@owf/eudi-wrprc 0.0.0

package/dist/index.mjs

@@ -0,0 +1,892 @@
+import { z } from "zod";
+import { IdentityException, base64urlEncode, decodeJwt } from "@owf/identity-common";
+import { pemToDer } from "@owf/crypto";
+//#region src/schemas.ts
+/**
+* WRPRC Zod Schemas
+*
+* Zod schemas for ETSI TS 119 475 (Wallet-Relying Party Registration Certificates).
+* Types are derived from these schemas via z.infer<>.
+*
+* @see https://www.etsi.org/deliver/etsi_ts/119400_119499/119475/01.02.01_60/ts_119475v010201p.pdf
+*/
+/**
+* Multilingual string schema (B.2.6 Class MultiLangString)
+*/
+const MultiLangStringSchema = z.object({
+	lang: z.string().min(2),
+	value: z.string().min(1)
+});
+/**
+* Supervisory Authority schema for Data Protection Authority
+*/
+const SupervisoryAuthoritySchema = z.object({
+	email: z.string().email().optional(),
+	phone: z.string().optional(),
+	uri: z.string().url().optional()
+});
+/**
+* Claim schema for credential attribute specification (B.2.10 Class Claim)
+*/
+const ClaimSchema = z.object({
+	path: z.array(z.string()).min(1),
+	values: z.array(z.union([
+		z.string(),
+		z.number(),
+		z.boolean()
+	])).optional()
+});
+/**
+* Credential schema for attestations (B.2.9 Class Credential)
+*/
+const CredentialSchema = z.object({
+	format: z.string().min(1),
+	meta: z.record(z.unknown()),
+	claim: z.array(ClaimSchema).optional()
+});
+/**
+* Status list reference for certificate validity
+*/
+const StatusListSchema = z.object({
+	idx: z.number().int().nonnegative(),
+	uri: z.string().url()
+});
+/**
+* Status schema for WRPRC validity
+*/
+const StatusSchema = z.object({ status_list: StatusListSchema });
+/**
+* Intermediary information when WRP acts through an intermediary
+*/
+const IntermediarySchema = z.object({
+	sub: z.string().min(1),
+	name: z.string().min(1)
+});
+/**
+* WRPRC Payload schema according to ETSI TS 119 475 clause 5.2.4
+*/
+const WRPRCPayloadSchema = z.object({
+	name: z.string().min(1),
+	sub_ln: z.string().optional(),
+	sub_gn: z.string().optional(),
+	sub_fn: z.string().optional(),
+	sub: z.string().min(1),
+	country: z.string().length(2),
+	registry_uri: z.string().url(),
+	srv_description: z.array(z.array(MultiLangStringSchema)).optional(),
+	entitlements: z.array(z.string().url()).min(1),
+	privacy_policy: z.string().url().optional(),
+	info_uri: z.string().url().optional(),
+	support_uri: z.string().url().optional(),
+	supervisory_authority: SupervisoryAuthoritySchema.optional(),
+	policy_id: z.array(z.string()).optional(),
+	certificate_policy: z.string().url().optional(),
+	iat: z.number().int().positive(),
+	status: StatusSchema.optional(),
+	purpose: z.array(MultiLangStringSchema).optional(),
+	credentials: z.array(CredentialSchema).optional(),
+	provides_attestations: z.array(CredentialSchema).optional(),
+	intermediary: IntermediarySchema.optional()
+});
+/**
+* JWT Header schema according to ETSI TS 119 475 clause 5.2.2
+*/
+const WRPRCJWTHeaderSchema = z.object({
+	typ: z.literal("rc-wrp+jwt"),
+	alg: z.enum([
+		"ES256",
+		"ES384",
+		"ES512",
+		"RS256",
+		"RS384",
+		"RS512"
+	]),
+	x5c: z.array(z.string()).min(1),
+	kid: z.string().optional()
+});
+/**
+* CWT Header schema according to ETSI TS 119 475 clause 5.2.3
+*/
+const WRPRCCWTHeaderSchema = z.object({
+	typ: z.literal("rc-wrp+cwt"),
+	alg: z.number().int(),
+	x5chain: z.array(z.instanceof(Uint8Array)).min(1)
+});
+z.object({
+	header: WRPRCJWTHeaderSchema,
+	payload: WRPRCPayloadSchema
+});
+z.object({
+	header: WRPRCCWTHeaderSchema,
+	payload: WRPRCPayloadSchema
+});
+/**
+* Schema for legal person WRPRC subject
+*/
+const LegalPersonSubjectSchema = WRPRCPayloadSchema.extend({ sub_ln: z.string().min(1) }).omit({
+	sub_gn: true,
+	sub_fn: true
+});
+/**
+* Schema for natural person WRPRC subject
+*/
+const NaturalPersonSubjectSchema = WRPRCPayloadSchema.extend({
+	sub_gn: z.string().min(1),
+	sub_fn: z.string().min(1)
+}).omit({ sub_ln: true });
+//#endregion
+//#region src/entitlements.ts
+/**
+* WRPRC Entitlement Constants
+*
+* Entitlement identifiers as defined in ETSI TS 119 475 Annex A.
