@openid4vc/openid4vci 0.5.2 → 0.5.3-alpha-20260702123119

package/dist/index.d.mts

@@ -1721,10 +1721,14 @@ declare const zCredentialRequestProof: z.ZodUnion<readonly [z.ZodObject<{
 }, z.core.$strip>, z.ZodObject<{
   proof_type: z.ZodLiteral<"attestation">;
   attestation: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+  proof_type: z.ZodLiteral<"di_vp">;
+  di_vp: z.ZodRecord<z.ZodString, z.ZodUnknown>;
 }, z.core.$strip>], "proof_type">]>;
 declare const zCredentialRequestProofs: z.ZodObject<{
   jwt: z.ZodOptional<z.ZodArray<z.ZodString>>;
   attestation: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  di_vp: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
 }, z.core.$strip>;
 type CredentialRequestProof = z.infer<typeof zCredentialRequestProof>;
 type CredentialRequestProofsFormatSpecific = z.infer<typeof zCredentialRequestProofs>;
@@ -1773,10 +1777,14 @@ declare const zCredentialRequestCommon: z.ZodObject<{
   }, z.core.$strip>, z.ZodObject<{
     proof_type: z.ZodLiteral<"attestation">;
     attestation: z.ZodString;
+  }, z.core.$strip>, z.ZodObject<{
+    proof_type: z.ZodLiteral<"di_vp">;
+    di_vp: z.ZodRecord<z.ZodString, z.ZodUnknown>;
   }, z.core.$strip>], "proof_type">]>>;
   proofs: z.ZodOptional<z.ZodIntersection<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodUnknown>>, z.ZodObject<{
     jwt: z.ZodOptional<z.ZodArray<z.ZodString>>;
     attestation: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    di_vp: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
   }, z.core.$strip>>>;
   credential_response_encryption: z.ZodOptional<z.ZodObject<{
     jwk: z.ZodObject<{
@@ -1865,10 +1873,14 @@ declare const zCredentialRequestDraft15: z.ZodUnion<readonly [z.ZodIntersection<
   }, z.core.$strip>, z.ZodObject<{
     proof_type: z.ZodLiteral<"attestation">;
     attestation: z.ZodString;
+  }, z.core.$strip>, z.ZodObject<{
+    proof_type: z.ZodLiteral<"di_vp">;
+    di_vp: z.ZodRecord<z.ZodString, z.ZodUnknown>;
   }, z.core.$strip>], "proof_type">]>>;
   proofs: z.ZodOptional<z.ZodIntersection<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodUnknown>>, z.ZodObject<{
     jwt: z.ZodOptional<z.ZodArray<z.ZodString>>;
     attestation: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    di_vp: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
   }, z.core.$strip>>>;
   credential_response_encryption: z.ZodOptional<z.ZodObject<{
     jwk: z.ZodObject<{
@@ -1916,10 +1928,14 @@ declare const zCredentialRequestDraft15: z.ZodUnion<readonly [z.ZodIntersection<
   }, z.core.$strip>, z.ZodObject<{
     proof_type: z.ZodLiteral<"attestation">;
     attestation: z.ZodString;
+  }, z.core.$strip>, z.ZodObject<{
+    proof_type: z.ZodLiteral<"di_vp">;
+    di_vp: z.ZodRecord<z.ZodString, z.ZodUnknown>;
   }, z.core.$strip>], "proof_type">]>>;
   proofs: z.ZodOptional<z.ZodIntersection<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodUnknown>>, z.ZodObject<{
     jwt: z.ZodOptional<z.ZodArray<z.ZodString>>;
     attestation: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    di_vp: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
   }, z.core.$strip>>>;
   credential_response_encryption: z.ZodOptional<z.ZodObject<{
     jwk: z.ZodObject<{
@@ -1968,10 +1984,14 @@ declare const zCredentialRequestDraft14: z.ZodUnion<readonly [z.ZodPipe<z.ZodInt
   }, z.core.$strip>, z.ZodObject<{
     proof_type: z.ZodLiteral<"attestation">;
     attestation: z.ZodString;
