@openeudi/openid4vp 0.8.0 → 0.9.0

package/dist/index.cjs

@@ -147,10 +147,10 @@ var init_errors = __esm({
       code = "unsupported_jwe";
       alg;
       enc;
-      constructor(alg, enc) {
-        super(`Unsupported JWE algorithms: alg=${alg}, enc=${enc}`);
+      constructor(alg, enc3) {
+        super(`Unsupported JWE algorithms: alg=${alg}, enc=${enc3}`);
         this.alg = alg;
-        this.enc = enc;
+        this.enc = enc3;
       }
     };
     exports.DecryptionFailedError = class extends exports.OpenID4VPError {
@@ -334,9 +334,9 @@ var init_index_es = __esm({
       static isBase64Url(data) {
         return typeof data === STRING_TYPE && BASE64URL_REGEX.test(data);
       }
-      static ToString(buffer, enc = "utf8") {
+      static ToString(buffer, enc3 = "utf8") {
         const buf = BufferSourceConverter.toUint8Array(buffer);
-        switch (enc.toLowerCase()) {
+        switch (enc3.toLowerCase()) {
           case "utf8":
             return this.ToUtf8String(buf);
           case "binary":
@@ -353,14 +353,14 @@ var init_index_es = __esm({
           case "utf16be":
             return Utf16Converter.toString(buf);
           default:
-            throw new Error(`Unknown type of encoding '${enc}'`);
+            throw new Error(`Unknown type of encoding '${enc3}'`);
         }
       }
-      static FromString(str, enc = "utf8") {
+      static FromString(str, enc3 = "utf8") {
         if (!str) {
           return new ArrayBuffer(0);
         }
-        switch (enc.toLowerCase()) {
+        switch (enc3.toLowerCase()) {
           case "utf8":
             return this.FromUtf8String(str);
           case "binary":
@@ -377,7 +377,7 @@ var init_index_es = __esm({
           case "utf16be":
             return Utf16Converter.fromString(str);
           default:
-            throw new Error(`Unknown type of encoding '${enc}'`);
+            throw new Error(`Unknown type of encoding '${enc3}'`);
         }
       }
       static ToBase64(buffer) {
@@ -6382,6 +6382,33 @@ var init_es20152 = __esm({
     init_validity();
   }
 });
+function getSkiHex(cert) {
+  const ext = cert.getExtension(x509.SubjectKeyIdentifierExtension);
+  return ext ? ext.keyId.toLowerCase() : null;
+}
+function certificatesEqual(a, b) {
+  const ab = new Uint8Array(a.rawData);
+  const bb = new Uint8Array(b.rawData);
+  if (ab.length !== bb.length) return false;
+  for (let i = 0; i < ab.length; i++) {
+    if (ab[i] !== bb[i]) return false;
+  }
+  return true;
+}
+function getSkiBytes(cert) {
+  const ext = cert.getExtension(x509.SubjectKeyIdentifierExtension);
+  if (!ext) return null;
+  const hex = ext.keyId;
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) {
+    out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return out;
+}
+var init_x509_utils = __esm({
+  "src/trust/x509-utils.ts"() {
+  }
+});
 function mapX509AlgoToJwaName(cert) {
   const alg = cert.signatureAlgorithm;
   const name = alg?.name ?? "";
@@ -6391,8 +6418,11 @@ function mapX509AlgoToJwaName(cert) {
   if (name === "ECDSA" && hash === "SHA-512") return "ES512";
   if (name === "Ed25519" || name === "EdDSA") return "EdDSA";
   if (name === "RSASSA-PKCS1-v1_5" && hash === "SHA-256") return "RS256";
+  if (name === "RSASSA-PKCS1-v1_5" && hash === "SHA-384") return "RS384";
+  if (name === "RSASSA-PKCS1-v1_5" && hash === "SHA-512") return "RS512";
   if (name === "RSA-PSS" && hash === "SHA-256") return "PS256";
