@openid4vc/openid4vci 0.3.0-alpha-20250324183425 → 0.3.0-alpha-20250325212250
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.mts +17553 -10748
- package/dist/index.d.ts +17553 -10748
- package/dist/index.js +530 -302
- package/dist/index.js.map +1 -1
- package/dist/index.mjs +532 -302
- package/dist/index.mjs.map +1 -1
- package/package.json +3 -3
package/dist/index.js
CHANGED
|
@@ -37,6 +37,7 @@ __export(src_exports, {
|
|
|
37
37
|
Openid4vciIssuer: () => Openid4vciIssuer,
|
|
38
38
|
Openid4vciRetrieveCredentialsError: () => Openid4vciRetrieveCredentialsError,
|
|
39
39
|
Openid4vciSendNotificationError: () => Openid4vciSendNotificationError,
|
|
40
|
+
Openid4vciWalletProvider: () => Openid4vciWalletProvider,
|
|
40
41
|
credentialsSupportedToCredentialConfigurationsSupported: () => credentialsSupportedToCredentialConfigurationsSupported,
|
|
41
42
|
extractScopesForCredentialConfigurationIds: () => extractScopesForCredentialConfigurationIds,
|
|
42
43
|
getCredentialConfigurationsMatchingRequestFormat: () => getCredentialConfigurationsMatchingRequestFormat,
|
|
@@ -56,117 +57,81 @@ var import_utils3 = require("@openid4vc/utils");
|
|
|
56
57
|
// src/metadata/credential-issuer/z-credential-issuer-metadata.ts
|
|
57
58
|
var import_oauth22 = require("@openid4vc/oauth2");
|
|
58
59
|
var import_utils2 = require("@openid4vc/utils");
|
|
59
|
-
var
|
|
60
|
+
var import_zod11 = __toESM(require("zod"));
|
|
60
61
|
|
|
61
62
|
// src/formats/credential/mso-mdoc/z-mso-mdoc.ts
|
|
62
|
-
var import_zod3 = __toESM(require("zod"));
|
|
63
|
-
|
|
64
|
-
// src/metadata/credential-issuer/z-credential-configuration-supported-common.ts
|
|
65
63
|
var import_zod2 = __toESM(require("zod"));
|
|
66
64
|
|
|
67
|
-
// src/
|
|
68
|
-
var import_oauth2 = require("@openid4vc/oauth2");
|
|
69
|
-
var import_utils = require("@openid4vc/utils");
|
|
65
|
+
// src/metadata/credential-issuer/z-claims-description.ts
|
|
70
66
|
var import_zod = __toESM(require("zod"));
|
|
71
|
-
var
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
message: `When 'trust_chain' is provided, 'kid' is required`
|
|
78
|
-
});
|
|
79
|
-
var zIso18045 = import_zod.default.enum(["iso_18045_high", "iso_18045_moderate", "iso_18045_enhanced-basic", "iso_18045_basic"]);
|
|
80
|
-
var zIso18045OrStringArray = import_zod.default.array(import_zod.default.union([zIso18045, import_zod.default.string()]));
|
|
81
|
-
var zKeyAttestationJwtPayload = import_zod.default.object({
|
|
82
|
-
...import_oauth2.zJwtPayload.shape,
|
|
83
|
-
iat: import_utils.zInteger,
|
|
84
|
-
attested_keys: import_zod.default.array(import_oauth2.zJwk),
|
|
85
|
-
key_storage: import_zod.default.optional(zIso18045OrStringArray),
|
|
86
|
-
user_authentication: import_zod.default.optional(zIso18045OrStringArray),
|
|
87
|
-
certification: import_zod.default.optional(import_zod.default.string())
|
|
88
|
-
}).passthrough();
|
|
89
|
-
var zKeyAttestationJwtPayloadForUse = (use) => import_zod.default.object({
|
|
90
|
-
...zKeyAttestationJwtPayload.shape,
|
|
91
|
-
// REQUIRED when used as proof_type.attesation directly
|
|
92
|
-
nonce: use === "proof_type.attestation" ? import_zod.default.string({
|
|
93
|
-
message: `Nonce must be defined when key attestation is used as 'proof_type.attestation' directly`
|
|
94
|
-
}) : import_zod.default.optional(import_zod.default.string()),
|
|
95
|
-
// REQUIRED when used within header of proof_type.jwt
|
|
96
|
-
exp: use === "proof_type.jwt" ? import_utils.zInteger : import_zod.default.optional(import_utils.zInteger)
|
|
97
|
-
}).passthrough();
|
|
98
|
-
|
|
99
|
-
// src/metadata/credential-issuer/z-credential-configuration-supported-common.ts
|
|
100
|
-
var zCredentialConfigurationSupportedClaims = import_zod2.default.object({
|
|
101
|
-
mandatory: import_zod2.default.boolean().optional(),
|
|
102
|
-
value_type: import_zod2.default.string().optional(),
|
|
103
|
-
display: import_zod2.default.object({
|
|
104
|
-
name: import_zod2.default.string().optional(),
|
|
105
|
-
locale: import_zod2.default.string().optional()
|
|
67
|
+
var zCredentialConfigurationSupportedClaimsDraft14 = import_zod.default.object({
|
|
68
|
+
mandatory: import_zod.default.boolean().optional(),
|
|
69
|
+
value_type: import_zod.default.string().optional(),
|
|
70
|
+
display: import_zod.default.object({
|
|
71
|
+
name: import_zod.default.string().optional(),
|
|
72
|
+
locale: import_zod.default.string().optional()
|
|
106
73
|
}).passthrough().optional()
|
|
107
74
|
}).passthrough();
|
|
108
|
-
var
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
user_authentication: zIso18045OrStringArray.optional()
|
|
120
|
-
}).passthrough().optional()
|
|
121
|
-
})
|
|
122
|
-
).optional(),
|
|
123
|
-
display: import_zod2.default.array(
|
|
124
|
-
import_zod2.default.object({
|
|
125
|
-
name: import_zod2.default.string(),
|
|
126
|
-
locale: import_zod2.default.string().optional(),
|
|
127
|
-
logo: import_zod2.default.object({
|
|
128
|
-
// FIXME: make required again, but need to support draft 11 first
|
|
129
|
-
uri: import_zod2.default.string().optional(),
|
|
130
|
-
alt_text: import_zod2.default.string().optional()
|
|
131
|
-
}).passthrough().optional(),
|
|
132
|
-
description: import_zod2.default.string().optional(),
|
|
133
|
-
background_color: import_zod2.default.string().optional(),
|
|
134
|
-
background_image: import_zod2.default.object({
|
|
135
|
-
// TODO: should be required, but paradym's metadata is wrong here.
|
|
136
|
-
uri: import_zod2.default.string().optional()
|
|
137
|
-
}).passthrough().optional(),
|
|
138
|
-
text_color: import_zod2.default.string().optional()
|
|
75
|
+
var zClaimsDescriptionPath = import_zod.default.array(import_zod.default.union([import_zod.default.string(), import_zod.default.number().int().nonnegative(), import_zod.default.null()])).nonempty();
|
|
76
|
+
var zMsoMdocClaimsDescriptionPath = import_zod.default.tuple([import_zod.default.string(), import_zod.default.string()], {
|
|
77
|
+
message: "mso_mdoc claims description path MUST be an array with exactly two string elements, pointing to the namespace and element identifier within an mdoc credential"
|
|
78
|
+
});
|
|
79
|
+
var zIssuerMetadataClaimsDescription = import_zod.default.object({
|
|
80
|
+
path: zClaimsDescriptionPath,
|
|
81
|
+
mandatory: import_zod.default.boolean().optional(),
|
|
82
|
+
display: import_zod.default.array(
|
|
83
|
+
import_zod.default.object({
|
|
84
|
+
name: import_zod.default.string().optional(),
|
|
85
|
+
locale: import_zod.default.string().optional()
|
|
139
86
|
}).passthrough()
|
|
140
87
|
).optional()
|
|
141
88
|
}).passthrough();
|
|
89
|
+
var zMsoMdocIssuerMetadataClaimsDescription = zIssuerMetadataClaimsDescription.extend({
|
|
90
|
+
path: zMsoMdocClaimsDescriptionPath
|
|
91
|
+
});
|
|
142
92
|
|
|
143
93
|
// src/formats/credential/mso-mdoc/z-mso-mdoc.ts
|
|
144
|
-
var zMsoMdocFormatIdentifier =
|
|
145
|
-
var zMsoMdocCredentialIssuerMetadata =
|
|
94
|
+
var zMsoMdocFormatIdentifier = import_zod2.default.literal("mso_mdoc");
|
|
95
|
+
var zMsoMdocCredentialIssuerMetadata = import_zod2.default.object({
|
|
146
96
|
format: zMsoMdocFormatIdentifier,
|
|
147
|
-
doctype:
|
|
148
|
-
claims:
|
|
149
|
-
order: import_zod3.default.optional(import_zod3.default.array(import_zod3.default.string()))
|
|
97
|
+
doctype: import_zod2.default.string(),
|
|
98
|
+
claims: import_zod2.default.array(zMsoMdocIssuerMetadataClaimsDescription).optional()
|
|
150
99
|
});
|
|
151
|
-
var
|
|
100
|
+
var zMsoMdocCredentialIssuerMetadataDraft14 = import_zod2.default.object({
|
|
152
101
|
format: zMsoMdocFormatIdentifier,
|
|
153
|
-
doctype:
|
|
154
|
-
claims:
|
|
102
|
+
doctype: import_zod2.default.string(),
|
|
103
|
+
claims: zCredentialConfigurationSupportedClaimsDraft14.optional(),
|
|
104
|
+
order: import_zod2.default.optional(import_zod2.default.array(import_zod2.default.string()))
|
|
105
|
+
});
|
|
106
|
+
var zMsoMdocCredentialRequestFormatDraft14 = import_zod2.default.object({
|
|
107
|
+
format: zMsoMdocFormatIdentifier,
|
|
108
|
+
doctype: import_zod2.default.string(),
|
|
109
|
+
// Format based request is removed in Draft 15, so only old claims syntax supported.
