@openid4vc/openid4vci 0.3.0-alpha-20250813113255 → 0.3.0-alpha-20250820090758

package/dist/index.js

@@ -346,25 +346,24 @@ var zKeyAttestationJwtPayloadForUse = (use) => import_zod3.default.object({
 }).passthrough();
 
 // src/metadata/credential-issuer/z-credential-configuration-supported-common.ts
+var zCredentialConfigurationSupportedDisplayEntry = import_zod4.default.object({
+  name: import_zod4.default.string(),
+  locale: import_zod4.default.string().optional(),
+  logo: import_zod4.default.object({
+    // FIXME: make required again, but need to support draft 11 first
+    uri: import_zod4.default.string().optional(),
+    alt_text: import_zod4.default.string().optional()
+  }).passthrough().optional(),
+  description: import_zod4.default.string().optional(),
+  background_color: import_zod4.default.string().optional(),
+  background_image: import_zod4.default.object({
+    // TODO: should be required, but paradym's metadata is wrong here.
+    uri: import_zod4.default.string().optional()
+  }).passthrough().optional(),
+  text_color: import_zod4.default.string().optional()
+}).passthrough();
 var zCredentialConfigurationSupportedCommonCredentialMetadata = import_zod4.default.object({
-  display: import_zod4.default.array(
-    import_zod4.default.object({
-      name: import_zod4.default.string(),
-      locale: import_zod4.default.string().optional(),
-      logo: import_zod4.default.object({
-        // FIXME: make required again, but need to support draft 11 first
-        uri: import_zod4.default.string().optional(),
-        alt_text: import_zod4.default.string().optional()
-      }).passthrough().optional(),
-      description: import_zod4.default.string().optional(),
-      background_color: import_zod4.default.string().optional(),
-      background_image: import_zod4.default.object({
-        // TODO: should be required, but paradym's metadata is wrong here.
-        uri: import_zod4.default.string().optional()
-      }).passthrough().optional(),
-      text_color: import_zod4.default.string().optional()
-    }).passthrough()
-  ).optional()
+  display: import_zod4.default.array(zCredentialConfigurationSupportedDisplayEntry).optional()
 });
 var zCredentialConfigurationSupportedCommon = import_zod4.default.object({
   format: import_zod4.default.string(),
@@ -381,24 +380,45 @@ var zCredentialConfigurationSupportedCommon = import_zod4.default.object({
       }).passthrough().optional()
     })
   ).optional(),
-  credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.optional()
-}).passthrough();
+  credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.optional(),
+  // For typing purposes. Can be removed once we drop support for draft <= 15.
+  claims: import_zod4.default.optional(import_zod4.default.never())
+});
+var zCredentialConfigurationSupportedCommonDraft15 = import_zod4.default.object({
+  format: import_zod4.default.string(),
+  scope: import_zod4.default.string().optional(),
+  cryptographic_binding_methods_supported: import_zod4.default.array(import_zod4.default.string()).optional(),
+  credential_signing_alg_values_supported: import_zod4.default.array(import_zod4.default.string()).or(import_zod4.default.array(import_zod4.default.number())).optional(),
+  proof_types_supported: import_zod4.default.record(
+    import_zod4.default.union([import_zod4.default.literal("jwt"), import_zod4.default.literal("attestation"), import_zod4.default.string()]),
+    import_zod4.default.object({
+      proof_signing_alg_values_supported: import_zod4.default.array(import_zod4.default.string()),
+      key_attestations_required: import_zod4.default.object({
+        key_storage: zIso18045OrStringArray.optional(),
+        user_authentication: zIso18045OrStringArray.optional()
+      }).passthrough().optional()
+    })
+  ).optional(),
+  display: import_zod4.default.array(zCredentialConfigurationSupportedDisplayEntry).optional(),
+  // For typing purposes.