+  }, z.core.$strip>, z.ZodObject<{
+    proof_type: z.ZodLiteral<"di_vp">;
+    di_vp: z.ZodRecord<z.ZodString, z.ZodUnknown>;
   }, z.core.$strip>], "proof_type">]>>;
   proofs: z.ZodOptional<z.ZodIntersection<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodUnknown>>, z.ZodObject<{
     jwt: z.ZodOptional<z.ZodArray<z.ZodString>>;
     attestation: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    di_vp: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
   }, z.core.$strip>>>;
   credential_response_encryption: z.ZodOptional<z.ZodObject<{
     jwk: z.ZodObject<{
@@ -2019,6 +2039,9 @@ declare const zCredentialRequestDraft14: z.ZodUnion<readonly [z.ZodPipe<z.ZodInt
   } | {
     proof_type: "attestation";
     attestation: string;
+  } | {
+    proof_type: "di_vp";
+    di_vp: Record<string, unknown>;
   } | {
     [x: string]: unknown;
     proof_type: string;
@@ -2026,6 +2049,7 @@ declare const zCredentialRequestDraft14: z.ZodUnion<readonly [z.ZodPipe<z.ZodInt
   proofs?: (Record<string, unknown[]> & {
     jwt?: string[] | undefined;
     attestation?: string[] | undefined;
+    di_vp?: Record<string, unknown>[] | undefined;
   }) | undefined;
   credential_response_encryption?: {
     [x: string]: unknown;
@@ -2077,6 +2101,9 @@ declare const zCredentialRequestDraft14: z.ZodUnion<readonly [z.ZodPipe<z.ZodInt
   } | {
     proof_type: "attestation";
     attestation: string;
+  } | {
+    proof_type: "di_vp";
+    di_vp: Record<string, unknown>;
   } | {
     [x: string]: unknown;
     proof_type: string;
@@ -2084,6 +2111,7 @@ declare const zCredentialRequestDraft14: z.ZodUnion<readonly [z.ZodPipe<z.ZodInt
   proofs?: (Record<string, unknown[]> & {
     jwt?: string[] | undefined;
     attestation?: string[] | undefined;
+    di_vp?: Record<string, unknown>[] | undefined;
   }) | undefined;
   credential_response_encryption?: {
     [x: string]: unknown;
@@ -2136,10 +2164,14 @@ declare const zCredentialRequestDraft14: z.ZodUnion<readonly [z.ZodPipe<z.ZodInt
   }, z.core.$strip>, z.ZodObject<{
     proof_type: z.ZodLiteral<"attestation">;
     attestation: z.ZodString;
+  }, z.core.$strip>, z.ZodObject<{
+    proof_type: z.ZodLiteral<"di_vp">;
+    di_vp: z.ZodRecord<z.ZodString, z.ZodUnknown>;
   }, z.core.$strip>], "proof_type">]>>;
   proofs: z.ZodOptional<z.ZodIntersection<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodUnknown>>, z.ZodObject<{
     jwt: z.ZodOptional<z.ZodArray<z.ZodString>>;
     attestation: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    di_vp: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
   }, z.core.$strip>>>;
   credential_response_encryption: z.ZodOptional<z.ZodObject<{
     jwk: z.ZodObject<{
@@ -2622,6 +2654,10 @@ type Iso18045 = z.infer<typeof zIso18045>;
 declare const zAttestationProofTypeIdentifier: z.ZodLiteral<"attestation">;
 type AttestationProofTypeIdentifier = z.infer<typeof zAttestationProofTypeIdentifier>;
 //#endregion
+//#region src/formats/proof-type/di-vp/z-di-vp-proof-type.d.ts
+declare const zDiVpProofTypeIdentifier: z.ZodLiteral<"di_vp">;
+type DiVpProofTypeIdentifier = z.infer<typeof zDiVpProofTypeIdentifier>;
+//#endregion
 //#region src/formats/proof-type/jwt/z-jwt-proof-type.d.ts
 declare const zJwtProofTypeIdentifier: z.ZodLiteral<"jwt">;
 type JwtProofTypeIdentifier = z.infer<typeof zJwtProofTypeIdentifier>;
@@ -2710,7 +2746,7 @@ declare const zCredentialRequestJwtProofTypePayload: z.ZodObject<{
 type CredentialRequestJwtProofTypePayload = z.infer<typeof zCredentialRequestJwtProofTypePayload>;
