@openid4vc/openid4vci 0.3.0-alpha-20251120111517 → 0.3.0-alpha-20251120112059

package/dist/index.mjs

@@ -144,32 +144,53 @@ async function createCredentialOffer(options) {
 }
 
 //#endregion
-//#region src/metadata/credential-issuer/z-claims-description.ts
-const zCredentialConfigurationSupportedClaimsDescriptionDraft14 = z.object({
-	mandatory: z.boolean().optional(),
-	value_type: z.string().optional(),
-	display: z.array(z.object({
-		name: z.string().optional(),
-		locale: z.string().optional()
-	}).loose()).optional()
-}).loose();
-const zCredentialConfigurationSupportedClaimsDraft14 = z.record(z.string(), z.union([zCredentialConfigurationSupportedClaimsDescriptionDraft14, z.lazy(() => zCredentialConfigurationSupportedClaimsDraft14)]));
-const zClaimDescriptionPathValue = z.union([
-	z.string(),
-	z.number().int().nonnegative(),
-	z.null()
-]);
-const zClaimsDescriptionPath = z.tuple([zClaimDescriptionPathValue], zClaimDescriptionPathValue);
-const zMsoMdocClaimsDescriptionPath = z.tuple([z.string(), z.string()], z.string(), { message: "mso_mdoc claims description path MUST be an array with at least two string elements, pointing to the namespace and element identifier within an mdoc credential" });
-const zIssuerMetadataClaimsDescription = z.object({
-	path: zClaimsDescriptionPath,
-	mandatory: z.boolean().optional(),
-	display: z.array(z.object({
-		name: z.string().optional(),
-		locale: z.string().optional()
-	}).loose()).optional()
-}).loose();
-const zMsoMdocIssuerMetadataClaimsDescription = zIssuerMetadataClaimsDescription.extend({ path: zMsoMdocClaimsDescriptionPath });
+//#region src/credential-request/credential-request-configurations.ts
+function getCredentialConfigurationsMatchingRequestFormat({ requestFormat, issuerMetadata }) {
+	const knownCredentialConfigurations = issuerMetadata.knownCredentialConfigurations;
+	return Object.fromEntries(Object.entries(knownCredentialConfigurations).filter(([, credentialConfiguration]) => {
+		if (credentialConfiguration.format !== requestFormat.format) return false;
+		const r = requestFormat;
+		const c = credentialConfiguration;
+		if ((c.format === "ldp_vc" || c.format === "jwt_vc_json-ld") && r.format === c.format) return arrayEqualsIgnoreOrder(r.credential_definition.type, c.credential_definition.type) && arrayEqualsIgnoreOrder(r.credential_definition["@context"], c.credential_definition["@context"]);
+		if (c.format === "jwt_vc_json" && r.format === c.format) return arrayEqualsIgnoreOrder(r.credential_definition.type, c.credential_definition.type);
+		if (c.format === "vc+sd-jwt" && r.format === c.format) {
+			if (r.vct && c.vct) return r.vct === c.vct;
+			if (c.credential_definition && r.credential_definition) return arrayEqualsIgnoreOrder(r.credential_definition.type, c.credential_definition.type);
+		}
+		if (c.format === "mso_mdoc" && r.format === c.format) return r.doctype === c.doctype;
+		return false;
+	}));
+}
+
+//#endregion
+//#region src/error/Openid4vciError.ts
+var Openid4vciError = class extends Error {
+	constructor(message, options) {
+		const errorMessage = message ?? "Unknown error occurred.";
+		const causeMessage = options?.cause instanceof Error ? ` ${options.cause.message}` : options?.cause ? ` ${options?.cause}` : "";
+		super(`${errorMessage}${causeMessage}`);
+		this.cause = options?.cause;
+	}
+};
+
+//#endregion
+//#region src/error/Openid4vciRetrieveCredentialsError.ts
+var Openid4vciRetrieveCredentialsError = class extends Openid4vciError {
+	constructor(message, response, responseText) {
+		const errorData = response.credentialResponseResult?.data ?? response.credentialErrorResponseResult?.data ?? (response.credentialResponseResult?.error ? formatZodError(response.credentialResponseResult.error) : void 0) ?? responseText;
+		super(`${message}\n${JSON.stringify(errorData, null, 2)}`);
