@openeudi/openid4vp 0.6.0 → 0.8.0

package/README.md

@@ -124,6 +124,96 @@ Mismatches return `valid: false` — they do not throw. Only crypto/structural f
 
 > **Privacy — diagnostics are verifier-internal.** `match.unmatched[].reason` and `detail` (including `value_mismatch`) are intended for verifier-side logging, debugging, and admin UIs. OpenID4VP §11 warns that per-claim verification outcomes can reveal wallet contents to observers. Do NOT echo these diagnostics into the OpenID4VP wire response sent back to the wallet, into end-user-visible error messages that another party could correlate, or into public analytics/third-party logs. The protocol's own error codes are the public interface; these fields are your internal instrumentation.
 
+## Signed authorization requests (x509_san_dns)
+
+For flows that require a signed request object (JAR) per OpenID4VP 1.0 §5.10, use `createSignedAuthorizationRequest`:
+
+```ts
+import { createSignedAuthorizationRequest } from "@openeudi/openid4vp";
+
+const req = await createSignedAuthorizationRequest({
+  hostname: "verifier.example.com",
+  requestUri: "https://verifier.example.com/request.jwt",
+  responseUri: "https://verifier.example.com/response",
+  nonce,
+  signer: verifierKeyPair,          // CryptoKeyPair with public+private
+  certificateChain: [leafCertDer],  // DER-encoded, leaf SAN DNSName must equal hostname
+  encryptionKey: {
+    publicJwk: encryptionPublicJwk, // must include alg, e.g. "ECDH-ES"
+  },
+  vpFormatsSupported: {
+    "dc+sd-jwt": { "sd-jwt_alg_values": ["ES256"] },
+  },
+}, dcqlQuery);
+
+// req.uri — the short URI to hand to the wallet
+// req.requestObject — the JWS the verifier must host at requestUri
+//                     (Content-Type: application/oauth-authz-req+jwt)
+```
+
+The caller hosts `req.requestObject` at `requestUri` (the library does not host HTTP). The library verifies that the signing key's public SPKI matches the leaf certificate's public key — an attempt to sign with a mismatched key fails with `SignedRequestBuildError: signing_key_cert_mismatch`.
+
+## Authorization responses (direct_post and direct_post.jwt)
+
+Wallets POST the Authorization Response to your `responseUri`. The library is stateless — you MUST compare the envelope's `state` against the value you issued before treating the response as trustworthy. The recommended pattern differs slightly between the unencrypted and encrypted modes.
+
+### Unencrypted (`direct_post`)
+
+The envelope arrives as form-encoded JSON; parse it, check `state`, then verify:
+
+```ts
+import { verifyAuthorizationResponse } from "@openeudi/openid4vp";
+
+const envelope = parsedVpTokenObject; // { vp_token, state, ... }
+
+if (envelope.state !== submittedState) {
+  throw new Error("state mismatch — possible CSRF / replay");
+}
+
+const result = await verifyAuthorizationResponse(envelope, dcqlQuery, {
+  trustedCertificates: [issuerCertDer],
+  nonce,
+});
+```
+
+### Encrypted (`direct_post.jwt`)
+
+The wallet wraps the envelope in a JWE. Decrypt explicitly so you can check `state` against the decrypted envelope **before** verification runs:
+
+```ts
+import {
+  decryptAuthorizationResponse,
+  verifyAuthorizationResponse,
+} from "@openeudi/openid4vp";
+
+const decrypted = await decryptAuthorizationResponse(
+  form.get("response"), // the JWE string
+  verifierEncryptionPrivateKey,
+);
+
+if (decrypted.state !== submittedState) {
+  throw new Error("state mismatch — possible CSRF / replay");
+}
+
+const result = await verifyAuthorizationResponse(decrypted, dcqlQuery, {
+  trustedCertificates: [issuerCertDer],
+  nonce,
+});
+```
+
+`verifyAuthorizationResponse` also accepts the JWE directly via `{ response: jwe }` together with `options.decryptionKey` — but that path makes the `state` check easy to skip, since the caller never holds the decrypted envelope. Prefer the explicit two-step pattern above.
+
+`verifyAuthorizationResponse` accepts the OpenID4VP 1.0 §8.1 envelope shape: `vp_token` is always an object keyed by DCQL credential query id, with arrays of presentations. This release supports **single-credential single-presentation only** — multi-credential queries or multi-presentation arrays throw `MultipleCredentialsNotSupportedError`.
+
+### Supported JWE algorithms
+
+`direct_post.jwt` decryption supports:
+
+- `alg`: `ECDH-ES` (driven by the encryption JWK's `alg` parameter)
+- `enc`: `A128GCM`, `A256GCM` (HAIP requires both)
+
+Other algorithms throw `UnsupportedJweError`.
+
 ### ParseOptions / VerifyOptions
 
