@openeudi/openid4vp 0.3.0 → 0.4.0

package/dist/index.cjs

@@ -1,11 +1,34 @@
 'use strict';
 
-var decode = require('@sd-jwt/decode');
-var jose = require('jose');
-var cborX = require('cbor-x');
 var uuid = require('uuid');
+var cborX = require('cbor-x');
+var jose = require('jose');
+var decode = require('@sd-jwt/decode');
+var dcql = require('@openeudi/dcql');
 
-// src/parsers/sd-jwt.parser.ts
+// src/authorization.ts
+function createAuthorizationRequest(input, query) {
+  if (!input.clientId) throw new TypeError("clientId is required");
+  if (!input.nonce) throw new TypeError("nonce is required");
+  if (!input.responseUri) throw new TypeError("responseUri is required");
+  const state = input.state ?? uuid.v4();
+  const responseMode = input.responseMode ?? "direct_post";
+  const params = new URLSearchParams({
+    response_type: "vp_token",
+    response_mode: responseMode,
+    response_uri: input.responseUri,
+    client_id: input.clientId,
+    nonce: input.nonce,
+    state,
+    dcql_query: JSON.stringify(query)
+  });
+  return {
+    uri: `openid4vp://authorize?${params.toString()}`,
+    dcqlQuery: query,
+    nonce: input.nonce,
+    state
+  };
+}
 
 // src/errors.ts
 var InvalidSignatureError = class extends Error {
@@ -43,228 +66,131 @@ var NonceValidationError = class extends Error {
     Object.setPrototypeOf(this, new.target.prototype);
   }
 };
+var HaipValidationError = class extends Error {
+  code;
+  credentialId;
+  constructor(code, message, credentialId) {
+    super(message);
+    this.name = "HaipValidationError";
+    this.code = code;
+    this.credentialId = credentialId;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
 
-// src/parsers/sd-jwt.parser.ts
-var DEFAULT_ALLOWED_ALGORITHMS = ["ES256", "ES384", "ES512"];
-var sha256Hasher = async (data, _alg) => {
-  const encoder2 = new TextEncoder();
-  const input = typeof data === "string" ? encoder2.encode(data) : data;
-  const hashBuffer = await crypto.subtle.digest("SHA-256", input);
-  return new Uint8Array(hashBuffer);
+// src/haip.ts
+var HAIP_DOCTYPE_NAMESPACES = {
+  "org.iso.18013.5.1.mDL": "org.iso.18013.5.1",
+  "eu.europa.ec.eudi.pid.1": "eu.europa.ec.eudi.pid.1"
 };
-var BASE64_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
-function base64ToBytes(base64) {
-  const cleaned = base64.replace(/=+$/, "");
-  const byteLength = Math.floor(cleaned.length * 3 / 4);
-  const buffer = new ArrayBuffer(byteLength);
-  const bytes = new Uint8Array(buffer);
-  let byteIndex = 0;
-  for (let i = 0; i < cleaned.length; i += 4) {
-    const a = BASE64_CHARS.indexOf(cleaned[i]);
-    const b = i + 1 < cleaned.length ? BASE64_CHARS.indexOf(cleaned[i + 1]) : 0;
-    const c = i + 2 < cleaned.length ? BASE64_CHARS.indexOf(cleaned[i + 2]) : 0;
-    const d = i + 3 < cleaned.length ? BASE64_CHARS.indexOf(cleaned[i + 3]) : 0;
-    bytes[byteIndex++] = a << 2 | b >> 4;
-    if (byteIndex < byteLength) bytes[byteIndex++] = (b & 15) << 4 | c >> 2;
-    if (byteIndex < byteLength) bytes[byteIndex++] = (c & 3) << 6 | d;
-  }
-  return bytes;
-}
-function bytesEqual(a, b) {
-  if (a.length !== b.length) return false;
-  for (let i = 0; i < a.length; i++) {
-    if (a[i] !== b[i]) return false;
-  }
-  return true;
-}
-function derToPem(base64Der) {
-  const lines = base64Der.match(/.{1,64}/g) || [];
-  return `-----BEGIN CERTIFICATE-----
-${lines.join("\n")}
------END CERTIFICATE-----`;
-}
-function bytesToBase64url(bytes) {
-  let binary = "";
-  for (const byte of bytes) {
-    binary += String.fromCharCode(byte);
-  }
-  return globalThis.btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function mapToCredentialClaims(raw) {
-  const claims = {};
-  if (typeof raw["age_over_18"] === "boolean") {
-    claims.age_over_18 = raw["age_over_18"];
-  }
-  if (typeof raw["age_over_21"] === "boolean") {
-    claims.age_over_21 = raw["age_over_21"];
-  }
