@openid4vc/openid4vci 0.3.0-alpha-20250922085649 → 0.3.0-alpha-20251017082202

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/dist/index.d.mts +44482 -46928
  2. package/dist/index.d.ts +44481 -46927
  3. package/dist/index.js +1820 -2434
  4. package/dist/index.js.map +1 -1
  5. package/dist/index.mjs +1779 -2435
  6. package/dist/index.mjs.map +1 -1
  7. package/package.json +6 -6
package/dist/index.js CHANGED
@@ -1,2625 +1,2011 @@
1
- "use strict";
1
+ //#region rolldown:runtime
2
2
  var __create = Object.create;
3
3
  var __defProp = Object.defineProperty;
4
4
  var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
5
5
  var __getOwnPropNames = Object.getOwnPropertyNames;
6
6
  var __getProtoOf = Object.getPrototypeOf;
7
7
  var __hasOwnProp = Object.prototype.hasOwnProperty;
8
- var __export = (target, all) => {
9
- for (var name in all)
10
- __defProp(target, name, { get: all[name], enumerable: true });
11
- };
12
8
  var __copyProps = (to, from, except, desc) => {
13
- if (from && typeof from === "object" || typeof from === "function") {
14
- for (let key of __getOwnPropNames(from))
15
- if (!__hasOwnProp.call(to, key) && key !== except)
16
- __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
17
- }
18
- return to;
9
+ if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
10
+ key = keys[i];
11
+ if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
12
+ get: ((k) => from[k]).bind(null, key),
13
+ enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
14
+ });
15
+ }
16
+ return to;
19
17
  };
20
- var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
21
- // If the importer is in node compatibility mode or this is not an ESM
22
- // file that has been converted to a CommonJS file using a Babel-
23
- // compatible transform (i.e. "__esModule" has not been set), then set
24
- // "default" to the CommonJS "module.exports" for node compatibility.
25
- isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
26
- mod
27
- ));
28
- var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
18
+ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
19
+ value: mod,
20
+ enumerable: true
21
+ }) : target, mod));
29
22
 
30
- // src/index.ts
31
- var index_exports = {};
32
- __export(index_exports, {
33
- AuthorizationFlow: () => AuthorizationFlow,
34
- Openid4vciClient: () => Openid4vciClient,
35
- Openid4vciDraftVersion: () => Openid4vciDraftVersion,
36
- Openid4vciError: () => Openid4vciError,
37
- Openid4vciIssuer: () => Openid4vciIssuer,
38
- Openid4vciRetrieveCredentialsError: () => Openid4vciRetrieveCredentialsError,
39
- Openid4vciSendNotificationError: () => Openid4vciSendNotificationError,
40
- Openid4vciWalletProvider: () => Openid4vciWalletProvider,
41
- createKeyAttestationJwt: () => createKeyAttestationJwt,
42
- credentialsSupportedToCredentialConfigurationsSupported: () => credentialsSupportedToCredentialConfigurationsSupported,
43
- determineAuthorizationServerForCredentialOffer: () => determineAuthorizationServerForCredentialOffer,
44
- extractScopesForCredentialConfigurationIds: () => extractScopesForCredentialConfigurationIds,
45
- getCredentialConfigurationsMatchingRequestFormat: () => getCredentialConfigurationsMatchingRequestFormat,
46
- getGlobalConfig: () => import_utils22.getGlobalConfig,
47
- parseKeyAttestationJwt: () => parseKeyAttestationJwt,
48
- setGlobalConfig: () => import_utils22.setGlobalConfig,
49
- verifyKeyAttestationJwt: () => verifyKeyAttestationJwt
50
- });
51
- module.exports = __toCommonJS(index_exports);
23
+ //#endregion
24
+ let __openid4vc_utils = require("@openid4vc/utils");
25
+ __openid4vc_utils = __toESM(__openid4vc_utils);
26
+ let __openid4vc_oauth2 = require("@openid4vc/oauth2");
27
+ __openid4vc_oauth2 = __toESM(__openid4vc_oauth2);
28
+ let zod = require("zod");
29
+ zod = __toESM(zod);
52
30
 
53
- // src/credential-offer/credential-offer.ts
54
- var import_oauth22 = require("@openid4vc/oauth2");
55
- var import_utils2 = require("@openid4vc/utils");
31
+ //#region src/version.ts
32
+ let Openid4vciDraftVersion = /* @__PURE__ */ function(Openid4vciDraftVersion$1) {
33
+ Openid4vciDraftVersion$1["Draft16"] = "Draft16";
34
+ Openid4vciDraftVersion$1["Draft15"] = "Draft15";
35
+ Openid4vciDraftVersion$1["Draft14"] = "Draft14";
36
+ Openid4vciDraftVersion$1["Draft11"] = "Draft11";
37
+ return Openid4vciDraftVersion$1;
38
+ }({});
56
39
 
57
- // src/version.ts
58
- var Openid4vciDraftVersion = /* @__PURE__ */ ((Openid4vciDraftVersion2) => {
59
- Openid4vciDraftVersion2["Draft16"] = "Draft16";
60
- Openid4vciDraftVersion2["Draft15"] = "Draft15";
61
- Openid4vciDraftVersion2["Draft14"] = "Draft14";
62
- Openid4vciDraftVersion2["Draft11"] = "Draft11";
63
- return Openid4vciDraftVersion2;
64
- })(Openid4vciDraftVersion || {});
65
-
66
- // src/credential-offer/z-credential-offer.ts
67
- var import_oauth2 = require("@openid4vc/oauth2");
68
- var import_utils = require("@openid4vc/utils");
69
- var import_zod = __toESM(require("zod"));
70
- var zTxCode = import_zod.default.object({
71
- input_mode: import_zod.default.union([import_zod.default.literal("numeric"), import_zod.default.literal("text")]).optional(),
72
- length: import_zod.default.number().int().optional(),
73
- description: import_zod.default.string().max(300).optional()
40
+ //#endregion
41
+ //#region src/credential-offer/z-credential-offer.ts
42
+ const zTxCode = zod.default.object({
43
+ input_mode: zod.default.union([zod.default.literal("numeric"), zod.default.literal("text")]).optional(),
44
+ length: zod.default.number().int().optional(),
45
+ description: zod.default.string().max(300).optional()
74
46
  }).passthrough();
75
- var zCredentialOfferGrants = import_zod.default.object({
76
- authorization_code: import_zod.default.object({
77
- issuer_state: import_zod.default.string().optional(),
78
- authorization_server: import_utils.zHttpsUrl.optional()
79
- }).passthrough().optional(),
80
- [import_oauth2.preAuthorizedCodeGrantIdentifier]: import_zod.default.object({
81
- "pre-authorized_code": import_zod.default.string(),
82
- tx_code: zTxCode.optional(),
83
- authorization_server: import_utils.zHttpsUrl.optional()
84
- }).passthrough().optional()
47
+ const zCredentialOfferGrants = zod.default.object({
48
+ authorization_code: zod.default.object({
49
+ issuer_state: zod.default.string().optional(),
50
+ authorization_server: __openid4vc_utils.zHttpsUrl.optional()
51
+ }).passthrough().optional(),
52
+ [__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier]: zod.default.object({
53
+ "pre-authorized_code": zod.default.string(),
54
+ tx_code: zTxCode.optional(),
55
+ authorization_server: __openid4vc_utils.zHttpsUrl.optional()
56
+ }).passthrough().optional()
85
57
  }).passthrough();
86
- var zCredentialOfferObjectDraft14 = import_zod.default.object({
87
- credential_issuer: import_utils.zHttpsUrl,
88
- credential_configuration_ids: import_zod.default.array(import_zod.default.string()),
89
- grants: import_zod.default.optional(zCredentialOfferGrants)
58
+ const zCredentialOfferObjectDraft14 = zod.default.object({
59
+ credential_issuer: __openid4vc_utils.zHttpsUrl,
60
+ credential_configuration_ids: zod.default.array(zod.default.string()),
61
+ grants: zod.default.optional(zCredentialOfferGrants)
90
62
  }).passthrough();
91
- var zCredentialOfferObjectDraft11To14 = import_zod.default.object({
92
- credential_issuer: import_utils.zHttpsUrl,
93
- // We don't support the inline offer objects from draft 11
94
- credentials: import_zod.default.array(
95
- import_zod.default.string({ message: "Only string credential identifiers are supported for draft 11 credential offers" })
96
- ),
97
- grants: import_zod.default.optional(
98
- import_zod.default.object({
99
- // Has extra param in draft 14, but doesn't matter for transform purposes
100
- authorization_code: zCredentialOfferGrants.shape.authorization_code,
101
- [import_oauth2.preAuthorizedCodeGrantIdentifier]: import_zod.default.object({
102
- "pre-authorized_code": import_zod.default.string(),
103
- user_pin_required: import_zod.default.optional(import_zod.default.boolean())
104
- }).passthrough().optional()
105
- })
106
- )
107
- }).passthrough().transform(({ credentials, grants, ...rest }) => {
108
- const v14 = {
109
- ...rest,
110
- credential_configuration_ids: credentials
111
- };
112
- if (grants) {
113
- v14.grants = { ...grants };
114
- if (grants[import_oauth2.preAuthorizedCodeGrantIdentifier]) {
115
- const { user_pin_required, ...restGrants } = grants[import_oauth2.preAuthorizedCodeGrantIdentifier];
116
- v14.grants[import_oauth2.preAuthorizedCodeGrantIdentifier] = {
117
- ...restGrants
118
- };
119
- if (user_pin_required) {
120
- v14.grants[import_oauth2.preAuthorizedCodeGrantIdentifier].tx_code = {
121
- input_mode: "text"
122
- };
123
- }
124
- }
125
- }
126
- return v14;
63
+ const zCredentialOfferObjectDraft11To14 = zod.default.object({
64
+ credential_issuer: __openid4vc_utils.zHttpsUrl,
65
+ credentials: zod.default.array(zod.default.string({ message: "Only string credential identifiers are supported for draft 11 credential offers" })),
66
+ grants: zod.default.optional(zod.default.object({
67
+ authorization_code: zCredentialOfferGrants.shape.authorization_code,
68
+ [__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier]: zod.default.object({
69
+ "pre-authorized_code": zod.default.string(),
70
+ user_pin_required: zod.default.optional(zod.default.boolean())
71
+ }).passthrough().optional()
72
+ }))
73
+ }).passthrough().transform(({ credentials, grants,...rest }) => {
74
+ const v14 = {
75
+ ...rest,
76
+ credential_configuration_ids: credentials
77
+ };
78
+ if (grants) {
79
+ v14.grants = { ...grants };
80
+ if (grants[__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier]) {
81
+ const { user_pin_required,...restGrants } = grants[__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier];
82
+ v14.grants[__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier] = { ...restGrants };
83
+ if (user_pin_required) v14.grants[__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier].tx_code = { input_mode: "text" };
84
+ }
85
+ }
86
+ return v14;
127
87
  }).pipe(zCredentialOfferObjectDraft14);
128
- var zCredentialOfferObject = import_zod.default.union([
129
- // First prioritize draft 14 (and 13)
130
- zCredentialOfferObjectDraft14,
131
- // Then try parsing draft 11 and transform into draft 14
132
- zCredentialOfferObjectDraft11To14
133
- ]);
88
+ const zCredentialOfferObject = zod.default.union([zCredentialOfferObjectDraft14, zCredentialOfferObjectDraft11To14]);
134
89
 
135
- // src/credential-offer/credential-offer.ts
90
+ //#endregion
91
+ //#region src/credential-offer/credential-offer.ts
92
+ /**
93
+ * Resolve a credential offer, optionally fetching it if the credential_offer_uri is provided.
94
+ */
136
95
  async function resolveCredentialOffer(credentialOffer, options) {
137
- const parsedQueryParams = (0, import_utils2.getQueryParams)(credentialOffer);
138
- let credentialOfferParseResult;
139
- if (parsedQueryParams.credential_offer_uri) {
140
- const fetchWithZod = (0, import_utils2.createZodFetcher)(options?.fetch);
141
- const { response, result } = await fetchWithZod(
142
- zCredentialOfferObject,
143
- import_utils2.ContentType.Json,
144
- parsedQueryParams.credential_offer_uri
145
- );
146
- if (!response.ok || !result) {
147
- throw new import_oauth22.InvalidFetchResponseError(
148
- `Fetching credential offer from '${parsedQueryParams.credential_offer_uri}' resulted in an unsuccessful response with status '${response.status}'`,
149
- await response.clone().text(),
150
- response
151
- );
152
- }
153
- credentialOfferParseResult = result;
154
- } else if (parsedQueryParams.credential_offer) {
155
- let credentialOfferJson;
156
- try {
157
- credentialOfferJson = JSON.parse(decodeURIComponent(parsedQueryParams.credential_offer));
158
- } catch (error) {
159
- throw new import_oauth22.Oauth2Error(`Error parsing JSON from 'credential_offer' param in credential offer '${credentialOffer}'`);
160
- }
161
- credentialOfferParseResult = zCredentialOfferObject.safeParse(credentialOfferJson);
162
- } else {
163
- throw new import_oauth22.Oauth2Error(`Credential offer did not contain either 'credential_offer' or 'credential_offer_uri' param.`);
164
- }
165
- if (credentialOfferParseResult.error) {
166
- throw new import_utils2.ValidationError(
167
- `Error parsing credential offer in draft 11, 13 or 14 format extracted from credential offer '${credentialOffer}'`,
168
- credentialOfferParseResult.error
169
- );
170
- }
171
- return credentialOfferParseResult.data;
96
+ const parsedQueryParams = (0, __openid4vc_utils.getQueryParams)(credentialOffer);
97
+ let credentialOfferParseResult;
98
+ if (parsedQueryParams.credential_offer_uri) {
99
+ const { response, result } = await (0, __openid4vc_utils.createZodFetcher)(options?.fetch)(zCredentialOfferObject, __openid4vc_utils.ContentType.Json, parsedQueryParams.credential_offer_uri);
100
+ if (!response.ok || !result) throw new __openid4vc_oauth2.InvalidFetchResponseError(`Fetching credential offer from '${parsedQueryParams.credential_offer_uri}' resulted in an unsuccessful response with status '${response.status}'`, await response.clone().text(), response);
101
+ credentialOfferParseResult = result;
102
+ } else if (parsedQueryParams.credential_offer) {
103
+ let credentialOfferJson;
104
+ try {
105
+ credentialOfferJson = JSON.parse(decodeURIComponent(parsedQueryParams.credential_offer));
106
+ } catch (_error) {
107
+ throw new __openid4vc_oauth2.Oauth2Error(`Error parsing JSON from 'credential_offer' param in credential offer '${credentialOffer}'`);
108
+ }
109
+ credentialOfferParseResult = zCredentialOfferObject.safeParse(credentialOfferJson);
110
+ } else throw new __openid4vc_oauth2.Oauth2Error(`Credential offer did not contain either 'credential_offer' or 'credential_offer_uri' param.`);
111
+ if (credentialOfferParseResult.error) throw new __openid4vc_utils.ValidationError(`Error parsing credential offer in draft 11, 13 or 14 format extracted from credential offer '${credentialOffer}'`, credentialOfferParseResult.error);
112
+ return credentialOfferParseResult.data;
172
113
  }
173
114
  function determineAuthorizationServerForCredentialOffer(options) {
174
- const authorizationServers = options.issuerMetadata.credentialIssuer.authorization_servers;
175
- let authorizationServer;
176
- if (options.grantAuthorizationServer) {
177
- authorizationServer = options.grantAuthorizationServer;
178
- if (!authorizationServers) {
179
- throw new import_oauth22.Oauth2Error(
180
- `Credential offer grant contains 'authorization_server' with value '${options.grantAuthorizationServer}' but credential issuer metadata does not have an 'authorization_servers' property to match the value against.`
181
- );
182
- }
183
- if (!authorizationServers.includes(authorizationServer)) {
184
- throw new import_oauth22.Oauth2Error(
185
- `Credential offer grant contains 'authorization_server' with value '${options.grantAuthorizationServer}' but credential issuer metadata does not include this authorization server. Available 'authorization_server' values are ${authorizationServers.join(", ")}.`
186
- );
187
- }
188
- } else if (!authorizationServers) {
189
- authorizationServer = options.issuerMetadata.credentialIssuer.credential_issuer;
190
- } else {
191
- if (authorizationServers.length === 0) {
192
- throw new import_oauth22.Oauth2Error(`Credential issuer metadata has 'authorization_servers' value with length of 0`);
193
- }
194
- if (authorizationServers.length > 1) {
195
- throw new import_oauth22.Oauth2Error(
196
- `Credential issuer metadata has 'authorization_server' with multiple entries, but the credential offer grant did not specify which authorization server to use.`
197
- );
198
- }
199
- authorizationServer = authorizationServers[0];
200
- }
201
- return authorizationServer;
115
+ const authorizationServers = options.issuerMetadata.credentialIssuer.authorization_servers;
116
+ let authorizationServer;
117
+ if (options.grantAuthorizationServer) {
118
+ authorizationServer = options.grantAuthorizationServer;
119
+ if (!authorizationServers) throw new __openid4vc_oauth2.Oauth2Error(`Credential offer grant contains 'authorization_server' with value '${options.grantAuthorizationServer}' but credential issuer metadata does not have an 'authorization_servers' property to match the value against.`);
120
+ if (!authorizationServers.includes(authorizationServer)) throw new __openid4vc_oauth2.Oauth2Error(`Credential offer grant contains 'authorization_server' with value '${options.grantAuthorizationServer}' but credential issuer metadata does not include this authorization server. Available 'authorization_server' values are ${authorizationServers.join(", ")}.`);
121
+ } else if (!authorizationServers) authorizationServer = options.issuerMetadata.credentialIssuer.credential_issuer;
122
+ else {
123
+ if (authorizationServers.length === 0) throw new __openid4vc_oauth2.Oauth2Error(`Credential issuer metadata has 'authorization_servers' value with length of 0`);
124
+ if (authorizationServers.length > 1) throw new __openid4vc_oauth2.Oauth2Error(`Credential issuer metadata has 'authorization_server' with multiple entries, but the credential offer grant did not specify which authorization server to use.`);
125
+ authorizationServer = authorizationServers[0];
126
+ }
127
+ return authorizationServer;
202
128
  }
203
129
  async function createCredentialOffer(options) {
204
- const {
205
- [import_oauth22.preAuthorizedCodeGrantIdentifier]: preAuthorizedCodeGrant,
206
- [import_oauth22.authorizationCodeGrantIdentifier]: authorizationCodeGrant,
207
- ...restGrants
208
- } = options.grants;
209
- const grants = { ...restGrants };
210
- if (authorizationCodeGrant) {
211
- determineAuthorizationServerForCredentialOffer({
212
- issuerMetadata: options.issuerMetadata,
213
- grantAuthorizationServer: authorizationCodeGrant.authorization_server
214
- });
215
- grants[import_oauth22.authorizationCodeGrantIdentifier] = authorizationCodeGrant;
216
- }
217
- if (preAuthorizedCodeGrant) {
218
- determineAuthorizationServerForCredentialOffer({
219
- issuerMetadata: options.issuerMetadata,
220
- grantAuthorizationServer: preAuthorizedCodeGrant.authorization_server
221
- });
222
- grants[import_oauth22.preAuthorizedCodeGrantIdentifier] = {
223
- ...preAuthorizedCodeGrant,
224
- "pre-authorized_code": preAuthorizedCodeGrant["pre-authorized_code"] ?? (0, import_utils2.encodeToBase64Url)(await options.callbacks.generateRandom(32))
225
- };
226
- const txCode = grants[import_oauth22.preAuthorizedCodeGrantIdentifier].tx_code;
227
- if (txCode && options.issuerMetadata.originalDraftVersion === "Draft11" /* Draft11 */) {
228
- grants[import_oauth22.preAuthorizedCodeGrantIdentifier].user_pin_required = txCode !== void 0;
229
- }
230
- }
231
- const idsNotInMetadata = options.credentialConfigurationIds.filter(
232
- (id) => options.issuerMetadata.credentialIssuer.credential_configurations_supported[id] === void 0
233
- );
234
- if (idsNotInMetadata.length > 0) {
235
- throw new import_oauth22.Oauth2Error(
236
- `Credential configuration ids ${idsNotInMetadata} not found in the credential issuer metadata 'credential_configurations_supported'. Available ids are ${Object.keys(options.issuerMetadata.credentialIssuer.credential_configurations_supported).join(", ")}.`
237
- );
238
- }
239
- const credentialOfferScheme = options.credentialOfferScheme ?? "openid-credential-offer://";
240
- const credentialOfferObject = (0, import_utils2.parseWithErrorHandling)(zCredentialOfferObject, {
241
- credential_issuer: options.issuerMetadata.credentialIssuer.credential_issuer,
242
- credential_configuration_ids: options.credentialConfigurationIds,
243
- grants,
244
- ...options.additionalPayload
245
- });
246
- if (options.issuerMetadata.originalDraftVersion === "Draft11" /* Draft11 */) {
247
- credentialOfferObject.credentials = credentialOfferObject.credential_configuration_ids;
248
- }
249
- const url = new import_utils2.URL(credentialOfferScheme);
250
- url.search = `?${new import_utils2.URLSearchParams([
251
- ...url.searchParams.entries(),
252
- ...(0, import_utils2.objectToQueryParams)({
253
- credential_offer_uri: options.credentialOfferUri,
254
- // Only add credential_offer is uri is undefined
255
- credential_offer: options.credentialOfferUri ? void 0 : credentialOfferObject
256
- }).entries()
257
- ]).toString()}`;
258
- return {
259
- credentialOffer: url.toString(),
260
- credentialOfferObject
261
- };
130
+ const { [__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier]: preAuthorizedCodeGrant, [__openid4vc_oauth2.authorizationCodeGrantIdentifier]: authorizationCodeGrant,...restGrants } = options.grants;
131
+ const grants = { ...restGrants };
132
+ if (authorizationCodeGrant) {
133
+ determineAuthorizationServerForCredentialOffer({
134
+ issuerMetadata: options.issuerMetadata,
135
+ grantAuthorizationServer: authorizationCodeGrant.authorization_server
136
+ });
137
+ grants[__openid4vc_oauth2.authorizationCodeGrantIdentifier] = authorizationCodeGrant;
138
+ }
139
+ if (preAuthorizedCodeGrant) {
140
+ determineAuthorizationServerForCredentialOffer({
141
+ issuerMetadata: options.issuerMetadata,
142
+ grantAuthorizationServer: preAuthorizedCodeGrant.authorization_server
143
+ });
144
+ grants[__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier] = {
145
+ ...preAuthorizedCodeGrant,
146
+ "pre-authorized_code": preAuthorizedCodeGrant["pre-authorized_code"] ?? (0, __openid4vc_utils.encodeToBase64Url)(await options.callbacks.generateRandom(32))
147
+ };
148
+ const txCode = grants[__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier].tx_code;
149
+ if (txCode && options.issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft11) grants[__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier].user_pin_required = txCode !== void 0;
150
+ }
151
+ const idsNotInMetadata = options.credentialConfigurationIds.filter((id) => options.issuerMetadata.credentialIssuer.credential_configurations_supported[id] === void 0);
152
+ if (idsNotInMetadata.length > 0) throw new __openid4vc_oauth2.Oauth2Error(`Credential configuration ids ${idsNotInMetadata} not found in the credential issuer metadata 'credential_configurations_supported'. Available ids are ${Object.keys(options.issuerMetadata.credentialIssuer.credential_configurations_supported).join(", ")}.`);
153
+ const credentialOfferScheme = options.credentialOfferScheme ?? "openid-credential-offer://";
154
+ const credentialOfferObject = (0, __openid4vc_utils.parseWithErrorHandling)(zCredentialOfferObject, {
155
+ credential_issuer: options.issuerMetadata.credentialIssuer.credential_issuer,
156
+ credential_configuration_ids: options.credentialConfigurationIds,
157
+ grants,
158
+ ...options.additionalPayload
159
+ });
160
+ if (options.issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft11) credentialOfferObject.credentials = credentialOfferObject.credential_configuration_ids;
161
+ const url = new __openid4vc_utils.URL(credentialOfferScheme);
162
+ url.search = `?${new __openid4vc_utils.URLSearchParams([...url.searchParams.entries(), ...(0, __openid4vc_utils.objectToQueryParams)({
163
+ credential_offer_uri: options.credentialOfferUri,
164
+ credential_offer: options.credentialOfferUri ? void 0 : credentialOfferObject
165
+ }).entries()]).toString()}`;
166
+ return {
167
+ credentialOffer: url.toString(),
168
+ credentialOfferObject
169
+ };
262
170
  }
263
171
 
264
- // src/index.ts
265
- var import_utils22 = require("@openid4vc/utils");
266
-
267
- // src/credential-request/credential-request-configurations.ts
268
- var import_utils6 = require("@openid4vc/utils");
269
-
270
- // src/metadata/credential-issuer/credential-issuer-metadata.ts
271
- var import_oauth25 = require("@openid4vc/oauth2");
272
- var import_utils5 = require("@openid4vc/utils");
273
-
274
- // src/metadata/credential-issuer/z-credential-issuer-metadata.ts
275
- var import_oauth24 = require("@openid4vc/oauth2");
276
- var import_utils4 = require("@openid4vc/utils");
277
- var import_zod13 = __toESM(require("zod"));
278
-
279
- // src/formats/credential/mso-mdoc/z-mso-mdoc.ts
280
- var import_zod5 = __toESM(require("zod"));
281
-
282
- // src/metadata/credential-issuer/z-claims-description.ts
283
- var import_zod2 = __toESM(require("zod"));
284
- var zCredentialConfigurationSupportedClaimsDraft14 = import_zod2.default.object({
285
- mandatory: import_zod2.default.boolean().optional(),
286
- value_type: import_zod2.default.string().optional(),
287
- display: import_zod2.default.object({
288
- name: import_zod2.default.string().optional(),
289
- locale: import_zod2.default.string().optional()
290
- }).passthrough().optional()
172
+ //#endregion
173
+ //#region src/metadata/credential-issuer/z-claims-description.ts
174
+ const zCredentialConfigurationSupportedClaimsDescriptionDraft14 = zod.default.object({
175
+ mandatory: zod.default.boolean().optional(),
176
+ value_type: zod.default.string().optional(),
177
+ display: zod.default.array(zod.default.object({
178
+ name: zod.default.string().optional(),
179
+ locale: zod.default.string().optional()
180
+ }).passthrough()).optional()
291
181
  }).passthrough();
292
- var zClaimsDescriptionPath = import_zod2.default.array(import_zod2.default.union([import_zod2.default.string(), import_zod2.default.number().int().nonnegative(), import_zod2.default.null()])).nonempty();
293
- var zMsoMdocClaimsDescriptionPath = import_zod2.default.tuple([import_zod2.default.string(), import_zod2.default.string()], {
294
- message: "mso_mdoc claims description path MUST be an array with exactly two string elements, pointing to the namespace and element identifier within an mdoc credential"
295
- });
296
- var zIssuerMetadataClaimsDescription = import_zod2.default.object({
297
- path: zClaimsDescriptionPath,
298
- mandatory: import_zod2.default.boolean().optional(),
299
- display: import_zod2.default.array(
300
- import_zod2.default.object({
301
- name: import_zod2.default.string().optional(),
302
- locale: import_zod2.default.string().optional()
303
- }).passthrough()
304
- ).optional()
182
+ const zCredentialConfigurationSupportedClaimsDraft14 = zod.default.record(zod.default.string(), zod.default.union([zCredentialConfigurationSupportedClaimsDescriptionDraft14, zod.default.lazy(() => zCredentialConfigurationSupportedClaimsDraft14)]));
183
+ const zClaimsDescriptionPath = zod.default.array(zod.default.union([
184
+ zod.default.string(),
185
+ zod.default.number().int().nonnegative(),
186
+ zod.default.null()
187
+ ])).nonempty();
188
+ const zMsoMdocClaimsDescriptionPath = zod.default.tuple([zod.default.string(), zod.default.string()], { message: "mso_mdoc claims description path MUST be an array with exactly two string elements, pointing to the namespace and element identifier within an mdoc credential" });
189
+ const zIssuerMetadataClaimsDescription = zod.default.object({
190
+ path: zClaimsDescriptionPath,
191
+ mandatory: zod.default.boolean().optional(),
192
+ display: zod.default.array(zod.default.object({
193
+ name: zod.default.string().optional(),
194
+ locale: zod.default.string().optional()
195
+ }).passthrough()).optional()
305
196
  }).passthrough();
306
- var zMsoMdocIssuerMetadataClaimsDescription = zIssuerMetadataClaimsDescription.extend({
307
- path: zMsoMdocClaimsDescriptionPath
308
- });
309
-
310
- // src/metadata/credential-issuer/z-credential-configuration-supported-common.ts
311
- var import_zod4 = __toESM(require("zod"));
197
+ const zMsoMdocIssuerMetadataClaimsDescription = zIssuerMetadataClaimsDescription.extend({ path: zMsoMdocClaimsDescriptionPath });
312
198
 
313
- // src/key-attestation/z-key-attestation.ts
314
- var import_oauth23 = require("@openid4vc/oauth2");
315
- var import_utils3 = require("@openid4vc/utils");
316
- var import_zod3 = __toESM(require("zod"));
317
- var zKeyAttestationJwtHeader = import_zod3.default.object({
318
- ...import_oauth23.zJwtHeader.shape,
319
- typ: import_zod3.default.literal("keyattestation+jwt").or(
320
- // Draft 16
321
- import_zod3.default.literal("key-attestation+jwt")
322
- )
323
- }).passthrough().refine(({ kid, jwk }) => jwk === void 0 || kid === void 0, {
324
- message: `Both 'jwk' and 'kid' are defined. Only one is allowed`
325
- }).refine(({ trust_chain, kid }) => !trust_chain || !kid, {
326
- message: `When 'trust_chain' is provided, 'kid' is required`
327
- });
328
- var zIso18045 = import_zod3.default.enum(["iso_18045_high", "iso_18045_moderate", "iso_18045_enhanced-basic", "iso_18045_basic"]);
329
- var zIso18045OrStringArray = import_zod3.default.array(import_zod3.default.union([zIso18045, import_zod3.default.string()]));
330
- var zKeyAttestationJwtPayload = import_zod3.default.object({
331
- ...import_oauth23.zJwtPayload.shape,
332
- iat: import_utils3.zInteger,
333
- attested_keys: import_zod3.default.array(import_oauth23.zJwk),
334
- key_storage: import_zod3.default.optional(zIso18045OrStringArray),
335
- user_authentication: import_zod3.default.optional(zIso18045OrStringArray),
336
- certification: import_zod3.default.optional(import_zod3.default.string().url())
199
+ //#endregion
200
+ //#region src/key-attestation/z-key-attestation.ts
201
+ const zKeyAttestationJwtHeader = zod.default.object({
202
+ ...__openid4vc_oauth2.zJwtHeader.shape,
203
+ typ: zod.default.literal("keyattestation+jwt").or(zod.default.literal("key-attestation+jwt"))
204
+ }).passthrough().refine(({ kid, jwk }) => jwk === void 0 || kid === void 0, { message: `Both 'jwk' and 'kid' are defined. Only one is allowed` }).refine(({ trust_chain, kid }) => !trust_chain || !kid, { message: `When 'trust_chain' is provided, 'kid' is required` });
205
+ const zIso18045 = zod.default.enum([
206
+ "iso_18045_high",
207
+ "iso_18045_moderate",
208
+ "iso_18045_enhanced-basic",
209
+ "iso_18045_basic"
210
+ ]);
211
+ const zIso18045OrStringArray = zod.default.array(zod.default.union([zIso18045, zod.default.string()]));
212
+ const zKeyAttestationJwtPayload = zod.default.object({
213
+ ...__openid4vc_oauth2.zJwtPayload.shape,
214
+ iat: __openid4vc_utils.zInteger,
215
+ attested_keys: zod.default.array(__openid4vc_oauth2.zJwk),
216
+ key_storage: zod.default.optional(zIso18045OrStringArray),
217
+ user_authentication: zod.default.optional(zIso18045OrStringArray),
218
+ certification: zod.default.optional(zod.default.string().url())
337
219
  }).passthrough();
338
- var zKeyAttestationJwtPayloadForUse = (use) => import_zod3.default.object({
339
- ...zKeyAttestationJwtPayload.shape,
340
- // REQUIRED when used as proof_type.attesation directly
341
- nonce: use === "proof_type.attestation" ? import_zod3.default.string({
342
- message: `Nonce must be defined when key attestation is used as 'proof_type.attestation' directly`
343
- }) : import_zod3.default.optional(import_zod3.default.string()),
344
- // REQUIRED when used within header of proof_type.jwt
345
- exp: use === "proof_type.jwt" ? import_utils3.zInteger : import_zod3.default.optional(import_utils3.zInteger)
220
+ const zKeyAttestationJwtPayloadForUse = (use) => zod.default.object({
221
+ ...zKeyAttestationJwtPayload.shape,
222
+ nonce: use === "proof_type.attestation" ? zod.default.string({ message: `Nonce must be defined when key attestation is used as 'proof_type.attestation' directly` }) : zod.default.optional(zod.default.string()),
223
+ exp: use === "proof_type.jwt" ? __openid4vc_utils.zInteger : zod.default.optional(__openid4vc_utils.zInteger)
346
224
  }).passthrough();
347
225
 
