@verana-labs/vs-agent-plugin-openid4vc 1.11.0

package/build/sdk/setupOpenId4Vc.d.ts

@@ -0,0 +1,18 @@
+import type { OpenId4VcPluginOptions } from '../types';
+import { X509Module } from '@credo-ts/core';
+import { OpenId4VcModule, type OpenId4VciCredentialRequestToCredentialMapper } from '@credo-ts/openid4vc';
+import { type Express } from 'express';
+export interface OpenId4VcIssuerRequestMapper {
+    mapCredentialRequest: OpenId4VciCredentialRequestToCredentialMapper;
+    getVctMetadata: (configurationId: string) => Record<string, unknown> | undefined;
+}
+export interface OpenId4VcAgentModules {
+    [key: string]: unknown;
+    openId4Vc: OpenId4VcModule<null, null>;
+    x509: X509Module;
+}
+export interface OpenId4VcSdkPlugin {
+    modules: OpenId4VcAgentModules;
+    publicMiddleware: Express;
+}
+export declare function setupOpenId4Vc(options: OpenId4VcPluginOptions, getIssuerService?: () => OpenId4VcIssuerRequestMapper): OpenId4VcSdkPlugin;

package/build/sdk/setupOpenId4Vc.js

@@ -0,0 +1,111 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setupOpenId4Vc = setupOpenId4Vc;
+const core_1 = require("@credo-ts/core");
+const openid4vc_1 = require("@credo-ts/openid4vc");
+const express_1 = __importDefault(require("express"));
+const CertificateTrust_1 = require("../trust/CertificateTrust");
+const ATTESTATION_AUTH_METHOD = 'attest_jwt_client_auth';
+const ATTESTATION_ALGORITHMS = ['ES256'];
+function setupOpenId4Vc(options, getIssuerService) {
+    var _a, _b;
+    const walletAttestationCertificates = (_a = options.issuer) === null || _a === void 0 ? void 0 : _a.walletAttestationCertificates;
+    const walletAttestationEnabled = ((_b = options.issuer) === null || _b === void 0 ? void 0 : _b.requireWalletAttestation) === true && Boolean(walletAttestationCertificates === null || walletAttestationCertificates === void 0 ? void 0 : walletAttestationCertificates.length);
+    if (walletAttestationEnabled && walletAttestationCertificates) {
+        assertValidWalletAttestationCertificates(walletAttestationCertificates);
+    }
+    const app = (0, express_1.default)();
+    if (walletAttestationEnabled)
+        app.use(advertiseWalletAttestationMetadata);
+    if (options.issuer) {
+        app.get('/oid4vc/vct/:configurationId', (request, response, next) => {
+            try {
+                if (!getIssuerService)
+                    throw new Error('OpenID4VC issuer service is not initialized');
+                const metadata = getIssuerService().getVctMetadata(request.params.configurationId);
+                if (!metadata) {
+                    response.status(404).json({ message: 'credential configuration not found' });
+                    return;
+                }
+                response.json(metadata);
+            }
+            catch (error) {
+                next(error);
+            }
+        });
+    }
+    const moduleOptions = Object.assign(Object.assign({ 
+        // Credo declares Express 5, while VS Agent mounts the compatible Express 4 application.
