@pagopa/io-wallet-oid-federation 0.3.0 → 0.4.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/dist/index.d.mts +44306 -31511
  2. package/dist/index.d.ts +44306 -31511
  3. package/dist/index.js +149 -144
  4. package/dist/index.js.map +1 -1
  5. package/dist/index.mjs +151 -149
  6. package/dist/index.mjs.map +1 -1
  7. package/package.json +11 -8
package/dist/index.js CHANGED
@@ -1,3 +1,4 @@
1
+ "use strict";
1
2
  var __defProp = Object.defineProperty;
2
3
  var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
3
4
  var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -19,6 +20,8 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
19
20
  // src/index.ts
20
21
  var index_exports = {};
21
22
  __export(index_exports, {
23
+ JWK: () => JWK,
24
+ JWKS: () => JWKS,
22
25
  createItWalletEntityConfiguration: () => createItWalletEntityConfiguration,
23
26
  itWalletAuthorizationServerIdentifier: () => itWalletAuthorizationServerIdentifier,
24
27
  itWalletAuthorizationServerMetadata: () => itWalletAuthorizationServerMetadata,
@@ -36,6 +39,26 @@ __export(index_exports, {
36
39
  });
37
40
  module.exports = __toCommonJS(index_exports);
38
41
 
42
+ // src/entityConfiguration/createItWalletEntityConfiguration.ts
43
+ var import_core3 = require("@openid-federation/core");
44
+
45
+ // src/utils/validate.ts
46
+ var import_utils = require("@openid4vc/utils");
47
+ var parseWithErrorHandling = (schema, data, customErrorMessage) => {
48
+ try {
49
+ return schema.parse(data);
50
+ } catch (e) {
51
+ const error = e;
52
+ const errorMessage = customErrorMessage ?? `Error validating schema with data ${JSON.stringify(data)}`;
53
+ throw new import_utils.ValidationError(`${errorMessage}: ${formattedErrors(error)}`);
54
+ }
55
+ };
56
+ var formattedErrors = (error) => error.issues.map((issue) => {
57
+ const path = issue.path.join(".");
58
+ const message = issue.message;
59
+ return `${path}: ${message}`;
60
+ });
61
+
39
62
  // src/entityStatement/itWalletEntityStatementClaims.ts
40
63
  var import_core2 = require("@openid-federation/core");
41
64
  var import_zod8 = require("zod");
@@ -74,7 +97,6 @@ var JWK = import_zod.z.object({
74
97
  /** JWK "use" (Public Key Use) Parameter. */
75
98
  use: import_zod.z.string().optional(),
76
99
  x: import_zod.z.string().optional(),
77
- y: import_zod.z.string().optional(),
78
100
  /** JWK "x5c" (X.509 Certificate Chain) Parameter. */
79
101
  x5c: import_zod.z.array(import_zod.z.string()).optional(),
80
102
  /** JWK "x5t" (X.509 Certificate SHA-1 Thumbprint) Parameter. */
@@ -82,7 +104,8 @@ var JWK = import_zod.z.object({
82
104
  /** "x5t#S256" (X.509 Certificate SHA-256 Thumbprint) Parameter. */
83
105
  "x5t#S256": import_zod.z.string().optional(),
84
106
  /** JWK "x5u" (X.509 URL) Parameter. */
85
- x5u: import_zod.z.string().optional()
107
+ x5u: import_zod.z.string().optional(),
108
+ y: import_zod.z.string().optional()
86
109
  });
87
110
  var JWKS = import_zod.z.object({
88
111
  keys: import_zod.z.array(JWK)
@@ -90,172 +113,172 @@ var JWKS = import_zod.z.object({
90
113
 
91
114
  // src/metadata/entity/ItWalletProvider.ts
92
115
  var itWalletProviderEntityMetadata = import_zod2.z.object({
93
- // -- 5.2.1 Extensions for JWK Sets in Entity Metadata
94
- signed_jwks_uri: import_zod2.z.string().url().optional(),
116
+ jwks: JWKS.optional(),
95
117
  jwks_uri: import_zod2.z.string().url().optional(),
96
- jwks: JWKS.optional()
118
+ // -- 5.2.1 Extensions for JWK Sets in Entity Metadata
119
+ signed_jwks_uri: import_zod2.z.string().url().optional()
97
120
  }).passthrough();
98
121
  var itWalletProviderEntityIdentifier = "wallet_provider";
99
122
 
100
- // src/metadata/entity/itWalletCredentialIssuer.ts
123
+ // src/metadata/entity/itWalletAuthorizationServer.ts
101
124
  var import_zod3 = require("zod");
102
- var CredentialDisplayMetadata = import_zod3.z.object({
103
- name: import_zod3.z.string(),
104
- locale: import_zod3.z.string()
125
+ var itWalletAuthorizationServerMetadata = import_zod3.z.object({
126
+ acr_values_supported: import_zod3.z.array(
127
+ import_zod3.z.union([
128
+ import_zod3.z.literal("https://trust-registry.eid-wallet.example.it/loa/low"),
129
+ import_zod3.z.literal(
130
+ "https://trust-registry.eid-wallet.example.it/loa/substantial"
131
+ ),
132
+ import_zod3.z.literal("https://trust-registry.eid-wallet.example.it/loa/high")
133
+ ])
134
+ ),
135
+ authorization_endpoint: import_zod3.z.string().url(),
136
+ authorization_signing_alg_values_supported: import_zod3.z.array(import_zod3.z.string()),
137
+ client_registration_types_supported: import_zod3.z.array(
138
+ import_zod3.z.union([import_zod3.z.literal("automatic"), import_zod3.z.literal("explicit")])
139
+ ),
140
+ code_challenge_methods_supported: import_zod3.z.array(import_zod3.z.string()).refine((arr) => arr.includes("S256"), {
141
+ message: "The code_challenge_methods_supported array MUST include 'S256'."
142
+ }),
143
+ grant_types_supported: import_zod3.z.array(import_zod3.z.string()).refine((arr) => arr.includes("authorization_code"), {
144
+ message: "The grant_types_supported array MUST include 'authorization_code'."
145
+ }),
146
+ issuer: import_zod3.z.string().url(),
147
+ jwks: JWKS,
148
+ pushed_authorization_request_endpoint: import_zod3.z.string().url(),
149
+ request_object_signing_alg_values_supported: import_zod3.z.array(import_zod3.z.string()),
150
+ response_modes_supported: import_zod3.z.array(
151
+ import_zod3.z.union([import_zod3.z.literal("query"), import_zod3.z.literal("form_post.jwt")])
152
+ ),
153
+ response_types_supported: import_zod3.z.array(import_zod3.z.string()).refine((arr) => arr.includes("code"), {
154
+ message: "The response_types_supported array MUST include 'code'."
155
+ }),
156
+ scopes_supported: import_zod3.z.array(import_zod3.z.string()),
157
+ token_endpoint: import_zod3.z.string().url(),
158
+ token_endpoint_auth_methods_supported: import_zod3.z.array(import_zod3.z.string()).refine((arr) => arr.includes("attest_jwt_client_auth"), {
159
+ message: "The token_endpoint_auth_methods_supported array MUST include 'attest_jwt_client_auth'."
160
+ }),
161
+ token_endpoint_auth_signing_alg_values_supported: import_zod3.z.array(import_zod3.z.string())
162
+ }).passthrough();
163
+ var itWalletAuthorizationServerIdentifier = "oauth_authorization_server";
164
+
165
+ // src/metadata/entity/itWalletCredentialIssuer.ts
166
+ var import_zod4 = require("zod");
167
+ var CredentialDisplayMetadata = import_zod4.z.object({
168
+ locale: import_zod4.z.string(),
169
+ name: import_zod4.z.string()
105
170
  });
106
- var ClaimsMetadata = import_zod3.z.object({
107
- path: import_zod3.z.array(import_zod3.z.union([import_zod3.z.string(), import_zod3.z.number(), import_zod3.z.null()])),
108
- display: import_zod3.z.array(CredentialDisplayMetadata)
171
+ var ClaimsMetadata = import_zod4.z.object({
172
+ display: import_zod4.z.array(CredentialDisplayMetadata),
173
+ path: import_zod4.z.array(import_zod4.z.union([import_zod4.z.string(), import_zod4.z.number(), import_zod4.z.null()]))
109
174
  });
110
- var SupportedCredentialMetadata = import_zod3.z.intersection(
111
- import_zod3.z.discriminatedUnion("format", [
112
- import_zod3.z.object({ format: import_zod3.z.literal("dc+sd-jwt"), vct: import_zod3.z.string() }),
113
- import_zod3.z.object({ format: import_zod3.z.literal("mso_mdoc"), doctype: import_zod3.z.string() })
175
+ var SupportedCredentialMetadata = import_zod4.z.intersection(
176
+ import_zod4.z.discriminatedUnion("format", [
177
+ import_zod4.z.object({ format: import_zod4.z.literal("dc+sd-jwt"), vct: import_zod4.z.string() }),
178
+ import_zod4.z.object({ doctype: import_zod4.z.string(), format: import_zod4.z.literal("mso_mdoc") })
114
179
  ]),
115
- import_zod3.z.object({
116
- scope: import_zod3.z.string(),
117
- display: import_zod3.z.array(CredentialDisplayMetadata),
118
- claims: import_zod3.z.array(ClaimsMetadata),
119
- cryptographic_binding_methods_supported: import_zod3.z.array(import_zod3.z.string()),
120
- credential_signing_alg_values_supported: import_zod3.z.array(import_zod3.z.string()),
121
- proof_types_supported: import_zod3.z.object({
122
- jwt: import_zod3.z.object({
123
- proof_signing_alg_values_supported: import_zod3.z.array(import_zod3.z.string())
180
+ import_zod4.z.object({
181
+ claims: import_zod4.z.array(ClaimsMetadata),
182
+ credential_signing_alg_values_supported: import_zod4.z.array(import_zod4.z.string()),
183
+ cryptographic_binding_methods_supported: import_zod4.z.array(import_zod4.z.string()),
184
+ display: import_zod4.z.array(CredentialDisplayMetadata),
185
+ proof_types_supported: import_zod4.z.object({
186
+ jwt: import_zod4.z.object({
187
+ proof_signing_alg_values_supported: import_zod4.z.array(import_zod4.z.string())
124
188
  })
125
- })
189
+ }),
190
+ scope: import_zod4.z.string()
126
191
  })
127
192
  );
128
- var itWalletCredentialIssuerMetadata = import_zod3.z.object({
129
- credential_issuer: import_zod3.z.string().url(),
130
- credential_endpoint: import_zod3.z.string().url(),
131
- nonce_endpoint: import_zod3.z.string().url(),
132
- revocation_endpoint: import_zod3.z.string().url(),
133
- deferred_credential_endpoint: import_zod3.z.string().url(),
134
- status_assertion_endpoint: import_zod3.z.string().url(),
135
- status_attestation_endpoint: import_zod3.z.string().url(),
136
- notification_endpoint: import_zod3.z.string().url(),
137
- authorization_servers: import_zod3.z.array(import_zod3.z.string().url()).optional(),
138
- display: import_zod3.z.array(CredentialDisplayMetadata),
139
- credential_configurations_supported: import_zod3.z.record(SupportedCredentialMetadata),
140
- jwks: JWKS,
141
- trust_frameworks_supported: import_zod3.z.array(
142
- import_zod3.z.union([
143
- import_zod3.z.literal("it_cie"),
144
- import_zod3.z.literal("it_wallet"),
145
- import_zod3.z.literal("eudi_wallet")
146
- ])
147
- ),
148
- evidence_supported: import_zod3.z.array(import_zod3.z.string()).refine((arr) => arr.includes("vouch"), {
193
+ var itWalletCredentialIssuerMetadata = import_zod4.z.object({
194
+ authorization_servers: import_zod4.z.array(import_zod4.z.string().url()).optional(),
195
+ batch_credential_issuance: import_zod4.z.object({
196
+ batch_size: import_zod4.z.number().int()
197
+ }),
198
+ credential_configurations_supported: import_zod4.z.record(SupportedCredentialMetadata),
199
+ credential_endpoint: import_zod4.z.string().url(),
200
+ credential_hash_alg_supported: import_zod4.z.string(),
201
+ credential_issuer: import_zod4.z.string().url(),
202
+ deferred_credential_endpoint: import_zod4.z.string().url(),
203
+ display: import_zod4.z.array(CredentialDisplayMetadata),
204
+ evidence_supported: import_zod4.z.array(import_zod4.z.string()).refine((arr) => arr.includes("vouch"), {
149
205
  message: "The evidence_supported array MUST include 'vouch'."