+* These identifiers define the roles and capabilities of Wallet-Relying Parties.
+*
+* @see https://www.etsi.org/deliver/etsi_ts/119400_119499/119475/01.02.01_60/ts_119475v010201p.pdf
+*/
+/**
+* Base OID for ETSI WRPA entitlements: 0.4.0.19475
+* id-etsi-wrpa OBJECT IDENTIFIER ::= { itu-t(0) identified-organization(4) etsi(0) 19475 }
+*/
+const ETSI_WRPA_BASE_OID = "0.4.0.19475";
+`${ETSI_WRPA_BASE_OID}`;
+/**
+* Service_Provider - General service provider (A.2.1)
+* OID: id-etsi-wrpa-entitlement 1
+*/
+const ENTITLEMENT_SERVICE_PROVIDER = "https://uri.etsi.org/19475/Entitlement/Service_Provider";
+/**
+* QEAA_Provider - Qualified trust service provider issuing qualified electronic attestations of attributes (A.2.2)
+* OID: id-etsi-wrpa-entitlement 2
+*/
+const ENTITLEMENT_QEAA_PROVIDER = "https://uri.etsi.org/19475/Entitlement/QEAA_Provider";
+/**
+* Non_Q_EAA_Provider - Trust service provider issuing non-qualified electronic attestations of attributes (A.2.3)
+* OID: id-etsi-wrpa-entitlement 3
+*/
+const ENTITLEMENT_NON_Q_EAA_PROVIDER = "https://uri.etsi.org/19475/Entitlement/Non_Q_EAA_Provider";
+/**
+* PUB_EAA_Provider - Public sector body or its agent issuing electronic attestations of attributes from authentic sources (A.2.4)
+* OID: id-etsi-wrpa-entitlement 4
+*/
+const ENTITLEMENT_PUB_EAA_PROVIDER = "https://uri.etsi.org/19475/Entitlement/PUB_EAA_Provider";
+/**
+* PID_Provider - Provider of person identification data (A.2.5)
+* OID: id-etsi-wrpa-entitlement 5
+*/
+const ENTITLEMENT_PID_PROVIDER = "https://uri.etsi.org/19475/Entitlement/PID_Provider";
+/**
+* All standard WRP entitlements defined in ETSI TS 119 475
+*/
+const WRP_ENTITLEMENTS = {
+	SERVICE_PROVIDER: ENTITLEMENT_SERVICE_PROVIDER,
+	QEAA_PROVIDER: ENTITLEMENT_QEAA_PROVIDER,
+	NON_Q_EAA_PROVIDER: ENTITLEMENT_NON_Q_EAA_PROVIDER,
+	PUB_EAA_PROVIDER: ENTITLEMENT_PUB_EAA_PROVIDER,
+	PID_PROVIDER: ENTITLEMENT_PID_PROVIDER,
+	QCERT_FOR_ESEAL_PROVIDER: "https://uri.etsi.org/19475/Entitlement/QCert_for_ESeal_Provider",
+	QCERT_FOR_ESIG_PROVIDER: "https://uri.etsi.org/19475/Entitlement/QCert_for_ESig_Provider",
+	RQSEALCDS_PROVIDER: "https://uri.etsi.org/19475/Entitlement/rQSealCDs_Provider",
+	RQSIGCDS_PROVIDER: "https://uri.etsi.org/19475/Entitlement/rQSigCDs_Provider",
+	ESIG_ESEAL_CREATION_PROVIDER: "https://uri.etsi.org/19475/Entitlement/ESig_ESeal_Creation_Provider"
+};
+/**
+* List of all standard entitlement URIs
+*/
+const ALL_ENTITLEMENTS = Object.values(WRP_ENTITLEMENTS);