348
- // src/metadata/credential-issuer/z-credential-configuration-supported-common.ts
349
- var zCredentialConfigurationSupportedDisplayEntry = import_zod4.default.object({
350
- name: import_zod4.default.string(),
351
- locale: import_zod4.default.string().optional(),
352
- logo: import_zod4.default.object({
353
- // FIXME: make required again, but need to support draft 11 first
354
- uri: import_zod4.default.string().optional(),
355
- alt_text: import_zod4.default.string().optional()
356
- }).passthrough().optional(),
357
- description: import_zod4.default.string().optional(),
358
- background_color: import_zod4.default.string().optional(),
359
- background_image: import_zod4.default.object({
360
- // TODO: should be required, but paradym's metadata is wrong here.
361
- uri: import_zod4.default.string().optional()
362
- }).passthrough().optional(),
363
- text_color: import_zod4.default.string().optional()
226
+ //#endregion
227
+ //#region src/metadata/credential-issuer/z-credential-configuration-supported-common.ts
228
+ const zCredentialConfigurationSupportedDisplayEntry = zod.default.object({
229
+ name: zod.default.string(),
230
+ locale: zod.default.string().optional(),
231
+ logo: zod.default.object({
232
+ uri: zod.default.string().optional(),
233
+ alt_text: zod.default.string().optional()
234
+ }).passthrough().optional(),
235
+ description: zod.default.string().optional(),
236
+ background_color: zod.default.string().optional(),
237
+ background_image: zod.default.object({ uri: zod.default.string().optional() }).passthrough().optional(),
238
+ text_color: zod.default.string().optional()
364
239
  }).passthrough();
365
- var zCredentialConfigurationSupportedCommonCredentialMetadata = import_zod4.default.object({
366
- display: import_zod4.default.array(zCredentialConfigurationSupportedDisplayEntry).optional()
367
- });
368
- var zCredentialConfigurationSupportedCommon = import_zod4.default.object({
369
- format: import_zod4.default.string(),
370
- scope: import_zod4.default.string().optional(),
371
- cryptographic_binding_methods_supported: import_zod4.default.array(import_zod4.default.string()).optional(),
372
- credential_signing_alg_values_supported: import_zod4.default.array(import_zod4.default.string()).or(import_zod4.default.array(import_zod4.default.number())).optional(),
373
- proof_types_supported: import_zod4.default.record(
374
- import_zod4.default.union([import_zod4.default.literal("jwt"), import_zod4.default.literal("attestation"), import_zod4.default.string()]),
375
- import_zod4.default.object({
376
- proof_signing_alg_values_supported: import_zod4.default.array(import_zod4.default.string()),
377
- key_attestations_required: import_zod4.default.object({
378
- key_storage: zIso18045OrStringArray.optional(),
379
- user_authentication: zIso18045OrStringArray.optional()
380
- }).passthrough().optional()
381
- })
382
- ).optional(),
383
- credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.optional(),
384
- // For typing purposes. Can be removed once we drop support for draft <= 15.
385
- claims: import_zod4.default.optional(import_zod4.default.never())
240
+ const zCredentialConfigurationSupportedCommonCredentialMetadata = zod.default.object({ display: zod.default.array(zCredentialConfigurationSupportedDisplayEntry).optional() });
241
+ const zCredentialConfigurationSupportedCommon = zod.default.object({
242
+ format: zod.default.string(),
243
+ scope: zod.default.string().optional(),
244
+ cryptographic_binding_methods_supported: zod.default.array(zod.default.string()).optional(),
245
+ credential_signing_alg_values_supported: zod.default.array(zod.default.string()).or(zod.default.array(zod.default.number())).optional(),
246
+ proof_types_supported: zod.default.record(zod.default.union([
247
+ zod.default.literal("jwt"),
248
+ zod.default.literal("attestation"),
249
+ zod.default.string()
250
+ ]), zod.default.object({
251
+ proof_signing_alg_values_supported: zod.default.array(zod.default.string()),
252
+ key_attestations_required: zod.default.object({
253
+ key_storage: zIso18045OrStringArray.optional(),
254
+ user_authentication: zIso18045OrStringArray.optional()
255
+ }).passthrough().optional()
256
+ })).optional(),
257
+ credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.optional(),
258
+ claims: zod.default.optional(zod.default.never())
386
259
  }).passthrough();
387
- var zCredentialConfigurationSupportedCommonDraft15 = import_zod4.default.object({
388
- format: import_zod4.default.string(),
389
- scope: import_zod4.default.string().optional(),
390
- cryptographic_binding_methods_supported: import_zod4.default.array(import_zod4.default.string()).optional(),
391
- credential_signing_alg_values_supported: import_zod4.default.array(import_zod4.default.string()).or(import_zod4.default.array(import_zod4.default.number())).optional(),
392
- proof_types_supported: import_zod4.default.record(
393
- import_zod4.default.union([import_zod4.default.literal("jwt"), import_zod4.default.literal("attestation"), import_zod4.default.string()]),
394
- import_zod4.default.object({
395
- proof_signing_alg_values_supported: import_zod4.default.array(import_zod4.default.string()),
396
- key_attestations_required: import_zod4.default.object({
397
- key_storage: zIso18045OrStringArray.optional(),
398
- user_authentication: zIso18045OrStringArray.optional()
399
- }).passthrough().optional()
400
- })
401
- ).optional(),
402
- display: import_zod4.default.array(zCredentialConfigurationSupportedDisplayEntry).optional(),
403
- // For typing purposes.
404
- credential_metadata: import_zod4.default.optional(import_zod4.default.never())
260
+ const zCredentialConfigurationSupportedCommonDraft15 = zod.default.object({
261
+ format: zod.default.string(),
262
+ scope: zod.default.string().optional(),
263
+ cryptographic_binding_methods_supported: zod.default.array(zod.default.string()).optional(),
264
+ credential_signing_alg_values_supported: zod.default.array(zod.default.string()).or(zod.default.array(zod.default.number())).optional(),
265
+ proof_types_supported: zod.default.record(zod.default.union([
266
+ zod.default.literal("jwt"),
267
+ zod.default.literal("attestation"),
268
+ zod.default.string()
269
+ ]), zod.default.object({
270
+ proof_signing_alg_values_supported: zod.default.array(zod.default.string()),
271
+ key_attestations_required: zod.default.object({
272
+ key_storage: zIso18045OrStringArray.optional(),
273
+ user_authentication: zIso18045OrStringArray.optional()
274
+ }).passthrough().optional()
275
+ })).optional(),
276
+ display: zod.default.array(zCredentialConfigurationSupportedDisplayEntry).optional(),
277
+ credential_metadata: zod.default.optional(zod.default.never())
405
278
  }).passthrough();
406
279
 
407
- // src/formats/credential/mso-mdoc/z-mso-mdoc.ts
408
- var zMsoMdocFormatIdentifier = import_zod5.default.literal("mso_mdoc");
409
- var zMsoMdocCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
410
- format: zMsoMdocFormatIdentifier,
411
- doctype: import_zod5.default.string(),
412
- credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({
413
- claims: import_zod5.default.array(zMsoMdocIssuerMetadataClaimsDescription).optional()
414
- }).optional()
280
+ //#endregion
281
+ //#region src/formats/credential/mso-mdoc/z-mso-mdoc.ts
282
+ const zMsoMdocFormatIdentifier = zod.default.literal("mso_mdoc");
283
+ const zMsoMdocCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
284
+ format: zMsoMdocFormatIdentifier,
285
+ doctype: zod.default.string(),
286
+ credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({ claims: zod.default.array(zMsoMdocIssuerMetadataClaimsDescription).optional() }).optional()
415
287
  });
416
- var zMsoMdocCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
417
- format: zMsoMdocFormatIdentifier,
418
- doctype: import_zod5.default.string(),
419
- claims: import_zod5.default.array(zMsoMdocIssuerMetadataClaimsDescription).optional()
288
+ const zMsoMdocCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
289
+ format: zMsoMdocFormatIdentifier,
290
+ doctype: zod.default.string(),
291
+ claims: zod.default.array(zMsoMdocIssuerMetadataClaimsDescription).optional()
420
292
  });
421
- var zMsoMdocCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
422
- format: zMsoMdocFormatIdentifier,
423
- doctype: import_zod5.default.string(),
424
- claims: zCredentialConfigurationSupportedClaimsDraft14.optional(),
425
- order: import_zod5.default.optional(import_zod5.default.array(import_zod5.default.string()))
293
+ const zMsoMdocCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
294
+ format: zMsoMdocFormatIdentifier,
295
+ doctype: zod.default.string(),
296
+ claims: zCredentialConfigurationSupportedClaimsDraft14.optional(),
297
+ order: zod.default.optional(zod.default.array(zod.default.string()))
426
298
  });
427
- var zMsoMdocCredentialRequestFormatDraft14 = import_zod5.default.object({
428
- format: zMsoMdocFormatIdentifier,
429
- doctype: import_zod5.default.string(),
430
- // Format based request is removed in Draft 15, so only old claims syntax supported.
431
- claims: import_zod5.default.optional(zCredentialConfigurationSupportedClaimsDraft14)
299
+ const zMsoMdocCredentialRequestFormatDraft14 = zod.default.object({
300
+ format: zMsoMdocFormatIdentifier,
301
+ doctype: zod.default.string(),
302
+ claims: zCredentialConfigurationSupportedClaimsDraft14.optional()
432
303
  });
433
304
 
434
- // src/formats/credential/sd-jwt-vc/z-sd-jwt-vc.ts
435
- var import_zod6 = __toESM(require("zod"));
436
- var zLegacySdJwtVcFormatIdentifier = import_zod6.default.literal("vc+sd-jwt");
437
- var zLegacySdJwtVcCredentialIssuerMetadataDraft16 = zCredentialConfigurationSupportedCommon.extend({
438
- vct: import_zod6.default.string(),
439
- format: zLegacySdJwtVcFormatIdentifier,
440
- order: import_zod6.default.optional(import_zod6.default.array(import_zod6.default.string())),
441
- credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({
442
- claims: import_zod6.default.array(zCredentialConfigurationSupportedClaimsDraft14).optional()
443
- }).optional(),
444
- credential_definition: import_zod6.default.optional(import_zod6.default.never())
305
+ //#endregion
306
+ //#region src/formats/credential/sd-jwt-dc/z-sd-jwt-dc.ts
307
+ const zSdJwtDcFormatIdentifier = zod.default.literal("dc+sd-jwt");
308
+ const zSdJwtDcCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
309
+ vct: zod.default.string(),
310
+ format: zSdJwtDcFormatIdentifier,
311
+ credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({ claims: zod.default.array(zIssuerMetadataClaimsDescription).optional() }).optional()
445
312
  });
446
- var zLegacySdJwtVcCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
447
- vct: import_zod6.default.string(),
448
- format: zLegacySdJwtVcFormatIdentifier,
449
- claims: import_zod6.default.optional(zCredentialConfigurationSupportedClaimsDraft14),
450
- order: import_zod6.default.optional(import_zod6.default.array(import_zod6.default.string())),
451
- credential_definition: import_zod6.default.optional(import_zod6.default.never())
452
- });
453
- var zLegacySdJwtVcCredentialRequestFormatDraft14 = import_zod6.default.object({
454
- format: zLegacySdJwtVcFormatIdentifier,
455
- vct: import_zod6.default.string(),
456
- claims: import_zod6.default.optional(zCredentialConfigurationSupportedClaimsDraft14),
457
- credential_definition: import_zod6.default.optional(import_zod6.default.never())
313
+ const zSdJwtDcCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
314
+ vct: zod.default.string(),
315
+ format: zSdJwtDcFormatIdentifier,
316
+ claims: zod.default.array(zIssuerMetadataClaimsDescription).optional()
458
317
  });
459
318
 
460
- // src/formats/credential/sd-jwt-dc/z-sd-jwt-dc.ts
461
- var import_zod7 = __toESM(require("zod"));
462
- var zSdJwtDcFormatIdentifier = import_zod7.default.literal("dc+sd-jwt");
463
- var zSdJwtDcCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
464
- vct: import_zod7.default.string(),
465
- format: zSdJwtDcFormatIdentifier,
466
- credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({
467
- claims: import_zod7.default.array(zIssuerMetadataClaimsDescription).optional()
468
- }).optional()
319
+ //#endregion
320
+ //#region src/formats/credential/sd-jwt-vc/z-sd-jwt-vc.ts
321
+ /**
322
+ * @deprecated format has been deprecated in favor of "dc+sd-jwt" since Draft 23
323
+ * of the OpenID for Verifiable Presentations specification. Please update your
324
+ * implementations accordingly.
325
+ */
326
+ const zLegacySdJwtVcFormatIdentifier = zod.default.literal("vc+sd-jwt");
327
+ /**
328
+ * @deprecated format has been deprecated in favor of "dc+sd-jwt" since Draft 23
329
+ * of the OpenID for Verifiable Presentations specification. Please update your
330
+ * implementations accordingly.
331
+ */
332
+ const zLegacySdJwtVcCredentialIssuerMetadataDraft16 = zCredentialConfigurationSupportedCommon.extend({
333
+ vct: zod.default.string(),
334
+ format: zLegacySdJwtVcFormatIdentifier,
335
+ order: zod.default.optional(zod.default.array(zod.default.string())),
336
+ credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({ claims: zod.default.array(zIssuerMetadataClaimsDescription).optional() }).optional(),
337
+ credential_definition: zod.default.optional(zod.default.never())
469
338
  });
470
- var zSdJwtDcCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
471
- vct: import_zod7.default.string(),
472
- format: zSdJwtDcFormatIdentifier,
473
- claims: import_zod7.default.array(zIssuerMetadataClaimsDescription).optional()
339
+ /**
340
+ * @deprecated format has been deprecated in favor of "dc+sd-jwt" since Draft 23
341
+ * of the OpenID for Verifiable Presentations specification. Please update your
342
+ * implementations accordingly.
343
+ */
344
+ const zLegacySdJwtVcCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
345
+ vct: zod.default.string(),
346
+ format: zLegacySdJwtVcFormatIdentifier,
347
+ claims: zod.default.optional(zCredentialConfigurationSupportedClaimsDraft14),
348
+ order: zod.default.optional(zod.default.array(zod.default.string())),
349
+ credential_definition: zod.default.optional(zod.default.never())
350
+ });
351
+ /**
352
+ * @deprecated format has been deprecated in favor of "dc+sd-jwt" since Draft 23
353
+ * of the OpenID for Verifiable Presentations specification. Please update your
354
+ * implementations accordingly.
355
+ */
356
+ const zLegacySdJwtVcCredentialRequestFormatDraft14 = zod.default.object({
357
+ format: zLegacySdJwtVcFormatIdentifier,
358
+ vct: zod.default.string(),
359
+ claims: zod.default.optional(zCredentialConfigurationSupportedClaimsDraft14),
360
+ credential_definition: zod.default.optional(zod.default.never())
474
361
  });
475
362
 
476
- // src/formats/credential/w3c-vc/z-w3c-ldp-vc.ts
477
- var import_zod9 = __toESM(require("zod"));
478
-
479
- // src/formats/credential/w3c-vc/z-w3c-vc-common.ts
480
- var import_zod8 = __toESM(require("zod"));
481
- var zCredentialSubjectLeafTypeDraft14 = import_zod8.default.object({
482
- mandatory: import_zod8.default.boolean().optional(),
483
- value_type: import_zod8.default.string().optional(),
484
- display: import_zod8.default.array(
485
- import_zod8.default.object({
486
- name: import_zod8.default.string().optional(),
487
- locale: import_zod8.default.string().optional()
488
- }).passthrough()
489
- ).optional()
363
+ //#endregion
364
+ //#region src/formats/credential/w3c-vc/z-w3c-vc-common.ts
365
+ const zCredentialSubjectLeafTypeDraft14 = zod.default.object({
366
+ mandatory: zod.default.boolean().optional(),
367
+ value_type: zod.default.string().optional(),
368
+ display: zod.default.array(zod.default.object({
369
+ name: zod.default.string().optional(),
370
+ locale: zod.default.string().optional()
371
+ }).passthrough()).optional()
490
372
  }).passthrough();
491
- var zClaimValueSchemaDraft14 = import_zod8.default.union([
492
- import_zod8.default.array(import_zod8.default.any()),
493
- import_zod8.default.record(import_zod8.default.string(), import_zod8.default.any()),
494
- zCredentialSubjectLeafTypeDraft14
373
+ const zClaimValueSchemaDraft14 = zod.default.union([
374
+ zod.default.array(zod.default.any()),
375
+ zod.default.record(zod.default.string(), zod.default.any()),
376
+ zCredentialSubjectLeafTypeDraft14
495
377
  ]);
496
- var zW3cVcCredentialSubjectDraft14 = import_zod8.default.record(import_zod8.default.string(), zClaimValueSchemaDraft14);
497
- var zW3cVcJsonLdCredentialDefinition = import_zod8.default.object({
498
- "@context": import_zod8.default.array(import_zod8.default.string()),
499
- type: import_zod8.default.array(import_zod8.default.string()).nonempty()
378
+ const zW3cVcCredentialSubjectDraft14 = zod.default.record(zod.default.string(), zClaimValueSchemaDraft14);
379
+ const zW3cVcJsonLdCredentialDefinition = zod.default.object({
380
+ "@context": zod.default.array(zod.default.string()),
381
+ type: zod.default.array(zod.default.string()).nonempty()
500
382
  }).passthrough();
501
- var zW3cVcJsonLdCredentialDefinitionDraft14 = zW3cVcJsonLdCredentialDefinition.extend({
502
- credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
503
- });
383
+ const zW3cVcJsonLdCredentialDefinitionDraft14 = zW3cVcJsonLdCredentialDefinition.extend({ credentialSubject: zW3cVcCredentialSubjectDraft14.optional() });
504
384
 
505
- // src/formats/credential/w3c-vc/z-w3c-ldp-vc.ts
506
- var zLdpVcFormatIdentifier = import_zod9.default.literal("ldp_vc");
507
- var zLdpVcCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
508
- format: zLdpVcFormatIdentifier,
509
- credential_definition: zW3cVcJsonLdCredentialDefinition,
510
- credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({
511
- claims: zIssuerMetadataClaimsDescription.optional()
512
- }).optional()
385
+ //#endregion
386
+ //#region src/formats/credential/w3c-vc/z-w3c-jwt-vc-json.ts
387
+ const zJwtVcJsonFormatIdentifier = zod.default.literal("jwt_vc_json");
388
+ const zJwtVcJsonCredentialDefinition = zod.default.object({ type: zod.default.array(zod.default.string()).nonempty() }).passthrough();
389
+ const zJwtVcJsonCredentialDefinitionDraft14 = zJwtVcJsonCredentialDefinition.extend({ credentialSubject: zW3cVcCredentialSubjectDraft14.optional() });
390
+ const zJwtVcJsonCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
391
+ format: zJwtVcJsonFormatIdentifier,
392
+ credential_definition: zJwtVcJsonCredentialDefinition,
393
+ credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({ claims: zod.default.array(zIssuerMetadataClaimsDescription).optional() }).optional()
513
394
  });
514
- var zLdpVcCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
515
- format: zLdpVcFormatIdentifier,
516
- credential_definition: zW3cVcJsonLdCredentialDefinition,
517
- claims: zIssuerMetadataClaimsDescription.optional()
395
+ const zJwtVcJsonCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
396
+ format: zJwtVcJsonFormatIdentifier,
397
+ credential_definition: zJwtVcJsonCredentialDefinition,
398
+ claims: zod.default.array(zIssuerMetadataClaimsDescription).optional()
518
399
  });
519
- var zLdpVcCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
520
- format: zLdpVcFormatIdentifier,
521
- credential_definition: zW3cVcJsonLdCredentialDefinitionDraft14,
522
- order: import_zod9.default.array(import_zod9.default.string()).optional()
400
+ const zJwtVcJsonCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
401
+ format: zJwtVcJsonFormatIdentifier,
402
+ credential_definition: zJwtVcJsonCredentialDefinitionDraft14,
403
+ order: zod.default.array(zod.default.string()).optional()
523
404
  });
524
- var zLdpVcCredentialIssuerMetadataDraft11 = import_zod9.default.object({
525
- order: import_zod9.default.array(import_zod9.default.string()).optional(),
526
- format: zLdpVcFormatIdentifier,
527
- // Credential definition was spread on top level instead of a separatey property in v11
528
- // As well as using types instead of type
529
- "@context": import_zod9.default.array(import_zod9.default.string()),
530
- types: import_zod9.default.array(import_zod9.default.string()),
531
- credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
405
+ const zJwtVcJsonCredentialIssuerMetadataDraft11 = zod.default.object({
406
+ format: zJwtVcJsonFormatIdentifier,
407
+ order: zod.default.array(zod.default.string()).optional(),
408
+ types: zod.default.array(zod.default.string()),
409
+ credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
532
410
  }).passthrough();
533
- var zLdpVcCredentialIssuerMetadataDraft11To14 = zLdpVcCredentialIssuerMetadataDraft11.transform(
534
- ({ "@context": context, types, credentialSubject, ...rest }) => ({
535
- ...rest,
536
- credential_definition: {
537
- "@context": context,
538
- type: types,
539
- // Prevent weird typing issue with optional vs undefined
540
- ...credentialSubject ? { credentialSubject } : {}
541
- }
542
- })
543
- );
544
- var zLdpVcCredentialIssuerMetadataDraft14To11 = zLdpVcCredentialIssuerMetadataDraft14.passthrough().transform(({ credential_definition: { type, ...credentialDefinition }, ...rest }) => ({
545
- ...rest,
546
- ...credentialDefinition,
547
- types: type
548
- })).pipe(zLdpVcCredentialIssuerMetadataDraft11);
549
- var zLdpVcCredentialRequestFormatDraft14 = import_zod9.default.object({
550
- format: zLdpVcFormatIdentifier,
551
- credential_definition: zW3cVcJsonLdCredentialDefinitionDraft14
411
+ const zJwtVcJsonCredentialIssuerMetadataDraft11To14 = zJwtVcJsonCredentialIssuerMetadataDraft11.transform(({ types, credentialSubject,...rest }) => ({
412
+ ...rest,
413
+ credential_definition: {
414
+ type: types,
415
+ ...credentialSubject ? { credentialSubject } : {}
416
+ }
417
+ }));
418
+ const zJwtVcJsonCredentialIssuerMetadataDraft14To11 = zJwtVcJsonCredentialIssuerMetadataDraft14.passthrough().transform(({ credential_definition: { type,...credentialDefinition },...rest }) => ({
419
+ ...rest,
420
+ types: type,
421
+ ...credentialDefinition
422
+ })).pipe(zJwtVcJsonCredentialIssuerMetadataDraft11);
423
+ const zJwtVcJsonCredentialRequestFormatDraft14 = zod.default.object({
424
+ format: zJwtVcJsonFormatIdentifier,
425
+ credential_definition: zJwtVcJsonCredentialDefinition
552
426
  });
553
- var zLdpVcCredentialRequestDraft11 = import_zod9.default.object({
554
- format: zLdpVcFormatIdentifier,
555
- credential_definition: import_zod9.default.object({
556
- "@context": import_zod9.default.array(import_zod9.default.string()),
557
- // credential_definition was using types instead of type in v11
558
- types: import_zod9.default.array(import_zod9.default.string()),
559
- credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
560
- })
427
+ const zJwtVcJsonCredentialRequestDraft11 = zod.default.object({
428
+ format: zJwtVcJsonFormatIdentifier,
429
+ types: zod.default.array(zod.default.string()),
430
+ credentialSubject: zod.default.optional(zW3cVcCredentialSubjectDraft14)
561
431
  }).passthrough();
562
- var zLdpVcCredentialRequestDraft11To14 = zLdpVcCredentialRequestDraft11.transform(
563
- ({ credential_definition: { types, ...restCredentialDefinition }, ...rest }) => ({
564
- ...rest,
565
- credential_definition: {
566
- ...restCredentialDefinition,
567
- type: types
568
- }
569
- })
570
- );
571
- var zLdpVcCredentialRequestDraft14To11 = zLdpVcCredentialRequestFormatDraft14.passthrough().transform(({ credential_definition: { type, ...restCredentialDefinition }, ...rest }) => ({
572
- ...rest,
573
- credential_definition: {
574
- ...restCredentialDefinition,
575
- types: type
576
- }
577
- })).pipe(zLdpVcCredentialRequestDraft11);
432
+ const zJwtVcJsonCredentialRequestDraft11To14 = zJwtVcJsonCredentialRequestDraft11.transform(({ types, credentialSubject,...rest }) => {
433
+ return {
434
+ ...rest,
435
+ credential_definition: {
436
+ type: types,
437
+ ...credentialSubject ? { credentialSubject } : {}
438
+ }
439
+ };
440
+ });
441
+ const zJwtVcJsonCredentialRequestDraft14To11 = zJwtVcJsonCredentialRequestFormatDraft14.passthrough().transform(({ credential_definition: { type,...credentialDefinition },...rest }) => ({
442
+ ...rest,
443
+ types: type,
444
+ ...credentialDefinition
445
+ })).pipe(zJwtVcJsonCredentialRequestDraft11);
578
446
 
579
- // src/formats/credential/w3c-vc/z-w3c-jwt-vc-json-ld.ts
580
- var import_zod10 = __toESM(require("zod"));
581
- var zJwtVcJsonLdFormatIdentifier = import_zod10.default.literal("jwt_vc_json-ld");
582
- var zJwtVcJsonLdCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
583
- format: zJwtVcJsonLdFormatIdentifier,
584
- credential_definition: zW3cVcJsonLdCredentialDefinition,
585
- credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({
586
- claims: zIssuerMetadataClaimsDescription.optional()
587
- }).optional()
447
+ //#endregion
448
+ //#region src/formats/credential/w3c-vc/z-w3c-jwt-vc-json-ld.ts
449
+ const zJwtVcJsonLdFormatIdentifier = zod.default.literal("jwt_vc_json-ld");
450
+ const zJwtVcJsonLdCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
451
+ format: zJwtVcJsonLdFormatIdentifier,
452
+ credential_definition: zW3cVcJsonLdCredentialDefinition,
453
+ credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({ claims: zod.default.array(zIssuerMetadataClaimsDescription).optional() }).optional()
588
454
  });
589
- var zJwtVcJsonLdCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
590
- format: zJwtVcJsonLdFormatIdentifier,
591
- credential_definition: zW3cVcJsonLdCredentialDefinition,
592
- claims: zIssuerMetadataClaimsDescription.optional()
455
+ const zJwtVcJsonLdCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
456
+ format: zJwtVcJsonLdFormatIdentifier,
457
+ credential_definition: zW3cVcJsonLdCredentialDefinition,
458
+ claims: zod.default.array(zIssuerMetadataClaimsDescription).optional()
593
459
  });
594
- var zJwtVcJsonLdCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
595
- format: zJwtVcJsonLdFormatIdentifier,
596
- credential_definition: zW3cVcJsonLdCredentialDefinitionDraft14,
597
- order: import_zod10.default.optional(import_zod10.default.array(import_zod10.default.string()))
460
+ const zJwtVcJsonLdCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
461
+ format: zJwtVcJsonLdFormatIdentifier,
462
+ credential_definition: zW3cVcJsonLdCredentialDefinitionDraft14,
463
+ order: zod.default.optional(zod.default.array(zod.default.string()))
598
464
  });
599
- var zJwtVcJsonLdCredentialIssuerMetadataDraft11 = import_zod10.default.object({
600
- order: import_zod10.default.array(import_zod10.default.string()).optional(),
601
- format: zJwtVcJsonLdFormatIdentifier,
602
- // Credential definition was spread on top level instead of a separatey property in v11
603
- // As well as using types instead of type
604
- "@context": import_zod10.default.array(import_zod10.default.string()),
605
- types: import_zod10.default.array(import_zod10.default.string()),
606
- credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
465
+ const zJwtVcJsonLdCredentialIssuerMetadataDraft11 = zod.default.object({
466
+ order: zod.default.array(zod.default.string()).optional(),
467
+ format: zJwtVcJsonLdFormatIdentifier,
468
+ "@context": zod.default.array(zod.default.string()),
469
+ types: zod.default.array(zod.default.string()),
470
+ credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
607
471
  }).passthrough();
608
- var zJwtVcJsonLdCredentialIssuerMetadataDraft11To14 = zJwtVcJsonLdCredentialIssuerMetadataDraft11.transform(
609
- ({ "@context": context, types, credentialSubject, ...rest }) => ({
610
- ...rest,
611
- credential_definition: {
612
- "@context": context,
613
- type: types,
614
- // Prevent weird typing issue with optional vs undefined
615
- ...credentialSubject ? { credentialSubject } : {}
616
- }
617
- })
618
- );
619
- var zJwtVcJsonLdCredentialIssuerMetadataDraft14To11 = zJwtVcJsonLdCredentialIssuerMetadataDraft14.passthrough().transform(({ credential_definition: { type, ...credentialDefinition }, ...rest }) => ({
620
- ...rest,
621
- ...credentialDefinition,
622
- types: type
472
+ const zJwtVcJsonLdCredentialIssuerMetadataDraft11To14 = zJwtVcJsonLdCredentialIssuerMetadataDraft11.transform(({ "@context": context, types, credentialSubject,...rest }) => ({
473
+ ...rest,
474
+ credential_definition: {
475
+ "@context": context,
476
+ type: types,
477
+ ...credentialSubject ? { credentialSubject } : {}
478
+ }
479
+ }));
480
+ const zJwtVcJsonLdCredentialIssuerMetadataDraft14To11 = zJwtVcJsonLdCredentialIssuerMetadataDraft14.passthrough().transform(({ credential_definition: { type,...credentialDefinition },...rest }) => ({
481
+ ...rest,
482
+ ...credentialDefinition,
483
+ types: type
623
484
  })).pipe(zJwtVcJsonLdCredentialIssuerMetadataDraft11);
624
- var zJwtVcJsonLdCredentialRequestFormatDraft14 = import_zod10.default.object({
625
- format: zJwtVcJsonLdFormatIdentifier,
626
- credential_definition: zW3cVcJsonLdCredentialDefinition
485
+ const zJwtVcJsonLdCredentialRequestFormatDraft14 = zod.default.object({
486
+ format: zJwtVcJsonLdFormatIdentifier,
487
+ credential_definition: zW3cVcJsonLdCredentialDefinition
627
488
  });
628
- var zJwtVcJsonLdCredentialRequestDraft11 = import_zod10.default.object({
629
- format: zJwtVcJsonLdFormatIdentifier,
630
- credential_definition: import_zod10.default.object({
631
- "@context": import_zod10.default.array(import_zod10.default.string()),
632
- // credential_definition was using types instead of type in v11
633
- types: import_zod10.default.array(import_zod10.default.string()),
634
- credentialSubject: import_zod10.default.optional(zW3cVcCredentialSubjectDraft14)
635
- }).passthrough()
489
+ const zJwtVcJsonLdCredentialRequestDraft11 = zod.default.object({
490
+ format: zJwtVcJsonLdFormatIdentifier,
491
+ credential_definition: zod.default.object({
492
+ "@context": zod.default.array(zod.default.string()),
493
+ types: zod.default.array(zod.default.string()),
494
+ credentialSubject: zod.default.optional(zW3cVcCredentialSubjectDraft14)
495
+ }).passthrough()
636
496
  }).passthrough();
637
- var zJwtVcJsonLdCredentialRequestDraft11To14 = zJwtVcJsonLdCredentialRequestDraft11.transform(
638
- ({ credential_definition: { types, ...restCredentialDefinition }, ...rest }) => ({
639
- ...rest,
640
- credential_definition: {
641
- ...restCredentialDefinition,
642
- type: types
643
- }
644
- })
645
- );
646
- var zJwtVcJsonLdCredentialRequestDraft14To11 = zJwtVcJsonLdCredentialRequestFormatDraft14.passthrough().transform(({ credential_definition: { type, ...restCredentialDefinition }, ...rest }) => ({
647
- ...rest,
648
- credential_definition: {
649
- ...restCredentialDefinition,
650
- types: type
651
- }
497
+ const zJwtVcJsonLdCredentialRequestDraft11To14 = zJwtVcJsonLdCredentialRequestDraft11.transform(({ credential_definition: { types,...restCredentialDefinition },...rest }) => ({
498
+ ...rest,
499
+ credential_definition: {
500
+ ...restCredentialDefinition,
501
+ type: types
502
+ }
503
+ }));
504
+ const zJwtVcJsonLdCredentialRequestDraft14To11 = zJwtVcJsonLdCredentialRequestFormatDraft14.passthrough().transform(({ credential_definition: { type,...restCredentialDefinition },...rest }) => ({
505
+ ...rest,
506
+ credential_definition: {
507
+ ...restCredentialDefinition,
508
+ types: type
509
+ }
652
510
  })).pipe(zJwtVcJsonLdCredentialRequestDraft11);
653
511
 
