@openid4vc/openid4vci 0.3.0-alpha-20250324183425 → 0.3.0-alpha-20250325212250
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.mts +17553 -10748
- package/dist/index.d.ts +17553 -10748
- package/dist/index.js +530 -302
- package/dist/index.js.map +1 -1
- package/dist/index.mjs +532 -302
- package/dist/index.mjs.map +1 -1
- package/package.json +3 -3
package/dist/index.mjs
CHANGED
|
@@ -11,117 +11,81 @@ import { joinUriParts } from "@openid4vc/utils";
|
|
|
11
11
|
// src/metadata/credential-issuer/z-credential-issuer-metadata.ts
|
|
12
12
|
import { zCompactJwt } from "@openid4vc/oauth2";
|
|
13
13
|
import { zHttpsUrl } from "@openid4vc/utils";
|
|
14
|
-
import
|
|
14
|
+
import z11 from "zod";
|
|
15
15
|
|
|
16
16
|
// src/formats/credential/mso-mdoc/z-mso-mdoc.ts
|
|
17
|
-
import z3 from "zod";
|
|
18
|
-
|
|
19
|
-
// src/metadata/credential-issuer/z-credential-configuration-supported-common.ts
|
|
20
17
|
import z2 from "zod";
|
|
21
18
|
|
|
22
|
-
// src/
|
|
23
|
-
import { zJwk, zJwtHeader, zJwtPayload } from "@openid4vc/oauth2";
|
|
24
|
-
import { zInteger } from "@openid4vc/utils";
|
|
19
|
+
// src/metadata/credential-issuer/z-claims-description.ts
|
|
25
20
|
import z from "zod";
|
|
26
|
-
var
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
message: `When 'trust_chain' is provided, 'kid' is required`
|
|
33
|
-
});
|
|
34
|
-
var zIso18045 = z.enum(["iso_18045_high", "iso_18045_moderate", "iso_18045_enhanced-basic", "iso_18045_basic"]);
|
|
35
|
-
var zIso18045OrStringArray = z.array(z.union([zIso18045, z.string()]));
|
|
36
|
-
var zKeyAttestationJwtPayload = z.object({
|
|
37
|
-
...zJwtPayload.shape,
|
|
38
|
-
iat: zInteger,
|
|
39
|
-
attested_keys: z.array(zJwk),
|
|
40
|
-
key_storage: z.optional(zIso18045OrStringArray),
|
|
41
|
-
user_authentication: z.optional(zIso18045OrStringArray),
|
|
42
|
-
certification: z.optional(z.string())
|
|
43
|
-
}).passthrough();
|
|
44
|
-
var zKeyAttestationJwtPayloadForUse = (use) => z.object({
|
|
45
|
-
...zKeyAttestationJwtPayload.shape,
|
|
46
|
-
// REQUIRED when used as proof_type.attesation directly
|
|
47
|
-
nonce: use === "proof_type.attestation" ? z.string({
|
|
48
|
-
message: `Nonce must be defined when key attestation is used as 'proof_type.attestation' directly`
|
|
49
|
-
}) : z.optional(z.string()),
|
|
50
|
-
// REQUIRED when used within header of proof_type.jwt
|
|
51
|
-
exp: use === "proof_type.jwt" ? zInteger : z.optional(zInteger)
|
|
52
|
-
}).passthrough();
|
|
53
|
-
|
|
54
|
-
// src/metadata/credential-issuer/z-credential-configuration-supported-common.ts
|
|
55
|
-
var zCredentialConfigurationSupportedClaims = z2.object({
|
|
56
|
-
mandatory: z2.boolean().optional(),
|
|
57
|
-
value_type: z2.string().optional(),
|
|
58
|
-
display: z2.object({
|
|
59
|
-
name: z2.string().optional(),
|
|
60
|
-
locale: z2.string().optional()
|
|
21
|
+
var zCredentialConfigurationSupportedClaimsDraft14 = z.object({
|
|
22
|
+
mandatory: z.boolean().optional(),
|
|
23
|
+
value_type: z.string().optional(),
|
|
24
|
+
display: z.object({
|
|
25
|
+
name: z.string().optional(),
|
|
26
|
+
locale: z.string().optional()
|
|
61
27
|
}).passthrough().optional()
|
|
62
28
|
}).passthrough();
|
|
63
|
-
var
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
user_authentication: zIso18045OrStringArray.optional()
|
|
75
|
-
}).passthrough().optional()
|
|
76
|
-
})
|
|
77
|
-
).optional(),
|
|
78
|
-
display: z2.array(
|
|
79
|
-
z2.object({
|
|
80
|
-
name: z2.string(),
|
|
81
|
-
locale: z2.string().optional(),
|
|
82
|
-
logo: z2.object({
|
|
83
|
-
// FIXME: make required again, but need to support draft 11 first
|
|
84
|
-
uri: z2.string().optional(),
|
|
85
|
-
alt_text: z2.string().optional()
|
|
86
|
-
}).passthrough().optional(),
|
|
87
|
-
description: z2.string().optional(),
|
|
88
|
-
background_color: z2.string().optional(),
|
|
89
|
-
background_image: z2.object({
|
|
90
|
-
// TODO: should be required, but paradym's metadata is wrong here.
|
|
91
|
-
uri: z2.string().optional()
|
|
92
|
-
}).passthrough().optional(),
|
|
93
|
-
text_color: z2.string().optional()
|
|
29
|
+
var zClaimsDescriptionPath = z.array(z.union([z.string(), z.number().int().nonnegative(), z.null()])).nonempty();
|
|
30
|
+
var zMsoMdocClaimsDescriptionPath = z.tuple([z.string(), z.string()], {
|
|
31
|
+
message: "mso_mdoc claims description path MUST be an array with exactly two string elements, pointing to the namespace and element identifier within an mdoc credential"
|
|
32
|
+
});
|
|
33
|
+
var zIssuerMetadataClaimsDescription = z.object({
|
|
34
|
+
path: zClaimsDescriptionPath,
|
|
35
|
+
mandatory: z.boolean().optional(),
|
|
36
|
+
display: z.array(
|
|
37
|
+
z.object({
|
|
38
|
+
name: z.string().optional(),
|
|
39
|
+
locale: z.string().optional()
|
|
94
40
|
}).passthrough()
|
|
95
41
|
).optional()
|
|
96
42
|
}).passthrough();
|
|
43
|
+
var zMsoMdocIssuerMetadataClaimsDescription = zIssuerMetadataClaimsDescription.extend({
|
|
44
|
+
path: zMsoMdocClaimsDescriptionPath
|
|
45
|
+
});
|
|
97
46
|
|
|
98
47
|
// src/formats/credential/mso-mdoc/z-mso-mdoc.ts
|
|
99
|
-
var zMsoMdocFormatIdentifier =
|
|
100
|
-
var zMsoMdocCredentialIssuerMetadata =
|
|
48
|
+
var zMsoMdocFormatIdentifier = z2.literal("mso_mdoc");
|
|
49
|
+
var zMsoMdocCredentialIssuerMetadata = z2.object({
|
|
101
50
|
format: zMsoMdocFormatIdentifier,
|
|
102
|
-
doctype:
|
|
103
|
-
claims:
|
|
104
|
-
order: z3.optional(z3.array(z3.string()))
|
|
51
|
+
doctype: z2.string(),
|
|
52
|
+
claims: z2.array(zMsoMdocIssuerMetadataClaimsDescription).optional()
|
|
105
53
|
});
|
|
106
|
-
var
|
|
54
|
+
var zMsoMdocCredentialIssuerMetadataDraft14 = z2.object({
|
|
107
55
|
format: zMsoMdocFormatIdentifier,
|
|
108
|
-
doctype:
|
|
109
|
-
claims:
|
|
56
|
+
doctype: z2.string(),
|
|
57
|
+
claims: zCredentialConfigurationSupportedClaimsDraft14.optional(),
|
|
58
|
+
order: z2.optional(z2.array(z2.string()))
|
|
59
|
+
});
|
|
60
|
+
var zMsoMdocCredentialRequestFormatDraft14 = z2.object({
|
|
61
|
+
format: zMsoMdocFormatIdentifier,
|
|
62
|
+
doctype: z2.string(),
|
|
63
|
+
// Format based request is removed in Draft 15, so only old claims syntax supported.