+/**
+* Entitlements for attestation providers (QEAA, Non-Q EAA, PUB EAA, PID)
+*/
+const ATTESTATION_PROVIDER_ENTITLEMENTS = [
+	ENTITLEMENT_QEAA_PROVIDER,
+	ENTITLEMENT_NON_Q_EAA_PROVIDER,
+	ENTITLEMENT_PUB_EAA_PROVIDER,
+	ENTITLEMENT_PID_PROVIDER
+];
+/**
+* Payment Service Provider Sub-entitlements (A.3.1)
+* As defined in ETSI TS 119 495
+*/
+const PSP_SUB_ENTITLEMENTS = {
+	ACCOUNT_SERVICING: "https://uri.etsi.org/19475/SubEntitlement/psp/psp-as",
+	PAYMENT_INITIATION: "https://uri.etsi.org/19475/SubEntitlement/psp/psp-pi",
+	ACCOUNT_INFORMATION: "https://uri.etsi.org/19475/SubEntitlement/psp/psp-ai",
+	CARD_BASED: "https://uri.etsi.org/19475/SubEntitlement/psp/psp-ic",
+	UNSPECIFIED: "https://uri.etsi.org/19475/SubEntitlement/psp/unspecified"
+};
+/**
+* All PSP sub-entitlement URIs
+*/
+const ALL_PSP_SUB_ENTITLEMENTS = Object.values(PSP_SUB_ENTITLEMENTS);
+/**
+* Identifier type URIs for legal person semantic identifiers
+*/
+const IDENTIFIER_TYPES = {
+	EORI: "http://data.europa.eu/eudi/id/EORI-No",
+	LEI: "http://data.europa.eu/eudi/id/LEI",
+	EUID: "http://data.europa.eu/eudi/id/EUID",
+	VATIN: "http://data.europa.eu/eudi/id/VATIN",
+	TIN: "http://data.europa.eu/eudi/id/TIN",
+	EXCISE: "http://data.europa.eu/eudi/id/Excise"
+};
+IDENTIFIER_TYPES.EORI, IDENTIFIER_TYPES.LEI, IDENTIFIER_TYPES.EUID, IDENTIFIER_TYPES.VATIN, IDENTIFIER_TYPES.TIN, IDENTIFIER_TYPES.EXCISE;
+`${ETSI_WRPA_BASE_OID}`;
+/**
+* Check if a given URI is a valid WRP entitlement
+*/
+function isValidEntitlement(uri) {
+	return ALL_ENTITLEMENTS.includes(uri);
+}
+/**
+* Check if a given URI is a PSP sub-entitlement
+*/
+function isPSPSubEntitlement(uri) {
+	return ALL_PSP_SUB_ENTITLEMENTS.includes(uri);
+}
+/**
+* Check if entitlements include an attestation provider role
+*/
+function hasAttestationProviderEntitlement(entitlements) {
+	return entitlements.some((e) => ATTESTATION_PROVIDER_ENTITLEMENTS.includes(e));
+}
+//#endregion
+//#region src/wrprc-exception.ts
+/**
+* WRPRCException is a custom error class for WRPRC-related exceptions.
+*/
+var WRPRCException = class WRPRCException extends IdentityException {
+	constructor(message, details) {
+		super(message, details);
+		Object.setPrototypeOf(this, WRPRCException.prototype);
+		this.name = "WRPRCException";
+	}
+};
+//#endregion
+//#region src/validator.ts
+/**
+* WRPRC Validator
+*
+* Validation functions for ETSI TS 119 475 Wallet-Relying Party Registration Certificates.