+        app: app }, (options.issuer
+        ? {
+            issuer: {
+                baseUrl: `${options.publicApiBaseUrl}/oid4vci`,
+                walletAttestationsRequired: walletAttestationEnabled,
+                credentialRequestToCredentialMapper: input => {
+                    if (!getIssuerService) {
+                        throw new Error('OpenID4VC issuer service is not initialized');
+                    }
+                    return getIssuerService().mapCredentialRequest(input);
+                },
+            },
+        }
+        : {})), (options.verifier ? { verifier: { baseUrl: `${options.publicApiBaseUrl}/oid4vp` } } : {}));
+    return {
+        modules: {
+            openId4Vc: new openid4vc_1.OpenId4VcModule(moduleOptions),
+            x509: new core_1.X509Module({
+                getTrustedCertificatesForVerification: (_agentContext, { certificateChain, verification }) => (0, CertificateTrust_1.trustedCertificatesForVerification)(options, {
+                    type: verification.type,
+                    certificateChain,
+                }),
+            }),
+        },
+        publicMiddleware: app,
+    };
+}
+function assertValidWalletAttestationCertificates(certificates) {
+    certificates.forEach((certificate, index) => {
+        try {
+            core_1.X509Certificate.fromEncodedCertificate(certificate);
+        }
+        catch (_a) {
+            throw new Error(`issuer.walletAttestationCertificates[${index}] must be a valid X.509 certificate`);
+        }
+    });
+}
+function advertiseWalletAttestationMetadata(request, response, next) {
+    if (request.method !== 'GET' || !isAuthorizationServerMetadataPath(request.path)) {
+        next();
+        return;
+    }
+    const send = response.send.bind(response);
+    response.send = ((body) => send(typeof body === 'string' ? withWalletAttestationMetadata(body) : body));
+    next();
+}
+function withWalletAttestationMetadata(body) {
+    try {
+        const metadata = JSON.parse(body);
+        if (!isRecord(metadata))
+            return body;
+        const methods = Array.isArray(metadata.token_endpoint_auth_methods_supported)
+            ? metadata.token_endpoint_auth_methods_supported.filter((method) => typeof method === 'string')
+            : [];
+        if (!methods.includes(ATTESTATION_AUTH_METHOD))
+            methods.push(ATTESTATION_AUTH_METHOD);
+        return JSON.stringify(Object.assign(Object.assign({}, metadata), { token_endpoint_auth_methods_supported: methods, client_attestation_signing_alg_values_supported: ATTESTATION_ALGORITHMS, client_attestation_pop_signing_alg_values_supported: ATTESTATION_ALGORITHMS }));
+    }
+    catch (_a) {
+        return body;
+    }
+}
+function isAuthorizationServerMetadataPath(path) {
+    return (path.startsWith('/.well-known/oauth-authorization-server/') ||
+        path.endsWith('/.well-known/oauth-authorization-server'));
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+//# sourceMappingURL=setupOpenId4Vc.js.map

package/build/sdk/setupOpenId4Vc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setupOpenId4Vc.js","sourceRoot":"","sources":["../../src/sdk/setupOpenId4Vc.ts"],"names":[],"mappings":";;;;;AA+BA,wCA+DC;AA5FD,yCAA4D;AAC5D,mDAI4B;AAC5B,sDAA+F;AAE/F,gEAA8E;AAE9E,MAAM,uBAAuB,GAAG,wBAAwB,CAAA;AACxD,MAAM,sBAAsB,GAAG,CAAC,OAAO,CAAC,CAAA;AAkBxC,SAAgB,cAAc,CAC5B,OAA+B,EAC/B,gBAAqD;;IAErD,MAAM,6BAA6B,GAAG,MAAA,OAAO,CAAC,MAAM,0CAAE,6BAA6B,CAAA;IACnF,MAAM,wBAAwB,GAC5B,CAAA,MAAA,OAAO,CAAC,MAAM,0CAAE,wBAAwB,MAAK,IAAI,IAAI,OAAO,CAAC,6BAA6B,aAA7B,6BAA6B,uBAA7B,6BAA6B,CAAE,MAAM,CAAC,CAAA;IACrG,IAAI,wBAAwB,IAAI,6BAA6B,EAAE,CAAC;QAC9D,wCAAwC,CAAC,6BAA6B,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,GAAG,GAAG,IAAA,iBAAO,GAAE,CAAA;IACrB,IAAI,wBAAwB;QAAE,GAAG,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;IACzE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;YAClE,IAAI,CAAC;gBACH,IAAI,CAAC,gBAAgB;oBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;gBACrF,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;gBAClF,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAA;oBAC5E,OAAM;gBACR,