|
|
110
|
+
claims: import_zod2.default.optional(zCredentialConfigurationSupportedClaimsDraft14)
|
|
155
111
|
});
|
|
156
112
|
|
|
157
113
|
// src/formats/credential/sd-jwt-vc/z-sd-jwt-vc.ts
|
|
158
|
-
var
|
|
159
|
-
var zSdJwtVcFormatIdentifier =
|
|
160
|
-
var
|
|
161
|
-
vct:
|
|
114
|
+
var import_zod3 = __toESM(require("zod"));
|
|
115
|
+
var zSdJwtVcFormatIdentifier = import_zod3.default.literal("vc+sd-jwt");
|
|
116
|
+
var zSdJwtVcCredentialIssuerMetadataDraft14 = import_zod3.default.object({
|
|
117
|
+
vct: import_zod3.default.string(),
|
|
162
118
|
format: zSdJwtVcFormatIdentifier,
|
|
163
|
-
claims:
|
|
164
|
-
order:
|
|
119
|
+
claims: import_zod3.default.optional(zCredentialConfigurationSupportedClaimsDraft14),
|
|
120
|
+
order: import_zod3.default.optional(import_zod3.default.array(import_zod3.default.string()))
|
|
165
121
|
});
|
|
166
|
-
var
|
|
122
|
+
var zSdJwtVcCredentialRequestFormatDraft14 = import_zod3.default.object({
|
|
167
123
|
format: zSdJwtVcFormatIdentifier,
|
|
124
|
+
vct: import_zod3.default.string(),
|
|
125
|
+
claims: import_zod3.default.optional(zCredentialConfigurationSupportedClaimsDraft14)
|
|
126
|
+
});
|
|
127
|
+
|
|
128
|
+
// src/formats/credential/sd-jwt-dc/z-sd-jwt-dc.ts
|
|
129
|
+
var import_zod4 = __toESM(require("zod"));
|
|
130
|
+
var zSdJwtDcFormatIdentifier = import_zod4.default.literal("dc+sd-jwt");
|
|
131
|
+
var zSdJwtDcCredentialIssuerMetadata = import_zod4.default.object({
|
|
168
132
|
vct: import_zod4.default.string(),
|
|
169
|
-
|
|
133
|
+
format: zSdJwtDcFormatIdentifier,
|
|
134
|
+
claims: import_zod4.default.array(zIssuerMetadataClaimsDescription).optional()
|
|
170
135
|
});
|
|
171
136
|
|
|
172
137
|
// src/formats/credential/w3c-vc/z-w3c-ldp-vc.ts
|
|
@@ -174,7 +139,7 @@ var import_zod6 = __toESM(require("zod"));
|
|
|
174
139
|
|
|
175
140
|
// src/formats/credential/w3c-vc/z-w3c-vc-common.ts
|
|
176
141
|
var import_zod5 = __toESM(require("zod"));
|
|
177
|
-
var
|
|
142
|
+
var zCredentialSubjectLeafTypeDraft14 = import_zod5.default.object({
|
|
178
143
|
mandatory: import_zod5.default.boolean().optional(),
|
|
179
144
|
value_type: import_zod5.default.string().optional(),
|
|
180
145
|
display: import_zod5.default.array(
|
|
@@ -184,19 +149,30 @@ var zCredentialSubjectLeafType = import_zod5.default.object({
|
|
|
184
149
|
}).passthrough()
|
|
185
150
|
).optional()
|
|
186
151
|
}).passthrough();
|
|
187
|
-
var
|
|
188
|
-
|
|
152
|
+
var zClaimValueSchemaDraft14 = import_zod5.default.union([
|
|
153
|
+
import_zod5.default.array(import_zod5.default.any()),
|
|
154
|
+
import_zod5.default.record(import_zod5.default.string(), import_zod5.default.any()),
|
|
155
|
+
zCredentialSubjectLeafTypeDraft14
|
|
156
|
+
]);
|
|
157
|
+
var zW3cVcCredentialSubjectDraft14 = import_zod5.default.record(import_zod5.default.string(), zClaimValueSchemaDraft14);
|
|
189
158
|
var zW3cVcJsonLdCredentialDefinition = import_zod5.default.object({
|
|
190
159
|
"@context": import_zod5.default.array(import_zod5.default.string()),
|
|
191
|
-
type: import_zod5.default.array(import_zod5.default.string())
|
|
192
|
-
credentialSubject: zW3cVcCredentialSubject.optional()
|
|
160
|
+
type: import_zod5.default.array(import_zod5.default.string())
|
|
193
161
|
}).passthrough();
|
|
162
|
+
var zW3cVcJsonLdCredentialDefinitionDraft14 = zW3cVcJsonLdCredentialDefinition.extend({
|
|
163
|
+
credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
|
|
164
|
+
});
|
|
194
165
|
|
|
195
166
|
// src/formats/credential/w3c-vc/z-w3c-ldp-vc.ts
|
|
196
167
|
var zLdpVcFormatIdentifier = import_zod6.default.literal("ldp_vc");
|
|
197
168
|
var zLdpVcCredentialIssuerMetadata = import_zod6.default.object({
|
|
198
169
|
format: zLdpVcFormatIdentifier,
|
|
199
170
|
credential_definition: zW3cVcJsonLdCredentialDefinition,
|
|
171
|
+
claims: zIssuerMetadataClaimsDescription.optional()
|
|
172
|
+
});
|
|
173
|
+
var zLdpVcCredentialIssuerMetadataDraft14 = import_zod6.default.object({
|
|
174
|
+
format: zLdpVcFormatIdentifier,
|
|
175
|
+
credential_definition: zW3cVcJsonLdCredentialDefinitionDraft14,
|
|
200
176
|
order: import_zod6.default.array(import_zod6.default.string()).optional()
|
|
201
177
|
});
|
|
202
178
|
var zLdpVcCredentialIssuerMetadataDraft11 = import_zod6.default.object({
|
|
@@ -206,7 +182,7 @@ var zLdpVcCredentialIssuerMetadataDraft11 = import_zod6.default.object({
|
|
|
206
182
|
// As well as using types instead of type
|
|
207
183
|
"@context": import_zod6.default.array(import_zod6.default.string()),
|
|
208
184
|
types: import_zod6.default.array(import_zod6.default.string()),
|
|
209
|
-
credentialSubject:
|
|
185
|
+
credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
|
|
210
186
|
}).passthrough();
|
|
211
187
|
var zLdpVcCredentialIssuerMetadataDraft11To14 = zLdpVcCredentialIssuerMetadataDraft11.transform(
|
|
212
188
|
({ "@context": context, types, credentialSubject, ...rest }) => ({
|
|
@@ -219,14 +195,14 @@ var zLdpVcCredentialIssuerMetadataDraft11To14 = zLdpVcCredentialIssuerMetadataDr
|
|
|
219
195
|
}
|
|
220
196
|
})
|
|
221
197
|
);
|
|
222
|
-
var zLdpVcCredentialIssuerMetadataDraft14To11 =
|
|
198
|
+
var zLdpVcCredentialIssuerMetadataDraft14To11 = zLdpVcCredentialIssuerMetadataDraft14.passthrough().transform(({ credential_definition: { type, ...credentialDefinition }, ...rest }) => ({
|
|
223
199
|
...rest,
|
|
224
200
|
...credentialDefinition,
|
|
225
201
|
types: type
|
|
226
202
|
})).pipe(zLdpVcCredentialIssuerMetadataDraft11);
|
|
227
|
-
var
|
|
203
|
+
var zLdpVcCredentialRequestFormatDraft14 = import_zod6.default.object({
|
|
228
204
|
format: zLdpVcFormatIdentifier,
|
|
229
|
-
credential_definition:
|
|
205
|
+
credential_definition: zW3cVcJsonLdCredentialDefinitionDraft14
|
|
230
206
|
});
|
|
231
207
|
var zLdpVcCredentialRequestDraft11 = import_zod6.default.object({
|
|
232
208
|
format: zLdpVcFormatIdentifier,
|
|
@@ -234,7 +210,7 @@ var zLdpVcCredentialRequestDraft11 = import_zod6.default.object({
|
|
|
234
210
|
"@context": import_zod6.default.array(import_zod6.default.string()),
|
|
235
211
|
// credential_definition was using types instead of type in v11
|
|
236
212
|
types: import_zod6.default.array(import_zod6.default.string()),
|
|
237
|
-
credentialSubject:
|
|
213
|
+
credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
|
|
238
214
|
})
|
|
239
215
|
}).passthrough();
|
|
240
216
|
var zLdpVcCredentialRequestDraft11To14 = zLdpVcCredentialRequestDraft11.transform(
|
|
@@ -246,7 +222,7 @@ var zLdpVcCredentialRequestDraft11To14 = zLdpVcCredentialRequestDraft11.transfor
|
|
|
246
222
|
}
|
|
247
223
|
})
|
|
248
224
|
);
|
|
249
|
-
var zLdpVcCredentialRequestDraft14To11 =
|
|
225
|
+
var zLdpVcCredentialRequestDraft14To11 = zLdpVcCredentialRequestFormatDraft14.passthrough().transform(({ credential_definition: { type, ...restCredentialDefinition }, ...rest }) => ({
|
|
250
226
|
...rest,
|
|
251
227
|
credential_definition: {
|
|
252
228
|
...restCredentialDefinition,
|
|
@@ -260,6 +236,11 @@ var zJwtVcJsonLdFormatIdentifier = import_zod7.default.literal("jwt_vc_json-ld")
|
|
|
260
236
|
var zJwtVcJsonLdCredentialIssuerMetadata = import_zod7.default.object({
|
|
261
237
|
format: zJwtVcJsonLdFormatIdentifier,
|
|
262
238
|
credential_definition: zW3cVcJsonLdCredentialDefinition,
|
|
239
|
+
claims: zIssuerMetadataClaimsDescription.optional()
|
|
240
|
+
});
|
|
241
|
+
var zJwtVcJsonLdCredentialIssuerMetadataDraft14 = import_zod7.default.object({
|
|
242
|
+
format: zJwtVcJsonLdFormatIdentifier,
|
|
243
|
+
credential_definition: zW3cVcJsonLdCredentialDefinitionDraft14,
|
|
263
244
|
order: import_zod7.default.optional(import_zod7.default.array(import_zod7.default.string()))
|
|
264
245
|
});
|
|
265
246
|
var zJwtVcJsonLdCredentialIssuerMetadataDraft11 = import_zod7.default.object({
|
|
@@ -269,7 +250,7 @@ var zJwtVcJsonLdCredentialIssuerMetadataDraft11 = import_zod7.default.object({
|
|
|
269
250
|
// As well as using types instead of type
|
|
270
251
|
"@context": import_zod7.default.array(import_zod7.default.string()),
|
|
271
252
|
types: import_zod7.default.array(import_zod7.default.string()),
|
|
272
|
-
credentialSubject:
|
|
253
|
+
credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
|
|
273
254
|
}).passthrough();
|
|
274
255
|
var zJwtVcJsonLdCredentialIssuerMetadataDraft11To14 = zJwtVcJsonLdCredentialIssuerMetadataDraft11.transform(
|
|
275
256
|
({ "@context": context, types, credentialSubject, ...rest }) => ({
|
|
@@ -282,12 +263,12 @@ var zJwtVcJsonLdCredentialIssuerMetadataDraft11To14 = zJwtVcJsonLdCredentialIssu
|
|
|
282
263
|
}
|
|
283
264
|
})
|
|
284
265
|
);
|
|
285
|
-
var zJwtVcJsonLdCredentialIssuerMetadataDraft14To11 =
|
|
266
|
+
var zJwtVcJsonLdCredentialIssuerMetadataDraft14To11 = zJwtVcJsonLdCredentialIssuerMetadataDraft14.passthrough().transform(({ credential_definition: { type, ...credentialDefinition }, ...rest }) => ({
|
|
286
267
|
...rest,
|
|
287
268
|
...credentialDefinition,
|
|
288
269
|
types: type
|
|
289
270
|
})).pipe(zJwtVcJsonLdCredentialIssuerMetadataDraft11);
|
|
290
|
-
var
|
|
271
|
+
var zJwtVcJsonLdCredentialRequestFormatDraft14 = import_zod7.default.object({
|
|
291
272
|
format: zJwtVcJsonLdFormatIdentifier,
|
|
292
273
|
credential_definition: zW3cVcJsonLdCredentialDefinition
|
|
293
274
|
});
|
|
@@ -297,7 +278,7 @@ var zJwtVcJsonLdCredentialRequestDraft11 = import_zod7.default.object({
|
|
|
297
278
|
"@context": import_zod7.default.array(import_zod7.default.string()),
|
|
298
279
|
// credential_definition was using types instead of type in v11
|
|
299
280
|
types: import_zod7.default.array(import_zod7.default.string()),
|
|
300
|
-
credentialSubject: import_zod7.default.optional(
|
|
281
|
+