-  if (typeof raw["resident_country"] === "string") {
-    claims.resident_country = raw["resident_country"];
-  }
-  if (typeof raw["nationality"] === "string") {
-    claims.nationality = raw["nationality"];
-  }
-  if (typeof raw["family_name_birth"] === "string") {
-    claims.family_name_birth = raw["family_name_birth"];
-  }
-  for (const [key, value] of Object.entries(raw)) {
-    if (!(key in claims) && !key.startsWith("_sd") && key !== "iss" && key !== "exp" && key !== "iat" && key !== "cnf" && key !== "vct") {
-      claims[key] = value;
+function buildHaipQuery(input) {
+  if (input.claims.length === 0) {
+    throw new HaipValidationError(
+      "NO_CLAIMS",
+      `credential '${input.credentialId}' must declare at least one claim`,
+      input.credentialId
+    );
+  }
+  let meta;
+  let claims;
+  if (input.format === "dc+sd-jwt") {
+    if (!input.vctValues || input.vctValues.length === 0) {
+      throw new HaipValidationError(
+        "MISSING_SDJWT_META",
+        `credential '${input.credentialId}' with format 'dc+sd-jwt' must provide non-empty vctValues`,
+        input.credentialId
+      );
     }
-  }
-  return claims;
-}
-function extractCountryHint(issuer) {
-  try {
-    const url = new URL(issuer);
-    const tld = url.hostname.split(".").pop()?.toUpperCase();
-    if (tld && tld.length === 2) {
-      return tld;
+    meta = { vct_values: input.vctValues };
+    claims = input.claims.map((c) => ({ path: [c] }));
+  } else {
+    if (!input.doctypeValue) {
+      throw new HaipValidationError(
+        "MISSING_MDOC_META",
+        `credential '${input.credentialId}' with format 'mso_mdoc' must provide doctypeValue`,
+        input.credentialId
+      );
     }
-  } catch {
+    meta = { doctype_value: input.doctypeValue };
+    const namespace = HAIP_DOCTYPE_NAMESPACES[input.doctypeValue] ?? input.doctypeValue;
+    claims = input.claims.map((c) => ({ path: [namespace, c] }));
   }
-  return "";
-}
-var SdJwtParser = class {
-  format = "sd-jwt-vc";
-  canParse(vpToken) {
-    return typeof vpToken === "string" && vpToken.includes("~");
+  const credential = {
+    id: input.credentialId,
+    format: input.format,
+    meta,
+    claims
+  };
+  if (input.trustedAuthorities && input.trustedAuthorities.length > 0) {
+    credential.trusted_authorities = input.trustedAuthorities;
   }
-  async parse(vpToken, options) {
-    if (typeof vpToken !== "string") {
-      throw new MalformedCredentialError("VP token must be a string");
-    }
-    const allowedAlgorithms = options.allowedAlgorithms ?? DEFAULT_ALLOWED_ALGORITHMS;
-    const invalidResult = (error) => ({
-      valid: false,
-      format: this.format,
-      claims: {},
-      issuer: { certificate: new Uint8Array(), country: "" },
-      error
-    });
-    let parts;
-    try {
-      parts = decode.splitSdJwt(vpToken);
-    } catch {
-      throw new MalformedCredentialError("Failed to split SD-JWT structure");
-    }
-    let header;
-    try {
-      header = jose.decodeProtectedHeader(parts.jwt);
-    } catch {
-      throw new MalformedCredentialError("Failed to decode SD-JWT issuer JWT header");
-    }
-    const alg = header.alg;
-    if (typeof alg !== "string" || !allowedAlgorithms.includes(alg)) {
-      return invalidResult(`Unsupported algorithm: ${alg}`);
-    }
-    const x5cArray = header.x5c;
-    if (!Array.isArray(x5cArray) || x5cArray.length === 0 || typeof x5cArray[0] !== "string") {
-      throw new MalformedCredentialError("Missing or invalid x5c in JWT header");
-    }
-    let issuerKey;
-    let issuerCertBytes;
-    try {
-      issuerKey = await jose.importX509(derToPem(x5cArray[0]), alg);
-      issuerCertBytes = base64ToBytes(x5cArray[0]);
-    } catch (err) {
-      if (err instanceof MalformedCredentialError) throw err;
-      throw new MalformedCredentialError("Failed to import issuer certificate");
-    }
-    let payload;