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,KAAK,CAAC,CAAA;YACb,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,aAAa;QACjB,wFAAwF;QACxF,GAAG,EAAE,GAAiE,IACnE,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC;YACE,MAAM,EAAE;gBACN,OAAO,EAAE,GAAG,OAAO,CAAC,gBAAgB,UAAU;gBAC9C,0BAA0B,EAAE,wBAAwB;gBACpD,mCAAmC,EAAE,KAAK,CAAC,EAAE;oBAC3C,IAAI,CAAC,gBAAgB,EAAE,CAAC;wBACtB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;oBAChE,CAAC;oBAED,OAAO,gBAAgB,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAA;gBACvD,CAAC;aACF;SACF;QACH,CAAC,CAAC,EAAE,CAAC,GACJ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,gBAAgB,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC7F,CAAA;IAED,OAAO;QACL,OAAO,EAAE;YACP,SAAS,EAAE,IAAI,2BAAe,CAAC,aAAa,CAAC;YAC7C,IAAI,EAAE,IAAI,iBAAU,CAAC;gBACnB,qCAAqC,EAAE,CAAC,aAAa,EAAE,EAAE,gBAAgB,EAAE,YAAY,EAAE,EAAE,EAAE,CAC3F,IAAA,qDAAkC,EAAC,OAAO,EAAE;oBAC1C,IAAI,EAAE,YAAY,CAAC,IAAI;oBACvB,gBAAgB;iBACjB,CAAC;aACL,CAAC;SACH;QACD,gBAAgB,EAAE,GAAG;KACtB,CAAA;AACH,CAAC;AAED,SAAS,wCAAwC,CAAC,YAAsB;IACtE,YAAY,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE;QAC1C,IAAI,CAAC;YACH,sBAAe,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAA;QACrD,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,wCAAwC,KAAK,qCAAqC,CAAC,CAAA;QACrG,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,kCAAkC,CAAC,OAAgB,EAAE,QAAkB,EAAE,IAAkB;IAClG,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,iCAAiC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACjF,IAAI,EAAE,CAAA;QACN,OAAM;IACR,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACzC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAc,EAAE,EAAE,CAClC,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAqB,CAAA;IAClG,IAAI,EAAE,CAAA;AACR,CAAC;AAED,SAAS,6BAA6B,CAAC,IAAY;IACjD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC1C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAA;QAEpC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,qCAAqC,CAAC;YAC3E,CAAC,CAAC,QAAQ,CAAC,qCAAqC,CAAC,MAAM,CACnD,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CACzD;YACH,CAAC,CAAC,EAAE,CAAA;QACN,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;QAErF,OAAO,IAAI,CAAC,SAAS,iCAChB,QAAQ,KACX,qCAAqC,EAAE,OAAO,EAC9C,+CAA+C,EAAE,sBAAsB,EACvE,mDAAmD,EAAE,sBAAsB,IAC3E,CAAA;IACJ,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,iCAAiC,CAAC,IAAY;IACrD,OAAO,CACL,IAAI,CAAC,UAAU,CAAC,0CAA0C,CAAC;QAC3D,IAAI,CAAC,QAAQ,CAAC,yCAAyC,CAAC,CACzD,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC"}

package/build/services/CertificateService.d.ts

@@ -0,0 +1,22 @@
+import type { OpenId4VcSigningOptions } from '../types';
+import { type BaseAgent, X509Certificate } from '@credo-ts/core';
+export type SigningRole = 'issuer' | 'verifier';
+type CertificateAgent = Pick<BaseAgent, 'genericRecords' | 'kms' | 'x509'> & {
+    did?: string;
+    publicApiBaseUrl?: string;
+};
+export interface SigningCertificateHandle {
+    certificate: X509Certificate;
+    chain: X509Certificate[];
+    keyId: string;
+    development: boolean;
+}
+type DevelopmentDidAgent = {
+    did?: string;
+    dids: Pick<BaseAgent['dids'], 'resolve' | 'update'>;
+};
+export declare function loadSigningCertificate(agent: CertificateAgent, signing: OpenId4VcSigningOptions, publicApiBaseUrl?: string | undefined, role?: SigningRole): Promise<SigningCertificateHandle>;
+export declare function didFromValidatedCertificate(certificate: X509Certificate): string;
+export declare function publishDevelopmentSigningKey(agent: DevelopmentDidAgent, signingCertificate: SigningCertificateHandle, role: SigningRole): Promise<void>;
+export declare function assertCertificateChainUsable(chain: X509Certificate[], now?: Date): void;
+export {};

package/build/services/CertificateService.js

@@ -0,0 +1,249 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadSigningCertificate = loadSigningCertificate;
+exports.didFromValidatedCertificate = didFromValidatedCertificate;
+exports.publishDevelopmentSigningKey = publishDevelopmentSigningKey;
+exports.assertCertificateChainUsable = assertCertificateChainUsable;
+const core_1 = require("@credo-ts/core");
+const node_crypto_1 = require("node:crypto");