credentialSubject: import_zod7.default.optional(zW3cVcCredentialSubjectDraft14)
|
|
301
282
|
}).passthrough()
|
|
302
283
|
}).passthrough();
|
|
303
284
|
var zJwtVcJsonLdCredentialRequestDraft11To14 = zJwtVcJsonLdCredentialRequestDraft11.transform(
|
|
@@ -309,7 +290,7 @@ var zJwtVcJsonLdCredentialRequestDraft11To14 = zJwtVcJsonLdCredentialRequestDraf
|
|
|
309
290
|
}
|
|
310
291
|
})
|
|
311
292
|
);
|
|
312
|
-
var zJwtVcJsonLdCredentialRequestDraft14To11 =
|
|
293
|
+
var zJwtVcJsonLdCredentialRequestDraft14To11 = zJwtVcJsonLdCredentialRequestFormatDraft14.passthrough().transform(({ credential_definition: { type, ...restCredentialDefinition }, ...rest }) => ({
|
|
313
294
|
...rest,
|
|
314
295
|
credential_definition: {
|
|
315
296
|
...restCredentialDefinition,
|
|
@@ -321,12 +302,19 @@ var zJwtVcJsonLdCredentialRequestDraft14To11 = zJwtVcJsonLdCredentialRequestForm
|
|
|
321
302
|
var import_zod8 = __toESM(require("zod"));
|
|
322
303
|
var zJwtVcJsonFormatIdentifier = import_zod8.default.literal("jwt_vc_json");
|
|
323
304
|
var zJwtVcJsonCredentialDefinition = import_zod8.default.object({
|
|
324
|
-
type: import_zod8.default.array(import_zod8.default.string())
|
|
325
|
-
credentialSubject: zW3cVcCredentialSubject.optional()
|
|
305
|
+
type: import_zod8.default.array(import_zod8.default.string())
|
|
326
306
|
}).passthrough();
|
|
307
|
+
var zJwtVcJsonCredentialDefinitionDraft14 = zJwtVcJsonCredentialDefinition.extend({
|
|
308
|
+
credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
|
|
309
|
+
});
|
|
327
310
|
var zJwtVcJsonCredentialIssuerMetadata = import_zod8.default.object({
|
|
328
311
|
format: zJwtVcJsonFormatIdentifier,
|
|
329
312
|
credential_definition: zJwtVcJsonCredentialDefinition,
|
|
313
|
+
claims: zIssuerMetadataClaimsDescription.optional()
|
|
314
|
+
});
|
|
315
|
+
var zJwtVcJsonCredentialIssuerMetadataDraft14 = import_zod8.default.object({
|
|
316
|
+
format: zJwtVcJsonFormatIdentifier,
|
|
317
|
+
credential_definition: zJwtVcJsonCredentialDefinitionDraft14,
|
|
330
318
|
order: import_zod8.default.array(import_zod8.default.string()).optional()
|
|
331
319
|
});
|
|
332
320
|
var zJwtVcJsonCredentialIssuerMetadataDraft11 = import_zod8.default.object({
|
|
@@ -335,7 +323,7 @@ var zJwtVcJsonCredentialIssuerMetadataDraft11 = import_zod8.default.object({
|
|
|
335
323
|
// Credential definition was spread on top level instead of a separatey property in v11
|
|
336
324
|
// As well as using types instead of type
|
|
337
325
|
types: import_zod8.default.array(import_zod8.default.string()),
|
|
338
|
-
credentialSubject:
|
|
326
|
+
credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
|
|
339
327
|
}).passthrough();
|
|
340
328
|
var zJwtVcJsonCredentialIssuerMetadataDraft11To14 = zJwtVcJsonCredentialIssuerMetadataDraft11.transform(
|
|
341
329
|
({ types, credentialSubject, ...rest }) => ({
|
|
@@ -347,12 +335,12 @@ var zJwtVcJsonCredentialIssuerMetadataDraft11To14 = zJwtVcJsonCredentialIssuerMe
|
|
|
347
335
|
}
|
|
348
336
|
})
|
|
349
337
|
);
|
|
350
|
-
var zJwtVcJsonCredentialIssuerMetadataDraft14To11 =
|
|
338
|
+
var zJwtVcJsonCredentialIssuerMetadataDraft14To11 = zJwtVcJsonCredentialIssuerMetadataDraft14.passthrough().transform(({ credential_definition: { type, ...credentialDefinition }, ...rest }) => ({
|
|
351
339
|
...rest,
|
|
352
340
|
types: type,
|
|
353
341
|
...credentialDefinition
|
|
354
342
|
})).pipe(zJwtVcJsonCredentialIssuerMetadataDraft11);
|
|
355
|
-
var
|
|
343
|
+
var zJwtVcJsonCredentialRequestFormatDraft14 = import_zod8.default.object({
|
|
356
344
|
format: zJwtVcJsonFormatIdentifier,
|
|
357
345
|
credential_definition: zJwtVcJsonCredentialDefinition
|
|
358
346
|
});
|
|
@@ -361,7 +349,7 @@ var zJwtVcJsonCredentialRequestDraft11 = import_zod8.default.object({
|
|
|
361
349
|
// Credential definition was spread on top level instead of a separatey property in v11
|
|
362
350
|
// As well as using types instead of type
|
|
363
351
|
types: import_zod8.default.array(import_zod8.default.string()),
|
|
364
|
-
credentialSubject: import_zod8.default.optional(
|
|
352
|
+
credentialSubject: import_zod8.default.optional(zW3cVcCredentialSubjectDraft14)
|
|
365
353
|
}).passthrough();
|
|
366
354
|
var zJwtVcJsonCredentialRequestDraft11To14 = zJwtVcJsonCredentialRequestDraft11.transform(
|
|
367
355
|
({ types, credentialSubject, ...rest }) => {
|
|
@@ -375,7 +363,7 @@ var zJwtVcJsonCredentialRequestDraft11To14 = zJwtVcJsonCredentialRequestDraft11.
|
|
|
375
363
|
};
|
|
376
364
|
}
|
|
377
365
|
);
|
|
378
|
-
var zJwtVcJsonCredentialRequestDraft14To11 =
|
|
366
|
+
var zJwtVcJsonCredentialRequestDraft14To11 = zJwtVcJsonCredentialRequestFormatDraft14.passthrough().transform(({ credential_definition: { type, ...credentialDefinition }, ...rest }) => ({
|
|
379
367
|
...rest,
|
|
380
368
|
types: type,
|
|
381
369
|
...credentialDefinition
|
|
@@ -383,18 +371,95 @@ var zJwtVcJsonCredentialRequestDraft14To11 = zJwtVcJsonCredentialRequestFormat.p
|
|
|
383
371
|
|
|
384
372
|
// src/version.ts
|
|
385
373
|
var Openid4vciDraftVersion = /* @__PURE__ */ ((Openid4vciDraftVersion2) => {
|
|
374
|
+
Openid4vciDraftVersion2["Draft15"] = "Draft15";
|
|
386
375
|
Openid4vciDraftVersion2["Draft14"] = "Draft14";
|
|
387
376
|
Openid4vciDraftVersion2["Draft11"] = "Draft11";
|
|
388
377
|
return Openid4vciDraftVersion2;
|
|
389
378
|
})(Openid4vciDraftVersion || {});
|
|
390
379
|
|
|
380
|
+
// src/metadata/credential-issuer/z-credential-configuration-supported-common.ts
|
|
381
|
+
var import_zod10 = __toESM(require("zod"));
|
|
382
|
+
|
|
383
|
+
// src/key-attestation/z-key-attestation.ts
|
|
384
|
+
var import_oauth2 = require("@openid4vc/oauth2");
|
|
385
|
+
var import_utils = require("@openid4vc/utils");
|
|
386
|
+
var import_zod9 = __toESM(require("zod"));
|
|
387
|
+
var zKeyAttestationJwtHeader = import_zod9.default.object({
|
|
388
|
+
...import_oauth2.zJwtHeader.shape,
|
|
389
|
+
typ: import_zod9.default.literal("keyattestation+jwt")
|
|
390
|
+
}).passthrough().refine(({ kid, jwk }) => jwk === void 0 || kid === void 0, {
|
|
391
|
+
message: `Both 'jwk' and 'kid' are defined. Only one is allowed`
|
|
392
|
+
}).refine(({ trust_chain, kid }) => !trust_chain || !kid, {
|
|
393
|
+
message: `When 'trust_chain' is provided, 'kid' is required`
|
|
394
|
+
});
|
|
395
|
+
var zIso18045 = import_zod9.default.enum(["iso_18045_high", "iso_18045_moderate", "iso_18045_enhanced-basic", "iso_18045_basic"]);
|
|
396
|
+
var zIso18045OrStringArray = import_zod9.default.array(import_zod9.default.union([zIso18045, import_zod9.default.string()]));
|
|
397
|
+
var zKeyAttestationJwtPayload = import_zod9.default.object({
|
|
398
|
+
...import_oauth2.zJwtPayload.shape,
|
|
399
|
+
iat: import_utils.zInteger,
|
|
400
|
+
attested_keys: import_zod9.default.array(import_oauth2.zJwk),
|
|
401
|
+
key_storage: import_zod9.default.optional(zIso18045OrStringArray),
|
|
402
|
+
user_authentication: import_zod9.default.optional(zIso18045OrStringArray),
|
|
403
|
+
certification: import_zod9.default.optional(import_zod9.default.string().url())
|
|
404
|
+
}).passthrough();
|
|
405
|
+
var zKeyAttestationJwtPayloadForUse = (use) => import_zod9.default.object({
|
|
406
|
+
...zKeyAttestationJwtPayload.shape,
|
|
407
|
+
// REQUIRED when used as proof_type.attesation directly
|
|
408
|
+
nonce: use === "proof_type.attestation" ? import_zod9.default.string({
|
|
409
|
+
message: `Nonce must be defined when key attestation is used as 'proof_type.attestation' directly`
|
|
410
|
+
}) : import_zod9.default.optional(import_zod9.default.string()),
|
|
411
|
+
// REQUIRED when used within header of proof_type.jwt
|
|
412
|
+
exp: use === "proof_type.jwt" ? import_utils.zInteger : import_zod9.default.optional(import_utils.zInteger)
|
|
413
|
+
}).passthrough();
|
|
414
|
+
|
|
415
|
+
// src/metadata/credential-issuer/z-credential-configuration-supported-common.ts
|
|
416
|
+
var zCredentialConfigurationSupportedCommon = import_zod10.default.object({
|
|
417
|
+
format: import_zod10.default.string(),
|
|
418
|
+
scope: import_zod10.default.string().optional(),
|
|
419
|
+
cryptographic_binding_methods_supported: import_zod10.default.array(import_zod10.default.string()).optional(),
|
|
420
|
+
credential_signing_alg_values_supported: import_zod10.default.array(import_zod10.default.string()).optional(),
|
|
421
|
+
proof_types_supported: import_zod10.default.record(
|
|
422
|
+
import_zod10.default.union([import_zod10.default.literal("jwt"), import_zod10.default.literal("attestation"), import_zod10.default.string()]),
|
|
423
|
+
import_zod10.default.object({
|
|
424
|
+
proof_signing_alg_values_supported: import_zod10.default.array(import_zod10.default.string()),
|
|
425
|
+
key_attestations_required: import_zod10.default.object({
|
|
426
|
+
key_storage: zIso18045OrStringArray.optional(),
|
|
427
|
+
user_authentication: zIso18045OrStringArray.optional()
|
|
428
|
+
}).passthrough().optional()
|
|
429
|
+
})
|
|
430
|
+
).optional(),
|
|
431
|
+
display: import_zod10.default.array(
|
|
432
|
+
import_zod10.default.object({
|
|
433
|
+
name: import_zod10.default.string(),
|
|
434
|
+
locale: import_zod10.default.string().optional(),
|
|
435
|
+
logo: import_zod10.default.object({
|
|
436
|
+
// FIXME: make required again, but need to support draft 11 first
|
|
437
|
+
uri: import_zod10.default.string().optional(),
|
|
438
|
+
alt_text: import_zod10.default.string().optional()
|
|
439
|
+
}).passthrough().optional(),
|
|
440
|
+
description: import_zod10.default.string().optional(),
|
|
441
|
+
background_color: import_zod10.default.string().optional(),
|
|
442
|
+
background_image: import_zod10.default.object({
|
|
443
|
+
// TODO: should be required, but paradym's metadata is wrong here.