654
- // src/formats/credential/w3c-vc/z-w3c-jwt-vc-json.ts
655
- var import_zod11 = __toESM(require("zod"));
656
- var zJwtVcJsonFormatIdentifier = import_zod11.default.literal("jwt_vc_json");
657
- var zJwtVcJsonCredentialDefinition = import_zod11.default.object({
658
- type: import_zod11.default.array(import_zod11.default.string()).nonempty()
659
- }).passthrough();
660
- var zJwtVcJsonCredentialDefinitionDraft14 = zJwtVcJsonCredentialDefinition.extend({
661
- credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
662
- });
663
- var zJwtVcJsonCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
664
- format: zJwtVcJsonFormatIdentifier,
665
- credential_definition: zJwtVcJsonCredentialDefinition,
666
- credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({
667
- claims: zIssuerMetadataClaimsDescription.optional()
668
- }).optional()
512
+ //#endregion
513
+ //#region src/formats/credential/w3c-vc/z-w3c-ldp-vc.ts
514
+ const zLdpVcFormatIdentifier = zod.default.literal("ldp_vc");
515
+ const zLdpVcCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
516
+ format: zLdpVcFormatIdentifier,
517
+ credential_definition: zW3cVcJsonLdCredentialDefinition,
518
+ credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({ claims: zod.default.array(zIssuerMetadataClaimsDescription).optional() }).optional()
669
519
  });
670
- var zJwtVcJsonCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
671
- format: zJwtVcJsonFormatIdentifier,
672
- credential_definition: zJwtVcJsonCredentialDefinition,
673
- claims: zIssuerMetadataClaimsDescription.optional()
520
+ const zLdpVcCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
521
+ format: zLdpVcFormatIdentifier,
522
+ credential_definition: zW3cVcJsonLdCredentialDefinition,
523
+ claims: zod.default.array(zIssuerMetadataClaimsDescription).optional()
674
524
  });
675
- var zJwtVcJsonCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
676
- format: zJwtVcJsonFormatIdentifier,
677
- credential_definition: zJwtVcJsonCredentialDefinitionDraft14,
678
- order: import_zod11.default.array(import_zod11.default.string()).optional()
525
+ const zLdpVcCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
526
+ format: zLdpVcFormatIdentifier,
527
+ credential_definition: zW3cVcJsonLdCredentialDefinitionDraft14,
528
+ order: zod.default.array(zod.default.string()).optional()
679
529
  });
680
- var zJwtVcJsonCredentialIssuerMetadataDraft11 = import_zod11.default.object({
681
- format: zJwtVcJsonFormatIdentifier,
682
- order: import_zod11.default.array(import_zod11.default.string()).optional(),
683
- // Credential definition was spread on top level instead of a separatey property in v11
684
- // As well as using types instead of type
685
- types: import_zod11.default.array(import_zod11.default.string()),
686
- credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
530
+ const zLdpVcCredentialIssuerMetadataDraft11 = zod.default.object({
531
+ order: zod.default.array(zod.default.string()).optional(),
532
+ format: zLdpVcFormatIdentifier,
533
+ "@context": zod.default.array(zod.default.string()),
534
+ types: zod.default.array(zod.default.string()),
535
+ credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
687
536
  }).passthrough();
688
- var zJwtVcJsonCredentialIssuerMetadataDraft11To14 = zJwtVcJsonCredentialIssuerMetadataDraft11.transform(
689
- ({ types, credentialSubject, ...rest }) => ({
690
- ...rest,
691
- credential_definition: {
692
- type: types,
693
- // Prevent weird typing issue with optional vs undefined
694
- ...credentialSubject ? { credentialSubject } : {}
695
- }
696
- })
697
- );
698
- var zJwtVcJsonCredentialIssuerMetadataDraft14To11 = zJwtVcJsonCredentialIssuerMetadataDraft14.passthrough().transform(({ credential_definition: { type, ...credentialDefinition }, ...rest }) => ({
699
- ...rest,
700
- types: type,
701
- ...credentialDefinition
702
- })).pipe(zJwtVcJsonCredentialIssuerMetadataDraft11);
703
- var zJwtVcJsonCredentialRequestFormatDraft14 = import_zod11.default.object({
704
- format: zJwtVcJsonFormatIdentifier,
705
- credential_definition: zJwtVcJsonCredentialDefinition
537
+ const zLdpVcCredentialIssuerMetadataDraft11To14 = zLdpVcCredentialIssuerMetadataDraft11.transform(({ "@context": context, types, credentialSubject,...rest }) => ({
538
+ ...rest,
539
+ credential_definition: {
540
+ "@context": context,
541
+ type: types,
542
+ ...credentialSubject ? { credentialSubject } : {}
543
+ }
544
+ }));
545
+ const zLdpVcCredentialIssuerMetadataDraft14To11 = zLdpVcCredentialIssuerMetadataDraft14.passthrough().transform(({ credential_definition: { type,...credentialDefinition },...rest }) => ({
546
+ ...rest,
547
+ ...credentialDefinition,
548
+ types: type
549
+ })).pipe(zLdpVcCredentialIssuerMetadataDraft11);
550
+ const zLdpVcCredentialRequestFormatDraft14 = zod.default.object({
551
+ format: zLdpVcFormatIdentifier,
552
+ credential_definition: zW3cVcJsonLdCredentialDefinitionDraft14
706
553
  });
707
- var zJwtVcJsonCredentialRequestDraft11 = import_zod11.default.object({
708
- format: zJwtVcJsonFormatIdentifier,
709
- // Credential definition was spread on top level instead of a separatey property in v11
710
- // As well as using types instead of type
711
- types: import_zod11.default.array(import_zod11.default.string()),
712
- credentialSubject: import_zod11.default.optional(zW3cVcCredentialSubjectDraft14)
554
+ const zLdpVcCredentialRequestDraft11 = zod.default.object({
555
+ format: zLdpVcFormatIdentifier,
556
+ credential_definition: zod.default.object({
557
+ "@context": zod.default.array(zod.default.string()),
558
+ types: zod.default.array(zod.default.string()),
559
+ credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
560
+ })
713
561
  }).passthrough();
714
- var zJwtVcJsonCredentialRequestDraft11To14 = zJwtVcJsonCredentialRequestDraft11.transform(
715
- ({ types, credentialSubject, ...rest }) => {
716
- return {
717
- ...rest,
718
- credential_definition: {
719
- type: types,
720
- // Prevent weird typing issue with optional vs undefined
721
- ...credentialSubject ? { credentialSubject } : {}
722
- }
723
- };
724
- }
725
- );
726
- var zJwtVcJsonCredentialRequestDraft14To11 = zJwtVcJsonCredentialRequestFormatDraft14.passthrough().transform(({ credential_definition: { type, ...credentialDefinition }, ...rest }) => ({
727
- ...rest,
728
- types: type,
729
- ...credentialDefinition
730
- })).pipe(zJwtVcJsonCredentialRequestDraft11);
562
+ const zLdpVcCredentialRequestDraft11To14 = zLdpVcCredentialRequestDraft11.transform(({ credential_definition: { types,...restCredentialDefinition },...rest }) => ({
563
+ ...rest,
564
+ credential_definition: {
565
+ ...restCredentialDefinition,
566
+ type: types
567
+ }
568
+ }));
569
+ const zLdpVcCredentialRequestDraft14To11 = zLdpVcCredentialRequestFormatDraft14.passthrough().transform(({ credential_definition: { type,...restCredentialDefinition },...rest }) => ({
570
+ ...rest,
571
+ credential_definition: {
572
+ ...restCredentialDefinition,
573
+ types: type
574
+ }
575
+ })).pipe(zLdpVcCredentialRequestDraft11);
731
576
 
732
- // src/formats/credential/w3c-vc/z-w3c-sd-jwt-vc.ts
733
- var import_zod12 = __toESM(require("zod"));
734
- var zSdJwtW3VcFormatIdentifier = import_zod12.default.literal("vc+sd-jwt");
735
- var zSdJwtW3VcCredentialDefinition = import_zod12.default.object({
736
- type: import_zod12.default.array(import_zod12.default.string()).nonempty()
737
- }).passthrough();
738
- var zSdJwtW3VcCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
739
- format: zSdJwtW3VcFormatIdentifier,
740
- credential_definition: zSdJwtW3VcCredentialDefinition,
741
- credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({
742
- claims: zIssuerMetadataClaimsDescription.optional()
743
- }).optional(),
744
- // FIXME(vc+sd-jwt): remove when dropping support for legacy vc+sd-jwt. Allows type narrowing.
745
- vct: import_zod12.default.optional(import_zod12.default.never())
577
+ //#endregion
578
+ //#region src/formats/credential/w3c-vc/z-w3c-sd-jwt-vc.ts
579
+ const zSdJwtW3VcFormatIdentifier = zod.default.literal("vc+sd-jwt");
580
+ const zSdJwtW3VcCredentialDefinition = zod.default.object({ type: zod.default.array(zod.default.string()).nonempty() }).passthrough();
581
+ const zSdJwtW3VcCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
582
+ format: zSdJwtW3VcFormatIdentifier,
583
+ credential_definition: zSdJwtW3VcCredentialDefinition,
584
+ credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({ claims: zod.default.array(zIssuerMetadataClaimsDescription).optional() }).optional(),
585
+ vct: zod.default.optional(zod.default.never())
586
+ });
587
+ const zSdJwtW3VcCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
588
+ format: zSdJwtW3VcFormatIdentifier,
589
+ credential_definition: zSdJwtW3VcCredentialDefinition,
590
+ claims: zod.default.array(zIssuerMetadataClaimsDescription).optional(),
591
+ vct: zod.default.optional(zod.default.never())
746
592
  });
747
- var zSdJwtW3VcCredentialRequestFormatDraft14 = import_zod12.default.object({
748
- format: zSdJwtW3VcFormatIdentifier,
749
- credential_definition: zSdJwtW3VcCredentialDefinition,
750
- // FIXME(vc+sd-jwt): remove when dropping support for legacy vc+sd-jwt. Allows type narrowing.
751
- vct: import_zod12.default.optional(import_zod12.default.never())
593
+ const zSdJwtW3VcCredentialRequestFormatDraft14 = zod.default.object({
594
+ format: zSdJwtW3VcFormatIdentifier,
595
+ credential_definition: zSdJwtW3VcCredentialDefinition,
596
+ vct: zod.default.optional(zod.default.never())
752
597
  });
753
598
 
754
- // src/metadata/credential-issuer/z-credential-issuer-metadata.ts
755
- var allCredentialIssuerMetadataFormats = [
756
- zSdJwtDcCredentialIssuerMetadata,
757
- zMsoMdocCredentialIssuerMetadata,
758
- zJwtVcJsonLdCredentialIssuerMetadata,
759
- zLdpVcCredentialIssuerMetadata,
760
- zJwtVcJsonCredentialIssuerMetadata,
761
- zSdJwtW3VcCredentialIssuerMetadata,
762
- zLegacySdJwtVcCredentialIssuerMetadataDraft16,
763
- zSdJwtDcCredentialIssuerMetadataDraft15,
764
- zMsoMdocCredentialIssuerMetadataDraft15,
765
- zJwtVcJsonLdCredentialIssuerMetadataDraft15,
766
- zLdpVcCredentialIssuerMetadataDraft15,
767
- zJwtVcJsonCredentialIssuerMetadataDraft15,
768
- zMsoMdocCredentialIssuerMetadataDraft14,
769
- zLegacySdJwtVcCredentialIssuerMetadataDraft14,
770
- zJwtVcJsonLdCredentialIssuerMetadataDraft14,
771
- zLdpVcCredentialIssuerMetadataDraft14,
772
- zJwtVcJsonCredentialIssuerMetadataDraft14
599
+ //#endregion
600
+ //#region src/metadata/credential-issuer/z-credential-issuer-metadata.ts
601
+ const allCredentialIssuerMetadataFormats = [
602
+ zSdJwtDcCredentialIssuerMetadata,
603
+ zMsoMdocCredentialIssuerMetadata,
604
+ zJwtVcJsonLdCredentialIssuerMetadata,
605
+ zLdpVcCredentialIssuerMetadata,
606
+ zJwtVcJsonCredentialIssuerMetadata,
607
+ zSdJwtW3VcCredentialIssuerMetadata,
608
+ zSdJwtW3VcCredentialIssuerMetadataDraft15,
609
+ zLegacySdJwtVcCredentialIssuerMetadataDraft16,
610
+ zSdJwtDcCredentialIssuerMetadataDraft15,
611
+ zMsoMdocCredentialIssuerMetadataDraft15,
612
+ zJwtVcJsonLdCredentialIssuerMetadataDraft15,
613
+ zLdpVcCredentialIssuerMetadataDraft15,
614
+ zJwtVcJsonCredentialIssuerMetadataDraft15,
615
+ zMsoMdocCredentialIssuerMetadataDraft14,
616
+ zLegacySdJwtVcCredentialIssuerMetadataDraft14,
617
+ zJwtVcJsonLdCredentialIssuerMetadataDraft14,
618
+ zLdpVcCredentialIssuerMetadataDraft14,
619
+ zJwtVcJsonCredentialIssuerMetadataDraft14
773
620
  ];
774
- var allCredentialIssuerMetadataFormatIdentifiers = allCredentialIssuerMetadataFormats.map(
775
- (format) => format.shape.format.value
776
- );
777
- var zCredentialConfigurationSupportedWithFormats = import_zod13.default.union([zCredentialConfigurationSupportedCommon, zCredentialConfigurationSupportedCommonDraft15]).transform((data, ctx) => {
778
- if (!allCredentialIssuerMetadataFormatIdentifiers.includes(data.format)) return data;
779
- const validators = allCredentialIssuerMetadataFormats.filter(
780
- (formatValidator) => formatValidator.shape.format.value === data.format
781
- );
782
- const result = import_zod13.default.object({}).passthrough().and(
783
- validators.length > 1 ? import_zod13.default.union(
784
- validators
785
- ) : validators[0]
786
- ).safeParse(data);
787
- if (result.success) {
788
- return result.data;
789
- }
790
- for (const issue of result.error.issues) {
791
- ctx.addIssue(issue);
792
- }
793
- return import_zod13.default.NEVER;
621
+ const allCredentialIssuerMetadataFormatIdentifiers = allCredentialIssuerMetadataFormats.map((format) => format.shape.format.value);
622
+ const zCredentialConfigurationSupportedWithFormats = zod.default.union([zCredentialConfigurationSupportedCommon, zCredentialConfigurationSupportedCommonDraft15]).transform((data, ctx) => {
623
+ if (!allCredentialIssuerMetadataFormatIdentifiers.includes(data.format)) return data;
624
+ const validators = allCredentialIssuerMetadataFormats.filter((formatValidator) => formatValidator.shape.format.value === data.format);
625
+ const result = zod.default.object({}).passthrough().and(validators.length > 1 ? zod.default.union(validators) : validators[0]).safeParse(data);
626
+ if (result.success) return result.data;
627
+ for (const issue of result.error.issues) ctx.addIssue(issue);
628
+ return zod.default.NEVER;
794
629
  });
795
- var zCredentialIssuerMetadataDisplayEntry = import_zod13.default.object({
796
- name: import_zod13.default.string().optional(),
797
- locale: import_zod13.default.string().optional(),
798
- logo: import_zod13.default.object({
799
- // FIXME: make required again, but need to support draft 11 first
800
- uri: import_zod13.default.string().optional(),
801
- alt_text: import_zod13.default.string().optional()
802
- }).passthrough().optional()
630
+ const zCredentialIssuerMetadataDisplayEntry = zod.default.object({
631
+ name: zod.default.string().optional(),
632
+ locale: zod.default.string().optional(),
633
+ logo: zod.default.object({
634
+ uri: zod.default.string().optional(),
635
+ alt_text: zod.default.string().optional()
636
+ }).passthrough().optional()
803
637
  }).passthrough();
804
- var zCredentialIssuerMetadataDraft14Draft15Draft16 = import_zod13.default.object({
805
- credential_issuer: import_utils4.zHttpsUrl,
806
- authorization_servers: import_zod13.default.array(import_utils4.zHttpsUrl).optional(),
807
- credential_endpoint: import_utils4.zHttpsUrl,
808
- deferred_credential_endpoint: import_utils4.zHttpsUrl.optional(),
809
- notification_endpoint: import_utils4.zHttpsUrl.optional(),
810
- // Added after draft 14, but needed for proper
811
- nonce_endpoint: import_utils4.zHttpsUrl.optional(),
812
- credential_response_encryption: import_zod13.default.object({
813
- alg_values_supported: import_zod13.default.array(import_zod13.default.string()),
814
- enc_values_supported: import_zod13.default.array(import_zod13.default.string()),
815
- encryption_required: import_zod13.default.boolean()
816
- }).passthrough().optional(),
817
- batch_credential_issuance: import_zod13.default.object({
818
- batch_size: import_zod13.default.number().positive()
819
- }).passthrough().optional(),
820
- signed_metadata: import_oauth24.zCompactJwt.optional(),
821
- display: import_zod13.default.array(zCredentialIssuerMetadataDisplayEntry).optional(),
822
- credential_configurations_supported: import_zod13.default.record(import_zod13.default.string(), zCredentialConfigurationSupportedWithFormats)
638
+ const zCredentialIssuerMetadataDraft14Draft15Draft16 = zod.default.object({
639
+ credential_issuer: __openid4vc_utils.zHttpsUrl,
640
+ authorization_servers: zod.default.array(__openid4vc_utils.zHttpsUrl).optional(),
641
+ credential_endpoint: __openid4vc_utils.zHttpsUrl,
642
+ deferred_credential_endpoint: __openid4vc_utils.zHttpsUrl.optional(),
643
+ notification_endpoint: __openid4vc_utils.zHttpsUrl.optional(),
644
+ nonce_endpoint: __openid4vc_utils.zHttpsUrl.optional(),
645
+ credential_response_encryption: zod.default.object({
646
+ alg_values_supported: zod.default.array(zod.default.string()),
647
+ enc_values_supported: zod.default.array(zod.default.string()),
648
+ encryption_required: zod.default.boolean()
649
+ }).passthrough().optional(),
650
+ batch_credential_issuance: zod.default.object({ batch_size: zod.default.number().positive() }).passthrough().optional(),
651
+ signed_metadata: __openid4vc_oauth2.zCompactJwt.optional(),
652
+ display: zod.default.array(zCredentialIssuerMetadataDisplayEntry).optional(),
653
+ credential_configurations_supported: zod.default.record(zod.default.string(), zCredentialConfigurationSupportedWithFormats)
823
654
  }).passthrough();
824
- var zCredentialConfigurationSupportedDraft11To16 = import_zod13.default.object({
825
- id: import_zod13.default.string().optional(),
826
- format: import_zod13.default.string(),
827
- cryptographic_suites_supported: import_zod13.default.array(import_zod13.default.string()).optional(),
828
- display: import_zod13.default.array(
829
- import_zod13.default.object({
830
- logo: import_zod13.default.object({
831
- url: import_zod13.default.string().url().optional()
832
- }).passthrough().optional(),
833
- background_image: import_zod13.default.object({
834
- url: import_zod13.default.string().url().optional()
835
- }).passthrough().optional()
836
- }).passthrough()
837
- ).optional(),
838
- claims: import_zod13.default.any().optional()
839
- }).passthrough().transform(({ cryptographic_suites_supported, display, claims, id, ...rest }) => ({
840
- ...rest,
841
- ...cryptographic_suites_supported ? { credential_signing_alg_values_supported: cryptographic_suites_supported } : {},
842
- ...claims || display ? {
843
- credential_metadata: {
844
- ...claims ? { claims } : {},
845
- ...display ? {
846
- display: display.map(({ logo, background_image, ...displayRest }) => ({
847
- ...displayRest,
848
- // url became uri and also required
849
- // so if there's no url in the logo, we remove the whole logo object
850
- ...logo?.url ? {
851
- // TODO: we should add the other params from logo as well
852
- logo: {
853
- uri: logo.url
854
- }
855
- } : {},
856
- // TODO: we should add the other params from background_image as well
857
- // url became uri and also required
858
- // so if there's no url in the background_image, we remove the whole logo object
859
- ...background_image?.url ? {
860
- background_image: {
861
- uri: background_image.url
862
- }
863
- } : {}
864
- }))
865
- } : {}
866
- }
867
- } : {}
655
+ const zCredentialConfigurationSupportedDraft11To16 = zod.default.object({
656
+ id: zod.default.string().optional(),
657
+ format: zod.default.string(),
658
+ cryptographic_suites_supported: zod.default.array(zod.default.string()).optional(),
659
+ display: zod.default.array(zod.default.object({
660
+ logo: zod.default.object({ url: zod.default.string().url().optional() }).passthrough().optional(),
661
+ background_image: zod.default.object({ url: zod.default.string().url().optional() }).passthrough().optional()
662
+ }).passthrough()).optional(),
663
+ claims: zod.default.any().optional()
664
+ }).passthrough().transform(({ cryptographic_suites_supported, display, claims, id,...rest }) => ({
665
+ ...rest,
666
+ ...cryptographic_suites_supported ? { credential_signing_alg_values_supported: cryptographic_suites_supported } : {},
667
+ ...claims || display ? { credential_metadata: {
668
+ ...claims ? { claims } : {},
669
+ ...display ? { display: display.map(({ logo, background_image,...displayRest }) => ({
670
+ ...displayRest,
671
+ ...logo?.url ? { logo: { uri: logo.url } } : {},
672
+ ...background_image?.url ? { background_image: { uri: background_image.url } } : {}
673
+ })) } : {}
674
+ } } : {}
868
675
  })).transform((data, ctx) => {
869
- const formatSpecificTransformations = {
870
- [zLdpVcFormatIdentifier.value]: zLdpVcCredentialIssuerMetadataDraft11To14,
871
- [zJwtVcJsonFormatIdentifier.value]: zJwtVcJsonCredentialIssuerMetadataDraft11To14,
872
- [zJwtVcJsonLdFormatIdentifier.value]: zJwtVcJsonLdCredentialIssuerMetadataDraft11To14
873
- };
874
- if (!Object.keys(formatSpecificTransformations).includes(data.format)) return data;
875
- const schema = formatSpecificTransformations[data.format];
876
- const result = schema.safeParse(data);
877
- if (result.success) return result.data;
878
- for (const issue of result.error.issues) {
879
- ctx.addIssue(issue);
880
- }
881
- return import_zod13.default.NEVER;
676
+ const formatSpecificTransformations = {
677
+ [zLdpVcFormatIdentifier.value]: zLdpVcCredentialIssuerMetadataDraft11To14,
678
+ [zJwtVcJsonFormatIdentifier.value]: zJwtVcJsonCredentialIssuerMetadataDraft11To14,
679
+ [zJwtVcJsonLdFormatIdentifier.value]: zJwtVcJsonLdCredentialIssuerMetadataDraft11To14
680
+ };
681
+ if (!Object.keys(formatSpecificTransformations).includes(data.format)) return data;
682
+ const result = formatSpecificTransformations[data.format].safeParse(data);
683
+ if (result.success) return result.data;
684
+ for (const issue of result.error.issues) ctx.addIssue(issue);
685
+ return zod.default.NEVER;
882
686
  }).pipe(zCredentialConfigurationSupportedWithFormats);
883
- var zCredentialConfigurationSupportedDraft16To15 = zCredentialConfigurationSupportedWithFormats.transform(
884
- ({ credential_metadata, ...rest }) => ({
885
- ...credential_metadata,
886
- ...rest
887
- })
888
- );
889
- var zCredentialConfigurationSupportedDraft16To11 = zCredentialConfigurationSupportedDraft16To15.and(
890
- import_zod13.default.object({
891
- id: import_zod13.default.string()
892
- }).passthrough()
893
- ).transform(({ id, credential_signing_alg_values_supported, display, proof_types_supported, scope, ...rest }) => ({
894
- ...rest,
895
- ...credential_signing_alg_values_supported ? { cryptographic_suites_supported: credential_signing_alg_values_supported } : {},
896
- ...display ? {
897
- display: display.map(({ logo, background_image, ...displayRest }) => {
898
- const { uri: logoUri, ...logoRest } = logo ?? {};
899
- const { uri: backgroundImageUri, ...backgroundImageRest } = background_image ?? {};
900
- return {
901
- ...displayRest,
902
- // draft 11 uses url, draft 13/14 uses uri
903
- ...logoUri ? { logo: { url: logoUri, ...logoRest } } : {},
904
- // draft 11 uses url, draft 13/14 uses uri
905
- ...backgroundImageUri ? { logo: { url: backgroundImageUri, ...backgroundImageRest } } : {}
906
- };
907
- })
908
- } : {},
909
- id
910
- })).pipe(
911
- import_zod13.default.union([
912
- zLdpVcCredentialIssuerMetadataDraft14To11,
913
- zJwtVcJsonCredentialIssuerMetadataDraft14To11,
914
- zJwtVcJsonLdCredentialIssuerMetadataDraft14To11,
915
- // To handle unrecognized formats and not error immediately we allow the common format as well
916
- // but they can't use any of the format identifiers that have a specific transformation. This way if a format is
917
- // has a transformation it NEEDS to use the format specific transformation, and otherwise we fall back to the common validation
918
- import_zod13.default.object({
919
- format: import_zod13.default.string().refine(
920
- (input) => ![
921
- zLdpVcFormatIdentifier.value,
922
- zJwtVcJsonFormatIdentifier.value,
923
- zJwtVcJsonLdFormatIdentifier.value
924
- ].includes(input)
925
- )
926
- }).passthrough()
927
- ])
928
- );
929
- var zCredentialIssuerMetadataDraft11To16 = import_zod13.default.object({
930
- authorization_server: import_zod13.default.string().optional(),
931
- credentials_supported: import_zod13.default.array(
932
- import_zod13.default.object({
933
- id: import_zod13.default.string().optional()
934
- }).passthrough()
935
- )
936
- }).passthrough().transform(({ authorization_server, credentials_supported, ...rest }) => {
937
- return {
938
- ...rest,
939
- ...authorization_server ? { authorization_servers: [authorization_server] } : {},
940
- // Go from array to map but keep v11 structure
941
- credential_configurations_supported: Object.fromEntries(
942
- credentials_supported.map((supported) => supported.id ? [supported.id, supported] : void 0).filter((i) => i !== void 0)
943
- )
944
- };
945
- }).pipe(
946
- import_zod13.default.object({
947
- // Update from v11 structure to v14 structure
948
- credential_configurations_supported: import_zod13.default.record(import_zod13.default.string(), zCredentialConfigurationSupportedDraft11To16)
949
- }).passthrough()
950
- ).pipe(zCredentialIssuerMetadataDraft14Draft15Draft16);
951
- var zCredentialIssuerMetadataWithDraft11 = zCredentialIssuerMetadataDraft14Draft15Draft16.transform((issuerMetadata) => ({
952
- ...issuerMetadata,
953
- ...issuerMetadata.authorization_servers ? { authorization_server: issuerMetadata.authorization_servers[0] } : {},
954
- credentials_supported: Object.entries(issuerMetadata.credential_configurations_supported).map(([id, value]) => ({
955
- ...value,
956
- id
957
- }))
958
- })).pipe(
959
- zCredentialIssuerMetadataDraft14Draft15Draft16.extend({
960
- credentials_supported: import_zod13.default.array(zCredentialConfigurationSupportedDraft16To11)
961
- })
962
- );
963
- var zCredentialIssuerMetadata = import_zod13.default.union([
964
- // First prioritize draft 16/15/14 (and 13)
965
- zCredentialIssuerMetadataDraft14Draft15Draft16,
966
- // Then try parsing draft 11 and transform into draft 16
967
- zCredentialIssuerMetadataDraft11To16
968
- ]);
969
- var zCredentialIssuerMetadataWithDraftVersion = import_zod13.default.union([
970
- zCredentialIssuerMetadataDraft14Draft15Draft16.transform((credentialIssuerMetadata) => {
971
- const credentialConfigurations = Object.values(credentialIssuerMetadata.credential_configurations_supported);
972
- const isDraft15 = credentialConfigurations.some((configuration) => {
973
- const knownConfiguration = configuration;
974
- if (knownConfiguration.format === zSdJwtDcFormatIdentifier.value) return true;
975
- if (Array.isArray(knownConfiguration.claims)) return true;
976
- if (Object.values(knownConfiguration.proof_types_supported ?? {}).some(
977
- (proofType) => proofType.key_attestations_required !== void 0
978
- ))
979
- return true;
980
- return false;
981
- });
982
- const isDraft16 = credentialConfigurations.some((configuration) => {
983
- return configuration.credential_metadata;
984
- });
985
- return {
986
- credentialIssuerMetadata,
987
- originalDraftVersion: isDraft16 ? "Draft16" /* Draft16 */ : isDraft15 ? "Draft15" /* Draft15 */ : "Draft14" /* Draft14 */
988
- };
989
- }),
990
- // Then try parsing draft 11 and transform into draft 14
991
- zCredentialIssuerMetadataDraft11To16.transform((credentialIssuerMetadata) => ({
992
- credentialIssuerMetadata,
993
- originalDraftVersion: "Draft11" /* Draft11 */
994
- }))
995
- ]);
687
+ const zCredentialConfigurationSupportedDraft16To11 = zCredentialConfigurationSupportedWithFormats.transform(({ credential_metadata,...rest }) => ({
688
+ ...credential_metadata,
689
+ ...rest
690
+ })).and(zod.default.object({ id: zod.default.string() }).passthrough()).transform(({ id, credential_signing_alg_values_supported, display, proof_types_supported, scope,...rest }) => ({
691
+ ...rest,
692
+ ...credential_signing_alg_values_supported ? { cryptographic_suites_supported: credential_signing_alg_values_supported } : {},
693
+ ...display ? { display: display.map(({ logo, background_image,...displayRest }) => {
694
+ const { uri: logoUri,...logoRest } = logo ?? {};
695
+ const { uri: backgroundImageUri,...backgroundImageRest } = background_image ?? {};
696
+ return {
697
+ ...displayRest,
698
+ ...logoUri ? { logo: {
699
+ url: logoUri,
700
+ ...logoRest
701
+ } } : {},
702
+ ...backgroundImageUri ? { logo: {
703
+ url: backgroundImageUri,
704
+ ...backgroundImageRest
705
+ } } : {}
706
+ };
707
+ }) } : {},
708
+ id
709
+ })).pipe(zod.default.union([
710
+ zLdpVcCredentialIssuerMetadataDraft14To11,
711
+ zJwtVcJsonCredentialIssuerMetadataDraft14To11,
712
+ zJwtVcJsonLdCredentialIssuerMetadataDraft14To11,
713
+ zod.default.object({ format: zod.default.string().refine((input) => ![
714
+ zLdpVcFormatIdentifier.value,
715
+ zJwtVcJsonFormatIdentifier.value,
716
+ zJwtVcJsonLdFormatIdentifier.value
717
+ ].includes(input)) }).passthrough()
718
+ ]));
719
+ const zCredentialIssuerMetadataDraft11To16 = zod.default.object({
720
+ authorization_server: zod.default.string().optional(),
721
+ credentials_supported: zod.default.array(zod.default.object({ id: zod.default.string().optional() }).passthrough())
722
+ }).passthrough().transform(({ authorization_server, credentials_supported,...rest }) => {
723
+ return {
724
+ ...rest,
725
+ ...authorization_server ? { authorization_servers: [authorization_server] } : {},
726
+ credential_configurations_supported: Object.fromEntries(credentials_supported.map((supported) => supported.id ? [supported.id, supported] : void 0).filter((i) => i !== void 0))
727
+ };
728
+ }).pipe(zod.default.object({ credential_configurations_supported: zod.default.record(zod.default.string(), zCredentialConfigurationSupportedDraft11To16) }).passthrough()).pipe(zCredentialIssuerMetadataDraft14Draft15Draft16);
729
+ const zCredentialIssuerMetadataWithDraft11 = zCredentialIssuerMetadataDraft14Draft15Draft16.transform((issuerMetadata) => ({
730
+ ...issuerMetadata,
731
+ ...issuerMetadata.authorization_servers ? { authorization_server: issuerMetadata.authorization_servers[0] } : {},
732
+ credentials_supported: Object.entries(issuerMetadata.credential_configurations_supported).map(([id, value]) => ({
733
+ ...value,
734
+ id
735
+ }))
736
+ })).pipe(zCredentialIssuerMetadataDraft14Draft15Draft16.extend({ credentials_supported: zod.default.array(zCredentialConfigurationSupportedDraft16To11) }));
737
+ const zCredentialIssuerMetadata = zod.default.union([zCredentialIssuerMetadataDraft14Draft15Draft16, zCredentialIssuerMetadataDraft11To16]);
738
+ const zCredentialIssuerMetadataWithDraftVersion = zod.default.union([zCredentialIssuerMetadataDraft14Draft15Draft16.transform((credentialIssuerMetadata) => {
739
+ const credentialConfigurations = Object.values(credentialIssuerMetadata.credential_configurations_supported);
740
+ const isDraft15 = credentialConfigurations.some((configuration) => {
741
+ const knownConfiguration = configuration;
742
+ if (knownConfiguration.format === zSdJwtDcFormatIdentifier.value) return true;
743
+ if (Array.isArray(knownConfiguration.claims)) return true;
744
+ if (Object.values(knownConfiguration.proof_types_supported ?? {}).some((proofType) => proofType.key_attestations_required !== void 0)) return true;
745
+ return false;
746
+ });
747
+ return {
748
+ credentialIssuerMetadata,
749
+ originalDraftVersion: credentialConfigurations.some((configuration) => {
750
+ return configuration.credential_metadata;
751
+ }) ? Openid4vciDraftVersion.Draft16 : isDraft15 ? Openid4vciDraftVersion.Draft15 : Openid4vciDraftVersion.Draft14
752
+ };
753
+ }), zCredentialIssuerMetadataDraft11To16.transform((credentialIssuerMetadata) => ({
754
+ credentialIssuerMetadata,
755
+ originalDraftVersion: Openid4vciDraftVersion.Draft11
756
+ }))]);
996
757
 