+*
+* @see https://www.etsi.org/deliver/etsi_ts/119400_119499/119475/01.02.01_60/ts_119475v010201p.pdf
+*/
+/**
+* Validate a WRPRC payload against the schema
+*/
+function validateWRPRCPayload(payload) {
+	const result = WRPRCPayloadSchema.safeParse(payload);
+	const errors = [];
+	const warnings = [];
+	if (!result.success) {
+		for (const issue of result.error.issues) errors.push({
+			path: issue.path.map(String),
+			message: issue.message,
+			code: issue.code
+		});
+		return {
+			valid: false,
+			errors,
+			warnings
+		};
+	}
+	const validPayload = result.data;
+	for (const entitlement of validPayload.entitlements) if (!ALL_ENTITLEMENTS.includes(entitlement)) {
+		if (!ALL_PSP_SUB_ENTITLEMENTS.includes(entitlement)) warnings.push({
+			path: ["entitlements"],
+			message: `Unknown entitlement URI: ${entitlement}. This may be a national or EU-defined extension.`,
+			code: "unknown_entitlement"
+		});
+	}
+	if (validPayload.entitlements.length === 0) errors.push({
+		path: ["entitlements"],
+		message: "At least one entitlement must be specified (GEN-5.2.4-03)",
+		code: "missing_entitlement"
+	});
+	const hasSubEntitlement = validPayload.entitlements.some((e) => ALL_PSP_SUB_ENTITLEMENTS.includes(e));
+	const hasServiceProvider = validPayload.entitlements.includes("https://uri.etsi.org/19475/Entitlement/Service_Provider");
+	if (hasSubEntitlement && !hasServiceProvider) errors.push({
+		path: ["entitlements"],
+		message: "Service provider sub-entitlements require Service_Provider entitlement (GEN-5.2.4-04)",
+		code: "missing_base_entitlement"
+	});
+	if (validPayload.entitlements.some((e) => ATTESTATION_PROVIDER_ENTITLEMENTS.includes(e)) && !validPayload.provides_attestations) warnings.push({
+		path: ["provides_attestations"],
+		message: "Attestation providers should include provides_attestations field (GEN-5.2.4-05). This is recommended but not required.",
+		code: "missing_provides_attestations"
+	});
+	const subResult = validateSemanticIdentifier(validPayload.sub);
+	if (!subResult.valid) errors.push({
+		path: ["sub"],
+		message: subResult.message,
+		code: "invalid_semantic_identifier"
+	});
+	return {
+		valid: errors.length === 0,
+		errors,
+		warnings
+	};
+}
+/**
+* Validate a JWT header for WRPRC
+*/
+function validateWRPRCJWTHeader(header) {
+	const result = WRPRCJWTHeaderSchema.safeParse(header);
+	const errors = [];
+	const warnings = [];
+	if (!result.success) for (const issue of result.error.issues) errors.push({
+		path: issue.path.map(String),
+		message: issue.message,
+		code: issue.code
+	});
+	return {
+		valid: errors.length === 0,
+		errors,
+		warnings
+	};
+}
+/**
+* Validate a complete WRPRC (header + payload)
+*/
+function validateWRPRC(header, payload) {
+	const headerResult = validateWRPRCJWTHeader(header);
+	const payloadResult = validateWRPRCPayload(payload);
+	const errors = [...headerResult.errors.map((e) => ({
+		...e,
+		path: ["header", ...e.path]
+	})), ...payloadResult.errors.map((e) => ({
+		...e,
+		path: ["payload", ...e.path]
+	}))];
+	const warnings = [...headerResult.warnings.map((w) => ({
+		...w,
+		path: ["header", ...w.path]
+	})), ...payloadResult.warnings.map((w) => ({
+		...w,
+		path: ["payload", ...w.path]
+	}))];
+	return {
+		valid: errors.length === 0,
+		errors,
+		warnings
+	};
+}
+/**
+* Check if payload represents a legal person
+*/
+function isLegalPersonWRPRC(payload) {
+	return typeof payload.sub_ln === "string" && payload.sub_ln.length > 0;
+}
+/**
+* Check if payload represents a natural person