   if (name === "RSA-PSS" && hash === "SHA-384") return "PS384";
+  if (name === "RSA-PSS" && hash === "SHA-512") return "PS512";
   return `${name}-${hash}`;
 }
 function collectLeafNames(leaf) {
@@ -6485,8 +6515,20 @@ var init_ChainBuilder = __esm({
     init_es2015();
     init_es20152();
     init_errors();
+    init_x509_utils();
     NAME_CONSTRAINTS_OID = "2.5.29.30";
-    DEFAULT_ALGORITHMS = ["ES256", "ES384", "EdDSA", "RS256", "PS256"];
+    DEFAULT_ALGORITHMS = [
+      "ES256",
+      "ES384",
+      "ES512",
+      "EdDSA",
+      "RS256",
+      "RS384",
+      "RS512",
+      "PS256",
+      "PS384",
+      "PS512"
+    ];
     ChainBuilder = class {
       constructor(opts = {}) {
         this.opts = opts;
@@ -6545,6 +6587,12 @@ var init_ChainBuilder = __esm({
           current = issuer;
           nonLeafDepth += 1;
         }
+        if (!certificatesEqual(current, anchor)) {
+          throw new exports.CertificateChainError(
+            `certificate ${current.subject} shares the trust anchor's Subject DN but is not the anchor (no signature closure)`,
+            { reason: "signature" }
+          );
+        }
         this.checkNameConstraints(leaf, chain.slice(1));
         return chain;
       }
@@ -7785,7 +7833,10 @@ var init_RevocationChecker = __esm({
         if (hints.ocspUrl) {
           try {
             return await this.ocsp.checkCached(subjectCert, issuerCert, hints.ocspUrl, now);
-          } catch {
+          } catch (err) {
+            console.warn(
+              `[openid4vp] OCSP check failed for ${subjectCert.subject} via ${hints.ocspUrl}, falling back to CRL: ${err.message}`
+            );
           }
         }
         for (const url of hints.crlUrls) {
@@ -7813,6 +7864,9 @@ var init_RevocationChecker = __esm({
             return { status: "good", source: "crl", checkedAt: now };
           } catch (err) {
             if (err instanceof exports.RevocationCheckFailedError) throw err;
+            console.warn(
+              `[openid4vp] CRL check failed for ${subjectCert.subject} via ${url}: ${err.message}`
+            );
             continue;
           }
         }
@@ -7831,24 +7885,6 @@ var init_RevocationChecker = __esm({
     };
   }
 });
-function getSkiHex(cert) {
-  const ext = cert.getExtension(x509.SubjectKeyIdentifierExtension);
-  return ext ? ext.keyId.toLowerCase() : null;
-}
-function getSkiBytes(cert) {
-  const ext = cert.getExtension(x509.SubjectKeyIdentifierExtension);
-  if (!ext) return null;
-  const hex = ext.keyId;
-  const out = new Uint8Array(hex.length / 2);
-  for (let i = 0; i < out.length; i++) {
-    out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
-  }
-  return out;
-}
-var init_x509_utils = __esm({
-  "src/trust/x509-utils.ts"() {
-  }
-});
 
 // src/trust/lotl-loa-mapping.ts
 function mapLoA(uris) {
@@ -8030,8 +8066,13 @@ var init_TrustEvaluator = __esm({
         );
         const terminusCert = chain[chain.length - 1];
         const anchor = anchors.find(
-          (a) => a.certificate.serialNumber === terminusCert.serialNumber
-        ) ?? anchors[0];
+          (a) => certificatesEqual(a.certificate, terminusCert)
+        );
+        if (!anchor) {
+          throw new exports.TrustAnchorNotFoundError(
+            `chain terminus ${terminusCert.subject} does not match any trust anchor certificate`
+          );
+        }