-    try {
-      const result = await jose.jwtVerify(parts.jwt, issuerKey, { algorithms: allowedAlgorithms });
-      payload = result.payload;
-    } catch {
-      return invalidResult("Issuer JWT signature verification failed");
+  return { credentials: [credential] };
+}
+var HAIP_FORMATS = /* @__PURE__ */ new Set(["dc+sd-jwt", "mso_mdoc"]);
+function validateHaipQuery(query) {
+  if (!query.credentials || query.credentials.length === 0) {
+    throw new HaipValidationError(
+      "EMPTY_QUERY",
+      "query.credentials must have at least one entry"
+    );
+  }
+  if (query.credential_sets !== void 0) {
+    throw new HaipValidationError(
+      "CREDENTIAL_SETS_DISALLOWED",
+      "credential_sets are not permitted in HAIP-minimal"
+    );
+  }
+  for (const credential of query.credentials) {
+    if (!HAIP_FORMATS.has(credential.format)) {
+      throw new HaipValidationError(
+        "UNSUPPORTED_FORMAT",
+        `credential '${credential.id}' uses unsupported format '${credential.format}' (allowed: dc+sd-jwt, mso_mdoc)`,
+        credential.id
+      );
     }
-    const issuerString = typeof payload["iss"] === "string" ? payload["iss"] : "";
-    const issuerInfo = {
-      certificate: issuerCertBytes,
-      country: extractCountryHint(issuerString)
-    };
-    if (options.trustedCertificates.length === 0) {
-      if (options.skipTrustCheck !== true) {
-        throw new MalformedCredentialError(
-          "trustedCertificates must not be empty unless skipTrustCheck is true"
+    if (credential.format === "dc+sd-jwt") {
+      const vctValues = credential.meta?.vct_values;
+      if (!vctValues || vctValues.length === 0) {
+        throw new HaipValidationError(
+          "MISSING_SDJWT_META",
+          `credential '${credential.id}' with format 'dc+sd-jwt' must set meta.vct_values`,
+          credential.id
         );
       }
-    } else {
-      const isTrusted = options.trustedCertificates.some((trusted) => bytesEqual(trusted, issuerCertBytes));
-      if (!isTrusted) {
-        return invalidResult("Issuer certificate is not trusted");
-      }
     }
-    const sdArray = payload["_sd"];
-    if (parts.disclosures.length > 0) {
-      if (!Array.isArray(sdArray) || sdArray.length === 0) {
-        return invalidResult("Disclosures present but no _sd array in issuer JWT");
-      }
-      for (const disclosure of parts.disclosures) {
-        const hashBytes = await sha256Hasher(disclosure);
-        const hashB64url = bytesToBase64url(hashBytes);
-        if (!sdArray.includes(hashB64url)) {
-          return invalidResult("Disclosure hash mismatch");
-        }
+    if (credential.format === "mso_mdoc") {
+      if (typeof credential.meta?.doctype_value !== "string") {
+        throw new HaipValidationError(
+          "MISSING_MDOC_META",
+          `credential '${credential.id}' with format 'mso_mdoc' must set meta.doctype_value`,
+          credential.id
+        );
       }
     }
-    if (parts.kbJwt) {
-      const cnf = payload["cnf"];
-      if (!cnf || typeof cnf !== "object" || !cnf["jwk"]) {
-        throw new MalformedCredentialError("Missing cnf.jwk in issuer JWT for key binding");
-      }
-      let holderKey;
-      try {
-        const kbHeader = jose.decodeProtectedHeader(parts.kbJwt);
-        const kbAlg = kbHeader.alg;
-        if (typeof kbAlg !== "string" || !allowedAlgorithms.includes(kbAlg)) {
-          return invalidResult(`Unsupported KB-JWT algorithm: ${kbAlg}`);
-        }
-        holderKey = await jose.importJWK(cnf["jwk"], kbAlg);
-      } catch (err) {
-        if (err instanceof MalformedCredentialError) throw err;
-        throw new MalformedCredentialError("Failed to import holder key from cnf.jwk");
-      }
-      let kbPayload;
-      try {
-        const kbResult = await jose.jwtVerify(parts.kbJwt, holderKey, {
-          algorithms: allowedAlgorithms,