 Both `parsePresentation` and `verifyPresentation` accept:
@@ -248,6 +338,10 @@ This library implements the **verifier side** of OpenID4VP for SD-JWT VC and mDO
 
 EUDI Architecture Reference Framework (ARF) alignment: tracks OpenID4VP 1.0 final. Full ARF 1.4+ profile compliance will be added before a stable 1.0.
 
+## OIDF Conformance Testing
+
+Verifier-side conformance is automated against a self-hosted OpenID Foundation conformance suite. See `docs/manual-testing/oidf-interop.md` for both the CI orchestrator (`npm run oidf:ci -- --profile=happy-flow|full`) and the manual hosted-demo escape hatch.
+
 ## Related packages
 
 - **[@openeudi/core](https://www.npmjs.com/package/@openeudi/core)** -- Framework-agnostic EUDI Wallet verification protocol engine with session management and QR code generation.

package/dist/index.cjs

@@ -2,8 +2,8 @@
 
 var x509 = require('@peculiar/x509');
 var uuid = require('uuid');
-var cborX = require('cbor-x');
 var jose = require('jose');
+var cborX = require('cbor-x');
 var decode = require('@sd-jwt/decode');
 var dcql = require('@openeudi/dcql');
 var xmldom = require('@xmldom/xmldom');
@@ -40,7 +40,7 @@ var __export = (target, all) => {
 };
 
 // src/errors.ts
-exports.InvalidSignatureError = void 0; exports.ExpiredCredentialError = void 0; exports.UnsupportedFormatError = void 0; exports.MalformedCredentialError = void 0; exports.NonceValidationError = void 0; exports.HaipValidationError = void 0; exports.OpenID4VPError = void 0; exports.TrustAnchorNotFoundError = void 0; exports.CertificateChainError = void 0; exports.RevokedCertificateError = void 0; exports.RevocationCheckFailedError = void 0; exports.LotlFetchError = void 0; exports.LotlSignatureError = void 0;
+exports.InvalidSignatureError = void 0; exports.ExpiredCredentialError = void 0; exports.UnsupportedFormatError = void 0; exports.MalformedCredentialError = void 0; exports.NonceValidationError = void 0; exports.HaipValidationError = void 0; exports.OpenID4VPError = void 0; exports.TrustAnchorNotFoundError = void 0; exports.CertificateChainError = void 0; exports.RevokedCertificateError = void 0; exports.RevocationCheckFailedError = void 0; exports.LotlFetchError = void 0; exports.LotlSignatureError = void 0; exports.SignedRequestBuildError = void 0; exports.UnsupportedJweError = void 0; exports.DecryptionFailedError = void 0; exports.MissingDecryptionKeyError = void 0; exports.MultipleCredentialsNotSupportedError = void 0;
 var init_errors = __esm({
   "src/errors.ts"() {
     exports.InvalidSignatureError = class extends Error {
@@ -136,6 +136,47 @@ var init_errors = __esm({
     exports.LotlSignatureError = class extends exports.OpenID4VPError {
       code = "lotl_signature_invalid";
     };
+    exports.SignedRequestBuildError = class extends exports.OpenID4VPError {
+      code;
+      constructor(code, message) {
+        super(message);
+        this.code = code;
+      }
+    };
+    exports.UnsupportedJweError = class extends exports.OpenID4VPError {
+      code = "unsupported_jwe";
+      alg;
+      enc;
+      constructor(alg, enc) {
+        super(`Unsupported JWE algorithms: alg=${alg}, enc=${enc}`);
+        this.alg = alg;
+        this.enc = enc;
+      }
+    };
+    exports.DecryptionFailedError = class extends exports.OpenID4VPError {
+      code = "decryption_failed";
+      constructor(message = "Failed to decrypt authorization response", options) {
+        super(message, options);
+      }
+    };
+    exports.MissingDecryptionKeyError = class extends exports.OpenID4VPError {
+      code = "missing_decryption_key";
+      constructor(message = "decryptionKey is required to verify a direct_post.jwt response") {
+        super(message);
+      }
+    };
+    exports.MultipleCredentialsNotSupportedError = class extends exports.OpenID4VPError {
+      code = "multi_credential_unsupported";
+      entryCount;
+      presentationCount;
+      constructor(entryCount, presentationCount) {
+        super(
+          `Multi-credential presentations are not yet supported: ${entryCount} queryId entries, ${presentationCount} presentations`
+        );
+        this.entryCount = entryCount;
+        this.presentationCount = presentationCount;
+      }
+    };
   }
 });
 