+*/
+function isNaturalPersonWRPRC(payload) {
+	return typeof payload.sub_gn === "string" && payload.sub_gn.length > 0 && typeof payload.sub_fn === "string" && payload.sub_fn.length > 0;
+}
+/**
+* Validate as legal person WRPRC
+*/
+function validateLegalPersonWRPRC(payload) {
+	const result = LegalPersonSubjectSchema.safeParse(payload);
+	const errors = [];
+	const warnings = [];
+	if (!result.success) for (const issue of result.error.issues) errors.push({
+		path: issue.path.map(String),
+		message: issue.message,
+		code: issue.code
+	});
+	if (result.success) {
+		const sub = result.data.sub;
+		if (!/^[A-Z]{3}[A-Z]{2}-.+$/.test(sub)) warnings.push({
+			path: ["sub"],
+			message: "Legal person identifier should follow format: PREFIX + COUNTRY + \"-\" + ID (e.g., \"LEIXG-529900T8BM49AURSDO55\")",
+			code: "identifier_format_warning"
+		});
+	}
+	return {
+		valid: errors.length === 0,
+		errors,
+		warnings
+	};
+}
+/**
+* Validate as natural person WRPRC
+*/
+function validateNaturalPersonWRPRC(payload) {
+	const result = NaturalPersonSubjectSchema.safeParse(payload);
+	const errors = [];
+	const warnings = [];
+	if (!result.success) for (const issue of result.error.issues) errors.push({
+		path: issue.path.map(String),
+		message: issue.message,
+		code: issue.code
+	});
+	if (result.success) {
+		const sub = result.data.sub;
+		if (!/^[A-Z]{3}[A-Z]{2}-.+$/.test(sub)) warnings.push({
+			path: ["sub"],
+			message: "Natural person identifier should follow format: PREFIX + COUNTRY + \"-\" + ID (e.g., \"TINIT-RSSMRA85T10A562S\")",
+			code: "identifier_format_warning"
+		});
+	}
+	return {
+		valid: errors.length === 0,
+		errors,
+		warnings
+	};
+}
+/**
+* Valid semantic identifier prefixes for legal persons (ETSI EN 319 412-1 clause 5.1.4)
+*/
+const LEGAL_PERSON_PREFIXES = [
+	"EOR",
+	"LEI",
+	"NTR",
+	"VAT",
+	"TIN",
+	"EXC"
+];
+/**
+* Valid semantic identifier prefixes for natural persons (ETSI EN 319 412-1 clause 5.1.3)
+*/
+const NATURAL_PERSON_PREFIXES = [
+	"TIN",
+	"PAS",
+	"IDC",
+	"PNO",
+	"TAX"
+];
+/**
+* Validate a semantic identifier format
+*/
+function validateSemanticIdentifier(identifier) {
+	const match = identifier.match(/^([A-Z]{3})([A-Z]{2})-(.+)$/);
+	if (!match) return {
+		valid: false,
+		message: "Semantic identifier must follow format: PREFIX (3 chars) + COUNTRY (2 chars) + \"-\" + ID"
+	};
+	const [, prefix, , id] = match;
+	if (![...LEGAL_PERSON_PREFIXES, ...NATURAL_PERSON_PREFIXES].includes(prefix)) {}
+	if (!id || id.length === 0) return {
+		valid: false,
+		message: "Semantic identifier must have a non-empty ID part after the hyphen"
+	};
+	return {
+		valid: true,
+		message: ""
+	};
+}
+/**
+* Assert that a WRPRC payload is valid, throws WRPRCException if not
+*/
+function assertValidWRPRCPayload(payload) {
+	const result = validateWRPRCPayload(payload);
+	if (!result.valid) throw new WRPRCException(`Invalid WRPRC payload:\n${result.errors.map((e) => `${e.path.join(".")}: ${e.message}`).join("\n")}`, result.errors);
+}
+/**
+* Assert that a WRPRC is valid (header + payload), throws WRPRCException if not
+*/
+function assertValidWRPRC(header, payload) {
+	const result = validateWRPRC(header, payload);
+	if (!result.valid) throw new WRPRCException(`Invalid WRPRC:\n${result.errors.map((e) => `${e.path.join(".")}: ${e.message}`).join("\n")}`, result.errors);
+}
+//#endregion
+//#region src/builders.ts
+/**
+* WRPRC Builders
+*
+* Fluent builders for creating ETSI TS 119 475 Wallet-Relying Party Registration Certificates.