-          ...options.audience ? { audience: options.audience } : {}
-        });
-        kbPayload = kbResult.payload;
-      } catch {
-        return invalidResult("Key binding JWT signature verification failed");
-      }
-      if (kbPayload["nonce"] !== options.nonce) {
-        return invalidResult("Key binding JWT nonce does not match");
-      }
-      const disclosurePart = parts.disclosures.length > 0 ? parts.disclosures.join("~") + "~" : "";
-      const sdJwtForHash = parts.jwt + "~" + disclosurePart;
-      const sdHashBytes = await sha256Hasher(sdJwtForHash);
-      const expectedSdHash = bytesToBase64url(sdHashBytes);
-      if (kbPayload["sd_hash"] !== expectedSdHash) {
-        return invalidResult("Key binding JWT sd_hash does not match");
-      }
+    if (!credential.claims || credential.claims.length === 0) {
+      throw new HaipValidationError(
+        "NO_CLAIMS",
+        `credential '${credential.id}' must declare at least one claim`,
+        credential.id
+      );
     }
-    let resolvedClaims;
-    try {
-      const decoded = await decode.decodeSdJwt(vpToken, sha256Hasher);
-      resolvedClaims = await decode.getClaims(
-        decoded.jwt.payload,
-        decoded.disclosures,
-        sha256Hasher
+    if (credential.claim_sets !== void 0) {
+      throw new HaipValidationError(
+        "CLAIM_SETS_DISALLOWED",
+        `credential '${credential.id}' uses claim_sets, not permitted in HAIP-minimal`,
+        credential.id
       );
-    } catch {
-      throw new MalformedCredentialError("Failed to decode SD-JWT disclosures");
     }
-    return {
-      valid: true,
-      format: this.format,
-      claims: mapToCredentialClaims(resolvedClaims),
-      issuer: issuerInfo
-    };
   }
-};
+}
+function isHaipQuery(query) {
+  try {
+    validateHaipQuery(query);
+    return true;
+  } catch {
+    return false;
+  }
+}
 var decoder = new cborX.Encoder({ mapsAsObjects: false, useRecords: false });
 var HEADER_ALG = 1;
 var HEADER_X5CHAIN = 33;
@@ -371,7 +297,7 @@ async function computeItemDigest(itemBytes, digestAlgorithm) {
   const buf = await crypto.subtle.digest(digestAlgorithm, new Uint8Array(itemBytes));
   return new Uint8Array(buf);
 }
-function bytesEqual2(a, b) {
+function bytesEqual(a, b) {
   if (a.length !== b.length) return false;
   for (let i = 0; i < a.length; i++) {
     if (a[i] !== b[i]) return false;
@@ -417,7 +343,7 @@ async function verifyAllDigests(nameSpaces, mso) {
       if (!expectedDigest) {
         throw new MalformedCredentialError(`digestID ${digestID} missing from MSO valueDigests[${ns}]`);
       }
-      if (!bytesEqual2(hash, expectedDigest)) {
+      if (!bytesEqual(hash, expectedDigest)) {
         throw new MalformedCredentialError(`digest mismatch for ns=${ns} digestID=${digestID}`);
       }
     }
@@ -531,15 +457,15 @@ function validateMsoDocType(mso, expectedDocType) {
 // src/parsers/mdoc.parser.ts
 var decoder4 = new cborX.Encoder({ mapsAsObjects: false, useRecords: false });
 var encoder = new cborX.Encoder({ mapsAsObjects: false, useRecords: false });
-var DEFAULT_ALLOWED_ALGORITHMS2 = ["ES256", "ES384", "ES512"];
-function bytesEqual3(a, b) {
+var DEFAULT_ALLOWED_ALGORITHMS = ["ES256", "ES384", "ES512"];
+function bytesEqual2(a, b) {
   if (a.length !== b.length) return false;
   for (let i = 0; i < a.length; i++) {
     if (a[i] !== b[i]) return false;
   }
   return true;
 }
-function derToPem2(der) {
+function derToPem(der) {
   let binary = "";
   for (const b of der) binary += String.fromCharCode(b);
   const b64 = globalThis.btoa(binary);
@@ -564,8 +490,10 @@ function extractRawItemBytes(item) {
   throw new MalformedCredentialError("IssuerSignedItem must be a tag-24 byte string");
 }
 function mapRawToClaims(nameSpaces) {
-  const out = {};
-  for (const items of nameSpaces.values()) {
+  const flat = {};
+  const namespaced = {};
+  for (const [ns, items] of nameSpaces.entries()) {