@@ -8045,6 +8086,138 @@ function createAuthorizationRequest(input, query) {
   };
 }
 
+// src/signed-authorization.ts
+init_errors();
+var DEFAULT_SUPPORTED_ENC_VALUES = ["A128GCM", "A256GCM"];
+var SUPPORTED_SIGNING_ALGS = /* @__PURE__ */ new Set(["ES256", "ES384", "RS256"]);
+async function createSignedAuthorizationRequest(input, query) {
+  if (input.certificateChain.length === 0) {
+    throw new exports.SignedRequestBuildError(
+      "empty_cert_chain",
+      "certificateChain must contain at least the leaf certificate"
+    );
+  }
+  const signingAlg = input.signingAlgorithm ?? "ES256";
+  if (!SUPPORTED_SIGNING_ALGS.has(signingAlg)) {
+    throw new exports.SignedRequestBuildError(
+      "unsupported_signing_alg",
+      `signingAlgorithm ${signingAlg} is not supported (expected ES256/ES384/RS256)`
+    );
+  }
+  if (!input.vpFormatsSupported || Object.keys(input.vpFormatsSupported).length === 0) {
+    throw new exports.SignedRequestBuildError(
+      "missing_vp_formats",
+      "vpFormatsSupported is required and must be non-empty"
+    );
+  }
+  const leafCert = new x509.X509Certificate(toArrayBuffer(input.certificateChain[0]));
+  const sanDnsNames = extractDnsNames(leafCert);
+  if (!sanDnsNames.includes(input.hostname)) {
+    throw new exports.SignedRequestBuildError(
+      "hostname_cert_mismatch",
+      `leaf cert SAN DNSName values [${sanDnsNames.join(", ")}] do not include hostname "${input.hostname}"`
+    );
+  }
+  const signerPublicSpki = new Uint8Array(
+    await crypto.subtle.exportKey("spki", input.signer.publicKey)
+  );
+  const leafSpki = new Uint8Array(leafCert.publicKey.rawData);
+  if (!bytesEqual(signerPublicSpki, leafSpki)) {
+    throw new exports.SignedRequestBuildError(
+      "signing_key_cert_mismatch",
+      "signer.publicKey SPKI does not match leaf certificate SPKI"
+    );
+  }
+  const responseMode = input.responseMode ?? "direct_post.jwt";
+  if (responseMode === "direct_post.jwt") {
+    if (!input.encryptionKey?.publicJwk) {
+      throw new exports.SignedRequestBuildError(
+        "missing_encryption_jwk",
+        "direct_post.jwt response mode requires encryptionKey.publicJwk"
+      );
+    }
+    if (!input.encryptionKey.publicJwk.alg) {
+      throw new exports.SignedRequestBuildError(
+        "missing_encryption_alg",
+        "encryptionKey.publicJwk must carry alg (OpenID4VP 1.0 \xA78.3)"
+      );
+    }
+  }
+  const state = input.state ?? uuid.v4();
+  const clientId = `x509_san_dns:${input.hostname}`;
+  const now = Math.floor(Date.now() / 1e3);
+  const clientMetadata = {
+    vp_formats_supported: input.vpFormatsSupported
+  };
+  if (responseMode === "direct_post.jwt" && input.encryptionKey) {
+    const enc = input.encryptionKey.supportedEncValues;
+    if (enc !== void 0 && enc.length === 0) {
+      throw new exports.SignedRequestBuildError(
+        "empty_supported_enc_values",
+        "encryptionKey.supportedEncValues must not be empty (omit to use defaults [A128GCM, A256GCM])"
+      );
+    }
+    const jwk = { ...input.encryptionKey.publicJwk, use: "enc" };
+    clientMetadata.jwks = { keys: [jwk] };