997
- // src/metadata/credential-issuer/credential-issuer-metadata.ts
998
- var wellKnownCredentialIssuerSuffix = ".well-known/openid-credential-issuer";
758
+ //#endregion
759
+ //#region src/metadata/credential-issuer/credential-issuer-metadata.ts
760
+ const wellKnownCredentialIssuerSuffix = ".well-known/openid-credential-issuer";
761
+ /**
762
+ * @inheritdoc {@link fetchWellKnownMetadata}
763
+ */
999
764
  async function fetchCredentialIssuerMetadata(credentialIssuer, fetch) {
1000
- const wellKnownMetadataUrl = (0, import_utils5.joinUriParts)(credentialIssuer, [wellKnownCredentialIssuerSuffix]);
1001
- const result = await (0, import_oauth25.fetchWellKnownMetadata)(wellKnownMetadataUrl, zCredentialIssuerMetadataWithDraftVersion, fetch);
1002
- if (result && result.credentialIssuerMetadata.credential_issuer !== credentialIssuer) {
1003
- throw new import_oauth25.Oauth2Error(
1004
- `The 'credential_issuer' parameter '${result.credentialIssuerMetadata.credential_issuer}' in the well known credential issuer metadata at '${wellKnownMetadataUrl}' does not match the provided credential issuer '${credentialIssuer}'.`
1005
- );
1006
- }
1007
- return result;
765
+ const wellKnownMetadataUrl = (0, __openid4vc_utils.joinUriParts)(credentialIssuer, [wellKnownCredentialIssuerSuffix]);
766
+ const result = await (0, __openid4vc_oauth2.fetchWellKnownMetadata)(wellKnownMetadataUrl, zCredentialIssuerMetadataWithDraftVersion, fetch);
767
+ if (result && result.credentialIssuerMetadata.credential_issuer !== credentialIssuer) throw new __openid4vc_oauth2.Oauth2Error(`The 'credential_issuer' parameter '${result.credentialIssuerMetadata.credential_issuer}' in the well known credential issuer metadata at '${wellKnownMetadataUrl}' does not match the provided credential issuer '${credentialIssuer}'.`);
768
+ return result;
1008
769
  }
770
+ /**
771
+ * Extract credential configuration supported entries where the `format` is known to this
772
+ * library. Should be ran only after verifying the credential issuer metadata structure, so
773
+ * we can be certain that if the `format` matches the other format specific requirements are also met.
774
+ *
775
+ * Validation is done when resolving issuer metadata, or when calling `createIssuerMetadata`.
776
+ */
1009
777
  function extractKnownCredentialConfigurationSupportedFormats(credentialConfigurationsSupported) {
1010
- return Object.fromEntries(
1011
- Object.entries(credentialConfigurationsSupported).filter(
1012
- (entry) => allCredentialIssuerMetadataFormatIdentifiers.includes(entry[1].format)
1013
- )
1014
- );
778
+ return Object.fromEntries(Object.entries(credentialConfigurationsSupported).filter((entry) => allCredentialIssuerMetadataFormatIdentifiers.includes(entry[1].format)));
1015
779
  }
1016
780
  function getCredentialConfigurationSupportedById(credentialConfigurations, credentialConfigurationId) {
1017
- const configuration = credentialConfigurations[credentialConfigurationId];
1018
- if (!configuration) {
1019
- throw new import_oauth25.Oauth2Error(
1020
- `Credential configuration with id '${credentialConfigurationId}' not found in credential configurations supported.`
1021
- );
1022
- }
1023
- return configuration;
781
+ const configuration = credentialConfigurations[credentialConfigurationId];
782
+ if (!configuration) throw new __openid4vc_oauth2.Oauth2Error(`Credential configuration with id '${credentialConfigurationId}' not found in credential configurations supported.`);
783
+ return configuration;
1024
784
  }
1025
785
 
1026
- // src/credential-request/credential-request-configurations.ts
1027
- function getCredentialConfigurationsMatchingRequestFormat({
1028
- requestFormat,
1029
- credentialConfigurations
1030
- }) {
1031
- const knownCredentialConfigurations = extractKnownCredentialConfigurationSupportedFormats(credentialConfigurations);
1032
- return Object.fromEntries(
1033
- Object.entries(knownCredentialConfigurations).filter(([, credentialConfiguration]) => {
1034
- if (credentialConfiguration.format !== requestFormat.format) return false;
1035
- const r = requestFormat;
1036
- const c = credentialConfiguration;
1037
- if ((c.format === "ldp_vc" || c.format === "jwt_vc_json-ld") && r.format === c.format) {
1038
- return (0, import_utils6.arrayEqualsIgnoreOrder)(r.credential_definition.type, c.credential_definition.type) && (0, import_utils6.arrayEqualsIgnoreOrder)(r.credential_definition["@context"], c.credential_definition["@context"]);
1039
- }
1040
- if (c.format === "jwt_vc_json" && r.format === c.format) {
1041
- return (0, import_utils6.arrayEqualsIgnoreOrder)(r.credential_definition.type, c.credential_definition.type);
1042
- }
1043
- if (c.format === "vc+sd-jwt" && r.format === c.format) {
1044
- if (r.vct && c.vct) {
1045
- return r.vct === c.vct;
1046
- }
1047
- if (c.credential_definition && r.credential_definition) {
1048
- return (0, import_utils6.arrayEqualsIgnoreOrder)(r.credential_definition.type, c.credential_definition.type);
1049
- }
1050
- }
1051
- if (c.format === "mso_mdoc" && r.format === c.format) {
1052
- return r.doctype === c.doctype;
1053
- }
1054
- return false;
1055
- })
1056
- );
786
+ //#endregion
787
+ //#region src/credential-request/credential-request-configurations.ts
788
+ function getCredentialConfigurationsMatchingRequestFormat({ requestFormat, credentialConfigurations }) {
789
+ const knownCredentialConfigurations = extractKnownCredentialConfigurationSupportedFormats(credentialConfigurations);
790
+ return Object.fromEntries(Object.entries(knownCredentialConfigurations).filter(([, credentialConfiguration]) => {
791
+ if (credentialConfiguration.format !== requestFormat.format) return false;
792
+ const r = requestFormat;
793
+ const c = credentialConfiguration;
794
+ if ((c.format === "ldp_vc" || c.format === "jwt_vc_json-ld") && r.format === c.format) return (0, __openid4vc_utils.arrayEqualsIgnoreOrder)(r.credential_definition.type, c.credential_definition.type) && (0, __openid4vc_utils.arrayEqualsIgnoreOrder)(r.credential_definition["@context"], c.credential_definition["@context"]);
795
+ if (c.format === "jwt_vc_json" && r.format === c.format) return (0, __openid4vc_utils.arrayEqualsIgnoreOrder)(r.credential_definition.type, c.credential_definition.type);
796
+ if (c.format === "vc+sd-jwt" && r.format === c.format) {
797
+ if (r.vct && c.vct) return r.vct === c.vct;
798
+ if (c.credential_definition && r.credential_definition) return (0, __openid4vc_utils.arrayEqualsIgnoreOrder)(r.credential_definition.type, c.credential_definition.type);
799
+ }
800
+ if (c.format === "mso_mdoc" && r.format === c.format) return r.doctype === c.doctype;
801
+ return false;
802
+ }));
1057
803
  }
1058
804
 
1059
- // src/error/Openid4vciError.ts
805
+ //#endregion
806
+ //#region src/error/Openid4vciError.ts
1060
807
  var Openid4vciError = class extends Error {
1061
- constructor(message, options) {
1062
- const errorMessage = message ?? "Unknown error occured.";
1063
- const causeMessage = options?.cause instanceof Error ? ` ${options.cause.message}` : options?.cause ? ` ${options?.cause}` : "";
1064
- super(`${errorMessage}${causeMessage}`);
1065
- this.cause = options?.cause;
1066
- }
808
+ constructor(message, options) {
809
+ const errorMessage = message ?? "Unknown error occured.";
810
+ const causeMessage = options?.cause instanceof Error ? ` ${options.cause.message}` : options?.cause ? ` ${options?.cause}` : "";
811
+ super(`${errorMessage}${causeMessage}`);
812
+ this.cause = options?.cause;
813
+ }
1067
814
  };
1068
815
 
1069
- // src/error/Openid4vciRetrieveCredentialsError.ts
1070
- var import_utils7 = require("@openid4vc/utils");
816
+ //#endregion
817
+ //#region src/error/Openid4vciRetrieveCredentialsError.ts
1071
818
  var Openid4vciRetrieveCredentialsError = class extends Openid4vciError {
1072
- constructor(message, response, responseText) {
1073
- const errorData = response.credentialResponseResult?.data ?? response.credentialErrorResponseResult?.data ?? (response.credentialResponseResult?.error ? (0, import_utils7.formatZodError)(response.credentialResponseResult.error) : void 0) ?? responseText;
1074
- super(`${message}
1075
- ${JSON.stringify(errorData, null, 2)}`);
1076
- this.response = response;
1077
- }
819
+ constructor(message, response, responseText) {
820
+ const errorData = response.credentialResponseResult?.data ?? response.credentialErrorResponseResult?.data ?? (response.credentialResponseResult?.error ? (0, __openid4vc_utils.formatZodError)(response.credentialResponseResult.error) : void 0) ?? responseText;
821
+ super(`${message}\n${JSON.stringify(errorData, null, 2)}`);
822
+ this.response = response;
823
+ }
1078
824
  };
1079
825
 
1080
- // src/error/Openid4vciSendNotificationError.ts
826
+ //#endregion
827
+ //#region src/error/Openid4vciSendNotificationError.ts
1081
828
  var Openid4vciSendNotificationError = class extends Openid4vciError {
1082
- constructor(message, response) {
1083
- super(message);
1084
- this.response = response;
1085
- }
829
+ constructor(message, response) {
830
+ super(message);
831
+ this.response = response;
832
+ }
1086
833
  };
1087
834
 
1088
- // src/key-attestation/key-attestation.ts
1089
- var import_oauth26 = require("@openid4vc/oauth2");
1090
- var import_oauth27 = require("@openid4vc/oauth2");
1091
- var import_utils8 = require("@openid4vc/utils");
835
+ //#endregion
836
+ //#region src/key-attestation/key-attestation.ts
1092
837
  async function createKeyAttestationJwt(options) {
1093
- const header = (0, import_utils8.parseWithErrorHandling)(zKeyAttestationJwtHeader, {
1094
- ...(0, import_oauth26.jwtHeaderFromJwtSigner)(options.signer),
1095
- typ: "keyattestation+jwt"
1096
- });
1097
- const payload = (0, import_utils8.parseWithErrorHandling)(zKeyAttestationJwtPayloadForUse(options.use), {
1098
- iat: (0, import_utils8.dateToSeconds)(options.issuedAt),
1099
- exp: options.expiresAt ? (0, import_utils8.dateToSeconds)(options.expiresAt) : void 0,
1100
- nonce: options.nonce,
1101
- attested_keys: options.attestedKeys,
1102
- user_authentication: options.userAuthentication,
1103
- key_storage: options.keyStorage,
1104
- certification: options.certification,
1105
- ...options.additionalPayload
1106
- });
1107
- const { jwt } = await options.callbacks.signJwt(options.signer, { header, payload });
1108
- return jwt;
838
+ const header = (0, __openid4vc_utils.parseWithErrorHandling)(zKeyAttestationJwtHeader, {
839
+ ...(0, __openid4vc_oauth2.jwtHeaderFromJwtSigner)(options.signer),
840
+ typ: "keyattestation+jwt"
841
+ });
842
+ const payload = (0, __openid4vc_utils.parseWithErrorHandling)(zKeyAttestationJwtPayloadForUse(options.use), {
843
+ iat: (0, __openid4vc_utils.dateToSeconds)(options.issuedAt),
844
+ exp: options.expiresAt ? (0, __openid4vc_utils.dateToSeconds)(options.expiresAt) : void 0,
845
+ nonce: options.nonce,
846
+ attested_keys: options.attestedKeys,
847
+ user_authentication: options.userAuthentication,
848
+ key_storage: options.keyStorage,
849
+ certification: options.certification,
850
+ ...options.additionalPayload
851
+ });
852
+ const { jwt } = await options.callbacks.signJwt(options.signer, {
853
+ header,
854
+ payload
855
+ });
856
+ return jwt;
1109
857
  }
1110
858
  function parseKeyAttestationJwt({ keyAttestationJwt, use }) {
1111
- return (0, import_oauth26.decodeJwt)({
1112
- jwt: keyAttestationJwt,
1113
- headerSchema: zKeyAttestationJwtHeader,
1114
- payloadSchema: zKeyAttestationJwtPayloadForUse(use)
1115
- });
859
+ return (0, __openid4vc_oauth2.decodeJwt)({
860
+ jwt: keyAttestationJwt,
861
+ headerSchema: zKeyAttestationJwtHeader,
862
+ payloadSchema: zKeyAttestationJwtPayloadForUse(use)
863
+ });
1116
864
  }
1117
865
  async function verifyKeyAttestationJwt(options) {
1118
- const { header, payload } = parseKeyAttestationJwt({ keyAttestationJwt: options.keyAttestationJwt, use: options.use });
1119
- const now = options.now?.getTime() ?? Date.now();
1120
- if (options.nonceExpiresAt && now > options.nonceExpiresAt.getTime()) {
1121
- throw new Openid4vciError("Nonce used for key attestation jwt expired");
1122
- }
1123
- const { signer } = await (0, import_oauth27.verifyJwt)({
1124
- compact: options.keyAttestationJwt,
1125
- header,
1126
- payload,
1127
- signer: (0, import_oauth27.jwtSignerFromJwt)({ header, payload }),
1128
- verifyJwtCallback: options.callbacks.verifyJwt,
1129
- errorMessage: "Error verifiying key attestation jwt",
1130
- expectedNonce: options.expectedNonce,
1131
- now: options.now
1132
- });
1133
- return {
1134
- header,
1135
- payload,
1136
- signer
1137
- };
866
+ const { header, payload } = parseKeyAttestationJwt({
867
+ keyAttestationJwt: options.keyAttestationJwt,
868
+ use: options.use
869
+ });
870
+ const now = options.now?.getTime() ?? Date.now();
871
+ if (options.nonceExpiresAt && now > options.nonceExpiresAt.getTime()) throw new Openid4vciError("Nonce used for key attestation jwt expired");
872
+ const { signer } = await (0, __openid4vc_oauth2.verifyJwt)({
873
+ compact: options.keyAttestationJwt,
874
+ header,
875
+ payload,
876
+ signer: (0, __openid4vc_oauth2.jwtSignerFromJwt)({
877
+ header,
878
+ payload
879
+ }),
880
+ verifyJwtCallback: options.callbacks.verifyJwt,
881
+ errorMessage: "Error verifiying key attestation jwt",
882
+ expectedNonce: options.expectedNonce,
883
+ now: options.now
884
+ });
885
+ return {
886
+ header,
887
+ payload,
888
+ signer
889
+ };
1138
890
  }
1139
891
 
1140
- // src/metadata/credential-issuer/credential-configurations.ts
1141
- var import_oauth28 = require("@openid4vc/oauth2");
1142
- var import_utils9 = require("@openid4vc/utils");
892
+ //#endregion
893
+ //#region src/metadata/credential-issuer/credential-configurations.ts
1143
894
  function extractScopesForCredentialConfigurationIds(options) {
1144
- const scopes = /* @__PURE__ */ new Set();
1145
- for (const credentialConfigurationId of options.credentialConfigurationIds) {
1146
- const credentialConfiguration = options.issuerMetadata.credentialIssuer.credential_configurations_supported[credentialConfigurationId];
1147
- if (!credentialConfiguration) {
1148
- throw new import_oauth28.Oauth2Error(
1149
- `Credential configuration with id '${credentialConfigurationId}' not found in metadata from credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}'`
1150
- );
1151
- }
1152
- const scope = credentialConfiguration.scope;
1153
- if (scope) scopes.add(scope);
1154
- else if (!scope && options.throwOnConfigurationWithoutScope) {
1155
- throw new import_oauth28.Oauth2Error(
1156
- `Credential configuration with id '${credentialConfigurationId}' does not have a 'scope' configured, and 'throwOnConfigurationWithoutScope' was enabled.`
1157
- );
1158
- }
1159
- }
1160
- return scopes.size > 0 ? Array.from(scopes) : void 0;
895
+ const scopes = /* @__PURE__ */ new Set();
896
+ for (const credentialConfigurationId of options.credentialConfigurationIds) {
897
+ const credentialConfiguration = options.issuerMetadata.credentialIssuer.credential_configurations_supported[credentialConfigurationId];
898
+ if (!credentialConfiguration) throw new __openid4vc_oauth2.Oauth2Error(`Credential configuration with id '${credentialConfigurationId}' not found in metadata from credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}'`);
899
+ const scope = credentialConfiguration.scope;
900
+ if (scope) scopes.add(scope);
901
+ else if (!scope && options.throwOnConfigurationWithoutScope) throw new __openid4vc_oauth2.Oauth2Error(`Credential configuration with id '${credentialConfigurationId}' does not have a 'scope' configured, and 'throwOnConfigurationWithoutScope' was enabled.`);
902
+ }
903
+ return scopes.size > 0 ? Array.from(scopes) : void 0;
1161
904
  }
905
+ /**
906
+ * Transforms draft 11 credentials supported syntax to credential configurations supported
907
+ *
908
+ * @throws if a credentials supported entry without id is passed
909
+ * @throws if a credentials supported entry with invalid structure or format specific properties is passed
910
+ */
1162
911
  function credentialsSupportedToCredentialConfigurationsSupported(credentialsSupported) {
1163
- const credentialConfigurationsSupported = {};
1164
- for (let index = 0; index < credentialsSupported.length; index++) {
1165
- const credentialSupported = credentialsSupported[index];
1166
- if (!credentialSupported.id) {
1167
- throw new Openid4vciError(
1168
- `Credential supported at index '${index}' does not have an 'id' property. Credential configuration requires the 'id' property as key`
1169
- );
1170
- }
1171
- const parseResult = zCredentialConfigurationSupportedDraft11To16.safeParse(credentialSupported);
1172
- if (!parseResult.success) {
1173
- throw new import_utils9.ValidationError(
1174
- `Error transforming credential supported with id '${credentialSupported.id}' to credential configuration supported format`,
1175
- parseResult.error
1176
- );
1177
- }
1178
- credentialConfigurationsSupported[credentialSupported.id] = parseResult.data;
1179
- }
1180
- return credentialConfigurationsSupported;
912
+ const credentialConfigurationsSupported = {};
913
+ for (let index = 0; index < credentialsSupported.length; index++) {
914
+ const credentialSupported = credentialsSupported[index];
915
+ if (!credentialSupported.id) throw new Openid4vciError(`Credential supported at index '${index}' does not have an 'id' property. Credential configuration requires the 'id' property as key`);
916
+ const parseResult = zCredentialConfigurationSupportedDraft11To16.safeParse(credentialSupported);
917
+ if (!parseResult.success) throw new __openid4vc_utils.ValidationError(`Error transforming credential supported with id '${credentialSupported.id}' to credential configuration supported format`, parseResult.error);
918
+ credentialConfigurationsSupported[credentialSupported.id] = parseResult.data;
919
+ }
920
+ return credentialConfigurationsSupported;
1181
921
  }
1182
922
 
1183
- // src/Openid4vciClient.ts
1184
- var import_oauth219 = require("@openid4vc/oauth2");
1185
-
1186
- // src/credential-request/format-payload.ts
1187
- var import_utils10 = require("@openid4vc/utils");
923
+ //#endregion
924
+ //#region src/credential-request/format-payload.ts
1188
925
  function getCredentialRequestFormatPayloadForCredentialConfigurationId(options) {
1189
- const credentialConfiguration = getCredentialConfigurationSupportedById(
1190
- options.issuerMetadata.credentialIssuer.credential_configurations_supported,
1191
- options.credentialConfigurationId
1192
- );
1193
- if ((0, import_utils10.zIs)(zLegacySdJwtVcCredentialIssuerMetadataDraft16, credentialConfiguration) || (0, import_utils10.zIs)(zLegacySdJwtVcCredentialIssuerMetadataDraft14, credentialConfiguration)) {
1194
- return {
1195
- format: credentialConfiguration.format,
1196
- vct: credentialConfiguration.vct
1197
- };
1198
- }
1199
- if ((0, import_utils10.zIs)(zMsoMdocCredentialIssuerMetadata, credentialConfiguration) || (0, import_utils10.zIs)(zMsoMdocCredentialIssuerMetadataDraft14, credentialConfiguration)) {
1200
- return {
1201
- format: credentialConfiguration.format,
1202
- doctype: credentialConfiguration.doctype
1203
- };
1204
- }
1205
- if ((0, import_utils10.zIs)(zLdpVcCredentialIssuerMetadata, credentialConfiguration) || (0, import_utils10.zIs)(zLdpVcCredentialIssuerMetadataDraft14, credentialConfiguration)) {
1206
- return {
1207
- format: credentialConfiguration.format,
1208
- credential_definition: {
1209
- "@context": credentialConfiguration.credential_definition["@context"],
1210
- type: credentialConfiguration.credential_definition.type
1211
- }
1212
- };
1213
- }
1214
- if ((0, import_utils10.zIs)(zJwtVcJsonLdCredentialIssuerMetadata, credentialConfiguration) || (0, import_utils10.zIs)(zJwtVcJsonLdCredentialIssuerMetadataDraft14, credentialConfiguration)) {
1215
- return {
1216
- format: credentialConfiguration.format,
1217
- credential_definition: {
1218
- "@context": credentialConfiguration.credential_definition["@context"],
1219
- type: credentialConfiguration.credential_definition.type
1220
- }
1221
- };
1222
- }
1223
- if ((0, import_utils10.zIs)(zJwtVcJsonCredentialIssuerMetadata, credentialConfiguration) || (0, import_utils10.zIs)(zJwtVcJsonCredentialIssuerMetadataDraft14, credentialConfiguration)) {
1224
- return {
1225
- format: credentialConfiguration.format,
1226
- credential_definition: {
1227
- type: credentialConfiguration.credential_definition.type
1228
- }
1229
- };
1230
- }
1231
- if ((0, import_utils10.zIs)(zSdJwtDcCredentialIssuerMetadata, credentialConfiguration)) {
1232
- throw new Openid4vciError(
1233
- `Credential configuration id '${options.credentialConfigurationId}' with format ${zLegacySdJwtVcFormatIdentifier.value} does not support credential request based on 'format'. Use 'credential_configuration_id' directly.`
1234
- );
1235
- }
1236
- if ((0, import_utils10.zIs)(zSdJwtW3VcCredentialIssuerMetadata, credentialConfiguration)) {
1237
- return {
1238
- format: credentialConfiguration.format,
1239
- credential_definition: {
1240
- type: credentialConfiguration.credential_definition.type
1241
- }
1242
- };
1243
- }
1244
- throw new Openid4vciError(
1245
- `Unknown format '${credentialConfiguration.format}' in credential configuration with id '${options.credentialConfigurationId}' for credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}'`
1246
- );
926
+ const credentialConfiguration = getCredentialConfigurationSupportedById(options.issuerMetadata.credentialIssuer.credential_configurations_supported, options.credentialConfigurationId);
927
+ if ((0, __openid4vc_utils.zIs)(zLegacySdJwtVcCredentialIssuerMetadataDraft16, credentialConfiguration) || (0, __openid4vc_utils.zIs)(zLegacySdJwtVcCredentialIssuerMetadataDraft14, credentialConfiguration)) return {
928
+ format: credentialConfiguration.format,
929
+ vct: credentialConfiguration.vct
930
+ };
931
+ if ((0, __openid4vc_utils.zIs)(zMsoMdocCredentialIssuerMetadata, credentialConfiguration) || (0, __openid4vc_utils.zIs)(zMsoMdocCredentialIssuerMetadataDraft14, credentialConfiguration)) return {
932
+ format: credentialConfiguration.format,
933
+ doctype: credentialConfiguration.doctype
934
+ };
935
+ if ((0, __openid4vc_utils.zIs)(zLdpVcCredentialIssuerMetadata, credentialConfiguration) || (0, __openid4vc_utils.zIs)(zLdpVcCredentialIssuerMetadataDraft14, credentialConfiguration)) return {
936
+ format: credentialConfiguration.format,
937
+ credential_definition: {
938
+ "@context": credentialConfiguration.credential_definition["@context"],
939
+ type: credentialConfiguration.credential_definition.type
940
+ }
941
+ };
942
+ if ((0, __openid4vc_utils.zIs)(zJwtVcJsonLdCredentialIssuerMetadata, credentialConfiguration) || (0, __openid4vc_utils.zIs)(zJwtVcJsonLdCredentialIssuerMetadataDraft14, credentialConfiguration)) return {
943
+ format: credentialConfiguration.format,
944
+ credential_definition: {
945
+ "@context": credentialConfiguration.credential_definition["@context"],
946
+ type: credentialConfiguration.credential_definition.type
947
+ }
948
+ };
949
+ if ((0, __openid4vc_utils.zIs)(zJwtVcJsonCredentialIssuerMetadata, credentialConfiguration) || (0, __openid4vc_utils.zIs)(zJwtVcJsonCredentialIssuerMetadataDraft14, credentialConfiguration)) return {
950
+ format: credentialConfiguration.format,
951
+ credential_definition: { type: credentialConfiguration.credential_definition.type }
952
+ };
953
+ if ((0, __openid4vc_utils.zIs)(zSdJwtDcCredentialIssuerMetadata, credentialConfiguration)) throw new Openid4vciError(`Credential configuration id '${options.credentialConfigurationId}' with format ${zLegacySdJwtVcFormatIdentifier.value} does not support credential request based on 'format'. Use 'credential_configuration_id' directly.`);
954
+ if ((0, __openid4vc_utils.zIs)(zSdJwtW3VcCredentialIssuerMetadata, credentialConfiguration)) return {
955
+ format: credentialConfiguration.format,
956
+ credential_definition: { type: credentialConfiguration.credential_definition.type }
957
+ };
958
+ throw new Openid4vciError(`Unknown format '${credentialConfiguration.format}' in credential configuration with id '${options.credentialConfigurationId}' for credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}'`);
1247
959
  }
1248
960
 
1249
- // src/credential-request/retrieve-credentials.ts
1250
- var import_oauth213 = require("@openid4vc/oauth2");
1251
- var import_utils12 = require("@openid4vc/utils");
1252
-
1253
- // src/credential-request/z-credential-request.ts
1254
- var import_oauth212 = require("@openid4vc/oauth2");
1255
- var import_zod17 = __toESM(require("zod"));
1256
-
1257
- // src/credential-request/z-credential-request-common.ts
1258
- var import_oauth211 = require("@openid4vc/oauth2");
1259
- var import_zod16 = __toESM(require("zod"));
1260
-
1261
- // src/formats/proof-type/jwt/z-jwt-proof-type.ts
1262
- var import_oauth29 = require("@openid4vc/oauth2");
1263
- var import_utils11 = require("@openid4vc/utils");
1264
- var import_zod14 = __toESM(require("zod"));
1265
- var zJwtProofTypeIdentifier = import_zod14.default.literal("jwt");
1266
- var jwtProofTypeIdentifier = zJwtProofTypeIdentifier.value;
1267
- var zCredentialRequestProofJwt = import_zod14.default.object({
1268
- proof_type: zJwtProofTypeIdentifier,
1269
- jwt: import_oauth29.zCompactJwt
1270
- });
1271
- var zCredentialRequestJwtProofTypeHeader = import_oauth29.zJwtHeader.merge(
1272
- import_zod14.default.object({
1273
- key_attestation: import_zod14.default.optional(import_oauth29.zCompactJwt),
1274
- typ: import_zod14.default.literal("openid4vci-proof+jwt")
1275
- })
1276
- ).passthrough().refine(({ kid, jwk }) => jwk === void 0 || kid === void 0, {
1277
- message: `Both 'jwk' and 'kid' are defined. Only one is allowed`
1278
- }).refine(({ trust_chain, kid }) => !trust_chain || !kid, {
1279
- message: `When 'trust_chain' is provided, 'kid' is required`
961
+ //#endregion
962
+ //#region src/formats/proof-type/attestation/z-attestation-proof-type.ts
963
+ const zAttestationProofTypeIdentifier = zod.default.literal("attestation");
964
+ const attestationProofTypeIdentifier = zAttestationProofTypeIdentifier.value;
965
+ const zCredentialRequestProofAttestation = zod.default.object({
966
+ proof_type: zAttestationProofTypeIdentifier,
967
+ attestation: __openid4vc_oauth2.zCompactJwt
1280
968
  });
1281
- var zCredentialRequestJwtProofTypePayload = import_zod14.default.object({
1282
- ...import_oauth29.zJwtPayload.shape,
1283
- aud: import_utils11.zHttpsUrl,
1284
- iat: import_utils11.zInteger
1285
- }).passthrough();
969
+ const zCredentialRequestAttestationProofTypePayload = zKeyAttestationJwtPayloadForUse("proof_type.attestation");
1286
970
 
