@openeudi/openid4vp 0.6.0 → 0.8.0

package/dist/index.js

@@ -1,7 +1,7 @@
 import { X509Certificate, SubjectKeyIdentifierExtension, X509Certificates, BasicConstraintsExtension, KeyUsagesExtension, KeyUsageFlags as KeyUsageFlags$1, AuthorityKeyIdentifierExtension, SubjectAlternativeNameExtension, ExtendedKeyUsageExtension, Name as Name$1 } from '@peculiar/x509';
 import { v4 } from 'uuid';
+import { SignJWT, importX509, decodeProtectedHeader, jwtVerify, importJWK, compactDecrypt } from 'jose';
 import { Encoder, Tag } from 'cbor-x';
-import { importX509, decodeProtectedHeader, jwtVerify, importJWK } from 'jose';
 import { splitSdJwt, decodeSdJwt, getClaims } from '@sd-jwt/decode';
 import { matchQuery, buildSubmission } from '@openeudi/dcql';
 export { DcqlMatchError, DcqlValidationError } from '@openeudi/dcql';
@@ -19,7 +19,7 @@ var __export = (target, all) => {
 };
 
 // src/errors.ts
-var InvalidSignatureError, ExpiredCredentialError, UnsupportedFormatError, MalformedCredentialError, NonceValidationError, HaipValidationError, OpenID4VPError, TrustAnchorNotFoundError, CertificateChainError, RevokedCertificateError, RevocationCheckFailedError, LotlFetchError, LotlSignatureError;
+var InvalidSignatureError, ExpiredCredentialError, UnsupportedFormatError, MalformedCredentialError, NonceValidationError, HaipValidationError, OpenID4VPError, TrustAnchorNotFoundError, CertificateChainError, RevokedCertificateError, RevocationCheckFailedError, LotlFetchError, LotlSignatureError, SignedRequestBuildError, UnsupportedJweError, DecryptionFailedError, MissingDecryptionKeyError, MultipleCredentialsNotSupportedError;
 var init_errors = __esm({
   "src/errors.ts"() {
     InvalidSignatureError = class extends Error {
@@ -115,6 +115,47 @@ var init_errors = __esm({
     LotlSignatureError = class extends OpenID4VPError {
       code = "lotl_signature_invalid";
     };
+    SignedRequestBuildError = class extends OpenID4VPError {
+      code;
+      constructor(code, message) {
+        super(message);
+        this.code = code;
+      }
+    };
+    UnsupportedJweError = class extends OpenID4VPError {
+      code = "unsupported_jwe";
+      alg;
+      enc;
+      constructor(alg, enc) {
+        super(`Unsupported JWE algorithms: alg=${alg}, enc=${enc}`);
+        this.alg = alg;
+        this.enc = enc;
+      }
+    };
+    DecryptionFailedError = class extends OpenID4VPError {
+      code = "decryption_failed";
+      constructor(message = "Failed to decrypt authorization response", options) {
+        super(message, options);
+      }
+    };
+    MissingDecryptionKeyError = class extends OpenID4VPError {
+      code = "missing_decryption_key";
+      constructor(message = "decryptionKey is required to verify a direct_post.jwt response") {
+        super(message);
+      }
+    };
+    MultipleCredentialsNotSupportedError = class extends OpenID4VPError {
+      code = "multi_credential_unsupported";
+      entryCount;
+      presentationCount;
+      constructor(entryCount, presentationCount) {
+        super(
+          `Multi-credential presentations are not yet supported: ${entryCount} queryId entries, ${presentationCount} presentations`
+        );
+        this.entryCount = entryCount;
+        this.presentationCount = presentationCount;
+      }
+    };
   }
 });
 
@@ -8024,6 +8065,138 @@ function createAuthorizationRequest(input, query) {
   };
 }
 
+// src/signed-authorization.ts
+init_errors();
+var DEFAULT_SUPPORTED_ENC_VALUES = ["A128GCM", "A256GCM"];
+var SUPPORTED_SIGNING_ALGS = /* @__PURE__ */ new Set(["ES256", "ES384", "RS256"]);
+async function createSignedAuthorizationRequest(input, query) {
+  if (input.certificateChain.length === 0) {
+    throw new SignedRequestBuildError(
+      "empty_cert_chain",
+      "certificateChain must contain at least the leaf certificate"
+    );
+  }
+  const signingAlg = input.signingAlgorithm ?? "ES256";
+  if (!SUPPORTED_SIGNING_ALGS.has(signingAlg)) {