|
|
64
|
+
claims: z2.optional(zCredentialConfigurationSupportedClaimsDraft14)
|
|
110
65
|
});
|
|
111
66
|
|
|
112
67
|
// src/formats/credential/sd-jwt-vc/z-sd-jwt-vc.ts
|
|
113
|
-
import
|
|
114
|
-
var zSdJwtVcFormatIdentifier =
|
|
115
|
-
var
|
|
116
|
-
vct:
|
|
68
|
+
import z3 from "zod";
|
|
69
|
+
var zSdJwtVcFormatIdentifier = z3.literal("vc+sd-jwt");
|
|
70
|
+
var zSdJwtVcCredentialIssuerMetadataDraft14 = z3.object({
|
|
71
|
+
vct: z3.string(),
|
|
117
72
|
format: zSdJwtVcFormatIdentifier,
|
|
118
|
-
claims:
|
|
119
|
-
order:
|
|
73
|
+
claims: z3.optional(zCredentialConfigurationSupportedClaimsDraft14),
|
|
74
|
+
order: z3.optional(z3.array(z3.string()))
|
|
120
75
|
});
|
|
121
|
-
var
|
|
76
|
+
var zSdJwtVcCredentialRequestFormatDraft14 = z3.object({
|
|
122
77
|
format: zSdJwtVcFormatIdentifier,
|
|
78
|
+
vct: z3.string(),
|
|
79
|
+
claims: z3.optional(zCredentialConfigurationSupportedClaimsDraft14)
|
|
80
|
+
});
|
|
81
|
+
|
|
82
|
+
// src/formats/credential/sd-jwt-dc/z-sd-jwt-dc.ts
|
|
83
|
+
import z4 from "zod";
|
|
84
|
+
var zSdJwtDcFormatIdentifier = z4.literal("dc+sd-jwt");
|
|
85
|
+
var zSdJwtDcCredentialIssuerMetadata = z4.object({
|
|
123
86
|
vct: z4.string(),
|
|
124
|
-
|
|
87
|
+
format: zSdJwtDcFormatIdentifier,
|
|
88
|
+
claims: z4.array(zIssuerMetadataClaimsDescription).optional()
|
|
125
89
|
});
|
|
126
90
|
|
|
127
91
|
// src/formats/credential/w3c-vc/z-w3c-ldp-vc.ts
|
|
@@ -129,7 +93,7 @@ import z6 from "zod";
|
|
|
129
93
|
|
|
130
94
|
// src/formats/credential/w3c-vc/z-w3c-vc-common.ts
|
|
131
95
|
import z5 from "zod";
|
|
132
|
-
var
|
|
96
|
+
var zCredentialSubjectLeafTypeDraft14 = z5.object({
|
|
133
97
|
mandatory: z5.boolean().optional(),
|
|
134
98
|
value_type: z5.string().optional(),
|
|
135
99
|
display: z5.array(
|
|
@@ -139,19 +103,30 @@ var zCredentialSubjectLeafType = z5.object({
|
|
|
139
103
|
}).passthrough()
|
|
140
104
|
).optional()
|
|
141
105
|
}).passthrough();
|
|
142
|
-
var
|
|
143
|
-
|
|
106
|
+
var zClaimValueSchemaDraft14 = z5.union([
|
|
107
|
+
z5.array(z5.any()),
|
|
108
|
+
z5.record(z5.string(), z5.any()),
|
|
109
|
+
zCredentialSubjectLeafTypeDraft14
|
|
110
|
+
]);
|
|
111
|
+
var zW3cVcCredentialSubjectDraft14 = z5.record(z5.string(), zClaimValueSchemaDraft14);
|
|
144
112
|
var zW3cVcJsonLdCredentialDefinition = z5.object({
|
|
145
113
|
"@context": z5.array(z5.string()),
|
|
146
|
-
type: z5.array(z5.string())
|
|
147
|
-
credentialSubject: zW3cVcCredentialSubject.optional()
|
|
114
|
+
type: z5.array(z5.string())
|
|
148
115
|
}).passthrough();
|
|
116
|
+
var zW3cVcJsonLdCredentialDefinitionDraft14 = zW3cVcJsonLdCredentialDefinition.extend({
|
|
117
|
+
credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
|
|
118
|
+
});
|
|
149
119
|
|
|
150
120
|
// src/formats/credential/w3c-vc/z-w3c-ldp-vc.ts
|
|
151
121
|
var zLdpVcFormatIdentifier = z6.literal("ldp_vc");
|
|
152
122
|
var zLdpVcCredentialIssuerMetadata = z6.object({
|
|
153
123
|
format: zLdpVcFormatIdentifier,
|
|
154
124
|
credential_definition: zW3cVcJsonLdCredentialDefinition,
|
|
125
|
+
claims: zIssuerMetadataClaimsDescription.optional()
|
|
126
|
+
});
|
|
127
|
+
var zLdpVcCredentialIssuerMetadataDraft14 = z6.object({
|
|
128
|
+
format: zLdpVcFormatIdentifier,
|
|
129
|
+
credential_definition: zW3cVcJsonLdCredentialDefinitionDraft14,
|
|
155
130
|
order: z6.array(z6.string()).optional()
|
|
156
131
|
});
|
|
157
132
|
var zLdpVcCredentialIssuerMetadataDraft11 = z6.object({
|
|
@@ -161,7 +136,7 @@ var zLdpVcCredentialIssuerMetadataDraft11 = z6.object({
|
|
|
161
136
|
// As well as using types instead of type
|
|
162
137
|
"@context": z6.array(z6.string()),
|
|
163
138
|
types: z6.array(z6.string()),
|
|
164
|
-
credentialSubject:
|
|
139
|
+
credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
|
|
165
140
|
}).passthrough();
|
|
166
141
|
var zLdpVcCredentialIssuerMetadataDraft11To14 = zLdpVcCredentialIssuerMetadataDraft11.transform(
|
|
167
142
|
({ "@context": context, types, credentialSubject, ...rest }) => ({
|
|
@@ -174,14 +149,14 @@ var zLdpVcCredentialIssuerMetadataDraft11To14 = zLdpVcCredentialIssuerMetadataDr
|
|
|
174
149
|
}
|
|
175
150
|
})
|
|
176
151
|
);
|
|
177
|
-
var zLdpVcCredentialIssuerMetadataDraft14To11 =
|
|
152
|
+
var zLdpVcCredentialIssuerMetadataDraft14To11 = zLdpVcCredentialIssuerMetadataDraft14.passthrough().transform(({ credential_definition: { type, ...credentialDefinition }, ...rest }) => ({
|
|
178
153
|
...rest,
|
|
179
154
|
...credentialDefinition,
|
|
180
155
|
types: type
|
|
181
156
|
})).pipe(zLdpVcCredentialIssuerMetadataDraft11);
|
|
182
|
-
var
|
|
157
|
+
var zLdpVcCredentialRequestFormatDraft14 = z6.object({
|
|
183
158
|
format: zLdpVcFormatIdentifier,
|
|
184
|
-
credential_definition:
|
|
159
|
+
credential_definition: zW3cVcJsonLdCredentialDefinitionDraft14
|
|
185
160
|
});
|
|
186
161
|
var zLdpVcCredentialRequestDraft11 = z6.object({
|
|
187
162
|
format: zLdpVcFormatIdentifier,
|
|
@@ -189,7 +164,7 @@ var zLdpVcCredentialRequestDraft11 = z6.object({
|
|
|
189
164
|
"@context": z6.array(z6.string()),
|
|
190
165
|
// credential_definition was using types instead of type in v11
|
|
191
166
|
types: z6.array(z6.string()),
|
|
192
|
-
credentialSubject:
|
|
167
|
+
credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
|
|
193
168
|
})
|
|
194
169
|
}).passthrough();
|
|
195
170
|
var zLdpVcCredentialRequestDraft11To14 = zLdpVcCredentialRequestDraft11.transform(
|
|
@@ -201,7 +176,7 @@ var zLdpVcCredentialRequestDraft11To14 = zLdpVcCredentialRequestDraft11.transfor
|
|
|
201
176
|
}
|
|
202
177
|
})
|
|
203
178
|
);
|
|
204
|
-
var zLdpVcCredentialRequestDraft14To11 =
|
|
179
|
+
var zLdpVcCredentialRequestDraft14To11 = zLdpVcCredentialRequestFormatDraft14.passthrough().transform(({ credential_definition: { type, ...restCredentialDefinition }, ...rest }) => ({
|
|
205
180
|
...rest,
|
|
206
181
|
credential_definition: {
|
|
207
182
|
...restCredentialDefinition,
|
|
@@ -215,6 +190,11 @@ var zJwtVcJsonLdFormatIdentifier = z7.literal("jwt_vc_json-ld");
|
|
|
215
190
|
var zJwtVcJsonLdCredentialIssuerMetadata = z7.object({
|
|
216
191
|
format: zJwtVcJsonLdFormatIdentifier,
|
|
217
192
|
credential_definition: zW3cVcJsonLdCredentialDefinition,
|
|
193
|
+
claims: zIssuerMetadataClaimsDescription.optional()
|
|
194
|
+
});
|
|
195
|
+
var zJwtVcJsonLdCredentialIssuerMetadataDraft14 = z7.object({
|
|
196
|
+
format: zJwtVcJsonLdFormatIdentifier,
|
|
197
|
+
credential_definition: zW3cVcJsonLdCredentialDefinitionDraft14,
|
|
218
198
|
order: z7.optional(z7.array(z7.string()))
|
|
219
199
|
});
|
|
220
200
|
var zJwtVcJsonLdCredentialIssuerMetadataDraft11 = z7.object({
|
|
@@ -224,7 +204,7 @@ var zJwtVcJsonLdCredentialIssuerMetadataDraft11 = z7.object({
|
|
|
224
204
|
// As well as using types instead of type
|
|
225
205
|
"@context": z7.array(z7.string()),
|
|
226
206
|
types: z7.array(z7.string()),
|
|
227
|
-
credentialSubject:
|
|
207
|
+
credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
|
|
228
208
|
}).passthrough();
|
|
229
209
|
var zJwtVcJsonLdCredentialIssuerMetadataDraft11To14 = zJwtVcJsonLdCredentialIssuerMetadataDraft11.transform(
|
|
230
210
|
({ "@context": context, types, credentialSubject, ...rest }) => ({
|
|
@@ -237,12 +217,12 @@ var zJwtVcJsonLdCredentialIssuerMetadataDraft11To14 = zJwtVcJsonLdCredentialIssu
|
|
|
237
217
|
}
|
|
238
218
|
})
|
|
239
219
|
);
|
|
240
|
-
var zJwtVcJsonLdCredentialIssuerMetadataDraft14To11 =
|
|
220
|
+
var zJwtVcJsonLdCredentialIssuerMetadataDraft14To11 = zJwtVcJsonLdCredentialIssuerMetadataDraft14.passthrough().transform(({ credential_definition: { type, ...credentialDefinition }, ...rest }) => ({
|
|
241
221
|
...rest,
|
|
242
222
|
...credentialDefinition,
|
|
243
223
|
types: type
|
|
244
224
|
})).pipe(zJwtVcJsonLdCredentialIssuerMetadataDraft11);
|
|
245
|
-
var
|
|
225
|
+
var zJwtVcJsonLdCredentialRequestFormatDraft14 = z7.object({
|
|
246
226
|
format: zJwtVcJsonLdFormatIdentifier,
|
|
247
227
|
credential_definition: zW3cVcJsonLdCredentialDefinition
|
|
248
228
|
});
|
|
@@ -252,7 +232,7 @@ var zJwtVcJsonLdCredentialRequestDraft11 = z7.object({
|
|
|
252
232
|
"@context": z7.array(z7.string()),
|
|
253
233
|
// credential_definition was using types instead of type in v11
|
|
254
234
|
types: z7.array(z7.string()),
|
|
255
|
-
credentialSubject: z7.optional(
|
|
235
|
+
credentialSubject: z7.optional(zW3cVcCredentialSubjectDraft14)
|
|
256
236
|
}).passthrough()
|
|
257
237
|
}).passthrough();
|
|
258
238
|
var zJwtVcJsonLdCredentialRequestDraft11To14 = zJwtVcJsonLdCredentialRequestDraft11.transform(
|
|
@@ -264,7 +244,7 @@ var zJwtVcJsonLdCredentialRequestDraft11To14 = zJwtVcJsonLdCredentialRequestDraf
|
|
|
264
244
|
}
|
|
265
245
|
})
|
|
266
246
|
);
|
|
267
|
-
var zJwtVcJsonLdCredentialRequestDraft14To11 =
|
|
247
|
+
var zJwtVcJsonLdCredentialRequestDraft14To11 = zJwtVcJsonLdCredentialRequestFormatDraft14.passthrough().transform(({ credential_definition: { type, ...restCredentialDefinition }, ...rest }) => ({
|
|
268
248
|
...rest,
|
|
269
249
|
credential_definition: {
|
|
270
250
|
...restCredentialDefinition,
|
|
@@ -276,12 +256,19 @@ var zJwtVcJsonLdCredentialRequestDraft14To11 = zJwtVcJsonLdCredentialRequestForm
|
|
|
276
256
|
import z8 from "zod";
|
|
277
257
|
var zJwtVcJsonFormatIdentifier = z8.literal("jwt_vc_json");
|
|
278
258
|
var zJwtVcJsonCredentialDefinition = z8.object({
|
|
279
|
-
type: z8.array(z8.string())
|
|
280
|
-
credentialSubject: zW3cVcCredentialSubject.optional()
|
|
259
|
+
type: z8.array(z8.string())
|
|
281
260
|
}).passthrough();
|
|
261
|
+
var zJwtVcJsonCredentialDefinitionDraft14 = zJwtVcJsonCredentialDefinition.extend({
|
|
262
|
+
credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
|
|
263
|
+
});
|
|
282
264
|
var zJwtVcJsonCredentialIssuerMetadata = z8.object({
|
|
283
265
|
format: zJwtVcJsonFormatIdentifier,
|
|
284
266
|
credential_definition: zJwtVcJsonCredentialDefinition,
|
|
267
|
+
claims: zIssuerMetadataClaimsDescription.optional()
|
|
268
|
+
});
|
|
269
|
+
var zJwtVcJsonCredentialIssuerMetadataDraft14 = z8.object({
|
|
270
|
+
format: zJwtVcJsonFormatIdentifier,
|
|
271
|
+
credential_definition: zJwtVcJsonCredentialDefinitionDraft14,
|
|
285
272
|
order: z8.array(z8.string()).optional()
|
|
286
273
|
});
|
|
287
274
|
var zJwtVcJsonCredentialIssuerMetadataDraft11 = z8.object({
|
|
@@ -290,7 +277,7 @@ var zJwtVcJsonCredentialIssuerMetadataDraft11 = z8.object({
|
|
|
290
277
|
// Credential definition was spread on top level instead of a separatey property in v11
|
|
291
278
|
// As well as using types instead of type
|
|
292
279
|
types: z8.array(z8.string()),
|
|
293
|
-
credentialSubject:
|
|
280
|
+
credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
|
|
294
281
|
}).passthrough();
|
|
295
282
|
var zJwtVcJsonCredentialIssuerMetadataDraft11To14 = zJwtVcJsonCredentialIssuerMetadataDraft11.transform(
|
|
296
283
|
({ types, credentialSubject, ...rest }) => ({
|
|
@@ -302,12 +289,12 @@ var zJwtVcJsonCredentialIssuerMetadataDraft11To14 = zJwtVcJsonCredentialIssuerMe
|
|
|
302
289
|
}
|
|
303
290
|
})
|
|
304
291
|
);
|
|
305
|
-
var zJwtVcJsonCredentialIssuerMetadataDraft14To11 =
|
|
292
|
+
var zJwtVcJsonCredentialIssuerMetadataDraft14To11 = zJwtVcJsonCredentialIssuerMetadataDraft14.passthrough().transform(({ credential_definition: { type, ...credentialDefinition }, ...rest }) => ({
|
|
306
293
|
...rest,
|
|
307
294
|
types: type,
|
|
308
295
|
...credentialDefinition
|
|
309
296
|
})).pipe(zJwtVcJsonCredentialIssuerMetadataDraft11);
|
|
310
|
-
var
|
|
297
|
+
var zJwtVcJsonCredentialRequestFormatDraft14 = z8.object({
|
|
311
298
|
format: zJwtVcJsonFormatIdentifier,
|
|
312
299
|
credential_definition: zJwtVcJsonCredentialDefinition
|
|
313
300
|
});
|
|
@@ -316,7 +303,7 @@ var zJwtVcJsonCredentialRequestDraft11 = z8.object({
|
|
|
316
303
|
// Credential definition was spread on top level instead of a separatey property in v11
|
|
317
304
|
// As well as using types instead of type
|
|
318
305
|
types: z8.array(z8.string()),
|
|
319
|
-
credentialSubject: z8.optional(
|
|
306
|
+
credentialSubject: z8.optional(zW3cVcCredentialSubjectDraft14)
|
|
320
307
|
}).passthrough();
|
|
321
308
|
var zJwtVcJsonCredentialRequestDraft11To14 = zJwtVcJsonCredentialRequestDraft11.transform(
|
|
322
309
|
({ types, credentialSubject, ...rest }) => {
|
|
@@ -330,7 +317,7 @@ var zJwtVcJsonCredentialRequestDraft11To14 = zJwtVcJsonCredentialRequestDraft11.