150
206
  }),
151
- credential_hash_alg_supported: import_zod3.z.string(),
152
- batch_credential_issuance: import_zod3.z.object({
153
- batch_size: import_zod3.z.number().int()
154
- })
207
+ jwks: JWKS,
208
+ nonce_endpoint: import_zod4.z.string().url(),
209
+ notification_endpoint: import_zod4.z.string().url(),
210
+ revocation_endpoint: import_zod4.z.string().url(),
211
+ status_assertion_endpoint: import_zod4.z.string().url(),
212
+ status_attestation_endpoint: import_zod4.z.string().url(),
213
+ trust_frameworks_supported: import_zod4.z.array(
214
+ import_zod4.z.union([
215
+ import_zod4.z.literal("it_cie"),
216
+ import_zod4.z.literal("it_wallet"),
217
+ import_zod4.z.literal("eudi_wallet")
218
+ ])
219
+ )
155
220
  }).passthrough();
156
221
  var itWalletCredentialIssuerIdentifier = "openid_credential_issuer";
157
222
 
158
- // src/metadata/entity/itWalletFederationEntity.ts
159
- var import_core = require("@openid-federation/core");
160
- var import_zod4 = require("zod");
161
- var itWalletFederationEntityMetadata = import_core.federationEntityMetadata.schema.extend({
162
- tos_uri: import_zod4.z.string().url().optional()
163
- }).passthrough();
164
- var itWalletFederationEntityIdentifier = import_core.federationEntityMetadata.identifier;
165
-
166
223
  // src/metadata/entity/itWalletCredentialVerifier.ts
167
224
  var import_zod5 = require("zod");
168
225
  var itWalletCredentialVerifierMetadata = import_zod5.z.object({
169
- client_id: import_zod5.z.string().url(),
170
- client_name: import_zod5.z.string(),
171
226
  application_type: import_zod5.z.literal("web"),
172
- request_uris: import_zod5.z.array(import_zod5.z.string().url()),
173
- response_uris: import_zod5.z.array(import_zod5.z.string().url()),
227
+ authorization_encrypted_response_alg: import_zod5.z.string(),
228
+ authorization_encrypted_response_enc: import_zod5.z.string(),
174
229
  authorization_signed_response_alg: import_zod5.z.string().refine((v) => v !== "none", {
175
230
  message: "The authorization_signed_response_alg MUST not be 'none'."
176
231
  }),
177
- authorization_encrypted_response_alg: import_zod5.z.string(),
178
- authorization_encrypted_response_enc: import_zod5.z.string(),
232
+ client_id: import_zod5.z.string().url(),
233
+ client_name: import_zod5.z.string(),
234
+ erasure_endpoint: import_zod5.z.string().url().optional(),
235
+ jwks: JWKS,
236
+ request_uris: import_zod5.z.array(import_zod5.z.string().url()),
237
+ response_uris: import_zod5.z.array(import_zod5.z.string().url()),
179
238
  vp_formats: import_zod5.z.record(
180
239
  import_zod5.z.string(),
181
240
  import_zod5.z.object({
182
- "sd-jwt_alg_values": import_zod5.z.array(import_zod5.z.string()).optional(),
183
- alg: import_zod5.z.array(import_zod5.z.string()).optional()
241
+ alg: import_zod5.z.array(import_zod5.z.string()).optional(),
242
+ "sd-jwt_alg_values": import_zod5.z.array(import_zod5.z.string()).optional()
184
243
  })
185
- ),
186
- jwks: JWKS,
187
- erasure_endpoint: import_zod5.z.string().url().optional()
244
+ )
188
245
  }).passthrough();
189
246
  var itWalletCredentialVerifierIdentifier = "openid_credential_verifier";
190
247
 
191
- // src/metadata/entity/itWalletAuthorizationServer.ts
248
+ // src/metadata/entity/itWalletFederationEntity.ts
249
+ var import_core = require("@openid-federation/core");
192
250
  var import_zod6 = require("zod");
193
- var itWalletAuthorizationServerMetadata = import_zod6.z.object({
194
- issuer: import_zod6.z.string().url(),
195
- pushed_authorization_request_endpoint: import_zod6.z.string().url(),
196
- authorization_endpoint: import_zod6.z.string().url(),
197
- token_endpoint: import_zod6.z.string().url(),
198
- client_registration_types_supported: import_zod6.z.array(
199
- import_zod6.z.union([import_zod6.z.literal("automatic"), import_zod6.z.literal("explicit")])
200
- ),
201
- code_challenge_methods_supported: import_zod6.z.array(import_zod6.z.string()).refine((arr) => arr.includes("S256"), {
202
- message: "The code_challenge_methods_supported array MUST include 'S256'."
203
- }),
204
- acr_values_supported: import_zod6.z.array(
205
- import_zod6.z.union([
206
- import_zod6.z.literal("https://trust-registry.eid-wallet.example.it/loa/low"),
207
- import_zod6.z.literal(
208
- "https://trust-registry.eid-wallet.example.it/loa/substantial"
209
- ),
210
- import_zod6.z.literal("https://trust-registry.eid-wallet.example.it/loa/high")
211
- ])
212
- ),
213
- scopes_supported: import_zod6.z.array(import_zod6.z.string()),
214
- response_modes_supported: import_zod6.z.array(
215
- import_zod6.z.union([import_zod6.z.literal("query"), import_zod6.z.literal("form_post.jwt")])
216
- ),
217
- response_types_supported: import_zod6.z.array(import_zod6.z.string()).refine((arr) => arr.includes("code"), {
218
- message: "The response_types_supported array MUST include 'code'."
219
- }),
220
- authorization_signing_alg_values_supported: import_zod6.z.array(import_zod6.z.string()),
221
- grant_types_supported: import_zod6.z.array(import_zod6.z.string()).refine((arr) => arr.includes("authorization_code"), {
222
- message: "The grant_types_supported array MUST include 'authorization_code'."
223
- }),
224
- token_endpoint_auth_methods_supported: import_zod6.z.array(import_zod6.z.string()).refine((arr) => arr.includes("attest_jwt_client_auth"), {
225
- message: "The token_endpoint_auth_methods_supported array MUST include 'attest_jwt_client_auth'."
226
- }),
227
- token_endpoint_auth_signing_alg_values_supported: import_zod6.z.array(import_zod6.z.string()),
228
- request_object_signing_alg_values_supported: import_zod6.z.array(import_zod6.z.string()),
229
- jwks: JWKS
251
+ var itWalletFederationEntityMetadata = import_core.federationEntityMetadata.schema.extend({
252
+ tos_uri: import_zod6.z.string().url().optional()
230
253
  }).passthrough();
231
- var itWalletAuthorizationServerIdentifier = "oauth_authorization_server";
254
+ var itWalletFederationEntityIdentifier = import_core.federationEntityMetadata.identifier;
232
255
 
233
256
  // src/metadata/itWalletMetadata.ts
234
257
  var itWalletMetadataSchema = import_zod7.z.object({
235
- [itWalletFederationEntityIdentifier]: itWalletFederationEntityMetadata.optional(),
236
- [itWalletCredentialVerifierIdentifier]: itWalletCredentialVerifierMetadata.optional(),
258
+ [itWalletAuthorizationServerIdentifier]: itWalletAuthorizationServerMetadata.optional(),
237
259
  [itWalletCredentialIssuerIdentifier]: itWalletCredentialIssuerMetadata.optional(),
238
- [itWalletProviderEntityIdentifier]: itWalletProviderEntityMetadata.optional(),
239
- [itWalletAuthorizationServerIdentifier]: itWalletAuthorizationServerMetadata.optional()
260
+ [itWalletCredentialVerifierIdentifier]: itWalletCredentialVerifierMetadata.optional(),
261
+ [itWalletFederationEntityIdentifier]: itWalletFederationEntityMetadata.optional(),
262
+ [itWalletProviderEntityIdentifier]: itWalletProviderEntityMetadata.optional()
240
263
  });
241
264
 
242
265
  // src/entityStatement/itWalletEntityStatementClaims.ts
243
266
  var itWalletEntityStatementClaimsSchema = import_zod8.z.object({
244
- iss: import_zod8.z.string(),
245
- sub: import_zod8.z.string(),
246
- iat: import_core2.dateSchema,
267
+ authority_hints: import_zod8.z.array(import_zod8.z.string().url()).optional(),
268
+ constraints: import_core2.constraintSchema.optional(),
269
+ crit: import_zod8.z.array(import_zod8.z.string()).optional(),
247
270
  exp: import_core2.dateSchema,
271
+ iat: import_core2.dateSchema,
272
+ iss: import_zod8.z.string(),
248
273
  jwks: import_core2.jsonWebKeySetSchema,
249
- authority_hints: import_zod8.z.array(import_zod8.z.string().url()).optional(),
250
274
  metadata: itWalletMetadataSchema.optional(),
251
275
  metadata_policy: import_zod8.z.record(import_zod8.z.record(import_core2.metadataPolicySchema).optional()).optional(),
252
- constraints: import_core2.constraintSchema.optional(),
253
- crit: import_zod8.z.array(import_zod8.z.string()).optional(),
254
276