+    throw new SignedRequestBuildError(
+      "unsupported_signing_alg",
+      `signingAlgorithm ${signingAlg} is not supported (expected ES256/ES384/RS256)`
+    );
+  }
+  if (!input.vpFormatsSupported || Object.keys(input.vpFormatsSupported).length === 0) {
+    throw new SignedRequestBuildError(
+      "missing_vp_formats",
+      "vpFormatsSupported is required and must be non-empty"
+    );
+  }
+  const leafCert = new X509Certificate(toArrayBuffer(input.certificateChain[0]));
+  const sanDnsNames = extractDnsNames(leafCert);
+  if (!sanDnsNames.includes(input.hostname)) {
+    throw new SignedRequestBuildError(
+      "hostname_cert_mismatch",
+      `leaf cert SAN DNSName values [${sanDnsNames.join(", ")}] do not include hostname "${input.hostname}"`
+    );
+  }
+  const signerPublicSpki = new Uint8Array(
+    await crypto.subtle.exportKey("spki", input.signer.publicKey)
+  );
+  const leafSpki = new Uint8Array(leafCert.publicKey.rawData);
+  if (!bytesEqual(signerPublicSpki, leafSpki)) {
+    throw new SignedRequestBuildError(
+      "signing_key_cert_mismatch",
+      "signer.publicKey SPKI does not match leaf certificate SPKI"
+    );
+  }
+  const responseMode = input.responseMode ?? "direct_post.jwt";
+  if (responseMode === "direct_post.jwt") {
+    if (!input.encryptionKey?.publicJwk) {
+      throw new SignedRequestBuildError(
+        "missing_encryption_jwk",
+        "direct_post.jwt response mode requires encryptionKey.publicJwk"
+      );
+    }
+    if (!input.encryptionKey.publicJwk.alg) {
+      throw new SignedRequestBuildError(
+        "missing_encryption_alg",
+        "encryptionKey.publicJwk must carry alg (OpenID4VP 1.0 \xA78.3)"
+      );
+    }
+  }
+  const state = input.state ?? v4();
+  const clientId = `x509_san_dns:${input.hostname}`;
+  const now = Math.floor(Date.now() / 1e3);
+  const clientMetadata = {
+    vp_formats_supported: input.vpFormatsSupported
+  };
+  if (responseMode === "direct_post.jwt" && input.encryptionKey) {
+    const enc = input.encryptionKey.supportedEncValues;
+    if (enc !== void 0 && enc.length === 0) {
+      throw new SignedRequestBuildError(
+        "empty_supported_enc_values",
+        "encryptionKey.supportedEncValues must not be empty (omit to use defaults [A128GCM, A256GCM])"
+      );
+    }
+    const jwk = { ...input.encryptionKey.publicJwk, use: "enc" };
+    clientMetadata.jwks = { keys: [jwk] };
+    const encValues = enc ?? [...DEFAULT_SUPPORTED_ENC_VALUES];
+    clientMetadata.encrypted_response_enc_values_supported = encValues;
+    clientMetadata.authorization_encrypted_response_alg = "ECDH-ES";
+    clientMetadata.authorization_encrypted_response_enc = encValues[0];
+  }
+  const payload = {
+    iss: clientId,
+    aud: "https://self-issued.me/v2",
+    response_type: "vp_token",
+    response_mode: responseMode,
+    client_id: clientId,
+    response_uri: input.responseUri,
+    nonce: input.nonce,
+    state,
+    dcql_query: query,
+    client_metadata: clientMetadata,
+    iat: now,
+    exp: now + 120
+  };
+  const x5c = input.certificateChain.map((der) => bytesToBase64(der));
+  const jws = await new SignJWT(payload).setProtectedHeader({ typ: "oauth-authz-req+jwt", alg: signingAlg, x5c }).sign(input.signer.privateKey);
+  const uriParams = new URLSearchParams({
+    client_id: clientId,
+    request_uri: input.requestUri
+  });
+  return {
+    uri: `openid4vp://authorize?${uriParams.toString()}`,
+    requestObject: jws,
+    dcqlQuery: query,
+    nonce: input.nonce,
+    state
+  };
+}
+function extractDnsNames(cert) {
+  const SAN_OID = "2.5.29.17";
+  const ext = cert.extensions.find((e) => e.type === SAN_OID);
+  if (!ext) return [];
+  const names = ext.names;
+  const items = names?.items ?? [];
+  return items.filter((e) => e.type === "dns").map((e) => e.value);
+}
+function bytesEqual(a, b) {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) {
+    if (a[i] !== b[i]) return false;
+  }
+  return true;