+const DEVELOPMENT_CERTIFICATE_VALIDITY_MS = 365 * 24 * 60 * 60 * 1000;
+const DEVELOPMENT_RECORD_PREFIX = 'openid4vc-development-signing';
+async function loadSigningCertificate(agent, signing, publicApiBaseUrl = agent.publicApiBaseUrl, role = 'issuer') {
+    if (signing.configured) {
+        return await loadConfiguredSigningCertificate(agent, signing.configured);
+    }
+    return await loadDevelopmentSigningCertificate(agent, signing.development, publicApiBaseUrl, role);
+}
+function didFromValidatedCertificate(certificate) {
+    const did = certificate.sanUriNames.map(uri => { var _a; return (_a = (0, core_1.tryParseDid)(uri)) === null || _a === void 0 ? void 0 : _a.did; }).find(value => value !== undefined);
+    if (!did) {
+        throw new Error('certificate does not contain a DID URI SAN');
+    }
+    return did;
+}
+async function publishDevelopmentSigningKey(agent, signingCertificate, role) {
+    var _a, _b, _c, _d, _e;
+    if (!signingCertificate.development)
+        return;
+    const did = agent.did;
+    if (!did)
+        throw new Error('development signing key publication requires an agent DID');
+    let resolution;
+    try {
+        resolution = await agent.dids.resolve(did);
+    }
+    catch (_f) {
+        throw new Error('development signing key DID resolution failed');
+    }
+    if (((_a = resolution.didResolutionMetadata) === null || _a === void 0 ? void 0 : _a.error) || !resolution.didDocument) {
+        throw new Error('development signing key DID resolution failed');
+    }
+    if (resolution.didDocument.id !== did) {
+        throw new Error('development signing key DID resolution returned a different DID');
+    }
+    const methodId = `${did}#openid4vc-development-${role}`;
+    const purpose = role === 'issuer' ? 'assertionMethod' : 'authentication';
+    const publicJwk = canonicalP256PublicJwk(signingCertificate.certificate.publicJwk.toJson());
+    const existingMethod = (_b = resolution.didDocument.verificationMethod) === null || _b === void 0 ? void 0 : _b.find(method => method.id === methodId);
+    const relationship = (_c = resolution.didDocument[purpose]) !== null && _c !== void 0 ? _c : [];
+    if (existingMethod &&
+        equalVerificationMethodJwk(existingMethod, publicJwk) &&
+        relationship.some(method => (typeof method === 'string' ? method : method.id) === methodId)) {
+        return;
+    }
+    const didDocument = core_1.DidDocument.fromJSON(resolution.didDocument.toJSON());
+    didDocument.verificationMethod = [
+        ...((_d = didDocument.verificationMethod) !== null && _d !== void 0 ? _d : []).filter(method => method.id !== methodId),
+        new core_1.VerificationMethod({
+            id: methodId,
+            type: 'JsonWebKey2020',
+            controller: did,
+            publicKeyJwk: publicJwk,
+        }),
+    ];
+    didDocument[purpose] = [
+        ...((_e = didDocument[purpose]) !== null && _e !== void 0 ? _e : []).filter(method => (typeof method === 'string' ? method : method.id) !== methodId),
+        methodId,
+    ];
+    let update;
+    try {
+        update = await agent.dids.update({ did, didDocument });
+    }
+    catch (_g) {
+        throw new Error('development signing key DID update failed');
+    }
+    if (update.didState.state !== 'finished') {
+        throw new Error('development signing key DID update failed');
+    }
+    if (update.didState.did !== did || update.didState.didDocument.id !== did) {
+        throw new Error('development signing key DID update returned a different DID');
+    }
+}
+async function loadConfiguredSigningCertificate(agent, configured) {
+    var _a;
+    if (configured.certificateChain.length === 0) {
+        throw new Error('configured certificate chain must not be empty');
+    }
+    const chain = configured.certificateChain.map(encoded => core_1.X509Certificate.fromEncodedCertificate(encoded));
+    assertCertificateChainUsable(chain);
+    const configuredChainEndpoint = configured.certificateChain[configured.certificateChain.length - 1];
+    // This trust endpoint is operator-configured signing material, never a peer-provided chain.