  metadata_policy_crit: import_zod8.z.array(import_zod8.z.string()).optional(),
255
- trust_marks: import_zod8.z.array(import_core2.trustMarkSchema).optional(),
277
+ source_endpoint: import_zod8.z.string().url().optional(),
278
+ sub: import_zod8.z.string(),
256
279
  trust_mark_issuers: import_core2.trustMarkIssuerSchema.optional(),
257
280
  trust_mark_owners: import_core2.trustMarkOwnerSchema.optional(),
258
- source_endpoint: import_zod8.z.string().url().optional()
281
+ trust_marks: import_zod8.z.array(import_core2.trustMarkSchema).optional()
259
282
  }).passthrough().refine(
260
283
  (data) => {
261
284
  const keyIds = data.jwks.keys.map((key) => key.kid);
@@ -274,31 +297,11 @@ var itWalletEntityConfigurationClaimsSchema = itWalletEntityStatementClaimsSchem
274
297
  path: ["iss", "sub"]
275
298
  });
276
299
 
277
- // src/entityConfiguration/createItWalletEntityConfiguration.ts
278
- var import_core3 = require("@openid-federation/core");
279
-
280
- // src/utils/validate.ts
281
- var import_utils = require("@openid4vc/utils");
282
- var parseWithErrorHandling = (schema, data, customErrorMessage) => {
283
- try {
284
- return schema.parse(data);
285
- } catch (e) {
286
- const error = e;
287
- const errorMessage = customErrorMessage ?? `Error validating schema with data ${JSON.stringify(data)}`;
288
- throw new import_utils.ValidationError(`${errorMessage}: ${formattedErrors(error)}`);
289
- }
290
- };
291
- var formattedErrors = (error) => error.issues.map((issue) => {
292
- const path = issue.path.join(".");
293
- const message = issue.message;
294
- return `${path}: ${message}`;
295
- });
296
-
297
300
  // src/entityConfiguration/createItWalletEntityConfiguration.ts
298
301
  var createItWalletEntityConfiguration = async ({
302
+ claims,
299
303
  header,
300
- signJwtCallback,
301
- claims
304
+ signJwtCallback
302
305
  }) => {
303
306
  const validatedHeader = parseWithErrorHandling(
304
307
  import_core3.entityConfigurationHeaderSchema,
@@ -312,11 +315,13 @@ var createItWalletEntityConfiguration = async ({
312
315
  );
313
316
  const toBeSigned = (0, import_core3.createJwtSignableInput)(header, claims);
314
317
  const jwk = (0, import_core3.getUsedJsonWebKey)(validatedHeader, validatedClaims);
315
- const signature = await signJwtCallback({ toBeSigned, jwk });
318
+ const signature = await signJwtCallback({ jwk, toBeSigned });
316
319
  return (0, import_core3.createJsonWebToken)(header, claims, signature);
317
320
  };
318
321
  // Annotate the CommonJS export names for ESM import in node:
319
322
  0 && (module.exports = {
323
+ JWK,
324
+ JWKS,
320
325
  createItWalletEntityConfiguration,
321
326
  itWalletAuthorizationServerIdentifier,
322
327
  itWalletAuthorizationServerMetadata,
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/index.ts","../src/entityStatement/itWalletEntityStatementClaims.ts","../src/metadata/itWalletMetadata.ts","../src/metadata/entity/ItWalletProvider.ts","../src/jwk/jwk.ts","../src/metadata/entity/itWalletCredentialIssuer.ts","../src/metadata/entity/itWalletFederationEntity.ts","../src/metadata/entity/itWalletCredentialVerifier.ts","../src/metadata/entity/itWalletAuthorizationServer.ts","../src/entityConfiguration/itWalletEntityConfigurationClaims.ts","../src/entityConfiguration/createItWalletEntityConfiguration.ts","../src/utils/validate.ts"],"sourcesContent":["export * from \"./entityConfiguration\";\nexport * from \"./entityStatement\";\nexport * from \"./metadata\";\nexport * from \"./utils\";\n","import {\n constraintSchema,\n dateSchema,\n jsonWebKeySetSchema,\n metadataPolicySchema,\n trustMarkIssuerSchema,\n trustMarkOwnerSchema,\n trustMarkSchema,\n} from \"@openid-federation/core\";\nimport { z } from \"zod\";\nimport { itWalletMetadataSchema } from \"../metadata/itWalletMetadata\";\n\nexport const itWalletEntityStatementClaimsSchema = z\n .object({\n iss: z.string(),\n sub: z.string(),\n iat: dateSchema,\n exp: dateSchema,\n jwks: jsonWebKeySetSchema,\n authority_hints: z.array(z.string().url()).optional(),\n metadata: itWalletMetadataSchema.optional(),\n metadata_policy: z\n .record(z.record(metadataPolicySchema).optional())\n .optional(),\n constraints: constraintSchema.optional(),\n crit: z.array(z.string()).optional(),\n metadata_policy_crit: z.array(z.string()).optional(),\n trust_marks: z.array(trustMarkSchema).optional(),\n trust_mark_issuers: trustMarkIssuerSchema.optional(),\n trust_mark_owners: trustMarkOwnerSchema.optional(),\n source_endpoint: z.string().url().optional(),\n })\n .passthrough()\n .refine(\n (data) => {\n const keyIds = data.jwks.keys.map((key) => key.kid);\n const uniqueKeyIds = new Set(keyIds);\n return uniqueKeyIds.size === keyIds.length;\n },\n {\n message: \"keys include duplicate key ids\",\n path: [\"jwks\", \"keys\"],\n },\n );\n\nexport type ItWalletEntityStatementClaimsOptions = z.input<\n typeof itWalletEntityStatementClaimsSchema\n>;\n\nexport type ItWalletEntityStatementClaims = z.output<\n typeof itWalletEntityStatementClaimsSchema\n>;\n","import { z } from \"zod\";\nimport {\n itWalletFederationEntityMetadata,\n itWalletFederationEntityIdentifier,\n itWalletProviderEntityMetadata,\n itWalletProviderEntityIdentifier,\n itWalletCredentialVerifierMetadata,\n itWalletCredentialVerifierIdentifier,\n itWalletAuthorizationServerIdentifier,\n itWalletAuthorizationServerMetadata,\n itWalletCredentialIssuerIdentifier,\n itWalletCredentialIssuerMetadata,\n} from \"./entity\";\n\nexport const itWalletMetadataSchema = z.object({\n [itWalletFederationEntityIdentifier]:\n itWalletFederationEntityMetadata.optional(),\n [itWalletCredentialVerifierIdentifier]:\n itWalletCredentialVerifierMetadata.optional(),\n [itWalletCredentialIssuerIdentifier]:\n itWalletCredentialIssuerMetadata.optional(),\n [itWalletProviderEntityIdentifier]: itWalletProviderEntityMetadata.optional(),\n [itWalletAuthorizationServerIdentifier]:\n itWalletAuthorizationServerMetadata.optional(),\n});\n\nexport type Metadata = z.input<typeof itWalletMetadataSchema>;\n","import { z } from \"zod\";\nimport { JWKS } from \"../../jwk\";\n\n/**\n *\n * {@link https://italia.github.io/eid-wallet-it-docs/releases/1.1.0/en/wallet-provider-metadata.html}\n *\n */\nexport const itWalletProviderEntityMetadata = z\n .object({\n // -- 5.2.1 Extensions for JWK Sets in Entity Metadata\n signed_jwks_uri: z.string().url().optional(),\n jwks_uri: z.string().url().optional(),\n jwks: JWKS.optional(),\n })\n .passthrough();\n\nexport type ItWalletProviderEntityMetadata = z.input<\n typeof itWalletProviderEntityMetadata\n>;\n\nexport const itWalletProviderEntityIdentifier = \"wallet_provider\";\n","import { z } from \"zod\";\n\nexport type JWK = z.infer<typeof JWK>;\nexport const JWK = z.object({\n /** JWK \"alg\" (Algorithm) Parameter. */\n alg: z.string().optional(),\n crv: z.string().optional(),\n d: z.string().optional(),\n dp: z.string().optional(),\n dq: z.string().optional(),\n e: z.string().optional(),\n /** JWK \"ext\" (Extractable) Parameter. */\n ext: z.boolean().optional(),\n k: z.string().optional(),\n /** JWK \"key_ops\" (Key Operations) Parameter. */\n key_ops: z.array(z.string()).optional(),\n /** JWK \"kid\" (Key ID) Parameter. */\n kid: z.string().optional(),\n /** JWK \"kty\" (Key Type) Parameter.