1287
- // src/formats/proof-type/attestation/z-attestation-proof-type.ts
1288
- var import_oauth210 = require("@openid4vc/oauth2");
1289
- var import_zod15 = __toESM(require("zod"));
1290
- var zAttestationProofTypeIdentifier = import_zod15.default.literal("attestation");
1291
- var attestationProofTypeIdentifier = zAttestationProofTypeIdentifier.value;
1292
- var zCredentialRequestProofAttestation = import_zod15.default.object({
1293
- proof_type: zAttestationProofTypeIdentifier,
1294
- attestation: import_oauth210.zCompactJwt
971
+ //#endregion
972
+ //#region src/formats/proof-type/jwt/z-jwt-proof-type.ts
973
+ const zJwtProofTypeIdentifier = zod.default.literal("jwt");
974
+ const jwtProofTypeIdentifier = zJwtProofTypeIdentifier.value;
975
+ const zCredentialRequestProofJwt = zod.default.object({
976
+ proof_type: zJwtProofTypeIdentifier,
977
+ jwt: __openid4vc_oauth2.zCompactJwt
1295
978
  });
1296
- var zCredentialRequestAttestationProofTypePayload = zKeyAttestationJwtPayloadForUse("proof_type.attestation");
1297
-
1298
- // src/credential-request/z-credential-request-common.ts
1299
- var zCredentialRequestProofCommon = import_zod16.default.object({
1300
- proof_type: import_zod16.default.string()
979
+ const zCredentialRequestJwtProofTypeHeader = __openid4vc_oauth2.zJwtHeader.merge(zod.default.object({
980
+ key_attestation: zod.default.optional(__openid4vc_oauth2.zCompactJwt),
981
+ typ: zod.default.literal("openid4vci-proof+jwt")
982
+ })).passthrough().refine(({ kid, jwk }) => jwk === void 0 || kid === void 0, { message: `Both 'jwk' and 'kid' are defined. Only one is allowed` }).refine(({ trust_chain, kid }) => !trust_chain || !kid, { message: `When 'trust_chain' is provided, 'kid' is required` });
983
+ const zCredentialRequestJwtProofTypePayload = zod.default.object({
984
+ ...__openid4vc_oauth2.zJwtPayload.shape,
985
+ aud: __openid4vc_utils.zHttpsUrl,
986
+ iat: __openid4vc_utils.zInteger
1301
987
  }).passthrough();
1302
- var allCredentialRequestProofs = [zCredentialRequestProofJwt, zCredentialRequestProofAttestation];
1303
- var zCredentialRequestProof = import_zod16.default.union([
1304
- zCredentialRequestProofCommon,
1305
- import_zod16.default.discriminatedUnion("proof_type", allCredentialRequestProofs)
1306
- ]);
1307
- var zCredentialRequestProofsCommon = import_zod16.default.record(import_zod16.default.string(), import_zod16.default.array(import_zod16.default.unknown()));
1308
- var zCredentialRequestProofs = import_zod16.default.object({
1309
- [zJwtProofTypeIdentifier.value]: import_zod16.default.optional(import_zod16.default.array(zCredentialRequestProofJwt.shape.jwt)),
1310
- [zAttestationProofTypeIdentifier.value]: import_zod16.default.optional(import_zod16.default.array(zCredentialRequestProofAttestation.shape.attestation))
1311
- });
1312
- var zCredentialRequestCommon = import_zod16.default.object({
1313
- proof: zCredentialRequestProof.optional(),
1314
- proofs: import_zod16.default.optional(
1315
- import_zod16.default.intersection(zCredentialRequestProofsCommon, zCredentialRequestProofs).refine((proofs) => Object.values(proofs).length === 1, {
1316
- message: `The 'proofs' object in a credential request should contain exactly one attribute`
1317
- })
1318
- ),
1319
- credential_response_encryption: import_zod16.default.object({
1320
- jwk: import_oauth211.zJwk,
1321
- alg: import_zod16.default.string(),
1322
- enc: import_zod16.default.string()
1323
- }).passthrough().optional()
1324
- }).passthrough().refine(({ proof, proofs }) => !(proof !== void 0 && proofs !== void 0), {
1325
- message: `Both 'proof' and 'proofs' are defined. Only one is allowed`
988
+
989
+ //#endregion
990
+ //#region src/credential-request/z-credential-request-common.ts
991
+ const zCredentialRequestProofCommon = zod.default.object({ proof_type: zod.default.string() }).passthrough();
992
+ const allCredentialRequestProofs = [zCredentialRequestProofJwt, zCredentialRequestProofAttestation];
993
+ const zCredentialRequestProof = zod.default.union([zCredentialRequestProofCommon, zod.default.discriminatedUnion("proof_type", allCredentialRequestProofs)]);
994
+ const zCredentialRequestProofsCommon = zod.default.record(zod.default.string(), zod.default.array(zod.default.unknown()));
995
+ const zCredentialRequestProofs = zod.default.object({
996
+ [zJwtProofTypeIdentifier.value]: zod.default.optional(zod.default.array(zCredentialRequestProofJwt.shape.jwt)),
997
+ [zAttestationProofTypeIdentifier.value]: zod.default.optional(zod.default.array(zCredentialRequestProofAttestation.shape.attestation))
1326
998
  });
999
+ const zCredentialRequestCommon = zod.default.object({
1000
+ proof: zCredentialRequestProof.optional(),
1001
+ proofs: zod.default.optional(zod.default.intersection(zCredentialRequestProofsCommon, zCredentialRequestProofs).refine((proofs) => Object.values(proofs).length === 1, { message: `The 'proofs' object in a credential request should contain exactly one attribute` })),
1002
+ credential_response_encryption: zod.default.object({
1003
+ jwk: __openid4vc_oauth2.zJwk,
1004
+ alg: zod.default.string(),
1005
+ enc: zod.default.string()
1006
+ }).passthrough().optional()
1007
+ }).passthrough().refine(({ proof, proofs }) => !(proof !== void 0 && proofs !== void 0), { message: `Both 'proof' and 'proofs' are defined. Only one is allowed` });
1327
1008
 
1328
- // src/credential-request/z-credential-request.ts
1329
- var allCredentialRequestFormats = [
1330
- zSdJwtW3VcCredentialRequestFormatDraft14,
1331
- zMsoMdocCredentialRequestFormatDraft14,
1332
- zLdpVcCredentialRequestFormatDraft14,
1333
- zJwtVcJsonLdCredentialRequestFormatDraft14,
1334
- zJwtVcJsonCredentialRequestFormatDraft14,
1335
- zLegacySdJwtVcCredentialRequestFormatDraft14
1009
+ //#endregion
1010
+ //#region src/credential-request/z-credential-request.ts
1011
+ const allCredentialRequestFormats = [
1012
+ zSdJwtW3VcCredentialRequestFormatDraft14,
1013
+ zMsoMdocCredentialRequestFormatDraft14,
1014
+ zLdpVcCredentialRequestFormatDraft14,
1015
+ zJwtVcJsonLdCredentialRequestFormatDraft14,
1016
+ zJwtVcJsonCredentialRequestFormatDraft14,
1017
+ zLegacySdJwtVcCredentialRequestFormatDraft14
1336
1018
  ];
1337
- var allCredentialRequestFormatIdentifiers = allCredentialRequestFormats.map(
1338
- (format) => format.shape.format.value
1339
- );
1340
- var zCredentialRequestCredentialConfigurationId = import_zod17.default.object({
1341
- credential_configuration_id: import_zod17.default.string(),
1342
- format: import_zod17.default.never({ message: "'format' cannot be defined when 'credential_configuration_id' is set." }).optional(),
1343
- credential_identifier: import_zod17.default.never({ message: "'credential_identifier' cannot be defined when 'credential_configuration_id' is set." }).optional()
1019
+ const allCredentialRequestFormatIdentifiers = allCredentialRequestFormats.map((format) => format.shape.format.value);
1020
+ const zCredentialRequestCredentialConfigurationId = zod.default.object({
1021
+ credential_configuration_id: zod.default.string(),
1022
+ format: zod.default.never({ message: "'format' cannot be defined when 'credential_configuration_id' is set." }).optional(),
1023
+ credential_identifier: zod.default.never({ message: "'credential_identifier' cannot be defined when 'credential_configuration_id' is set." }).optional()
1344
1024
  });
1345
- var zAuthorizationDetailsCredentialRequest = import_zod17.default.object({
1346
- credential_identifier: import_zod17.default.string(),
1347
- credential_configuration_id: import_zod17.default.never({ message: "'credential_configuration_id' cannot be defined when 'credential_identifier' is set." }).optional(),
1348
- // Cannot be present if credential identifier is present
1349
- format: import_zod17.default.never({ message: "'format' cannot be defined when 'credential_identifier' is set." }).optional()
1025
+ const zAuthorizationDetailsCredentialRequest = zod.default.object({
1026
+ credential_identifier: zod.default.string(),
1027
+ credential_configuration_id: zod.default.never({ message: "'credential_configuration_id' cannot be defined when 'credential_identifier' is set." }).optional(),
1028
+ format: zod.default.never({ message: "'format' cannot be defined when 'credential_identifier' is set." }).optional()
1350
1029
  });
1351
- var zCredentialRequestFormat = import_zod17.default.object({
1352
- format: import_zod17.default.string(),
1353
- credential_identifier: import_zod17.default.never({ message: "'credential_identifier' cannot be defined when 'format' is set." }).optional(),
1354
- credential_configuration_id: import_zod17.default.never({ message: "'credential_configuration_id' cannot be defined when 'format' is set." }).optional()
1030
+ const zCredentialRequestFormat = zod.default.object({
1031
+ format: zod.default.string(),
1032
+ credential_identifier: zod.default.never({ message: "'credential_identifier' cannot be defined when 'format' is set." }).optional(),
1033
+ credential_configuration_id: zod.default.never({ message: "'credential_configuration_id' cannot be defined when 'format' is set." }).optional()
1355
1034
  }).passthrough();
1356
- var zCredentialRequestDraft14WithFormat = zCredentialRequestCommon.and(zCredentialRequestFormat).transform((data, ctx) => {
1357
- if (!allCredentialRequestFormatIdentifiers.includes(
1358
- data.format
1359
- ))
1360
- return data;
1361
- const result = import_zod17.default.object({}).passthrough().and(import_zod17.default.union(allCredentialRequestFormats)).safeParse(data);
1362
- if (result.success) {
1363
- return result.data;
1364
- }
1365
- for (const issue of result.error.issues) {
1366
- ctx.addIssue(issue);
1367
- }
1368
- return import_zod17.default.NEVER;
1035
+ const zCredentialRequestDraft14WithFormat = zCredentialRequestCommon.and(zCredentialRequestFormat).transform((data, ctx) => {
1036
+ if (!allCredentialRequestFormatIdentifiers.includes(data.format)) return data;
1037
+ const result = zod.default.object({}).passthrough().and(zod.default.union(allCredentialRequestFormats)).safeParse(data);
1038
+ if (result.success) return result.data;
1039
+ for (const issue of result.error.issues) ctx.addIssue(issue);
1040
+ return zod.default.NEVER;
1369
1041
  });
1370
- var zCredentialRequestDraft15 = import_zod17.default.union([
1371
- zCredentialRequestCommon.and(zAuthorizationDetailsCredentialRequest),
1372
- zCredentialRequestCommon.and(zCredentialRequestCredentialConfigurationId)
1373
- ]);
1374
- var zCredentialRequestDraft14 = import_zod17.default.union([
1375
- zCredentialRequestDraft14WithFormat,
1376
- zCredentialRequestCommon.and(zAuthorizationDetailsCredentialRequest)
1377
- ]);
1378
- var zCredentialRequestDraft11To14 = zCredentialRequestCommon.and(zCredentialRequestFormat).transform((data, ctx) => {
1379
- const formatSpecificTransformations = {
1380
- [zLdpVcFormatIdentifier.value]: zLdpVcCredentialRequestDraft11To14,
1381
- [zJwtVcJsonFormatIdentifier.value]: zJwtVcJsonCredentialRequestDraft11To14,
1382
- [zJwtVcJsonLdFormatIdentifier.value]: zJwtVcJsonLdCredentialRequestDraft11To14
1383
- };
1384
- if (!Object.keys(formatSpecificTransformations).includes(data.format)) return data;
1385
- const schema = formatSpecificTransformations[data.format];
1386
- const result = schema.safeParse(data);
1387
- if (result.success) return result.data;
1388
- for (const issue of result.error.issues) {
1389
- ctx.addIssue(issue);
1390
- }
1391
- return import_zod17.default.NEVER;
1042
+ const zCredentialRequestDraft15 = zod.default.union([zCredentialRequestCommon.and(zAuthorizationDetailsCredentialRequest), zCredentialRequestCommon.and(zCredentialRequestCredentialConfigurationId)]);
1043
+ const zCredentialRequestDraft14 = zod.default.union([zCredentialRequestDraft14WithFormat, zCredentialRequestCommon.and(zAuthorizationDetailsCredentialRequest)]);
1044
+ const zCredentialRequestDraft11To14 = zCredentialRequestCommon.and(zCredentialRequestFormat).transform((data, ctx) => {
1045
+ const formatSpecificTransformations = {
1046
+ [zLdpVcFormatIdentifier.value]: zLdpVcCredentialRequestDraft11To14,
1047
+ [zJwtVcJsonFormatIdentifier.value]: zJwtVcJsonCredentialRequestDraft11To14,
1048
+ [zJwtVcJsonLdFormatIdentifier.value]: zJwtVcJsonLdCredentialRequestDraft11To14
1049
+ };
1050
+ if (!Object.keys(formatSpecificTransformations).includes(data.format)) return data;
1051
+ const result = formatSpecificTransformations[data.format].safeParse(data);
1052
+ if (result.success) return result.data;
1053
+ for (const issue of result.error.issues) ctx.addIssue(issue);
1054
+ return zod.default.NEVER;
1392
1055
  }).pipe(zCredentialRequestDraft14);
1393
- var zCredentialRequestDraft14To11 = zCredentialRequestDraft14.refine(
1394
- (data) => data.credential_identifier === void 0,
1395
- `'credential_identifier' is not supported in OpenID4VCI draft 11`
1396
- ).transform((data, ctx) => {
1397
- const formatSpecificTransformations = {
1398
- [zLdpVcFormatIdentifier.value]: zLdpVcCredentialRequestDraft14To11,
1399
- [zJwtVcJsonFormatIdentifier.value]: zJwtVcJsonCredentialRequestDraft14To11,
1400
- [zJwtVcJsonLdFormatIdentifier.value]: zJwtVcJsonLdCredentialRequestDraft14To11
1401
- };
1402
- if (!Object.keys(formatSpecificTransformations).includes(data.format)) return data;
1403
- const schema = formatSpecificTransformations[data.format];
1404
- const result = schema.safeParse(data);
1405
- if (result.success) return result.data;
1406
- for (const issue of result.error.issues) {
1407
- ctx.addIssue(issue);
1408
- }
1409
- return import_zod17.default.NEVER;
1056
+ const zCredentialRequestDraft14To11 = zCredentialRequestDraft14.refine((data) => data.credential_identifier === void 0, `'credential_identifier' is not supported in OpenID4VCI draft 11`).transform((data, ctx) => {
1057
+ const formatSpecificTransformations = {
1058
+ [zLdpVcFormatIdentifier.value]: zLdpVcCredentialRequestDraft14To11,
1059
+ [zJwtVcJsonFormatIdentifier.value]: zJwtVcJsonCredentialRequestDraft14To11,
1060
+ [zJwtVcJsonLdFormatIdentifier.value]: zJwtVcJsonLdCredentialRequestDraft14To11
1061
+ };
1062
+ if (!Object.keys(formatSpecificTransformations).includes(data.format)) return data;
1063
+ const result = formatSpecificTransformations[data.format].safeParse(data);
1064
+ if (result.success) return result.data;
1065
+ for (const issue of result.error.issues) ctx.addIssue(issue);
1066
+ return zod.default.NEVER;
1410
1067
  });
1411
- var zCredentialRequest = import_zod17.default.union([
1412
- zCredentialRequestDraft15,
1413
- zCredentialRequestDraft14,
1414
- zCredentialRequestDraft11To14
1068
+ const zCredentialRequest = zod.default.union([
1069
+ zCredentialRequestDraft15,
1070
+ zCredentialRequestDraft14,
1071
+ zCredentialRequestDraft11To14
1415
1072
  ]);
1416
- var zDeferredCredentialRequest = import_zod17.default.object({
1417
- transaction_id: import_zod17.default.string().nonempty(),
1418
- credential_response_encryption: import_zod17.default.object({
1419
- jwk: import_oauth212.zJwk,
1420
- alg: import_zod17.default.string(),
1421
- enc: import_zod17.default.string()
1422
- }).passthrough().optional()
1073
+ const zDeferredCredentialRequest = zod.default.object({
1074
+ transaction_id: zod.default.string().nonempty(),
1075
+ credential_response_encryption: zod.default.object({
1076
+ jwk: __openid4vc_oauth2.zJwk,
1077
+ alg: zod.default.string(),
1078
+ enc: zod.default.string()
1079
+ }).passthrough().optional()
1423
1080
  });
1424
1081
 
1425
- // src/credential-request/z-credential-response.ts
1426
- var import_zod19 = __toESM(require("zod"));
1427
-
1428
- // ../oauth2/src/common/z-oauth2-error.ts
1429
- var import_zod18 = __toESM(require("zod"));
1430
- var Oauth2ErrorCodes = /* @__PURE__ */ ((Oauth2ErrorCodes4) => {
1431
- Oauth2ErrorCodes4["ServerError"] = "server_error";
1432
- Oauth2ErrorCodes4["InvalidTarget"] = "invalid_target";
1433
- Oauth2ErrorCodes4["InvalidRequest"] = "invalid_request";
1434
- Oauth2ErrorCodes4["InvalidToken"] = "invalid_token";
1435
- Oauth2ErrorCodes4["InsufficientScope"] = "insufficient_scope";
1436
- Oauth2ErrorCodes4["InvalidGrant"] = "invalid_grant";
1437
- Oauth2ErrorCodes4["InvalidClient"] = "invalid_client";
1438
- Oauth2ErrorCodes4["UnauthorizedClient"] = "unauthorized_client";
1439
- Oauth2ErrorCodes4["UnsupportedGrantType"] = "unsupported_grant_type";
1440
- Oauth2ErrorCodes4["InvalidScope"] = "invalid_scope";
1441
- Oauth2ErrorCodes4["InvalidDpopProof"] = "invalid_dpop_proof";
1442
- Oauth2ErrorCodes4["UseDpopNonce"] = "use_dpop_nonce";
1443
- Oauth2ErrorCodes4["RedirectToWeb"] = "redirect_to_web";
1444
- Oauth2ErrorCodes4["InvalidSession"] = "invalid_session";
1445
- Oauth2ErrorCodes4["InsufficientAuthorization"] = "insufficient_authorization";
1446
- Oauth2ErrorCodes4["InvalidCredentialRequest"] = "invalid_credential_request";
1447
- Oauth2ErrorCodes4["CredentialRequestDenied"] = "credential_request_denied";
1448
- Oauth2ErrorCodes4["InvalidProof"] = "invalid_proof";
1449
- Oauth2ErrorCodes4["InvalidNonce"] = "invalid_nonce";
1450
- Oauth2ErrorCodes4["InvalidEncryptionParameters"] = "invalid_encryption_parameters";
1451
- Oauth2ErrorCodes4["UnknownCredentialConfiguration"] = "unknown_credential_configuration";
1452
- Oauth2ErrorCodes4["UnknownCredentialIdentifier"] = "unknown_credential_identifier";
1453
- Oauth2ErrorCodes4["InvalidTransactionId"] = "invalid_transaction_id";
1454
- Oauth2ErrorCodes4["UnsupportedCredentialType"] = "unsupported_credential_type";
1455
- Oauth2ErrorCodes4["UnsupportedCredentialFormat"] = "unsupported_credential_format";
1456
- Oauth2ErrorCodes4["InvalidRequestUri"] = "invalid_request_uri";
1457
- Oauth2ErrorCodes4["InvalidRequestObject"] = "invalid_request_object";
1458
- Oauth2ErrorCodes4["RequestNotSupported"] = "request_not_supported";
1459
- Oauth2ErrorCodes4["RequestUriNotSupported"] = "request_uri_not_supported";
1460
- Oauth2ErrorCodes4["VpFormatsNotSupported"] = "vp_formats_not_supported";
1461
- Oauth2ErrorCodes4["AccessDenied"] = "access_denied";
1462
- Oauth2ErrorCodes4["InvalidPresentationDefinitionUri"] = "invalid_presentation_definition_uri";
1463
- Oauth2ErrorCodes4["InvalidPresentationDefinitionReference"] = "invalid_presentation_definition_reference";
1464
- Oauth2ErrorCodes4["InvalidRequestUriMethod"] = "invalid_request_uri_method";
1465
- Oauth2ErrorCodes4["InvalidTransactionData"] = "invalid_transaction_data";
1466
- Oauth2ErrorCodes4["WalletUnavailable"] = "wallet_unavailable";
1467
- return Oauth2ErrorCodes4;
1468
- })(Oauth2ErrorCodes || {});
1469
- var zOauth2ErrorResponse = import_zod18.default.object({
1470
- error: import_zod18.default.union([import_zod18.default.nativeEnum(Oauth2ErrorCodes), import_zod18.default.string()]),
1471
- error_description: import_zod18.default.string().optional(),
1472
- error_uri: import_zod18.default.string().optional()
1082
+ //#endregion
1083
+ //#region ../oauth2/src/common/z-oauth2-error.ts
1084
+ let Oauth2ErrorCodes$2 = /* @__PURE__ */ function(Oauth2ErrorCodes$3) {
1085
+ Oauth2ErrorCodes$3["ServerError"] = "server_error";
1086
+ Oauth2ErrorCodes$3["InvalidTarget"] = "invalid_target";
1087
+ Oauth2ErrorCodes$3["InvalidRequest"] = "invalid_request";
1088
+ Oauth2ErrorCodes$3["InvalidToken"] = "invalid_token";
1089
+ Oauth2ErrorCodes$3["InsufficientScope"] = "insufficient_scope";
1090
+ Oauth2ErrorCodes$3["InvalidGrant"] = "invalid_grant";
1091
+ Oauth2ErrorCodes$3["InvalidClient"] = "invalid_client";
1092
+ Oauth2ErrorCodes$3["UnauthorizedClient"] = "unauthorized_client";
1093
+ Oauth2ErrorCodes$3["UnsupportedGrantType"] = "unsupported_grant_type";
1094
+ Oauth2ErrorCodes$3["InvalidScope"] = "invalid_scope";
1095
+ Oauth2ErrorCodes$3["InvalidDpopProof"] = "invalid_dpop_proof";
1096
+ Oauth2ErrorCodes$3["UseDpopNonce"] = "use_dpop_nonce";
1097
+ Oauth2ErrorCodes$3["RedirectToWeb"] = "redirect_to_web";
1098
+ Oauth2ErrorCodes$3["InvalidSession"] = "invalid_session";
1099
+ Oauth2ErrorCodes$3["InsufficientAuthorization"] = "insufficient_authorization";
1100
+ Oauth2ErrorCodes$3["InvalidCredentialRequest"] = "invalid_credential_request";
1101
+ Oauth2ErrorCodes$3["CredentialRequestDenied"] = "credential_request_denied";
1102
+ Oauth2ErrorCodes$3["InvalidProof"] = "invalid_proof";
1103
+ Oauth2ErrorCodes$3["InvalidNonce"] = "invalid_nonce";
1104
+ Oauth2ErrorCodes$3["InvalidEncryptionParameters"] = "invalid_encryption_parameters";
1105
+ Oauth2ErrorCodes$3["UnknownCredentialConfiguration"] = "unknown_credential_configuration";
1106
+ Oauth2ErrorCodes$3["UnknownCredentialIdentifier"] = "unknown_credential_identifier";
1107
+ Oauth2ErrorCodes$3["InvalidTransactionId"] = "invalid_transaction_id";
1108
+ Oauth2ErrorCodes$3["UnsupportedCredentialType"] = "unsupported_credential_type";
1109
+ Oauth2ErrorCodes$3["UnsupportedCredentialFormat"] = "unsupported_credential_format";
1110
+ Oauth2ErrorCodes$3["InvalidRequestUri"] = "invalid_request_uri";
1111
+ Oauth2ErrorCodes$3["InvalidRequestObject"] = "invalid_request_object";
1112
+ Oauth2ErrorCodes$3["RequestNotSupported"] = "request_not_supported";
1113
+ Oauth2ErrorCodes$3["RequestUriNotSupported"] = "request_uri_not_supported";
1114
+ Oauth2ErrorCodes$3["VpFormatsNotSupported"] = "vp_formats_not_supported";
1115
+ Oauth2ErrorCodes$3["AccessDenied"] = "access_denied";
1116
+ Oauth2ErrorCodes$3["InvalidPresentationDefinitionUri"] = "invalid_presentation_definition_uri";
1117
+ Oauth2ErrorCodes$3["InvalidPresentationDefinitionReference"] = "invalid_presentation_definition_reference";
1118
+ Oauth2ErrorCodes$3["InvalidRequestUriMethod"] = "invalid_request_uri_method";
1119
+ Oauth2ErrorCodes$3["InvalidTransactionData"] = "invalid_transaction_data";
1120
+ Oauth2ErrorCodes$3["WalletUnavailable"] = "wallet_unavailable";
1121
+ return Oauth2ErrorCodes$3;
1122
+ }({});
1123
+ const zOauth2ErrorResponse = zod.default.object({
1124
+ error: zod.default.union([zod.default.nativeEnum(Oauth2ErrorCodes$2), zod.default.string()]),
1125
+ error_description: zod.default.string().optional(),
1126
+ error_uri: zod.default.string().optional()
1473
1127
  }).passthrough();
1474
1128
 
1475
- // src/credential-request/z-credential-response.ts
1476
- var zCredentialEncoding = import_zod19.default.union([import_zod19.default.string(), import_zod19.default.record(import_zod19.default.string(), import_zod19.default.any())]);
1477
- var zBaseCredentialResponse = import_zod19.default.object({
1478
- credentials: import_zod19.default.union([
1479
- // Draft >= 15
1480
- import_zod19.default.array(import_zod19.default.object({ credential: zCredentialEncoding })),
1481
- // Draft < 15
1482
- import_zod19.default.array(zCredentialEncoding)
1483
- ]).optional(),
1484
- interval: import_zod19.default.number().int().positive().optional(),
1485
- notification_id: import_zod19.default.string().optional()
1129
+ //#endregion
1130
+ //#region src/credential-request/z-credential-response.ts
1131
+ const zCredentialEncoding = zod.default.union([zod.default.string(), zod.default.record(zod.default.string(), zod.default.any())]);
1132
+ const zBaseCredentialResponse = zod.default.object({
1133
+ credentials: zod.default.union([zod.default.array(zod.default.object({ credential: zCredentialEncoding })), zod.default.array(zCredentialEncoding)]).optional(),
1134
+ interval: zod.default.number().int().positive().optional(),
1135
+ notification_id: zod.default.string().optional()
1486
1136
  }).passthrough();
1487
- var zCredentialResponse = zBaseCredentialResponse.extend({
1488
- credential: import_zod19.default.optional(zCredentialEncoding),
1489
- transaction_id: import_zod19.default.string().optional(),
1490
- c_nonce: import_zod19.default.string().optional(),
1491
- c_nonce_expires_in: import_zod19.default.number().int().optional()
1137
+ const zCredentialResponse = zBaseCredentialResponse.extend({
1138
+ credential: zod.default.optional(zCredentialEncoding),
1139
+ transaction_id: zod.default.string().optional(),
1140
+ c_nonce: zod.default.string().optional(),
1141
+ c_nonce_expires_in: zod.default.number().int().optional()
1492
1142
  }).passthrough().superRefine((value, ctx) => {
1493
- const { credential, credentials, transaction_id, interval, notification_id } = value;
1494
- if ([credential, credentials, transaction_id].filter((i) => i !== void 0).length !== 1) {
1495
- ctx.addIssue({
1496
- code: import_zod19.default.ZodIssueCode.custom,
1497
- message: `Exactly one of 'credential', 'credentials', or 'transaction_id' MUST be defined.`
1498
- });
1499
- }
1500
- if (transaction_id && !interval) {
1501
- ctx.addIssue({
1502
- code: import_zod19.default.ZodIssueCode.custom,
1503
- message: `'interval' MUST be defined when 'transaction_id' is defined.`
1504
- });
1505
- }
1506
- if (notification_id && !(credentials || credential)) {
1507
- ctx.addIssue({
1508
- code: import_zod19.default.ZodIssueCode.custom,
1509
- message: `'notification_id' MUST NOT be defined when 'credential' or 'credentials' are not defined.`
1510
- });
1511
- }
1143
+ const { credential, credentials, transaction_id, interval, notification_id } = value;
1144
+ if ([
1145
+ credential,
1146
+ credentials,
1147
+ transaction_id
1148
+ ].filter((i) => i !== void 0).length !== 1) ctx.addIssue({
1149
+ code: zod.default.ZodIssueCode.custom,
1150
+ message: `Exactly one of 'credential', 'credentials', or 'transaction_id' MUST be defined.`
1151
+ });
1152
+ if (transaction_id && !interval) ctx.addIssue({
1153
+ code: zod.default.ZodIssueCode.custom,
1154
+ message: `'interval' MUST be defined when 'transaction_id' is defined.`
1155
+ });
1156
+ if (notification_id && !(credentials || credential)) ctx.addIssue({
1157
+ code: zod.default.ZodIssueCode.custom,
1158
+ message: `'notification_id' MUST NOT be defined when 'credential' or 'credentials' are not defined.`
1159
+ });
1512
1160
  });
1513
- var zCredentialErrorResponse = import_zod19.default.object({
1514
- ...zOauth2ErrorResponse.shape,
1515
- c_nonce: import_zod19.default.string().optional(),
1516
- c_nonce_expires_in: import_zod19.default.number().int().optional()
1161
+ const zCredentialErrorResponse = zod.default.object({
1162
+ ...zOauth2ErrorResponse.shape,
1163
+ c_nonce: zod.default.string().optional(),
1164
+ c_nonce_expires_in: zod.default.number().int().optional()
1517
1165
  }).passthrough();
1518
- var zDeferredCredentialResponse = zBaseCredentialResponse.refine(
1519
- (value) => {
1520
- const { credentials, interval } = value;
1521
- return [credentials, interval].filter((i) => i !== void 0).length === 1;
1522
- },
1523
- {
1524
- message: `Exactly one of 'credentials' or 'interval' MUST be defined.`
1525
- }
1526
- );
1166
+ const zDeferredCredentialResponse = zBaseCredentialResponse.refine((value) => {
1167
+ const { credentials, interval } = value;
1168
+ return [credentials, interval].filter((i) => i !== void 0).length === 1;
1169
+ }, { message: `Exactly one of 'credentials' or 'interval' MUST be defined.` });
1527
1170
 