+    const nsBucket = namespaced[ns] ?? {};
     for (const itemBytes of items) {
       let decoded;
       try {
@@ -587,12 +515,14 @@ function mapRawToClaims(nameSpaces) {
         const id = inner.get("elementIdentifier");
         const val = inner.get("elementValue");
         if (typeof id === "string") {
-          out[id] = val;
+          flat[id] = val;
+          nsBucket[id] = val;
         }
       }
     }
+    namespaced[ns] = nsBucket;
   }
-  return out;
+  return { flat, namespaced };
 }
 var MdocParser = class {
   format = "mdoc";
@@ -614,7 +544,7 @@ var MdocParser = class {
     if (!(vpToken instanceof Uint8Array)) {
       throw new MalformedCredentialError("mDOC vpToken must be a Uint8Array");
     }
-    const allowedAlgorithms = options.allowedAlgorithms ?? DEFAULT_ALLOWED_ALGORITHMS2;
+    const allowedAlgorithms = options.allowedAlgorithms ?? DEFAULT_ALLOWED_ALGORITHMS;
     let deviceResponse;
     try {
       const decoded = decoder4.decode(vpToken);
@@ -661,7 +591,7 @@ var MdocParser = class {
         );
       }
     } else {
-      const trusted = options.trustedCertificates.some((t) => bytesEqual3(t, issuerCertBytes));
+      const trusted = options.trustedCertificates.some((t) => bytesEqual2(t, issuerCertBytes));
       if (!trusted) {
         return {
           valid: false,
@@ -672,7 +602,7 @@ var MdocParser = class {
         };
       }
     }
-    const publicKey = await jose.importX509(derToPem2(issuerCertBytes), cose.alg);
+    const publicKey = await jose.importX509(derToPem(issuerCertBytes), cose.alg);
     try {
       await verifyCoseSign1(cose, publicKey, allowedAlgorithms);
     } catch (err) {
@@ -730,52 +660,243 @@ var MdocParser = class {
       nameSpaces.set(ns, items.map(extractRawItemBytes));
     }
     await verifyAllDigests(nameSpaces, mso);
-    const claims = mapRawToClaims(nameSpaces);
+    const { flat: claims, namespaced: namespacedClaims } = mapRawToClaims(nameSpaces);
     const issuer = {
       certificate: issuerCertBytes,
       country: extractCountryHintFromCert()
     };
-    return { valid: true, format: this.format, claims, issuer };
+    return {
+      valid: true,
+      format: this.format,
+      claims,
+      issuer,
+      docType: mso.docType,
+      namespacedClaims
+    };
   }
 };
-function createAuthorizationRequest(input) {
-  const state = input.state ?? uuid.v4();
-  const presentationDefinition = {
-    id: uuid.v4(),
-    input_descriptors: input.requestedAttributes.map((attr, index) => ({
-      id: `descriptor_${index}`,
-      format: Object.fromEntries(
-        input.acceptedFormats.map((fmt) => {
-          if (fmt === "sd-jwt-vc") return ["vc+sd-jwt", { "sd-jwt_alg_values": ["ES256"] }];
-          return ["mso_mdoc", { alg: ["ES256"] }];
-        })
-      ),
-      constraints: {
-        fields: [
-          {
-            path: [`$.${attr}`, `$['${attr}']`],
-            filter: { type: attr.startsWith("age_over") ? "boolean" : "string" }
-          }
-        ]
-      }
-    }))
-  };
-  const params = new URLSearchParams({
-    response_type: "vp_token",
-    response_mode: "direct_post",
-    response_uri: input.responseUri,
-    client_id: input.clientId,
-    nonce: input.nonce,
-    state,
-    presentation_definition: JSON.stringify(presentationDefinition)
-  });
-  return {
-    uri: `openid4vp://authorize?${params.toString()}`,
-    presentationDefinition,
-    nonce: input.nonce,
-    state
-  };
+var DEFAULT_ALLOWED_ALGORITHMS2 = ["ES256", "ES384", "ES512"];
+var sha256Hasher = async (data, _alg) => {
+  const encoder2 = new TextEncoder();
+  const input = typeof data === "string" ? encoder2.encode(data) : data;
+  const hashBuffer = await crypto.subtle.digest("SHA-256", input);
+  return new Uint8Array(hashBuffer);
+};
+var BASE64_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function base64ToBytes(base64) {