+    const encValues = enc ?? [...DEFAULT_SUPPORTED_ENC_VALUES];
+    clientMetadata.encrypted_response_enc_values_supported = encValues;
+    clientMetadata.authorization_encrypted_response_alg = "ECDH-ES";
+    clientMetadata.authorization_encrypted_response_enc = encValues[0];
+  }
+  const payload = {
+    iss: clientId,
+    aud: "https://self-issued.me/v2",
+    response_type: "vp_token",
+    response_mode: responseMode,
+    client_id: clientId,
+    response_uri: input.responseUri,
+    nonce: input.nonce,
+    state,
+    dcql_query: query,
+    client_metadata: clientMetadata,
+    iat: now,
+    exp: now + 120
+  };
+  const x5c = input.certificateChain.map((der) => bytesToBase64(der));
+  const jws = await new jose.SignJWT(payload).setProtectedHeader({ typ: "oauth-authz-req+jwt", alg: signingAlg, x5c }).sign(input.signer.privateKey);
+  const uriParams = new URLSearchParams({
+    client_id: clientId,
+    request_uri: input.requestUri
+  });
+  return {
+    uri: `openid4vp://authorize?${uriParams.toString()}`,
+    requestObject: jws,
+    dcqlQuery: query,
+    nonce: input.nonce,
+    state
+  };
+}
+function extractDnsNames(cert) {
+  const SAN_OID = "2.5.29.17";
+  const ext = cert.extensions.find((e) => e.type === SAN_OID);
+  if (!ext) return [];
+  const names = ext.names;
+  const items = names?.items ?? [];
+  return items.filter((e) => e.type === "dns").map((e) => e.value);
+}
+function bytesEqual(a, b) {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) {
+    if (a[i] !== b[i]) return false;
+  }
+  return true;
+}
+function bytesToBase64(bytes) {
+  let s = "";
+  for (let i = 0; i < bytes.length; i++) s += String.fromCharCode(bytes[i]);
+  return btoa(s);
+}
+function toArrayBuffer(bytes) {
+  const out = new ArrayBuffer(bytes.byteLength);
+  new Uint8Array(out).set(bytes);
+  return out;
+}
+
 // src/haip.ts
 init_errors();
 var HAIP_DOCTYPE_NAMESPACES = {
@@ -8248,7 +8421,7 @@ async function verifyCoseSign1(coseSign1, publicKey, allowedAlgorithms) {
     throw new exports.MalformedCredentialError(`no hash mapping for alg ${coseSign1.alg}`);
   }
   const sigStructure = ["Signature1", coseSign1.protectedHeaderBytes, new Uint8Array(0), coseSign1.payload];
-  const sigInput = decoder.encode(sigStructure);
+  const sigInput = new Uint8Array(decoder.encode(sigStructure));
   const ok = await crypto.subtle.verify(
     { name: "ECDSA", hash: hashAlg },
     publicKey,
@@ -8271,7 +8444,7 @@ async function computeItemDigest(itemBytes, digestAlgorithm) {
   const buf = await crypto.subtle.digest(digestAlgorithm, new Uint8Array(itemBytes));
   return new Uint8Array(buf);
 }
-function bytesEqual(a, b) {
+function bytesEqual2(a, b) {
   if (a.length !== b.length) return false;
   for (let i = 0; i < a.length; i++) {
     if (a[i] !== b[i]) return false;
@@ -8317,7 +8490,7 @@ async function verifyAllDigests(nameSpaces, mso) {
       if (!expectedDigest) {
         throw new exports.MalformedCredentialError(`digestID ${digestID} missing from MSO valueDigests[${ns}]`);
       }
-      if (!bytesEqual(hash, expectedDigest)) {
+      if (!bytesEqual2(hash, expectedDigest)) {