+    const validatedRootToLeafChain = await agent.x509.validateCertificateChain({
+        certificateChain: configured.certificateChain,
+        trustedCertificates: [configuredChainEndpoint],
+        allowNonRootTrustedCertificate: true,
+    });
+    const validatedChain = [...validatedRootToLeafChain].reverse();
+    if (validatedChain.length !== chain.length ||
+        validatedChain.some((certificate, index) => !certificate.equal(chain[index]))) {
+        throw new Error('configured certificate chain must be ordered leaf-first');
+    }
+    const certificate = validatedChain[0];
+    if (certificate.subject === certificate.issuer) {
+        throw new Error('configured leaf certificate must not be self-signed');
+    }
+    const privatePublicJwk = canonicalP256PublicJwk(configured.privateJwk);
+    const certificatePublicJwk = canonicalP256PublicJwk(certificate.publicJwk.toJson());
+    if (!equalPublicJwk(privatePublicJwk, certificatePublicJwk)) {
+        throw new Error('configured private key does not match the leaf certificate');
+    }
+    const keyId = (_a = configured.privateJwk.kid) !== null && _a !== void 0 ? _a : core_1.Kms.PublicJwk.fromPublicJwk(privatePublicJwk).legacyKeyId;
+    let storedPublicJwk;
+    try {
+        storedPublicJwk = await agent.kms.getPublicKey({ keyId });
+    }
+    catch (error) {
+        if (!(error instanceof core_1.Kms.KeyManagementKeyNotFoundError))
+            throw error;
+        const imported = await agent.kms.importKey({
+            privateJwk: Object.assign(Object.assign({}, configured.privateJwk), { kid: keyId }),
+        });
+        storedPublicJwk = imported.publicJwk;
+    }
+    if (!equalPublicJwk(canonicalP256PublicJwk(storedPublicJwk), privatePublicJwk)) {
+        throw new Error('stored KMS key does not match the configured private key');
+    }
+    certificate.keyId = keyId;
+    return { certificate, chain: validatedChain, keyId, development: false };
+}
+async function loadDevelopmentSigningCertificate(agent, development, publicApiBaseUrl, role = 'issuer') {
+    if (development.enabled !== true) {
+        throw new Error('development certificate mode must be explicitly enabled');
+    }
+    if (!agent.did || !(0, core_1.tryParseDid)(agent.did)) {
+        throw new Error('development certificate mode requires an agent DID');
+    }
+    if (!publicApiBaseUrl) {
+        throw new Error('development certificate mode requires publicApiBaseUrl');
+    }
+    const hostname = hostnameFromPublicApiBaseUrl(publicApiBaseUrl);
+    const recordId = developmentRecordId(agent.did, hostname, development.commonName, role);
+    const existing = await agent.genericRecords.findById(recordId);
+    if (existing) {
+        const stored = parseDevelopmentRecord(existing.content);
+        const certificate = core_1.X509Certificate.fromEncodedCertificate(stored.certificate);
+        assertCertificateChainUsable([certificate]);
+        assertDevelopmentCertificateIdentity(certificate, agent.did, hostname);
+        const storedPublicJwk = await agent.kms.getPublicKey({ keyId: stored.keyId });
+        if (!equalPublicJwk(canonicalP256PublicJwk(storedPublicJwk), canonicalP256PublicJwk(certificate.publicJwk.toJson()))) {
+            throw new Error('stored development KMS key does not match its certificate');
+        }
+        certificate.keyId = stored.keyId;
+        return { certificate, chain: [certificate], keyId: stored.keyId, development: true };
+    }
+    const { keyId, publicJwk } = await agent.kms.createKey({ type: { kty: 'EC', crv: 'P-256' } });
+    const authorityKey = core_1.Kms.PublicJwk.fromPublicJwk(publicJwk);
+    const now = new Date();
+    const certificate = await agent.x509.createCertificate({
+        serialNumber: (0, node_crypto_1.createHash)('sha256').update(keyId).digest('hex').slice(0, 32),
+        authorityKey,
+        issuer: { commonName: development.commonName },
+        validity: {
+            notBefore: new Date(now.getTime() - 60000),
+            notAfter: new Date(now.getTime() + DEVELOPMENT_CERTIFICATE_VALIDITY_MS),
+        },
+        extensions: {
+            subjectKeyIdentifier: { include: true },
+            authorityKeyIdentifier: { include: true },
+            keyUsage: { usages: [core_1.X509KeyUsage.DigitalSignature] },
+            basicConstraints: { ca: false },
+            subjectAlternativeName: {