|
|
444
|
+
uri: import_zod10.default.string().optional()
|
|
445
|
+
}).passthrough().optional(),
|
|
446
|
+
text_color: import_zod10.default.string().optional()
|
|
447
|
+
}).passthrough()
|
|
448
|
+
).optional()
|
|
449
|
+
}).passthrough();
|
|
450
|
+
|
|
391
451
|
// src/metadata/credential-issuer/z-credential-issuer-metadata.ts
|
|
392
452
|
var allCredentialIssuerMetadataFormats = [
|
|
393
|
-
|
|
453
|
+
zSdJwtDcCredentialIssuerMetadata,
|
|
394
454
|
zMsoMdocCredentialIssuerMetadata,
|
|
395
455
|
zJwtVcJsonLdCredentialIssuerMetadata,
|
|
396
456
|
zLdpVcCredentialIssuerMetadata,
|
|
397
|
-
zJwtVcJsonCredentialIssuerMetadata
|
|
457
|
+
zJwtVcJsonCredentialIssuerMetadata,
|
|
458
|
+
zMsoMdocCredentialIssuerMetadataDraft14,
|
|
459
|
+
zSdJwtVcCredentialIssuerMetadataDraft14,
|
|
460
|
+
zJwtVcJsonLdCredentialIssuerMetadataDraft14,
|
|
461
|
+
zLdpVcCredentialIssuerMetadataDraft14,
|
|
462
|
+
zJwtVcJsonCredentialIssuerMetadataDraft14
|
|
398
463
|
];
|
|
399
464
|
var allCredentialIssuerMetadataFormatIdentifiers = allCredentialIssuerMetadataFormats.map(
|
|
400
465
|
(format) => format.shape.format.value
|
|
@@ -402,56 +467,69 @@ var allCredentialIssuerMetadataFormatIdentifiers = allCredentialIssuerMetadataFo
|
|
|
402
467
|
var zCredentialConfigurationSupportedWithFormats = zCredentialConfigurationSupportedCommon.transform(
|
|
403
468
|
(data, ctx) => {
|
|
404
469
|
if (!allCredentialIssuerMetadataFormatIdentifiers.includes(data.format)) return data;
|
|
405
|
-
const
|
|
470
|
+
const validators = allCredentialIssuerMetadataFormats.reduce(
|
|
471
|
+
(validators2, formatValidator) => {
|
|
472
|
+
const format = formatValidator.shape.format.value;
|
|
473
|
+
if (!validators2[format]) {
|
|
474
|
+
validators2[format] = [];
|
|
475
|
+
}
|
|
476
|
+
validators2[format].push(formatValidator);
|
|
477
|
+
return validators2;
|
|
478
|
+
},
|
|
479
|
+
{}
|
|
480
|
+
)[data.format];
|
|
481
|
+
const result = import_zod11.default.object({}).passthrough().and(
|
|
482
|
+
validators.length > 1 ? import_zod11.default.union(validators) : validators[0]
|
|
483
|
+
).safeParse(data);
|
|
406
484
|
if (result.success) {
|
|
407
485
|
return result.data;
|
|
408
486
|
}
|
|
409
487
|
for (const issue of result.error.issues) {
|
|
410
488
|
ctx.addIssue(issue);
|
|
411
489
|
}
|
|
412
|
-
return
|
|
490
|
+
return import_zod11.default.NEVER;
|
|
413
491
|
}
|
|
414
492
|
);
|
|
415
|
-
var zCredentialIssuerMetadataDisplayEntry =
|
|
416
|
-
name:
|
|
417
|
-
locale:
|
|
418
|
-
logo:
|
|
493
|
+
var zCredentialIssuerMetadataDisplayEntry = import_zod11.default.object({
|
|
494
|
+
name: import_zod11.default.string().optional(),
|
|
495
|
+
locale: import_zod11.default.string().optional(),
|
|
496
|
+
logo: import_zod11.default.object({
|
|
419
497
|
// FIXME: make required again, but need to support draft 11 first
|
|
420
|
-
uri:
|
|
421
|
-
alt_text:
|
|
498
|
+
uri: import_zod11.default.string().optional(),
|
|
499
|
+
alt_text: import_zod11.default.string().optional()
|
|
422
500
|
}).passthrough().optional()
|
|
423
501
|
}).passthrough();
|
|
424
|
-
var
|
|
502
|
+
var zCredentialIssuerMetadataDraft14Draft15 = import_zod11.default.object({
|
|
425
503
|
credential_issuer: import_utils2.zHttpsUrl,
|
|
426
|
-
authorization_servers:
|
|
504
|
+
authorization_servers: import_zod11.default.array(import_utils2.zHttpsUrl).optional(),
|
|
427
505
|
credential_endpoint: import_utils2.zHttpsUrl,
|
|
428
506
|
deferred_credential_endpoint: import_utils2.zHttpsUrl.optional(),
|
|
429
507
|
notification_endpoint: import_utils2.zHttpsUrl.optional(),
|
|
430
508
|
// Added after draft 14, but needed for proper
|
|
431
509
|
nonce_endpoint: import_utils2.zHttpsUrl.optional(),
|
|
432
|
-
credential_response_encryption:
|
|
433
|
-
alg_values_supported:
|
|
434
|
-
enc_values_supported:
|
|
435
|
-
encryption_required:
|
|
510
|
+
credential_response_encryption: import_zod11.default.object({
|
|
511
|
+
alg_values_supported: import_zod11.default.array(import_zod11.default.string()),
|
|
512
|
+
enc_values_supported: import_zod11.default.array(import_zod11.default.string()),
|
|
513
|
+
encryption_required: import_zod11.default.boolean()
|
|
436
514
|
}).passthrough().optional(),
|
|
437
|
-
batch_credential_issuance:
|
|
438
|
-
batch_size:
|
|
515
|
+
batch_credential_issuance: import_zod11.default.object({
|
|
516
|
+
batch_size: import_zod11.default.number().positive()
|
|
439
517
|
}).passthrough().optional(),
|
|
440
518
|
signed_metadata: import_oauth22.zCompactJwt.optional(),
|
|
441
|
-
display:
|
|
442
|
-
credential_configurations_supported:
|
|
519
|
+
display: import_zod11.default.array(zCredentialIssuerMetadataDisplayEntry).optional(),
|
|
520
|
+
credential_configurations_supported: import_zod11.default.record(import_zod11.default.string(), zCredentialConfigurationSupportedWithFormats)
|
|
443
521
|
}).passthrough();
|
|
444
|
-
var zCredentialConfigurationSupportedDraft11To14 =
|
|
445
|
-
id:
|
|
446
|
-
format:
|
|
447
|
-
cryptographic_suites_supported:
|
|
448
|
-
display:
|
|
449
|
-
|
|
450
|
-
logo:
|
|
451
|
-
url:
|
|
522
|
+
var zCredentialConfigurationSupportedDraft11To14 = import_zod11.default.object({
|
|
523
|
+
id: import_zod11.default.string().optional(),
|
|
524
|
+
format: import_zod11.default.string(),
|
|
525
|
+
cryptographic_suites_supported: import_zod11.default.array(import_zod11.default.string()).optional(),
|
|
526
|
+
display: import_zod11.default.array(
|
|
527
|
+
import_zod11.default.object({
|
|
528
|
+
logo: import_zod11.default.object({
|
|
529
|
+
url: import_zod11.default.string().url().optional()
|
|
452
530
|
}).passthrough().optional(),
|
|
453
|
-
background_image:
|
|
454
|
-
url:
|
|
531
|
+
background_image: import_zod11.default.object({
|
|
532
|
+
url: import_zod11.default.string().url().optional()
|
|
455
533
|
}).passthrough().optional()
|
|
456
534
|
}).passthrough()
|
|
457
535
|
).optional()
|
|
@@ -492,11 +570,11 @@ var zCredentialConfigurationSupportedDraft11To14 = import_zod9.default.object({
|
|
|
492
570
|
for (const issue of result.error.issues) {
|
|
493
571
|
ctx.addIssue(issue);
|
|
494
572
|
}
|
|
495
|
-
return
|
|
573
|
+
return import_zod11.default.NEVER;
|
|
496
574
|
}).pipe(zCredentialConfigurationSupportedWithFormats);
|
|
497
575
|
var zCredentialConfigurationSupportedDraft14To11 = zCredentialConfigurationSupportedWithFormats.and(
|
|
498
|
-
|
|
499
|
-
id:
|
|
576
|
+
import_zod11.default.object({
|
|
577
|
+
id: import_zod11.default.string()
|
|
500
578
|
}).passthrough()
|
|
501
579
|
).transform(({ id, credential_signing_alg_values_supported, display, proof_types_supported, scope, ...rest }) => ({
|
|
502
580
|
...rest,
|
|
@@ -516,15 +594,15 @@ var zCredentialConfigurationSupportedDraft14To11 = zCredentialConfigurationSuppo
|
|
|
516
594
|
} : {},
|
|
517
595
|
id
|
|
518
596
|
})).pipe(
|
|
519
|
-
|
|
597
|
+
import_zod11.default.union([
|
|
520
598
|
zLdpVcCredentialIssuerMetadataDraft14To11,
|
|
521
599
|
zJwtVcJsonCredentialIssuerMetadataDraft14To11,
|
|
522
600
|
zJwtVcJsonLdCredentialIssuerMetadataDraft14To11,
|
|
523
601
|
// To handle unrecognized formats and not error immediately we allow the common format as well
|
|
524
602
|
// but they can't use any of the foramt identifiers that have a specific transformation. This way if a format is
|
|
525
603
|
// has a transformation it NEEDS to use the format specific transformation, and otherwise we fall back to the common validation
|
|
526
|
-
|
|
527
|
-
format:
|
|
604
|
+
import_zod11.default.object({
|
|
605
|
+
format: import_zod11.default.string().refine(
|
|
528
606
|
(input) => ![
|
|
529
607
|
zLdpVcFormatIdentifier.value,
|
|
530
608
|
zJwtVcJsonFormatIdentifier.value,
|
|
@@ -534,11 +612,11 @@ var zCredentialConfigurationSupportedDraft14To11 = zCredentialConfigurationSuppo
|
|
|
534
612
|
}).passthrough()
|
|
535
613
|
])
|
|
536
614
|
);
|
|
537
|
-
var zCredentialIssuerMetadataDraft11To14 =
|
|
538
|
-
authorization_server:
|
|
539
|
-
credentials_supported:
|
|
540
|
-
|
|
541
|
-
id:
|
|
615
|
+
var zCredentialIssuerMetadataDraft11To14 = import_zod11.default.object({
|
|
616
|
+
authorization_server: import_zod11.default.string().optional(),
|
|
617
|
+
credentials_supported: import_zod11.default.array(
|
|
618
|
+
import_zod11.default.object({
|
|
619
|
+
id: import_zod11.default.string().optional()
|
|
542
620
|
}).passthrough()
|
|
543
621
|
)
|
|
544
622
|
}).passthrough().transform(({ authorization_server, credentials_supported, ...rest }) => {
|
|
@@ -551,12 +629,12 @@ var zCredentialIssuerMetadataDraft11To14 = import_zod9.default.object({
|
|
|
551
629
|
)
|
|
552
630
|
};
|
|
553
631
|
}).pipe(
|
|
554
|
-
|
|
632
|
+
import_zod11.default.object({
|
|
555
633
|
// Update from v11 structrue to v14 structure
|
|
556
|
-
credential_configurations_supported:
|
|
634
|
+
credential_configurations_supported: import_zod11.default.record(import_zod11.default.string(), zCredentialConfigurationSupportedDraft11To14)
|
|
557
635
|
}).passthrough()
|
|
558
|
-
).pipe(
|
|
559
|
-
var zCredentialIssuerMetadataWithDraft11 =
|
|
636
|
+
).pipe(zCredentialIssuerMetadataDraft14Draft15);
|
|
637
|
+
var zCredentialIssuerMetadataWithDraft11 = zCredentialIssuerMetadataDraft14Draft15.transform((issuerMetadata) => ({
|
|
560
638
|
...issuerMetadata,
|
|
561
639
|
...issuerMetadata.authorization_servers ? { authorization_server: issuerMetadata.authorization_servers[0] } : {},
|
|
562
640
|
credentials_supported: Object.entries(issuerMetadata.credential_configurations_supported).map(([id, value]) => ({
|
|
@@ -564,22 +642,35 @@ var zCredentialIssuerMetadataWithDraft11 = zCredentialIssuerMetadataDraft14.tran
|
|
|
564