|
|
|
330
317
|
};
|
|
331
318
|
}
|
|
332
319
|
);
|
|
333
|
-
var zJwtVcJsonCredentialRequestDraft14To11 =
|
|
320
|
+
var zJwtVcJsonCredentialRequestDraft14To11 = zJwtVcJsonCredentialRequestFormatDraft14.passthrough().transform(({ credential_definition: { type, ...credentialDefinition }, ...rest }) => ({
|
|
334
321
|
...rest,
|
|
335
322
|
types: type,
|
|
336
323
|
...credentialDefinition
|
|
@@ -338,18 +325,95 @@ var zJwtVcJsonCredentialRequestDraft14To11 = zJwtVcJsonCredentialRequestFormat.p
|
|
|
338
325
|
|
|
339
326
|
// src/version.ts
|
|
340
327
|
var Openid4vciDraftVersion = /* @__PURE__ */ ((Openid4vciDraftVersion2) => {
|
|
328
|
+
Openid4vciDraftVersion2["Draft15"] = "Draft15";
|
|
341
329
|
Openid4vciDraftVersion2["Draft14"] = "Draft14";
|
|
342
330
|
Openid4vciDraftVersion2["Draft11"] = "Draft11";
|
|
343
331
|
return Openid4vciDraftVersion2;
|
|
344
332
|
})(Openid4vciDraftVersion || {});
|
|
345
333
|
|
|
334
|
+
// src/metadata/credential-issuer/z-credential-configuration-supported-common.ts
|
|
335
|
+
import z10 from "zod";
|
|
336
|
+
|
|
337
|
+
// src/key-attestation/z-key-attestation.ts
|
|
338
|
+
import { zJwk, zJwtHeader, zJwtPayload } from "@openid4vc/oauth2";
|
|
339
|
+
import { zInteger } from "@openid4vc/utils";
|
|
340
|
+
import z9 from "zod";
|
|
341
|
+
var zKeyAttestationJwtHeader = z9.object({
|
|
342
|
+
...zJwtHeader.shape,
|
|
343
|
+
typ: z9.literal("keyattestation+jwt")
|
|
344
|
+
}).passthrough().refine(({ kid, jwk }) => jwk === void 0 || kid === void 0, {
|
|
345
|
+
message: `Both 'jwk' and 'kid' are defined. Only one is allowed`
|
|
346
|
+
}).refine(({ trust_chain, kid }) => !trust_chain || !kid, {
|
|
347
|
+
message: `When 'trust_chain' is provided, 'kid' is required`
|
|
348
|
+
});
|
|
349
|
+
var zIso18045 = z9.enum(["iso_18045_high", "iso_18045_moderate", "iso_18045_enhanced-basic", "iso_18045_basic"]);
|
|
350
|
+
var zIso18045OrStringArray = z9.array(z9.union([zIso18045, z9.string()]));
|
|
351
|
+
var zKeyAttestationJwtPayload = z9.object({
|
|
352
|
+
...zJwtPayload.shape,
|
|
353
|
+
iat: zInteger,
|
|
354
|
+
attested_keys: z9.array(zJwk),
|
|
355
|
+
key_storage: z9.optional(zIso18045OrStringArray),
|
|
356
|
+
user_authentication: z9.optional(zIso18045OrStringArray),
|
|
357
|
+
certification: z9.optional(z9.string().url())
|
|
358
|
+
}).passthrough();
|
|
359
|
+
var zKeyAttestationJwtPayloadForUse = (use) => z9.object({
|
|
360
|
+
...zKeyAttestationJwtPayload.shape,
|
|
361
|
+
// REQUIRED when used as proof_type.attesation directly
|
|
362
|
+
nonce: use === "proof_type.attestation" ? z9.string({
|
|
363
|
+
message: `Nonce must be defined when key attestation is used as 'proof_type.attestation' directly`
|
|
364
|
+
}) : z9.optional(z9.string()),
|
|
365
|
+
// REQUIRED when used within header of proof_type.jwt
|
|
366
|
+
exp: use === "proof_type.jwt" ? zInteger : z9.optional(zInteger)
|
|
367
|
+
}).passthrough();
|
|
368
|
+
|
|
369
|
+
// src/metadata/credential-issuer/z-credential-configuration-supported-common.ts
|
|
370
|
+
var zCredentialConfigurationSupportedCommon = z10.object({
|
|
371
|
+
format: z10.string(),
|
|
372
|
+
scope: z10.string().optional(),
|
|
373
|
+
cryptographic_binding_methods_supported: z10.array(z10.string()).optional(),
|
|
374
|
+
credential_signing_alg_values_supported: z10.array(z10.string()).optional(),
|
|
375
|
+
proof_types_supported: z10.record(
|
|
376
|
+
z10.union([z10.literal("jwt"), z10.literal("attestation"), z10.string()]),
|
|
377
|
+
z10.object({
|
|
378
|
+
proof_signing_alg_values_supported: z10.array(z10.string()),
|
|
379
|
+
key_attestations_required: z10.object({
|
|
380
|
+
key_storage: zIso18045OrStringArray.optional(),
|
|
381
|
+
user_authentication: zIso18045OrStringArray.optional()
|
|
382
|
+
}).passthrough().optional()
|
|
383
|
+
})
|
|
384
|
+
).optional(),
|
|
385
|
+
display: z10.array(
|
|
386
|
+
z10.object({
|
|
387
|
+
name: z10.string(),
|
|
388
|
+
locale: z10.string().optional(),
|
|
389
|
+
logo: z10.object({
|
|
390
|
+
// FIXME: make required again, but need to support draft 11 first
|
|
391
|
+
uri: z10.string().optional(),
|
|
392
|
+
alt_text: z10.string().optional()
|
|
393
|
+
}).passthrough().optional(),
|
|
394
|
+
description: z10.string().optional(),
|
|
395
|
+
background_color: z10.string().optional(),
|
|
396
|
+
background_image: z10.object({
|
|
397
|
+
// TODO: should be required, but paradym's metadata is wrong here.