         const issuerForRevocation = chain.length > 1 ? chain[1] : terminusCert;
         const revocation = await this.revocationChecker.check(
           leaf,
@@ -8150,8 +8191,8 @@ async function createSignedAuthorizationRequest(input, query) {
     vp_formats_supported: input.vpFormatsSupported
   };
   if (responseMode === "direct_post.jwt" && input.encryptionKey) {
-    const enc = input.encryptionKey.supportedEncValues;
-    if (enc !== void 0 && enc.length === 0) {
+    const enc3 = input.encryptionKey.supportedEncValues;
+    if (enc3 !== void 0 && enc3.length === 0) {
       throw new exports.SignedRequestBuildError(
         "empty_supported_enc_values",
         "encryptionKey.supportedEncValues must not be empty (omit to use defaults [A128GCM, A256GCM])"
@@ -8159,7 +8200,7 @@ async function createSignedAuthorizationRequest(input, query) {
     }
     const jwk = { ...input.encryptionKey.publicJwk, use: "enc" };
     clientMetadata.jwks = { keys: [jwk] };
-    const encValues = enc ?? [...DEFAULT_SUPPORTED_ENC_VALUES];
+    const encValues = enc3 ?? [...DEFAULT_SUPPORTED_ENC_VALUES];
     clientMetadata.encrypted_response_enc_values_supported = encValues;
     clientMetadata.authorization_encrypted_response_alg = "ECDH-ES";
     clientMetadata.authorization_encrypted_response_enc = encValues[0];
@@ -8335,7 +8376,7 @@ function isHaipQuery(query) {
 
 // src/crypto/cose-sign1.ts
 init_errors();
-var decoder = new cborX.Encoder({ mapsAsObjects: false, useRecords: false });
+var decoder = new cborX.Encoder({ mapsAsObjects: false, useRecords: false, tagUint8Array: false });
 var HEADER_ALG = 1;
 var HEADER_X5CHAIN = 33;
 var COSE_ALG_TO_NAME = {
@@ -8433,6 +8474,131 @@ async function verifyCoseSign1(coseSign1, publicKey, allowedAlgorithms) {
   }
 }
 
+// src/crypto/device-auth.ts
+init_errors();
+var enc = new cborX.Encoder({ mapsAsObjects: false, useRecords: false, tagUint8Array: false });
+var HEADER_ALG2 = 1;
+var COSE_ALG_TO_NAME2 = {
+  [-7]: "ES256",
+  [-35]: "ES384",
+  [-36]: "ES512"
+};
+var ALG_TO_HASH2 = { ES256: "SHA-256", ES384: "SHA-384", ES512: "SHA-512" };
+var COSE_KEY_KTY = 1;
+var COSE_KEY_CRV = -1;
+var COSE_KEY_X = -2;
+var COSE_KEY_Y = -3;
+var COSE_KTY_EC2 = 2;
+var COSE_CRV_TO_JWK = { 1: "P-256", 2: "P-384", 3: "P-521" };
+function concatBytes(...chunks) {
+  let len = 0;
+  for (const c of chunks) len += c.length;
+  const out = new Uint8Array(len);
+  let off = 0;
+  for (const c of chunks) {
+    out.set(c, off);
+    off += c.length;
+  }
+  return out;
+}
+function bytesToBase64Url(bytes) {
+  let bin = "";
+  for (const b of bytes) bin += String.fromCharCode(b);
+  return globalThis.btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function encodeTag24(inner) {
+  return concatBytes(new Uint8Array([216, 24]), new Uint8Array(enc.encode(inner)));
+}
+function buildDeviceAuthenticationBytes(params) {
+  const deviceAuthentication = concatBytes(
+    new Uint8Array([132]),
+    // array(4)
+    new Uint8Array(enc.encode("DeviceAuthentication")),
+    params.sessionTranscript,
+    new Uint8Array(enc.encode(params.docType)),
+    encodeTag24(params.deviceNameSpacesInner)
+  );
+  return encodeTag24(deviceAuthentication);
+}
+function encodeDeviceSigStructure(protectedBytes, deviceAuthBytes) {
+  const sig = ["Signature1", protectedBytes, new Uint8Array(0), deviceAuthBytes];
+  return new Uint8Array(enc.encode(sig));
+}