+  credential_metadata: import_zod4.default.optional(import_zod4.default.never())
+});
 
 // src/formats/credential/mso-mdoc/z-mso-mdoc.ts
 var zMsoMdocFormatIdentifier = import_zod5.default.literal("mso_mdoc");
-var zMsoMdocCredentialIssuerMetadata = import_zod5.default.object({
+var zMsoMdocCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
   format: zMsoMdocFormatIdentifier,
   doctype: import_zod5.default.string(),
   credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({
     claims: import_zod5.default.array(zMsoMdocIssuerMetadataClaimsDescription).optional()
   }).optional()
 });
-var zMsoMdocCredentialIssuerMetadataDraft15 = import_zod5.default.object({
+var zMsoMdocCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
   format: zMsoMdocFormatIdentifier,
   doctype: import_zod5.default.string(),
   claims: import_zod5.default.array(zMsoMdocIssuerMetadataClaimsDescription).optional()
 });
-var zMsoMdocCredentialIssuerMetadataDraft14 = import_zod5.default.object({
+var zMsoMdocCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
   format: zMsoMdocFormatIdentifier,
   doctype: import_zod5.default.string(),
   claims: zCredentialConfigurationSupportedClaimsDraft14.optional(),
@@ -414,13 +434,21 @@ var zMsoMdocCredentialRequestFormatDraft14 = import_zod5.default.object({
 // src/formats/credential/sd-jwt-vc/z-sd-jwt-vc.ts
 var import_zod6 = __toESM(require("zod"));
 var zSdJwtVcFormatIdentifier = import_zod6.default.literal("vc+sd-jwt");
-var zSdJwtVcCredentialIssuerMetadataDraft14 = import_zod6.default.object({
+var zSdJwtVcCredentialIssuerMetadataDraft16 = zCredentialConfigurationSupportedCommon.extend({
+  vct: import_zod6.default.string(),
+  format: zSdJwtVcFormatIdentifier,
+  order: import_zod6.default.optional(import_zod6.default.array(import_zod6.default.string())),
+  credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({
+    claims: import_zod6.default.array(zCredentialConfigurationSupportedClaimsDraft14).optional()
+  }).optional()
+});
+var zSdJwtVcCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
   vct: import_zod6.default.string(),
   format: zSdJwtVcFormatIdentifier,
   claims: import_zod6.default.optional(zCredentialConfigurationSupportedClaimsDraft14),
   order: import_zod6.default.optional(import_zod6.default.array(import_zod6.default.string()))
 });
-var zSdJwtVcCredentialRequestFormatDraft14 = import_zod6.default.object({
+var zSdJwtVcCredentialRequestFormatDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
   format: zSdJwtVcFormatIdentifier,
   vct: import_zod6.default.string(),
   claims: import_zod6.default.optional(zCredentialConfigurationSupportedClaimsDraft14)
@@ -429,14 +457,14 @@ var zSdJwtVcCredentialRequestFormatDraft14 = import_zod6.default.object({
 // src/formats/credential/sd-jwt-dc/z-sd-jwt-dc.ts
 var import_zod7 = __toESM(require("zod"));
 var zSdJwtDcFormatIdentifier = import_zod7.default.literal("dc+sd-jwt");
-var zSdJwtDcCredentialIssuerMetadata = import_zod7.default.object({
+var zSdJwtDcCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
   vct: import_zod7.default.string(),
   format: zSdJwtDcFormatIdentifier,
   credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({
     claims: import_zod7.default.array(zIssuerMetadataClaimsDescription).optional()
   }).optional()
 });
-var zSdJwtDcCredentialIssuerMetadataDraft15 = import_zod7.default.object({
+var zSdJwtDcCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
   vct: import_zod7.default.string(),
   format: zSdJwtDcFormatIdentifier,
   claims: import_zod7.default.array(zIssuerMetadataClaimsDescription).optional()
@@ -473,19 +501,19 @@ var zW3cVcJsonLdCredentialDefinitionDraft14 = zW3cVcJsonLdCredentialDefinition.e
 
 // src/formats/credential/w3c-vc/z-w3c-ldp-vc.ts
 var zLdpVcFormatIdentifier = import_zod9.default.literal("ldp_vc");
-var zLdpVcCredentialIssuerMetadata = import_zod9.default.object({
+var zLdpVcCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