|
|
398
|
+
uri: z10.string().optional()
|
|
399
|
+
}).passthrough().optional(),
|
|
400
|
+
text_color: z10.string().optional()
|
|
401
|
+
}).passthrough()
|
|
402
|
+
).optional()
|
|
403
|
+
}).passthrough();
|
|
404
|
+
|
|
346
405
|
// src/metadata/credential-issuer/z-credential-issuer-metadata.ts
|
|
347
406
|
var allCredentialIssuerMetadataFormats = [
|
|
348
|
-
|
|
407
|
+
zSdJwtDcCredentialIssuerMetadata,
|
|
349
408
|
zMsoMdocCredentialIssuerMetadata,
|
|
350
409
|
zJwtVcJsonLdCredentialIssuerMetadata,
|
|
351
410
|
zLdpVcCredentialIssuerMetadata,
|
|
352
|
-
zJwtVcJsonCredentialIssuerMetadata
|
|
411
|
+
zJwtVcJsonCredentialIssuerMetadata,
|
|
412
|
+
zMsoMdocCredentialIssuerMetadataDraft14,
|
|
413
|
+
zSdJwtVcCredentialIssuerMetadataDraft14,
|
|
414
|
+
zJwtVcJsonLdCredentialIssuerMetadataDraft14,
|
|
415
|
+
zLdpVcCredentialIssuerMetadataDraft14,
|
|
416
|
+
zJwtVcJsonCredentialIssuerMetadataDraft14
|
|
353
417
|
];
|
|
354
418
|
var allCredentialIssuerMetadataFormatIdentifiers = allCredentialIssuerMetadataFormats.map(
|
|
355
419
|
(format) => format.shape.format.value
|
|
@@ -357,56 +421,69 @@ var allCredentialIssuerMetadataFormatIdentifiers = allCredentialIssuerMetadataFo
|
|
|
357
421
|
var zCredentialConfigurationSupportedWithFormats = zCredentialConfigurationSupportedCommon.transform(
|
|
358
422
|
(data, ctx) => {
|
|
359
423
|
if (!allCredentialIssuerMetadataFormatIdentifiers.includes(data.format)) return data;
|
|
360
|
-
const
|
|
424
|
+
const validators = allCredentialIssuerMetadataFormats.reduce(
|
|
425
|
+
(validators2, formatValidator) => {
|
|
426
|
+
const format = formatValidator.shape.format.value;
|
|
427
|
+
if (!validators2[format]) {
|
|
428
|
+
validators2[format] = [];
|
|
429
|
+
}
|
|
430
|
+
validators2[format].push(formatValidator);
|
|
431
|
+
return validators2;
|
|
432
|
+
},
|
|
433
|
+
{}
|
|
434
|
+
)[data.format];
|
|
435
|
+
const result = z11.object({}).passthrough().and(
|
|
436
|
+
validators.length > 1 ? z11.union(validators) : validators[0]
|
|
437
|
+
).safeParse(data);
|
|
361
438
|
if (result.success) {
|
|
362
439
|
return result.data;
|
|
363
440
|
}
|
|
364
441
|
for (const issue of result.error.issues) {
|
|
365
442
|
ctx.addIssue(issue);
|
|
366
443
|
}
|
|
367
|
-
return
|
|
444
|
+
return z11.NEVER;
|
|
368
445
|
}
|
|
369
446
|
);
|
|
370
|
-
var zCredentialIssuerMetadataDisplayEntry =
|
|
371
|
-
name:
|
|
372
|
-
locale:
|
|
373
|
-
logo:
|
|
447
|
+
var zCredentialIssuerMetadataDisplayEntry = z11.object({
|
|
448
|
+
name: z11.string().optional(),
|
|
449
|
+
locale: z11.string().optional(),
|
|
450
|
+
logo: z11.object({
|
|
374
451
|
// FIXME: make required again, but need to support draft 11 first
|
|
375
|
-
uri:
|
|
376
|
-
alt_text:
|
|
452
|
+
uri: z11.string().optional(),
|
|
453
|
+
alt_text: z11.string().optional()
|
|
377
454
|
}).passthrough().optional()
|
|
378
455
|
}).passthrough();
|
|
379
|
-
var
|
|
456
|
+
var zCredentialIssuerMetadataDraft14Draft15 = z11.object({
|
|
380
457
|
credential_issuer: zHttpsUrl,
|
|
381
|
-
authorization_servers:
|
|
458
|
+
authorization_servers: z11.array(zHttpsUrl).optional(),
|
|
382
459
|
credential_endpoint: zHttpsUrl,
|
|
383
460
|
deferred_credential_endpoint: zHttpsUrl.optional(),
|
|
384
461
|
notification_endpoint: zHttpsUrl.optional(),
|
|
385
462
|
// Added after draft 14, but needed for proper
|
|
386
463
|
nonce_endpoint: zHttpsUrl.optional(),
|
|
387
|
-
credential_response_encryption:
|
|
388
|
-
alg_values_supported:
|
|
389
|
-
enc_values_supported:
|
|
390
|
-
encryption_required:
|
|
464
|
+
credential_response_encryption: z11.object({
|
|
465
|
+
alg_values_supported: z11.array(z11.string()),
|
|
466
|
+
enc_values_supported: z11.array(z11.string()),
|
|
467
|
+
encryption_required: z11.boolean()
|
|
391
468
|
}).passthrough().optional(),
|
|
392
|
-
batch_credential_issuance:
|
|
393
|
-
batch_size:
|
|
469
|
+
batch_credential_issuance: z11.object({
|
|
470
|
+
batch_size: z11.number().positive()
|
|
394
471
|
}).passthrough().optional(),
|
|
395
472
|
signed_metadata: zCompactJwt.optional(),
|
|
396
|
-
display:
|
|
397
|
-
credential_configurations_supported:
|
|
473
|
+
display: z11.array(zCredentialIssuerMetadataDisplayEntry).optional(),
|
|
474
|
+
credential_configurations_supported: z11.record(z11.string(), zCredentialConfigurationSupportedWithFormats)
|
|
398
475
|
}).passthrough();
|
|
399
|
-
var zCredentialConfigurationSupportedDraft11To14 =
|
|
400
|
-
id:
|
|
401
|
-
format:
|
|
402
|
-
cryptographic_suites_supported:
|
|
403
|
-
display:
|
|
404
|
-
|
|
405
|
-
logo:
|
|
406
|
-
url:
|
|
476
|
+
var zCredentialConfigurationSupportedDraft11To14 = z11.object({
|
|
477
|
+
id: z11.string().optional(),
|
|
478
|
+
format: z11.string(),
|
|
479
|
+
cryptographic_suites_supported: z11.array(z11.string()).optional(),
|
|
480
|
+
display: z11.array(
|
|
481
|
+
z11.object({
|
|
482
|
+
logo: z11.object({
|
|
483
|
+
url: z11.string().url().optional()
|
|
407
484
|
}).passthrough().optional(),
|
|
408
|
-
background_image:
|
|
409
|
-
url:
|
|
485
|
+
background_image: z11.object({
|
|
486
|
+
url: z11.string().url().optional()
|
|
410
487
|
}).passthrough().optional()
|
|
411
488
|
}).passthrough()
|
|
412
489
|
).optional()
|
|
@@ -447,11 +524,11 @@ var zCredentialConfigurationSupportedDraft11To14 = z9.object({
|
|
|
447
524
|
for (const issue of result.error.issues) {
|
|
448
525
|
ctx.addIssue(issue);
|
|
449
526
|
}
|
|
450
|
-
return
|
|
527
|
+
return z11.NEVER;
|
|
451
528
|
}).pipe(zCredentialConfigurationSupportedWithFormats);
|
|
452
529
|
var zCredentialConfigurationSupportedDraft14To11 = zCredentialConfigurationSupportedWithFormats.and(
|
|
453
|
-
|
|
454
|
-
id:
|
|
530
|
+
z11.object({
|
|
531
|
+
id: z11.string()
|
|
455
532
|
}).passthrough()
|
|
456
533
|
).transform(({ id, credential_signing_alg_values_supported, display, proof_types_supported, scope, ...rest }) => ({
|
|
457
534
|
...rest,
|
|
@@ -471,15 +548,15 @@ var zCredentialConfigurationSupportedDraft14To11 = zCredentialConfigurationSuppo
|
|
|
471
548
|
} : {},
|
|
472
549
|
id
|
|
473
550
|
})).pipe(
|
|
474
|
-
|
|
551
|
+
z11.union([
|
|
475
552
|
zLdpVcCredentialIssuerMetadataDraft14To11,
|
|
476
553
|
zJwtVcJsonCredentialIssuerMetadataDraft14To11,
|
|
477
554
|
zJwtVcJsonLdCredentialIssuerMetadataDraft14To11,
|
|
478
555
|
// To handle unrecognized formats and not error immediately we allow the common format as well
|
|
479
556
|
// but they can't use any of the foramt identifiers that have a specific transformation. This way if a format is
|
|
480
557
|
// has a transformation it NEEDS to use the format specific transformation, and otherwise we fall back to the common validation
|
|
481
|
-
|
|
482
|
-
format:
|
|
558
|
+
z11.object({
|
|
559
|
+
format: z11.string().refine(
|
|
483
560
|
(input) => ![
|
|
484
561
|
zLdpVcFormatIdentifier.value,
|
|
485
562
|
zJwtVcJsonFormatIdentifier.value,
|
|
@@ -489,11 +566,11 @@ var zCredentialConfigurationSupportedDraft14To11 = zCredentialConfigurationSuppo
|
|
|
489
566
|
}).passthrough()
|
|
490
567
|
])
|
|
491
568
|
);
|
|
492
|
-
var zCredentialIssuerMetadataDraft11To14 =
|
|
493
|
-
authorization_server:
|
|
494
|
-
credentials_supported:
|
|
495
|
-
|
|
496
|
-
id:
|
|
569
|
+
var zCredentialIssuerMetadataDraft11To14 = z11.object({
|
|
570
|
+
authorization_server: z11.string().optional(),
|
|
571
|
+
credentials_supported: z11.array(
|
|
572
|
+
z11.object({
|
|
573
|
+
id: z11.string().optional()
|
|
497
574
|
}).passthrough()
|
|
498
575
|
)
|
|
499
576
|
}).passthrough().transform(({ authorization_server, credentials_supported, ...rest }) => {
|
|
@@ -506,12 +583,12 @@ var zCredentialIssuerMetadataDraft11To14 = z9.object({
|
|
|
506
583
|
)
|
|
507
584
|
};
|
|
508
585
|
}).pipe(
|
|
509
|
-
|
|
586
|
+
z11.object({
|
|
510
587
|
// Update from v11 structrue to v14 structure
|
|
511
|
-
credential_configurations_supported:
|
|
588
|
+
credential_configurations_supported: z11.record(z11.string(), zCredentialConfigurationSupportedDraft11To14)
|
|
512
589
|
}).passthrough()
|
|
513
|
-
).pipe(
|
|
514
|
-
var zCredentialIssuerMetadataWithDraft11 =
|
|
590
|
+
).pipe(zCredentialIssuerMetadataDraft14Draft15);
|
|
591
|
+
var zCredentialIssuerMetadataWithDraft11 = zCredentialIssuerMetadataDraft14Draft15.transform((issuerMetadata) => ({
|
|
515
592
|
...issuerMetadata,
|
|
516
593
|
...issuerMetadata.authorization_servers ? { authorization_server: issuerMetadata.authorization_servers[0] } : {},
|
|
517
594
|
credentials_supported: Object.entries(issuerMetadata.credential_configurations_supported).map(([id, value]) => ({
|
|
@@ -519,22 +596,35 @@ var zCredentialIssuerMetadataWithDraft11 = zCredentialIssuerMetadataDraft14.tran
|
|
|
519
596
|
id
|
|
520
597
|
}))
|
|
521
598
|
})).pipe(
|
|
522
|
-
|
|
523
|
-
credentials_supported:
|
|
599
|
+
zCredentialIssuerMetadataDraft14Draft15.extend({
|
|
600
|
+
credentials_supported: z11.array(zCredentialConfigurationSupportedDraft14To11)
|
|
524
601
|
})
|
|
525
602
|
);
|
|
526
|
-