+*
+* @see https://www.etsi.org/deliver/etsi_ts/119400_119499/119475/01.02.01_60/ts_119475v010201p.pdf
+*/
+/**
+* Builder for creating WRPRC payloads with a fluent API
+*/
+var WRPRCBuilder = class {
+	constructor() {
+		this.payload = {};
+	}
+	/**
+	* Set the trade name (display name) of the WRP
+	*/
+	name(value) {
+		this.payload.name = value;
+		return this;
+	}
+	/**
+	* Set the legal name for a legal person WRP
+	*/
+	legalName(value) {
+		this.payload.sub_ln = value;
+		return this;
+	}
+	/**
+	* Set the given name for a natural person WRP
+	*/
+	givenName(value) {
+		this.payload.sub_gn = value;
+		return this;
+	}
+	/**
+	* Set the family name for a natural person WRP
+	*/
+	familyName(value) {
+		this.payload.sub_fn = value;
+		return this;
+	}
+	/**
+	* Set the WRP identifier (semantic identifier)
+	*
+	* @param identifier - The semantic identifier following ETSI EN 319 412-1
+	*                     Format: PREFIX (3 chars) + COUNTRY (2 chars) + "-" + ID
+	*                     Examples: "LEIXG-529900T8BM49AURSDO55", "TINIT-RSSMRA85T10A562S"
+	*/
+	identifier(identifier) {
+		this.payload.sub = identifier;
+		return this;
+	}
+	/**
+	* Set the country code (ISO 3166-1 Alpha-2)
+	*/
+	country(code) {
+		this.payload.country = code;
+		return this;
+	}
+	/**
+	* Set the URL to the national registry API endpoint
+	*/
+	registryUri(uri) {
+		this.payload.registry_uri = uri;
+		return this;
+	}
+	/**
+	* Add a service description in a specific language
+	*/
+	serviceDescription(description, lang = "en") {
+		this.payload.srv_description = this.payload.srv_description ?? [];
+		const existing = this.payload.srv_description.find((group) => group.some((d) => d.lang === lang));
+		if (existing) existing.push({
+			lang,
+			value: description
+		});
+		else this.payload.srv_description.push([{
+			lang,
+			value: description
+		}]);
+		return this;
+	}
+	/**
+	* Add multiple service descriptions (one array per service, with multiple languages)
+	*/
+	addServiceDescriptions(descriptions) {
+		this.payload.srv_description = this.payload.srv_description ?? [];
+		this.payload.srv_description.push(descriptions);
+		return this;
+	}
+	/**
+	* Add an entitlement
+	*
+	* @param entitlement - The entitlement URI or key from WRP_ENTITLEMENTS
+	*/
+	addEntitlement(entitlement) {
+		this.payload.entitlements = this.payload.entitlements ?? [];
+		if (!this.payload.entitlements.includes(entitlement)) this.payload.entitlements.push(entitlement);
+		return this;
+	}
+	/**
+	* Set all entitlements (replaces existing)
+	*/
+	entitlements(entitlements) {
+		this.payload.entitlements = [...entitlements];
+		return this;
+	}
+	/**
+	* Set the privacy policy URL
+	*/
+	privacyPolicy(uri) {
+		this.payload.privacy_policy = uri;
+		return this;
+	}
+	/**
+	* Set the info URI (general-purpose web address)
+	*/
+	infoUri(uri) {
+		this.payload.info_uri = uri;
+		return this;
+	}
+	/**
+	* Set the support URI for data requests
+	*/
+	supportUri(uri) {
+		this.payload.support_uri = uri;
+		return this;
+	}
+	/**
+	* Set the supervisory authority (Data Protection Authority)
+	*/
+	supervisoryAuthority(authority) {
+		this.payload.supervisory_authority = authority;
+		return this;
+	}
+	/**
+	* Set the policy ID(s)
+	*/
+	policyId(ids) {
+		this.payload.policy_id = ids;
+		return this;
+	}
+	/**
+	* Set the certificate policy URL
+	*/
+	certificatePolicy(uri) {
+		this.payload.certificate_policy = uri;
+		return this;
+	}
+	/**
+	* Set the issued-at timestamp (Unix timestamp)
+	* If not set, will default to current time when building
+	*/
+	issuedAt(timestamp) {
+		this.payload.iat = typeof timestamp === "number" ? timestamp : Math.floor(timestamp.getTime() / 1e3);
+		return this;
+	}
+	/**
+	* Set the status reference for certificate validity
+	*/
+	status(status) {
+		this.payload.status = status;
+		return this;
+	}
+	/**
+	* Add a purpose description
+	*/
+	addPurpose(description, lang = "en") {
+		this.payload.purpose = this.payload.purpose ?? [];
+		this.payload.purpose.push({
+			lang,
+			value: description