+}
+function bytesToBase64(bytes) {
+  let s = "";
+  for (let i = 0; i < bytes.length; i++) s += String.fromCharCode(bytes[i]);
+  return btoa(s);
+}
+function toArrayBuffer(bytes) {
+  const out = new ArrayBuffer(bytes.byteLength);
+  new Uint8Array(out).set(bytes);
+  return out;
+}
+
 // src/haip.ts
 init_errors();
 var HAIP_DOCTYPE_NAMESPACES = {
@@ -8227,7 +8400,7 @@ async function verifyCoseSign1(coseSign1, publicKey, allowedAlgorithms) {
     throw new MalformedCredentialError(`no hash mapping for alg ${coseSign1.alg}`);
   }
   const sigStructure = ["Signature1", coseSign1.protectedHeaderBytes, new Uint8Array(0), coseSign1.payload];
-  const sigInput = decoder.encode(sigStructure);
+  const sigInput = new Uint8Array(decoder.encode(sigStructure));
   const ok = await crypto.subtle.verify(
     { name: "ECDSA", hash: hashAlg },
     publicKey,
@@ -8250,7 +8423,7 @@ async function computeItemDigest(itemBytes, digestAlgorithm) {
   const buf = await crypto.subtle.digest(digestAlgorithm, new Uint8Array(itemBytes));
   return new Uint8Array(buf);
 }
-function bytesEqual(a, b) {
+function bytesEqual2(a, b) {
   if (a.length !== b.length) return false;
   for (let i = 0; i < a.length; i++) {
     if (a[i] !== b[i]) return false;
@@ -8296,7 +8469,7 @@ async function verifyAllDigests(nameSpaces, mso) {
       if (!expectedDigest) {
         throw new MalformedCredentialError(`digestID ${digestID} missing from MSO valueDigests[${ns}]`);
       }
-      if (!bytesEqual(hash, expectedDigest)) {
+      if (!bytesEqual2(hash, expectedDigest)) {
         throw new MalformedCredentialError(`digest mismatch for ns=${ns} digestID=${digestID}`);
       }
     }
@@ -8415,7 +8588,7 @@ init_errors();
 var decoder4 = new Encoder({ mapsAsObjects: false, useRecords: false });
 var encoder = new Encoder({ mapsAsObjects: false, useRecords: false });
 var DEFAULT_ALLOWED_ALGORITHMS = ["ES256", "ES384", "ES512"];
-function bytesEqual2(a, b) {
+function bytesEqual3(a, b) {
   if (a.length !== b.length) return false;
   for (let i = 0; i < a.length; i++) {
     if (a[i] !== b[i]) return false;
@@ -8551,8 +8724,8 @@ var MdocParser = class {
         cache: options.cache,
         clockSkewTolerance: options.clockSkewTolerance
       });
-      const { X509Certificate: X509Certificate8 } = await import('@peculiar/x509');
-      const leaf = new X509Certificate8(issuerCertBytes);
+      const { X509Certificate: X509Certificate9 } = await import('@peculiar/x509');
+      const leaf = new X509Certificate9(issuerCertBytes);
       trustResult = await evaluator.evaluate(leaf);
     } else {
       if (options.trustedCertificates.length === 0) {
@@ -8562,7 +8735,7 @@ var MdocParser = class {
           );
         }
       } else {
-        const trusted = options.trustedCertificates.some((t) => bytesEqual2(t, issuerCertBytes));
+        const trusted = options.trustedCertificates.some((t) => bytesEqual3(t, issuerCertBytes));
         if (!trusted) {
           return {
             valid: false,
@@ -8677,7 +8850,7 @@ function base64ToBytes(base64) {
   }
   return bytes;
 }
-function bytesEqual3(a, b) {
+function bytesEqual4(a, b) {
   if (a.length !== b.length) return false;
   for (let i = 0; i < a.length; i++) {
     if (a[i] !== b[i]) return false;
@@ -8766,32 +8939,74 @@ var SdJwtParser = class {
       return invalidResult(`Unsupported algorithm: ${alg}`);
     }
     const x5cArray = header.x5c;
-    if (!Array.isArray(x5cArray) || x5cArray.length === 0 || typeof x5cArray[0] !== "string") {
-      throw new MalformedCredentialError("Missing or invalid x5c in JWT header");
-    }
+    const hasX5c = Array.isArray(x5cArray) && x5cArray.length > 0 && typeof x5cArray[0] === "string";
     let issuerKey;
     let issuerCertBytes;
-    try {
-      issuerKey = await importX509(derToPem2(x5cArray[0]), alg);
-      issuerCertBytes = base64ToBytes(x5cArray[0]);
-    } catch (err) {
-      if (err instanceof MalformedCredentialError) throw err;