var zCredentialIssuerMetadata =
|
|
527
|
-
// First prioritize draft 14 (and 13)
|
|
528
|
-
|
|
603
|
+
var zCredentialIssuerMetadata = z11.union([
|
|
604
|
+
// First prioritize draft 15/14 (and 13)
|
|
605
|
+
zCredentialIssuerMetadataDraft14Draft15,
|
|
529
606
|
// Then try parsing draft 11 and transform into draft 14
|
|
530
607
|
zCredentialIssuerMetadataDraft11To14
|
|
531
608
|
]);
|
|
532
|
-
var zCredentialIssuerMetadataWithDraftVersion =
|
|
533
|
-
|
|
534
|
-
|
|
535
|
-
|
|
536
|
-
|
|
537
|
-
|
|
609
|
+
var zCredentialIssuerMetadataWithDraftVersion = z11.union([
|
|
610
|
+
zCredentialIssuerMetadataDraft14Draft15.transform((credentialIssuerMetadata) => {
|
|
611
|
+
const isDraft15 = Object.values(credentialIssuerMetadata.credential_configurations_supported).some(
|
|
612
|
+
(configuration) => {
|
|
613
|
+
const knownConfiguration = configuration;
|
|
614
|
+
if (knownConfiguration.format === zSdJwtDcFormatIdentifier.value) return true;
|
|
615
|
+
if (Array.isArray(knownConfiguration.claims)) return true;
|
|
616
|
+
if (Object.values(knownConfiguration.proof_types_supported ?? {}).some(
|
|
617
|
+
(proofType) => proofType.key_attestations_required !== void 0
|
|
618
|
+
))
|
|
619
|
+
return true;
|
|
620
|
+
return false;
|
|
621
|
+
}
|
|
622
|
+
);
|
|
623
|
+
return {
|
|
624
|
+
credentialIssuerMetadata,
|
|
625
|
+
originalDraftVersion: isDraft15 ? "Draft15" /* Draft15 */ : "Draft14" /* Draft14 */
|
|
626
|
+
};
|
|
627
|
+
}),
|
|
538
628
|
// Then try parsing draft 11 and transform into draft 14
|
|
539
629
|
zCredentialIssuerMetadataDraft11To14.transform((credentialIssuerMetadata) => ({
|
|
540
630
|
credentialIssuerMetadata,
|
|
@@ -561,6 +651,15 @@ function extractKnownCredentialConfigurationSupportedFormats(credentialConfigura
|
|
|
561
651
|
)
|
|
562
652
|
);
|
|
563
653
|
}
|
|
654
|
+
function getCredentialConfigurationSupportedById(credentialConfigurations, credentialConfigurationId) {
|
|
655
|
+
const configuration = credentialConfigurations[credentialConfigurationId];
|
|
656
|
+
if (!configuration) {
|
|
657
|
+
throw new Oauth2Error(
|
|
658
|
+
`Credential configuration with id '${credentialConfigurationId}' not found in credential configurations supported.`
|
|
659
|
+
);
|
|
660
|
+
}
|
|
661
|
+
return configuration;
|
|
662
|
+
}
|
|
564
663
|
|
|
565
664
|
// src/credential-request/credential-request-configurations.ts
|
|
566
665
|
function getCredentialConfigurationsMatchingRequestFormat({
|
|
@@ -698,41 +797,41 @@ import {
|
|
|
698
797
|
preAuthorizedCodeGrantIdentifier
|
|
699
798
|
} from "@openid4vc/oauth2";
|
|
700
799
|
import { zHttpsUrl as zHttpsUrl2 } from "@openid4vc/utils";
|
|
701
|
-
import
|
|
702
|
-
var zTxCode =
|
|
703
|
-
input_mode:
|
|
704
|
-
length:
|
|
705
|
-
description:
|
|
800
|
+
import z12 from "zod";
|
|
801
|
+
var zTxCode = z12.object({
|
|
802
|
+
input_mode: z12.union([z12.literal("numeric"), z12.literal("text")]).optional(),
|
|
803
|
+
length: z12.number().int().optional(),
|
|
804
|
+
description: z12.string().max(300).optional()
|
|
706
805
|
}).passthrough();
|
|
707
|
-
var zCredentialOfferGrants =
|
|
708
|
-
authorization_code:
|
|
709
|
-
issuer_state:
|
|
806
|
+
var zCredentialOfferGrants = z12.object({
|
|
807
|
+
authorization_code: z12.object({
|
|
808
|
+
issuer_state: z12.string().optional(),
|
|
710
809
|
authorization_server: zHttpsUrl2.optional()
|
|
711
810
|
}).passthrough().optional(),
|
|
712
|
-
[preAuthorizedCodeGrantIdentifier]:
|
|
713
|
-
"pre-authorized_code":
|
|
811
|
+
[preAuthorizedCodeGrantIdentifier]: z12.object({
|
|
812
|
+
"pre-authorized_code": z12.string(),
|
|
714
813
|
tx_code: zTxCode.optional(),
|
|
715
814
|
authorization_server: zHttpsUrl2.optional()
|
|
716
815
|
}).passthrough().optional()
|
|
717
816
|
}).passthrough();
|
|
718
|
-
var zCredentialOfferObjectDraft14 =
|
|
817
|
+
var zCredentialOfferObjectDraft14 = z12.object({
|
|
719
818
|
credential_issuer: zHttpsUrl2,
|
|
720
|
-
credential_configuration_ids:
|
|
721
|
-
grants:
|
|
819
|
+
credential_configuration_ids: z12.array(z12.string()),
|
|
820
|
+
grants: z12.optional(zCredentialOfferGrants)
|
|
722
821
|
}).passthrough();
|
|
723
|
-
var zCredentialOfferObjectDraft11To14 =
|
|
822
|
+
var zCredentialOfferObjectDraft11To14 = z12.object({
|
|
724
823
|
credential_issuer: zHttpsUrl2,
|
|
725
824
|
// We don't support the inline offer objects from draft 11
|
|
726
|
-
credentials:
|
|
727
|
-
|
|
825
|
+
credentials: z12.array(
|
|
826
|
+
z12.string({ message: "Only string credential identifiers are supported for draft 11 credential offers" })
|
|
728
827
|
),
|
|
729
|
-
grants:
|
|
730
|
-
|
|
828
|
+
grants: z12.optional(
|
|
829
|
+
z12.object({
|
|
731
830
|
// Has extra param in draft 14, but doesn't matter for transform purposes
|
|
732
831
|
authorization_code: zCredentialOfferGrants.shape.authorization_code,
|
|
733
|
-
[preAuthorizedCodeGrantIdentifier]:
|
|
734
|
-
"pre-authorized_code":
|
|
735
|
-
user_pin_required:
|
|
832
|
+
[preAuthorizedCodeGrantIdentifier]: z12.object({
|
|
833
|
+
"pre-authorized_code": z12.string(),
|
|
834
|
+
user_pin_required: z12.optional(z12.boolean())
|
|
736
835
|
}).passthrough().optional()
|
|
737
836
|
})
|
|
738
837
|
)
|
|
@@ -757,7 +856,7 @@ var zCredentialOfferObjectDraft11To14 = z10.object({
|
|
|
757
856
|
}
|
|
758
857
|
return v14;
|
|
759
858
|
}).pipe(zCredentialOfferObjectDraft14);
|
|
760
|
-
var zCredentialOfferObject =
|
|
859
|
+
var zCredentialOfferObject = z12.union([
|
|
761
860
|
// First prioritize draft 14 (and 13)
|
|
762
861
|
zCredentialOfferObjectDraft14,
|
|
763
862
|
// Then try parsing draft 11 and transform into draft 14
|
|
@@ -896,25 +995,23 @@ async function createCredentialOffer(options) {
|
|
|
896
995
|
// src/credential-request/format-payload.ts
|
|
897
996
|
import { zIs } from "@openid4vc/utils";
|
|
898
997
|
function getCredentialRequestFormatPayloadForCredentialConfigurationId(options) {
|
|
899
|
-
const credentialConfiguration =
|
|
900
|
-
|
|
901
|
-
|
|
902
|
-
|
|
903
|
-
|
|
904
|
-
}
|
|
905
|
-
if (zIs(zSdJwtVcCredentialIssuerMetadata, credentialConfiguration)) {
|
|
998
|
+
const credentialConfiguration = getCredentialConfigurationSupportedById(
|
|
999
|
+
options.issuerMetadata.credentialIssuer.credential_configurations_supported,
|
|
1000
|
+
options.credentialConfigurationId
|
|
1001
|
+
);
|
|
1002
|
+
if (zIs(zSdJwtVcCredentialIssuerMetadataDraft14, credentialConfiguration)) {
|
|
906
1003
|
return {
|
|
907
1004
|
format: credentialConfiguration.format,
|
|
908
1005
|
vct: credentialConfiguration.vct
|
|
909
1006
|
};
|
|
910
1007
|
}
|
|
911
|
-
if (zIs(zMsoMdocCredentialIssuerMetadata, credentialConfiguration)) {
|
|
1008
|
+
if (zIs(zMsoMdocCredentialIssuerMetadata, credentialConfiguration) || zIs(zMsoMdocCredentialIssuerMetadataDraft14, credentialConfiguration)) {
|
|
912
1009
|
return {
|
|
913
1010
|
format: credentialConfiguration.format,
|
|
914
1011
|
doctype: credentialConfiguration.doctype
|
|
915
1012
|
};
|
|
916
1013
|
}
|
|
917
|
-
if (zIs(zLdpVcCredentialIssuerMetadata, credentialConfiguration)) {
|
|
1014
|
+
if (zIs(zLdpVcCredentialIssuerMetadata, credentialConfiguration) || zIs(zLdpVcCredentialIssuerMetadataDraft14, credentialConfiguration)) {
|
|
918
1015
|
return {
|
|
919
1016
|
format: credentialConfiguration.format,
|
|
920
1017
|
credential_definition: {
|
|
@@ -923,7 +1020,7 @@ function getCredentialRequestFormatPayloadForCredentialConfigurationId(options)
|
|
|
923
1020
|
}
|
|
924
1021
|
};
|
|
925
1022
|
}
|
|
926
|
-
if (zIs(zJwtVcJsonLdCredentialIssuerMetadata, credentialConfiguration)) {
|
|
1023
|
+
if (zIs(zJwtVcJsonLdCredentialIssuerMetadata, credentialConfiguration) || zIs(zJwtVcJsonLdCredentialIssuerMetadataDraft14, credentialConfiguration)) {
|
|
927
1024
|
return {
|
|
928
1025
|
format: credentialConfiguration.format,
|
|
929
1026
|
credential_definition: {
|
|
@@ -932,7 +1029,7 @@ function getCredentialRequestFormatPayloadForCredentialConfigurationId(options)
|
|
|
932
1029
|
}
|
|
933
1030
|
};
|
|
934
1031
|
}
|
|
935
|
-
if (zIs(zJwtVcJsonCredentialIssuerMetadata, credentialConfiguration)) {
|
|
1032
|
+
if (zIs(zJwtVcJsonCredentialIssuerMetadata, credentialConfiguration) || zIs(zJwtVcJsonCredentialIssuerMetadataDraft14, credentialConfiguration)) {
|
|
936
1033
|
return {
|
|
937
1034
|
format: credentialConfiguration.format,
|
|
938
1035
|
credential_definition: {
|
|
@@ -940,6 +1037,11 @@ function getCredentialRequestFormatPayloadForCredentialConfigurationId(options)
|
|
|
940
1037
|
}
|
|
941
1038
|
};
|
|
942
1039
|
}
|
|
1040
|
+
if (zIs(zSdJwtDcCredentialIssuerMetadata, credentialConfiguration)) {
|
|
1041
|
+
throw new Openid4vciError(
|
|
1042
|
+
`Credential configuration id '${options.credentialConfigurationId}' with format ${zSdJwtVcFormatIdentifier.value} does not support credential request based on 'format'. Use 'credential_configuration_id' directly.`
|
|
1043
|
+
);
|
|
1044
|
+
}
|
|
943
1045
|
throw new Openid4vciError(
|
|
944
1046
|