 //#endregion
 //#region src/formats/proof-type/index.d.ts
-type ProofTypeIdentifier = JwtProofTypeIdentifier | AttestationProofTypeIdentifier;
+type ProofTypeIdentifier = JwtProofTypeIdentifier | AttestationProofTypeIdentifier | DiVpProofTypeIdentifier;
 //#endregion
 //#region src/interactive-authorization/create-interactive-authorization-response.d.ts
 interface CreateInteractiveAuthorizationCodeResponseOptions {
@@ -2912,8 +2948,8 @@ declare function createInteractiveAuthorizationErrorResponse(options: CreateInte
 declare const zInteractiveAuthorizationInitialRequest: z$1.ZodObject<{
   interaction_types_supported: z$1.ZodString;
   response_type: z$1.ZodDefault<z$1.ZodLiteral<"code">>;
-  scope: z$1.ZodOptional<z$1.ZodString>;
   issuer_state: z$1.ZodOptional<z$1.ZodString>;
+  scope: z$1.ZodOptional<z$1.ZodString>;
   client_id: z$1.ZodString;
   redirect_uri: z$1.ZodOptional<z$1.ZodURL>;
   resource: z$1.ZodOptional<z$1.ZodURL>;
@@ -4305,6 +4341,13 @@ type VerifyJwtCallback = (jwtSigner: JwtSigner$1, jwt: {
   verified: false;
   signerJwk?: Jwk$1;
 }>;
+type VerifyDataIntegrityProofCallback = (dataIntegrityProof: Record<string, unknown>, document: Record<string, unknown>) => OrPromise<{
+  verified: true;
+  signerJwk: Jwk$1;
+} | {
+  verified: false;
+  signerJwk?: Jwk$1;
+}>;
 interface DecryptJweCallbackOptions {
   jwk?: Jwk$1;
 }
@@ -4349,6 +4392,11 @@ interface CallbackContext$1 {
    * Verify jwt callback for verification of Json Web Tokens
    */
   verifyJwt: VerifyJwtCallback;
+  /**
+   * Verify a Data Integrity proof (e.g. the `proof` of a `di_vp` key proof's Verifiable
+   * Presentation). Optional because most issuers won't support the `di_vp` proof type.
+   */
+  verifyDataIntegrityProof?: VerifyDataIntegrityProofCallback;
   /**
    * Generate random callback to generate random bytes. Used for
    * e.g. the 'jti' value in a dpop jwt, and 'code_verifier' in pkce.
@@ -4413,6 +4461,34 @@ interface ParseDeferredCredentialRequestReturn {
 //#region src/formats/proof-type/attestation/attestation-proof-type.d.ts
 interface VerifyCredentialRequestAttestationProofOptions extends Omit<VerifyKeyAttestationJwtOptions, 'use'> {}
 //#endregion
+//#region src/formats/proof-type/di-vp/di-vp-proof-type.d.ts
+interface VerifyCredentialRequestDiVpProofOptions {
+  /**
+   * The di_vp proof — a W3C Verifiable Presentation
+   */
+  vp: Record<string, unknown>;
+  /**
+   * Expected nonce. Should be a c_nonce previously shared with the wallet
+   */
+  expectedNonce?: string;
+  /**
+   * Date at which the nonce will expire
+   */
+  nonceExpiresAt?: Date;
+  /**
+   * The credential issuer identifier, will be matched against the DataIntegrityProof's `domain`.
+   */
+  credentialIssuer: string;
+  /**
+   * Current time, if not provided a new date instance will be created
+   */
+  now?: Date;
+  /**
+   * Callbacks required for the di_vp proof verification.
+   */
+  callbacks: Pick<CallbackContext, 'verifyDataIntegrityProof'>;
+}
+//#endregion
 //#region src/metadata/credential-issuer/signed-credential-issuer-metadata.d.ts
 interface CreateSignedCredentialIssuerMetadataJwtOptions {
   /**
@@ -4935,6 +5011,55 @@ declare class Openid4vciIssuer {
     };
     signer: import("@openid4vc/oauth2").JwtSignerWithJwk;
   }>;
+  /**
+   * @throws Oauth2ServerErrorResponseError - if verification of the di_vp proof failed. You can
+   *  extract the credential error response from this.