\n * This attribute is required to discriminate the\n * type of EC/RSA algorithm */\n kty: z.union([z.literal(\"RSA\"), z.literal(\"EC\")]),\n n: z.string().optional(),\n p: z.string().optional(),\n q: z.string().optional(),\n qi: z.string().optional(),\n /** JWK \"use\" (Public Key Use) Parameter. */\n use: z.string().optional(),\n x: z.string().optional(),\n y: z.string().optional(),\n /** JWK \"x5c\" (X.509 Certificate Chain) Parameter. */\n x5c: z.array(z.string()).optional(),\n /** JWK \"x5t\" (X.509 Certificate SHA-1 Thumbprint) Parameter. */\n x5t: z.string().optional(),\n /** \"x5t#S256\" (X.509 Certificate SHA-256 Thumbprint) Parameter. */\n \"x5t#S256\": z.string().optional(),\n /** JWK \"x5u\" (X.509 URL) Parameter. */\n x5u: z.string().optional(),\n});\n\nexport type JWKS = z.infer<typeof JWKS>;\nexport const JWKS = z.object({\n keys: z.array(JWK),\n});\n","import { z } from \"zod\";\nimport { JWKS } from \"../../jwk\";\n\n/**\n *\n * {@link https://italia.github.io/eid-wallet-it-docs/releases/1.1.0/en/credential-issuer-solution.html#metadata-for-openid-credential-issuer}\n *\n */\ntype CredentialDisplayMetadata = z.infer<typeof CredentialDisplayMetadata>;\nconst CredentialDisplayMetadata = z.object({\n name: z.string(),\n locale: z.string(),\n});\n\ntype ClaimsMetadata = z.infer<typeof ClaimsMetadata>;\nconst ClaimsMetadata = z.object({\n path: z.array(z.union([z.string(), z.number(), z.null()])),\n display: z.array(CredentialDisplayMetadata),\n});\n\n// Metadata for a credential which is supported by an Issuer\ntype SupportedCredentialMetadata = z.infer<typeof SupportedCredentialMetadata>;\nconst SupportedCredentialMetadata = z.intersection(\n z.discriminatedUnion(\"format\", [\n z.object({ format: z.literal(\"dc+sd-jwt\"), vct: z.string() }),\n z.object({ format: z.literal(\"mso_mdoc\"), doctype: z.string() }),\n ]),\n z.object({\n scope: z.string(),\n display: z.array(CredentialDisplayMetadata),\n claims: z.array(ClaimsMetadata),\n cryptographic_binding_methods_supported: z.array(z.string()),\n credential_signing_alg_values_supported: z.array(z.string()),\n proof_types_supported: z.object({\n jwt: z.object({\n proof_signing_alg_values_supported: z.array(z.string()),\n }),\n }),\n }),\n);\n\nexport const itWalletCredentialIssuerMetadata = z\n .object({\n credential_issuer: z.string().url(),\n credential_endpoint: z.string().url(),\n nonce_endpoint: z.string().url(),\n revocation_endpoint: z.string().url(),\n deferred_credential_endpoint: z.string().url(),\n status_assertion_endpoint: z.string().url(),\n status_attestation_endpoint: z.string().url(),\n notification_endpoint: z.string().url(),\n authorization_servers: z.array(z.string().url()).optional(),\n display: z.array(CredentialDisplayMetadata),\n credential_configurations_supported: z.record(SupportedCredentialMetadata),\n jwks: JWKS,\n trust_frameworks_supported: z.array(\n z.union([\n z.literal(\"it_cie\"),\n z.literal(\"it_wallet\"),\n z.literal(\"eudi_wallet\"),\n ]),\n ),\n evidence_supported: z\n .array(z.string())\n .refine((arr) => arr.includes(\"vouch\"), {\n message: \"The evidence_supported array MUST include 'vouch'.\",\n }),\n credential_hash_alg_supported: z.string(),\n batch_credential_issuance: z.object({\n batch_size: z.number().int(),\n }),\n })\n .passthrough();\n\nexport type ItWalletCredentialIssuerMetadata = z.input<\n typeof itWalletCredentialIssuerMetadata\n>;\n\nexport const itWalletCredentialIssuerIdentifier = \"openid_credential_issuer\";\n","import { federationEntityMetadata } from \"@openid-federation/core\";\nimport { z } from \"zod\";\n/**\n *\n * {@link https://italia.github.io/eid-wallet-it-docs/releases/1.1.0/en/trust.html#metadata-of-federation-entity-leaves}\n *\n */\nexport const itWalletFederationEntityMetadata = federationEntityMetadata.schema\n .extend({\n tos_uri: z.string().url().optional(),\n })\n .passthrough();\n\nexport type ItWalletFederationEntityMetadata = z.input<\n typeof itWalletFederationEntityMetadata\n>;\n\nexport const itWalletFederationEntityIdentifier =\n federationEntityMetadata.identifier;\n","import { z } from \"zod\";\nimport { JWKS } from \"../../jwk\";\n\n/**\n *\n * {@link https://italia.github.io/eid-wallet-it-docs/releases/1.1.0/en/relying-party-metadata.html}\n *\n */\nexport const itWalletCredentialVerifierMetadata = z\n .object({\n client_id: z.string().url(),\n client_name: z.string(),\n application_type: z.literal(\"web\"),\n request_uris: z.array(z.string().url()),\n response_uris: z.array(z.string().url()),\n authorization_signed_response_alg: z.string().refine((v) => v !== \"none\", {\n message: \"The authorization_signed_response_alg MUST not be 'none'.\",\n }),\n authorization_encrypted_response_alg: z.string(),\n authorization_encrypted_response_enc: z.string(),\n vp_formats: z.record(\n z.string(),\n z.object({\n \"sd-jwt_alg_values\": z.array(z.string()).optional(),\n alg: z.array(z.string()).optional(),\n }),\n ),\n jwks: JWKS,\n erasure_endpoint: z.string().url().optional(),\n })\n .passthrough();\n\nexport type ItWalletCredentialVerifierMetadata = z.input<\n typeof itWalletCredentialVerifierMetadata\n>;\n\nexport const itWalletCredentialVerifierIdentifier =\n \"openid_credential_verifier\";\n","import { z } from \"zod\";\nimport { JWKS } from \"../../jwk\";\n\n/**\n *\n * {@link https://italia.github.io/eid-wallet-it-docs/releases/1.1.0/en/credential-issuer-solution.html#metadata-for-oauth-authorization-server}\n *\n */\nexport const itWalletAuthorizationServerMetadata = z\n .object({\n issuer: z.string().url(),\n pushed_authorization_request_endpoint: z.string().url(),\n authorization_endpoint: z.string().url(),\n token_endpoint: z.string().url(),\n client_registration_types_supported: z.array(\n z.union([z.literal(\"automatic\"), z.literal(\"explicit\")]),\n ),\n code_challenge_methods_supported: z\n .array(z.string())\n .refine((arr) => arr.includes(\"S256\"), {\n message:\n \"The code_challenge_methods_supported array MUST include 'S256'.\",\n }),\n acr_values_supported: z.array(\n z.union([\n z.literal(\"https://trust-registry.eid-wallet.example.it/loa/low\"),\n z.literal(\n \"https://trust-registry.eid-wallet.example.it/loa/substantial\",\n ),\n z.literal(\"https://trust-registry.eid-wallet.example.it/loa/high\"),\n ]),\n ),\n scopes_supported: z.array(z.string()),\n response_modes_supported: z.array(\n z.union([z.literal(\"query\"), z.literal(\"form_post.jwt\")]),\n ),\n response_types_supported: z\n .array(z.string())\n .refine((arr) => arr.includes(\"code\"), {\n message: \"The response_types_supported array MUST include 'code'.\",\n }),\n authorization_signing_alg_values_supported: z.array(z.string()),\n grant_types_supported: z\n .array(z.string())\n .refine((arr) => arr.includes(\"authorization_code\"), {\n message:\n \"The grant_types_supported array MUST include 'authorization_code'.\",\n }),\n token_endpoint_auth_methods_supported: z\n .array(z.string())\n .refine((arr) => arr.includes(\"attest_jwt_client_auth\"), {\n message:\n \"The token_endpoint_auth_methods_supported array MUST include 'attest_jwt_client_auth'.\",\n }),\n token_endpoint_auth_signing_alg_values_supported: z.array(z.string()),\n request_object_signing_alg_values_supported: z.array(z.string()),\n jwks: JWKS,\n })\n .passthrough();\n\nexport type ItWalletAuthorizationServerMetadata = z.input<\n typeof itWalletAuthorizationServerMetadata\n>;\n\nexport const itWalletAuthorizationServerIdentifier =\n \"oauth_authorization_server\";\n","import type { z } from \"zod\";\nimport { itWalletEntityStatementClaimsSchema } from \"../entityStatement/itWalletEntityStatementClaims\";\n\nexport const itWalletEntityConfigurationClaimsSchema =\n itWalletEntityStatementClaimsSchema.refine((data) => data.iss === data.sub, {\n message: \"iss and sub must be equal\",\n path: [\"iss\", \"sub\"],\n });\n\nexport type ItWalletEntityConfigurationClaimsOptions = z.input<\n typeof itWalletEntityConfigurationClaimsSchema\n>;\n\nexport type ItWalletEntityConfigurationClaims = z.output<\n typeof itWalletEntityConfigurationClaimsSchema\n>;\n","import {\n createJsonWebToken,\n createJwtSignableInput,\n EntityConfigurationHeaderOptions,\n entityConfigurationHeaderSchema,\n getUsedJsonWebKey,\n SignCallback,\n} from \"@openid-federation/core\";\nimport {\n ItWalletEntityConfigurationClaimsOptions,\n itWalletEntityConfigurationClaimsSchema,\n} from \"./itWalletEntityConfigurationClaims\";\nimport { parseWithErrorHandling } from \"../utils/validate\";\n\nexport type CreateEntityConfigurationOptions = {\n claims: ItWalletEntityConfigurationClaimsOptions;\n header: EntityConfigurationHeaderOptions;\n signJwtCallback: SignCallback;\n};\n\n/**\n *\n * Create an entity configuration\n *\n * The signing callback will be called with the `header.kid` value in the `claims.jwks.keys` and a signed JWT will be returned\n *\n */\nexport const createItWalletEntityConfiguration = async ({\n header,\n signJwtCallback,\n claims,\n}: CreateEntityConfigurationOptions) => {\n const validatedHeader = parseWithErrorHandling(\n entityConfigurationHeaderSchema,\n header,\n \"invalid header claims provided\",\n );\n const validatedClaims = parseWithErrorHandling(\n itWalletEntityConfigurationClaimsSchema,\n claims,\n \"invalid payload claims provided\",\n );\n\n const toBeSigned = createJwtSignableInput(header, claims);\n\n const jwk = getUsedJsonWebKey(validatedHeader, validatedClaims);\n\n const signature = await signJwtCallback({ toBeSigned, jwk });\n\n return createJsonWebToken(header, claims, signature);\n};\n","import { ValidationError } from \"@openid4vc/utils\";\nimport type { z } from \"zod\";\n\nexport const parseWithErrorHandling = <Schema extends z.ZodSchema>(\n schema: Schema,\n data: unknown,\n customErrorMessage?: string,\n): z.infer<Schema> => {\n try {\n return schema.parse(data);\n } catch (e) {\n const error = e as z.ZodError;\n const errorMessage =\n customErrorMessage ??