+async function importDeviceKeyFromCose(coseKey) {
+  if (!(coseKey instanceof Map)) {
+    throw new exports.MalformedCredentialError("MSO deviceKeyInfo.deviceKey is not a COSE_Key map");
+  }
+  const kty = coseKey.get(COSE_KEY_KTY);
+  if (kty !== COSE_KTY_EC2) {
+    throw new exports.MalformedCredentialError(`Unsupported COSE key type for device key: ${String(kty)}`);
+  }
+  const crv = coseKey.get(COSE_KEY_CRV);
+  const crvName = typeof crv === "number" ? COSE_CRV_TO_JWK[crv] : void 0;
+  const x = coseKey.get(COSE_KEY_X);
+  const y = coseKey.get(COSE_KEY_Y);
+  if (!crvName || !(x instanceof Uint8Array) || !(y instanceof Uint8Array)) {
+    throw new exports.MalformedCredentialError("Malformed EC2 COSE_Key in MSO deviceKeyInfo");
+  }
+  return crypto.subtle.importKey(
+    "jwk",
+    { kty: "EC", crv: crvName, x: bytesToBase64Url(x), y: bytesToBase64Url(y) },
+    { name: "ECDSA", namedCurve: crvName },
+    false,
+    ["verify"]
+  );
+}
+async function verifyDeviceAuth(params) {
+  const { deviceSigned, deviceKeyCose, docType, sessionTranscript, allowedAlgorithms } = params;
+  const deviceAuth = deviceSigned.get("deviceAuth");
+  if (!(deviceAuth instanceof Map)) {
+    throw new exports.MalformedCredentialError("deviceSigned.deviceAuth is missing or malformed");
+  }
+  if (deviceAuth.has("deviceMac") && !deviceAuth.has("deviceSignature")) {
+    throw new exports.MalformedCredentialError("mDOC DeviceMac authentication is not supported");
+  }
+  const deviceSignature = deviceAuth.get("deviceSignature");
+  if (!Array.isArray(deviceSignature) || deviceSignature.length !== 4) {
+    throw new exports.MalformedCredentialError("deviceAuth.deviceSignature must be a COSE_Sign1 array");
+  }
+  const protectedBytes = deviceSignature[0];
+  const signature = deviceSignature[3];
+  if (!(protectedBytes instanceof Uint8Array) || !(signature instanceof Uint8Array)) {
+    throw new exports.MalformedCredentialError("DeviceSignature protected header / signature must be byte strings");
+  }
+  let alg;
+  try {
+    const ph = enc.decode(protectedBytes);
+    const label = ph instanceof Map ? ph.get(HEADER_ALG2) : void 0;
+    alg = typeof label === "number" ? COSE_ALG_TO_NAME2[label] : void 0;
+  } catch {
+    throw new exports.MalformedCredentialError("DeviceSignature protected header is not decodable CBOR");
+  }
+  if (!alg || !allowedAlgorithms.includes(alg)) {
+    throw new exports.MalformedCredentialError(`DeviceSignature uses a disallowed algorithm: ${String(alg)}`);
+  }
+  const deviceNameSpacesInner = extractTag24Inner(deviceSigned.get("nameSpaces"));
+  const deviceAuthBytes = buildDeviceAuthenticationBytes({ sessionTranscript, docType, deviceNameSpacesInner });
+  const sigInput = encodeDeviceSigStructure(protectedBytes, deviceAuthBytes);
+  const deviceKey = await importDeviceKeyFromCose(deviceKeyCose);
+  const ok = await crypto.subtle.verify(
+    { name: "ECDSA", hash: ALG_TO_HASH2[alg] },
+    deviceKey,
+    new Uint8Array(signature),
+    sigInput
+  );
+  if (!ok) {
+    throw new exports.MalformedCredentialError("mDOC device authentication (DeviceSignature) failed to verify");
+  }
+}
+function extractTag24Inner(value) {
+  if (value instanceof Uint8Array) return value;
+  if (value !== null && typeof value === "object" && "value" in value && value.value instanceof Uint8Array && // Tag(24,bytes) and EmbeddedCbor both expose .value; both are fine here.