-      throw new MalformedCredentialError("Failed to import issuer certificate");
+    if (hasX5c) {
+      try {
+        issuerKey = await importX509(derToPem2(x5cArray[0]), alg);
+        issuerCertBytes = base64ToBytes(x5cArray[0]);
+      } catch (err) {
+        if (err instanceof MalformedCredentialError) throw err;
+        throw new MalformedCredentialError("Failed to import issuer certificate");
+      }
+    } else if (options.trustedIssuerJwks && options.trustedIssuerJwks.length > 0) {
+      issuerKey = void 0;
+    } else {
+      throw new MalformedCredentialError("Missing or invalid x5c in JWT header");
     }
     let payload;
-    try {
-      const result2 = await jwtVerify(parts.jwt, issuerKey, { algorithms: allowedAlgorithms });
-      payload = result2.payload;
-    } catch {
-      return invalidResult("Issuer JWT signature verification failed");
+    if (issuerKey) {
+      try {
+        const result2 = await jwtVerify(parts.jwt, issuerKey, { algorithms: allowedAlgorithms });
+        payload = result2.payload;
+      } catch {
+        return invalidResult("Issuer JWT signature verification failed");
+      }
+    } else {
+      const jwks = options.trustedIssuerJwks;
+      const headerKid = header["kid"];
+      let candidates;
+      if (typeof headerKid === "string") {
+        const matched = jwks.find((k) => k["kid"] === headerKid);
+        if (!matched) {
+          return invalidResult(
+            `No matching JWK found in trustedIssuerJwks for kid=${headerKid}`
+          );
+        }
+        candidates = [matched];
+      } else {
+        candidates = jwks;
+      }
+      let verifiedPayload;
+      for (const jwk of candidates) {
+        let candidateKey;
+        try {
+          candidateKey = await importJWK(jwk, alg);
+        } catch {
+          continue;
+        }
+        try {
+          const result2 = await jwtVerify(parts.jwt, candidateKey, {
+            algorithms: allowedAlgorithms
+          });
+          verifiedPayload = result2.payload;
+          break;
+        } catch {
+        }
+      }
+      if (!verifiedPayload) {
+        return invalidResult("Issuer JWT signature verification failed");
+      }
+      payload = verifiedPayload;
     }
     const issuerString = typeof payload["iss"] === "string" ? payload["iss"] : "";
     const issuerInfo = {
-      certificate: issuerCertBytes,
+      certificate: issuerCertBytes ?? new Uint8Array(),
       country: extractCountryHint(issuerString)
     };
     let trustResult;
-    if (options.trustStore) {
+    if (issuerCertBytes === void 0) ; else if (options.trustStore) {
       const { TrustEvaluator: TrustEvaluator2 } = await Promise.resolve().then(() => (init_TrustEvaluator(), TrustEvaluator_exports));
       const evaluator = new TrustEvaluator2({
         trustStore: options.trustStore,
@@ -8800,8 +9015,8 @@ var SdJwtParser = class {
         cache: options.cache,
         clockSkewTolerance: options.clockSkewTolerance
       });
-      const { X509Certificate: X509Certificate8 } = await import('@peculiar/x509');
-      const leaf = new X509Certificate8(issuerCertBytes);
+      const { X509Certificate: X509Certificate9 } = await import('@peculiar/x509');
+      const leaf = new X509Certificate9(issuerCertBytes);
       trustResult = await evaluator.evaluate(leaf);
     } else {
       if (options.trustedCertificates.length === 0) {
@@ -8811,23 +9026,55 @@ var SdJwtParser = class {
           );
         }
       } else {
-        const isTrusted = options.trustedCertificates.some((trusted) => bytesEqual3(trusted, issuerCertBytes));
+        const isTrusted = options.trustedCertificates.some(
+          (trusted) => bytesEqual4(trusted, issuerCertBytes)
+        );
         if (!isTrusted) {
           return invalidResult("Issuer certificate is not trusted");
         }
       }
     }
-    const sdArray = payload["_sd"];
     if (parts.disclosures.length > 0) {