\n `Error validating schema with data ${JSON.stringify(data)}`;\n\n throw new ValidationError(`${errorMessage}: ${formattedErrors(error)}`);\n }\n};\nconst formattedErrors = (error: z.ZodError) =>\n error.issues.map((issue) => {\n // Joins nested paths with a dot, e.g., ['user', 'name'] -> 'user.name'\n const path = issue.path.join(\".\");\n const message = issue.message;\n\n // Example output: \"kid: Required\"\n return `${path}: ${message}`;\n });\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAA,eAQO;AACP,IAAAC,cAAkB;;;ACTlB,IAAAC,cAAkB;;;ACAlB,IAAAC,cAAkB;;;ACAlB,iBAAkB;AAGX,IAAM,MAAM,aAAE,OAAO;AAAA;AAAA,EAE1B,KAAK,aAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAK,aAAE,OAAO,EAAE,SAAS;AAAA,EACzB,GAAG,aAAE,OAAO,EAAE,SAAS;AAAA,EACvB,IAAI,aAAE,OAAO,EAAE,SAAS;AAAA,EACxB,IAAI,aAAE,OAAO,EAAE,SAAS;AAAA,EACxB,GAAG,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,KAAK,aAAE,QAAQ,EAAE,SAAS;AAAA,EAC1B,GAAG,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,SAAS,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAEtC,KAAK,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIzB,KAAK,aAAE,MAAM,CAAC,aAAE,QAAQ,KAAK,GAAG,aAAE,QAAQ,IAAI,CAAC,CAAC;AAAA,EAChD,GAAG,aAAE,OAAO,EAAE,SAAS;AAAA,EACvB,GAAG,aAAE,OAAO,EAAE,SAAS;AAAA,EACvB,GAAG,aAAE,OAAO,EAAE,SAAS;AAAA,EACvB,IAAI,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAExB,KAAK,aAAE,OAAO,EAAE,SAAS;AAAA,EACzB,GAAG,aAAE,OAAO,EAAE,SAAS;AAAA,EACvB,GAAG,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,KAAK,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAElC,KAAK,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEzB,YAAY,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEhC,KAAK,aAAE,OAAO,EAAE,SAAS;AAC3B,CAAC;AAGM,IAAM,OAAO,aAAE,OAAO;AAAA,EAC3B,MAAM,aAAE,MAAM,GAAG;AACnB,CAAC;;;ADnCM,IAAM,iCAAiC,cAC3C,OAAO;AAAA;AAAA,EAEN,iBAAiB,cAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC3C,UAAU,cAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,MAAM,KAAK,SAAS;AACtB,CAAC,EACA,YAAY;AAMR,IAAM,mCAAmC;;;AErBhD,IAAAC,cAAkB;AASlB,IAAM,4BAA4B,cAAE,OAAO;AAAA,EACzC,MAAM,cAAE,OAAO;AAAA,EACf,QAAQ,cAAE,OAAO;AACnB,CAAC;AAGD,IAAM,iBAAiB,cAAE,OAAO;AAAA,EAC9B,MAAM,cAAE,MAAM,cAAE,MAAM,CAAC,cAAE,OAAO,GAAG,cAAE,OAAO,GAAG,cAAE,KAAK,CAAC,CAAC,CAAC;AAAA,EACzD,SAAS,cAAE,MAAM,yBAAyB;AAC5C,CAAC;AAID,IAAM,8BAA8B,cAAE;AAAA,EACpC,cAAE,mBAAmB,UAAU;AAAA,IAC7B,cAAE,OAAO,EAAE,QAAQ,cAAE,QAAQ,WAAW,GAAG,KAAK,cAAE,OAAO,EAAE,CAAC;AAAA,IAC5D,cAAE,OAAO,EAAE,QAAQ,cAAE,QAAQ,UAAU,GAAG,SAAS,cAAE,OAAO,EAAE,CAAC;AAAA,EACjE,CAAC;AAAA,EACD,cAAE,OAAO;AAAA,IACP,OAAO,cAAE,OAAO;AAAA,IAChB,SAAS,cAAE,MAAM,yBAAyB;AAAA,IAC1C,QAAQ,cAAE,MAAM,cAAc;AAAA,IAC9B,yCAAyC,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA,IAC3D,yCAAyC,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA,IAC3D,uBAAuB,cAAE,OAAO;AAAA,MAC9B,KAAK,cAAE,OAAO;AAAA,QACZ,oCAAoC,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA,MACxD,CAAC;AAAA,IACH,CAAC;AAAA,EACH,CAAC;AACH;AAEO,IAAM,mCAAmC,cAC7C,OAAO;AAAA,EACN,mBAAmB,cAAE,OAAO,EAAE,IAAI;AAAA,EAClC,qBAAqB,cAAE,OAAO,EAAE,IAAI;AAAA,EACpC,gBAAgB,cAAE,OAAO,EAAE,IAAI;AAAA,EAC/B,qBAAqB,cAAE,OAAO,EAAE,IAAI;AAAA,EACpC,8BAA8B,cAAE,OAAO,EAAE,IAAI;AAAA,EAC7C,2BAA2B,cAAE,OAAO,EAAE,IAAI;AAAA,EAC1C,6BAA6B,cAAE,OAAO,EAAE,IAAI;AAAA,EAC5C,uBAAuB,cAAE,OAAO,EAAE,IAAI;AAAA,EACtC,uBAAuB,cAAE,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC1D,SAAS,cAAE,MAAM,yBAAyB;AAAA,EAC1C,qCAAqC,cAAE,OAAO,2BAA2B;AAAA,EACzE,MAAM;AAAA,EACN,4BAA4B,cAAE;AAAA,IAC5B,cAAE,MAAM;AAAA,MACN,cAAE,QAAQ,QAAQ;AAAA,MAClB,cAAE,QAAQ,WAAW;AAAA,MACrB,cAAE,QAAQ,aAAa;AAAA,IACzB,CAAC;AAAA,EACH;AAAA,EACA,oBAAoB,cACjB,MAAM,cAAE,OAAO,CAAC,EAChB,OAAO,CAAC,QAAQ,IAAI,SAAS,OAAO,GAAG;AAAA,IACtC,SAAS;AAAA,EACX,CAAC;AAAA,EACH,+BAA+B,cAAE,OAAO;AAAA,EACxC,2BAA2B,cAAE,OAAO;AAAA,IAClC,YAAY,cAAE,OAAO,EAAE,IAAI;AAAA,EAC7B,CAAC;AACH,CAAC,EACA,YAAY;AAMR,IAAM,qCAAqC;;;AC9ElD,kBAAyC;AACzC,IAAAC,cAAkB;AAMX,IAAM,mCAAmC,qCAAyB,OACtE,OAAO;AAAA,EACN,SAAS,cAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACrC,CAAC,EACA,YAAY;AAMR,IAAM,qCACX,qCAAyB;;;AClB3B,IAAAC,cAAkB;AAQX,IAAM,qCAAqC,cAC/C,OAAO;AAAA,EACN,WAAW,cAAE,OAAO,EAAE,IAAI;AAAA,EAC1B,aAAa,cAAE,OAAO;AAAA,EACtB,kBAAkB,cAAE,QAAQ,KAAK;AAAA,EACjC,cAAc,cAAE,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtC,eAAe,cAAE,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvC,mCAAmC,cAAE,OAAO,EAAE,OAAO,CAAC,MAAM,MAAM,QAAQ;AAAA,IACxE,SAAS;AAAA,EACX,CAAC;AAAA,EACD,sCAAsC,cAAE,OAAO;AAAA,EAC/C,sCAAsC,cAAE,OAAO;AAAA,EAC/C,YAAY,cAAE;AAAA,IACZ,cAAE,OAAO;AAAA,IACT,cAAE,OAAO;AAAA,MACP,qBAAqB,cAAE,MAAM,cAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MAClD,KAAK,cAAE,MAAM,cAAE,OAAO,CAAC,EAAE,SAAS;AAAA,IACpC,CAAC;AAAA,EACH;AAAA,EACA,MAAM;AAAA,EACN,kBAAkB,cAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAC9C,CAAC,EACA,YAAY;AAMR,IAAM,uCACX;;;ACrCF,IAAAC,cAAkB;AAQX,IAAM,sCAAsC,cAChD,OAAO;AAAA,EACN,QAAQ,cAAE,OAAO,EAAE,IAAI;AAAA,EACvB,uCAAuC,cAAE,OAAO,EAAE,IAAI;AAAA,EACtD,wBAAwB,cAAE,OAAO,EAAE,IAAI;AAAA,EACvC,gBAAgB,cAAE,OAAO,EAAE,IAAI;AAAA,EAC/B,qCAAqC,cAAE;AAAA,IACrC,cAAE,MAAM,CAAC,cAAE,QAAQ,WAAW,GAAG,cAAE,QAAQ,UAAU,CAAC,CAAC;AAAA,EACzD;AAAA,EACA,kCAAkC,cAC/B,MAAM,cAAE,OAAO,CAAC,EAChB,OAAO,CAAC,QAAQ,IAAI,SAAS,MAAM,GAAG;AAAA,IACrC,SACE;AAAA,EACJ,CAAC;AAAA,EACH,sBAAsB,cAAE;AAAA,IACtB,cAAE,MAAM;AAAA,MACN,cAAE,QAAQ,sDAAsD;AAAA,MAChE,cAAE;AAAA,QACA;AAAA,MACF;AAAA,MACA,cAAE,QAAQ,uDAAuD;AAAA,IACnE,CAAC;AAAA,EACH;AAAA,EACA,kBAAkB,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA,EACpC,0BAA0B,cAAE;AAAA,IAC1B,cAAE,MAAM,CAAC,cAAE,QAAQ,OAAO,GAAG,cAAE,QAAQ,eAAe,CAAC,CAAC;AAAA,EAC1D;AAAA,EACA,0BAA0B,cACvB,MAAM,cAAE,OAAO,CAAC,EAChB,OAAO,CAAC,QAAQ,IAAI,SAAS,MAAM,GAAG;AAAA,IACrC,SAAS;AAAA,EACX,CAAC;AAAA,EACH,4CAA4C,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA,EAC9D,uBAAuB,cACpB,MAAM,cAAE,OAAO,CAAC,EAChB,OAAO,CAAC,QAAQ,IAAI,SAAS,oBAAoB,GAAG;AAAA,IACnD,SACE;AAAA,EACJ,CAAC;AAAA,EACH,uCAAuC,cACpC,MAAM,cAAE,OAAO,CAAC,EAChB,OAAO,CAAC,QAAQ,IAAI,SAAS,wBAAwB,GAAG;AAAA,IACvD,SACE;AAAA,EACJ,CAAC;AAAA,EACH,kDAAkD,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA,EACpE,6CAA6C,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA,EAC/D,MAAM;AACR,CAAC,EACA,YAAY;AAMR,IAAM,wCACX;;;ANnDK,IAAM,yBAAyB,cAAE,OAAO;AAAA,EAC7C,CAAC,kCAAkC,GACjC,iCAAiC,SAAS;AAAA,EAC5C,CAAC,oCAAoC,GACnC,mCAAmC,SAAS;AAAA,EAC9C,CAAC,kCAAkC,GACjC,iCAAiC,SAAS;AAAA,EAC5C,CAAC,gCAAgC,GAAG,+BAA+B,SAAS;AAAA,EAC5E,CAAC,qCAAqC,GACpC,oCAAoC,SAAS;AACjD,CAAC;;;ADZM,IAAM,sCAAsC,cAChD,OAAO;AAAA,EACN,KAAK,cAAE,OAAO;AAAA,EACd,KAAK,cAAE,OAAO;AAAA,EACd,KAAK;AAAA,EACL,KAAK;AAAA,EACL,MAAM;AAAA,EACN,iBAAiB,cAAE,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACpD,UAAU,uBAAuB,SAAS;AAAA,EAC1C,iBAAiB,cACd,OAAO,cAAE,OAAO,iCAAoB,EAAE,SAAS,CAAC,EAChD,SAAS;AAAA,EACZ,aAAa,8BAAiB,SAAS;AAAA,EACvC,MAAM,cAAE,MAAM,cAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACnC,sBAAsB,cAAE,MAAM,cAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACnD,aAAa,cAAE,MAAM,4BAAe,EAAE,SAAS;AAAA,EAC/C,oBAAoB,mCAAsB,SAAS;AAAA,EACnD,mBAAmB,kCAAqB,SAAS;AAAA,EACjD,iBAAiB,cAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAC7C,CAAC,EACA,YAAY,EACZ;AAAA,EACC,CAAC,SAAS;AACR,UAAM,SAAS,KAAK,KAAK,KAAK,IAAI,CAAC,QAAQ,IAAI,GAAG;AAClD,UAAM,eAAe,IAAI,IAAI,MAAM;AACnC,WAAO,aAAa,SAAS,OAAO;AAAA,EACtC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,MAAM,CAAC,QAAQ,MAAM;AAAA,EACvB;AACF;;;AQxCK,IAAM,0CACX,oCAAoC,OAAO,CAAC,SAAS,KAAK,QAAQ,KAAK,KAAK;AAAA,EAC1E,SAAS;AAAA,EACT,MAAM,CAAC,OAAO,KAAK;AACrB,CAAC;;;ACPH,IAAAC,eAOO;;;ACPP,mBAAgC;AAGzB,IAAM,yBAAyB,CACpC,QACA,MACA,uBACoB;AACpB,MAAI;AACF,WAAO,OAAO,MAAM,IAAI;AAAA,EAC1B,SAAS,GAAG;AACV,UAAM,QAAQ;AACd,UAAM,eACJ,sBACA,qCAAqC,KAAK,UAAU,IAAI,CAAC;AAE3D,UAAM,IAAI,6BAAgB,GAAG,YAAY,KAAK,gBAAgB,KAAK,CAAC,EAAE;AAAA,EACxE;AACF;AACA,IAAM,kBAAkB,CAAC,UACvB,MAAM,OAAO,IAAI,CAAC,UAAU;AAE1B,QAAM,OAAO,MAAM,KAAK,KAAK,GAAG;AAChC,QAAM,UAAU,MAAM;AAGtB,SAAO,GAAG,IAAI,KAAK,OAAO;AAC5B,CAAC;;;ADAI,IAAM,oCAAoC,OAAO;AAAA,EACtD;AAAA,EACA;AAAA,EACA;AACF,MAAwC;AACtC,QAAM,kBAAkB;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,kBAAkB;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,QAAM,iBAAa,qCAAuB,QAAQ,MAAM;AAExD,QAAM,UAAM,gCAAkB,iBAAiB,eAAe;AAE9D,QAAM,YAAY,MAAM,gBAAgB,EAAE,YAAY,IAAI,CAAC;AAE3D,aAAO,iCAAmB,QAAQ,QAAQ,SAAS;AACrD;","names":["import_core","import_zod","import_zod","import_zod","import_zod","import_zod","import_zod","import_zod","import_core"]}
1
+ {"version":3,"sources":["../src/index.ts","../src/entityConfiguration/createItWalletEntityConfiguration.ts","../src/utils/validate.ts","../src/entityStatement/itWalletEntityStatementClaims.ts","../src/metadata/itWalletMetadata.ts","../src/metadata/entity/ItWalletProvider.ts","../src/jwk/jwk.ts","../src/metadata/entity/itWalletAuthorizationServer.ts","../src/metadata/entity/itWalletCredentialIssuer.ts","../src/metadata/entity/itWalletCredentialVerifier.ts","../src/metadata/entity/itWalletFederationEntity.ts","../src/entityConfiguration/itWalletEntityConfigurationClaims.ts"],"sourcesContent":["export * from \"./entityConfiguration\";\nexport * from \"./entityStatement\";\nexport * from \"./jwk\";\nexport * from \"./metadata\";\nexport * from \"./utils\";\n","import {\n EntityConfigurationHeaderOptions,\n SignCallback,\n createJsonWebToken,\n createJwtSignableInput,\n entityConfigurationHeaderSchema,\n getUsedJsonWebKey,\n} from \"@openid-federation/core\";\n\nimport { parseWithErrorHandling } from \"../utils/validate\";\nimport {\n ItWalletEntityConfigurationClaimsOptions,\n itWalletEntityConfigurationClaimsSchema,\n} from \"./itWalletEntityConfigurationClaims\";\n\nexport interface CreateEntityConfigurationOptions {\n claims: ItWalletEntityConfigurationClaimsOptions;\n header: EntityConfigurationHeaderOptions;\n signJwtCallback: SignCallback;\n}\n\n/**\n *\n * Create an entity configuration\n *\n * The signing callback will be called with the `header.kid` value in the `claims.jwks.keys` and a signed JWT will be returned\n *\n */\nexport const createItWalletEntityConfiguration = async ({\n claims,\n header,\n signJwtCallback,\n}: CreateEntityConfigurationOptions) => {\n const validatedHeader = parseWithErrorHandling(\n entityConfigurationHeaderSchema,\n header,\n \"invalid header claims provided\",\n );\n const validatedClaims = parseWithErrorHandling(\n itWalletEntityConfigurationClaimsSchema,\n claims,\n \"invalid payload claims provided\",\n );\n\n const toBeSigned = createJwtSignableInput(header, claims);\n\n const jwk = getUsedJsonWebKey(validatedHeader, validatedClaims);\n\n const signature = await signJwtCallback({ jwk, toBeSigned });\n\n return createJsonWebToken(header, claims, signature);\n};\n","import type { z } from \"zod\";\n\nimport { ValidationError } from \"@openid4vc/utils\";\n\nexport const parseWithErrorHandling = <Schema extends z.ZodSchema>(\n schema: Schema,\n data: unknown,\n customErrorMessage?: string,\n): z.infer<Schema> => {\n try {\n return schema.parse(data);\n } catch (e) {\n const error = e as z.ZodError;\n const errorMessage =\n customErrorMessage ??\n `Error validating schema with data ${JSON.stringify(data)}`;\n\n throw new ValidationError(`${errorMessage}: ${formattedErrors(error)}`);\n }\n};\nconst formattedErrors = (error: z.ZodError) =>\n error.issues.map((issue) => {\n // Joins nested paths with a dot, e.g., ['user', 'name'] -> 'user.name'\n const path = issue.path.join(\".\");\n const message = issue.message;\n\n // Example output: \"kid: Required\"\n return `${path}: ${message}`;\n });\n","import {\n constraintSchema,\n dateSchema,\n jsonWebKeySetSchema,\n metadataPolicySchema,\n trustMarkIssuerSchema,\n trustMarkOwnerSchema,\n trustMarkSchema,\n} from \"@openid-federation/core\";\nimport { z } from \"zod\";\n\nimport { itWalletMetadataSchema } from \"../metadata/itWalletMetadata\";\n\nexport const itWalletEntityStatementClaimsSchema = z\n .object({\n authority_hints: z.array(z.string().url()).optional(),\n constraints: constraintSchema.optional(),\n crit: z.array(z.string()).optional(),\n exp: dateSchema,\n iat: dateSchema,\n iss: z.string(),\n jwks: jsonWebKeySetSchema,\n metadata: itWalletMetadataSchema.optional(),\n metadata_policy: z\n .record(z.record(metadataPolicySchema).optional())\n .optional(),\n metadata_policy_crit: z.array(z.string()).optional(),\n source_endpoint: z.string().url().optional(),\n sub: z.string(),\n trust_mark_issuers: trustMarkIssuerSchema.optional(),\n trust_mark_owners: trustMarkOwnerSchema.optional(),\n trust_marks: z.array(trustMarkSchema).optional(),\n })\n .passthrough()\n .refine(\n (data) => {\n const keyIds = data.jwks.keys.map((key) => key.kid);\n const uniqueKeyIds = new Set(keyIds);\n return uniqueKeyIds.size === keyIds.length;\n },\n {\n message: \"keys include duplicate key ids\",\n path: [\"jwks\", \"keys\"],\n },\n );\n\nexport type ItWalletEntityStatementClaimsOptions = z.input<\n typeof itWalletEntityStatementClaimsSchema\n>;\n\nexport type ItWalletEntityStatementClaims = z.output<\n typeof itWalletEntityStatementClaimsSchema\n>;\n","import { z } from \"zod\";\n\nimport {\n itWalletAuthorizationServerIdentifier,\n itWalletAuthorizationServerMetadata,\n itWalletCredentialIssuerIdentifier,\n itWalletCredentialIssuerMetadata,\n itWalletCredentialVerifierIdentifier,\n itWalletCredentialVerifierMetadata,\n itWalletFederationEntityIdentifier,\n itWalletFederationEntityMetadata,\n itWalletProviderEntityIdentifier,\n itWalletProviderEntityMetadata,\n} from \"./entity\";\n\nexport const itWalletMetadataSchema = z.object({\n [itWalletAuthorizationServerIdentifier]:\n itWalletAuthorizationServerMetadata.optional(),\n [itWalletCredentialIssuerIdentifier]:\n itWalletCredentialIssuerMetadata.optional(),\n [itWalletCredentialVerifierIdentifier]:\n itWalletCredentialVerifierMetadata.optional(),\n [itWalletFederationEntityIdentifier]:\n itWalletFederationEntityMetadata.optional(),\n [itWalletProviderEntityIdentifier]: itWalletProviderEntityMetadata.optional(),\n});\n\nexport type Metadata = z.input<typeof itWalletMetadataSchema>;\n","import { z } from \"zod\";\n\nimport { JWKS } from \"../../jwk\";\n\n/**\n *\n * {@link https://italia.github.io/eid-wallet-it-docs/releases/1.1.0/en/wallet-provider-metadata.html}\n *\n */\nexport const itWalletProviderEntityMetadata = z\n .object({\n jwks: JWKS.optional(),\n jwks_uri: z.string().url().optional(),\n // -- 5.2.1 Extensions for JWK Sets in Entity Metadata\n signed_jwks_uri: z.string().url().optional(),\n })\n .passthrough();\n\nexport type ItWalletProviderEntityMetadata = z.input<\n typeof itWalletProviderEntityMetadata\n>;\n\nexport const itWalletProviderEntityIdentifier = \"wallet_provider\";\n","import { z } from \"zod\";\n\nexport type JWK = z.infer<typeof JWK>;\nexport const JWK = z.object({\n /** JWK \"alg\" (Algorithm) Parameter. */\n alg: z.string().optional(),\n crv: z.string().optional(),\n d: z.string().optional(),\n dp: z.string().optional(),\n dq: z.string().optional(),\n e: z.string().optional(),\n /** JWK \"ext\" (Extractable) Parameter. */\n ext: z.boolean().optional(),\n k: z.string().optional(),\n /** JWK \"key_ops\" (Key Operations) Parameter. */\n key_ops: z.array(z.string()).optional(),\n /** JWK \"kid\" (Key ID) Parameter. */\n kid: z.string().optional(),\n /** JWK \"kty\" (Key Type) Parameter.