         throw new exports.MalformedCredentialError(`digest mismatch for ns=${ns} digestID=${digestID}`);
       }
     }
@@ -8436,7 +8609,7 @@ init_errors();
 var decoder4 = new cborX.Encoder({ mapsAsObjects: false, useRecords: false });
 var encoder = new cborX.Encoder({ mapsAsObjects: false, useRecords: false });
 var DEFAULT_ALLOWED_ALGORITHMS = ["ES256", "ES384", "ES512"];
-function bytesEqual2(a, b) {
+function bytesEqual3(a, b) {
   if (a.length !== b.length) return false;
   for (let i = 0; i < a.length; i++) {
     if (a[i] !== b[i]) return false;
@@ -8572,8 +8745,8 @@ var MdocParser = class {
         cache: options.cache,
         clockSkewTolerance: options.clockSkewTolerance
       });
-      const { X509Certificate: X509Certificate8 } = await import('@peculiar/x509');
-      const leaf = new X509Certificate8(issuerCertBytes);
+      const { X509Certificate: X509Certificate9 } = await import('@peculiar/x509');
+      const leaf = new X509Certificate9(issuerCertBytes);
       trustResult = await evaluator.evaluate(leaf);
     } else {
       if (options.trustedCertificates.length === 0) {
@@ -8583,7 +8756,7 @@ var MdocParser = class {
           );
         }
       } else {
-        const trusted = options.trustedCertificates.some((t) => bytesEqual2(t, issuerCertBytes));
+        const trusted = options.trustedCertificates.some((t) => bytesEqual3(t, issuerCertBytes));
         if (!trusted) {
           return {
             valid: false,
@@ -8698,7 +8871,7 @@ function base64ToBytes(base64) {
   }
   return bytes;
 }
-function bytesEqual3(a, b) {
+function bytesEqual4(a, b) {
   if (a.length !== b.length) return false;
   for (let i = 0; i < a.length; i++) {
     if (a[i] !== b[i]) return false;
@@ -8787,32 +8960,74 @@ var SdJwtParser = class {
       return invalidResult(`Unsupported algorithm: ${alg}`);
     }
     const x5cArray = header.x5c;
-    if (!Array.isArray(x5cArray) || x5cArray.length === 0 || typeof x5cArray[0] !== "string") {
-      throw new exports.MalformedCredentialError("Missing or invalid x5c in JWT header");
-    }
+    const hasX5c = Array.isArray(x5cArray) && x5cArray.length > 0 && typeof x5cArray[0] === "string";
     let issuerKey;
     let issuerCertBytes;
-    try {
-      issuerKey = await jose.importX509(derToPem2(x5cArray[0]), alg);
-      issuerCertBytes = base64ToBytes(x5cArray[0]);
-    } catch (err) {
-      if (err instanceof exports.MalformedCredentialError) throw err;
-      throw new exports.MalformedCredentialError("Failed to import issuer certificate");
+    if (hasX5c) {
+      try {
+        issuerKey = await jose.importX509(derToPem2(x5cArray[0]), alg);
+        issuerCertBytes = base64ToBytes(x5cArray[0]);
+      } catch (err) {
+        if (err instanceof exports.MalformedCredentialError) throw err;
+        throw new exports.MalformedCredentialError("Failed to import issuer certificate");
+      }
+    } else if (options.trustedIssuerJwks && options.trustedIssuerJwks.length > 0) {
+      issuerKey = void 0;
+    } else {
+      throw new exports.MalformedCredentialError("Missing or invalid x5c in JWT header");
     }
     let payload;
-    try {
-      const result2 = await jose.jwtVerify(parts.jwt, issuerKey, { algorithms: allowedAlgorithms });