+		this.response = response;
+	}
+};
+
+//#endregion
+//#region src/error/Openid4vciSendNotificationError.ts
+var Openid4vciSendNotificationError = class extends Openid4vciError {
+	constructor(message, response) {
+		super(message);
+		this.response = response;
+	}
+};
 
 //#endregion
 //#region src/key-attestation/z-key-attestation.ts
@@ -198,6 +219,91 @@ const zKeyAttestationJwtPayloadForUse = (use) => z.object({
 	exp: use === "proof_type.jwt" ? zInteger : z.optional(zInteger)
 }).loose();
 
+//#endregion
+//#region src/key-attestation/key-attestation.ts
+async function createKeyAttestationJwt(options) {
+	const header = parseWithErrorHandling(zKeyAttestationJwtHeader, {
+		...jwtHeaderFromJwtSigner(options.signer),
+		typ: "keyattestation+jwt"
+	});
+	const payload = parseWithErrorHandling(zKeyAttestationJwtPayloadForUse(options.use), {
+		iat: dateToSeconds(options.issuedAt),
+		exp: options.expiresAt ? dateToSeconds(options.expiresAt) : void 0,
+		nonce: options.nonce,
+		attested_keys: options.attestedKeys,
+		user_authentication: options.userAuthentication,
+		key_storage: options.keyStorage,
+		certification: options.certification,
+		...options.additionalPayload
+	});
+	const { jwt } = await options.callbacks.signJwt(options.signer, {
+		header,
+		payload
+	});
+	return jwt;
+}
+function parseKeyAttestationJwt({ keyAttestationJwt, use }) {
+	return decodeJwt({
+		jwt: keyAttestationJwt,
+		headerSchema: zKeyAttestationJwtHeader,
+		payloadSchema: zKeyAttestationJwtPayloadForUse(use)
+	});
+}
+async function verifyKeyAttestationJwt(options) {
+	const { header, payload } = parseKeyAttestationJwt({
+		keyAttestationJwt: options.keyAttestationJwt,
+		use: options.use
+	});
+	const now = options.now?.getTime() ?? Date.now();
+	if (options.nonceExpiresAt && now > options.nonceExpiresAt.getTime()) throw new Openid4vciError("Nonce used for key attestation jwt expired");
+	const { signer } = await verifyJwt({
+		compact: options.keyAttestationJwt,
+		header,
+		payload,
+		signer: jwtSignerFromJwt({
+			header,
+			payload
+		}),
+		verifyJwtCallback: options.callbacks.verifyJwt,
+		errorMessage: "Error verifiying key attestation jwt",
+		expectedNonce: options.expectedNonce,
+		now: options.now
+	});
+	return {
+		header,
+		payload,
+		signer
+	};
+}
+
+//#endregion
+//#region src/metadata/credential-issuer/z-claims-description.ts
+const zCredentialConfigurationSupportedClaimsDescriptionDraft14 = z.object({
+	mandatory: z.boolean().optional(),
+	value_type: z.string().optional(),
+	display: z.array(z.object({
+		name: z.string().optional(),
+		locale: z.string().optional()
+	}).loose()).optional()
+}).loose();
+const zCredentialConfigurationSupportedClaimsDraft14 = z.record(z.string(), z.union([zCredentialConfigurationSupportedClaimsDescriptionDraft14, z.lazy(() => zCredentialConfigurationSupportedClaimsDraft14)]));
+const zClaimDescriptionPathValue = z.union([
+	z.string(),
+	z.number().int().nonnegative(),
+	z.null()
+]);
+const zClaimsDescriptionPath = z.tuple([zClaimDescriptionPathValue], zClaimDescriptionPathValue);
+const zMsoMdocClaimsDescriptionPath = z.tuple([z.string(), z.string()], z.string(), { message: "mso_mdoc claims description path MUST be an array with at least two string elements, pointing to the namespace and element identifier within an mdoc credential" });
+const zIssuerMetadataClaimsDescription = z.object({
+	path: zClaimsDescriptionPath,
+	mandatory: z.boolean().optional(),
+	display: z.array(z.object({
+		name: z.string().optional(),
+		locale: z.string().optional()
+	}).loose()).optional()
+}).loose();
+const zMsoMdocIssuerMetadataClaimsDescription = zIssuerMetadataClaimsDescription.extend({ path: zMsoMdocClaimsDescriptionPath });
+
 //#endregion
 //#region src/metadata/credential-issuer/z-credential-configuration-supported-common.ts