   format: zLdpVcFormatIdentifier,
   credential_definition: zW3cVcJsonLdCredentialDefinition,
   credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({
     claims: zIssuerMetadataClaimsDescription.optional()
   }).optional()
 });
-var zLdpVcCredentialIssuerMetadataDraft15 = import_zod9.default.object({
+var zLdpVcCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
   format: zLdpVcFormatIdentifier,
   credential_definition: zW3cVcJsonLdCredentialDefinition,
   claims: zIssuerMetadataClaimsDescription.optional()
 });
-var zLdpVcCredentialIssuerMetadataDraft14 = import_zod9.default.object({
+var zLdpVcCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
   format: zLdpVcFormatIdentifier,
   credential_definition: zW3cVcJsonLdCredentialDefinitionDraft14,
   order: import_zod9.default.array(import_zod9.default.string()).optional()
@@ -548,19 +576,19 @@ var zLdpVcCredentialRequestDraft14To11 = zLdpVcCredentialRequestFormatDraft14.pa
 // src/formats/credential/w3c-vc/z-w3c-jwt-vc-json-ld.ts
 var import_zod10 = __toESM(require("zod"));
 var zJwtVcJsonLdFormatIdentifier = import_zod10.default.literal("jwt_vc_json-ld");
-var zJwtVcJsonLdCredentialIssuerMetadata = import_zod10.default.object({
+var zJwtVcJsonLdCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
   format: zJwtVcJsonLdFormatIdentifier,
   credential_definition: zW3cVcJsonLdCredentialDefinition,
   credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({
     claims: zIssuerMetadataClaimsDescription.optional()
   }).optional()
 });
-var zJwtVcJsonLdCredentialIssuerMetadataDraft15 = import_zod10.default.object({
+var zJwtVcJsonLdCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
   format: zJwtVcJsonLdFormatIdentifier,
   credential_definition: zW3cVcJsonLdCredentialDefinition,
   claims: zIssuerMetadataClaimsDescription.optional()
 });
-var zJwtVcJsonLdCredentialIssuerMetadataDraft14 = import_zod10.default.object({
+var zJwtVcJsonLdCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
   format: zJwtVcJsonLdFormatIdentifier,
   credential_definition: zW3cVcJsonLdCredentialDefinitionDraft14,
   order: import_zod10.default.optional(import_zod10.default.array(import_zod10.default.string()))
@@ -629,19 +657,19 @@ var zJwtVcJsonCredentialDefinition = import_zod11.default.object({
 var zJwtVcJsonCredentialDefinitionDraft14 = zJwtVcJsonCredentialDefinition.extend({
   credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
 });
-var zJwtVcJsonCredentialIssuerMetadata = import_zod11.default.object({
+var zJwtVcJsonCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
   format: zJwtVcJsonFormatIdentifier,
   credential_definition: zJwtVcJsonCredentialDefinition,
   credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({
     claims: zIssuerMetadataClaimsDescription.optional()
   }).optional()
 });
-var zJwtVcJsonCredentialIssuerMetadataDraft15 = import_zod11.default.object({
+var zJwtVcJsonCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
   format: zJwtVcJsonFormatIdentifier,
   credential_definition: zJwtVcJsonCredentialDefinition,
   claims: zIssuerMetadataClaimsDescription.optional()
 });
-var zJwtVcJsonCredentialIssuerMetadataDraft14 = import_zod11.default.object({
+var zJwtVcJsonCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
   format: zJwtVcJsonFormatIdentifier,
   credential_definition: zJwtVcJsonCredentialDefinitionDraft14,
   order: import_zod11.default.array(import_zod11.default.string()).optional()
@@ -705,6 +733,7 @@ var allCredentialIssuerMetadataFormats = [
   zJwtVcJsonLdCredentialIssuerMetadata,
   zLdpVcCredentialIssuerMetadata,
   zJwtVcJsonCredentialIssuerMetadata,
+  zSdJwtVcCredentialIssuerMetadataDraft16,
   zSdJwtDcCredentialIssuerMetadataDraft15,
   zMsoMdocCredentialIssuerMetadataDraft15,
   zJwtVcJsonLdCredentialIssuerMetadataDraft15,
@@ -719,32 +748,27 @@ var allCredentialIssuerMetadataFormats = [
 var allCredentialIssuerMetadataFormatIdentifiers = allCredentialIssuerMetadataFormats.map(