-      payload = result2.payload;
-    } catch {
-      return invalidResult("Issuer JWT signature verification failed");
+    if (issuerKey) {
+      try {
+        const result2 = await jose.jwtVerify(parts.jwt, issuerKey, { algorithms: allowedAlgorithms });
+        payload = result2.payload;
+      } catch {
+        return invalidResult("Issuer JWT signature verification failed");
+      }
+    } else {
+      const jwks = options.trustedIssuerJwks;
+      const headerKid = header["kid"];
+      let candidates;
+      if (typeof headerKid === "string") {
+        const matched = jwks.find((k) => k["kid"] === headerKid);
+        if (!matched) {
+          return invalidResult(
+            `No matching JWK found in trustedIssuerJwks for kid=${headerKid}`
+          );
+        }
+        candidates = [matched];
+      } else {
+        candidates = jwks;
+      }
+      let verifiedPayload;
+      for (const jwk of candidates) {
+        let candidateKey;
+        try {
+          candidateKey = await jose.importJWK(jwk, alg);
+        } catch {
+          continue;
+        }
+        try {
+          const result2 = await jose.jwtVerify(parts.jwt, candidateKey, {
+            algorithms: allowedAlgorithms
+          });
+          verifiedPayload = result2.payload;
+          break;
+        } catch {
+        }
+      }
+      if (!verifiedPayload) {
+        return invalidResult("Issuer JWT signature verification failed");
+      }
+      payload = verifiedPayload;
     }
     const issuerString = typeof payload["iss"] === "string" ? payload["iss"] : "";
     const issuerInfo = {
-      certificate: issuerCertBytes,
+      certificate: issuerCertBytes ?? new Uint8Array(),
       country: extractCountryHint(issuerString)
     };
     let trustResult;
-    if (options.trustStore) {
+    if (issuerCertBytes === void 0) ; else if (options.trustStore) {
       const { TrustEvaluator: TrustEvaluator2 } = await Promise.resolve().then(() => (init_TrustEvaluator(), TrustEvaluator_exports));
       const evaluator = new TrustEvaluator2({
         trustStore: options.trustStore,
@@ -8821,8 +9036,8 @@ var SdJwtParser = class {
         cache: options.cache,
         clockSkewTolerance: options.clockSkewTolerance
       });
-      const { X509Certificate: X509Certificate8 } = await import('@peculiar/x509');
-      const leaf = new X509Certificate8(issuerCertBytes);
+      const { X509Certificate: X509Certificate9 } = await import('@peculiar/x509');
+      const leaf = new X509Certificate9(issuerCertBytes);
       trustResult = await evaluator.evaluate(leaf);
     } else {
       if (options.trustedCertificates.length === 0) {
@@ -8832,23 +9047,55 @@ var SdJwtParser = class {
           );
         }
       } else {
-        const isTrusted = options.trustedCertificates.some((trusted) => bytesEqual3(trusted, issuerCertBytes));
+        const isTrusted = options.trustedCertificates.some(
+          (trusted) => bytesEqual4(trusted, issuerCertBytes)
+        );
         if (!isTrusted) {
           return invalidResult("Issuer certificate is not trusted");
         }
       }