`Unknown format '${credentialConfiguration.format}' in credential configuration with id '${options.credentialConfigurationId}' for credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}'`
|
|
945
1047
|
);
|
|
@@ -953,33 +1055,33 @@ import {
|
|
|
953
1055
|
import { ContentType as ContentType2, isResponseContentType, parseWithErrorHandling as parseWithErrorHandling2 } from "@openid4vc/utils";
|
|
954
1056
|
|
|
955
1057
|
// src/credential-request/z-credential-request.ts
|
|
956
|
-
import
|
|
1058
|
+
import z16 from "zod";
|
|
957
1059
|
|
|
958
1060
|
// src/credential-request/z-credential-request-common.ts
|
|
959
1061
|
import { zJwk as zJwk2 } from "@openid4vc/oauth2";
|
|
960
|
-
import
|
|
1062
|
+
import z15 from "zod";
|
|
961
1063
|
|
|
962
1064
|
// src/formats/proof-type/jwt/z-jwt-proof-type.ts
|
|
963
1065
|
import { zCompactJwt as zCompactJwt2, zJwtHeader as zJwtHeader2, zJwtPayload as zJwtPayload2 } from "@openid4vc/oauth2";
|
|
964
1066
|
import { zHttpsUrl as zHttpsUrl3, zInteger as zInteger2 } from "@openid4vc/utils";
|
|
965
|
-
import
|
|
966
|
-
var zJwtProofTypeIdentifier =
|
|
1067
|
+
import z13 from "zod";
|
|
1068
|
+
var zJwtProofTypeIdentifier = z13.literal("jwt");
|
|
967
1069
|
var jwtProofTypeIdentifier = zJwtProofTypeIdentifier.value;
|
|
968
|
-
var zCredentialRequestProofJwt =
|
|
1070
|
+
var zCredentialRequestProofJwt = z13.object({
|
|
969
1071
|
proof_type: zJwtProofTypeIdentifier,
|
|
970
1072
|
jwt: zCompactJwt2
|
|
971
1073
|
});
|
|
972
1074
|
var zCredentialRequestJwtProofTypeHeader = zJwtHeader2.merge(
|
|
973
|
-
|
|
974
|
-
key_attestation:
|
|
975
|
-
typ:
|
|
1075
|
+
z13.object({
|
|
1076
|
+
key_attestation: z13.optional(zCompactJwt2),
|
|
1077
|
+
typ: z13.literal("openid4vci-proof+jwt")
|
|
976
1078
|
})
|
|
977
1079
|
).passthrough().refine(({ kid, jwk }) => jwk === void 0 || kid === void 0, {
|
|
978
1080
|
message: `Both 'jwk' and 'kid' are defined. Only one is allowed`
|
|
979
1081
|
}).refine(({ trust_chain, kid }) => !trust_chain || !kid, {
|
|
980
1082
|
message: `When 'trust_chain' is provided, 'kid' is required`
|
|
981
1083
|
});
|
|
982
|
-
var zCredentialRequestJwtProofTypePayload =
|
|
1084
|
+
var zCredentialRequestJwtProofTypePayload = z13.object({
|
|
983
1085
|
...zJwtPayload2.shape,
|
|
984
1086
|
aud: zHttpsUrl3,
|
|
985
1087
|
iat: zInteger2
|
|
@@ -987,40 +1089,40 @@ var zCredentialRequestJwtProofTypePayload = z11.object({
|
|
|
987
1089
|
|
|
988
1090
|
// src/formats/proof-type/attestation/z-attestation-proof-type.ts
|
|
989
1091
|
import { zCompactJwt as zCompactJwt3 } from "@openid4vc/oauth2";
|
|
990
|
-
import
|
|
991
|
-
var zAttestationProofTypeIdentifier =
|
|
1092
|
+
import z14 from "zod";
|
|
1093
|
+
var zAttestationProofTypeIdentifier = z14.literal("attestation");
|
|
992
1094
|
var attestationProofTypeIdentifier = zAttestationProofTypeIdentifier.value;
|
|
993
|
-
var zCredentialRequestProofAttestation =
|
|
1095
|
+
var zCredentialRequestProofAttestation = z14.object({
|
|
994
1096
|
proof_type: zAttestationProofTypeIdentifier,
|
|
995
1097
|
attestation: zCompactJwt3
|
|
996
1098
|
});
|
|
997
1099
|
var zCredentialRequestAttestationProofTypePayload = zKeyAttestationJwtPayloadForUse("proof_type.attestation");
|
|
998
1100
|
|
|
999
1101
|
// src/credential-request/z-credential-request-common.ts
|
|
1000
|
-
var zCredentialRequestProofCommon =
|
|
1001
|
-
proof_type:
|
|
1102
|
+
var zCredentialRequestProofCommon = z15.object({
|
|
1103
|
+
proof_type: z15.string()
|
|
1002
1104
|
}).passthrough();
|
|
1003
1105
|
var allCredentialRequestProofs = [zCredentialRequestProofJwt, zCredentialRequestProofAttestation];
|
|
1004
|
-
var zCredentialRequestProof =
|
|
1106
|
+
var zCredentialRequestProof = z15.union([
|
|
1005
1107
|
zCredentialRequestProofCommon,
|
|
1006
|
-
|
|
1108
|
+
z15.discriminatedUnion("proof_type", allCredentialRequestProofs)
|
|
1007
1109
|
]);
|
|
1008
|
-
var zCredentialRequestProofsCommon =
|
|
1009
|
-
var zCredentialRequestProofs =
|
|
1010
|
-
[zJwtProofTypeIdentifier.value]:
|
|
1011
|
-
[zAttestationProofTypeIdentifier.value]:
|
|
1110
|
+
var zCredentialRequestProofsCommon = z15.record(z15.string(), z15.array(z15.unknown()));
|
|
1111
|
+
var zCredentialRequestProofs = z15.object({
|
|
1112
|
+
[zJwtProofTypeIdentifier.value]: z15.optional(z15.array(zCredentialRequestProofJwt.shape.jwt)),
|
|
1113
|
+
[zAttestationProofTypeIdentifier.value]: z15.optional(z15.array(zCredentialRequestProofAttestation.shape.attestation))
|
|
1012
1114
|
});
|
|
1013
|
-
var zCredentialRequestCommon =
|
|
1115
|
+
var zCredentialRequestCommon = z15.object({
|
|
1014
1116
|
proof: zCredentialRequestProof.optional(),
|
|
1015
|
-
proofs:
|
|
1016
|
-
|
|
1117
|
+
proofs: z15.optional(
|
|
1118
|
+
z15.intersection(zCredentialRequestProofsCommon, zCredentialRequestProofs).refine((proofs) => Object.values(proofs).length === 1, {
|
|
1017
1119
|
message: `The 'proofs' object in a credential request should contain exactly one attribute`
|
|
1018
1120
|
})
|
|
1019
1121
|
),
|
|
1020
|
-
credential_response_encryption:
|
|
1122
|
+
credential_response_encryption: z15.object({
|
|
1021
1123
|
jwk: zJwk2,
|
|
1022
|
-
alg:
|
|
1023
|
-
enc:
|
|
1124
|
+
alg: z15.string(),
|
|
1125
|
+
enc: z15.string()
|
|
1024
1126
|
}).passthrough().optional()
|
|
1025
1127
|
}).passthrough().refine(({ proof, proofs }) => !(proof !== void 0 && proofs !== void 0), {
|
|
1026
1128
|
message: `Both 'proof' and 'proofs' are defined. Only one is allowed`
|
|
@@ -1028,40 +1130,54 @@ var zCredentialRequestCommon = z13.object({
|
|
|
1028
1130
|
|
|
1029
1131
|
// src/credential-request/z-credential-request.ts
|
|
1030
1132
|
var allCredentialRequestFormats = [
|
|
1031
|
-
|
|
1032
|
-
|
|
1033
|
-
|
|
1034
|
-
|
|
1035
|
-
|
|
1133
|
+
zSdJwtVcCredentialRequestFormatDraft14,
|
|
1134
|
+
zMsoMdocCredentialRequestFormatDraft14,
|
|
1135
|
+
zLdpVcCredentialRequestFormatDraft14,
|
|
1136
|
+
zJwtVcJsonLdCredentialRequestFormatDraft14,
|
|
1137
|
+
zJwtVcJsonCredentialRequestFormatDraft14
|
|
1036
1138
|
];
|
|
1037
1139
|
var allCredentialRequestFormatIdentifiers = allCredentialRequestFormats.map(
|
|
1038
1140
|
(format) => format.shape.format.value
|
|
1039
1141
|
);
|
|
1040
|
-
var
|
|
1041
|
-
|
|
1142
|
+
var zCredentialRequestCredentialConfigurationId = z16.object({
|
|
1143
|
+
credential_configuration_id: z16.string(),
|
|
1144
|
+
format: z16.never({ message: "'format' cannot be defined when 'credential_configuration_id' is set." }).optional(),
|
|
1145
|
+
credential_identifier: z16.never({ message: "'credential_identifier' cannot be defined when 'credential_configuration_id' is set." }).optional()
|
|
1146
|
+
});
|
|
1147
|
+
var zAuthorizationDetailsCredentialRequest = z16.object({
|
|
1148
|
+
credential_identifier: z16.string(),
|
|
1149
|
+
credential_configuration_id: z16.never({ message: "'credential_configuration_id' cannot be defined when 'credential_identifier' is set." }).optional(),
|
|
1042
1150
|
// Cannot be present if credential identifier is present
|
|
1043
|
-
format:
|
|
1151
|
+
format: z16.never({ message: "'format' cannot be defined when 'credential_identifier' is set." }).optional()
|
|
1044
1152
|
});
|
|
1045
|
-
var
|
|
1046
|
-
format:
|
|
1047
|
-
credential_identifier:
|
|
1153
|
+
var zCredentialRequestFormat = z16.object({
|
|
1154
|
+
format: z16.string(),
|
|
1155
|
+
credential_identifier: z16.never({ message: "'credential_identifier' cannot be defined when 'format' is set." }).optional(),
|
|
1156
|
+
credential_configuration_id: z16.never({ message: "'credential_configuration_id' cannot be defined when 'format' is set." }).optional()
|
|
1048
1157
|
}).passthrough();
|
|
1049
|
-
var zCredenialRequestDraft14WithFormat = zCredentialRequestCommon.and(
|
|
1050
|
-
if (!allCredentialRequestFormatIdentifiers.includes(
|
|
1051
|
-
|
|
1158
|
+
var zCredenialRequestDraft14WithFormat = zCredentialRequestCommon.and(zCredentialRequestFormat).transform((data, ctx) => {
|
|
1159
|
+
if (!allCredentialRequestFormatIdentifiers.includes(
|
|
1160
|
+
data.format
|
|
1161
|
+
))
|
|
1162
|
+
return data;
|
|
1163
|
+
const result = z16.object({}).passthrough().and(z16.discriminatedUnion("format", allCredentialRequestFormats)).safeParse(data);
|
|
1052
1164
|
if (result.success) {
|
|
1053
1165
|
return result.data;
|
|
1054
1166
|
}
|
|
1055
1167
|
for (const issue of result.error.issues) {
|
|
1056
1168
|
ctx.addIssue(issue);
|
|
1057
1169
|
}
|
|
1058
|
-
return
|
|
1170
|
+
return z16.NEVER;
|
|
1059
1171
|
});
|
|
1060
|
-
var
|
|
1172
|
+
var zCredentialRequestDraft15 = z16.union([
|
|
1173
|
+
zCredentialRequestCommon.and(zAuthorizationDetailsCredentialRequest),
|
|
1174
|
+
zCredentialRequestCommon.and(zCredentialRequestCredentialConfigurationId)
|
|
1175
|
+
]);
|
|
1176
|
+
var zCredentialRequestDraft14 = z16.union([
|
|
1061
1177
|
zCredenialRequestDraft14WithFormat,
|
|
1062
1178
|
zCredentialRequestCommon.and(zAuthorizationDetailsCredentialRequest)
|
|
1063
1179
|
]);
|
|
1064
|
-
var zCredentialRequestDraft11To14 = zCredentialRequestCommon.and(