+                name: [
+                    { type: 'url', value: agent.did },
+                    { type: 'dns', value: hostname },
+                ],
+            },
+        },
+    });
+    certificate.keyId = keyId;
+    await agent.genericRecords.save({
+        id: recordId,
+        content: { certificate: certificate.toString('base64'), keyId },
+    });
+    return { certificate, chain: [certificate], keyId, development: true };
+}
+function assertCertificateChainUsable(chain, now = new Date()) {
+    for (const certificate of chain) {
+        if (certificate.data.notAfter.getTime() < now.getTime()) {
+            throw new Error('certificate chain contains an expired certificate');
+        }
+        if (certificate.data.notBefore.getTime() > now.getTime()) {
+            throw new Error('certificate chain contains a certificate that is not yet valid');
+        }
+    }
+}
+function assertDevelopmentCertificateIdentity(certificate, expectedDid, expectedHostname) {
+    if (certificate.subject !== certificate.issuer) {
+        throw new Error('stored development certificate is not self-signed');
+    }
+    if (didFromValidatedCertificate(certificate) !== expectedDid) {
+        throw new Error('stored development certificate DID does not match the agent DID');
+    }
+    if (!certificate.sanDnsNames.includes(expectedHostname)) {
+        throw new Error('stored development certificate DNS SAN does not match publicApiBaseUrl');
+    }
+}
+function canonicalP256PublicJwk(jwk) {
+    if (!isRecord(jwk))
+        throw new Error('certificate signing key must be a P-256 key');
+    if (jwk.kty !== 'EC' || jwk.crv !== 'P-256' || typeof jwk.x !== 'string' || typeof jwk.y !== 'string') {
+        throw new Error('certificate signing key must be a P-256 key');
+    }
+    return { kty: 'EC', crv: 'P-256', x: jwk.x, y: jwk.y };
+}
+function equalPublicJwk(left, right) {
+    return left.kty === right.kty && left.crv === right.crv && left.x === right.x && left.y === right.y;
+}
+function equalVerificationMethodJwk(method, expected) {
+    try {
+        return equalPublicJwk(canonicalP256PublicJwk(method.publicKeyJwk), expected);
+    }
+    catch (_a) {
+        return false;
+    }
+}
+function hostnameFromPublicApiBaseUrl(publicApiBaseUrl) {
+    try {
+        const hostname = new URL(publicApiBaseUrl).hostname;
+        if (!hostname)
+            throw new Error();
+        return hostname;
+    }
+    catch (_a) {
+        throw new Error('development certificate mode requires a valid publicApiBaseUrl');
+    }
+}
+function developmentRecordId(did, hostname, commonName, role) {
+    const suffix = (0, node_crypto_1.createHash)('sha256').update(`${did}\0${hostname}\0${commonName}\0${role}`).digest('hex');
+    return `${DEVELOPMENT_RECORD_PREFIX}:${suffix}`;
+}
+function parseDevelopmentRecord(content) {
+    if (typeof content.certificate !== 'string' || typeof content.keyId !== 'string') {
+        throw new Error('stored development certificate record is invalid');
+    }
+    return { certificate: content.certificate, keyId: content.keyId };
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+//# sourceMappingURL=CertificateService.js.map

package/build/services/CertificateService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CertificateService.js","sourceRoot":"","sources":["../../src/services/CertificateService.ts"],"names":[],"mappings":";;AAuCA,wDAWC;AAED,kEAOC;AAED,oEAiEC;AAuID,oEASC;AA5QD,yCAQuB;AACvB,6CAAwC;AAExC,MAAM,mCAAmC,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAK,CAAA;AACtE,MAAM,yBAAyB,GAAG,+BAA+B,CAAA;AAyB1D,KAAK,UAAU,sBAAsB,CAC1C,KAAuB,EACvB,OAAgC,EAChC,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,EACzC,OAAoB,QAAQ;IAE5B,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,OAAO,MAAM,gCAAgC,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IAC1E,CAAC;IAED,OAAO,MAAM,iCAAiC,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAA;AACpG,CAAC;AAED,SAAgB,2BAA2B,CAAC,WAA4B;IACtE,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,WAAC,OAAA,MAAA,IAAA,kBAAW,EAAC,GAAG,CAAC,0CAAE,GAAG,CAAA,EAAA,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAA;IACxG,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAC/D,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC;AAEM,KAAK,UAAU,4BAA4B,CAChD,KAA0B,EAC1B,kBAA4C,EAC5C,IAAiB;;IAEjB,IAAI,CAAC,kBAAkB,CAAC,WAAW;QAAE,