     }
-    const sdArray = payload["_sd"];
     if (parts.disclosures.length > 0) {
-      if (!Array.isArray(sdArray) || sdArray.length === 0) {
-        return invalidResult("Disclosures present but no _sd array in issuer JWT");
-      }
+      const decodedDisclosures = [];
       for (const disclosure of parts.disclosures) {
+        let parsed;
+        try {
+          parsed = JSON.parse(new TextDecoder().decode(base64ToBytes(disclosure)));
+        } catch {
+          return invalidResult("Disclosure is not valid base64url-encoded JSON");
+        }
+        if (!Array.isArray(parsed) || parsed.length !== 2 && parsed.length !== 3) {
+          return invalidResult("Disclosure must be a 2- or 3-element array");
+        }
         const hashBytes = await sha256Hasher(disclosure);
-        const hashB64url = bytesToBase64url(hashBytes);
-        if (!sdArray.includes(hashB64url)) {
-          return invalidResult("Disclosure hash mismatch");
+        decodedDisclosures.push({
+          raw: disclosure,
+          hash: bytesToBase64url(hashBytes),
+          length: parsed.length,
+          value: parsed.length === 3 ? parsed[2] : parsed[1]
+        });
+      }
+      const seed = collectAnchorHashes(payload);
+      const kvHashes = seed.kvHashes;
+      const arrayElemHashes = seed.arrayElemHashes;
+      const remaining = [...decodedDisclosures];
+      for (; ; ) {
+        const anchored = [];
+        for (const d of remaining) {
+          const valid = d.length === 3 ? kvHashes.has(d.hash) : arrayElemHashes.has(d.hash);
+          if (valid) anchored.push(d);
         }
+        if (anchored.length === 0) break;
+        for (const a of anchored) {
+          const sub = collectAnchorHashes(a.value);
+          for (const h of sub.kvHashes) kvHashes.add(h);
+          for (const h of sub.arrayElemHashes) arrayElemHashes.add(h);
+          const idx = remaining.indexOf(a);
+          if (idx >= 0) remaining.splice(idx, 1);
+        }
+      }
+      if (remaining.length > 0) {
+        return invalidResult("Disclosure hash mismatch");
       }
     }
     if (parts.kbJwt) {
@@ -8912,6 +9159,35 @@ var SdJwtParser = class {
     return result;
   }
 };
+function collectAnchorHashes(node) {
+  const kvHashes = /* @__PURE__ */ new Set();
+  const arrayElemHashes = /* @__PURE__ */ new Set();
+  const visit = (value) => {
+    if (Array.isArray(value)) {
+      for (const item of value) {
+        if (item && typeof item === "object" && !Array.isArray(item)) {
+          const obj = item;
+          const keys = Object.keys(obj);
+          if (keys.length === 1 && keys[0] === "..." && typeof obj["..."] === "string") {
+            arrayElemHashes.add(obj["..."]);
+            continue;
+          }
+        }
+        visit(item);
+      }
+    } else if (value && typeof value === "object") {
+      for (const [k, v] of Object.entries(value)) {
+        if (k === "_sd" && Array.isArray(v)) {
+          for (const h of v) if (typeof h === "string") kvHashes.add(h);
+          continue;
+        }
+        visit(v);
+      }
+    }
+  };
+  visit(node);
+  return { kvHashes, arrayElemHashes };
+}
 