 const zCredentialConfigurationSupportedDisplayEntry = z.object({
@@ -633,7 +739,7 @@ const zCredentialIssuerMetadataDraft14Draft15V1 = z.object({
 	}).loose().optional(),
 	batch_credential_issuance: z.object({ batch_size: z.number().positive() }).loose().optional(),
 	display: z.array(zCredentialIssuerMetadataDisplayEntry).optional(),
-	credential_configurations_supported: z.record(z.string(), zCredentialConfigurationSupportedWithFormats)
+	credential_configurations_supported: z.record(z.string(), zCredentialConfigurationSupportedCommon)
 }).loose();
 const zCredentialConfigurationSupportedDraft11ToV1 = z.object({
 	id: z.string().optional(),
@@ -741,6 +847,37 @@ const zCredentialIssuerMetadataWithDraftVersion = z.union([zCredentialIssuerMeta
 	originalDraftVersion: Openid4vciDraftVersion.Draft11
 }))]);
 
+//#endregion
+//#region src/metadata/credential-issuer/credential-configurations.ts
+function extractScopesForCredentialConfigurationIds(options) {
+	const scopes = /* @__PURE__ */ new Set();
+	for (const credentialConfigurationId of options.credentialConfigurationIds) {
+		const credentialConfiguration = options.issuerMetadata.credentialIssuer.credential_configurations_supported[credentialConfigurationId];
+		if (!credentialConfiguration) throw new Oauth2Error(`Credential configuration with id '${credentialConfigurationId}' not found in metadata from credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}'`);
+		const scope = credentialConfiguration.scope;
+		if (scope) scopes.add(scope);
+		else if (!scope && options.throwOnConfigurationWithoutScope) throw new Oauth2Error(`Credential configuration with id '${credentialConfigurationId}' does not have a 'scope' configured, and 'throwOnConfigurationWithoutScope' was enabled.`);
+	}
+	return scopes.size > 0 ? Array.from(scopes) : void 0;
+}
+/**
+* Transforms draft 11 credentials supported syntax to credential configurations supported
+*
+* @throws if a credentials supported entry without id is passed
+* @throws if a credentials supported entry with invalid structure or format specific properties is passed
+*/
+function credentialsSupportedToCredentialConfigurationsSupported(credentialsSupported) {
+	const credentialConfigurationsSupported = {};
+	for (let index = 0; index < credentialsSupported.length; index++) {
+		const credentialSupported = credentialsSupported[index];
+		if (!credentialSupported.id) throw new Openid4vciError(`Credential supported at index '${index}' does not have an 'id' property. Credential configuration requires the 'id' property as key`);
+		const parseResult = zCredentialConfigurationSupportedDraft11ToV1.safeParse(credentialSupported);
+		if (!parseResult.success) throw new ValidationError(`Error transforming credential supported with id '${credentialSupported.id}' to credential configuration supported format`, parseResult.error);
+		credentialConfigurationsSupported[credentialSupported.id] = parseResult.data;
+	}
+	return credentialConfigurationsSupported;
+}
+
 //#endregion
 //#region src/metadata/credential-issuer/z-signed-credential-issuer-metadata.ts
 const zSignedCredentialIssuerMetadataHeader = z.object({
@@ -814,161 +951,34 @@ async function fetchCredentialIssuerMetadata(credentialIssuer, options) {
 }
 /**
 * Extract credential configuration supported entries where the `format` is known to this
-* library. Should be ran only after verifying the credential issuer metadata structure, so
-* we can be certain that if the `format` matches the other format specific requirements are also met.
+* library and the configuration validates correctly. Should be ran only after verifying
+* the credential issuer metadata structure, so we can be certain that if the `format`
+* matches the other format specific requirements are also met.
 *
 * Validation is done when resolving issuer metadata, or when calling `createIssuerMetadata`.