OAAM;IAE3C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;IACrB,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;IAEtF,IAAI,UAAU,CAAA;IACd,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC5C,CAAC;IAAC,WAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,IAAI,CAAA,MAAA,UAAU,CAAC,qBAAqB,0CAAE,KAAK,KAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;IACpF,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,GAAG,0BAA0B,IAAI,EAAE,CAAA;IACvD,MAAM,OAAO,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,CAAA;IACxE,MAAM,SAAS,GAAG,sBAAsB,CAAC,kBAAkB,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAA;IAC3F,MAAM,cAAc,GAAG,MAAA,UAAU,CAAC,WAAW,CAAC,kBAAkB,0CAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAA;IACxG,MAAM,YAAY,GAAG,MAAA,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC,mCAAI,EAAE,CAAA;IAC1D,IACE,cAAc;QACd,0BAA0B,CAAC,cAAc,EAAE,SAAS,CAAC;QACrD,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,QAAQ,CAAC,EAC3F,CAAC;QACD,OAAM;IACR,CAAC;IAED,MAAM,WAAW,GAAG,kBAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAA;IACzE,WAAW,CAAC,kBAAkB,GAAG;QAC/B,GAAG,CAAC,MAAA,WAAW,CAAC,kBAAkB,mCAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC;QAClF,IAAI,yBAAkB,CAAC;YACrB,EAAE,EAAE,QAAQ;YACZ,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,GAAG;YACf,YAAY,EAAE,SAAS;SACxB,CAAC;KACH,CAAA;IACD,WAAW,CAAC,OAAO,CAAC,GAAG;QACrB,GAAG,CAAC,MAAA,WAAW,CAAC,OAAO,CAAC,mCAAI,EAAE,CAAC,CAAC,MAAM,CACpC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,QAAQ,CACzE;QACD,QAAQ;KACT,CAAA;IAED,IAAI,MAAM,CAAA;IACV,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAA;IACxD,CAAC;IAAC,WAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAC9D,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAC9D,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;IAChF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gCAAgC,CAC7C,KAAuB,EACvB,UAA8D;;IAE9D,IAAI,UAAU,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,sBAAe,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAA;IACzG,4BAA4B,CAAC,KAAK,CAAC,CAAA;IACnC,MAAM,uBAAuB,GAAG,UAAU,CAAC,gBAAgB,CAAC,UAAU,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAEnG,4FAA4F;IAC5F,MAAM,wBAAwB,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC;QACzE,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;QAC7C,mBAAmB,EAAE,CAAC,uBAAuB,CAAC;QAC9C,8BAA8B,EAAE,IAAI;KACrC,CAAC,CAAA;IAEF,MAAM,cAAc,GAAG,CAAC,GAAG,wBAAwB,CAAC,CAAC,OAAO,EAAE,CAAA;IAC9D,IACE,cAAc,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QACtC,cAAc,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAC7E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IAED,MAAM,WAAW,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;IACrC,IAAI,WAAW,CAAC,OAAO,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IAED,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;IACtE,MAAM,oBAAoB,GAAG,sBAAsB,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAA;IACnF,IAAI,CAAC,cAAc,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;IAC/E,CAAC;IAED,MAAM,KAAK,GAAG,MAAA,UAAU,CAAC,UAAU,CAAC,GAAG,mCAAI,UAAG,CAAC,SAAS,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,WAAW,CAAA;IACpG,IAAI,eAAwB,CAAA;IAE5B,IAAI,CAAC;QACH,eAAe,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,UAAG,CAAC,6BAA6B,CAAC;YAAE,MAAM,KAAK,CAAA;QAEtE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YACzC,UAAU,kCAAO,UAAU,CAAC,UAAU,KAAE,GAAG,EAAE,KAAK,GAAE;SACrD,CAAC,CAAA;QACF,eAAe,GAAG,QAAQ,CAAC,SAAS,CAAA;IACtC,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,eAAe,CAAC,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC7E,CAAC;IAED,WAAW,CAAC,KAAK,GAAG,KAAK,CAAA;IACzB,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAA;AAC1E,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAAuB,EACvB,WAAgE,EAChE,gBAAyB,EACzB,OAAoB,QAAQ;IAE5B,IAAI,WAAW,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAA,kBAAW,EAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,QAAQ,GAAG,4BAA4B,CAAC,gBAAgB,CAAC,CAAA;IAC/D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IACvF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC9D,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QACvD,MAAM,WAAW,GAAG,sBAAe,CAAC,sBAAsB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QAC9E,4BAA4B,CAAC,CAAC,WAAW,CAAC,CAAC,CAAA;QAC3C,oCAAoC,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAEtE,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;QAC7E,IACE,