+   */
+  verifyCredentialRequestDiVpProof(options: Pick<VerifyCredentialRequestDiVpProofOptions, 'vp' | 'now' | 'expectedNonce' | 'nonceExpiresAt'> & {
+    issuerMetadata: IssuerMetadataResult;
+  }): Promise<{
+    vp: Record<string, unknown>;
+    proof: {
+      [x: string]: unknown;
+      type: "DataIntegrityProof";
+      cryptosuite: string;
+      proofPurpose: "authentication";
+      domain: string;
+      verificationMethod: string;
+      challenge?: string | undefined;
+    };
+    signerJwk: {
+      [x: string]: unknown;
+      kty: string;
+      crv?: string | undefined;
+      x?: string | undefined;
+      y?: string | undefined;
+      e?: string | undefined;
+      n?: string | undefined;
+      alg?: string | undefined;
+      d?: string | undefined;
+      dp?: string | undefined;
+      dq?: string | undefined;
+      ext?: boolean | undefined;
+      k?: string | undefined;
+      key_ops?: string[] | undefined;
+      kid?: string | undefined;
+      oth?: {
+        [x: string]: unknown;
+        d?: string | undefined;
+        r?: string | undefined;
+        t?: string | undefined;
+      }[] | undefined;
+      p?: string | undefined;
+      q?: string | undefined;
+      qi?: string | undefined;
+      use?: string | undefined;
+      x5c?: string[] | undefined;
+      x5t?: string | undefined;
+      'x5t#S256'?: string | undefined;
+      x5u?: string | undefined;
+    };
+  }>;
   /**
    * @throws Oauth2ServerErrorResponseError - when validation of the credential request fails
    *  You can extract the credential error response from this.
@@ -5249,5 +5374,5 @@ declare class Openid4vciWalletProvider {
   createKeyAttestationJwt(options: Omit<CreateKeyAttestationJwtOptions, 'callbacks'>): Promise<string>;
 }
 //#endregion
-export { AuthorizationFlow, type CreateCredentialResponseOptions, type CreateCredentialResponseReturn, type CreateInteractiveAuthorizationCodeResponseOptions, type CreateInteractiveAuthorizationErrorResponseOptions, type CreateInteractiveAuthorizationOpenid4vpInteractionOptions, type CreateInteractiveAuthorizationRedirectToWebInteractionOptions, type CreateKeyAttestationJwtOptions, type CredentialConfigurationSupported, type CredentialConfigurationSupportedWithFormats, type CredentialConfigurationsSupported, type CredentialConfigurationsSupportedWithFormats, type CredentialErrorResponse, type CredentialFormatIdentifier, type CredentialIssuerMetadata, type CredentialIssuerMetadataDisplayEntry, type CredentialOfferAuthorizationCodeGrant, type CredentialOfferGrants, type CredentialOfferObject, type CredentialOfferPreAuthorizedCodeGrant, type CredentialOfferPreAuthorizedCodeGrantTxCode, type CredentialRequest, type CredentialRequestFormatSpecific, type CredentialRequestJwtProofTypeHeader, type CredentialRequestJwtProofTypePayload, type CredentialRequestWithFormats, type CredentialResponse, type CredentialResponseEncryption, type DeferredCredentialRequest, type DeferredCredentialResponse, type ExtractScopesForCredentialConfigurationIdsOptions, type GetCredentialConfigurationsMatchingRequestFormatOptions, type InteractiveAuthorizationCodeResponse, type InteractiveAuthorizationFollowUpRequest, type InteractiveAuthorizationInitialRequest, type InteractiveAuthorizationInteractionRequiredResponse, type InteractiveAuthorizationOpenid4vpPresentationResponse, type InteractiveAuthorizationRedirectToWebResponse, type InteractiveAuthorizationRequest, InteractiveAuthorizationRequestType, type InteractiveAuthorizationResponse, type IssuerMetadataResult, type JwtProofTypeIdentifier, type JwtVcJsonFormatIdentifier, type JwtVcJsonLdFormatIdentifier, type LdpVcFormatIdentifier, type LegacySdJwtVcFormatIdentifier, type MsoMdocFormatIdentifier, type NonceResponse, type NotificationErrorResponse, type NotificationEvent, type Oid4vcTsConfig, Openid4vciClient, Openid4vciClientInteractiveAuthorizationError, type