 // src/presentation.ts
 var parsers = [new SdJwtParser(), new MdocParser()];
@@ -8929,6 +9205,44 @@ async function parsePresentation(vpToken, options) {
     error: "Unsupported credential format"
   };
 }
+
+// src/decrypt-response.ts
+init_errors();
+var SUPPORTED_ALG = "ECDH-ES";
+var SUPPORTED_ENC = /* @__PURE__ */ new Set(["A128GCM", "A256GCM"]);
+async function decryptAuthorizationResponse(jwe, privateKey) {
+  let header;
+  try {
+    header = jose.decodeProtectedHeader(jwe);
+  } catch (err) {
+    throw new exports.DecryptionFailedError("Malformed JWE header", {
+      cause: err
+    });
+  }
+  const alg = typeof header.alg === "string" ? header.alg : "";
+  const enc = typeof header.enc === "string" ? header.enc : "";
+  if (alg !== SUPPORTED_ALG || !SUPPORTED_ENC.has(enc)) {
+    throw new exports.UnsupportedJweError(alg, enc);
+  }
+  let plaintext;
+  try {
+    const result = await jose.compactDecrypt(jwe, privateKey);
+    plaintext = result.plaintext;
+  } catch (err) {
+    throw new exports.DecryptionFailedError(void 0, { cause: err });
+  }
+  try {
+    const text = new TextDecoder().decode(plaintext);
+    return JSON.parse(text);
+  } catch (err) {
+    throw new exports.DecryptionFailedError("Decrypted plaintext is not valid JSON", {
+      cause: err
+    });
+  }
+}
+
+// src/verify.ts
+init_errors();
 var INTERNAL_TO_DCQL_FORMAT = {
   "sd-jwt-vc": "dc+sd-jwt",
   mdoc: "mso_mdoc"
@@ -8960,6 +9274,48 @@ async function verifyPresentation(vpToken, query, options) {
     valid: parsed.valid && match.satisfied
   };
 }
+function isEncryptedResponse(x) {
+  return typeof x === "object" && x !== null && "response" in x && typeof x.response === "string" && Object.keys(x).length === 1;
+}
+function isAuthorizationResponse(x) {
+  return typeof x === "object" && x !== null && "vp_token" in x && typeof x.vp_token === "object" && x.vp_token !== null;
+}
+async function verifyAuthorizationResponse(envelope, query, options) {
+  if (isEncryptedResponse(envelope)) {
+    if (!options.decryptionKey) {
+      throw new exports.MissingDecryptionKeyError();
+    }
+    const decrypted = await decryptAuthorizationResponse(
+      envelope.response,
+      options.decryptionKey
+    );
+    return verifyAuthorizationResponse(decrypted, query, options);
+  }
+  if (!isAuthorizationResponse(envelope)) {
+    throw new TypeError("envelope must contain vp_token as a JSON object per OpenID4VP 1.0 \xA78.1");
+  }
+  const vpToken = envelope.vp_token;
+  const queryIds = Object.keys(vpToken);
+  if (queryIds.length === 0) {
+    throw new TypeError("vp_token cannot be empty per OpenID4VP 1.0 \xA78.1");
+  }
+  for (const id of queryIds) {
+    if (!Array.isArray(vpToken[id])) {
+      throw new TypeError(
+        `vp_token entry "${id}" must be an array of presentations per OpenID4VP 1.0 \xA78.1`
+      );
+    }
+  }
+  const presentationCount = queryIds.reduce(
+    (sum, id) => sum + vpToken[id].length,
+    0
+  );
+  if (queryIds.length > 1 || presentationCount > 1) {
+    throw new exports.MultipleCredentialsNotSupportedError(queryIds.length, presentationCount);
+  }
+  const presentation = vpToken[queryIds[0]][0];
+  return verifyPresentation(presentation, query, options);
+}
 
 // src/index.ts
 init_errors();
@@ -9571,7 +9927,7 @@ function equalBytes(a, b) {
 
 // src/index.ts
 init_errors();
-var VERSION = "0.5.0";
+var VERSION = "0.8.0";
 /*! Bundled license information:
 
 pvtsutils/build/index.es.js:
@@ -9659,9 +10015,12 @@ exports.StaticTrustStore = StaticTrustStore;
 exports.VERSION = VERSION;
 exports.buildHaipQuery = buildHaipQuery;
 exports.createAuthorizationRequest = createAuthorizationRequest;
+exports.createSignedAuthorizationRequest = createSignedAuthorizationRequest;
+exports.decryptAuthorizationResponse = decryptAuthorizationResponse;
 exports.isHaipQuery = isHaipQuery;
 exports.parsePresentation = parsePresentation;
 exports.validateHaipQuery = validateHaipQuery;
+exports.verifyAuthorizationResponse = verifyAuthorizationResponse;
 exports.verifyPresentation = verifyPresentation;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map