1528
- // src/credential-request/retrieve-credentials.ts
1171
+ //#endregion
1172
+ //#region src/credential-request/retrieve-credentials.ts
1529
1173
  async function retrieveCredentialsWithCredentialConfigurationId(options) {
1530
- if (options.issuerMetadata.originalDraftVersion !== "Draft15" /* Draft15 */ && options.issuerMetadata.originalDraftVersion !== "Draft16" /* Draft16 */) {
1531
- throw new Openid4vciError(
1532
- "Requesting credentials based on credential configuration ID is not supported in OpenID4VCI below draft 15. Make sure to provide the format and format specific claims in the request."
1533
- );
1534
- }
1535
- getCredentialConfigurationSupportedById(
1536
- options.issuerMetadata.credentialIssuer.credential_configurations_supported,
1537
- options.credentialConfigurationId
1538
- );
1539
- const credentialRequest = {
1540
- ...options.additionalRequestPayload,
1541
- credential_configuration_id: options.credentialConfigurationId,
1542
- proof: options.proof,
1543
- proofs: options.proofs
1544
- };
1545
- return retrieveCredentials({
1546
- callbacks: options.callbacks,
1547
- credentialRequest,
1548
- issuerMetadata: options.issuerMetadata,
1549
- accessToken: options.accessToken,
1550
- dpop: options.dpop
1551
- });
1174
+ if (options.issuerMetadata.originalDraftVersion !== Openid4vciDraftVersion.Draft15 && options.issuerMetadata.originalDraftVersion !== Openid4vciDraftVersion.Draft16) throw new Openid4vciError("Requesting credentials based on credential configuration ID is not supported in OpenID4VCI below draft 15. Make sure to provide the format and format specific claims in the request.");
1175
+ getCredentialConfigurationSupportedById(options.issuerMetadata.credentialIssuer.credential_configurations_supported, options.credentialConfigurationId);
1176
+ const credentialRequest = {
1177
+ ...options.additionalRequestPayload,
1178
+ credential_configuration_id: options.credentialConfigurationId,
1179
+ proof: options.proof,
1180
+ proofs: options.proofs
1181
+ };
1182
+ return retrieveCredentials({
1183
+ callbacks: options.callbacks,
1184
+ credentialRequest,
1185
+ issuerMetadata: options.issuerMetadata,
1186
+ accessToken: options.accessToken,
1187
+ dpop: options.dpop
1188
+ });
1552
1189
  }
1553
1190
  async function retrieveCredentialsWithFormat(options) {
1554
- if (options.issuerMetadata.originalDraftVersion === "Draft15" /* Draft15 */ || options.issuerMetadata.originalDraftVersion === "Draft16" /* Draft16 */) {
1555
- throw new Openid4vciError(
1556
- "Requesting credentials based on format is not supported in OpenID4VCI draft 15. Provide the credential configuration id directly in the request."
1557
- );
1558
- }
1559
- const credentialRequest = {
1560
- ...options.formatPayload,
1561
- ...options.additionalRequestPayload,
1562
- proof: options.proof,
1563
- proofs: options.proofs
1564
- };
1565
- return retrieveCredentials({
1566
- callbacks: options.callbacks,
1567
- credentialRequest,
1568
- issuerMetadata: options.issuerMetadata,
1569
- accessToken: options.accessToken,
1570
- dpop: options.dpop
1571
- });
1191
+ if (options.issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft15 || options.issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft16) throw new Openid4vciError("Requesting credentials based on format is not supported in OpenID4VCI draft 15. Provide the credential configuration id directly in the request.");
1192
+ const credentialRequest = {
1193
+ ...options.formatPayload,
1194
+ ...options.additionalRequestPayload,
1195
+ proof: options.proof,
1196
+ proofs: options.proofs
1197
+ };
1198
+ return retrieveCredentials({
1199
+ callbacks: options.callbacks,
1200
+ credentialRequest,
1201
+ issuerMetadata: options.issuerMetadata,
1202
+ accessToken: options.accessToken,
1203
+ dpop: options.dpop
1204
+ });
1572
1205
  }
1206
+ /**
1207
+ * internal method
1208
+ */
1573
1209
  async function retrieveCredentials(options) {
1574
- const credentialEndpoint = options.issuerMetadata.credentialIssuer.credential_endpoint;
1575
- let credentialRequest = (0, import_utils12.parseWithErrorHandling)(
1576
- zCredentialRequest,
1577
- options.credentialRequest,
1578
- "Error validating credential request"
1579
- );
1580
- if (credentialRequest.proofs) {
1581
- const { batch_credential_issuance } = options.issuerMetadata.credentialIssuer;
1582
- if (options.issuerMetadata.originalDraftVersion === "Draft11" /* Draft11 */) {
1583
- throw new import_oauth213.Oauth2Error(
1584
- `Credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}' does not support batch credential issuance using the 'proofs' request property. Only 'proof' is supported.`
1585
- );
1586
- }
1587
- const proofs = Object.values(credentialRequest.proofs)[0];
1588
- if (proofs.length > (batch_credential_issuance?.batch_size ?? 1)) {
1589
- throw new import_oauth213.Oauth2Error(
1590
- `Credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}' supports batch issuance, but the max batch size is '${batch_credential_issuance?.batch_size ?? 1}'. A total of '${proofs.length}' proofs were provided.`
1591
- );
1592
- }
1593
- }
1594
- if (options.issuerMetadata.originalDraftVersion === "Draft11" /* Draft11 */) {
1595
- credentialRequest = (0, import_utils12.parseWithErrorHandling)(
1596
- zCredentialRequestDraft14To11,
1597
- credentialRequest,
1598
- `Error transforming credential request from ${"Draft14" /* Draft14 */} to ${"Draft11" /* Draft11 */}`
1599
- );
1600
- }
1601
- const resourceResponse = await (0, import_oauth213.resourceRequest)({
1602
- dpop: options.dpop,
1603
- accessToken: options.accessToken,
1604
- callbacks: options.callbacks,
1605
- url: credentialEndpoint,
1606
- requestOptions: {
1607
- method: "POST",
1608
- headers: {
1609
- "Content-Type": import_utils12.ContentType.Json
1610
- },
1611
- body: JSON.stringify(credentialRequest)
1612
- }
1613
- });
1614
- if (!resourceResponse.ok) {
1615
- const credentialErrorResponseResult = (0, import_utils12.isResponseContentType)(import_utils12.ContentType.Json, resourceResponse.response) ? zCredentialErrorResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
1616
- return {
1617
- ...resourceResponse,
1618
- credentialErrorResponseResult
1619
- };
1620
- }
1621
- const credentialResponseResult = (0, import_utils12.isResponseContentType)(import_utils12.ContentType.Json, resourceResponse.response) ? zCredentialResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
1622
- if (!credentialResponseResult?.success) {
1623
- return {
1624
- ...resourceResponse,
1625
- ok: false,
1626
- credentialResponseResult
1627
- };
1628
- }
1629
- return {
1630
- ...resourceResponse,
1631
- credentialResponse: credentialResponseResult.data
1632
- };
1210
+ const credentialEndpoint = options.issuerMetadata.credentialIssuer.credential_endpoint;
1211
+ let credentialRequest = (0, __openid4vc_utils.parseWithErrorHandling)(zCredentialRequest, options.credentialRequest, "Error validating credential request");
1212
+ if (credentialRequest.proofs) {
1213
+ const { batch_credential_issuance } = options.issuerMetadata.credentialIssuer;
1214
+ if (options.issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft11) throw new __openid4vc_oauth2.Oauth2Error(`Credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}' does not support batch credential issuance using the 'proofs' request property. Only 'proof' is supported.`);
1215
+ const proofs = Object.values(credentialRequest.proofs)[0];
1216
+ if (proofs.length > (batch_credential_issuance?.batch_size ?? 1)) throw new __openid4vc_oauth2.Oauth2Error(`Credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}' supports batch issuance, but the max batch size is '${batch_credential_issuance?.batch_size ?? 1}'. A total of '${proofs.length}' proofs were provided.`);
1217
+ }
1218
+ if (options.issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft11) credentialRequest = (0, __openid4vc_utils.parseWithErrorHandling)(zCredentialRequestDraft14To11, credentialRequest, `Error transforming credential request from ${Openid4vciDraftVersion.Draft14} to ${Openid4vciDraftVersion.Draft11}`);
1219
+ const resourceResponse = await (0, __openid4vc_oauth2.resourceRequest)({
1220
+ dpop: options.dpop,
1221
+ accessToken: options.accessToken,
1222
+ callbacks: options.callbacks,
1223
+ url: credentialEndpoint,
1224
+ requestOptions: {
1225
+ method: "POST",
1226
+ headers: { "Content-Type": __openid4vc_utils.ContentType.Json },
1227
+ body: JSON.stringify(credentialRequest)
1228
+ }
1229
+ });
1230
+ if (!resourceResponse.ok) {
1231
+ const credentialErrorResponseResult = (0, __openid4vc_utils.isResponseContentType)(__openid4vc_utils.ContentType.Json, resourceResponse.response) ? zCredentialErrorResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
1232
+ return {
1233
+ ...resourceResponse,
1234
+ credentialErrorResponseResult
1235
+ };
1236
+ }
1237
+ const credentialResponseResult = (0, __openid4vc_utils.isResponseContentType)(__openid4vc_utils.ContentType.Json, resourceResponse.response) ? zCredentialResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
1238
+ if (!credentialResponseResult?.success) return {
1239
+ ...resourceResponse,
1240
+ ok: false,
1241
+ credentialResponseResult
1242
+ };
1243
+ return {
1244
+ ...resourceResponse,
1245
+ credentialResponse: credentialResponseResult.data
1246
+ };
1633
1247
  }
1634
1248
  async function retrieveDeferredCredentials(options) {
1635
- const credentialEndpoint = options.issuerMetadata.credentialIssuer.deferred_credential_endpoint;
1636
- if (!credentialEndpoint) {
1637
- throw new Openid4vciError(
1638
- `Credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}' does not support deferred credential retrieval.`
1639
- );
1640
- }
1641
- const deferredCredentialRequest = (0, import_utils12.parseWithErrorHandling)(
1642
- zDeferredCredentialRequest,
1643
- {
1644
- transaction_id: options.transactionId,
1645
- ...options.additionalRequestPayload
1646
- },
1647
- "Error validating deferred credential request"
1648
- );
1649
- const resourceResponse = await (0, import_oauth213.resourceRequest)({
1650
- dpop: options.dpop,
1651
- accessToken: options.accessToken,
1652
- callbacks: options.callbacks,
1653
- url: credentialEndpoint,
1654
- requestOptions: {
1655
- method: "POST",
1656
- headers: {
1657
- "Content-Type": import_utils12.ContentType.Json
1658
- },
1659
- body: JSON.stringify(deferredCredentialRequest)
1660
- }
1661
- });
1662
- if (!resourceResponse.ok) {
1663
- const deferredCredentialErrorResponseResult = (0, import_utils12.isResponseContentType)(import_utils12.ContentType.Json, resourceResponse.response) ? zCredentialErrorResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
1664
- return {
1665
- ...resourceResponse,
1666
- deferredCredentialErrorResponseResult
1667
- };
1668
- }
1669
- const deferredCredentialResponseResult = (0, import_utils12.isResponseContentType)(import_utils12.ContentType.Json, resourceResponse.response) ? zDeferredCredentialResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
1670
- if (!deferredCredentialResponseResult?.success) {
1671
- return {
1672
- ...resourceResponse,
1673
- ok: false,
1674
- deferredCredentialResponseResult
1675
- };
1676
- }
1677
- return {
1678
- ...resourceResponse,
1679
- deferredCredentialResponse: deferredCredentialResponseResult.data
1680
- };
1249
+ const credentialEndpoint = options.issuerMetadata.credentialIssuer.deferred_credential_endpoint;
1250
+ if (!credentialEndpoint) throw new Openid4vciError(`Credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}' does not support deferred credential retrieval.`);
1251
+ const deferredCredentialRequest = (0, __openid4vc_utils.parseWithErrorHandling)(zDeferredCredentialRequest, {
1252
+ transaction_id: options.transactionId,
1253
+ ...options.additionalRequestPayload
1254
+ }, "Error validating deferred credential request");
1255
+ const resourceResponse = await (0, __openid4vc_oauth2.resourceRequest)({
1256
+ dpop: options.dpop,
1257
+ accessToken: options.accessToken,
1258
+ callbacks: options.callbacks,
1259
+ url: credentialEndpoint,
1260
+ requestOptions: {
1261
+ method: "POST",
1262
+ headers: { "Content-Type": __openid4vc_utils.ContentType.Json },
1263
+ body: JSON.stringify(deferredCredentialRequest)
1264
+ }
1265
+ });
1266
+ if (!resourceResponse.ok) {
1267
+ const deferredCredentialErrorResponseResult = (0, __openid4vc_utils.isResponseContentType)(__openid4vc_utils.ContentType.Json, resourceResponse.response) ? zCredentialErrorResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
1268
+ return {
1269
+ ...resourceResponse,
1270
+ deferredCredentialErrorResponseResult
1271
+ };
1272
+ }
1273
+ const deferredCredentialResponseResult = (0, __openid4vc_utils.isResponseContentType)(__openid4vc_utils.ContentType.Json, resourceResponse.response) ? zDeferredCredentialResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
1274
+ if (!deferredCredentialResponseResult?.success) return {
1275
+ ...resourceResponse,
1276
+ ok: false,
1277
+ deferredCredentialResponseResult
1278
+ };
1279
+ return {
1280
+ ...resourceResponse,
1281
+ deferredCredentialResponse: deferredCredentialResponseResult.data
1282
+ };
1681
1283
  }
1682
1284
 
1683
- // src/formats/proof-type/jwt/jwt-proof-type.ts
1684
- var import_oauth214 = require("@openid4vc/oauth2");
1685
- var import_oauth215 = require("@openid4vc/oauth2");
1686
- var import_utils13 = require("@openid4vc/utils");
1285
+ //#endregion
1286
+ //#region src/formats/proof-type/jwt/jwt-proof-type.ts
1687
1287
  async function createCredentialRequestJwtProof(options) {
1688
- const header = (0, import_utils13.parseWithErrorHandling)(zCredentialRequestJwtProofTypeHeader, {
1689
- ...(0, import_oauth214.jwtHeaderFromJwtSigner)(options.signer),
1690
- key_attestation: options.keyAttestationJwt,
1691
- typ: "openid4vci-proof+jwt"
1692
- });
1693
- const payload = (0, import_utils13.parseWithErrorHandling)(zCredentialRequestJwtProofTypePayload, {
1694
- nonce: options.nonce,
1695
- aud: options.credentialIssuer,
1696
- iat: (0, import_utils13.dateToSeconds)(options.issuedAt),
1697
- iss: options.clientId
1698
- });
1699
- const { jwt, signerJwk } = await options.callbacks.signJwt(options.signer, { header, payload });
1700
- if (options.keyAttestationJwt) {
1701
- const decodedKeyAttestation = (0, import_oauth214.decodeJwt)({
1702
- jwt: options.keyAttestationJwt,
1703
- headerSchema: zKeyAttestationJwtHeader,
1704
- payloadSchema: zKeyAttestationJwtPayload
1705
- });
1706
- const isSigedWithAttestedKey = await (0, import_oauth214.isJwkInSet)({
1707
- jwk: signerJwk,
1708
- jwks: decodedKeyAttestation.payload.attested_keys,
1709
- callbacks: options.callbacks
1710
- });
1711
- if (!isSigedWithAttestedKey) {
1712
- throw new Openid4vciError(
1713
- `Credential request jwt proof is not signed with a key in the 'key_attestation' jwt payload 'attested_keys'`
1714
- );
1715
- }
1716
- }
1717
- return jwt;
1288
+ const header = (0, __openid4vc_utils.parseWithErrorHandling)(zCredentialRequestJwtProofTypeHeader, {
1289
+ ...(0, __openid4vc_oauth2.jwtHeaderFromJwtSigner)(options.signer),
1290
+ key_attestation: options.keyAttestationJwt,
1291
+ typ: "openid4vci-proof+jwt"
1292
+ });
1293
+ const payload = (0, __openid4vc_utils.parseWithErrorHandling)(zCredentialRequestJwtProofTypePayload, {
1294
+ nonce: options.nonce,
1295
+ aud: options.credentialIssuer,
1296
+ iat: (0, __openid4vc_utils.dateToSeconds)(options.issuedAt),
1297
+ iss: options.clientId
1298
+ });
1299
+ const { jwt, signerJwk } = await options.callbacks.signJwt(options.signer, {
1300
+ header,
1301
+ payload
1302
+ });
1303
+ if (options.keyAttestationJwt) {
1304
+ if (!await (0, __openid4vc_oauth2.isJwkInSet)({
1305
+ jwk: signerJwk,
1306
+ jwks: (0, __openid4vc_oauth2.decodeJwt)({
1307
+ jwt: options.keyAttestationJwt,
1308
+ headerSchema: zKeyAttestationJwtHeader,
1309
+ payloadSchema: zKeyAttestationJwtPayload
1310
+ }).payload.attested_keys,
1311
+ callbacks: options.callbacks
1312
+ })) throw new Openid4vciError(`Credential request jwt proof is not signed with a key in the 'key_attestation' jwt payload 'attested_keys'`);
1313
+ }
1314
+ return jwt;
1718
1315
  }
1719
1316
  async function verifyCredentialRequestJwtProof(options) {
1720
- const { header, payload } = (0, import_oauth214.decodeJwt)({
1721
- jwt: options.jwt,
1722
- headerSchema: zCredentialRequestJwtProofTypeHeader,
1723
- payloadSchema: zCredentialRequestJwtProofTypePayload
1724
- });
1725
- const now = options.now?.getTime() ?? Date.now();
1726
- if (options.nonceExpiresAt && now > options.nonceExpiresAt.getTime()) {
1727
- throw new Openid4vciError("Nonce used for credential request proof expired");
1728
- }
1729
- const { signer } = await (0, import_oauth215.verifyJwt)({
1730
- compact: options.jwt,
1731
- header,
1732
- payload,
1733
- signer: (0, import_oauth215.jwtSignerFromJwt)({ header, payload }),
1734
- verifyJwtCallback: options.callbacks.verifyJwt,
1735
- errorMessage: "Error verifiying credential request proof jwt.",
1736
- expectedNonce: options.expectedNonce,
1737
- expectedAudience: options.credentialIssuer,
1738
- expectedIssuer: options.clientId,
1739
- now: options.now
1740
- });
1741
- let keyAttestationResult = void 0;
1742
- if (header.key_attestation) {
1743
- keyAttestationResult = await verifyKeyAttestationJwt({
1744
- callbacks: options.callbacks,
1745
- keyAttestationJwt: header.key_attestation,
1746
- use: "proof_type.jwt"
1747
- });
1748
- const isSigedWithAttestedKey = await (0, import_oauth214.isJwkInSet)({
1749
- jwk: signer.publicJwk,
1750
- jwks: keyAttestationResult.payload.attested_keys,
1751
- callbacks: options.callbacks
1752
- });
1753
- if (!isSigedWithAttestedKey) {
1754
- throw new Openid4vciError(
1755
- `Credential request jwt proof is not signed with a key in the 'key_attestation' jwt payload 'attested_keys'`
1756
- );
1757
- }
1758
- }
1759
- return {
1760
- header,
1761
- payload,
1762
- signer,
1763
- keyAttestation: keyAttestationResult
1764
- };
1317
+ const { header, payload } = (0, __openid4vc_oauth2.decodeJwt)({
1318
+ jwt: options.jwt,
1319
+ headerSchema: zCredentialRequestJwtProofTypeHeader,
1320
+ payloadSchema: zCredentialRequestJwtProofTypePayload
1321
+ });
1322
+ const now = options.now?.getTime() ?? Date.now();
1323
+ if (options.nonceExpiresAt && now > options.nonceExpiresAt.getTime()) throw new Openid4vciError("Nonce used for credential request proof expired");
1324
+ const { signer } = await (0, __openid4vc_oauth2.verifyJwt)({
1325
+ compact: options.jwt,
1326
+ header,
1327
+ payload,
1328
+ signer: (0, __openid4vc_oauth2.jwtSignerFromJwt)({
1329
+ header,
1330
+ payload
1331
+ }),
1332
+ verifyJwtCallback: options.callbacks.verifyJwt,
1333
+ errorMessage: "Error verifiying credential request proof jwt.",
1334
+ expectedNonce: options.expectedNonce,
1335
+ expectedAudience: options.credentialIssuer,
1336
+ expectedIssuer: options.clientId,
1337
+ now: options.now
1338
+ });
1339
+ let keyAttestationResult;
1340
+ if (header.key_attestation) {
1341
+ keyAttestationResult = await verifyKeyAttestationJwt({
1342
+ callbacks: options.callbacks,
1343
+ keyAttestationJwt: header.key_attestation,
1344
+ use: "proof_type.jwt"
1345
+ });
1346
+ if (!await (0, __openid4vc_oauth2.isJwkInSet)({
1347
+ jwk: signer.publicJwk,
1348
+ jwks: keyAttestationResult.payload.attested_keys,
1349
+ callbacks: options.callbacks
1350
+ })) throw new Openid4vciError(`Credential request jwt proof is not signed with a key in the 'key_attestation' jwt payload 'attested_keys'`);
1351
+ }
1352
+ return {
1353
+ header,
1354
+ payload,
1355
+ signer,
1356
+ keyAttestation: keyAttestationResult
1357
+ };
1765
1358
  }
1766
1359
 
1767
- // src/metadata/fetch-issuer-metadata.ts
1768
- var import_oauth216 = require("@openid4vc/oauth2");
1769
- var import_utils14 = require("@openid4vc/utils");
1360
+ //#endregion
1361
+ //#region src/metadata/fetch-issuer-metadata.ts
1770
1362
  async function resolveIssuerMetadata(credentialIssuer, options) {
1771
- const allowAuthorizationMetadataFromCredentialIssuerMetadata = options?.allowAuthorizationMetadataFromCredentialIssuerMetadata ?? true;
1772
- const credentialIssuerMetadataWithDraftVersion = await fetchCredentialIssuerMetadata(credentialIssuer, options?.fetch);
1773
- if (!credentialIssuerMetadataWithDraftVersion) {
1774
- throw new import_oauth216.Oauth2Error(`Well known credential issuer metadata for issuer '${credentialIssuer}' not found.`);
1775
- }
1776
- const { credentialIssuerMetadata, originalDraftVersion } = credentialIssuerMetadataWithDraftVersion;
1777
- const authorizationServers = credentialIssuerMetadata.authorization_servers ?? [credentialIssuer];
1778
- const authoriationServersMetadata = [];
1779
- for (const authorizationServer of authorizationServers) {
1780
- if (options?.restrictToAuthorizationServers && !options.restrictToAuthorizationServers.includes(authorizationServer)) {
1781
- continue;
1782
- }
1783
- let authorizationServerMetadata = await (0, import_oauth216.fetchAuthorizationServerMetadata)(authorizationServer, options?.fetch);
1784
- if (!authorizationServerMetadata && authorizationServer === credentialIssuer && allowAuthorizationMetadataFromCredentialIssuerMetadata) {
1785
- authorizationServerMetadata = (0, import_utils14.parseWithErrorHandling)(
1786
- import_oauth216.zAuthorizationServerMetadata,
1787
- {
1788
- token_endpoint: credentialIssuerMetadata.token_endpoint,
1789
- issuer: credentialIssuer
1790
- },
1791
- `Well known authorization server metadata for authorization server '${authorizationServer}' not found, and could also not extract required values from the credential issuer metadata as a fallback.`
1792
- );
1793
- }
1794
- if (!authorizationServerMetadata) {
1795
- throw new import_oauth216.Oauth2Error(
1796
- `Well known openid configuration or authorization server metadata for authorization server '${authorizationServer}' not found.`
1797
- );
1798
- }
1799
- authoriationServersMetadata.push(authorizationServerMetadata);
1800
- }
1801
- return {
1802
- originalDraftVersion,
1803
- credentialIssuer: credentialIssuerMetadata,
1804
- authorizationServers: authoriationServersMetadata
1805
- };
1363
+ const allowAuthorizationMetadataFromCredentialIssuerMetadata = options?.allowAuthorizationMetadataFromCredentialIssuerMetadata ?? true;
1364
+ const credentialIssuerMetadataWithDraftVersion = await fetchCredentialIssuerMetadata(credentialIssuer, options?.fetch);
1365
+ if (!credentialIssuerMetadataWithDraftVersion) throw new __openid4vc_oauth2.Oauth2Error(`Well known credential issuer metadata for issuer '${credentialIssuer}' not found.`);
1366
+ const { credentialIssuerMetadata, originalDraftVersion } = credentialIssuerMetadataWithDraftVersion;
1367
+ const authorizationServers = credentialIssuerMetadata.authorization_servers ?? [credentialIssuer];
1368
+ const authoriationServersMetadata = [];
1369
+ for (const authorizationServer of authorizationServers) {
1370
+ if (options?.restrictToAuthorizationServers && !options.restrictToAuthorizationServers.includes(authorizationServer)) continue;
1371
+ let authorizationServerMetadata = await (0, __openid4vc_oauth2.fetchAuthorizationServerMetadata)(authorizationServer, options?.fetch);
1372
+ if (!authorizationServerMetadata && authorizationServer === credentialIssuer && allowAuthorizationMetadataFromCredentialIssuerMetadata) authorizationServerMetadata = (0, __openid4vc_utils.parseWithErrorHandling)(__openid4vc_oauth2.zAuthorizationServerMetadata, {
1373
+ token_endpoint: credentialIssuerMetadata.token_endpoint,
1374
+ issuer: credentialIssuer
1375
+ }, `Well known authorization server metadata for authorization server '${authorizationServer}' not found, and could also not extract required values from the credential issuer metadata as a fallback.`);
1376
+ if (!authorizationServerMetadata) throw new __openid4vc_oauth2.Oauth2Error(`Well known openid configuration or authorization server metadata for authorization server '${authorizationServer}' not found.`);
1377
+ authoriationServersMetadata.push(authorizationServerMetadata);
1378
+ }
1379
+ return {
1380
+ originalDraftVersion,
1381
+ credentialIssuer: credentialIssuerMetadata,
1382
+ authorizationServers: authoriationServersMetadata
1383
+ };
1806
1384
  }
1807
1385
 
1808
- // src/nonce/nonce-request.ts
1809
- var import_oauth217 = require("@openid4vc/oauth2");
1810
- var import_utils16 = require("@openid4vc/utils");
1811
-
1812
- // src/nonce/z-nonce.ts
1813
- var import_utils15 = require("@openid4vc/utils");
1814
- var import_zod20 = __toESM(require("zod"));
1815
- var zNonceResponse = import_zod20.default.object({
1816
- c_nonce: import_zod20.default.string(),
1817
- c_nonce_expires_in: import_zod20.default.optional(import_utils15.zInteger)
1386
+ //#endregion
1387
+ //#region src/nonce/z-nonce.ts
1388
+ const zNonceResponse = zod.default.object({
1389
+ c_nonce: zod.default.string(),
1390
+ c_nonce_expires_in: zod.default.optional(__openid4vc_utils.zInteger)
1818
1391
  }).passthrough();
1819
1392
 
1820
- // src/nonce/nonce-request.ts
1393
+ //#endregion
1394
+ //#region src/nonce/nonce-request.ts
1395
+ /**
1396
+ * Request a nonce from the `nonce_endpoint`
1397
+ *
1398
+ * @throws Openid4vciError - if no `nonce_endpoint` is configured in the issuer metadata
1399
+ * @throws InvalidFetchResponseError - if the nonce endpoint did not return a successful response
1400
+ * @throws ValidationError - if validating the nonce response failed
1401
+ */
1821
1402
  async function requestNonce(options) {
1822
- const fetchWithZod = (0, import_utils16.createZodFetcher)(options?.fetch);
1823
- const nonceEndpoint = options.issuerMetadata.credentialIssuer.nonce_endpoint;
1824
- if (!nonceEndpoint) {
1825
- throw new Openid4vciError(
1826
- `Credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}' does not have a nonce endpoint.`
1827
- );
1828
- }
1829
- const { response, result } = await fetchWithZod(zNonceResponse, import_utils16.ContentType.Json, nonceEndpoint, {
1830
- method: "POST"
1831
- });
1832
- if (!response.ok || !result) {
1833
- throw new import_oauth217.InvalidFetchResponseError(
1834
- `Requesting nonce from '${nonceEndpoint}' resulted in an unsuccessful response with status '${response.status}'`,
1835
- await response.clone().text(),
1836
- response
1837
- );
1838
- }
1839
- if (!result.success) {
1840
- throw new import_utils16.ValidationError("Error parsing nonce response", result.error);
1841
- }
1842
- return result.data;
1403
+ const fetchWithZod = (0, __openid4vc_utils.createZodFetcher)(options?.fetch);
1404
+ const nonceEndpoint = options.issuerMetadata.credentialIssuer.nonce_endpoint;
1405
+ if (!nonceEndpoint) throw new Openid4vciError(`Credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}' does not have a nonce endpoint.`);
1406
+ const { response, result } = await fetchWithZod(zNonceResponse, __openid4vc_utils.ContentType.Json, nonceEndpoint, { method: "POST" });
1407
+ if (!response.ok || !result) throw new __openid4vc_oauth2.InvalidFetchResponseError(`Requesting nonce from '${nonceEndpoint}' resulted in an unsuccessful response with status '${response.status}'`, await response.clone().text(), response);
1408
+ if (!result.success) throw new __openid4vc_utils.ValidationError("Error parsing nonce response", result.error);
1409
+ return result.data;
1843
1410
  }
1844
1411
  function createNonceResponse(options) {
1845
- return (0, import_utils16.parseWithErrorHandling)(zNonceResponse, {
1846
- c_nonce: options.cNonce,
1847
- c_nonce_expires_in: options.cNonceExpiresIn,
1848
- ...options.additionalPayload
1849
- });
1412
+ return (0, __openid4vc_utils.parseWithErrorHandling)(zNonceResponse, {
1413
+ c_nonce: options.cNonce,
1414
+ c_nonce_expires_in: options.cNonceExpiresIn,
1415
+ ...options.additionalPayload
1416
+ });
1850
1417
  }
1851
1418
 
1852
- // src/notification/notification.ts
1853
- var import_oauth218 = require("@openid4vc/oauth2");
1854
- var import_utils17 = require("@openid4vc/utils");
1855
-
1856
- // src/notification/z-notification.ts
1857
- var import_zod21 = __toESM(require("zod"));
1858
- var zNotificationEvent = import_zod21.default.enum(["credential_accepted", "credential_failure", "credential_deleted"]);
1859
- var zNotificationRequest = import_zod21.default.object({
1860
- notification_id: import_zod21.default.string(),
1861
- event: zNotificationEvent,
1862
- event_description: import_zod21.default.optional(import_zod21.default.string())
1863
- }).passthrough();
1864
- var zNotificationErrorResponse = import_zod21.default.object({
1865
- error: import_zod21.default.enum(["invalid_notification_id", "invalid_notification_request"])
1419
+ //#endregion
1420
+ //#region src/notification/z-notification.ts
1421
+ const zNotificationEvent = zod.default.enum([
1422
+ "credential_accepted",
1423
+ "credential_failure",
1424
+ "credential_deleted"
1425
+ ]);
1426
+ const zNotificationRequest = zod.default.object({
1427
+ notification_id: zod.default.string(),
1428
+ event: zNotificationEvent,
1429
+ event_description: zod.default.optional(zod.default.string())
1866
1430
  }).passthrough();
1431
+ const zNotificationErrorResponse = zod.default.object({ error: zod.default.enum(["invalid_notification_id", "invalid_notification_request"]) }).passthrough();
1867
1432
 