642
|
id
|
|
565
643
|
}))
|
|
566
644
|
})).pipe(
|
|
567
|
-
|
|
568
|
-
credentials_supported:
|
|
645
|
+
zCredentialIssuerMetadataDraft14Draft15.extend({
|
|
646
|
+
credentials_supported: import_zod11.default.array(zCredentialConfigurationSupportedDraft14To11)
|
|
569
647
|
})
|
|
570
648
|
);
|
|
571
|
-
var zCredentialIssuerMetadata =
|
|
572
|
-
// First prioritize draft 14 (and 13)
|
|
573
|
-
|
|
649
|
+
var zCredentialIssuerMetadata = import_zod11.default.union([
|
|
650
|
+
// First prioritize draft 15/14 (and 13)
|
|
651
|
+
zCredentialIssuerMetadataDraft14Draft15,
|
|
574
652
|
// Then try parsing draft 11 and transform into draft 14
|
|
575
653
|
zCredentialIssuerMetadataDraft11To14
|
|
576
654
|
]);
|
|
577
|
-
var zCredentialIssuerMetadataWithDraftVersion =
|
|
578
|
-
|
|
579
|
-
|
|
580
|
-
|
|
581
|
-
|
|
582
|
-
|
|
655
|
+
var zCredentialIssuerMetadataWithDraftVersion = import_zod11.default.union([
|
|
656
|
+
zCredentialIssuerMetadataDraft14Draft15.transform((credentialIssuerMetadata) => {
|
|
657
|
+
const isDraft15 = Object.values(credentialIssuerMetadata.credential_configurations_supported).some(
|
|
658
|
+
(configuration) => {
|
|
659
|
+
const knownConfiguration = configuration;
|
|
660
|
+
if (knownConfiguration.format === zSdJwtDcFormatIdentifier.value) return true;
|
|
661
|
+
if (Array.isArray(knownConfiguration.claims)) return true;
|
|
662
|
+
if (Object.values(knownConfiguration.proof_types_supported ?? {}).some(
|
|
663
|
+
(proofType) => proofType.key_attestations_required !== void 0
|
|
664
|
+
))
|
|
665
|
+
return true;
|
|
666
|
+
return false;
|
|
667
|
+
}
|
|
668
|
+
);
|
|
669
|
+
return {
|
|
670
|
+
credentialIssuerMetadata,
|
|
671
|
+
originalDraftVersion: isDraft15 ? "Draft15" /* Draft15 */ : "Draft14" /* Draft14 */
|
|
672
|
+
};
|
|
673
|
+
}),
|
|
583
674
|
// Then try parsing draft 11 and transform into draft 14
|
|
584
675
|
zCredentialIssuerMetadataDraft11To14.transform((credentialIssuerMetadata) => ({
|
|
585
676
|
credentialIssuerMetadata,
|
|
@@ -606,6 +697,15 @@ function extractKnownCredentialConfigurationSupportedFormats(credentialConfigura
|
|
|
606
697
|
)
|
|
607
698
|
);
|
|
608
699
|
}
|
|
700
|
+
function getCredentialConfigurationSupportedById(credentialConfigurations, credentialConfigurationId) {
|
|
701
|
+
const configuration = credentialConfigurations[credentialConfigurationId];
|
|
702
|
+
if (!configuration) {
|
|
703
|
+
throw new import_oauth23.Oauth2Error(
|
|
704
|
+
`Credential configuration with id '${credentialConfigurationId}' not found in credential configurations supported.`
|
|
705
|
+
);
|
|
706
|
+
}
|
|
707
|
+
return configuration;
|
|
708
|
+
}
|
|
609
709
|
|
|
610
710
|
// src/credential-request/credential-request-configurations.ts
|
|
611
711
|
function getCredentialConfigurationsMatchingRequestFormat({
|
|
@@ -717,41 +817,41 @@ var import_utils7 = require("@openid4vc/utils");
|
|
|
717
817
|
// src/credential-offer/z-credential-offer.ts
|
|
718
818
|
var import_oauth25 = require("@openid4vc/oauth2");
|
|
719
819
|
var import_utils6 = require("@openid4vc/utils");
|
|
720
|
-
var
|
|
721
|
-
var zTxCode =
|
|
722
|
-
input_mode:
|
|
723
|
-
length:
|
|
724
|
-
description:
|
|
820
|
+
var import_zod12 = __toESM(require("zod"));
|
|
821
|
+
var zTxCode = import_zod12.default.object({
|
|
822
|
+
input_mode: import_zod12.default.union([import_zod12.default.literal("numeric"), import_zod12.default.literal("text")]).optional(),
|
|
823
|
+
length: import_zod12.default.number().int().optional(),
|
|
824
|
+
description: import_zod12.default.string().max(300).optional()
|
|
725
825
|
}).passthrough();
|
|
726
|
-
var zCredentialOfferGrants =
|
|
727
|
-
authorization_code:
|
|
728
|
-
issuer_state:
|
|
826
|
+
var zCredentialOfferGrants = import_zod12.default.object({
|
|
827
|
+
authorization_code: import_zod12.default.object({
|
|
828
|
+
issuer_state: import_zod12.default.string().optional(),
|
|
729
829
|
authorization_server: import_utils6.zHttpsUrl.optional()
|
|
730
830
|
}).passthrough().optional(),
|
|
731
|
-
[import_oauth25.preAuthorizedCodeGrantIdentifier]:
|
|
732
|
-
"pre-authorized_code":
|
|
831
|
+
[import_oauth25.preAuthorizedCodeGrantIdentifier]: import_zod12.default.object({
|
|
832
|
+
"pre-authorized_code": import_zod12.default.string(),
|
|
733
833
|
tx_code: zTxCode.optional(),
|
|
734
834
|
authorization_server: import_utils6.zHttpsUrl.optional()
|
|
735
835
|
}).passthrough().optional()
|
|
736
836
|
}).passthrough();
|
|
737
|
-
var zCredentialOfferObjectDraft14 =
|
|
837
|
+
var zCredentialOfferObjectDraft14 = import_zod12.default.object({
|
|
738
838
|
credential_issuer: import_utils6.zHttpsUrl,
|
|
739
|
-
credential_configuration_ids:
|
|
740
|
-
grants:
|
|
839
|
+
credential_configuration_ids: import_zod12.default.array(import_zod12.default.string()),
|
|
840
|
+
grants: import_zod12.default.optional(zCredentialOfferGrants)
|
|
741
841
|
}).passthrough();
|
|
742
|
-
var zCredentialOfferObjectDraft11To14 =
|
|
842
|
+
var zCredentialOfferObjectDraft11To14 = import_zod12.default.object({
|
|
743
843
|
credential_issuer: import_utils6.zHttpsUrl,
|
|
744
844
|
// We don't support the inline offer objects from draft 11
|
|
745
|
-
credentials:
|
|
746
|
-
|
|
845
|
+
credentials: import_zod12.default.array(
|
|
846
|
+
import_zod12.default.string({ message: "Only string credential identifiers are supported for draft 11 credential offers" })
|
|
747
847
|
),
|
|
748
|
-
grants:
|
|
749
|
-
|
|
848
|
+
grants: import_zod12.default.optional(
|
|
849
|
+
import_zod12.default.object({
|
|
750
850
|
// Has extra param in draft 14, but doesn't matter for transform purposes
|
|
751
851
|
authorization_code: zCredentialOfferGrants.shape.authorization_code,
|
|
752
|
-
[import_oauth25.preAuthorizedCodeGrantIdentifier]:
|
|
753
|
-
"pre-authorized_code":
|
|
754
|
-
user_pin_required:
|
|
852
|
+
[import_oauth25.preAuthorizedCodeGrantIdentifier]: import_zod12.default.object({
|
|
853
|
+
"pre-authorized_code": import_zod12.default.string(),
|
|
854
|
+
user_pin_required: import_zod12.default.optional(import_zod12.default.boolean())
|
|
755
855
|
}).passthrough().optional()
|
|
756
856
|
})
|
|
757
857
|
)
|
|
@@ -776,7 +876,7 @@ var zCredentialOfferObjectDraft11To14 = import_zod10.default.object({
|
|
|
776
876
|
}
|
|
777
877
|
return v14;
|
|
778
878
|
}).pipe(zCredentialOfferObjectDraft14);
|
|
779
|
-
var zCredentialOfferObject =
|
|
879
|
+
var zCredentialOfferObject = import_zod12.default.union([
|
|
780
880
|
// First prioritize draft 14 (and 13)
|
|
781
881
|
zCredentialOfferObjectDraft14,
|
|
782
882
|
// Then try parsing draft 11 and transform into draft 14
|
|
@@ -915,25 +1015,23 @@ async function createCredentialOffer(options) {
|
|
|
915
1015
|
// src/credential-request/format-payload.ts
|
|
916
1016
|
var import_utils8 = require("@openid4vc/utils");
|
|
917
1017
|
function getCredentialRequestFormatPayloadForCredentialConfigurationId(options) {
|
|
918
|
-
const credentialConfiguration =
|
|
919
|
-
|
|
920
|
-
|
|
921
|
-
|
|
922
|
-
|
|
923
|
-
}
|
|
924
|
-
if ((0, import_utils8.zIs)(zSdJwtVcCredentialIssuerMetadata, credentialConfiguration)) {
|
|
1018
|
+
const credentialConfiguration = getCredentialConfigurationSupportedById(
|
|
1019
|
+
options.issuerMetadata.credentialIssuer.credential_configurations_supported,
|
|
1020
|
+
options.credentialConfigurationId
|
|
1021
|
+
);
|
|
1022
|
+
if ((0, import_utils8.zIs)(zSdJwtVcCredentialIssuerMetadataDraft14, credentialConfiguration)) {
|
|
925
1023
|
return {
|
|
926
1024
|
format: credentialConfiguration.format,
|
|
927
1025
|
vct: credentialConfiguration.vct
|
|
928
1026
|
};
|
|
929
1027
|
}
|
|
930
|
-
if ((0, import_utils8.zIs)(zMsoMdocCredentialIssuerMetadata, credentialConfiguration)) {
|
|
1028
|
+
if ((0, import_utils8.zIs)(zMsoMdocCredentialIssuerMetadata, credentialConfiguration) || (0, import_utils8.zIs)(zMsoMdocCredentialIssuerMetadataDraft14, credentialConfiguration)) {
|
|
931
1029
|
return {
|
|
932
1030
|
format: credentialConfiguration.format,
|
|
933
1031
|
doctype: credentialConfiguration.doctype
|
|
934
1032
|
};
|
|
935
1033
|
}
|
|
936
|
-
if ((0, import_utils8.zIs)(zLdpVcCredentialIssuerMetadata, credentialConfiguration)) {
|
|
1034
|
+
if ((0, import_utils8.zIs)(zLdpVcCredentialIssuerMetadata, credentialConfiguration) || (0, import_utils8.zIs)(zLdpVcCredentialIssuerMetadataDraft14, credentialConfiguration)) {
|
|
937
1035
|
return {
|
|
938
1036
|
format: credentialConfiguration.format,
|
|
939
1037
|
credential_definition: {
|
|
@@ -942,7 +1040,7 @@ function getCredentialRequestFormatPayloadForCredentialConfigurationId(options)
|
|
|
942
1040
|
}
|
|
943
1041
|
};
|
|
944
1042
|
}
|
|
945
|
-
if ((0, import_utils8.zIs)(zJwtVcJsonLdCredentialIssuerMetadata, credentialConfiguration)) {
|
|
1043
|
+
if ((0, import_utils8.zIs)(zJwtVcJsonLdCredentialIssuerMetadata, credentialConfiguration) || (0, import_utils8.zIs)(zJwtVcJsonLdCredentialIssuerMetadataDraft14, credentialConfiguration)) {
|
|
946
1044
|
return {
|
|
947
1045
|
format: credentialConfiguration.format,
|
|
948
1046
|
credential_definition: {
|
|
@@ -951,7 +1049,7 @@ function getCredentialRequestFormatPayloadForCredentialConfigurationId(options)
|
|
|
951
1049
|
}
|
|
952
1050
|
};
|
|
953
1051
|
}
|
|
954
|
-
if ((0, import_utils8.zIs)(zJwtVcJsonCredentialIssuerMetadata, credentialConfiguration)) {
|
|
1052
|
+
if ((0, import_utils8.zIs)(zJwtVcJsonCredentialIssuerMetadata, credentialConfiguration) || (0, import_utils8.zIs)(zJwtVcJsonCredentialIssuerMetadataDraft14, credentialConfiguration)) {
|
|
955
1053
|
return {
|
|
956
1054
|
format: credentialConfiguration.format,
|
|
957
1055
|
credential_definition: {