-      if (!Array.isArray(sdArray) || sdArray.length === 0) {
-        return invalidResult("Disclosures present but no _sd array in issuer JWT");
-      }
+      const decodedDisclosures = [];
       for (const disclosure of parts.disclosures) {
+        let parsed;
+        try {
+          parsed = JSON.parse(new TextDecoder().decode(base64ToBytes(disclosure)));
+        } catch {
+          return invalidResult("Disclosure is not valid base64url-encoded JSON");
+        }
+        if (!Array.isArray(parsed) || parsed.length !== 2 && parsed.length !== 3) {
+          return invalidResult("Disclosure must be a 2- or 3-element array");
+        }
         const hashBytes = await sha256Hasher(disclosure);
-        const hashB64url = bytesToBase64url(hashBytes);
-        if (!sdArray.includes(hashB64url)) {
-          return invalidResult("Disclosure hash mismatch");
+        decodedDisclosures.push({
+          raw: disclosure,
+          hash: bytesToBase64url(hashBytes),
+          length: parsed.length,
+          value: parsed.length === 3 ? parsed[2] : parsed[1]
+        });
+      }
+      const seed = collectAnchorHashes(payload);
+      const kvHashes = seed.kvHashes;
+      const arrayElemHashes = seed.arrayElemHashes;
+      const remaining = [...decodedDisclosures];
+      for (; ; ) {
+        const anchored = [];
+        for (const d of remaining) {
+          const valid = d.length === 3 ? kvHashes.has(d.hash) : arrayElemHashes.has(d.hash);
+          if (valid) anchored.push(d);
         }
+        if (anchored.length === 0) break;
+        for (const a of anchored) {
+          const sub = collectAnchorHashes(a.value);
+          for (const h of sub.kvHashes) kvHashes.add(h);
+          for (const h of sub.arrayElemHashes) arrayElemHashes.add(h);
+          const idx = remaining.indexOf(a);
+          if (idx >= 0) remaining.splice(idx, 1);
+        }
+      }
+      if (remaining.length > 0) {
+        return invalidResult("Disclosure hash mismatch");
       }
     }
     if (parts.kbJwt) {
@@ -8891,6 +9138,35 @@ var SdJwtParser = class {
     return result;
   }
 };
+function collectAnchorHashes(node) {
+  const kvHashes = /* @__PURE__ */ new Set();
+  const arrayElemHashes = /* @__PURE__ */ new Set();
+  const visit = (value) => {
+    if (Array.isArray(value)) {
+      for (const item of value) {
+        if (item && typeof item === "object" && !Array.isArray(item)) {
+          const obj = item;
+          const keys = Object.keys(obj);
+          if (keys.length === 1 && keys[0] === "..." && typeof obj["..."] === "string") {
+            arrayElemHashes.add(obj["..."]);
+            continue;
+          }
+        }
+        visit(item);
+      }
+    } else if (value && typeof value === "object") {
+      for (const [k, v] of Object.entries(value)) {
+        if (k === "_sd" && Array.isArray(v)) {
+          for (const h of v) if (typeof h === "string") kvHashes.add(h);
+          continue;
+        }
+        visit(v);
+      }
+    }
+  };
+  visit(node);
+  return { kvHashes, arrayElemHashes };
+}
 
 // src/presentation.ts
 var parsers = [new SdJwtParser(), new MdocParser()];
@@ -8908,6 +9184,44 @@ async function parsePresentation(vpToken, options) {
     error: "Unsupported credential format"
   };
 }
+
+// src/decrypt-response.ts
+init_errors();
+var SUPPORTED_ALG = "ECDH-ES";
+var SUPPORTED_ENC = /* @__PURE__ */ new Set(["A128GCM", "A256GCM"]);
+async function decryptAuthorizationResponse(jwe, privateKey) {
+  let header;
+  try {
+    header = decodeProtectedHeader(jwe);
+  } catch (err) {
+    throw new DecryptionFailedError("Malformed JWE header", {
+      cause: err
+    });
+  }
+  const alg = typeof header.alg === "string" ? header.alg : "";
+  const enc = typeof header.enc === "string" ? header.enc : "";
+  if (alg !== SUPPORTED_ALG || !SUPPORTED_ENC.has(enc)) {
+    throw new UnsupportedJweError(alg, enc);
+  }
+  let plaintext;
+  try {