 */
 function extractKnownCredentialConfigurationSupportedFormats(credentialConfigurationsSupported) {
-	return Object.fromEntries(Object.entries(credentialConfigurationsSupported).filter((entry) => allCredentialIssuerMetadataFormatIdentifiers.includes(entry[1].format)));
-}
-function getCredentialConfigurationSupportedById(credentialConfigurations, credentialConfigurationId) {
-	const configuration = credentialConfigurations[credentialConfigurationId];
-	if (!configuration) throw new Oauth2Error(`Credential configuration with id '${credentialConfigurationId}' not found in credential configurations supported.`);
-	return configuration;
-}
-
-//#endregion
-//#region src/credential-request/credential-request-configurations.ts
-function getCredentialConfigurationsMatchingRequestFormat({ requestFormat, credentialConfigurations }) {
-	const knownCredentialConfigurations = extractKnownCredentialConfigurationSupportedFormats(credentialConfigurations);
-	return Object.fromEntries(Object.entries(knownCredentialConfigurations).filter(([, credentialConfiguration]) => {
-		if (credentialConfiguration.format !== requestFormat.format) return false;
-		const r = requestFormat;
-		const c = credentialConfiguration;
-		if ((c.format === "ldp_vc" || c.format === "jwt_vc_json-ld") && r.format === c.format) return arrayEqualsIgnoreOrder(r.credential_definition.type, c.credential_definition.type) && arrayEqualsIgnoreOrder(r.credential_definition["@context"], c.credential_definition["@context"]);
-		if (c.format === "jwt_vc_json" && r.format === c.format) return arrayEqualsIgnoreOrder(r.credential_definition.type, c.credential_definition.type);
-		if (c.format === "vc+sd-jwt" && r.format === c.format) {
-			if (r.vct && c.vct) return r.vct === c.vct;
-			if (c.credential_definition && r.credential_definition) return arrayEqualsIgnoreOrder(r.credential_definition.type, c.credential_definition.type);
-		}
-		if (c.format === "mso_mdoc" && r.format === c.format) return r.doctype === c.doctype;
-		return false;
+	return Object.fromEntries(Object.entries(credentialConfigurationsSupported).filter((entry) => {
+		const credentialConfiguration = zCredentialConfigurationSupportedWithFormats.safeParse(entry[1]);
+		if (!credentialConfiguration.success) return false;
+		return allCredentialIssuerMetadataFormatIdentifiers.includes(credentialConfiguration.data.format);
 	}));
 }
-
-//#endregion
-//#region src/error/Openid4vciError.ts
-var Openid4vciError = class extends Error {
-	constructor(message, options) {
-		const errorMessage = message ?? "Unknown error occurred.";
-		const causeMessage = options?.cause instanceof Error ? ` ${options.cause.message}` : options?.cause ? ` ${options?.cause}` : "";
-		super(`${errorMessage}${causeMessage}`);
-		this.cause = options?.cause;
-	}
-};
-
-//#endregion
-//#region src/error/Openid4vciRetrieveCredentialsError.ts
-var Openid4vciRetrieveCredentialsError = class extends Openid4vciError {
-	constructor(message, response, responseText) {
-		const errorData = response.credentialResponseResult?.data ?? response.credentialErrorResponseResult?.data ?? (response.credentialResponseResult?.error ? formatZodError(response.credentialResponseResult.error) : void 0) ?? responseText;
-		super(`${message}\n${JSON.stringify(errorData, null, 2)}`);
-		this.response = response;
-	}
-};
-
-//#endregion
-//#region src/error/Openid4vciSendNotificationError.ts
-var Openid4vciSendNotificationError = class extends Openid4vciError {
-	constructor(message, response) {
-		super(message);
-		this.response = response;
-	}
-};
-
-//#endregion
-//#region src/key-attestation/key-attestation.ts
-async function createKeyAttestationJwt(options) {
-	const header = parseWithErrorHandling(zKeyAttestationJwtHeader, {
-		...jwtHeaderFromJwtSigner(options.signer),
-		typ: "keyattestation+jwt"
-	});
-	const payload = parseWithErrorHandling(zKeyAttestationJwtPayloadForUse(options.use), {
-		iat: dateToSeconds(options.issuedAt),
-		exp: options.expiresAt ? dateToSeconds(options.expiresAt) : void 0,
-		nonce: options.nonce,
-		attested_keys: options.attestedKeys,