|
|
@@ -959,6 +1057,11 @@ function getCredentialRequestFormatPayloadForCredentialConfigurationId(options)
|
|
|
959
1057
|
}
|
|
960
1058
|
};
|
|
961
1059
|
}
|
|
1060
|
+
if ((0, import_utils8.zIs)(zSdJwtDcCredentialIssuerMetadata, credentialConfiguration)) {
|
|
1061
|
+
throw new Openid4vciError(
|
|
1062
|
+
`Credential configuration id '${options.credentialConfigurationId}' with format ${zSdJwtVcFormatIdentifier.value} does not support credential request based on 'format'. Use 'credential_configuration_id' directly.`
|
|
1063
|
+
);
|
|
1064
|
+
}
|
|
962
1065
|
throw new Openid4vciError(
|
|
963
1066
|
`Unknown format '${credentialConfiguration.format}' in credential configuration with id '${options.credentialConfigurationId}' for credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}'`
|
|
964
1067
|
);
|
|
@@ -969,33 +1072,33 @@ var import_oauth210 = require("@openid4vc/oauth2");
|
|
|
969
1072
|
var import_utils10 = require("@openid4vc/utils");
|
|
970
1073
|
|
|
971
1074
|
// src/credential-request/z-credential-request.ts
|
|
972
|
-
var
|
|
1075
|
+
var import_zod16 = __toESM(require("zod"));
|
|
973
1076
|
|
|
974
1077
|
// src/credential-request/z-credential-request-common.ts
|
|
975
1078
|
var import_oauth29 = require("@openid4vc/oauth2");
|
|
976
|
-
var
|
|
1079
|
+
var import_zod15 = __toESM(require("zod"));
|
|
977
1080
|
|
|
978
1081
|
// src/formats/proof-type/jwt/z-jwt-proof-type.ts
|
|
979
1082
|
var import_oauth27 = require("@openid4vc/oauth2");
|
|
980
1083
|
var import_utils9 = require("@openid4vc/utils");
|
|
981
|
-
var
|
|
982
|
-
var zJwtProofTypeIdentifier =
|
|
1084
|
+
var import_zod13 = __toESM(require("zod"));
|
|
1085
|
+
var zJwtProofTypeIdentifier = import_zod13.default.literal("jwt");
|
|
983
1086
|
var jwtProofTypeIdentifier = zJwtProofTypeIdentifier.value;
|
|
984
|
-
var zCredentialRequestProofJwt =
|
|
1087
|
+
var zCredentialRequestProofJwt = import_zod13.default.object({
|
|
985
1088
|
proof_type: zJwtProofTypeIdentifier,
|
|
986
1089
|
jwt: import_oauth27.zCompactJwt
|
|
987
1090
|
});
|
|
988
1091
|
var zCredentialRequestJwtProofTypeHeader = import_oauth27.zJwtHeader.merge(
|
|
989
|
-
|
|
990
|
-
key_attestation:
|
|
991
|
-
typ:
|
|
1092
|
+
import_zod13.default.object({
|
|
1093
|
+
key_attestation: import_zod13.default.optional(import_oauth27.zCompactJwt),
|
|
1094
|
+
typ: import_zod13.default.literal("openid4vci-proof+jwt")
|
|
992
1095
|
})
|
|
993
1096
|
).passthrough().refine(({ kid, jwk }) => jwk === void 0 || kid === void 0, {
|
|
994
1097
|
message: `Both 'jwk' and 'kid' are defined. Only one is allowed`
|
|
995
1098
|
}).refine(({ trust_chain, kid }) => !trust_chain || !kid, {
|
|
996
1099
|
message: `When 'trust_chain' is provided, 'kid' is required`
|
|
997
1100
|
});
|
|
998
|
-
var zCredentialRequestJwtProofTypePayload =
|
|
1101
|
+
var zCredentialRequestJwtProofTypePayload = import_zod13.default.object({
|
|
999
1102
|
...import_oauth27.zJwtPayload.shape,
|
|
1000
1103
|
aud: import_utils9.zHttpsUrl,
|
|
1001
1104
|
iat: import_utils9.zInteger
|
|
@@ -1003,40 +1106,40 @@ var zCredentialRequestJwtProofTypePayload = import_zod11.default.object({
|
|
|
1003
1106
|
|
|
1004
1107
|
// src/formats/proof-type/attestation/z-attestation-proof-type.ts
|
|
1005
1108
|
var import_oauth28 = require("@openid4vc/oauth2");
|
|
1006
|
-
var
|
|
1007
|
-
var zAttestationProofTypeIdentifier =
|
|
1109
|
+
var import_zod14 = __toESM(require("zod"));
|
|
1110
|
+
var zAttestationProofTypeIdentifier = import_zod14.default.literal("attestation");
|
|
1008
1111
|
var attestationProofTypeIdentifier = zAttestationProofTypeIdentifier.value;
|
|
1009
|
-
var zCredentialRequestProofAttestation =
|
|
1112
|
+
var zCredentialRequestProofAttestation = import_zod14.default.object({
|
|
1010
1113
|
proof_type: zAttestationProofTypeIdentifier,
|
|
1011
1114
|
attestation: import_oauth28.zCompactJwt
|
|
1012
1115
|
});
|
|
1013
1116
|
var zCredentialRequestAttestationProofTypePayload = zKeyAttestationJwtPayloadForUse("proof_type.attestation");
|
|
1014
1117
|
|
|
1015
1118
|
// src/credential-request/z-credential-request-common.ts
|
|
1016
|
-
var zCredentialRequestProofCommon =
|
|
1017
|
-
proof_type:
|
|
1119
|
+
var zCredentialRequestProofCommon = import_zod15.default.object({
|
|
1120
|
+
proof_type: import_zod15.default.string()
|
|
1018
1121
|
}).passthrough();
|
|
1019
1122
|
var allCredentialRequestProofs = [zCredentialRequestProofJwt, zCredentialRequestProofAttestation];
|
|
1020
|
-
var zCredentialRequestProof =
|
|
1123
|
+
var zCredentialRequestProof = import_zod15.default.union([
|
|
1021
1124
|
zCredentialRequestProofCommon,
|
|
1022
|
-
|
|
1125
|
+
import_zod15.default.discriminatedUnion("proof_type", allCredentialRequestProofs)
|
|
1023
1126
|
]);
|
|
1024
|
-
var zCredentialRequestProofsCommon =
|
|
1025
|
-
var zCredentialRequestProofs =
|
|
1026
|
-
[zJwtProofTypeIdentifier.value]:
|
|
1027
|
-
[zAttestationProofTypeIdentifier.value]:
|
|
1127
|
+
var zCredentialRequestProofsCommon = import_zod15.default.record(import_zod15.default.string(), import_zod15.default.array(import_zod15.default.unknown()));
|
|
1128
|
+
var zCredentialRequestProofs = import_zod15.default.object({
|
|
1129
|
+
[zJwtProofTypeIdentifier.value]: import_zod15.default.optional(import_zod15.default.array(zCredentialRequestProofJwt.shape.jwt)),
|
|
1130
|
+
[zAttestationProofTypeIdentifier.value]: import_zod15.default.optional(import_zod15.default.array(zCredentialRequestProofAttestation.shape.attestation))
|
|
1028
1131
|
});
|
|
1029
|
-
var zCredentialRequestCommon =
|
|
1132
|
+
var zCredentialRequestCommon = import_zod15.default.object({
|
|
1030
1133
|
proof: zCredentialRequestProof.optional(),
|
|
1031
|
-
proofs:
|
|
1032
|
-
|
|
1134
|
+
proofs: import_zod15.default.optional(
|
|
1135
|
+
import_zod15.default.intersection(zCredentialRequestProofsCommon, zCredentialRequestProofs).refine((proofs) => Object.values(proofs).length === 1, {
|
|
1033
1136
|
message: `The 'proofs' object in a credential request should contain exactly one attribute`
|
|
1034
1137
|
})
|
|
1035
1138
|
),
|
|
1036
|
-
credential_response_encryption:
|
|
1139
|
+
credential_response_encryption: import_zod15.default.object({
|
|
1037
1140
|
jwk: import_oauth29.zJwk,
|
|
1038
|
-
alg:
|
|
1039
|
-
enc:
|
|
1141
|
+
alg: import_zod15.default.string(),
|
|
1142
|
+
enc: import_zod15.default.string()
|
|
1040
1143
|
}).passthrough().optional()
|
|
1041
1144
|
}).passthrough().refine(({ proof, proofs }) => !(proof !== void 0 && proofs !== void 0), {
|
|
1042
1145
|
message: `Both 'proof' and 'proofs' are defined. Only one is allowed`
|
|
@@ -1044,40 +1147,54 @@ var zCredentialRequestCommon = import_zod13.default.object({
|
|
|
1044
1147
|
|
|
1045
1148
|
// src/credential-request/z-credential-request.ts
|
|
1046
1149
|
var allCredentialRequestFormats = [
|
|
1047
|
-
|
|
1048
|
-
|
|
1049
|
-
|
|
1050
|
-
|
|
1051
|
-
|
|
1150
|
+
zSdJwtVcCredentialRequestFormatDraft14,
|
|
1151
|
+
zMsoMdocCredentialRequestFormatDraft14,
|
|
1152
|
+
zLdpVcCredentialRequestFormatDraft14,
|
|
1153
|
+
zJwtVcJsonLdCredentialRequestFormatDraft14,
|
|
1154
|
+
zJwtVcJsonCredentialRequestFormatDraft14
|
|
1052
1155
|
];
|
|
1053
1156
|
var allCredentialRequestFormatIdentifiers = allCredentialRequestFormats.map(
|
|
1054
1157
|
(format) => format.shape.format.value
|
|
1055
1158
|
);
|
|
1056
|
-
var
|
|
1057
|
-
|
|
1159
|
+
var zCredentialRequestCredentialConfigurationId = import_zod16.default.object({
|
|
1160
|
+
credential_configuration_id: import_zod16.default.string(),
|
|
1161
|
+
format: import_zod16.default.never({ message: "'format' cannot be defined when 'credential_configuration_id' is set." }).optional(),
|
|
1162
|
+
credential_identifier: import_zod16.default.never({ message: "'credential_identifier' cannot be defined when 'credential_configuration_id' is set." }).optional()
|
|
1163
|
+
});
|
|
1164
|
+
var zAuthorizationDetailsCredentialRequest = import_zod16.default.object({
|
|
1165
|
+
credential_identifier: import_zod16.default.string(),
|
|
1166
|
+
credential_configuration_id: import_zod16.default.never({ message: "'credential_configuration_id' cannot be defined when 'credential_identifier' is set." }).optional(),
|
|
1058
1167
|
// Cannot be present if credential identifier is present
|
|
1059
|
-
format:
|
|
1168
|
+
format: import_zod16.default.never({ message: "'format' cannot be defined when 'credential_identifier' is set." }).optional()
|
|
1060
1169
|
});
|
|
1061
|
-
var
|
|
1062
|
-
format:
|
|
1063
|
-
credential_identifier:
|
|
1170
|
+
var zCredentialRequestFormat = import_zod16.default.object({
|
|
1171
|
+
format: import_zod16.default.string(),
|
|
1172
|
+
credential_identifier: import_zod16.default.never({ message: "'credential_identifier' cannot be defined when 'format' is set." }).optional(),
|
|
1173
|
+
credential_configuration_id: import_zod16.default.never({ message: "'credential_configuration_id' cannot be defined when 'format' is set." }).optional()
|
|
1064
1174
|
}).passthrough();
|
|
1065
|
-
var zCredenialRequestDraft14WithFormat = zCredentialRequestCommon.and(
|
|
1066
|
-
if (!allCredentialRequestFormatIdentifiers.includes(
|
|
1067
|
-
|
|
1175
|
+
var zCredenialRequestDraft14WithFormat = zCredentialRequestCommon.and(zCredentialRequestFormat).transform((data, ctx) => {
|
|
1176
|
+
if (!allCredentialRequestFormatIdentifiers.includes(
|
|
1177
|
+
data.format
|
|
1178
|
+
))
|
|
1179
|
+
return data;
|
|
1180
|
+
const result = import_zod16.default.object({}).passthrough().and(import_zod16.default.discriminatedUnion("format", allCredentialRequestFormats)).safeParse(data);
|
|
1068
1181
|
if (result.success) {
|
|
1069
1182
|