+    const result = await compactDecrypt(jwe, privateKey);
+    plaintext = result.plaintext;
+  } catch (err) {
+    throw new DecryptionFailedError(void 0, { cause: err });
+  }
+  try {
+    const text = new TextDecoder().decode(plaintext);
+    return JSON.parse(text);
+  } catch (err) {
+    throw new DecryptionFailedError("Decrypted plaintext is not valid JSON", {
+      cause: err
+    });
+  }
+}
+
+// src/verify.ts
+init_errors();
 var INTERNAL_TO_DCQL_FORMAT = {
   "sd-jwt-vc": "dc+sd-jwt",
   mdoc: "mso_mdoc"
@@ -8939,6 +9253,48 @@ async function verifyPresentation(vpToken, query, options) {
     valid: parsed.valid && match.satisfied
   };
 }
+function isEncryptedResponse(x) {
+  return typeof x === "object" && x !== null && "response" in x && typeof x.response === "string" && Object.keys(x).length === 1;
+}
+function isAuthorizationResponse(x) {
+  return typeof x === "object" && x !== null && "vp_token" in x && typeof x.vp_token === "object" && x.vp_token !== null;
+}
+async function verifyAuthorizationResponse(envelope, query, options) {
+  if (isEncryptedResponse(envelope)) {
+    if (!options.decryptionKey) {
+      throw new MissingDecryptionKeyError();
+    }
+    const decrypted = await decryptAuthorizationResponse(
+      envelope.response,
+      options.decryptionKey
+    );
+    return verifyAuthorizationResponse(decrypted, query, options);
+  }
+  if (!isAuthorizationResponse(envelope)) {
+    throw new TypeError("envelope must contain vp_token as a JSON object per OpenID4VP 1.0 \xA78.1");
+  }
+  const vpToken = envelope.vp_token;
+  const queryIds = Object.keys(vpToken);
+  if (queryIds.length === 0) {
+    throw new TypeError("vp_token cannot be empty per OpenID4VP 1.0 \xA78.1");
+  }
+  for (const id of queryIds) {
+    if (!Array.isArray(vpToken[id])) {
+      throw new TypeError(
+        `vp_token entry "${id}" must be an array of presentations per OpenID4VP 1.0 \xA78.1`
+      );
+    }
+  }
+  const presentationCount = queryIds.reduce(
+    (sum, id) => sum + vpToken[id].length,
+    0
+  );
+  if (queryIds.length > 1 || presentationCount > 1) {
+    throw new MultipleCredentialsNotSupportedError(queryIds.length, presentationCount);
+  }
+  const presentation = vpToken[queryIds[0]][0];
+  return verifyPresentation(presentation, query, options);
+}
 
 // src/index.ts
 init_errors();
@@ -9550,7 +9906,7 @@ function equalBytes(a, b) {
 
 // src/index.ts
 init_errors();
-var VERSION = "0.5.0";
+var VERSION = "0.8.0";
 /*! Bundled license information:
 
 pvtsutils/build/index.es.js:
@@ -9620,6 +9976,6 @@ asn1js/build/index.es.js:
    *)
 */
 
-export { CertificateChainError, CompositeTrustStore, ExpiredCredentialError, HAIP_DOCTYPE_NAMESPACES, HaipValidationError, InMemoryCache, InvalidSignatureError, LotlFetchError, LotlSignatureError, LotlTrustStore, MalformedCredentialError, MdocParser, NonceValidationError, OpenID4VPError, RevocationCheckFailedError, RevokedCertificateError, SdJwtParser, StaticTrustStore, TrustAnchorNotFoundError, UnsupportedFormatError, VERSION, buildHaipQuery, createAuthorizationRequest, isHaipQuery, parsePresentation, validateHaipQuery, verifyPresentation };
+export { CertificateChainError, CompositeTrustStore, DecryptionFailedError, ExpiredCredentialError, HAIP_DOCTYPE_NAMESPACES, HaipValidationError, InMemoryCache, InvalidSignatureError, LotlFetchError, LotlSignatureError, LotlTrustStore, MalformedCredentialError, MdocParser, MissingDecryptionKeyError, MultipleCredentialsNotSupportedError, NonceValidationError, OpenID4VPError, RevocationCheckFailedError, RevokedCertificateError, SdJwtParser, SignedRequestBuildError, StaticTrustStore, TrustAnchorNotFoundError, UnsupportedFormatError, UnsupportedJweError, VERSION, buildHaipQuery, createAuthorizationRequest, createSignedAuthorizationRequest, decryptAuthorizationResponse, isHaipQuery, parsePresentation, validateHaipQuery, verifyAuthorizationResponse, verifyPresentation };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map