|
|
1180
|
+
var zCredentialRequestDraft11To14 = zCredentialRequestCommon.and(zCredentialRequestFormat).transform((data, ctx) => {
|
|
1065
1181
|
const formatSpecificTransformations = {
|
|
1066
1182
|
[zLdpVcFormatIdentifier.value]: zLdpVcCredentialRequestDraft11To14,
|
|
1067
1183
|
[zJwtVcJsonFormatIdentifier.value]: zJwtVcJsonCredentialRequestDraft11To14,
|
|
@@ -1074,7 +1190,7 @@ var zCredentialRequestDraft11To14 = zCredentialRequestCommon.and(zCredentialRequ
|
|
|
1074
1190
|
for (const issue of result.error.issues) {
|
|
1075
1191
|
ctx.addIssue(issue);
|
|
1076
1192
|
}
|
|
1077
|
-
return
|
|
1193
|
+
return z16.NEVER;
|
|
1078
1194
|
}).pipe(zCredentialRequestDraft14);
|
|
1079
1195
|
var zCredentialRequestDraft14To11 = zCredentialRequestDraft14.refine(
|
|
1080
1196
|
(data) => data.credential_identifier === void 0,
|
|
@@ -1092,15 +1208,19 @@ var zCredentialRequestDraft14To11 = zCredentialRequestDraft14.refine(
|
|
|
1092
1208
|
for (const issue of result.error.issues) {
|
|
1093
1209
|
ctx.addIssue(issue);
|
|
1094
1210
|
}
|
|
1095
|
-
return
|
|
1211
|
+
return z16.NEVER;
|
|
1096
1212
|
});
|
|
1097
|
-
var zCredentialRequest =
|
|
1213
|
+
var zCredentialRequest = z16.union([
|
|
1214
|
+
zCredentialRequestDraft15,
|
|
1215
|
+
zCredentialRequestDraft14,
|
|
1216
|
+
zCredentialRequestDraft11To14
|
|
1217
|
+
]);
|
|
1098
1218
|
|
|
1099
1219
|
// src/credential-request/z-credential-response.ts
|
|
1100
|
-
import
|
|
1220
|
+
import z18 from "zod";
|
|
1101
1221
|
|
|
1102
1222
|
// ../oauth2/src/common/z-oauth2-error.ts
|
|
1103
|
-
import
|
|
1223
|
+
import z17 from "zod";
|
|
1104
1224
|
var Oauth2ErrorCodes = /* @__PURE__ */ ((Oauth2ErrorCodes4) => {
|
|
1105
1225
|
Oauth2ErrorCodes4["ServerError"] = "server_error";
|
|
1106
1226
|
Oauth2ErrorCodes4["InvalidTarget"] = "invalid_target";
|
|
@@ -1137,21 +1257,21 @@ var Oauth2ErrorCodes = /* @__PURE__ */ ((Oauth2ErrorCodes4) => {
|
|
|
1137
1257
|
Oauth2ErrorCodes4["WalletUnavailable"] = "wallet_unavailable";
|
|
1138
1258
|
return Oauth2ErrorCodes4;
|
|
1139
1259
|
})(Oauth2ErrorCodes || {});
|
|
1140
|
-
var zOauth2ErrorResponse =
|
|
1141
|
-
error:
|
|
1142
|
-
error_description:
|
|
1143
|
-
error_uri:
|
|
1260
|
+
var zOauth2ErrorResponse = z17.object({
|
|
1261
|
+
error: z17.union([z17.nativeEnum(Oauth2ErrorCodes), z17.string()]),
|
|
1262
|
+
error_description: z17.string().optional(),
|
|
1263
|
+
error_uri: z17.string().optional()
|
|
1144
1264
|
}).passthrough();
|
|
1145
1265
|
|
|
1146
1266
|
// src/credential-request/z-credential-response.ts
|
|
1147
|
-
var zCredentialEncoding =
|
|
1148
|
-
var zCredentialResponse =
|
|
1149
|
-
credential:
|
|
1150
|
-
credentials:
|
|
1151
|
-
transaction_id:
|
|
1152
|
-
c_nonce:
|
|
1153
|
-
c_nonce_expires_in:
|
|
1154
|
-
notification_id:
|
|
1267
|
+
var zCredentialEncoding = z18.union([z18.string(), z18.record(z18.string(), z18.any())]);
|
|
1268
|
+
var zCredentialResponse = z18.object({
|
|
1269
|
+
credential: z18.optional(zCredentialEncoding),
|
|
1270
|
+
credentials: z18.optional(z18.array(zCredentialEncoding)),
|
|
1271
|
+
transaction_id: z18.string().optional(),
|
|
1272
|
+
c_nonce: z18.string().optional(),
|
|
1273
|
+
c_nonce_expires_in: z18.number().int().optional(),
|
|
1274
|
+
notification_id: z18.string().optional()
|
|
1155
1275
|
}).passthrough().refine(
|
|
1156
1276
|
(value) => {
|
|
1157
1277
|
const { credential, credentials, transaction_id } = value;
|
|
@@ -1161,14 +1281,43 @@ var zCredentialResponse = z16.object({
|
|
|
1161
1281
|
message: `Exactly one of 'credential', 'credentials', or 'transaction_id' MUST be defined.`
|
|
1162
1282
|
}
|
|
1163
1283
|
);
|
|
1164
|
-
var zCredentialErrorResponse =
|
|
1284
|
+
var zCredentialErrorResponse = z18.object({
|
|
1165
1285
|
...zOauth2ErrorResponse.shape,
|
|
1166
|
-
c_nonce:
|
|
1167
|
-
c_nonce_expires_in:
|
|
1286
|
+
c_nonce: z18.string().optional(),
|
|
1287
|
+
c_nonce_expires_in: z18.number().int().optional()
|
|
1168
1288
|
}).passthrough();
|
|
1169
1289
|
|
|
1170
1290
|
// src/credential-request/retrieve-credentials.ts
|
|
1291
|
+
async function retrieveCredentialsWithCredentialConfigurationId(options) {
|
|
1292
|
+
if (options.issuerMetadata.originalDraftVersion !== "Draft15" /* Draft15 */) {
|
|
1293
|
+
throw new Openid4vciError(
|
|
1294
|
+
"Requesting credentials based on format is not supported in OpenID4VCI below draft 15. Make sure to provide the format and format specific claims in the request."
|
|
1295
|
+
);
|
|
1296
|
+
}
|
|
1297
|
+
getCredentialConfigurationSupportedById(
|
|
1298
|
+
options.issuerMetadata.credentialIssuer.credential_configurations_supported,
|
|
1299
|
+
options.credentialConfigurationId
|
|
1300
|
+
);
|
|
1301
|
+
const credentialRequest = {
|
|
1302
|
+
...options.additionalRequestPayload,
|
|
1303
|
+
credential_configuration_id: options.credentialConfigurationId,
|
|
1304
|
+
proof: options.proof,
|
|
1305
|
+
proofs: options.proofs
|
|
1306
|
+
};
|
|
1307
|
+
return retrieveCredentials({
|
|
1308
|
+
callbacks: options.callbacks,
|
|
1309
|
+
credentialRequest,
|
|
1310
|
+
issuerMetadata: options.issuerMetadata,
|
|
1311
|
+
accessToken: options.accessToken,
|
|
1312
|
+
dpop: options.dpop
|
|
1313
|
+
});
|
|
1314
|
+
}
|
|
1171
1315
|
async function retrieveCredentialsWithFormat(options) {
|
|
1316
|
+
if (options.issuerMetadata.originalDraftVersion === "Draft15" /* Draft15 */) {
|
|
1317
|
+
throw new Openid4vciError(
|
|
1318
|
+
"Requesting credentials based on format is not supported in OpenID4VCI draft 15. Provide the credential configuration id directly in the request."
|
|
1319
|
+
);
|
|
1320
|
+
}
|
|
1172
1321
|
const credentialRequest = {
|
|
1173
1322
|
...options.formatPayload,
|
|
1174
1323
|
...options.additionalRequestPayload,
|
|
@@ -1254,6 +1403,24 @@ import { dateToSeconds as dateToSeconds2, parseWithErrorHandling as parseWithErr
|
|
|
1254
1403
|
import { decodeJwt, jwtHeaderFromJwtSigner } from "@openid4vc/oauth2";
|
|
1255
1404
|
import { jwtSignerFromJwt, verifyJwt } from "@openid4vc/oauth2";
|
|
1256
1405
|
import { dateToSeconds, parseWithErrorHandling as parseWithErrorHandling3 } from "@openid4vc/utils";
|
|
1406
|
+
async function createKeyAttestationJwt(options) {
|
|
1407
|
+
const header = parseWithErrorHandling3(zKeyAttestationJwtHeader, {
|
|
1408
|
+
...jwtHeaderFromJwtSigner(options.signer),
|
|
1409
|
+
typ: "keyattestation+jwt"
|
|
1410
|
+
});
|
|
1411
|
+
const payload = parseWithErrorHandling3(zKeyAttestationJwtPayloadForUse(options.use), {
|
|
1412
|
+
iat: dateToSeconds(options.issuedAt),
|
|
1413
|
+
exp: options.expiresAt ? dateToSeconds(options.expiresAt) : void 0,
|
|
1414
|
+
nonce: options.nonce,
|
|
1415
|
+
attested_keys: options.attestedKeys,
|
|
1416
|
+
user_authentication: options.userAuthentication,
|
|
1417
|
+
key_storage: options.keyStorage,
|
|
1418
|
+
certification: options.certification,
|
|
1419
|
+
...options.additionalPayload
|
|
1420
|
+
});
|
|
1421
|
+
const { jwt } = await options.callbacks.signJwt(options.signer, { header, payload });
|
|
1422
|
+
return jwt;
|
|
1423
|
+
}
|
|
1257
1424
|
async function verifyKeyAttestationJwt(options) {
|
|
1258
1425
|
const { header, payload } = decodeJwt({
|
|
1259
1426
|
jwt: options.keyAttestationJwt,
|
|
@@ -1413,10 +1580,10 @@ import { ContentType as ContentType3, ValidationError as ValidationError3, creat
|
|
|
1413
1580
|
|
|
1414
1581
|
// src/nonce/z-nonce.ts
|
|
1415
1582
|
import { zInteger as zInteger3 } from "@openid4vc/utils";
|
|
1416
|
-
import
|
|
1417
|
-
var zNonceResponse =
|
|
1418
|
-
c_nonce:
|
|
1419
|
-
c_nonce_expires_in:
|
|
1583
|
+
import z19 from "zod";
|
|
1584
|
+
var zNonceResponse = z19.object({
|
|
1585
|
+
c_nonce: z19.string(),
|
|
1586
|
+
c_nonce_expires_in: z19.optional(zInteger3)
|
|
1420
1587
|
}).passthrough();
|
|
1421
1588
|
|
|
1422
1589
|
// src/nonce/nonce-request.ts
|
|
@@ -1459,15 +1626,15 @@ import {
|
|
|
1459
1626
|
import { ContentType as ContentType4, isResponseContentType as isResponseContentType2, parseWithErrorHandling as parseWithErrorHandling7 } from "@openid4vc/utils";
|
|
1460
1627
|
|
|
1461
1628
|
// src/notification/z-notification.ts
|
|
1462
|
-
import
|
|
1463
|
-
var zNotificationEvent =
|
|
1464
|
-
var zNotificationRequest =
|
|
1465
|
-
notification_id:
|
|
1629
|
+
import z20 from "zod";
|
|
1630
|
+
var zNotificationEvent = z20.enum(["credential_accepted", "credential_failure", "credential_deleted"]);
|
|
1631
|
+
var zNotificationRequest = z20.object({
|
|
1632
|
+
notification_id: z20.string(),
|
|
1466
1633
|
event: zNotificationEvent,
|
|
1467
|
-
event_description:
|
|
1634
|
+
event_description: z20.optional(z20.string())
|
|
1468
1635
|
}).passthrough();
|
|
1469
|
-
var zNotificationErrorResponse =
|
|
1470
|
-
error:
|
|
1636
|
+
var zNotificationErrorResponse = z20.object({
|
|
1637
|
+
error: z20.enum(["invalid_notification_id", "invalid_notification_request"])
|
|
1471
1638
|
}).passthrough();
|
|
1472
1639
|
|
|
1473
1640
|
// src/notification/notification.ts