+		});
+		return this;
+	}
+	/**
+	* Set all purposes (replaces existing)
+	*/
+	purposes(purposes) {
+		this.payload.purpose = purposes;
+		return this;
+	}
+	/**
+	* Add a credential that the WRP intends to request
+	*/
+	addCredential(credential) {
+		this.payload.credentials = this.payload.credentials ?? [];
+		this.payload.credentials.push(credential);
+		return this;
+	}
+	/**
+	* Add a credential the WRP provides (for attestation providers)
+	*/
+	addProvidedAttestation(credential) {
+		this.payload.provides_attestations = this.payload.provides_attestations ?? [];
+		this.payload.provides_attestations.push(credential);
+		return this;
+	}
+	/**
+	* Set intermediary information
+	*/
+	intermediary(intermediary) {
+		this.payload.intermediary = intermediary;
+		return this;
+	}
+	/**
+	* Build the WRPRC payload
+	*
+	* @throws WRPRCException if the payload is invalid
+	*/
+	build() {
+		if (!this.payload.iat) this.payload.iat = Math.floor(Date.now() / 1e3);
+		const result = WRPRCPayloadSchema.safeParse(this.payload);
+		if (!result.success) throw new WRPRCException(`Invalid WRPRC payload:\n${result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("\n")}`, result.error.issues);
+		return result.data;
+	}
+};
+/**
+* Builder for creating Credential objects
+*/
+var CredentialBuilder = class {
+	constructor() {
+		this.credential = {};
+	}
+	/**
+	* Set the credential format
+	*
+	* @param format - The format identifier (e.g., "dc+sd-jwt", "mso_mdoc")
+	*/
+	format(format) {
+		this.credential.format = format;
+		return this;
+	}
+	/**
+	* Set the credential metadata
+	*
+	* @param meta - Metadata object per credential format specification
+	*/
+	meta(meta) {
+		this.credential.meta = meta;
+		return this;
+	}
+	/**
+	* Set SD-JWT credential metadata (vct_values)
+	*/
+	sdJwtMeta(vctValues) {
+		this.credential.format = "dc+sd-jwt";
+		this.credential.meta = { vct_values: vctValues };
+		return this;
+	}
+	/**
+	* Set mDL/mDoc credential metadata (doctype_value)
+	*/
+	mdocMeta(doctypeValue) {
+		this.credential.format = "mso_mdoc";
+		this.credential.meta = { doctype_value: doctypeValue };
+		return this;
+	}
+	/**
+	* Add a claim to request
+	*/
+	addClaim(claim) {
+		this.credential.claim = this.credential.claim ?? [];
+		this.credential.claim.push(claim);
+		return this;
+	}
+	/**
+	* Add a simple path claim
+	*/
+	addPathClaim(...path) {
+		this.credential.claim = this.credential.claim ?? [];
+		this.credential.claim.push({ path });
+		return this;
+	}
+	/**
+	* Build the Credential object
+	*/
+	build() {
+		if (!this.credential.format) throw new WRPRCException("Credential format is required");
+		if (!this.credential.meta) throw new WRPRCException("Credential meta is required");
+		return this.credential;
+	}
+};
+/**
+* Create a new WRPRCBuilder
+*/
+function wrprc() {
+	return new WRPRCBuilder();
+}
+/**
+* Create a new CredentialBuilder
+*/
+function credential() {
+	return new CredentialBuilder();
+}
+/**
+* Create a WRPRC payload for a legal person
+*/
+function createLegalPersonWRPRC(input) {
+	return wrprc().name(input.name).legalName(input.legalName).identifier(input.identifier).country(input.country).registryUri(input.registryUri).entitlements(input.entitlements).build();
+}
+/**
+* Create a WRPRC payload for a natural person
+*/
+function createNaturalPersonWRPRC(input) {
+	return wrprc().name(input.name).givenName(input.givenName).familyName(input.familyName).identifier(input.identifier).country(input.country).registryUri(input.registryUri).entitlements(input.entitlements).build();
+}
+/**
+* Create a simple service provider WRPRC
+*/
+function createServiceProviderWRPRC(name, legalName, identifier, country, registryUri) {
+	return wrprc().name(name).legalName(legalName).identifier(identifier).country(country).registryUri(registryUri).addEntitlement(ENTITLEMENT_SERVICE_PROVIDER).build();
+}
+//#endregion
+//#region src/signer.ts
+/**
+* WRPRC Signer
+*
+* Functions for creating and signing ETSI TS 119 475 Wallet-Relying Party Registration Certificates.