return result.data;
|
|
1070
1183
|
}
|
|
1071
1184
|
for (const issue of result.error.issues) {
|
|
1072
1185
|
ctx.addIssue(issue);
|
|
1073
1186
|
}
|
|
1074
|
-
return
|
|
1187
|
+
return import_zod16.default.NEVER;
|
|
1075
1188
|
});
|
|
1076
|
-
var
|
|
1189
|
+
var zCredentialRequestDraft15 = import_zod16.default.union([
|
|
1190
|
+
zCredentialRequestCommon.and(zAuthorizationDetailsCredentialRequest),
|
|
1191
|
+
zCredentialRequestCommon.and(zCredentialRequestCredentialConfigurationId)
|
|
1192
|
+
]);
|
|
1193
|
+
var zCredentialRequestDraft14 = import_zod16.default.union([
|
|
1077
1194
|
zCredenialRequestDraft14WithFormat,
|
|
1078
1195
|
zCredentialRequestCommon.and(zAuthorizationDetailsCredentialRequest)
|
|
1079
1196
|
]);
|
|
1080
|
-
var zCredentialRequestDraft11To14 = zCredentialRequestCommon.and(
|
|
1197
|
+
var zCredentialRequestDraft11To14 = zCredentialRequestCommon.and(zCredentialRequestFormat).transform((data, ctx) => {
|
|
1081
1198
|
const formatSpecificTransformations = {
|
|
1082
1199
|
[zLdpVcFormatIdentifier.value]: zLdpVcCredentialRequestDraft11To14,
|
|
1083
1200
|
[zJwtVcJsonFormatIdentifier.value]: zJwtVcJsonCredentialRequestDraft11To14,
|
|
@@ -1090,7 +1207,7 @@ var zCredentialRequestDraft11To14 = zCredentialRequestCommon.and(zCredentialRequ
|
|
|
1090
1207
|
for (const issue of result.error.issues) {
|
|
1091
1208
|
ctx.addIssue(issue);
|
|
1092
1209
|
}
|
|
1093
|
-
return
|
|
1210
|
+
return import_zod16.default.NEVER;
|
|
1094
1211
|
}).pipe(zCredentialRequestDraft14);
|
|
1095
1212
|
var zCredentialRequestDraft14To11 = zCredentialRequestDraft14.refine(
|
|
1096
1213
|
(data) => data.credential_identifier === void 0,
|
|
@@ -1108,15 +1225,19 @@ var zCredentialRequestDraft14To11 = zCredentialRequestDraft14.refine(
|
|
|
1108
1225
|
for (const issue of result.error.issues) {
|
|
1109
1226
|
ctx.addIssue(issue);
|
|
1110
1227
|
}
|
|
1111
|
-
return
|
|
1228
|
+
return import_zod16.default.NEVER;
|
|
1112
1229
|
});
|
|
1113
|
-
var zCredentialRequest =
|
|
1230
|
+
var zCredentialRequest = import_zod16.default.union([
|
|
1231
|
+
zCredentialRequestDraft15,
|
|
1232
|
+
zCredentialRequestDraft14,
|
|
1233
|
+
zCredentialRequestDraft11To14
|
|
1234
|
+
]);
|
|
1114
1235
|
|
|
1115
1236
|
// src/credential-request/z-credential-response.ts
|
|
1116
|
-
var
|
|
1237
|
+
var import_zod18 = __toESM(require("zod"));
|
|
1117
1238
|
|
|
1118
1239
|
// ../oauth2/src/common/z-oauth2-error.ts
|
|
1119
|
-
var
|
|
1240
|
+
var import_zod17 = __toESM(require("zod"));
|
|
1120
1241
|
var Oauth2ErrorCodes = /* @__PURE__ */ ((Oauth2ErrorCodes4) => {
|
|
1121
1242
|
Oauth2ErrorCodes4["ServerError"] = "server_error";
|
|
1122
1243
|
Oauth2ErrorCodes4["InvalidTarget"] = "invalid_target";
|
|
@@ -1153,21 +1274,21 @@ var Oauth2ErrorCodes = /* @__PURE__ */ ((Oauth2ErrorCodes4) => {
|
|
|
1153
1274
|
Oauth2ErrorCodes4["WalletUnavailable"] = "wallet_unavailable";
|
|
1154
1275
|
return Oauth2ErrorCodes4;
|
|
1155
1276
|
})(Oauth2ErrorCodes || {});
|
|
1156
|
-
var zOauth2ErrorResponse =
|
|
1157
|
-
error:
|
|
1158
|
-
error_description:
|
|
1159
|
-
error_uri:
|
|
1277
|
+
var zOauth2ErrorResponse = import_zod17.default.object({
|
|
1278
|
+
error: import_zod17.default.union([import_zod17.default.nativeEnum(Oauth2ErrorCodes), import_zod17.default.string()]),
|
|
1279
|
+
error_description: import_zod17.default.string().optional(),
|
|
1280
|
+
error_uri: import_zod17.default.string().optional()
|
|
1160
1281
|
}).passthrough();
|
|
1161
1282
|
|
|
1162
1283
|
// src/credential-request/z-credential-response.ts
|
|
1163
|
-
var zCredentialEncoding =
|
|
1164
|
-
var zCredentialResponse =
|
|
1165
|
-
credential:
|
|
1166
|
-
credentials:
|
|
1167
|
-
transaction_id:
|
|
1168
|
-
c_nonce:
|
|
1169
|
-
c_nonce_expires_in:
|
|
1170
|
-
notification_id:
|
|
1284
|
+
var zCredentialEncoding = import_zod18.default.union([import_zod18.default.string(), import_zod18.default.record(import_zod18.default.string(), import_zod18.default.any())]);
|
|
1285
|
+
var zCredentialResponse = import_zod18.default.object({
|
|
1286
|
+
credential: import_zod18.default.optional(zCredentialEncoding),
|
|
1287
|
+
credentials: import_zod18.default.optional(import_zod18.default.array(zCredentialEncoding)),
|
|
1288
|
+
transaction_id: import_zod18.default.string().optional(),
|
|
1289
|
+
c_nonce: import_zod18.default.string().optional(),
|
|
1290
|
+
c_nonce_expires_in: import_zod18.default.number().int().optional(),
|
|
1291
|
+
notification_id: import_zod18.default.string().optional()
|
|
1171
1292
|
}).passthrough().refine(
|
|
1172
1293
|
(value) => {
|
|
1173
1294
|
const { credential, credentials, transaction_id } = value;
|
|
@@ -1177,14 +1298,43 @@ var zCredentialResponse = import_zod16.default.object({
|
|
|
1177
1298
|
message: `Exactly one of 'credential', 'credentials', or 'transaction_id' MUST be defined.`
|
|
1178
1299
|
}
|
|
1179
1300
|
);
|
|
1180
|
-
var zCredentialErrorResponse =
|
|
1301
|
+
var zCredentialErrorResponse = import_zod18.default.object({
|
|
1181
1302
|
...zOauth2ErrorResponse.shape,
|
|
1182
|
-
c_nonce:
|
|
1183
|
-
c_nonce_expires_in:
|
|
1303
|
+
c_nonce: import_zod18.default.string().optional(),
|
|
1304
|
+
c_nonce_expires_in: import_zod18.default.number().int().optional()
|
|
1184
1305
|
}).passthrough();
|
|
1185
1306
|
|
|
1186
1307
|
// src/credential-request/retrieve-credentials.ts
|
|
1308
|
+
async function retrieveCredentialsWithCredentialConfigurationId(options) {
|
|
1309
|
+
if (options.issuerMetadata.originalDraftVersion !== "Draft15" /* Draft15 */) {
|
|
1310
|
+
throw new Openid4vciError(
|
|
1311
|
+
"Requesting credentials based on format is not supported in OpenID4VCI below draft 15. Make sure to provide the format and format specific claims in the request."
|
|
1312
|
+
);
|
|
1313
|
+
}
|
|
1314
|
+
getCredentialConfigurationSupportedById(
|
|
1315
|
+
options.issuerMetadata.credentialIssuer.credential_configurations_supported,
|
|
1316
|
+
options.credentialConfigurationId
|
|
1317
|
+
);
|
|
1318
|
+
const credentialRequest = {
|
|
1319
|
+
...options.additionalRequestPayload,
|
|
1320
|
+
credential_configuration_id: options.credentialConfigurationId,
|
|
1321
|
+
proof: options.proof,
|
|
1322
|
+
proofs: options.proofs
|
|
1323
|
+
};
|
|
1324
|
+
return retrieveCredentials({
|
|
1325
|
+
callbacks: options.callbacks,
|
|
1326
|
+
credentialRequest,
|
|
1327
|
+
issuerMetadata: options.issuerMetadata,
|
|
1328
|
+
accessToken: options.accessToken,
|
|
1329
|
+
dpop: options.dpop
|
|
1330
|
+
});
|
|
1331
|
+
}
|
|
1187
1332
|
async function retrieveCredentialsWithFormat(options) {
|
|
1333
|
+
if (options.issuerMetadata.originalDraftVersion === "Draft15" /* Draft15 */) {
|
|
1334
|
+
throw new Openid4vciError(
|
|
1335
|
+
"Requesting credentials based on format is not supported in OpenID4VCI draft 15. Provide the credential configuration id directly in the request."
|
|
1336
|
+
);
|
|
1337
|
+
}
|
|
1188
1338
|
const credentialRequest = {
|
|
1189
1339
|
...options.formatPayload,
|
|
1190
1340
|
...options.additionalRequestPayload,
|
|
@@ -1270,6 +1420,24 @@ var import_utils12 = require("@openid4vc/utils");
|
|
|
1270
1420
|
var import_oauth211 = require("@openid4vc/oauth2");
|
|
1271
1421
|
var import_oauth212 = require("@openid4vc/oauth2");
|
|
1272
1422
|
var import_utils11 = require("@openid4vc/utils");
|
|
1423
|
+
async function createKeyAttestationJwt(options) {
|
|
1424
|
+
const header = (0, import_utils11.parseWithErrorHandling)(zKeyAttestationJwtHeader, {
|
|
1425
|
+
...(0, import_oauth211.jwtHeaderFromJwtSigner)(options.signer),
|
|
1426
|
+
typ: "keyattestation+jwt"
|
|
1427
|
+
});
|
|
1428
|
+
const payload = (0, import_utils11.parseWithErrorHandling)(zKeyAttestationJwtPayloadForUse(options.use), {
|
|
1429
|
+
iat: (0, import_utils11.dateToSeconds)(options.issuedAt),
|
|
1430
|
+
exp: options.expiresAt ? (0, import_utils11.dateToSeconds)(options.expiresAt) : void 0,
|
|
1431
|
+
nonce: options.nonce,
|
|
1432
|
+
attested_keys: options.attestedKeys,
|
|
1433
|
+
user_authentication: options.userAuthentication,
|
|
1434
|
+
key_storage: options.keyStorage,
|
|
1435
|
+
certification: options.certification,
|
|
1436
|
+
...options.additionalPayload
|
|
1437
|
+
});
|
|
1438
|
+
const { jwt } = await options.callbacks.signJwt(options.signer, { header, payload });
|
|
1439
|
+
return jwt;
|
|
1440
|
+
}
|
|
1273
1441
|
async function verifyKeyAttestationJwt(options) {
|
|
1274
1442
|
const { header, payload } = (0, import_oauth211.decodeJwt)({
|
|
1275
1443
|
jwt: options.keyAttestationJwt,
|
|
@@ -1425,10 +1593,10 @@ var import_utils15 = require("@openid4vc/utils");
|
|
|
1425
1593
|
|
|
1426
1594
|
// src/nonce/z-nonce.ts
|
|
1427
1595
|
var import_utils14 = require("@openid4vc/utils");
|
|
1428
|
-
var
|
|
1429
|
-
var zNonceResponse =
|
|
1430
|
-
c_nonce:
|
|
1431
|
-
c_nonce_expires_in:
|
|
1596
|
+
var import_zod19 = __toESM(require("zod"));
|
|
1597
|
+
var zNonceResponse = import_zod19.default.object({
|
|
1598
|
+
c_nonce: import_zod19.default.string(),
|
|
1599
|
+
c_nonce_expires_in: import_zod19.default.optional(import_utils14.zInteger)
|
|
1432
1600
|
}).passthrough();
|
|
1433
1601
|
|
|
1434
1602
|
// src/nonce/nonce-request.ts
|
|
@@ -1468,15 +1636,15 @@ var import_oauth217 = require("@openid4vc/oauth2");
|
|
|
1468
1636
|
var import_utils16 = require("@openid4vc/utils");
|
|
1469
1637
|
|
|
1470
1638
|
// src/notification/z-notification.ts
|
|
1471
|
-
var
|
|
1472
|
-
var zNotificationEvent =
|
|
1473
|
-
var zNotificationRequest =
|
|
1474
|
-
notification_id:
|
|
1639
|
+
var import_zod20 = __toESM(require("zod"));
|
|
1640
|
+