-		user_authentication: options.userAuthentication,
-		key_storage: options.keyStorage,
-		certification: options.certification,
-		...options.additionalPayload
-	});
-	const { jwt } = await options.callbacks.signJwt(options.signer, {
-		header,
-		payload
-	});
-	return jwt;
-}
-function parseKeyAttestationJwt({ keyAttestationJwt, use }) {
-	return decodeJwt({
-		jwt: keyAttestationJwt,
-		headerSchema: zKeyAttestationJwtHeader,
-		payloadSchema: zKeyAttestationJwtPayloadForUse(use)
-	});
-}
-async function verifyKeyAttestationJwt(options) {
-	const { header, payload } = parseKeyAttestationJwt({
-		keyAttestationJwt: options.keyAttestationJwt,
-		use: options.use
-	});
-	const now = options.now?.getTime() ?? Date.now();
-	if (options.nonceExpiresAt && now > options.nonceExpiresAt.getTime()) throw new Openid4vciError("Nonce used for key attestation jwt expired");
-	const { signer } = await verifyJwt({
-		compact: options.keyAttestationJwt,
-		header,
-		payload,
-		signer: jwtSignerFromJwt({
-			header,
-			payload
-		}),
-		verifyJwtCallback: options.callbacks.verifyJwt,
-		errorMessage: "Error verifiying key attestation jwt",
-		expectedNonce: options.expectedNonce,
-		now: options.now
-	});
-	return {
-		header,
-		payload,
-		signer
-	};
-}
-
-//#endregion
-//#region src/metadata/credential-issuer/credential-configurations.ts
-function extractScopesForCredentialConfigurationIds(options) {
-	const scopes = /* @__PURE__ */ new Set();
-	for (const credentialConfigurationId of options.credentialConfigurationIds) {
-		const credentialConfiguration = options.issuerMetadata.credentialIssuer.credential_configurations_supported[credentialConfigurationId];
-		if (!credentialConfiguration) throw new Oauth2Error(`Credential configuration with id '${credentialConfigurationId}' not found in metadata from credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}'`);
-		const scope = credentialConfiguration.scope;
-		if (scope) scopes.add(scope);
-		else if (!scope && options.throwOnConfigurationWithoutScope) throw new Oauth2Error(`Credential configuration with id '${credentialConfigurationId}' does not have a 'scope' configured, and 'throwOnConfigurationWithoutScope' was enabled.`);
-	}
-	return scopes.size > 0 ? Array.from(scopes) : void 0;
-}
 /**
-* Transforms draft 11 credentials supported syntax to credential configurations supported
-*
-* @throws if a credentials supported entry without id is passed
-* @throws if a credentials supported entry with invalid structure or format specific properties is passed
+* Get a known credential configuration supported by its id, it will throw an error if the configuration
+* is not found or if its found but the credential configuration is invalid.
 */
-function credentialsSupportedToCredentialConfigurationsSupported(credentialsSupported) {
-	const credentialConfigurationsSupported = {};
-	for (let index = 0; index < credentialsSupported.length; index++) {
-		const credentialSupported = credentialsSupported[index];
-		if (!credentialSupported.id) throw new Openid4vciError(`Credential supported at index '${index}' does not have an 'id' property. Credential configuration requires the 'id' property as key`);
-		const parseResult = zCredentialConfigurationSupportedDraft11ToV1.safeParse(credentialSupported);
-		if (!parseResult.success) throw new ValidationError(`Error transforming credential supported with id '${credentialSupported.id}' to credential configuration supported format`, parseResult.error);
-		credentialConfigurationsSupported[credentialSupported.id] = parseResult.data;
-	}
-	return credentialConfigurationsSupported;
+function getKnownCredentialConfigurationSupportedById(issuerMetadata, credentialConfigurationId) {
+	const configuration = issuerMetadata.credentialIssuer.credential_configurations_supported[credentialConfigurationId];
+	if (!configuration) throw new Oauth2Error(`Credential configuration with id '${credentialConfigurationId}' not found in credential configurations supported.`);