   (format) => format.shape.format.value
 );
-var zCredentialConfigurationSupportedWithFormats = zCredentialConfigurationSupportedCommon.transform(
-  (data, ctx) => {
-    if (!allCredentialIssuerMetadataFormatIdentifiers.includes(data.format)) return data;
-    const validators = allCredentialIssuerMetadataFormats.reduce(
-      (validators2, formatValidator) => {
-        const format = formatValidator.shape.format.value;
-        if (!validators2[format]) {
-          validators2[format] = [];
-        }
-        validators2[format].push(formatValidator);
-        return validators2;
-      },
-      {}
-    )[data.format];
-    const result = import_zod12.default.object({}).passthrough().and(
-      validators.length > 1 ? import_zod12.default.union(validators) : validators[0]
-    ).safeParse(data);
-    if (result.success) {
-      return result.data;
-    }
-    for (const issue of result.error.issues) {
-      ctx.addIssue(issue);
-    }
-    return import_zod12.default.NEVER;
+var zCredentialConfigurationSupportedWithFormats = import_zod12.default.union([
+  zCredentialConfigurationSupportedCommon.passthrough(),
+  zCredentialConfigurationSupportedCommonDraft15.passthrough()
+]).transform((data, ctx) => {
+  if (!allCredentialIssuerMetadataFormatIdentifiers.includes(data.format)) return data;
+  const validators = allCredentialIssuerMetadataFormats.filter(
+    (formatValidator) => formatValidator.shape.format.value === data.format
+  );
+  const result = import_zod12.default.object({}).passthrough().and(
+    validators.length > 1 ? import_zod12.default.union(
+      validators
+    ) : validators[0]
+  ).safeParse(data);
+  if (result.success) {
+    return result.data;
   }
-);
+  for (const issue of result.error.issues) {
+    ctx.addIssue(issue);
+  }
+  return import_zod12.default.NEVER;
+});
 var zCredentialIssuerMetadataDisplayEntry = import_zod12.default.object({
   name: import_zod12.default.string().optional(),
   locale: import_zod12.default.string().optional(),
@@ -774,7 +798,7 @@ var zCredentialIssuerMetadataDraft14Draft15Draft16 = import_zod12.default.object
   display: import_zod12.default.array(zCredentialIssuerMetadataDisplayEntry).optional(),
   credential_configurations_supported: import_zod12.default.record(import_zod12.default.string(), zCredentialConfigurationSupportedWithFormats)
 }).passthrough();
-var zCredentialConfigurationSupportedDraft11To14 = import_zod12.default.object({
+var zCredentialConfigurationSupportedDraft11To16 = import_zod12.default.object({
   id: import_zod12.default.string().optional(),
   format: import_zod12.default.string(),
   cryptographic_suites_supported: import_zod12.default.array(import_zod12.default.string()).optional(),
@@ -787,30 +811,36 @@ var zCredentialConfigurationSupportedDraft11To14 = import_zod12.default.object({
         url: import_zod12.default.string().url().optional()
       }).passthrough().optional()
     }).passthrough()
-  ).optional()
-}).passthrough().transform(({ cryptographic_suites_supported, display, id, ...rest }) => ({
+  ).optional(),
+  claims: import_zod12.default.any().optional()
+}).passthrough().transform(({ cryptographic_suites_supported, display, claims, id, ...rest }) => ({
   ...rest,
   ...cryptographic_suites_supported ? { credential_signing_alg_values_supported: cryptographic_suites_supported } : {},
-  ...display ? {
-    display: display.map(({ logo, background_image, ...displayRest }) => ({
-      ...displayRest,
-      // url became uri and also required
-      // so if there's no url in the logo, we remove the whole logo object
-      ...logo?.url ? {
-        // TODO: we should add the other params from logo as well
-        logo: {
-          uri: logo.url
-        }
-      } : {},
-      // TODO: we should add the other params from background_image as well
-      // url became uri and also required
-      // so if there's no url in the background_image, we remove the whole logo object