+  ("tag" in value ? value.tag === 24 : true)) {
+    return value.value;
+  }
+  throw new exports.MalformedCredentialError("deviceSigned.nameSpaces must be tag-24 wrapped CBOR");
+}
+
 // src/crypto/digest.ts
 init_errors();
 var decoder2 = new cborX.Encoder({ mapsAsObjects: false, useRecords: false });
@@ -8565,6 +8731,14 @@ function decodeMso(payload) {
     }
     valueDigests.set(ns, perNs);
   }
+  let deviceKey;
+  const dkiRaw = m.get("deviceKeyInfo");
+  if (dkiRaw instanceof Map) {
+    const dk = dkiRaw.get("deviceKey");
+    if (dk instanceof Map) {
+      deviceKey = dk;
+    }
+  }
   const viRaw = m.get("validityInfo");
   if (!(viRaw instanceof Map)) {
     throw new exports.MalformedCredentialError("MSO.validityInfo must be a Map");
@@ -8578,7 +8752,7 @@ function decodeMso(payload) {
   if (vi.has("expectedUpdate")) {
     validityInfo.expectedUpdate = decodeDateLike(vi.get("expectedUpdate"));
   }
-  return { version, digestAlgorithm, valueDigests, docType, validityInfo };
+  return { version, digestAlgorithm, valueDigests, docType, deviceKey, validityInfo };
 }
 function validateMsoValidity(mso, now) {
   const { signed, validFrom, validUntil } = mso.validityInfo;
@@ -8628,15 +8802,54 @@ ${lines.join("\n")}
 function extractCountryHintFromCert(_certDer) {
   return "";
 }
+function cborByteStringHeader(length) {
+  if (length < 24) return Uint8Array.of(64 | length);
+  if (length < 256) return Uint8Array.of(88, length);
+  if (length < 65536) return Uint8Array.of(89, length >> 8 & 255, length & 255);
+  if (length < 4294967296) {
+    return Uint8Array.of(
+      90,
+      length >>> 24 & 255,
+      length >>> 16 & 255,
+      length >>> 8 & 255,
+      length & 255
+    );
+  }
+  const hi = Math.floor(length / 4294967296);
+  const lo = length >>> 0;
+  return Uint8Array.of(
+    91,
+    hi >>> 24 & 255,
+    hi >>> 16 & 255,
+    hi >>> 8 & 255,
+    hi & 255,
+    lo >>> 24 & 255,
+    lo >>> 16 & 255,
+    lo >>> 8 & 255,
+    lo & 255
+  );
+}
+function wrapIssuerSignedItemBytes(inner) {
+  const header = cborByteStringHeader(inner.length);
+  const out = new Uint8Array(2 + header.length + inner.length);
+  out[0] = 216;
+  out[1] = 24;
+  out.set(header, 2);
+  out.set(inner, 2 + header.length);
+  return out;
+}
 function extractRawItemBytes(item) {
   if (item instanceof cborX.Tag && item.tag === 24 && item.value instanceof Uint8Array) {
-    return item.value;
+    return wrapIssuerSignedItemBytes(item.value);
   }
   if (item instanceof Uint8Array) {
-    return item;
+    if (item.length >= 2 && item[0] === 216 && item[1] === 24) {
+      return item;
+    }
+    return wrapIssuerSignedItemBytes(item);
   }
   if (item !== null && typeof item === "object" && !(item instanceof cborX.Tag) && !(item instanceof Map) && "value" in item && item.value instanceof Uint8Array) {
-    return item.value;
+    return wrapIssuerSignedItemBytes(item.value);
   }
   throw new exports.MalformedCredentialError("IssuerSignedItem must be a tag-24 byte string");
 }
@@ -8826,6 +9039,54 @@ var MdocParser = class {
       nameSpaces.set(ns, items.map(extractRawItemBytes));
     }
     await verifyAllDigests(nameSpaces, mso);
+    const deviceSigned = document.get("deviceSigned");
+    if (!(deviceSigned instanceof Map)) {
+      return {
+        valid: false,
+        format: this.format,
+        claims: {},
+        issuer: { certificate: issuerCertBytes, country: "" },
+        error: "Missing deviceSigned \u2014 mDOC device authentication is required"
+      };
+    }
+    if (!(options.mdocSessionTranscript instanceof Uint8Array) || options.mdocSessionTranscript.length === 0) {
+      return {
+        valid: false,
+        format: this.format,
+        claims: {},
+        issuer: { certificate: issuerCertBytes, country: "" },
+        error: "mdocSessionTranscript is required to verify mDOC device authentication"
+      };
+    }
+    if (!mso.deviceKey) {
+      return {
+        valid: false,
+        format: this.format,
+        claims: {},
+        issuer: { certificate: issuerCertBytes, country: "" },