Openid4vciClientOptions, Openid4vciDraftVersion, Openid4vciError, type Openid4vciErrorOptions, Openid4vciIssuer, type Openid4vciIssuerOptions, Openid4vciRetrieveCredentialsError, Openid4vciSendNotificationError, Openid4vciVersion, Openid4vciWalletProvider, type Openid4vciWalletProviderOptions, type ParseCredentialRequestReturn, type ParseInteractiveAuthorizationFollowUpRequestResult, type ParseInteractiveAuthorizationInitialRequestResult, type ParseInteractiveAuthorizationRequestOptions, type ParseKeyAttestationJwtOptions, type ProofTypeIdentifier, type RetrieveCredentialsResponseNotOk, type RetrieveCredentialsResponseOk, type SendInteractiveAuthorizationRequestOptions, type SendNotificationResponseNotOk, type SendNotificationResponseOk, type VerifyInteractiveAuthorizationInitialRequestOptions, type VerifyInteractiveAuthorizationInitialRequestReturn, type VerifyKeyAttestationJwtOptions, type VerifyKeyAttestationJwtReturn, createInteractiveAuthorizationCodeResponse, createInteractiveAuthorizationErrorResponse, createInteractiveAuthorizationOpenid4vpInteraction, createInteractiveAuthorizationRedirectToWebInteraction, createKeyAttestationJwt, credentialsSupportedToCredentialConfigurationsSupported, determineAuthorizationServerForCredentialOffer, extractScopesForCredentialConfigurationIds, getCredentialConfigurationsMatchingRequestFormat, getGlobalConfig, parseInteractiveAuthorizationRequest, parseKeyAttestationJwt, sendInteractiveAuthorizationRequest, setGlobalConfig, verifyInteractiveAuthorizationInitialRequest, verifyKeyAttestationJwt, zCredentialIssuerMetadataDraft14Draft15V1 as zCredentialIssuerMetadataSchema };
+export { AuthorizationFlow, type CreateCredentialResponseOptions, type CreateCredentialResponseReturn, type CreateInteractiveAuthorizationCodeResponseOptions, type CreateInteractiveAuthorizationErrorResponseOptions, type CreateInteractiveAuthorizationOpenid4vpInteractionOptions, type CreateInteractiveAuthorizationRedirectToWebInteractionOptions, type CreateKeyAttestationJwtOptions, type CredentialConfigurationSupported, type CredentialConfigurationSupportedWithFormats, type CredentialConfigurationsSupported, type CredentialConfigurationsSupportedWithFormats, type CredentialErrorResponse, type CredentialFormatIdentifier, type CredentialIssuerMetadata, type CredentialIssuerMetadataDisplayEntry, type CredentialOfferAuthorizationCodeGrant, type CredentialOfferGrants, type CredentialOfferObject, type CredentialOfferPreAuthorizedCodeGrant, type CredentialOfferPreAuthorizedCodeGrantTxCode, type CredentialRequest, type CredentialRequestFormatSpecific, type CredentialRequestJwtProofTypeHeader, type CredentialRequestJwtProofTypePayload, type CredentialRequestWithFormats, type CredentialResponse, type CredentialResponseEncryption, type DeferredCredentialRequest, type DeferredCredentialResponse, type DiVpProofTypeIdentifier, type ExtractScopesForCredentialConfigurationIdsOptions, type GetCredentialConfigurationsMatchingRequestFormatOptions, type InteractiveAuthorizationCodeResponse, type InteractiveAuthorizationFollowUpRequest, type InteractiveAuthorizationInitialRequest, type InteractiveAuthorizationInteractionRequiredResponse, type InteractiveAuthorizationOpenid4vpPresentationResponse, type InteractiveAuthorizationRedirectToWebResponse, type InteractiveAuthorizationRequest, InteractiveAuthorizationRequestType, type InteractiveAuthorizationResponse, type IssuerMetadataResult, type JwtProofTypeIdentifier, type JwtVcJsonFormatIdentifier, type JwtVcJsonLdFormatIdentifier, type LdpVcFormatIdentifier, type LegacySdJwtVcFormatIdentifier, type MsoMdocFormatIdentifier, type NonceResponse, type NotificationErrorResponse, type NotificationEvent, type Oid4vcTsConfig, Openid4vciClient, Openid4vciClientInteractiveAuthorizationError, type Openid4vciClientOptions, Openid4vciDraftVersion, Openid4vciError, type Openid4vciErrorOptions, Openid4vciIssuer, type