\n * This attribute is required to discriminate the\n * type of EC/RSA algorithm */\n kty: z.union([z.literal(\"RSA\"), z.literal(\"EC\")]),\n n: z.string().optional(),\n p: z.string().optional(),\n q: z.string().optional(),\n qi: z.string().optional(),\n /** JWK \"use\" (Public Key Use) Parameter. */\n use: z.string().optional(),\n x: z.string().optional(),\n /** JWK \"x5c\" (X.509 Certificate Chain) Parameter. */\n x5c: z.array(z.string()).optional(),\n /** JWK \"x5t\" (X.509 Certificate SHA-1 Thumbprint) Parameter. */\n x5t: z.string().optional(),\n /** \"x5t#S256\" (X.509 Certificate SHA-256 Thumbprint) Parameter. */\n \"x5t#S256\": z.string().optional(),\n /** JWK \"x5u\" (X.509 URL) Parameter. */\n x5u: z.string().optional(),\n y: z.string().optional(),\n});\n\nexport type JWKS = z.infer<typeof JWKS>;\nexport const JWKS = z.object({\n keys: z.array(JWK),\n});\n","import { z } from \"zod\";\n\nimport { JWKS } from \"../../jwk\";\n\n/**\n *\n * {@link https://italia.github.io/eid-wallet-it-docs/releases/1.1.0/en/credential-issuer-solution.html#metadata-for-oauth-authorization-server}\n *\n */\nexport const itWalletAuthorizationServerMetadata = z\n .object({\n acr_values_supported: z.array(\n z.union([\n z.literal(\"https://trust-registry.eid-wallet.example.it/loa/low\"),\n z.literal(\n \"https://trust-registry.eid-wallet.example.it/loa/substantial\",\n ),\n z.literal(\"https://trust-registry.eid-wallet.example.it/loa/high\"),\n ]),\n ),\n authorization_endpoint: z.string().url(),\n authorization_signing_alg_values_supported: z.array(z.string()),\n client_registration_types_supported: z.array(\n z.union([z.literal(\"automatic\"), z.literal(\"explicit\")]),\n ),\n code_challenge_methods_supported: z\n .array(z.string())\n .refine((arr) => arr.includes(\"S256\"), {\n message:\n \"The code_challenge_methods_supported array MUST include 'S256'.\",\n }),\n grant_types_supported: z\n .array(z.string())\n .refine((arr) => arr.includes(\"authorization_code\"), {\n message:\n \"The grant_types_supported array MUST include 'authorization_code'.\",\n }),\n issuer: z.string().url(),\n jwks: JWKS,\n pushed_authorization_request_endpoint: z.string().url(),\n request_object_signing_alg_values_supported: z.array(z.string()),\n response_modes_supported: z.array(\n z.union([z.literal(\"query\"), z.literal(\"form_post.jwt\")]),\n ),\n response_types_supported: z\n .array(z.string())\n .refine((arr) => arr.includes(\"code\"), {\n message: \"The response_types_supported array MUST include 'code'.\",\n }),\n scopes_supported: z.array(z.string()),\n token_endpoint: z.string().url(),\n token_endpoint_auth_methods_supported: z\n .array(z.string())\n .refine((arr) => arr.includes(\"attest_jwt_client_auth\"), {\n message:\n \"The token_endpoint_auth_methods_supported array MUST include 'attest_jwt_client_auth'.\",\n }),\n token_endpoint_auth_signing_alg_values_supported: z.array(z.string()),\n })\n .passthrough();\n\nexport type ItWalletAuthorizationServerMetadata = z.input<\n typeof itWalletAuthorizationServerMetadata\n>;\n\nexport const itWalletAuthorizationServerIdentifier =\n \"oauth_authorization_server\";\n","import { z } from \"zod\";\n\nimport { JWKS } from \"../../jwk\";\n\n/**\n *\n * {@link https://italia.github.io/eid-wallet-it-docs/releases/1.1.0/en/credential-issuer-solution.html#metadata-for-openid-credential-issuer}\n *\n */\ntype CredentialDisplayMetadata = z.infer<typeof CredentialDisplayMetadata>;\nconst CredentialDisplayMetadata = z.object({\n locale: z.string(),\n name: z.string(),\n});\n\ntype ClaimsMetadata = z.infer<typeof ClaimsMetadata>;\nconst ClaimsMetadata = z.object({\n display: z.array(CredentialDisplayMetadata),\n path: z.array(z.union([z.string(), z.number(), z.null()])),\n});\n\n// Metadata for a credential which is supported by an Issuer\ntype SupportedCredentialMetadata = z.infer<typeof SupportedCredentialMetadata>;\nconst SupportedCredentialMetadata = z.intersection(\n z.discriminatedUnion(\"format\", [\n z.object({ format: z.literal(\"dc+sd-jwt\"), vct: z.string() }),\n z.object({ doctype: z.string(), format: z.literal(\"mso_mdoc\") }),\n ]),\n z.object({\n claims: z.array(ClaimsMetadata),\n credential_signing_alg_values_supported: z.array(z.string()),\n cryptographic_binding_methods_supported: z.array(z.string()),\n display: z.array(CredentialDisplayMetadata),\n proof_types_supported: z.object({\n jwt: z.object({\n proof_signing_alg_values_supported: z.array(z.string()),\n }),\n }),\n scope: z.string(),\n }),\n);\n\nexport const itWalletCredentialIssuerMetadata = z\n .object({\n authorization_servers: z.array(z.string().url()).optional(),\n batch_credential_issuance: z.object({\n batch_size: z.number().int(),\n }),\n credential_configurations_supported: z.record(SupportedCredentialMetadata),\n credential_endpoint: z.string().url(),\n credential_hash_alg_supported: z.string(),\n credential_issuer: z.string().url(),\n deferred_credential_endpoint: z.string().url(),\n display: z.array(CredentialDisplayMetadata),\n evidence_supported: z\n .array(z.string())\n .refine((arr) => arr.includes(\"vouch\"), {\n message: \"The evidence_supported array MUST include 'vouch'.\",\n }),\n jwks: JWKS,\n nonce_endpoint: z.string().url(),\n notification_endpoint: z.string().url(),\n revocation_endpoint: z.string().url(),\n status_assertion_endpoint: z.string().url(),\n status_attestation_endpoint: z.string().url(),\n trust_frameworks_supported: z.array(\n z.union([\n z.literal(\"it_cie\"),\n z.literal(\"it_wallet\"),\n z.literal(\"eudi_wallet\"),\n ]),\n ),\n })\n .passthrough();\n\nexport type ItWalletCredentialIssuerMetadata = z.input<\n typeof itWalletCredentialIssuerMetadata\n>;\n\nexport const itWalletCredentialIssuerIdentifier = \"openid_credential_issuer\";\n","import { z } from \"zod\";\n\nimport { JWKS } from \"../../jwk\";\n\n/**\n *\n * {@link https://italia.github.io/eid-wallet-it-docs/releases/1.1.0/en/relying-party-metadata.html}\n *\n */\nexport const itWalletCredentialVerifierMetadata = z\n .object({\n application_type: z.literal(\"web\"),\n authorization_encrypted_response_alg: z.string(),\n authorization_encrypted_response_enc: z.string(),\n authorization_signed_response_alg: z.string().refine((v) => v !== \"none\", {\n message: \"The authorization_signed_response_alg MUST not be 'none'.\",\n }),\n client_id: z.string().url(),\n client_name: z.string(),\n erasure_endpoint: z.string().url().optional(),\n jwks: JWKS,\n request_uris: z.array(z.string().url()),\n response_uris: z.array(z.string().url()),\n vp_formats: z.record(\n z.string(),\n z.object({\n alg: z.array(z.string()).optional(),\n \"sd-jwt_alg_values\": z.array(z.string()).optional(),\n }),\n ),\n })\n .passthrough();\n\nexport type ItWalletCredentialVerifierMetadata = z.input<\n typeof itWalletCredentialVerifierMetadata\n>;\n\nexport const itWalletCredentialVerifierIdentifier =\n \"openid_credential_verifier\";\n","import { federationEntityMetadata } from \"@openid-federation/core\";\nimport { z } from \"zod\";\n/**\n *\n * {@link https://italia.github.io/eid-wallet-it-docs/releases/1.1.0/en/trust.html#metadata-of-federation-entity-leaves}\n *\n */\nexport const itWalletFederationEntityMetadata = federationEntityMetadata.schema\n .extend({\n tos_uri: z.string().url().optional(),\n })\n .passthrough();\n\nexport type ItWalletFederationEntityMetadata = z.input<\n typeof itWalletFederationEntityMetadata\n>;\n\nexport const itWalletFederationEntityIdentifier =\n federationEntityMetadata.identifier;\n","import type { z } from \"zod\";\n\nimport { itWalletEntityStatementClaimsSchema } from \"../entityStatement/itWalletEntityStatementClaims\";\n\nexport const itWalletEntityConfigurationClaimsSchema =\n itWalletEntityStatementClaimsSchema.refine((data) => data.iss === data.sub, {\n message: \"iss and sub must be equal\",\n path: [\"iss\", \"sub\"],\n });\n\nexport type ItWalletEntityConfigurationClaimsOptions = z.input<\n typeof itWalletEntityConfigurationClaimsSchema\n>;\n\nexport type ItWalletEntityConfigurationClaims = z.output<\n typeof itWalletEntityConfigurationClaimsSchema\n>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAA,eAOO;;;ACLP,mBAAgC;AAEzB,IAAM,yBAAyB,CACpC,QACA,MACA,uBACoB;AACpB,MAAI;AACF,WAAO,OAAO,MAAM,IAAI;AAAA,EAC1B,SAAS,GAAG;AACV,UAAM,QAAQ;AACd,UAAM,eACJ,sBACA,qCAAqC,KAAK,UAAU,IAAI,CAAC;AAE3D,UAAM,IAAI,6BAAgB,GAAG,YAAY,KAAK,gBAAgB,KAAK,CAAC,EAAE;AAAA,EACxE;AACF;AACA,IAAM,kBAAkB,CAAC,UACvB,MAAM,OAAO,IAAI,CAAC,UAAU;AAE1B,QAAM,OAAO,MAAM,KAAK,KAAK,GAAG;AAChC,QAAM,UAAU,MAAM;AAGtB,SAAO,GAAG,IAAI,KAAK,OAAO;AAC5B,CAAC;;;AC5BH,IAAAC,eAQO;AACP,IAAAC,cAAkB;;;ACTlB,IAAAC,cAAkB;;;ACAlB,IAAAC,cAAkB;;;ACAlB,iBAAkB;AAGX,IAAM,MAAM,aAAE,OAAO;AAAA;AAAA,EAE1B,KAAK,aAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAK,aAAE,OAAO,EAAE,SAAS;AAAA,EACzB,GAAG,aAAE,OAAO,EAAE,SAAS;AAAA,EACvB,IAAI,aAAE,OAAO,EAAE,SAAS;AAAA,EACxB,IAAI,aAAE,OAAO,EAAE,SAAS;AAAA,EACxB,GAAG,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,KAAK,aAAE,QAAQ,EAAE,SAAS;AAAA,EAC1B,GAAG,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,SAAS,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAEtC,KAAK,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIzB,KAAK,aAAE,MAAM,CAAC,aAAE,QAAQ,KAAK,GAAG,aAAE,QAAQ,IAAI,CAAC,CAAC;AAAA,EAChD,GAAG,aAAE,OAAO,EAAE,SAAS;AAAA,EACvB,GAAG,aAAE,OAAO,EAAE,SAAS;AAAA,EACvB,GAAG,aAAE,OAAO,EAAE,SAAS;AAAA,EACvB,IAAI,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAExB,KAAK,aAAE,OAAO,EAAE,SAAS;AAAA,EACzB,GAAG,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,KAAK,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAElC,KAAK,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEzB,YAAY,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEhC,KAAK,aAAE,OAAO,EAAE,SAAS;AAAA,EACzB,GAAG,aAAE,OAAO,EAAE,SAAS;AACzB,CAAC;AAGM,IAAM,OAAO,aAAE,OAAO;AAAA,EAC3B,MAAM,aAAE,MAAM,GAAG;AACnB,CAAC;;;ADlCM,IAAM,iCAAiC,cAC3C,OAAO;AAAA,EACN,MAAM,KAAK,SAAS;AAAA,EACpB,UAAU,cAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA,EAEpC,iBAAiB,cAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAC7C,CAAC,EACA,YAAY;AAMR,IAAM,mCAAmC;;;AEtBhD,IAAAC,cAAkB;AASX,IAAM,sCAAsC,cAChD,OAAO;AAAA,EACN,sBAAsB,cAAE;AAAA,IACtB,cAAE,MAAM;AAAA,MACN,cAAE,QAAQ,sDAAsD;AAAA,MAChE,cAAE;AAAA,QACA;AAAA,MACF;AAAA,MACA,cAAE,QAAQ,uDAAuD;AAAA,IACnE,CAAC;AAAA,EACH;AAAA,EACA,wBAAwB,cAAE,OAAO,EAAE,IAAI;AAAA,EACvC,4CAA4C,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA,EAC9D,qCAAqC,cAAE;AAAA,IACrC,cAAE,MAAM,CAAC,cAAE,QAAQ,WAAW,GAAG,cAAE,QAAQ,UAAU,CAAC,CAAC;AAAA,EACzD;AAAA,EACA,kCAAkC,cAC/B,MAAM,cAAE,OAAO,CAAC,EAChB,OAAO,CAAC,QAAQ,IAAI,SAAS,MAAM,GAAG;AAAA,IACrC,SACE;AAAA,EACJ,CAAC;AAAA,EACH,uBAAuB,cACpB,MAAM,cAAE,OAAO,CAAC,EAChB,OAAO,CAAC,QAAQ,IAAI,SAAS,oBAAoB,GAAG;AAAA,IACnD,SACE;AAAA,EACJ,CAAC;AAAA,EACH,QAAQ,cAAE,OAAO,EAAE,IAAI;AAAA,EACvB,MAAM;AAAA,EACN,uCAAuC,cAAE,OAAO,EAAE,IAAI;AAAA,EACtD,6CAA6C,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA,EAC/D,0BAA0B,cAAE;AAAA,IAC1B,cAAE,MAAM,CAAC,cAAE,QAAQ,OAAO,GAAG,cAAE,QAAQ,eAAe,CAAC,CAAC;AAAA,EAC1D;AAAA,EACA,0BAA0B,cACvB,MAAM,cAAE,OAAO,CAAC,EAChB,OAAO,CAAC,QAAQ,IAAI,SAAS,MAAM,GAAG;AAAA,IACrC,SAAS;AAAA,EACX,CAAC;AAAA,EACH,kBAAkB,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA,EACpC,gBAAgB,cAAE,OAAO,EAAE,IAAI;AAAA,EAC/B,uCAAuC,cACpC,MAAM,cAAE,OAAO,CAAC,EAChB,OAAO,CAAC,QAAQ,IAAI,SAAS,wBAAwB,GAAG;AAAA,IACvD,SACE;AAAA,EACJ,CAAC;AAAA,EACH,kDAAkD,cAAE,MAAM,cAAE,OAAO,CAAC;AACtE,CAAC,EACA,YAAY;AAMR,IAAM,wCACX;;;AClEF,IAAAC,cAAkB;AAUlB,IAAM,4BAA4B,cAAE,OAAO;AAAA,EACzC,QAAQ,cAAE,OAAO;AAAA,EACjB,MAAM,cAAE,OAAO;AACjB,CAAC;AAGD,IAAM,iBAAiB,cAAE,OAAO;AAAA,EAC9B,SAAS,cAAE,MAAM,yBAAyB;AAAA,EAC1C,MAAM,cAAE,MAAM,cAAE,MAAM,CAAC,cAAE,OAAO,GAAG,cAAE,OAAO,GAAG,cAAE,KAAK,CAAC,CAAC,CAAC;AAC3D,CAAC;AAID,IAAM,8BAA8B,cAAE;AAAA,EACpC,cAAE,mBAAmB,UAAU;AAAA,IAC7B,cAAE,OAAO,EAAE,QAAQ,cAAE,QAAQ,WAAW,GAAG,KAAK,cAAE,OAAO,EAAE,CAAC;AAAA,IAC5D,cAAE,OAAO,EAAE,SAAS,cAAE,OAAO,GAAG,QAAQ,cAAE,QAAQ,UAAU,EAAE,CAAC;AAAA,EACjE,CAAC;AAAA,EACD,cAAE,OAAO;AAAA,IACP,QAAQ,cAAE,MAAM,cAAc;AAAA,IAC9B,yCAAyC,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA,IAC3D,yCAAyC,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA,IAC3D,SAAS,cAAE,MAAM,yBAAyB;AAAA,IAC1C,uBAAuB,cAAE,OAAO;AAAA,MAC9B,KAAK,cAAE,OAAO;AAAA,QACZ,oCAAoC,cAAE,MAAM,cAAE,OAAO,CAAC;AAAA,MACxD,CAAC;AAAA,IACH,CAAC;AAAA,IACD,OAAO,cAAE,OAAO;AAAA,EAClB,CAAC;AACH;AAEO,IAAM,mCAAmC,cAC7C,OAAO;AAAA,EACN,uBAAuB,cAAE,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC1D,2BAA2B,cAAE,OAAO;AAAA,IAClC,YAAY,cAAE,OAAO,EAAE,IAAI;AAAA,EAC7B,CAAC;AAAA,EACD,qCAAqC,cAAE,OAAO,2BAA2B;AAAA,EACzE,qBAAqB,cAAE,OAAO,EAAE,IAAI;AAAA,EACpC,+BAA+B,cAAE,OAAO;AAAA,EACxC,mBAAmB,cAAE,OAAO,EAAE,IAAI;AAAA,EAClC,8BAA8B,cAAE,OAAO,EAAE,IAAI;AAAA,EAC7C,SAAS,cAAE,MAAM,yBAAyB;AAAA,EAC1C,oBAAoB,cACjB,MAAM,cAAE,OAAO,CAAC,EAChB,OAAO,CAAC,QAAQ,IAAI,SAAS,OAAO,GAAG;AAAA,IACtC,SAAS;AAAA,EACX,CAAC;AAAA,EACH,MAAM;AAAA,EACN,gBAAgB,cAAE,OAAO,EAAE,IAAI;AAAA,EAC/B,uBAAuB,cAAE,OAAO,EAAE,IAAI;AAAA,EACtC,qBAAqB,cAAE,OAAO,EAAE,IAAI;AAAA,EACpC,2BAA2B,cAAE,OAAO,EAAE,IAAI;AAAA,EAC1C,6BAA6B,cAAE,OAAO,EAAE,IAAI;AAAA,EAC5C,4BAA4B,cAAE;AAAA,IAC5B,cAAE,MAAM;AAAA,MACN,cAAE,QAAQ,QAAQ;AAAA,MAClB,cAAE,QAAQ,WAAW;AAAA,MACrB,cAAE,QAAQ,aAAa;AAAA,IACzB,CAAC;AAAA,EACH;AACF,CAAC,EACA,YAAY;AAMR,IAAM,qCAAqC;;;AC/ElD,IAAAC,cAAkB;AASX,IAAM,qCAAqC,cAC/C,OAAO;AAAA,EACN,kBAAkB,cAAE,QAAQ,KAAK;AAAA,EACjC,sCAAsC,cAAE,OAAO;AAAA,EAC/C,sCAAsC,cAAE,OAAO;AAAA,EAC/C,mCAAmC,cAAE,OAAO,EAAE,OAAO,CAAC,MAAM,MAAM,QAAQ;AAAA,IACxE,SAAS;AAAA,EACX,CAAC;AAAA,EACD,WAAW,cAAE,OAAO,EAAE,IAAI;AAAA,EAC1B,aAAa,cAAE,OAAO;AAAA,EACtB,kBAAkB,cAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC5C,MAAM;AAAA,EACN,cAAc,cAAE,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtC,eAAe,cAAE,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvC,YAAY,cAAE;AAAA,IACZ,cAAE,OAAO;AAAA,IACT,cAAE,OAAO;AAAA,MACP,KAAK,cAAE,MAAM,cAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MAClC,qBAAqB,cAAE,MAAM,cAAE,OAAO,CAAC,EAAE,SAAS;AAAA,IACpD,CAAC;AAAA,EACH;AACF,CAAC,EACA,YAAY;AAMR,IAAM,uCACX;;;ACtCF,kBAAyC;AACzC,IAAAC,cAAkB;AAMX,IAAM,mCAAmC,qCAAyB,OACtE,OAAO;AAAA,EACN,SAAS,cAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACrC,CAAC,EACA,YAAY;AAMR,IAAM,qCACX,qCAAyB;;;ANHpB,IAAM,yBAAyB,cAAE,OAAO;AAAA,EAC7C,CAAC,qCAAqC,GACpC,oCAAoC,SAAS;AAAA,EAC/C,CAAC,kCAAkC,GACjC,iCAAiC,SAAS;AAAA,EAC5C,CAAC,oCAAoC,GACnC,mCAAmC,SAAS;AAAA,EAC9C,CAAC,kCAAkC,GACjC,iCAAiC,SAAS;AAAA,EAC5C,CAAC,gCAAgC,GAAG,+BAA+B,SAAS;AAC9E,CAAC;;;ADZM,IAAM,sCAAsC,cAChD,OAAO;AAAA,EACN,iBAAiB,cAAE,MAAM,cAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACpD,aAAa,8BAAiB,SAAS;AAAA,EACvC,MAAM,cAAE,MAAM,cAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACnC,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK,cAAE,OAAO;AAAA,EACd,MAAM;AAAA,EACN,UAAU,uBAAuB,SAAS;AAAA,EAC1C,iBAAiB,cACd,OAAO,cAAE,OAAO,iCAAoB,EAAE,SAAS,CAAC,EAChD,SAAS;AAAA,EACZ,sBAAsB,cAAE,MAAM,cAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACnD,iBAAiB,cAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC3C,KAAK,cAAE,OAAO;AAAA,EACd,oBAAoB,mCAAsB,SAAS;AAAA,EACnD,mBAAmB,kCAAqB,SAAS;AAAA,EACjD,aAAa,cAAE,MAAM,4BAAe,EAAE,SAAS;AACjD,CAAC,EACA,YAAY,EACZ;AAAA,EACC,CAAC,SAAS;AACR,UAAM,SAAS,KAAK,KAAK,KAAK,IAAI,CAAC,QAAQ,IAAI,GAAG;AAClD,UAAM,eAAe,IAAI,IAAI,MAAM;AACnC,WAAO,aAAa,SAAS,OAAO;AAAA,EACtC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,MAAM,CAAC,QAAQ,MAAM;AAAA,EACvB;AACF;;;AQxCK,IAAM,0CACX,oCAAoC,OAAO,CAAC,SAAS,KAAK,QAAQ,KAAK,KAAK;AAAA,EAC1E,SAAS;AAAA,EACT,MAAM,CAAC,OAAO,KAAK;AACrB,CAAC;;;AVoBI,IAAM,oCAAoC,OAAO;AAAA,EACtD;AAAA,EACA;AAAA,EACA;AACF,MAAwC;AACtC,QAAM,kBAAkB;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,kBAAkB;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,QAAM,iBAAa,qCAAuB,QAAQ,MAAM;AAExD,QAAM,UAAM,gCAAkB,iBAAiB,eAAe;AAE9D,QAAM,YAAY,MAAM,gBAAgB,EAAE,KAAK,WAAW,CAAC;AAE3D,aAAO,iCAAmB,QAAQ,QAAQ,SAAS;AACrD;","names":["import_core","import_core","import_zod","import_zod","import_zod","import_zod","import_zod","import_zod","import_zod"]}