+*
+* @see https://www.etsi.org/deliver/etsi_ts/119400_119499/119475/01.02.01_60/ts_119475v010201p.pdf
+*/
+/**
+* Sign a WRPRC payload to create a JWT
+*
+* @param options - Signing options including payload, algorithm, certificates, and signer
+* @returns Signed WRPRC with JWS string and decoded parts
+*/
+async function signWRPRC(options) {
+	const { payload, algorithm = "ES256", certificates, keyId, signer } = options;
+	assertValidWRPRCPayload(payload);
+	if (!certificates || certificates.length === 0) throw new WRPRCException("At least one certificate is required for x5c header");
+	const header = {
+		typ: "rc-wrp+jwt",
+		alg: algorithm,
+		x5c: certificates.map((cert) => {
+			const content = pemToDer(cert);
+			if (!content) throw new WRPRCException("Invalid PEM certificate format");
+			return content;
+		}),
+		...keyId && { kid: keyId }
+	};
+	const signingInput = `${base64urlEncode(JSON.stringify(header))}.${base64urlEncode(JSON.stringify(payload))}`;
+	return {
+		jws: `${signingInput}.${await signer(signingInput)}`,
+		header,
+		payload
+	};
+}
+/**
+* Decode a signed WRPRC JWT (without verification)
+*
+* @param jws - The compact JWS string
+* @returns Decoded WRPRC with header and payload
+*/
+function decodeWRPRC(jws) {
+	const decoded = decodeJwt(jws);
+	if (decoded.header.typ !== "rc-wrp+jwt") throw new WRPRCException(`Invalid WRPRC type: expected "rc-wrp+jwt", got "${decoded.header.typ}"`);
+	assertValidWRPRCPayload(decoded.payload);
+	return {
+		jws,
+		header: decoded.header,
+		payload: decoded.payload
+	};
+}
+/**
+* Parse a WRPRC JWT without validation (for inspection purposes)
+*
+* @param jws - The compact JWS string
+* @returns Decoded parts without validation
+*/
+function parseWRPRC(jws) {
+	const decoded = decodeJwt(jws);
+	const parts = jws.split(".");
+	return {
+		header: decoded.header,
+		payload: decoded.payload,
+		signature: parts[2]
+	};
+}
+/**
+* Create a WRPRC with automatic timestamp
+*
+* @param payload - Partial payload (iat will be set automatically if not provided)
+* @returns Complete payload with timestamp
+*/
+function createWRPRCPayload(payload) {
+	const completePayload = {
+		...payload,
+		iat: payload.iat ?? Math.floor(Date.now() / 1e3)
+	};
+	assertValidWRPRCPayload(completePayload);
+	return completePayload;
+}
+//#endregion
+export { ClaimSchema, CredentialBuilder, CredentialSchema, IDENTIFIER_TYPES, IntermediarySchema, LegalPersonSubjectSchema, MultiLangStringSchema, NaturalPersonSubjectSchema, PSP_SUB_ENTITLEMENTS, StatusSchema, SupervisoryAuthoritySchema, WRPRCBuilder, WRPRCCWTHeaderSchema, WRPRCException, WRPRCJWTHeaderSchema, WRPRCPayloadSchema, WRP_ENTITLEMENTS, assertValidWRPRC, assertValidWRPRCPayload, createLegalPersonWRPRC, createNaturalPersonWRPRC, createServiceProviderWRPRC, createWRPRCPayload, credential, decodeWRPRC, hasAttestationProviderEntitlement, isLegalPersonWRPRC, isNaturalPersonWRPRC, isPSPSubEntitlement, isValidEntitlement, parseWRPRC, signWRPRC, validateLegalPersonWRPRC, validateNaturalPersonWRPRC, validateWRPRC, validateWRPRCJWTHeader, validateWRPRCPayload, wrprc };
+
+//# sourceMappingURL=index.mjs.map