+  const cleaned = base64.replace(/=+$/, "");
+  const byteLength = Math.floor(cleaned.length * 3 / 4);
+  const buffer = new ArrayBuffer(byteLength);
+  const bytes = new Uint8Array(buffer);
+  let byteIndex = 0;
+  for (let i = 0; i < cleaned.length; i += 4) {
+    const a = BASE64_CHARS.indexOf(cleaned[i]);
+    const b = i + 1 < cleaned.length ? BASE64_CHARS.indexOf(cleaned[i + 1]) : 0;
+    const c = i + 2 < cleaned.length ? BASE64_CHARS.indexOf(cleaned[i + 2]) : 0;
+    const d = i + 3 < cleaned.length ? BASE64_CHARS.indexOf(cleaned[i + 3]) : 0;
+    bytes[byteIndex++] = a << 2 | b >> 4;
+    if (byteIndex < byteLength) bytes[byteIndex++] = (b & 15) << 4 | c >> 2;
+    if (byteIndex < byteLength) bytes[byteIndex++] = (c & 3) << 6 | d;
+  }
+  return bytes;
+}
+function bytesEqual3(a, b) {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) {
+    if (a[i] !== b[i]) return false;
+  }
+  return true;
+}
+function derToPem2(base64Der) {
+  const lines = base64Der.match(/.{1,64}/g) || [];
+  return `-----BEGIN CERTIFICATE-----
+${lines.join("\n")}
+-----END CERTIFICATE-----`;
+}
+function bytesToBase64url(bytes) {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return globalThis.btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
+function mapToCredentialClaims(raw) {
+  const claims = {};
+  if (typeof raw["age_over_18"] === "boolean") {
+    claims.age_over_18 = raw["age_over_18"];
+  }
+  if (typeof raw["age_over_21"] === "boolean") {
+    claims.age_over_21 = raw["age_over_21"];
+  }
+  if (typeof raw["resident_country"] === "string") {
+    claims.resident_country = raw["resident_country"];
+  }
+  if (typeof raw["nationality"] === "string") {
+    claims.nationality = raw["nationality"];
+  }
+  if (typeof raw["family_name_birth"] === "string") {
+    claims.family_name_birth = raw["family_name_birth"];
+  }
+  for (const [key, value] of Object.entries(raw)) {
+    if (!(key in claims) && !key.startsWith("_sd") && key !== "iss" && key !== "exp" && key !== "iat" && key !== "cnf" && key !== "vct") {
+      claims[key] = value;
+    }
+  }
+  return claims;
+}
+function extractCountryHint(issuer) {
+  try {
+    const url = new URL(issuer);
+    const tld = url.hostname.split(".").pop()?.toUpperCase();
+    if (tld && tld.length === 2) {
+      return tld;
+    }
+  } catch {
+  }
+  return "";
+}
+var SdJwtParser = class {
+  format = "sd-jwt-vc";
+  canParse(vpToken) {
+    return typeof vpToken === "string" && vpToken.includes("~");
+  }
+  async parse(vpToken, options) {
+    if (typeof vpToken !== "string") {
+      throw new MalformedCredentialError("VP token must be a string");
+    }
+    const allowedAlgorithms = options.allowedAlgorithms ?? DEFAULT_ALLOWED_ALGORITHMS2;
+    const invalidResult = (error) => ({
+      valid: false,
+      format: this.format,
+      claims: {},
+      issuer: { certificate: new Uint8Array(), country: "" },
+      error
+    });
+    let parts;
+    try {
+      parts = decode.splitSdJwt(vpToken);
+    } catch {
+      throw new MalformedCredentialError("Failed to split SD-JWT structure");
+    }
+    let header;
+    try {
+      header = jose.decodeProtectedHeader(parts.jwt);
+    } catch {
+      throw new MalformedCredentialError("Failed to decode SD-JWT issuer JWT header");
+    }
+    const alg = header.alg;
+    if (typeof alg !== "string" || !allowedAlgorithms.includes(alg)) {
+      return invalidResult(`Unsupported algorithm: ${alg}`);
+    }
+    const x5cArray = header.x5c;
+    if (!Array.isArray(x5cArray) || x5cArray.length === 0 || typeof x5cArray[0] !== "string") {
+      throw new MalformedCredentialError("Missing or invalid x5c in JWT header");
+    }
+    let issuerKey;
+    let issuerCertBytes;
+    try {
+      issuerKey = await jose.importX509(derToPem2(x5cArray[0]), alg);
+      issuerCertBytes = base64ToBytes(x5cArray[0]);
+    } catch (err) {