1868
- // src/notification/notification.ts
1433
+ //#endregion
1434
+ //#region src/notification/notification.ts
1869
1435
  async function sendNotification(options) {
1870
- const notificationEndpoint = options.issuerMetadata.credentialIssuer.notification_endpoint;
1871
- if (!notificationEndpoint) {
1872
- throw new import_oauth218.Oauth2Error(
1873
- `Credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}' does not have a notification endpiont configured.`
1874
- );
1875
- }
1876
- const notificationRequest = (0, import_utils17.parseWithErrorHandling)(
1877
- zNotificationRequest,
1878
- {
1879
- event: options.notification.event,
1880
- notification_id: options.notification.notificationId,
1881
- event_description: options.notification.eventDescription
1882
- },
1883
- "Error validating notification request"
1884
- );
1885
- const resourceResponse = await (0, import_oauth218.resourceRequest)({
1886
- dpop: options.dpop,
1887
- accessToken: options.accessToken,
1888
- callbacks: options.callbacks,
1889
- url: notificationEndpoint,
1890
- requestOptions: {
1891
- method: "POST",
1892
- headers: {
1893
- "Content-Type": import_utils17.ContentType.Json
1894
- },
1895
- body: JSON.stringify(notificationRequest)
1896
- }
1897
- });
1898
- if (!resourceResponse.ok) {
1899
- const notificationErrorResponseResult = (0, import_utils17.isResponseContentType)(import_utils17.ContentType.Json, resourceResponse.response) ? zNotificationErrorResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
1900
- return {
1901
- ...resourceResponse,
1902
- notificationErrorResponseResult
1903
- };
1904
- }
1905
- return resourceResponse;
1436
+ const notificationEndpoint = options.issuerMetadata.credentialIssuer.notification_endpoint;
1437
+ if (!notificationEndpoint) throw new __openid4vc_oauth2.Oauth2Error(`Credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}' does not have a notification endpiont configured.`);
1438
+ const notificationRequest = (0, __openid4vc_utils.parseWithErrorHandling)(zNotificationRequest, {
1439
+ event: options.notification.event,
1440
+ notification_id: options.notification.notificationId,
1441
+ event_description: options.notification.eventDescription
1442
+ }, "Error validating notification request");
1443
+ const resourceResponse = await (0, __openid4vc_oauth2.resourceRequest)({
1444
+ dpop: options.dpop,
1445
+ accessToken: options.accessToken,
1446
+ callbacks: options.callbacks,
1447
+ url: notificationEndpoint,
1448
+ requestOptions: {
1449
+ method: "POST",
1450
+ headers: { "Content-Type": __openid4vc_utils.ContentType.Json },
1451
+ body: JSON.stringify(notificationRequest)
1452
+ }
1453
+ });
1454
+ if (!resourceResponse.ok) {
1455
+ const notificationErrorResponseResult = (0, __openid4vc_utils.isResponseContentType)(__openid4vc_utils.ContentType.Json, resourceResponse.response) ? zNotificationErrorResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
1456
+ return {
1457
+ ...resourceResponse,
1458
+ notificationErrorResponseResult
1459
+ };
1460
+ }
1461
+ return resourceResponse;
1906
1462
  }
1907
1463
 
1908
- // src/Openid4vciClient.ts
1909
- var AuthorizationFlow = /* @__PURE__ */ ((AuthorizationFlow2) => {
1910
- AuthorizationFlow2["Oauth2Redirect"] = "Oauth2Redirect";
1911
- AuthorizationFlow2["PresentationDuringIssuance"] = "PresentationDuringIssuance";
1912
- return AuthorizationFlow2;
1913
- })(AuthorizationFlow || {});
1464
+ //#endregion
1465
+ //#region src/Openid4vciClient.ts
1466
+ let AuthorizationFlow = /* @__PURE__ */ function(AuthorizationFlow$1) {
1467
+ AuthorizationFlow$1["Oauth2Redirect"] = "Oauth2Redirect";
1468
+ AuthorizationFlow$1["PresentationDuringIssuance"] = "PresentationDuringIssuance";
1469
+ return AuthorizationFlow$1;
1470
+ }({});
1914
1471
  var Openid4vciClient = class {
1915
- constructor(options) {
1916
- this.options = options;
1917
- this.oauth2Client = new import_oauth219.Oauth2Client({
1918
- callbacks: this.options.callbacks
1919
- });
1920
- }
1921
- getKnownCredentialConfigurationsSupported(credentialIssuerMetadata) {
1922
- return extractKnownCredentialConfigurationSupportedFormats(
1923
- credentialIssuerMetadata.credential_configurations_supported
1924
- );
1925
- }
1926
- /**
1927
- * Resolve a credential offer into a credential offer object, handling both
1928
- * 'credential_offer' and 'credential_offer_uri' params.
1929
- */
1930
- async resolveCredentialOffer(credentialOffer) {
1931
- return resolveCredentialOffer(credentialOffer, {
1932
- fetch: this.options.callbacks.fetch
1933
- });
1934
- }
1935
- async resolveIssuerMetadata(credentialIssuer) {
1936
- return resolveIssuerMetadata(credentialIssuer, {
1937
- fetch: this.options.callbacks.fetch
1938
- });
1939
- }
1940
- /**
1941
- * Retrieve an authorization code for a presentation during issuance session
1942
- *
1943
- * This can only be called if an authorization challenge was performed before and returned a
1944
- * `presentation` parameter along with an `auth_session`. If the presentation response included
1945
- * an `presentation_during_issuance_session` parameter it MUST be included in this request as well.
1946
- */
1947
- async retrieveAuthorizationCodeUsingPresentation(options) {
1948
- if (!options.credentialOffer.grants?.[import_oauth219.authorizationCodeGrantIdentifier]) {
1949
- throw new import_oauth219.Oauth2Error(`Provided credential offer does not include the 'authorization_code' grant.`);
1950
- }
1951
- const authorizationCodeGrant = options.credentialOffer.grants[import_oauth219.authorizationCodeGrantIdentifier];
1952
- const authorizationServer = determineAuthorizationServerForCredentialOffer({
1953
- issuerMetadata: options.issuerMetadata,
1954
- grantAuthorizationServer: authorizationCodeGrant.authorization_server
1955
- });
1956
- const authorizationServerMetadata = (0, import_oauth219.getAuthorizationServerMetadataFromList)(
1957
- options.issuerMetadata.authorizationServers,
1958
- authorizationServer
1959
- );
1960
- const oauth2Client = new import_oauth219.Oauth2Client({ callbacks: this.options.callbacks });
1961
- const { authorizationChallengeResponse, dpop } = await oauth2Client.sendAuthorizationChallengeRequest({
1962
- authorizationServerMetadata,
1963
- authSession: options.authSession,
1964
- presentationDuringIssuanceSession: options.presentationDuringIssuanceSession,
1965
- dpop: options.dpop
1966
- });
1967
- return { authorizationChallengeResponse, dpop };
1968
- }
1969
- /**
1970
- * Initiates authorization for credential issuance. It handles the following cases:
1971
- * - Authorization Challenge
1972
- * - Pushed Authorization Request
1973
- * - Regular Authorization url
1974
- *
1975
- * In case the authorization challenge request returns an error with `insufficient_authorization`
1976
- * with a `presentation` field it means the authorization server expects presentation of credentials
1977
- * before issuance of credentials. If this is the case, the value in `presentation` should be treated
1978
- * as an openid4vp authorization request and submitted to the verifier. Once the presentation response
1979
- * has been submitted, the RP will respond with a `presentation_during_issuance_session` parameter.
1980
- * Together with the `auth_session` parameter returned in this call you can retrieve an `authorization_code`
1981
- * using
1982
- */
1983
- async initiateAuthorization(options) {
1984
- if (!options.credentialOffer.grants?.[import_oauth219.authorizationCodeGrantIdentifier]) {
1985
- throw new import_oauth219.Oauth2Error(`Provided credential offer does not include the 'authorization_code' grant.`);
1986
- }
1987
- const authorizationCodeGrant = options.credentialOffer.grants[import_oauth219.authorizationCodeGrantIdentifier];
1988
- const authorizationServer = determineAuthorizationServerForCredentialOffer({
1989
- issuerMetadata: options.issuerMetadata,
1990
- grantAuthorizationServer: authorizationCodeGrant.authorization_server
1991
- });
1992
- const authorizationServerMetadata = (0, import_oauth219.getAuthorizationServerMetadataFromList)(
1993
- options.issuerMetadata.authorizationServers,
1994
- authorizationServer
1995
- );
1996
- const oauth2Client = new import_oauth219.Oauth2Client({ callbacks: this.options.callbacks });
1997
- try {
1998
- const result = await oauth2Client.initiateAuthorization({
1999
- clientId: options.clientId,
2000
- pkceCodeVerifier: options.pkceCodeVerifier,
2001
- redirectUri: options.redirectUri,
2002
- scope: options.scope,
2003
- additionalRequestPayload: {
2004
- ...options.additionalRequestPayload,
2005
- issuer_state: options.credentialOffer?.grants?.authorization_code?.issuer_state
2006
- },
2007
- dpop: options.dpop,
2008
- resource: options.issuerMetadata.credentialIssuer.credential_issuer,
2009
- authorizationServerMetadata
2010
- });
2011
- return {
2012
- ...result,
2013
- authorizationFlow: "Oauth2Redirect" /* Oauth2Redirect */,
2014
- authorizationServer: authorizationServerMetadata.issuer
2015
- };
2016
- } catch (error) {
2017
- if (error instanceof import_oauth219.Oauth2ClientAuthorizationChallengeError && error.errorResponse.error === import_oauth219.Oauth2ErrorCodes.InsufficientAuthorization && error.errorResponse.presentation) {
2018
- if (!error.errorResponse.auth_session) {
2019
- throw new Openid4vciError(
2020
- `Expected 'auth_session' to be defined with authorization challenge response error '${error.errorResponse.error}' and 'presentation' parameter`
2021
- );
2022
- }
2023
- return {
2024
- authorizationFlow: "PresentationDuringIssuance" /* PresentationDuringIssuance */,
2025
- openid4vpRequestUrl: error.errorResponse.presentation,
2026
- authSession: error.errorResponse.auth_session,
2027
- authorizationServer: authorizationServerMetadata.issuer
2028
- };
2029
- }
2030
- throw error;
2031
- }
2032
- }
2033
- /**
2034
- * Convenience method around {@link Oauth2Client.createAuthorizationRequestUrl}
2035
- * but specifically focused on a credential offer
2036
- */
2037
- async createAuthorizationRequestUrlFromOffer(options) {
2038
- if (!options.credentialOffer.grants?.[import_oauth219.authorizationCodeGrantIdentifier]) {
2039
- throw new import_oauth219.Oauth2Error(`Provided credential offer does not include the 'authorization_code' grant.`);
2040
- }
2041
- const authorizationCodeGrant = options.credentialOffer.grants[import_oauth219.authorizationCodeGrantIdentifier];
2042
- const authorizationServer = determineAuthorizationServerForCredentialOffer({
2043
- issuerMetadata: options.issuerMetadata,
2044
- grantAuthorizationServer: authorizationCodeGrant.authorization_server
2045
- });
2046
- const authorizationServerMetadata = (0, import_oauth219.getAuthorizationServerMetadataFromList)(
2047
- options.issuerMetadata.authorizationServers,
2048
- authorizationServer
2049
- );
2050
- const { authorizationRequestUrl, pkce, dpop } = await this.oauth2Client.createAuthorizationRequestUrl({
2051
- authorizationServerMetadata,
2052
- clientId: options.clientId,
2053
- additionalRequestPayload: {
2054
- ...options.additionalRequestPayload,
2055
- issuer_state: options.credentialOffer?.grants?.authorization_code?.issuer_state
2056
- },
2057
- resource: options.issuerMetadata.credentialIssuer.credential_issuer,
2058
- redirectUri: options.redirectUri,
2059
- scope: options.scope,
2060
- pkceCodeVerifier: options.pkceCodeVerifier,
2061
- dpop: options.dpop
2062
- });
2063
- return {
2064
- authorizationRequestUrl,
2065
- pkce,
2066
- dpop,
2067
- authorizationServer: authorizationServerMetadata.issuer
2068
- };
2069
- }
2070
- /**
2071
- * Convenience method around {@link Oauth2Client.retrievePreAuthorizedCodeAccessToken}
2072
- * but specifically focused on a credential offer
2073
- */
2074
- async retrievePreAuthorizedCodeAccessTokenFromOffer({
2075
- credentialOffer,
2076
- issuerMetadata,
2077
- additionalRequestPayload,
2078
- txCode,
2079
- dpop
2080
- }) {
2081
- if (!credentialOffer.grants?.[import_oauth219.preAuthorizedCodeGrantIdentifier]) {
2082
- throw new import_oauth219.Oauth2Error(`The credential offer does not contain the '${import_oauth219.preAuthorizedCodeGrantIdentifier}' grant.`);
2083
- }
2084
- if (credentialOffer.grants[import_oauth219.preAuthorizedCodeGrantIdentifier].tx_code && !txCode) {
2085
- throw new import_oauth219.Oauth2Error(
2086
- `Retrieving access token requires a 'tx_code' in the request, but the 'txCode' parameter was not provided.`
2087
- );
2088
- }
2089
- const preAuthorizedCode = credentialOffer.grants[import_oauth219.preAuthorizedCodeGrantIdentifier]["pre-authorized_code"];
2090
- const authorizationServer = determineAuthorizationServerForCredentialOffer({
2091
- grantAuthorizationServer: credentialOffer.grants[import_oauth219.preAuthorizedCodeGrantIdentifier].authorization_server,
2092
- issuerMetadata
2093
- });
2094
- const authorizationServerMetadata = (0, import_oauth219.getAuthorizationServerMetadataFromList)(
2095
- issuerMetadata.authorizationServers,
2096
- authorizationServer
2097
- );
2098
- const result = await this.oauth2Client.retrievePreAuthorizedCodeAccessToken({
2099
- authorizationServerMetadata,
2100
- preAuthorizedCode,
2101
- txCode,
2102
- resource: issuerMetadata.credentialIssuer.credential_issuer,
2103
- additionalRequestPayload,
2104
- dpop
2105
- });
2106
- return {
2107
- ...result,
2108
- authorizationServer
2109
- };
2110
- }
2111
- /**
2112
- * Convenience method around {@link Oauth2Client.retrieveAuthorizationCodeAccessTokenFrom}
2113
- * but specifically focused on a credential offer
2114
- */
2115
- async retrieveAuthorizationCodeAccessTokenFromOffer({
2116
- issuerMetadata,
2117
- additionalRequestPayload,
2118
- credentialOffer,
2119
- authorizationCode,
2120
- pkceCodeVerifier,
2121
- redirectUri,
2122
- dpop
2123
- }) {
2124
- if (!credentialOffer.grants?.[import_oauth219.authorizationCodeGrantIdentifier]) {
2125
- throw new import_oauth219.Oauth2Error(`The credential offer does not contain the '${import_oauth219.authorizationCodeGrantIdentifier}' grant.`);
2126
- }
2127
- const authorizationServer = determineAuthorizationServerForCredentialOffer({
2128
- grantAuthorizationServer: credentialOffer.grants[import_oauth219.authorizationCodeGrantIdentifier].authorization_server,
2129
- issuerMetadata
2130
- });
2131
- const authorizationServerMetadata = (0, import_oauth219.getAuthorizationServerMetadataFromList)(
2132
- issuerMetadata.authorizationServers,
2133
- authorizationServer
2134
- );
2135
- const result = await this.oauth2Client.retrieveAuthorizationCodeAccessToken({
2136
- authorizationServerMetadata,
2137
- authorizationCode,
2138
- pkceCodeVerifier,
2139
- additionalRequestPayload,
2140
- dpop,
2141
- redirectUri,
2142
- resource: issuerMetadata.credentialIssuer.credential_issuer
2143
- });
2144
- return {
2145
- ...result,
2146
- authorizationServer
2147
- };
2148
- }
2149
- /**
2150
- * Request a nonce to be used in credential request proofs from the `nonce_endpoint`
2151
- *
2152
- * @throws Openid4vciError - if no `nonce_endpoint` is configured in the issuer metadata
2153
- * @throws InvalidFetchResponseError - if the nonce endpoint did not return a successful response
2154
- * @throws ValidationError - if validating the nonce response failed
2155
- */
2156
- async requestNonce(options) {
2157
- return requestNonce({
2158
- ...options,
2159
- fetch: this.options.callbacks.fetch
2160
- });
2161
- }
2162
- /**
2163
- * Creates the jwt proof payload and header to be included in a credential request.
2164
- */
2165
- async createCredentialRequestJwtProof(options) {
2166
- const credentialConfiguration = options.issuerMetadata.credentialIssuer.credential_configurations_supported[options.credentialConfigurationId];
2167
- if (!credentialConfiguration) {
2168
- throw new Openid4vciError(
2169
- `Credential configuration with '${options.credentialConfigurationId}' not found in 'credential_configurations_supported' from credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}'`
2170
- );
2171
- }
2172
- if (credentialConfiguration.proof_types_supported) {
2173
- if (!credentialConfiguration.proof_types_supported.jwt) {
2174
- throw new Openid4vciError(
2175
- `Credential configuration with id '${options.credentialConfigurationId}' does not support the 'jwt' proof type.`
2176
- );
2177
- }
2178
- if (!credentialConfiguration.proof_types_supported.jwt.proof_signing_alg_values_supported.includes(
2179
- options.signer.alg
2180
- )) {
2181
- throw new Openid4vciError(
2182
- `Credential configuration with id '${options.credentialConfigurationId}' does not support the '${options.signer.alg}' alg for 'jwt' proof type.`
2183
- );
2184
- }
2185
- if (credentialConfiguration.proof_types_supported.jwt.key_attestations_required && !options.keyAttestationJwt) {
2186
- throw new Openid4vciError(
2187
- `Credential configuration with id '${options.credentialConfigurationId}' requires key attestations for 'jwt' proof type but no 'keyAttestationJwt' was provided`
2188
- );
2189
- }
2190
- }
2191
- const jwt = await createCredentialRequestJwtProof({
2192
- credentialIssuer: options.issuerMetadata.credentialIssuer.credential_issuer,
2193
- signer: options.signer,
2194
- clientId: options.clientId,
2195
- issuedAt: options.issuedAt,
2196
- nonce: options.nonce,
2197
- keyAttestationJwt: options.keyAttestationJwt,
2198
- callbacks: this.options.callbacks
2199
- });
2200
- return {
2201
- jwt
2202
- };
2203
- }
2204
- /**
2205
- * @throws Openid4vciRetrieveCredentialsError - if an unsuccessful response or the response couldn't be parsed as credential response
2206
- * @throws ValidationError - if validation of the credential request failed
2207
- * @throws Openid4vciError - if the `credentialConfigurationId` couldn't be found, or if the the format specific request couldn't be constructed
2208
- */
2209
- async retrieveCredentials({
2210
- issuerMetadata,
2211
- proof,
2212
- proofs,
2213
- credentialConfigurationId,
2214
- additionalRequestPayload,
2215
- accessToken,
2216
- dpop
2217
- }) {
2218
- let credentialResponse;
2219
- if (issuerMetadata.originalDraftVersion === "Draft15" /* Draft15 */ || issuerMetadata.originalDraftVersion === "Draft16" /* Draft16 */) {
2220
- credentialResponse = await retrieveCredentialsWithCredentialConfigurationId({
2221
- accessToken,
2222
- credentialConfigurationId,
2223
- issuerMetadata,
2224
- additionalRequestPayload,
2225
- proof,
2226
- proofs,
2227
- callbacks: this.options.callbacks,
2228
- dpop
2229
- });
2230
- } else {
2231
- const formatPayload = getCredentialRequestFormatPayloadForCredentialConfigurationId({
2232
- credentialConfigurationId,
2233
- issuerMetadata
2234
- });
2235
- credentialResponse = await retrieveCredentialsWithFormat({
2236
- accessToken,
2237
- formatPayload,
2238
- issuerMetadata,
2239
- additionalRequestPayload,
2240
- proof,
2241
- proofs,
2242
- callbacks: this.options.callbacks,
2243
- dpop
2244
- });
2245
- }
2246
- if (!credentialResponse.ok) {
2247
- throw new Openid4vciRetrieveCredentialsError(
2248
- `Error retrieving credentials from '${issuerMetadata.credentialIssuer.credential_issuer}'`,
2249
- credentialResponse,
2250
- await credentialResponse.response.clone().text()
2251
- );
2252
- }
2253
- return credentialResponse;
2254
- }
2255
- /**
2256
- * @throws Openid4vciRetrieveCredentialsError - if an unsuccessful response or the response couldn't be parsed as credential response
2257
- * @throws ValidationError - if validation of the credential request failed
2258
- */
2259
- async retrieveDeferredCredentials(options) {
2260
- const credentialResponse = await retrieveDeferredCredentials({
2261
- ...options,
2262
- callbacks: this.options.callbacks
2263
- });
2264
- if (!credentialResponse.ok) {
2265
- throw new Openid4vciRetrieveCredentialsError(
2266
- `Error retrieving deferred credentials from '${options.issuerMetadata.credentialIssuer.credential_issuer}'`,
2267
- credentialResponse,
2268
- await credentialResponse.response.clone().text()
2269
- );
2270
- }
2271
- return credentialResponse;
2272
- }
2273
- /**
2274
- * @throws Openid4vciSendNotificationError - if an unsuccessful response
2275
- * @throws ValidationError - if validation of the notification request failed
2276
- */
2277
- async sendNotification({
2278
- issuerMetadata,
2279
- notification,
2280
- additionalRequestPayload,
2281
- accessToken,
2282
- dpop
2283
- }) {
2284
- const notificationResponse = await sendNotification({
2285
- accessToken,
2286
- issuerMetadata,
2287
- additionalRequestPayload,
2288
- callbacks: this.options.callbacks,
2289
- dpop,
2290
- notification
2291
- });
2292
- if (!notificationResponse.ok) {
2293
- throw new Openid4vciSendNotificationError(
2294
- `Error sending notification to '${issuerMetadata.credentialIssuer.credential_issuer}'`,
2295
- notificationResponse
2296
- );
2297
- }
2298
- return notificationResponse;
2299
- }
1472
+ constructor(options) {
1473
+ this.options = options;
1474
+ this.oauth2Client = new __openid4vc_oauth2.Oauth2Client({ callbacks: this.options.callbacks });
1475
+ }
1476
+ getKnownCredentialConfigurationsSupported(credentialIssuerMetadata) {
1477
+ return extractKnownCredentialConfigurationSupportedFormats(credentialIssuerMetadata.credential_configurations_supported);
1478
+ }
1479
+ /**
1480
+ * Resolve a credential offer into a credential offer object, handling both
1481
+ * 'credential_offer' and 'credential_offer_uri' params.
1482
+ */
1483
+ async resolveCredentialOffer(credentialOffer) {
1484
+ return resolveCredentialOffer(credentialOffer, { fetch: this.options.callbacks.fetch });
1485
+ }
1486
+ async resolveIssuerMetadata(credentialIssuer) {
1487
+ return resolveIssuerMetadata(credentialIssuer, { fetch: this.options.callbacks.fetch });
1488
+ }
1489
+ /**
1490
+ * Retrieve an authorization code for a presentation during issuance session
1491
+ *
1492
+ * This can only be called if an authorization challenge was performed before and returned a
1493
+ * `presentation` parameter along with an `auth_session`. If the presentation response included
1494
+ * an `presentation_during_issuance_session` parameter it MUST be included in this request as well.
1495
+ */
1496
+ async retrieveAuthorizationCodeUsingPresentation(options) {
1497
+ if (!options.credentialOffer.grants?.[__openid4vc_oauth2.authorizationCodeGrantIdentifier]) throw new __openid4vc_oauth2.Oauth2Error(`Provided credential offer does not include the 'authorization_code' grant.`);
1498
+ const authorizationCodeGrant = options.credentialOffer.grants[__openid4vc_oauth2.authorizationCodeGrantIdentifier];
1499
+ const authorizationServer = determineAuthorizationServerForCredentialOffer({
1500
+ issuerMetadata: options.issuerMetadata,
1501
+ grantAuthorizationServer: authorizationCodeGrant.authorization_server
1502
+ });
1503
+ const authorizationServerMetadata = (0, __openid4vc_oauth2.getAuthorizationServerMetadataFromList)(options.issuerMetadata.authorizationServers, authorizationServer);
1504
+ const { authorizationChallengeResponse, dpop } = await new __openid4vc_oauth2.Oauth2Client({ callbacks: this.options.callbacks }).sendAuthorizationChallengeRequest({
1505
+ authorizationServerMetadata,
1506
+ authSession: options.authSession,
1507
+ presentationDuringIssuanceSession: options.presentationDuringIssuanceSession,
1508
+ dpop: options.dpop
1509
+ });
1510
+ return {
1511
+ authorizationChallengeResponse,
1512
+ dpop
1513
+ };
1514
+ }
1515
+ /**
1516
+ * Initiates authorization for credential issuance. It handles the following cases:
1517
+ * - Authorization Challenge
1518
+ * - Pushed Authorization Request
1519
+ * - Regular Authorization url
1520
+ *
1521
+ * In case the authorization challenge request returns an error with `insufficient_authorization`
1522
+ * with a `presentation` field it means the authorization server expects presentation of credentials
1523
+ * before issuance of credentials. If this is the case, the value in `presentation` should be treated
1524
+ * as an openid4vp authorization request and submitted to the verifier. Once the presentation response
1525
+ * has been submitted, the RP will respond with a `presentation_during_issuance_session` parameter.
1526
+ * Together with the `auth_session` parameter returned in this call you can retrieve an `authorization_code`
1527
+ * using
1528
+ */
1529
+ async initiateAuthorization(options) {
1530
+ if (!options.credentialOffer.grants?.[__openid4vc_oauth2.authorizationCodeGrantIdentifier]) throw new __openid4vc_oauth2.Oauth2Error(`Provided credential offer does not include the 'authorization_code' grant.`);
1531
+ const authorizationCodeGrant = options.credentialOffer.grants[__openid4vc_oauth2.authorizationCodeGrantIdentifier];
1532
+ const authorizationServer = determineAuthorizationServerForCredentialOffer({
1533
+ issuerMetadata: options.issuerMetadata,
1534
+ grantAuthorizationServer: authorizationCodeGrant.authorization_server
1535
+ });
1536
+ const authorizationServerMetadata = (0, __openid4vc_oauth2.getAuthorizationServerMetadataFromList)(options.issuerMetadata.authorizationServers, authorizationServer);
1537
+ const oauth2Client = new __openid4vc_oauth2.Oauth2Client({ callbacks: this.options.callbacks });
1538
+ try {
1539
+ return {
1540
+ ...await oauth2Client.initiateAuthorization({
1541
+ clientId: options.clientId,
1542
+ pkceCodeVerifier: options.pkceCodeVerifier,
1543
+ redirectUri: options.redirectUri,
1544
+ scope: options.scope,
1545
+ additionalRequestPayload: {
1546
+ ...options.additionalRequestPayload,
1547
+ issuer_state: options.credentialOffer?.grants?.authorization_code?.issuer_state
1548
+ },
1549
+ dpop: options.dpop,
1550
+ resource: options.issuerMetadata.credentialIssuer.credential_issuer,
1551
+ authorizationServerMetadata
1552
+ }),
1553
+ authorizationFlow: AuthorizationFlow.Oauth2Redirect,
1554
+ authorizationServer: authorizationServerMetadata.issuer
1555
+ };
1556
+ } catch (error) {
1557
+ if (error instanceof __openid4vc_oauth2.Oauth2ClientAuthorizationChallengeError && error.errorResponse.error === __openid4vc_oauth2.Oauth2ErrorCodes.InsufficientAuthorization && error.errorResponse.presentation) {
1558
+ if (!error.errorResponse.auth_session) throw new Openid4vciError(`Expected 'auth_session' to be defined with authorization challenge response error '${error.errorResponse.error}' and 'presentation' parameter`);
1559
+ return {
1560
+ authorizationFlow: AuthorizationFlow.PresentationDuringIssuance,
1561
+ openid4vpRequestUrl: error.errorResponse.presentation,
1562
+ authSession: error.errorResponse.auth_session,
1563
+ authorizationServer: authorizationServerMetadata.issuer
1564
+ };
1565
+ }
1566
+ throw error;
1567
+ }
1568
+ }
1569
+ /**
1570
+ * Convenience method around {@link Oauth2Client.createAuthorizationRequestUrl}
1571
+ * but specifically focused on a credential offer
1572
+ */
1573
+ async createAuthorizationRequestUrlFromOffer(options) {
1574
+ if (!options.credentialOffer.grants?.[__openid4vc_oauth2.authorizationCodeGrantIdentifier]) throw new __openid4vc_oauth2.Oauth2Error(`Provided credential offer does not include the 'authorization_code' grant.`);
1575
+ const authorizationCodeGrant = options.credentialOffer.grants[__openid4vc_oauth2.authorizationCodeGrantIdentifier];
1576
+ const authorizationServer = determineAuthorizationServerForCredentialOffer({
1577
+ issuerMetadata: options.issuerMetadata,
1578
+ grantAuthorizationServer: authorizationCodeGrant.authorization_server
1579
+ });
1580
+ const authorizationServerMetadata = (0, __openid4vc_oauth2.getAuthorizationServerMetadataFromList)(options.issuerMetadata.authorizationServers, authorizationServer);
1581
+ const { authorizationRequestUrl, pkce, dpop } = await this.oauth2Client.createAuthorizationRequestUrl({
1582
+ authorizationServerMetadata,
1583
+ clientId: options.clientId,
1584
+ additionalRequestPayload: {
1585
+ ...options.additionalRequestPayload,
1586
+ issuer_state: options.credentialOffer?.grants?.authorization_code?.issuer_state
1587
+ },
1588
+ resource: options.issuerMetadata.credentialIssuer.credential_issuer,
1589
+ redirectUri: options.redirectUri,
1590
+ scope: options.scope,
1591
+ pkceCodeVerifier: options.pkceCodeVerifier,
1592
+ dpop: options.dpop
1593
+ });
1594
+ return {
1595
+ authorizationRequestUrl,
1596
+ pkce,
1597
+ dpop,
1598
+ authorizationServer: authorizationServerMetadata.issuer
1599
+ };
1600
+ }
1601
+ /**
1602
+ * Convenience method around {@link Oauth2Client.retrievePreAuthorizedCodeAccessToken}
1603
+ * but specifically focused on a credential offer
1604
+ */
1605
+ async retrievePreAuthorizedCodeAccessTokenFromOffer({ credentialOffer, issuerMetadata, additionalRequestPayload, txCode, dpop }) {
1606
+ if (!credentialOffer.grants?.[__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier]) throw new __openid4vc_oauth2.Oauth2Error(`The credential offer does not contain the '${__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier}' grant.`);
1607
+ if (credentialOffer.grants[__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier].tx_code && !txCode) throw new __openid4vc_oauth2.Oauth2Error(`Retrieving access token requires a 'tx_code' in the request, but the 'txCode' parameter was not provided.`);
1608
+ const preAuthorizedCode = credentialOffer.grants[__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier]["pre-authorized_code"];
1609
+ const authorizationServer = determineAuthorizationServerForCredentialOffer({
1610
+ grantAuthorizationServer: credentialOffer.grants[__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier].authorization_server,
1611
+ issuerMetadata
1612
+ });
1613
+ const authorizationServerMetadata = (0, __openid4vc_oauth2.getAuthorizationServerMetadataFromList)(issuerMetadata.authorizationServers, authorizationServer);
1614
+ return {
1615
+ ...await this.oauth2Client.retrievePreAuthorizedCodeAccessToken({
1616
+ authorizationServerMetadata,
1617
+ preAuthorizedCode,
1618
+ txCode,
1619
+ resource: issuerMetadata.credentialIssuer.credential_issuer,
1620
+ additionalRequestPayload,
1621
+ dpop
1622
+ }),
1623
+ authorizationServer
1624
+ };
1625
+ }
1626
+ /**
1627
+ * Convenience method around {@link Oauth2Client.retrieveAuthorizationCodeAccessTokenFrom}
1628
+ * but specifically focused on a credential offer
1629
+ */
1630
+ async retrieveAuthorizationCodeAccessTokenFromOffer({ issuerMetadata, additionalRequestPayload, credentialOffer, authorizationCode, pkceCodeVerifier, redirectUri, dpop }) {
1631
+ if (!credentialOffer.grants?.[__openid4vc_oauth2.authorizationCodeGrantIdentifier]) throw new __openid4vc_oauth2.Oauth2Error(`The credential offer does not contain the '${__openid4vc_oauth2.authorizationCodeGrantIdentifier}' grant.`);
1632
+ const authorizationServer = determineAuthorizationServerForCredentialOffer({
1633
+ grantAuthorizationServer: credentialOffer.grants[__openid4vc_oauth2.authorizationCodeGrantIdentifier].authorization_server,
1634
+ issuerMetadata
1635
+ });
1636
+ const authorizationServerMetadata = (0, __openid4vc_oauth2.getAuthorizationServerMetadataFromList)(issuerMetadata.authorizationServers, authorizationServer);
1637
+ return {
1638
+ ...await this.oauth2Client.retrieveAuthorizationCodeAccessToken({
1639
+ authorizationServerMetadata,
1640
+ authorizationCode,
1641
+ pkceCodeVerifier,
1642
+ additionalRequestPayload,
1643
+ dpop,
1644
+ redirectUri,
1645
+ resource: issuerMetadata.credentialIssuer.credential_issuer
1646
+ }),
1647
+ authorizationServer
1648
+ };
1649
+ }
1650
+ /**
1651
+ * Request a nonce to be used in credential request proofs from the `nonce_endpoint`
1652
+ *
1653
+ * @throws Openid4vciError - if no `nonce_endpoint` is configured in the issuer metadata
1654
+ * @throws InvalidFetchResponseError - if the nonce endpoint did not return a successful response
1655
+ * @throws ValidationError - if validating the nonce response failed
1656
+ */
1657
+ async requestNonce(options) {
1658
+ return requestNonce({
1659
+ ...options,
1660
+ fetch: this.options.callbacks.fetch
1661
+ });
1662
+ }
1663
+ /**
1664
+ * Creates the jwt proof payload and header to be included in a credential request.
1665
+ */
1666
+ async createCredentialRequestJwtProof(options) {
1667
+ const credentialConfiguration = options.issuerMetadata.credentialIssuer.credential_configurations_supported[options.credentialConfigurationId];
1668
+ if (!credentialConfiguration) throw new Openid4vciError(`Credential configuration with '${options.credentialConfigurationId}' not found in 'credential_configurations_supported' from credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}'`);
1669
+ if (credentialConfiguration.proof_types_supported) {
1670
+ if (!credentialConfiguration.proof_types_supported.jwt) throw new Openid4vciError(`Credential configuration with id '${options.credentialConfigurationId}' does not support the 'jwt' proof type.`);
1671
+ if (!credentialConfiguration.proof_types_supported.jwt.proof_signing_alg_values_supported.includes(options.signer.alg)) throw new Openid4vciError(`Credential configuration with id '${options.credentialConfigurationId}' does not support the '${options.signer.alg}' alg for 'jwt' proof type.`);
1672
+ if (credentialConfiguration.proof_types_supported.jwt.key_attestations_required && !options.keyAttestationJwt) throw new Openid4vciError(`Credential configuration with id '${options.credentialConfigurationId}' requires key attestations for 'jwt' proof type but no 'keyAttestationJwt' was provided`);
1673
+ }
1674
+ return { jwt: await createCredentialRequestJwtProof({
1675
+ credentialIssuer: options.issuerMetadata.credentialIssuer.credential_issuer,
1676
+ signer: options.signer,
1677
+ clientId: options.clientId,
1678
+ issuedAt: options.issuedAt,
1679
+ nonce: options.nonce,
1680
+ keyAttestationJwt: options.keyAttestationJwt,
1681
+ callbacks: this.options.callbacks
1682
+ }) };
1683
+ }
1684
+ /**
1685
+ * @throws Openid4vciRetrieveCredentialsError - if an unsuccessful response or the response couldn't be parsed as credential response
1686
+ * @throws ValidationError - if validation of the credential request failed
1687
+ * @throws Openid4vciError - if the `credentialConfigurationId` couldn't be found, or if the the format specific request couldn't be constructed
1688
+ */
1689
+ async retrieveCredentials({ issuerMetadata, proof, proofs, credentialConfigurationId, additionalRequestPayload, accessToken, dpop }) {
1690
+ let credentialResponse;
1691
+ if (issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft15 || issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft16) credentialResponse = await retrieveCredentialsWithCredentialConfigurationId({
1692
+ accessToken,
1693
+ credentialConfigurationId,
1694
+ issuerMetadata,
1695
+ additionalRequestPayload,
1696
+ proof,
1697
+ proofs,
1698
+ callbacks: this.options.callbacks,
1699
+ dpop
1700
+ });
1701
+ else credentialResponse = await retrieveCredentialsWithFormat({
1702
+ accessToken,
1703
+ formatPayload: getCredentialRequestFormatPayloadForCredentialConfigurationId({
1704
+ credentialConfigurationId,
1705
+ issuerMetadata
1706
+ }),
1707
+ issuerMetadata,
1708
+ additionalRequestPayload,
1709
+ proof,
1710
+ proofs,
1711
+ callbacks: this.options.callbacks,
1712
+ dpop
1713
+ });
1714
+ if (!credentialResponse.ok) throw new Openid4vciRetrieveCredentialsError(`Error retrieving credentials from '${issuerMetadata.credentialIssuer.credential_issuer}'`, credentialResponse, await credentialResponse.response.clone().text());
1715
+ return credentialResponse;
1716
+ }
1717
+ /**
1718
+ * @throws Openid4vciRetrieveCredentialsError - if an unsuccessful response or the response couldn't be parsed as credential response
1719
+ * @throws ValidationError - if validation of the credential request failed
1720
+ */
1721
+ async retrieveDeferredCredentials(options) {
1722
+ const credentialResponse = await retrieveDeferredCredentials({
1723
+ ...options,
1724
+ callbacks: this.options.callbacks
1725
+ });
1726
+ if (!credentialResponse.ok) throw new Openid4vciRetrieveCredentialsError(`Error retrieving deferred credentials from '${options.issuerMetadata.credentialIssuer.credential_issuer}'`, credentialResponse, await credentialResponse.response.clone().text());
1727
+ return credentialResponse;
1728
+ }
1729
+ /**
1730
+ * @throws Openid4vciSendNotificationError - if an unsuccessful response
1731
+ * @throws ValidationError - if validation of the notification request failed
1732
+ */
1733
+ async sendNotification({ issuerMetadata, notification, additionalRequestPayload, accessToken, dpop }) {
1734
+ const notificationResponse = await sendNotification({
1735
+ accessToken,
1736
+ issuerMetadata,
1737
+ additionalRequestPayload,
1738
+ callbacks: this.options.callbacks,
1739
+ dpop,
1740
+ notification
1741
+ });
1742
+ if (!notificationResponse.ok) throw new Openid4vciSendNotificationError(`Error sending notification to '${issuerMetadata.credentialIssuer.credential_issuer}'`, notificationResponse);
1743
+ return notificationResponse;
1744
+ }
2300
1745
  };
2301
1746
 