+        error: "MSO is missing deviceKeyInfo.deviceKey; cannot verify device authentication"
+      };
+    }
+    try {
+      await verifyDeviceAuth({
+        deviceSigned,
+        deviceKeyCose: mso.deviceKey,
+        docType: mso.docType,
+        sessionTranscript: options.mdocSessionTranscript,
+        allowedAlgorithms
+      });
+    } catch (err) {
+      if (err instanceof exports.MalformedCredentialError) {
+        return {
+          valid: false,
+          format: this.format,
+          claims: {},
+          issuer: { certificate: issuerCertBytes, country: "" },
+          error: err.message
+        };
+      }
+      throw err;
+    }
     const { flat: claims, namespaced: namespacedClaims } = mapRawToClaims(nameSpaces);
     const issuer = {
       certificate: issuerCertBytes,
@@ -9098,11 +9359,21 @@ var SdJwtParser = class {
         return invalidResult("Disclosure hash mismatch");
       }
     }
+    const cnf = payload["cnf"];
+    const isHolderBound = !!cnf && typeof cnf === "object" && !!cnf["jwk"];
+    const keyBindingRequired = isHolderBound || options.requireKeyBinding === true;
+    if (keyBindingRequired && !parts.kbJwt) {
+      return invalidResult(
+        "Key binding JWT is required for holder-bound credentials but was not presented"
+      );
+    }
     if (parts.kbJwt) {
-      const cnf = payload["cnf"];
-      if (!cnf || typeof cnf !== "object" || !cnf["jwk"]) {
+      if (!isHolderBound) {
         throw new exports.MalformedCredentialError("Missing cnf.jwk in issuer JWT for key binding");
       }
+      if (typeof options.nonce !== "string" || options.nonce.length === 0) {
+        return invalidResult("A nonce is required to verify the key binding JWT");
+      }
       let holderKey;
       try {
         const kbHeader = jose.decodeProtectedHeader(parts.kbJwt);
@@ -9220,9 +9491,9 @@ async function decryptAuthorizationResponse(jwe, privateKey) {
     });
   }
   const alg = typeof header.alg === "string" ? header.alg : "";
-  const enc = typeof header.enc === "string" ? header.enc : "";
-  if (alg !== SUPPORTED_ALG || !SUPPORTED_ENC.has(enc)) {
-    throw new exports.UnsupportedJweError(alg, enc);
+  const enc3 = typeof header.enc === "string" ? header.enc : "";
+  if (alg !== SUPPORTED_ALG || !SUPPORTED_ENC.has(enc3)) {
+    throw new exports.UnsupportedJweError(alg, enc3);
   }
   let plaintext;
   try {
@@ -9240,6 +9511,29 @@ async function decryptAuthorizationResponse(jwe, privateKey) {
     });
   }
 }
+var enc2 = new cborX.Encoder({ mapsAsObjects: false, useRecords: false, tagUint8Array: false });
+async function sha256(bytes) {
+  return new Uint8Array(await crypto.subtle.digest("SHA-256", bytes));
+}
+async function buildOid4vpSessionTranscript(params) {
+  const { clientId, responseUri, nonce, mdocGeneratedNonce } = params;
+  const clientIdHash = await sha256(new Uint8Array(enc2.encode([clientId, mdocGeneratedNonce])));
+  const responseUriHash = await sha256(new Uint8Array(enc2.encode([responseUri, mdocGeneratedNonce])));
+  return new Uint8Array(enc2.encode([null, null, [clientIdHash, responseUriHash, nonce]]));
+}
+async function jwkSha256Thumbprint(jwk) {
+  if (jwk.kty !== "EC") {
+    throw new Error(`Unsupported JWK kty for thumbprint: ${jwk.kty}`);
+  }
+  const canonical = `{"crv":"${jwk.crv}","kty":"EC","x":"${jwk.x}","y":"${jwk.y}"}`;
+  return sha256(new TextEncoder().encode(canonical));
+}
+async function buildOpenID4VPHandoverSessionTranscript(params) {
+  const { clientId, nonce, responseUri, verifierEncryptionJwk } = params;
+  const thumb = verifierEncryptionJwk ? await jwkSha256Thumbprint(verifierEncryptionJwk) : null;
+  const infoHash = await sha256(new Uint8Array(enc2.encode([clientId, nonce, thumb, responseUri])));
+  return new Uint8Array(enc2.encode([null, null, ["OpenID4VPHandover", infoHash]]));
+}
 
 // src/verify.ts
 init_errors();
@@ -9277,6 +9571,42 @@ async function verifyPresentation(vpToken, query, options) {
 function isEncryptedResponse(x) {
   return typeof x === "object" && x !== null && "response" in x && typeof x.response === "string" && Object.keys(x).length === 1;
 }