var zNotificationEvent = import_zod20.default.enum(["credential_accepted", "credential_failure", "credential_deleted"]);
|
|
1641
|
+
var zNotificationRequest = import_zod20.default.object({
|
|
1642
|
+
notification_id: import_zod20.default.string(),
|
|
1475
1643
|
event: zNotificationEvent,
|
|
1476
|
-
event_description:
|
|
1644
|
+
event_description: import_zod20.default.optional(import_zod20.default.string())
|
|
1477
1645
|
}).passthrough();
|
|
1478
|
-
var zNotificationErrorResponse =
|
|
1479
|
-
error:
|
|
1646
|
+
var zNotificationErrorResponse = import_zod20.default.object({
|
|
1647
|
+
error: import_zod20.default.enum(["invalid_notification_id", "invalid_notification_request"])
|
|
1480
1648
|
}).passthrough();
|
|
1481
1649
|
|
|
1482
1650
|
// src/notification/notification.ts
|
|
@@ -1619,7 +1787,6 @@ var Openid4vciClient = class {
|
|
|
1619
1787
|
issuer_state: options.credentialOffer?.grants?.authorization_code?.issuer_state
|
|
1620
1788
|
},
|
|
1621
1789
|
dpop: options.dpop,
|
|
1622
|
-
clientAttestation: options.clientAttestation,
|
|
1623
1790
|
resource: options.issuerMetadata.credentialIssuer.credential_issuer,
|
|
1624
1791
|
authorizationServerMetadata
|
|
1625
1792
|
});
|
|
@@ -1673,7 +1840,6 @@ var Openid4vciClient = class {
|
|
|
1673
1840
|
redirectUri: options.redirectUri,
|
|
1674
1841
|
scope: options.scope,
|
|
1675
1842
|
pkceCodeVerifier: options.pkceCodeVerifier,
|
|
1676
|
-
clientAttestation: options.clientAttestation,
|
|
1677
1843
|
dpop: options.dpop
|
|
1678
1844
|
});
|
|
1679
1845
|
return {
|
|
@@ -1692,8 +1858,7 @@ var Openid4vciClient = class {
|
|
|
1692
1858
|
issuerMetadata,
|
|
1693
1859
|
additionalRequestPayload,
|
|
1694
1860
|
txCode,
|
|
1695
|
-
dpop
|
|
1696
|
-
clientAttestation
|
|
1861
|
+
dpop
|
|
1697
1862
|
}) {
|
|
1698
1863
|
if (!credentialOffer.grants?.[import_oauth218.preAuthorizedCodeGrantIdentifier]) {
|
|
1699
1864
|
throw new import_oauth218.Oauth2Error(`The credential offer does not contain the '${import_oauth218.preAuthorizedCodeGrantIdentifier}' grant.`);
|
|
@@ -1718,8 +1883,7 @@ var Openid4vciClient = class {
|
|
|
1718
1883
|
txCode,
|
|
1719
1884
|
resource: issuerMetadata.credentialIssuer.credential_issuer,
|
|
1720
1885
|
additionalRequestPayload,
|
|
1721
|
-
dpop
|
|
1722
|
-
clientAttestation
|
|
1886
|
+
dpop
|
|
1723
1887
|
});
|
|
1724
1888
|
return {
|
|
1725
1889
|
...result,
|
|
@@ -1737,8 +1901,7 @@ var Openid4vciClient = class {
|
|
|
1737
1901
|
authorizationCode,
|
|
1738
1902
|
pkceCodeVerifier,
|
|
1739
1903
|
redirectUri,
|
|
1740
|
-
dpop
|
|
1741
|
-
clientAttestation
|
|
1904
|
+
dpop
|
|
1742
1905
|
}) {
|
|
1743
1906
|
if (!credentialOffer.grants?.[import_oauth218.authorizationCodeGrantIdentifier]) {
|
|
1744
1907
|
throw new import_oauth218.Oauth2Error(`The credential offer does not contain the '${import_oauth218.authorizationCodeGrantIdentifier}' grant.`);
|
|
@@ -1757,7 +1920,6 @@ var Openid4vciClient = class {
|
|
|
1757
1920
|
pkceCodeVerifier,
|
|
1758
1921
|
additionalRequestPayload,
|
|
1759
1922
|
dpop,
|
|
1760
|
-
clientAttestation,
|
|
1761
1923
|
redirectUri,
|
|
1762
1924
|
resource: issuerMetadata.credentialIssuer.credential_issuer
|
|
1763
1925
|
});
|
|
@@ -1835,20 +1997,34 @@ var Openid4vciClient = class {
|
|
|
1835
1997
|
accessToken,
|
|
1836
1998
|
dpop
|
|
1837
1999
|
}) {
|
|
1838
|
-
|
|
1839
|
-
|
|
1840
|
-
|
|
1841
|
-
|
|
1842
|
-
|
|
1843
|
-
|
|
1844
|
-
|
|
1845
|
-
|
|
1846
|
-
|
|
1847
|
-
|
|
1848
|
-
|
|
1849
|
-
|
|
1850
|
-
|
|
1851
|
-
|
|
2000
|
+
let credentialResponse;
|
|
2001
|
+
if (issuerMetadata.originalDraftVersion === "Draft15" /* Draft15 */) {
|
|
2002
|
+
credentialResponse = await retrieveCredentialsWithCredentialConfigurationId({
|
|
2003
|
+
accessToken,
|
|
2004
|
+
credentialConfigurationId,
|
|
2005
|
+
issuerMetadata,
|
|
2006
|
+
additionalRequestPayload,
|
|
2007
|
+
proof,
|
|
2008
|
+
proofs,
|
|
2009
|
+
callbacks: this.options.callbacks,
|
|
2010
|
+
dpop
|
|
2011
|
+
});
|
|
2012
|
+
} else {
|
|
2013
|
+
const formatPayload = getCredentialRequestFormatPayloadForCredentialConfigurationId({
|
|
2014
|
+
credentialConfigurationId,
|
|
2015
|
+
issuerMetadata
|
|
2016
|
+
});
|
|
2017
|
+
credentialResponse = await retrieveCredentialsWithFormat({
|
|
2018
|
+
accessToken,
|
|
2019
|
+
formatPayload,
|
|
2020
|
+
issuerMetadata,
|
|
2021
|
+
additionalRequestPayload,
|
|
2022
|
+
proof,
|
|
2023
|
+
proofs,
|
|
2024
|
+
callbacks: this.options.callbacks,
|
|
2025
|
+
dpop
|
|
2026
|
+
});
|
|
2027
|
+
}
|
|
1852
2028
|
if (!credentialResponse.ok) {
|
|
1853
2029
|
throw new Openid4vciRetrieveCredentialsError(
|
|
1854
2030
|
`Error retrieving credentials from '${issuerMetadata.credentialIssuer.credential_issuer}'`,
|
|
@@ -1910,7 +2086,7 @@ function createCredentialResponse(options) {
|
|
|
1910
2086
|
|
|
1911
2087
|
// src/credential-request/parse-credential-request.ts
|
|
1912
2088
|
var import_utils18 = require("@openid4vc/utils");
|
|
1913
|
-
var
|
|
2089
|
+
var import_zod21 = __toESM(require("zod"));
|
|
1914
2090
|
function parseCredentialRequest(options) {
|
|
1915
2091
|
const credentialRequest = (0, import_utils18.parseWithErrorHandling)(
|
|
1916
2092
|
zCredentialRequest,
|
|
@@ -1922,12 +2098,27 @@ function parseCredentialRequest(options) {
|
|
|
1922
2098
|
if (knownProofs.success) {
|
|
1923
2099
|
proofs = knownProofs.data;
|
|
1924
2100
|
}
|
|
1925
|
-
const knownProof =
|
|
2101
|
+
const knownProof = import_zod21.default.union(allCredentialRequestProofs).safeParse(credentialRequest.proof);
|
|
1926
2102
|
if (knownProof.success && knownProof.data.proof_type === jwtProofTypeIdentifier) {
|
|
1927
2103
|
proofs = { [jwtProofTypeIdentifier]: [knownProof.data.jwt] };
|
|
1928
2104
|
} else if (knownProof.success && knownProof.data.proof_type === attestationProofTypeIdentifier) {
|
|
1929
2105
|
proofs = { [attestationProofTypeIdentifier]: [knownProof.data.attestation] };
|
|
1930
2106
|
}
|
|
2107
|
+
if (credentialRequest.credential_configuration_id) {
|
|
2108
|
+
getCredentialConfigurationSupportedById(
|
|
2109
|
+
options.issuerMetadata.credentialIssuer.credential_configurations_supported,
|
|
2110
|
+
credentialRequest.credential_configuration_id
|
|
2111
|
+
);
|
|
2112
|
+
const credentialConfigurations = extractKnownCredentialConfigurationSupportedFormats(
|
|
2113
|
+
options.issuerMetadata.credentialIssuer.credential_configurations_supported
|
|
2114
|
+
);
|
|
2115
|
+
return {
|
|
2116
|
+
credentialConfiguration: credentialConfigurations[credentialRequest.credential_configuration_id],
|
|
2117
|
+
credentialConfigurationId: credentialRequest.credential_configuration_id,
|
|
2118
|
+
credentialRequest,
|
|
2119
|
+
proofs
|
|
2120
|
+
};
|
|
2121
|
+
}
|
|
1931
2122
|
if (credentialRequest.credential_identifier) {
|
|
1932
2123
|
return {
|
|
1933
2124
|
credentialIdentifier: credentialRequest.credential_identifier,
|
|
@@ -1935,11 +2126,13 @@ function parseCredentialRequest(options) {
|
|
|
1935
2126
|
proofs
|
|
1936
2127
|
};
|
|
1937
2128
|
}
|
|
1938
|
-
if (credentialRequest.format && allCredentialRequestFormatIdentifiers.includes(
|
|
2129
|
+
if (credentialRequest.format && allCredentialRequestFormatIdentifiers.includes(
|
|
2130
|
+
credentialRequest.format
|
|
2131
|
+
)) {
|
|
1939
2132
|
return {
|
|
1940
2133
|
// Removes all claims that are not specific to this format
|
|
1941
2134
|
format: (0, import_utils18.parseWithErrorHandling)(
|
|
1942
|
-
|
|
2135
|
+
import_zod21.default.union(allCredentialRequestFormats),
|
|
1943
2136
|
credentialRequest,
|
|
1944
2137
|
"Unable to validate format specific properties from credential request"
|
|
1945
2138
|
),
|
|
@@ -2091,6 +2284,40 @@ var Openid4vciIssuer = class {
|
|
|
2091
2284
|
createNonceResponse(options) {
|
|
2092
2285
|
return createNonceResponse(options);
|
|
2093
2286
|
}
|
|
2287
|
+
async verifyWalletAttestation(options) {
|
|
2288
|
+
return new import_oauth219.Oauth2AuthorizationServer({
|
|
2289
|
+
callbacks: this.options.callbacks
|
|
2290
|
+
}).verifyClientAttestation(options);
|
|
2291
|
+
}
|
|
2292
|
+
};
|
|
2293
|
+
|
|
2294
|
+
// src/Openid4vciWalletProvider.ts
|
|
2295
|
+
var import_oauth220 = require("@openid4vc/oauth2");
|
|
2296
|
+
var Openid4vciWalletProvider = class {
|
|
2297
|
+
constructor(options) {
|
|
2298
|
+
this.options = options;
|
|
2299
|
+
}
|
|
2300
|
+
async createWalletAttestationJwt(options) {
|
|
2301
|
+
const additionalPayload = options.additionalPayload ? {
|
|
2302
|
+
wallet_name: options.walletName,
|
|
2303
|
+
wallet_link: options.walletLink,
|
|
2304
|
+
...options.additionalPayload
|
|
2305
|
+
} : {
|
|
2306
|
+
wallet_name: options.walletName,
|
|
2307
|
+
wallet_link: options.walletLink
|
|
2308
|
+
};
|
|
2309
|
+
return await (0, import_oauth220.createClientAttestationJwt)({
|
|
2310
|
+
...options,
|
|
2311
|
+
callbacks: this.options.callbacks,
|
|
2312
|
+
additionalPayload
|
|
2313
|
+
});
|
|
2314
|
+
}
|
|
2315
|
+
async createKeyAttestationJwt(options) {
|
|
2316
|
+
return await createKeyAttestationJwt({
|
|
2317
|
+
callbacks: this.options.callbacks,
|
|
2318
|
+
...options
|
|
2319
|
+
});
|
|
2320
|
+
}
|
|
2094
2321
|
};
|
|
2095
2322
|
// Annotate the CommonJS export names for ESM import in node:
|
|
2096
2323
|
0 && (module.exports = {
|
|
@@ -2101,6 +2328,7 @@ var Openid4vciIssuer = class {
|
|
|
2101
2328
|
Openid4vciIssuer,
|
|
2102
2329
|
Openid4vciRetrieveCredentialsError,
|
|
2103
2330
|
Openid4vciSendNotificationError,
|
|
2331
|
+
Openid4vciWalletProvider,
|
|
2104
2332
|
credentialsSupportedToCredentialConfigurationsSupported,
|
|
2105
2333
|
extractScopesForCredentialConfigurationIds,
|
|
2106
2334
|
getCredentialConfigurationsMatchingRequestFormat,
|