|
|
@@ -1610,7 +1777,6 @@ var Openid4vciClient = class {
|
|
|
1610
1777
|
issuer_state: options.credentialOffer?.grants?.authorization_code?.issuer_state
|
|
1611
1778
|
},
|
|
1612
1779
|
dpop: options.dpop,
|
|
1613
|
-
clientAttestation: options.clientAttestation,
|
|
1614
1780
|
resource: options.issuerMetadata.credentialIssuer.credential_issuer,
|
|
1615
1781
|
authorizationServerMetadata
|
|
1616
1782
|
});
|
|
@@ -1664,7 +1830,6 @@ var Openid4vciClient = class {
|
|
|
1664
1830
|
redirectUri: options.redirectUri,
|
|
1665
1831
|
scope: options.scope,
|
|
1666
1832
|
pkceCodeVerifier: options.pkceCodeVerifier,
|
|
1667
|
-
clientAttestation: options.clientAttestation,
|
|
1668
1833
|
dpop: options.dpop
|
|
1669
1834
|
});
|
|
1670
1835
|
return {
|
|
@@ -1683,8 +1848,7 @@ var Openid4vciClient = class {
|
|
|
1683
1848
|
issuerMetadata,
|
|
1684
1849
|
additionalRequestPayload,
|
|
1685
1850
|
txCode,
|
|
1686
|
-
dpop
|
|
1687
|
-
clientAttestation
|
|
1851
|
+
dpop
|
|
1688
1852
|
}) {
|
|
1689
1853
|
if (!credentialOffer.grants?.[preAuthorizedCodeGrantIdentifier3]) {
|
|
1690
1854
|
throw new Oauth2Error7(`The credential offer does not contain the '${preAuthorizedCodeGrantIdentifier3}' grant.`);
|
|
@@ -1709,8 +1873,7 @@ var Openid4vciClient = class {
|
|
|
1709
1873
|
txCode,
|
|
1710
1874
|
resource: issuerMetadata.credentialIssuer.credential_issuer,
|
|
1711
1875
|
additionalRequestPayload,
|
|
1712
|
-
dpop
|
|
1713
|
-
clientAttestation
|
|
1876
|
+
dpop
|
|
1714
1877
|
});
|
|
1715
1878
|
return {
|
|
1716
1879
|
...result,
|
|
@@ -1728,8 +1891,7 @@ var Openid4vciClient = class {
|
|
|
1728
1891
|
authorizationCode,
|
|
1729
1892
|
pkceCodeVerifier,
|
|
1730
1893
|
redirectUri,
|
|
1731
|
-
dpop
|
|
1732
|
-
clientAttestation
|
|
1894
|
+
dpop
|
|
1733
1895
|
}) {
|
|
1734
1896
|
if (!credentialOffer.grants?.[authorizationCodeGrantIdentifier2]) {
|
|
1735
1897
|
throw new Oauth2Error7(`The credential offer does not contain the '${authorizationCodeGrantIdentifier2}' grant.`);
|
|
@@ -1748,7 +1910,6 @@ var Openid4vciClient = class {
|
|
|
1748
1910
|
pkceCodeVerifier,
|
|
1749
1911
|
additionalRequestPayload,
|
|
1750
1912
|
dpop,
|
|
1751
|
-
clientAttestation,
|
|
1752
1913
|
redirectUri,
|
|
1753
1914
|
resource: issuerMetadata.credentialIssuer.credential_issuer
|
|
1754
1915
|
});
|
|
@@ -1826,20 +1987,34 @@ var Openid4vciClient = class {
|
|
|
1826
1987
|
accessToken,
|
|
1827
1988
|
dpop
|
|
1828
1989
|
}) {
|
|
1829
|
-
|
|
1830
|
-
|
|
1831
|
-
|
|
1832
|
-
|
|
1833
|
-
|
|
1834
|
-
|
|
1835
|
-
|
|
1836
|
-
|
|
1837
|
-
|
|
1838
|
-
|
|
1839
|
-
|
|
1840
|
-
|
|
1841
|
-
|
|
1842
|
-
|
|
1990
|
+
let credentialResponse;
|
|
1991
|
+
if (issuerMetadata.originalDraftVersion === "Draft15" /* Draft15 */) {
|
|
1992
|
+
credentialResponse = await retrieveCredentialsWithCredentialConfigurationId({
|
|
1993
|
+
accessToken,
|
|
1994
|
+
credentialConfigurationId,
|
|
1995
|
+
issuerMetadata,
|
|
1996
|
+
additionalRequestPayload,
|
|
1997
|
+
proof,
|
|
1998
|
+
proofs,
|
|
1999
|
+
callbacks: this.options.callbacks,
|
|
2000
|
+
dpop
|
|
2001
|
+
});
|
|
2002
|
+
} else {
|
|
2003
|
+
const formatPayload = getCredentialRequestFormatPayloadForCredentialConfigurationId({
|
|
2004
|
+
credentialConfigurationId,
|
|
2005
|
+
issuerMetadata
|
|
2006
|
+
});
|
|
2007
|
+
credentialResponse = await retrieveCredentialsWithFormat({
|
|
2008
|
+
accessToken,
|
|
2009
|
+
formatPayload,
|
|
2010
|
+
issuerMetadata,
|
|
2011
|
+
additionalRequestPayload,
|
|
2012
|
+
proof,
|
|
2013
|
+
proofs,
|
|
2014
|
+
callbacks: this.options.callbacks,
|
|
2015
|
+
dpop
|
|
2016
|
+
});
|
|
2017
|
+
}
|
|
1843
2018
|
if (!credentialResponse.ok) {
|
|
1844
2019
|
throw new Openid4vciRetrieveCredentialsError(
|
|
1845
2020
|
`Error retrieving credentials from '${issuerMetadata.credentialIssuer.credential_issuer}'`,
|
|
@@ -1880,6 +2055,7 @@ var Openid4vciClient = class {
|
|
|
1880
2055
|
|
|
1881
2056
|
// src/Openid4vciIssuer.ts
|
|
1882
2057
|
import {
|
|
2058
|
+
Oauth2AuthorizationServer,
|
|
1883
2059
|
Oauth2ErrorCodes as Oauth2ErrorCodes3,
|
|
1884
2060
|
Oauth2JwtVerificationError,
|
|
1885
2061
|
Oauth2ServerErrorResponseError
|
|
@@ -1905,7 +2081,7 @@ function createCredentialResponse(options) {
|
|
|
1905
2081
|
|
|
1906
2082
|
// src/credential-request/parse-credential-request.ts
|
|
1907
2083
|
import { parseWithErrorHandling as parseWithErrorHandling9 } from "@openid4vc/utils";
|
|
1908
|
-
import
|
|
2084
|
+
import z21 from "zod";
|
|
1909
2085
|
function parseCredentialRequest(options) {
|
|
1910
2086
|
const credentialRequest = parseWithErrorHandling9(
|
|
1911
2087
|
zCredentialRequest,
|
|
@@ -1917,12 +2093,27 @@ function parseCredentialRequest(options) {
|
|
|
1917
2093
|
if (knownProofs.success) {
|
|
1918
2094
|
proofs = knownProofs.data;
|
|
1919
2095
|
}
|
|
1920
|
-
const knownProof =
|
|
2096
|
+
const knownProof = z21.union(allCredentialRequestProofs).safeParse(credentialRequest.proof);
|
|
1921
2097
|
if (knownProof.success && knownProof.data.proof_type === jwtProofTypeIdentifier) {
|
|
1922
2098
|
proofs = { [jwtProofTypeIdentifier]: [knownProof.data.jwt] };
|
|
1923
2099
|
} else if (knownProof.success && knownProof.data.proof_type === attestationProofTypeIdentifier) {
|
|
1924
2100
|
proofs = { [attestationProofTypeIdentifier]: [knownProof.data.attestation] };
|
|
1925
2101
|
}
|
|
2102
|
+
if (credentialRequest.credential_configuration_id) {
|
|
2103
|
+
getCredentialConfigurationSupportedById(
|
|
2104
|
+
options.issuerMetadata.credentialIssuer.credential_configurations_supported,
|
|
2105
|
+
credentialRequest.credential_configuration_id
|
|
2106
|
+
);
|
|
2107
|
+
const credentialConfigurations = extractKnownCredentialConfigurationSupportedFormats(
|
|
2108
|
+
options.issuerMetadata.credentialIssuer.credential_configurations_supported
|
|
2109
|
+
);
|
|
2110
|
+
return {
|
|
2111
|
+
credentialConfiguration: credentialConfigurations[credentialRequest.credential_configuration_id],
|
|
2112
|
+
credentialConfigurationId: credentialRequest.credential_configuration_id,
|
|
2113
|
+
credentialRequest,
|
|
2114
|
+
proofs
|
|
2115
|
+
};
|
|
2116
|
+
}
|
|
1926
2117
|
if (credentialRequest.credential_identifier) {
|
|
1927
2118
|
return {
|
|
1928
2119
|
credentialIdentifier: credentialRequest.credential_identifier,
|
|
@@ -1930,11 +2121,13 @@ function parseCredentialRequest(options) {
|
|
|
1930
2121
|
proofs
|
|
1931
2122
|
};
|
|
1932
2123
|
}
|
|
1933
|
-
if (credentialRequest.format && allCredentialRequestFormatIdentifiers.includes(
|
|
2124
|
+
if (credentialRequest.format && allCredentialRequestFormatIdentifiers.includes(
|
|
2125
|
+
credentialRequest.format
|
|
2126
|
+
)) {
|
|
1934
2127
|
return {
|
|
1935
2128
|
// Removes all claims that are not specific to this format
|
|
1936
2129
|
format: parseWithErrorHandling9(
|
|
1937
|
-
|
|
2130
|
+
z21.union(allCredentialRequestFormats),
|
|
1938
2131
|
credentialRequest,
|
|
1939
2132
|
"Unable to validate format specific properties from credential request"
|
|
1940
2133
|
),
|
|
@@ -2086,6 +2279,42 @@ var Openid4vciIssuer = class {
|
|
|
2086
2279
|
createNonceResponse(options) {
|
|
2087
2280
|
return createNonceResponse(options);
|
|
2088
2281
|
}
|
|
2282
|
+
async verifyWalletAttestation(options) {
|
|
2283
|
+
return new Oauth2AuthorizationServer({
|
|
2284
|
+
callbacks: this.options.callbacks
|
|
2285
|
+
}).verifyClientAttestation(options);
|
|
2286
|
+
}
|
|
2287
|
+
};
|
|
2288
|
+
|
|
2289
|
+
// src/Openid4vciWalletProvider.ts
|
|
2290
|
+
import {
|
|
2291
|
+
createClientAttestationJwt
|
|
2292
|
+
} from "@openid4vc/oauth2";
|
|
2293
|
+
var Openid4vciWalletProvider = class {
|
|
2294
|
+
constructor(options) {
|
|
2295
|
+
this.options = options;
|
|
2296
|
+
}
|
|
2297
|
+
async createWalletAttestationJwt(options) {
|
|
2298
|
+
const additionalPayload = options.additionalPayload ? {
|
|
2299
|
+
wallet_name: options.walletName,
|
|
2300
|
+
wallet_link: options.walletLink,
|
|
2301
|
+
...options.additionalPayload
|
|
2302
|
+
} : {
|
|
2303
|
+
wallet_name: options.walletName,
|
|
2304
|
+
wallet_link: options.walletLink
|
|
2305
|
+
};
|
|
2306
|
+
return await createClientAttestationJwt({
|
|
2307
|
+
...options,
|
|
2308
|
+
callbacks: this.options.callbacks,
|
|
2309
|
+
additionalPayload
|
|
2310
|
+
});
|
|
2311
|
+
}
|
|
2312
|
+
async createKeyAttestationJwt(options) {
|
|
2313
|
+
return await createKeyAttestationJwt({
|
|
2314
|
+
callbacks: this.options.callbacks,
|
|
2315
|
+
...options
|
|
2316
|
+
});
|
|
2317
|
+
}
|
|
2089
2318
|
};
|
|
2090
2319
|
export {
|
|
2091
2320
|
AuthorizationFlow,
|
|
@@ -2095,6 +2324,7 @@ export {
|
|
|
2095
2324
|
Openid4vciIssuer,
|
|
2096
2325
|
Openid4vciRetrieveCredentialsError,
|
|
2097
2326
|
Openid4vciSendNotificationError,
|
|
2327
|
+
Openid4vciWalletProvider,
|
|
2098
2328
|
credentialsSupportedToCredentialConfigurationsSupported,
|
|
2099
2329
|
extractScopesForCredentialConfigurationIds,
|
|
2100
2330
|
getCredentialConfigurationsMatchingRequestFormat,
|