-      ...background_image?.url ? {
-        background_image: {
-          uri: background_image.url
-        }
+  ...claims || display ? {
+    credential_metadata: {
+      ...claims ? { claims } : {},
+      ...display ? {
+        display: display.map(({ logo, background_image, ...displayRest }) => ({
+          ...displayRest,
+          // url became uri and also required
+          // so if there's no url in the logo, we remove the whole logo object
+          ...logo?.url ? {
+            // TODO: we should add the other params from logo as well
+            logo: {
+              uri: logo.url
+            }
+          } : {},
+          // TODO: we should add the other params from background_image as well
+          // url became uri and also required
+          // so if there's no url in the background_image, we remove the whole logo object
+          ...background_image?.url ? {
+            background_image: {
+              uri: background_image.url
+            }
+          } : {}
+        }))
       } : {}
-    }))
+    }
   } : {}
 })).transform((data, ctx) => {
   const formatSpecificTransformations = {
@@ -833,7 +863,7 @@ var zCredentialConfigurationSupportedDraft16To15 = zCredentialConfigurationSuppo
     ...rest
   })
 );
-var zCredentialConfigurationSupportedDraft14To11 = zCredentialConfigurationSupportedDraft16To15.and(
+var zCredentialConfigurationSupportedDraft16To11 = zCredentialConfigurationSupportedDraft16To15.and(
   import_zod12.default.object({
     id: import_zod12.default.string()
   }).passthrough()
@@ -892,7 +922,7 @@ var zCredentialIssuerMetadataDraft11To16 = import_zod12.default.object({
 }).pipe(
   import_zod12.default.object({
     // Update from v11 structure to v14 structure
-    credential_configurations_supported: import_zod12.default.record(import_zod12.default.string(), zCredentialConfigurationSupportedDraft11To14)
+    credential_configurations_supported: import_zod12.default.record(import_zod12.default.string(), zCredentialConfigurationSupportedDraft11To16)
   }).passthrough()
 ).pipe(zCredentialIssuerMetadataDraft14Draft15Draft16);
 var zCredentialIssuerMetadataWithDraft11 = zCredentialIssuerMetadataDraft14Draft15Draft16.transform((issuerMetadata) => ({
@@ -904,7 +934,7 @@ var zCredentialIssuerMetadataWithDraft11 = zCredentialIssuerMetadataDraft14Draft
   }))
 })).pipe(
   zCredentialIssuerMetadataDraft14Draft15Draft16.extend({
-    credentials_supported: import_zod12.default.array(zCredentialConfigurationSupportedDraft14To11)
+    credentials_supported: import_zod12.default.array(zCredentialConfigurationSupportedDraft16To11)
   })
 );
 var zCredentialIssuerMetadata = import_zod12.default.union([
@@ -1110,7 +1140,7 @@ function credentialsSupportedToCredentialConfigurationsSupported(credentialsSupp
         `Credential supported at index '${index}' does not have an 'id' property. Credential configuration requires the 'id' property as key`
       );
     }
-    const parseResult = zCredentialConfigurationSupportedDraft11To14.safeParse(credentialSupported);
+    const parseResult = zCredentialConfigurationSupportedDraft11To16.safeParse(credentialSupported);
     if (!parseResult.success) {
       throw new import_utils9.ValidationError(
         `Error transforming credential supported with id '${credentialSupported.id}' to credential configuration supported format`,
@@ -1132,7 +1162,7 @@ function getCredentialRequestFormatPayloadForCredentialConfigurationId(options)
     options.issuerMetadata.credentialIssuer.credential_configurations_supported,
     options.credentialConfigurationId
   );
-  if ((0, import_utils10.zIs)(zSdJwtVcCredentialIssuerMetadataDraft14, credentialConfiguration)) {
+  if ((0, import_utils10.zIs)(zSdJwtVcCredentialIssuerMetadataDraft16, credentialConfiguration) || (0, import_utils10.zIs)(zSdJwtVcCredentialIssuerMetadataDraft14, credentialConfiguration)) {
     return {
       format: credentialConfiguration.format,
       vct: credentialConfiguration.vct