+var BASE64URL_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+function base64UrlToBytes(input) {
+  const cleaned = input.replace(/=+$/, "");
+  const byteLength = Math.floor(cleaned.length * 3 / 4);
+  const bytes = new Uint8Array(byteLength);
+  let byteIndex = 0;
+  for (let i = 0; i < cleaned.length; i += 4) {
+    const a = BASE64URL_CHARS.indexOf(cleaned[i]);
+    const b = i + 1 < cleaned.length ? BASE64URL_CHARS.indexOf(cleaned[i + 1]) : 0;
+    const c = i + 2 < cleaned.length ? BASE64URL_CHARS.indexOf(cleaned[i + 2]) : 0;
+    const d = i + 3 < cleaned.length ? BASE64URL_CHARS.indexOf(cleaned[i + 3]) : 0;
+    if (a === -1 || b === -1 || c === -1 || d === -1) {
+      throw new TypeError("Invalid base64url character in vp_token/apu");
+    }
+    bytes[byteIndex++] = a << 2 | b >> 4;
+    if (byteIndex < byteLength) bytes[byteIndex++] = (b & 15) << 4 | c >> 2;
+    if (byteIndex < byteLength) bytes[byteIndex++] = (c & 3) << 6 | d;
+  }
+  return bytes;
+}
+function extractMdocGeneratedNonce(jwe) {
+  let apu;
+  try {
+    apu = jose.decodeProtectedHeader(jwe).apu;
+  } catch {
+    return void 0;
+  }
+  if (typeof apu !== "string" || apu.length === 0) {
+    return void 0;
+  }
+  try {
+    return new TextDecoder().decode(base64UrlToBytes(apu));
+  } catch {
+    return void 0;
+  }
+}
 function isAuthorizationResponse(x) {
   return typeof x === "object" && x !== null && "vp_token" in x && typeof x.vp_token === "object" && x.vp_token !== null;
 }
@@ -9285,11 +9615,32 @@ async function verifyAuthorizationResponse(envelope, query, options) {
     if (!options.decryptionKey) {
       throw new exports.MissingDecryptionKeyError();
     }
+    const nextOptions = { ...options };
+    if (options.mdocSessionTranscript === void 0 && options.clientId !== void 0 && options.responseUri !== void 0 && options.nonce !== void 0) {
+      if (options.sessionTranscriptProfile === "openid4vp-1.0") {
+        nextOptions.mdocSessionTranscript = await buildOpenID4VPHandoverSessionTranscript({
+          clientId: options.clientId,
+          nonce: options.nonce,
+          responseUri: options.responseUri,
+          verifierEncryptionJwk: options.verifierEncryptionJwk
+        });
+      } else {
+        const mdocGeneratedNonce = extractMdocGeneratedNonce(envelope.response);
+        if (mdocGeneratedNonce !== void 0) {
+          nextOptions.mdocSessionTranscript = await buildOid4vpSessionTranscript({
+            clientId: options.clientId,
+            responseUri: options.responseUri,
+            nonce: options.nonce,
+            mdocGeneratedNonce
+          });
+        }
+      }
+    }
     const decrypted = await decryptAuthorizationResponse(
       envelope.response,
       options.decryptionKey
     );
-    return verifyAuthorizationResponse(decrypted, query, options);
+    return verifyAuthorizationResponse(decrypted, query, nextOptions);
   }
   if (!isAuthorizationResponse(envelope)) {
     throw new TypeError("envelope must contain vp_token as a JSON object per OpenID4VP 1.0 \xA78.1");
@@ -9314,7 +9665,8 @@ async function verifyAuthorizationResponse(envelope, query, options) {
     throw new exports.MultipleCredentialsNotSupportedError(queryIds.length, presentationCount);
   }
   const presentation = vpToken[queryIds[0]][0];
-  return verifyPresentation(presentation, query, options);
+  const decodedPresentation = query.credentials[0]?.format === "mso_mdoc" && typeof presentation === "string" ? base64UrlToBytes(presentation) : presentation;
+  return verifyPresentation(decodedPresentation, query, options);
 }
 
 // src/index.ts
@@ -10014,6 +10366,8 @@ exports.SdJwtParser = SdJwtParser;
 exports.StaticTrustStore = StaticTrustStore;
 exports.VERSION = VERSION;
 exports.buildHaipQuery = buildHaipQuery;
+exports.buildOid4vpSessionTranscript = buildOid4vpSessionTranscript;
+exports.buildOpenID4VPHandoverSessionTranscript = buildOpenID4VPHandoverSessionTranscript;
 exports.createAuthorizationRequest = createAuthorizationRequest;
 exports.createSignedAuthorizationRequest = createSignedAuthorizationRequest;
 exports.decryptAuthorizationResponse = decryptAuthorizationResponse;