+      if (err instanceof MalformedCredentialError) throw err;
+      throw new MalformedCredentialError("Failed to import issuer certificate");
+    }
+    let payload;
+    try {
+      const result = await jose.jwtVerify(parts.jwt, issuerKey, { algorithms: allowedAlgorithms });
+      payload = result.payload;
+    } catch {
+      return invalidResult("Issuer JWT signature verification failed");
+    }
+    const issuerString = typeof payload["iss"] === "string" ? payload["iss"] : "";
+    const issuerInfo = {
+      certificate: issuerCertBytes,
+      country: extractCountryHint(issuerString)
+    };
+    if (options.trustedCertificates.length === 0) {
+      if (options.skipTrustCheck !== true) {
+        throw new MalformedCredentialError(
+          "trustedCertificates must not be empty unless skipTrustCheck is true"
+        );
+      }
+    } else {
+      const isTrusted = options.trustedCertificates.some((trusted) => bytesEqual3(trusted, issuerCertBytes));
+      if (!isTrusted) {
+        return invalidResult("Issuer certificate is not trusted");
+      }
+    }
+    const sdArray = payload["_sd"];
+    if (parts.disclosures.length > 0) {
+      if (!Array.isArray(sdArray) || sdArray.length === 0) {
+        return invalidResult("Disclosures present but no _sd array in issuer JWT");
+      }
+      for (const disclosure of parts.disclosures) {
+        const hashBytes = await sha256Hasher(disclosure);
+        const hashB64url = bytesToBase64url(hashBytes);
+        if (!sdArray.includes(hashB64url)) {
+          return invalidResult("Disclosure hash mismatch");
+        }
+      }
+    }
+    if (parts.kbJwt) {
+      const cnf = payload["cnf"];
+      if (!cnf || typeof cnf !== "object" || !cnf["jwk"]) {
+        throw new MalformedCredentialError("Missing cnf.jwk in issuer JWT for key binding");
+      }
+      let holderKey;
+      try {
+        const kbHeader = jose.decodeProtectedHeader(parts.kbJwt);
+        const kbAlg = kbHeader.alg;
+        if (typeof kbAlg !== "string" || !allowedAlgorithms.includes(kbAlg)) {
+          return invalidResult(`Unsupported KB-JWT algorithm: ${kbAlg}`);
+        }
+        holderKey = await jose.importJWK(cnf["jwk"], kbAlg);
+      } catch (err) {
+        if (err instanceof MalformedCredentialError) throw err;
+        throw new MalformedCredentialError("Failed to import holder key from cnf.jwk");
+      }
+      let kbPayload;
+      try {
+        const kbResult = await jose.jwtVerify(parts.kbJwt, holderKey, {
+          algorithms: allowedAlgorithms,
+          ...options.audience ? { audience: options.audience } : {}
+        });
+        kbPayload = kbResult.payload;
+      } catch {
+        return invalidResult("Key binding JWT signature verification failed");
+      }
+      if (kbPayload["nonce"] !== options.nonce) {
+        return invalidResult("Key binding JWT nonce does not match");
+      }
+      const disclosurePart = parts.disclosures.length > 0 ? parts.disclosures.join("~") + "~" : "";
+      const sdJwtForHash = parts.jwt + "~" + disclosurePart;
+      const sdHashBytes = await sha256Hasher(sdJwtForHash);
+      const expectedSdHash = bytesToBase64url(sdHashBytes);
+      if (kbPayload["sd_hash"] !== expectedSdHash) {
+        return invalidResult("Key binding JWT sd_hash does not match");
+      }
+    }
+    let resolvedClaims;
+    try {
+      const decoded = await decode.decodeSdJwt(vpToken, sha256Hasher);
+      resolvedClaims = await decode.getClaims(
+        decoded.jwt.payload,
+        decoded.disclosures,
+        sha256Hasher
+      );
+    } catch {
+      throw new MalformedCredentialError("Failed to decode SD-JWT disclosures");
+    }
+    const vct = typeof payload["vct"] === "string" ? payload["vct"] : void 0;
+    return {
+      valid: true,
+      format: this.format,
+      claims: mapToCredentialClaims(resolvedClaims),
+      issuer: issuerInfo,