Openid4vciIssuerOptions, Openid4vciRetrieveCredentialsError, Openid4vciSendNotificationError, Openid4vciVersion, Openid4vciWalletProvider, type Openid4vciWalletProviderOptions, type ParseCredentialRequestReturn, type ParseInteractiveAuthorizationFollowUpRequestResult, type ParseInteractiveAuthorizationInitialRequestResult, type ParseInteractiveAuthorizationRequestOptions, type ParseKeyAttestationJwtOptions, type ProofTypeIdentifier, type RetrieveCredentialsResponseNotOk, type RetrieveCredentialsResponseOk, type SendInteractiveAuthorizationRequestOptions, type SendNotificationResponseNotOk, type SendNotificationResponseOk, type VerifyInteractiveAuthorizationInitialRequestOptions, type VerifyInteractiveAuthorizationInitialRequestReturn, type VerifyKeyAttestationJwtOptions, type VerifyKeyAttestationJwtReturn, createInteractiveAuthorizationCodeResponse, createInteractiveAuthorizationErrorResponse, createInteractiveAuthorizationOpenid4vpInteraction, createInteractiveAuthorizationRedirectToWebInteraction, createKeyAttestationJwt, credentialsSupportedToCredentialConfigurationsSupported, determineAuthorizationServerForCredentialOffer, extractScopesForCredentialConfigurationIds, getCredentialConfigurationsMatchingRequestFormat, getGlobalConfig, parseInteractiveAuthorizationRequest, parseKeyAttestationJwt, sendInteractiveAuthorizationRequest, setGlobalConfig, verifyInteractiveAuthorizationInitialRequest, verifyKeyAttestationJwt, zCredentialIssuerMetadataDraft14Draft15V1 as zCredentialIssuerMetadataSchema };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.mjs

@@ -1506,6 +1506,22 @@ const zCredentialRequestProofAttestation = z.object({
 });
 zKeyAttestationJwtPayloadForUse("proof_type.attestation");
 //#endregion
+//#region src/formats/proof-type/di-vp/z-di-vp-proof-type.ts
+const zDiVpProofTypeIdentifier = z.literal("di_vp");
+const diVpProofTypeIdentifier = zDiVpProofTypeIdentifier.value;
+const zCredentialRequestProofDiVp = z.object({
+	proof_type: zDiVpProofTypeIdentifier,
+	di_vp: z.record(z.string(), z.unknown())
+});
+const zDataIntegrityProof = z.object({
+	type: z.literal("DataIntegrityProof", { message: `di_vp proof 'proof.type' must be 'DataIntegrityProof'` }),
+	cryptosuite: z.string({ message: `di_vp proof is missing required 'proof.cryptosuite'` }),
+	proofPurpose: z.literal("authentication", { message: `di_vp proof 'proof.proofPurpose' must be 'authentication'` }),
+	domain: z.string(),
+	challenge: z.string().optional(),
+	verificationMethod: z.string({ message: `di_vp proof is missing required 'proof.verificationMethod'` })
+}).loose();
+//#endregion
 //#region src/formats/proof-type/jwt/z-jwt-proof-type.ts
 const zJwtProofTypeIdentifier = z.literal("jwt");
 const jwtProofTypeIdentifier = zJwtProofTypeIdentifier.value;
@@ -1525,12 +1541,17 @@ const zCredentialRequestJwtProofTypePayload = z.object({
 //#endregion
 //#region src/credential-request/z-credential-request-common.ts
 const zCredentialRequestProofCommon = z.object({ proof_type: z.string() }).loose();
-const allCredentialRequestProofs = [zCredentialRequestProofJwt, zCredentialRequestProofAttestation];
+const allCredentialRequestProofs = [
+	zCredentialRequestProofJwt,
+	zCredentialRequestProofAttestation,
+	zCredentialRequestProofDiVp
+];
 const zCredentialRequestProof = z.union([zCredentialRequestProofCommon, z.discriminatedUnion("proof_type", allCredentialRequestProofs)]);
 const zCredentialRequestProofsCommon = z.record(z.string(), z.array(z.unknown()));
 const zCredentialRequestProofs = z.object({
 	[zJwtProofTypeIdentifier.value]: z.optional(z.array(zCredentialRequestProofJwt.shape.jwt)),
-	[zAttestationProofTypeIdentifier.value]: z.optional(z.array(zCredentialRequestProofAttestation.shape.attestation))
+	[zAttestationProofTypeIdentifier.value]: z.optional(z.array(zCredentialRequestProofAttestation.shape.attestation)),
+	[zDiVpProofTypeIdentifier.value]: z.optional(z.array(zCredentialRequestProofDiVp.shape.di_vp))