2302
- // src/Openid4vciIssuer.ts
2303
- var import_oauth220 = require("@openid4vc/oauth2");
2304
- var import_utils21 = require("@openid4vc/utils");
2305
-
2306
- // src/credential-request/credential-response.ts
2307
- var import_utils18 = require("@openid4vc/utils");
1747
+ //#endregion
1748
+ //#region src/credential-request/credential-response.ts
2308
1749
  function createCredentialResponse(options) {
2309
- return (0, import_utils18.parseWithErrorHandling)(zCredentialResponse, {
2310
- c_nonce: options.cNonce,
2311
- c_nonce_expires_in: options.cNonceExpiresInSeconds,
2312
- credential: options.credential,
2313
- credentials: options.credentials,
2314
- notification_id: options.notificationId,
2315
- transaction_id: options.transactionId,
2316
- interval: options.interval,
2317
- // NOTE `format` is removed in draft 13. For now if a format was requested
2318
- // we just always return it in the response as well.
2319
- format: options.credentialRequest.format?.format,
2320
- ...options.additionalPayload
2321
- });
1750
+ return (0, __openid4vc_utils.parseWithErrorHandling)(zCredentialResponse, {
1751
+ c_nonce: options.cNonce,
1752
+ c_nonce_expires_in: options.cNonceExpiresInSeconds,
1753
+ credential: options.credential,
1754
+ credentials: options.credentials,
1755
+ notification_id: options.notificationId,
1756
+ transaction_id: options.transactionId,
1757
+ interval: options.interval,
1758
+ format: options.credentialRequest.format?.format,
1759
+ ...options.additionalPayload
1760
+ });
2322
1761
  }
2323
1762
  function createDeferredCredentialResponse(options) {
2324
- return (0, import_utils18.parseWithErrorHandling)(zDeferredCredentialResponse, {
2325
- credentials: options.credentials,
2326
- notification_id: options.notificationId,
2327
- interval: options.interval,
2328
- ...options.additionalPayload
2329
- });
1763
+ return (0, __openid4vc_utils.parseWithErrorHandling)(zDeferredCredentialResponse, {
1764
+ credentials: options.credentials,
1765
+ notification_id: options.notificationId,
1766
+ interval: options.interval,
1767
+ ...options.additionalPayload
1768
+ });
2330
1769
  }
2331
1770
 
2332
- // src/credential-request/parse-credential-request.ts
2333
- var import_utils19 = require("@openid4vc/utils");
2334
- var import_zod22 = __toESM(require("zod"));
1771
+ //#endregion
1772
+ //#region src/credential-request/parse-credential-request.ts
2335
1773
  function parseCredentialRequest(options) {
2336
- const credentialRequest = (0, import_utils19.parseWithErrorHandling)(
2337
- zCredentialRequest,
2338
- options.credentialRequest,
2339
- "Error validating credential request"
2340
- );
2341
- let proofs = void 0;
2342
- const knownProofs = zCredentialRequestProofs.strict().safeParse(credentialRequest.proofs);
2343
- if (knownProofs.success) {
2344
- proofs = knownProofs.data;
2345
- }
2346
- const knownProof = import_zod22.default.union(allCredentialRequestProofs).safeParse(credentialRequest.proof);
2347
- if (knownProof.success && knownProof.data.proof_type === jwtProofTypeIdentifier) {
2348
- proofs = { [jwtProofTypeIdentifier]: [knownProof.data.jwt] };
2349
- } else if (knownProof.success && knownProof.data.proof_type === attestationProofTypeIdentifier) {
2350
- proofs = { [attestationProofTypeIdentifier]: [knownProof.data.attestation] };
2351
- }
2352
- if (credentialRequest.credential_configuration_id) {
2353
- getCredentialConfigurationSupportedById(
2354
- options.issuerMetadata.credentialIssuer.credential_configurations_supported,
2355
- credentialRequest.credential_configuration_id
2356
- );
2357
- const credentialConfigurations = extractKnownCredentialConfigurationSupportedFormats(
2358
- options.issuerMetadata.credentialIssuer.credential_configurations_supported
2359
- );
2360
- return {
2361
- credentialConfiguration: credentialConfigurations[credentialRequest.credential_configuration_id],
2362
- credentialConfigurationId: credentialRequest.credential_configuration_id,
2363
- credentialRequest,
2364
- proofs
2365
- };
2366
- }
2367
- if (credentialRequest.credential_identifier) {
2368
- return {
2369
- credentialIdentifier: credentialRequest.credential_identifier,
2370
- credentialRequest,
2371
- proofs
2372
- };
2373
- }
2374
- if (credentialRequest.format && allCredentialRequestFormatIdentifiers.includes(
2375
- credentialRequest.format
2376
- )) {
2377
- return {
2378
- // Removes all claims that are not specific to this format
2379
- format: (0, import_utils19.parseWithErrorHandling)(
2380
- import_zod22.default.union(allCredentialRequestFormats),
2381
- credentialRequest,
2382
- "Unable to validate format specific properties from credential request"
2383
- ),
2384
- credentialRequest,
2385
- proofs
2386
- };
2387
- }
2388
- return {
2389
- credentialRequest,
2390
- proofs
2391
- };
1774
+ const credentialRequest = (0, __openid4vc_utils.parseWithErrorHandling)(zCredentialRequest, options.credentialRequest, "Error validating credential request");
1775
+ let proofs;
1776
+ const knownProofs = zCredentialRequestProofs.strict().safeParse(credentialRequest.proofs);
1777
+ if (knownProofs.success) proofs = knownProofs.data;
1778
+ const knownProof = zod.default.union(allCredentialRequestProofs).safeParse(credentialRequest.proof);
1779
+ if (knownProof.success && knownProof.data.proof_type === jwtProofTypeIdentifier) proofs = { [jwtProofTypeIdentifier]: [knownProof.data.jwt] };
1780
+ else if (knownProof.success && knownProof.data.proof_type === attestationProofTypeIdentifier) proofs = { [attestationProofTypeIdentifier]: [knownProof.data.attestation] };
1781
+ if (credentialRequest.credential_configuration_id) {
1782
+ getCredentialConfigurationSupportedById(options.issuerMetadata.credentialIssuer.credential_configurations_supported, credentialRequest.credential_configuration_id);
1783
+ return {
1784
+ credentialConfiguration: extractKnownCredentialConfigurationSupportedFormats(options.issuerMetadata.credentialIssuer.credential_configurations_supported)[credentialRequest.credential_configuration_id],
1785
+ credentialConfigurationId: credentialRequest.credential_configuration_id,
1786
+ credentialRequest,
1787
+ proofs
1788
+ };
1789
+ }
1790
+ if (credentialRequest.credential_identifier) return {
1791
+ credentialIdentifier: credentialRequest.credential_identifier,
1792
+ credentialRequest,
1793
+ proofs
1794
+ };
1795
+ if (credentialRequest.format && allCredentialRequestFormatIdentifiers.includes(credentialRequest.format)) return {
1796
+ format: (0, __openid4vc_utils.parseWithErrorHandling)(zod.default.union(allCredentialRequestFormats), credentialRequest, "Unable to validate format specific properties from credential request"),
1797
+ credentialRequest,
1798
+ proofs
1799
+ };
1800
+ return {
1801
+ credentialRequest,
1802
+ proofs
1803
+ };
2392
1804
  }
2393
1805
 
2394
- // src/credential-request/parse-deferred-credential-request.ts
2395
- var import_utils20 = require("@openid4vc/utils");
1806
+ //#endregion
1807
+ //#region src/credential-request/parse-deferred-credential-request.ts
2396
1808
  function parseDeferredCredentialRequest(options) {
2397
- const deferredCredentialRequest = (0, import_utils20.parseWithErrorHandling)(
2398
- zDeferredCredentialRequest,
2399
- options.deferredCredentialRequest,
2400
- "Error validating credential request"
2401
- );
2402
- return {
2403
- deferredCredentialRequest
2404
- };
1809
+ return { deferredCredentialRequest: (0, __openid4vc_utils.parseWithErrorHandling)(zDeferredCredentialRequest, options.deferredCredentialRequest, "Error validating credential request") };
2405
1810
  }
2406
1811
 
2407
- // src/formats/proof-type/attestation/attestation-proof-type.ts
1812
+ //#endregion
1813
+ //#region src/formats/proof-type/attestation/attestation-proof-type.ts
2408
1814
  async function verifyCredentialRequestAttestationProof(options) {
2409
- const verificationResult = await verifyKeyAttestationJwt({
2410
- ...options,
2411
- use: "proof_type.attestation"
2412
- });
2413
- return verificationResult;
1815
+ return await verifyKeyAttestationJwt({
1816
+ ...options,
1817
+ use: "proof_type.attestation"
1818
+ });
2414
1819
  }
2415
1820
 
2416
- // src/Openid4vciIssuer.ts
1821
+ //#endregion
1822
+ //#region src/Openid4vciIssuer.ts
2417
1823
  var Openid4vciIssuer = class {
2418
- constructor(options) {
2419
- this.options = options;
2420
- }
2421
- getCredentialIssuerMetadataDraft11(credentialIssuerMetadata) {
2422
- return (0, import_utils21.parseWithErrorHandling)(zCredentialIssuerMetadataWithDraft11, credentialIssuerMetadata);
2423
- }
2424
- getKnownCredentialConfigurationsSupported(credentialIssuerMetadata) {
2425
- return extractKnownCredentialConfigurationSupportedFormats(
2426
- credentialIssuerMetadata.credential_configurations_supported
2427
- );
2428
- }
2429
- /**
2430
- * Create issuer metadata and validates the structure is correct
2431
- */
2432
- createCredentialIssuerMetadata(credentialIssuerMetadata) {
2433
- return (0, import_utils21.parseWithErrorHandling)(
2434
- zCredentialIssuerMetadata,
2435
- credentialIssuerMetadata,
2436
- "Error validating credential issuer metadata"
2437
- );
2438
- }
2439
- async createCredentialOffer(options) {
2440
- return createCredentialOffer({
2441
- callbacks: this.options.callbacks,
2442
- credentialConfigurationIds: options.credentialConfigurationIds,
2443
- grants: options.grants,
2444
- issuerMetadata: options.issuerMetadata,
2445
- additionalPayload: options.additionalPayload,
2446
- credentialOfferScheme: options.credentialOfferScheme,
2447
- credentialOfferUri: options.credentialOfferUri
2448
- });
2449
- }
2450
- /**
2451
- * @throws Oauth2ServerErrorResponseError - if verification of the jwt failed. You can extract
2452
- * the credential error response from this.
2453
- */
2454
- async verifyCredentialRequestJwtProof(options) {
2455
- try {
2456
- return await verifyCredentialRequestJwtProof({
2457
- callbacks: this.options.callbacks,
2458
- credentialIssuer: options.issuerMetadata.credentialIssuer.credential_issuer,
2459
- expectedNonce: options.expectedNonce,
2460
- nonceExpiresAt: options.nonceExpiresAt,
2461
- jwt: options.jwt,
2462
- clientId: options.clientId,
2463
- now: options.now
2464
- });
2465
- } catch (error) {
2466
- throw new import_oauth220.Oauth2ServerErrorResponseError(
2467
- {
2468
- error: import_oauth220.Oauth2ErrorCodes.InvalidProof,
2469
- error_description: (
2470
- // TODO: error should have a internalErrorMessage and a publicErrorMessage
2471
- error instanceof import_oauth220.Oauth2JwtVerificationError || error instanceof Openid4vciError ? error.message : "Invalid proof"
2472
- )
2473
- },
2474
- {
2475
- internalMessage: "Error verifying credential request proof jwt",
2476
- cause: error
2477
- }
2478
- );
2479
- }
2480
- }
2481
- /**
2482
- * @throws Oauth2ServerErrorResponseError - if verification of the key attestation failed. You can extract
2483
- * the credential error response from this.
2484
- */
2485
- async verifyCredentialRequestAttestationProof(options) {
2486
- try {
2487
- return await verifyCredentialRequestAttestationProof({
2488
- callbacks: this.options.callbacks,
2489
- expectedNonce: options.expectedNonce,
2490
- keyAttestationJwt: options.keyAttestationJwt,
2491
- nonceExpiresAt: options.nonceExpiresAt,
2492
- now: options.now
2493
- });
2494
- } catch (error) {
2495
- throw new import_oauth220.Oauth2ServerErrorResponseError(
2496
- {
2497
- error: import_oauth220.Oauth2ErrorCodes.InvalidProof,
2498
- error_description: (
2499
- // TODO: error should have a internalErrorMessage and a publicErrorMessage
2500
- error instanceof import_oauth220.Oauth2JwtVerificationError || error instanceof Openid4vciError ? error.message : "Invalid proof"
2501
- )
2502
- },
2503
- {
2504
- internalMessage: "Error verifying credential request proof attestation",
2505
- cause: error
2506
- }
2507
- );
2508
- }
2509
- }
2510
- /**
2511
- * @throws Oauth2ServerErrorResponseError - when validation of the credential request fails
2512
- * You can extract the credential error response from this.
2513
- */
2514
- parseCredentialRequest(options) {
2515
- try {
2516
- return parseCredentialRequest(options);
2517
- } catch (error) {
2518
- throw new import_oauth220.Oauth2ServerErrorResponseError(
2519
- {
2520
- error: import_oauth220.Oauth2ErrorCodes.InvalidCredentialRequest,
2521
- error_description: (
2522
- // TODO: error should have a internalErrorMessage and a publicErrorMessage
2523
- error instanceof import_utils21.ValidationError ? error.message : "Invalid request"
2524
- )
2525
- },
2526
- {
2527
- internalMessage: "Error verifying credential request proof jwt",
2528
- cause: error
2529
- }
2530
- );
2531
- }
2532
- }
2533
- /**
2534
- * @throws Oauth2ServerErrorResponseError - when validation of the deferred credential request fails
2535
- */
2536
- parseDeferredCredentialRequest(options) {
2537
- try {
2538
- return parseDeferredCredentialRequest(options);
2539
- } catch (error) {
2540
- throw new import_oauth220.Oauth2ServerErrorResponseError(
2541
- {
2542
- error: import_oauth220.Oauth2ErrorCodes.InvalidCredentialRequest,
2543
- error_description: error instanceof import_utils21.ValidationError ? error.message : "Invalid request"
2544
- },
2545
- {
2546
- internalMessage: "Error parsing deferred credential request",
2547
- cause: error
2548
- }
2549
- );
2550
- }
2551
- }
2552
- /**
2553
- * @throws ValidationError - when validation of the credential response fails
2554
- */
2555
- createCredentialResponse(options) {
2556
- return createCredentialResponse(options);
2557
- }
2558
- /**
2559
- * @throws ValidationError - when validation of the credential response fails
2560
- */
2561
- createDeferredCredentialResponse(options) {
2562
- return createDeferredCredentialResponse(options);
2563
- }
2564
- /**
2565
- * @throws ValidationError - when validation of the nonce response fails
2566
- */
2567
- createNonceResponse(options) {
2568
- return createNonceResponse(options);
2569
- }
2570
- async verifyWalletAttestation(options) {
2571
- return new import_oauth220.Oauth2AuthorizationServer({
2572
- callbacks: this.options.callbacks
2573
- }).verifyClientAttestation(options);
2574
- }
1824
+ constructor(options) {
1825
+ this.options = options;
1826
+ }
1827
+ getCredentialIssuerMetadataDraft11(credentialIssuerMetadata) {
1828
+ return (0, __openid4vc_utils.parseWithErrorHandling)(zCredentialIssuerMetadataWithDraft11, credentialIssuerMetadata);
1829
+ }
1830
+ getKnownCredentialConfigurationsSupported(credentialIssuerMetadata) {
1831
+ return extractKnownCredentialConfigurationSupportedFormats(credentialIssuerMetadata.credential_configurations_supported);
1832
+ }
1833
+ /**
1834
+ * Create issuer metadata and validates the structure is correct
1835
+ */
1836
+ createCredentialIssuerMetadata(credentialIssuerMetadata) {
1837
+ return (0, __openid4vc_utils.parseWithErrorHandling)(zCredentialIssuerMetadata, credentialIssuerMetadata, "Error validating credential issuer metadata");
1838
+ }
1839
+ async createCredentialOffer(options) {
1840
+ return createCredentialOffer({
1841
+ callbacks: this.options.callbacks,
1842
+ credentialConfigurationIds: options.credentialConfigurationIds,
1843
+ grants: options.grants,
1844
+ issuerMetadata: options.issuerMetadata,
1845
+ additionalPayload: options.additionalPayload,
1846
+ credentialOfferScheme: options.credentialOfferScheme,
1847
+ credentialOfferUri: options.credentialOfferUri
1848
+ });
1849
+ }
1850
+ /**
1851
+ * @throws Oauth2ServerErrorResponseError - if verification of the jwt failed. You can extract
1852
+ * the credential error response from this.
1853
+ */
1854
+ async verifyCredentialRequestJwtProof(options) {
1855
+ try {
1856
+ return await verifyCredentialRequestJwtProof({
1857
+ callbacks: this.options.callbacks,
1858
+ credentialIssuer: options.issuerMetadata.credentialIssuer.credential_issuer,
1859
+ expectedNonce: options.expectedNonce,
1860
+ nonceExpiresAt: options.nonceExpiresAt,
1861
+ jwt: options.jwt,
1862
+ clientId: options.clientId,
1863
+ now: options.now
1864
+ });
1865
+ } catch (error) {
1866
+ throw new __openid4vc_oauth2.Oauth2ServerErrorResponseError({
1867
+ error: __openid4vc_oauth2.Oauth2ErrorCodes.InvalidProof,
1868
+ error_description: error instanceof __openid4vc_oauth2.Oauth2JwtVerificationError || error instanceof Openid4vciError ? error.message : "Invalid proof"
1869
+ }, {
1870
+ internalMessage: "Error verifying credential request proof jwt",
1871
+ cause: error
1872
+ });
1873
+ }
1874
+ }
1875
+ /**
1876
+ * @throws Oauth2ServerErrorResponseError - if verification of the key attestation failed. You can extract
1877
+ * the credential error response from this.
1878
+ */
1879
+ async verifyCredentialRequestAttestationProof(options) {
1880
+ try {
1881
+ return await verifyCredentialRequestAttestationProof({
1882
+ callbacks: this.options.callbacks,
1883
+ expectedNonce: options.expectedNonce,
1884
+ keyAttestationJwt: options.keyAttestationJwt,
1885
+ nonceExpiresAt: options.nonceExpiresAt,
1886
+ now: options.now
1887
+ });
1888
+ } catch (error) {
1889
+ throw new __openid4vc_oauth2.Oauth2ServerErrorResponseError({
1890
+ error: __openid4vc_oauth2.Oauth2ErrorCodes.InvalidProof,
1891
+ error_description: error instanceof __openid4vc_oauth2.Oauth2JwtVerificationError || error instanceof Openid4vciError ? error.message : "Invalid proof"
1892
+ }, {
1893
+ internalMessage: "Error verifying credential request proof attestation",
1894
+ cause: error
1895
+ });
1896
+ }
1897
+ }
1898
+ /**
1899
+ * @throws Oauth2ServerErrorResponseError - when validation of the credential request fails
1900
+ * You can extract the credential error response from this.
1901
+ */
1902
+ parseCredentialRequest(options) {
1903
+ try {
1904
+ return parseCredentialRequest(options);
1905
+ } catch (error) {
1906
+ throw new __openid4vc_oauth2.Oauth2ServerErrorResponseError({
1907
+ error: __openid4vc_oauth2.Oauth2ErrorCodes.InvalidCredentialRequest,
1908
+ error_description: error instanceof __openid4vc_utils.ValidationError ? error.message : "Invalid request"
1909
+ }, {
1910
+ internalMessage: "Error verifying credential request proof jwt",
1911
+ cause: error
1912
+ });
1913
+ }
1914
+ }
1915
+ /**
1916
+ * @throws Oauth2ServerErrorResponseError - when validation of the deferred credential request fails
1917
+ */
1918
+ parseDeferredCredentialRequest(options) {
1919
+ try {
1920
+ return parseDeferredCredentialRequest(options);
1921
+ } catch (error) {
1922
+ throw new __openid4vc_oauth2.Oauth2ServerErrorResponseError({
1923
+ error: __openid4vc_oauth2.Oauth2ErrorCodes.InvalidCredentialRequest,
1924
+ error_description: error instanceof __openid4vc_utils.ValidationError ? error.message : "Invalid request"
1925
+ }, {
1926
+ internalMessage: "Error parsing deferred credential request",
1927
+ cause: error
1928
+ });
1929
+ }
1930
+ }
1931
+ /**
1932
+ * @throws ValidationError - when validation of the credential response fails
1933
+ */
1934
+ createCredentialResponse(options) {
1935
+ return createCredentialResponse(options);
1936
+ }
1937
+ /**
1938
+ * @throws ValidationError - when validation of the credential response fails
1939
+ */
1940
+ createDeferredCredentialResponse(options) {
1941
+ return createDeferredCredentialResponse(options);
1942
+ }
1943
+ /**
1944
+ * @throws ValidationError - when validation of the nonce response fails
1945
+ */
1946
+ createNonceResponse(options) {
1947
+ return createNonceResponse(options);
1948
+ }
1949
+ async verifyWalletAttestation(options) {
1950
+ return new __openid4vc_oauth2.Oauth2AuthorizationServer({ callbacks: this.options.callbacks }).verifyClientAttestation(options);
1951
+ }
2575
1952
  };
2576
1953
 
2577
- // src/Openid4vciWalletProvider.ts
2578
- var import_oauth221 = require("@openid4vc/oauth2");
1954
+ //#endregion
1955
+ //#region src/Openid4vciWalletProvider.ts
2579
1956
  var Openid4vciWalletProvider = class {
2580
- constructor(options) {
2581
- this.options = options;
2582
- }
2583
- async createWalletAttestationJwt(options) {
2584
- const additionalPayload = options.additionalPayload ? {
2585
- wallet_name: options.walletName,
2586
- wallet_link: options.walletLink,
2587
- ...options.additionalPayload
2588
- } : {
2589
- wallet_name: options.walletName,
2590
- wallet_link: options.walletLink
2591
- };
2592
- return await (0, import_oauth221.createClientAttestationJwt)({
2593
- ...options,
2594
- callbacks: this.options.callbacks,
2595
- additionalPayload
2596
- });
1957
+ constructor(options) {
1958
+ this.options = options;
1959
+ }
1960
+ async createWalletAttestationJwt(options) {
1961
+ const additionalPayload = options.additionalPayload ? {
1962
+ wallet_name: options.walletName,
1963
+ wallet_link: options.walletLink,
1964
+ ...options.additionalPayload
1965
+ } : {
1966
+ wallet_name: options.walletName,
1967
+ wallet_link: options.walletLink
1968
+ };
1969
+ return await (0, __openid4vc_oauth2.createClientAttestationJwt)({
1970
+ ...options,
1971
+ callbacks: this.options.callbacks,
1972
+ additionalPayload
1973
+ });
1974
+ }
1975
+ async createKeyAttestationJwt(options) {
1976
+ return await createKeyAttestationJwt({
1977
+ callbacks: this.options.callbacks,
1978
+ ...options
1979
+ });
1980
+ }
1981
+ };
1982
+
1983
+ //#endregion
1984
+ exports.AuthorizationFlow = AuthorizationFlow;
1985
+ exports.Openid4vciClient = Openid4vciClient;
1986
+ exports.Openid4vciDraftVersion = Openid4vciDraftVersion;
1987
+ exports.Openid4vciError = Openid4vciError;
1988
+ exports.Openid4vciIssuer = Openid4vciIssuer;
1989
+ exports.Openid4vciRetrieveCredentialsError = Openid4vciRetrieveCredentialsError;
1990
+ exports.Openid4vciSendNotificationError = Openid4vciSendNotificationError;
1991
+ exports.Openid4vciWalletProvider = Openid4vciWalletProvider;
1992
+ exports.createKeyAttestationJwt = createKeyAttestationJwt;
1993
+ exports.credentialsSupportedToCredentialConfigurationsSupported = credentialsSupportedToCredentialConfigurationsSupported;
1994
+ exports.determineAuthorizationServerForCredentialOffer = determineAuthorizationServerForCredentialOffer;
1995
+ exports.extractScopesForCredentialConfigurationIds = extractScopesForCredentialConfigurationIds;
1996
+ exports.getCredentialConfigurationsMatchingRequestFormat = getCredentialConfigurationsMatchingRequestFormat;
1997
+ Object.defineProperty(exports, 'getGlobalConfig', {
1998
+ enumerable: true,
1999
+ get: function () {
2000
+ return __openid4vc_utils.getGlobalConfig;
2597
2001
  }
2598
- async createKeyAttestationJwt(options) {
2599
- return await createKeyAttestationJwt({
2600
- callbacks: this.options.callbacks,
2601
- ...options
2602
- });
2002
+ });
2003
+ exports.parseKeyAttestationJwt = parseKeyAttestationJwt;
2004
+ Object.defineProperty(exports, 'setGlobalConfig', {
2005
+ enumerable: true,
2006
+ get: function () {
2007
+ return __openid4vc_utils.setGlobalConfig;
2603
2008
  }
2604
- };
2605
- // Annotate the CommonJS export names for ESM import in node:
2606
- 0 && (module.exports = {
2607
- AuthorizationFlow,
2608
- Openid4vciClient,
2609
- Openid4vciDraftVersion,
2610
- Openid4vciError,
2611
- Openid4vciIssuer,
2612
- Openid4vciRetrieveCredentialsError,
2613
- Openid4vciSendNotificationError,
2614
- Openid4vciWalletProvider,
2615
- createKeyAttestationJwt,
2616
- credentialsSupportedToCredentialConfigurationsSupported,
2617
- determineAuthorizationServerForCredentialOffer,
2618
- extractScopesForCredentialConfigurationIds,
2619
- getCredentialConfigurationsMatchingRequestFormat,
2620
- getGlobalConfig,
2621
- parseKeyAttestationJwt,
2622
- setGlobalConfig,
2623
- verifyKeyAttestationJwt
2624
2009
  });
2010
+ exports.verifyKeyAttestationJwt = verifyKeyAttestationJwt;
2625
2011
  //# sourceMappingURL=index.js.map