+      ...vct !== void 0 ? { vct } : {}
+    };
+  }
+};
 
 // src/presentation.ts
 var parsers = [new SdJwtParser(), new MdocParser()];
@@ -793,11 +914,80 @@ async function parsePresentation(vpToken, options) {
     error: "Unsupported credential format"
   };
 }
+var INTERNAL_TO_DCQL_FORMAT = {
+  "sd-jwt-vc": "dc+sd-jwt",
+  mdoc: "mso_mdoc"
+};
+function classifyMismatch(query, decoded, hasDetail) {
+  if (decoded.format !== query.format) return "format_mismatch";
+  if (query.format === "dc+sd-jwt") {
+    const allowed = query.meta?.vct_values;
+    if (allowed && allowed.length > 0 && !allowed.includes(decoded.vct ?? "")) {
+      return "vct_mismatch";
+    }
+  }
+  if (query.format === "mso_mdoc") {
+    const expected = query.meta?.doctype_value;
+    if (expected && expected !== decoded.doctype) return "doctype_mismatch";
+  }
+  if (query.trusted_authorities && query.trusted_authorities.length > 0) {
+    const decodedAuthIds = decoded.trusted_authority_ids ?? [];
+    const anyMatch = query.trusted_authorities.some(
+      (ta) => ta.values.some((v) => decodedAuthIds.includes(v))
+    );
+    if (!anyMatch) return "trusted_authority_mismatch";
+  }
+  if (hasDetail) return "missing_claims";
+  return "no_credential_found";
+}
+function refineUnmatched(query, decoded, match) {
+  if (match.unmatched.length === 0) return match;
+  const refined = match.unmatched.map((entry) => {
+    const credentialQuery = query.credentials.find((c) => c.id === entry.queryId);
+    if (!credentialQuery) return entry;
+    const specific = classifyMismatch(credentialQuery, decoded, entry.detail !== void 0);
+    return { ...entry, reason: specific };
+  });
+  return { ...match, unmatched: refined };
+}
+async function verifyPresentation(vpToken, query, options) {
+  const parsed = await parsePresentation(vpToken, options);
+  const dcqlFormat = INTERNAL_TO_DCQL_FORMAT[parsed.format] ?? parsed.format;
+  const decodedClaims = parsed.format === "mdoc" && parsed.namespacedClaims !== void 0 ? parsed.namespacedClaims : parsed.claims;
+  const decoded = {
+    id: query.credentials[0]?.id ?? "presented",
+    format: dcqlFormat,
+    claims: decodedClaims
+  };
+  if (parsed.format === "sd-jwt-vc" && typeof parsed.vct === "string") {
+    decoded.vct = parsed.vct;
+  }
+  if (parsed.format === "mdoc" && typeof parsed.docType === "string") {
+    decoded.doctype = parsed.docType;
+  }
+  const rawMatch = dcql.matchQuery(query, [decoded]);
+  const match = refineUnmatched(query, decoded, rawMatch);
+  const submission = match.satisfied ? dcql.buildSubmission(query, match) : null;
+  return {
+    parsed,
+    match,
+    submission,
+    valid: parsed.valid && match.satisfied
+  };
+}
+var VERSION = "0.4.0";
 
-// src/index.ts
-var VERSION = "0.3.0";
-
+Object.defineProperty(exports, "DcqlMatchError", {
+  enumerable: true,
+  get: function () { return dcql.DcqlMatchError; }
+});
+Object.defineProperty(exports, "DcqlValidationError", {
+  enumerable: true,
+  get: function () { return dcql.DcqlValidationError; }
+});
 exports.ExpiredCredentialError = ExpiredCredentialError;
+exports.HAIP_DOCTYPE_NAMESPACES = HAIP_DOCTYPE_NAMESPACES;
+exports.HaipValidationError = HaipValidationError;
 exports.InvalidSignatureError = InvalidSignatureError;
 exports.MalformedCredentialError = MalformedCredentialError;
 exports.MdocParser = MdocParser;
@@ -805,7 +995,11 @@ exports.NonceValidationError = NonceValidationError;
 exports.SdJwtParser = SdJwtParser;
 exports.UnsupportedFormatError = UnsupportedFormatError;
 exports.VERSION = VERSION;
+exports.buildHaipQuery = buildHaipQuery;
 exports.createAuthorizationRequest = createAuthorizationRequest;
+exports.isHaipQuery = isHaipQuery;
 exports.parsePresentation = parsePresentation;
+exports.validateHaipQuery = validateHaipQuery;
+exports.verifyPresentation = verifyPresentation;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map