmission | null;
+    valid: boolean;
+}
+
+/**
+ * Parses a VP token, then matches it against a DCQL query.
+ *
+ * Cryptographic / structural parser failures still throw (via `parsePresentation`).
+ * Query-level mismatches are surfaced as `match.unmatched` entries so callers can
+ * show per-claim diagnostics.
+ *
+ * @param vpToken raw VP token (SD-JWT string or mDOC Uint8Array)
+ * @param query  DCQL query describing the required credential(s)
+ * @param options parse + verify options (nonce, trusted issuers, etc.)
+ */
+declare function verifyPresentation(vpToken: unknown, query: DcqlQuery, options: VerifyOptions): Promise<VerifyResult>;
+
 /**
  * SD-JWT VC credential parser.
  *
@@ -78,18 +135,19 @@ declare class SdJwtParser implements ICredentialParser {
  * mDOC / mDL credential parser.
  *
  * Decodes and validates mDOC (Mobile Document) credentials as specified in
- * ISO 18013-5 and the EUDI Wallet ecosystem. Processes CBOR-encoded
- * DeviceResponse structures containing:
- *   - Document type validation (eu.europa.ec.eudi.pid.1)
- *   - Issuer certificate trust chain verification via COSE_Sign1 issuerAuth
- *   - Validity period checking
- *   - Claim extraction from IssuerSignedItem nameSpace elements
+ * ISO 18013-5 and the EUDI Wallet ecosystem. Composes the crypto modules
+ * to perform full verification:
+ *   - COSE_Sign1 decode + signature verification
+ *   - MSO decode + validity + docType validation
+ *   - Digest verification for all IssuerSignedItems
+ *   - Issuer certificate trust chain check
  */
 declare class MdocParser implements ICredentialParser {
     readonly format: CredentialFormat;
     /**
      * Returns true when the token is binary data (Uint8Array or Buffer),
      * indicating a CBOR-encoded mDOC DeviceResponse.
+     * Buffer extends Uint8Array, so `instanceof Uint8Array` catches both.
      */
     canParse(vpToken: unknown): boolean;
     /**
@@ -116,11 +174,13 @@ declare class MalformedCredentialError extends Error {
 declare class NonceValidationError extends Error {
     constructor(message?: string);
 }
+type HaipValidationCode = 'EMPTY_QUERY' | 'UNSUPPORTED_FORMAT' | 'MISSING_SDJWT_META' | 'MISSING_MDOC_META' | 'NO_CLAIMS' | 'CLAIM_SETS_DISALLOWED' | 'CREDENTIAL_SETS_DISALLOWED';
+declare class HaipValidationError extends Error {
+    readonly code: HaipValidationCode;
+    readonly credentialId?: string;
+    constructor(code: HaipValidationCode, message: string, credentialId?: string);
+}
 
-declare function createAuthorizationRequest(input: AuthorizationRequestInput): AuthorizationRequest;
-
-declare function parsePresentation(vpToken: unknown, options: ParseOptions): Promise<PresentationResult>;
-
-declare const VERSION = "0.2.1";
+declare const VERSION = "0.4.0";
 
-export { type AuthorizationRequest, type AuthorizationRequestInput, type CredentialClaims, type CredentialFormat, ExpiredCredentialError, type ICredentialParser, InvalidSignatureError, type IssuerInfo, MalformedCredentialError, MdocParser, NonceValidationError, type ParseOptions, type PresentationResult, SdJwtParser, UnsupportedFormatError, VERSION, createAuthorizationRequest, parsePresentation };
+export { type AuthorizationRequest, type AuthorizationRequestInput, type CredentialClaims, type CredentialFormat, ExpiredCredentialError, HAIP_DOCTYPE_NAMESPACES, type HaipQueryInput, type HaipValidationCode, HaipValidationError, type ICredentialParser, InvalidSignatureError, type IssuerInfo, MalformedCredentialError, MdocParser, NonceValidationError, type ParseOptions, type PresentationResult, SdJwtParser, UnsupportedFormatError, VERSION, type VerifyOptions, type VerifyResult, buildHaipQuery, createAuthorizationRequest, isHaipQuery, parsePresentation, validateHaipQuery, verifyPresentation };