 });
 const zCredentialResponseEncryption = z.object({
 	jwk: zJwk,
@@ -2528,6 +2549,7 @@ function parseCredentialRequest(options) {
 	const knownProof = z.union(allCredentialRequestProofs).safeParse(credentialRequest.proof);
 	if (knownProof.success && knownProof.data.proof_type === jwtProofTypeIdentifier) proofs = { [jwtProofTypeIdentifier]: [knownProof.data.jwt] };
 	else if (knownProof.success && knownProof.data.proof_type === attestationProofTypeIdentifier) proofs = { [attestationProofTypeIdentifier]: [knownProof.data.attestation] };
+	else if (knownProof.success && knownProof.data.proof_type === diVpProofTypeIdentifier) proofs = { [diVpProofTypeIdentifier]: [knownProof.data.di_vp] };
 	const credentialResponseEncryption = credentialRequest.credential_response_encryption;
 	if (credentialRequest.credential_configuration_id) {
 		getKnownCredentialConfigurationSupportedById(options.issuerMetadata, credentialRequest.credential_configuration_id);
@@ -2571,6 +2593,27 @@ async function verifyCredentialRequestAttestationProof(options) {
 	});
 }
 //#endregion
+//#region src/formats/proof-type/di-vp/di-vp-proof-type.ts
+async function verifyCredentialRequestDiVpProof(options) {
+	const now = options.now?.getTime() ?? Date.now();
+	if (options.nonceExpiresAt && now > options.nonceExpiresAt.getTime()) throw new Openid4vciError("Nonce used for credential request proof expired");
+	const rawProof = options.vp.proof;
+	if (rawProof === void 0) throw new Openid4vciError(`di_vp proof is missing a 'proof' entry`);
+	const proof = parseWithErrorHandling(zDataIntegrityProof, Array.isArray(rawProof) ? rawProof[0] : rawProof, "di_vp proof contains an invalid proof entry");
+	if (proof.domain !== options.credentialIssuer) throw new Openid4vciError(`di_vp proof 'proof.domain' does not match the credential issuer identifier`);
+	if (options.expectedNonce !== void 0) {
+		if (proof.challenge !== options.expectedNonce) throw new Openid4vciError(`di_vp proof 'proof.challenge' does not match the expected nonce`);
+	} else if (proof.challenge !== void 0) throw new Openid4vciError(`di_vp proof 'proof.challenge' must not be present when no nonce was issued`);
+	if (!options.callbacks.verifyDataIntegrityProof) throw new Openid4vciError("Cannot verify di_vp proof: no verifyDataIntegrityProof callback configured");
+	const result = await options.callbacks.verifyDataIntegrityProof(proof, options.vp);
+	if (!result.verified) throw new Openid4vciError("Error verifying credential request di_vp proof");
+	return {
+		vp: options.vp,
+		proof,
+		signerJwk: result.signerJwk
+	};
+}
+//#endregion
 //#region src/metadata/credential-issuer/signed-credential-issuer-metadata.ts
 async function createSignedCredentialIssuerMetadataJwt(options) {
 	const header = parseWithErrorHandling(zSignedCredentialIssuerMetadataHeader, {
@@ -2678,6 +2721,30 @@ var Openid4vciIssuer = class {
 		}
 	}
 	/**
+	* @throws Oauth2ServerErrorResponseError - if verification of the di_vp proof failed. You can
+	*  extract the credential error response from this.
+	*/
+	async verifyCredentialRequestDiVpProof(options) {
+		try {
+			return await verifyCredentialRequestDiVpProof({
+				callbacks: this.options.callbacks,
+				credentialIssuer: options.issuerMetadata.credentialIssuer.credential_issuer,
+				expectedNonce: options.expectedNonce,
+				nonceExpiresAt: options.nonceExpiresAt,
+				vp: options.vp,
+				now: options.now
+			});
+		} catch (error) {
+			throw new Oauth2ServerErrorResponseError({
+				error: Oauth2ErrorCodes.InvalidProof,
+				error_description: error instanceof Openid4vciError ? error.message : "Invalid proof"
+			}, {
+				internalMessage: "Error verifying credential request di_vp proof",
+				cause: error
+			});
+		}
+	}
+	/**
 	* @throws Oauth2ServerErrorResponseError - when validation of the credential request fails
 	*  You can extract the credential error response from this.
 	*/