+	if (!issuerMetadata.knownCredentialConfigurations[credentialConfigurationId]) parseWithErrorHandling(zCredentialConfigurationSupportedWithFormats, configuration, `Credential configuration with id '${credentialConfigurationId}' is not valid`);
+	return issuerMetadata.knownCredentialConfigurations[credentialConfigurationId];
 }
 
 //#endregion
 //#region src/credential-request/format-payload.ts
 function getCredentialRequestFormatPayloadForCredentialConfigurationId(options) {
-	const credentialConfiguration = getCredentialConfigurationSupportedById(options.issuerMetadata.credentialIssuer.credential_configurations_supported, options.credentialConfigurationId);
+	const credentialConfiguration = getKnownCredentialConfigurationSupportedById(options.issuerMetadata, options.credentialConfigurationId);
 	if (zIs(zLegacySdJwtVcCredentialIssuerMetadataV1, credentialConfiguration) || zIs(zLegacySdJwtVcCredentialIssuerMetadataDraft14, credentialConfiguration)) return {
 		format: credentialConfiguration.format,
 		vct: credentialConfiguration.vct
@@ -1246,7 +1256,7 @@ const zDeferredCredentialResponse = zBaseCredentialResponse.superRefine((value,
 //#region src/credential-request/retrieve-credentials.ts
 async function retrieveCredentialsWithCredentialConfigurationId(options) {
 	if (options.issuerMetadata.originalDraftVersion !== Openid4vciDraftVersion.Draft15 && options.issuerMetadata.originalDraftVersion !== Openid4vciDraftVersion.V1) throw new Openid4vciError("Requesting credentials based on credential configuration ID is not supported in OpenID4VCI below draft 15. Make sure to provide the format and format specific claims in the request.");
-	getCredentialConfigurationSupportedById(options.issuerMetadata.credentialIssuer.credential_configurations_supported, options.credentialConfigurationId);
+	getKnownCredentialConfigurationSupportedById(options.issuerMetadata, options.credentialConfigurationId);
 	const credentialRequest = {
 		...options.additionalRequestPayload,
 		credential_configuration_id: options.credentialConfigurationId,
@@ -1457,7 +1467,8 @@ async function resolveIssuerMetadata(credentialIssuer, options) {
 		originalDraftVersion,
 		credentialIssuer: credentialIssuerMetadata,
 		signedCredentialIssuer: signed,
-		authorizationServers: authoriationServersMetadata
+		authorizationServers: authoriationServersMetadata,
+		knownCredentialConfigurations: extractKnownCredentialConfigurationSupportedFormats(credentialIssuerMetadata.credential_configurations_supported)
 	};
 }
 
@@ -1551,9 +1562,6 @@ var Openid4vciClient = class {
 		this.options = options;
 		this.oauth2Client = new Oauth2Client({ callbacks: this.options.callbacks });
 	}
-	getKnownCredentialConfigurationsSupported(credentialIssuerMetadata) {
-		return extractKnownCredentialConfigurationSupportedFormats(credentialIssuerMetadata.credential_configurations_supported);
-	}
 	/**
 	* Resolve a credential offer into a credential offer object, handling both
 	* 'credential_offer' and 'credential_offer_uri' params.
@@ -1858,9 +1866,9 @@ function parseCredentialRequest(options) {
 	if (knownProof.success && knownProof.data.proof_type === jwtProofTypeIdentifier) proofs = { [jwtProofTypeIdentifier]: [knownProof.data.jwt] };
 	else if (knownProof.success && knownProof.data.proof_type === attestationProofTypeIdentifier) proofs = { [attestationProofTypeIdentifier]: [knownProof.data.attestation] };
 	if (credentialRequest.credential_configuration_id) {
-		getCredentialConfigurationSupportedById(options.issuerMetadata.credentialIssuer.credential_configurations_supported, credentialRequest.credential_configuration_id);
+		getKnownCredentialConfigurationSupportedById(options.issuerMetadata, credentialRequest.credential_configuration_id);
 		return {
-			credentialConfiguration: extractKnownCredentialConfigurationSupportedFormats(options.issuerMetadata.credentialIssuer.credential_configurations_supported)[credentialRequest.credential_configuration_id],
+			credentialConfiguration: options.issuerMetadata.knownCredentialConfigurations[credentialRequest.credential_configuration_id],
 			credentialConfigurationId: credentialRequest.credential_configuration_id,
 			credentialRequest,
 			proofs