CAAC,cAAc,CACb,sBAAsB,CAAC,eAAe,CAAC,EACvC,sBAAsB,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CACvD,EACD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;QAC9E,CAAC;QAED,WAAW,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAA;QAChC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;IACtF,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;IAC7F,MAAM,YAAY,GAAG,UAAG,CAAC,SAAS,CAAC,aAAa,CAAC,SAAS,CAAC,CAAA;IAC3D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC;QACrD,YAAY,EAAE,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAC3E,YAAY;QACZ,MAAM,EAAE,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE;QAC9C,QAAQ,EAAE;YACR,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAM,CAAC;YAC3C,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,mCAAmC,CAAC;SACxE;QACD,UAAU,EAAE;YACV,oBAAoB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YACvC,sBAAsB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YACzC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,mBAAY,CAAC,gBAAgB,CAAC,EAAE;YACrD,gBAAgB,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE;YAC/B,sBAAsB,EAAE;gBACtB,IAAI,EAAE;oBACJ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE;oBACjC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE;iBACjC;aACF;SACF;KACF,CAAC,CAAA;IAEF,WAAW,CAAC,KAAK,GAAG,KAAK,CAAA;IACzB,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC;QAC9B,EAAE,EAAE,QAAQ;QACZ,OAAO,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE;KAChE,CAAC,CAAA;IAEF,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;AACxE,CAAC;AAED,SAAgB,4BAA4B,CAAC,KAAwB,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IACrF,KAAK,MAAM,WAAW,IAAI,KAAK,EAAE,CAAC;QAChC,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;QACtE,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;QACnF,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,oCAAoC,CAC3C,WAA4B,EAC5B,WAAmB,EACnB,gBAAwB;IAExB,IAAI,WAAW,CAAC,OAAO,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACtE,CAAC;IACD,IAAI,2BAA2B,CAAC,WAAW,CAAC,KAAK,WAAW,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;IACpF,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAA;IAC3F,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAY;IAC1C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAClF,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACtG,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAA;AACxD,CAAC;AAED,SAAS,cAAc,CAAC,IAAwB,EAAE,KAAyB;IACzE,OAAO,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAA;AACrG,CAAC;AAED,SAAS,0BAA0B,CAAC,MAA0B,EAAE,QAA4B;IAC1F,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAA;IAC9E,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CAAC,gBAAwB;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAA;QACnD,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,EAAE,CAAA;QAChC,OAAO,QAAQ,CAAA;IACjB,CAAC;IAAC,WAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;IACnF,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW,EAAE,QAAgB,EAAE,UAAkB,EAAE,IAAiB;IAC/F,MAAM,MAAM,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,QAAQ,KAAK,UAAU,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACvG,OAAO,GAAG,yBAAyB,IAAI,MAAM,EAAE,CAAA;AACjD,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAgC;IAC9D,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAA;AACnE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC"}

package/build/services/IssuerService.d.ts

@@ -0,0 +1,47 @@
+import type { OpenId4VcPluginOptions } from '../types';
+import type { BaseAgent, SdJwtVcTypeMetadata } from '@credo-ts/core';
+import type { OpenId4VcIssuanceSessionRecord, OpenId4VcIssuerApi, OpenId4VciCredentialRequestToCredentialMapper } from '@credo-ts/openid4vc';
+type IssuerApi = Pick<OpenId4VcIssuerApi, 'getIssuerByIssuerId' | 'createIssuer' | 'updateIssuerMetadata' | 'createCredentialOffer' | 'getIssuanceSessionById'>;
+export type OpenId4VcIssuerAgent = Pick<BaseAgent, 'dids' | 'genericRecords' | 'kms' | 'x509'> & {
+    did?: string;
+    modules: {
+        openId4Vc?: {
+            issuer?: IssuerApi;
+        };
+    };
+};
+export interface OpenId4VcOfferResult {
+    credentialOffer: string;
+    issuanceSessionId: string;
+}
+export interface OpenId4VcOfferState {
+    id: string;
+    state: OpenId4VcIssuanceSessionRecord['state'];
+    createdAt: Date;
+    expiresAt?: Date;
+}
+export declare class OpenId4VcIssuerRequestError extends Error {
+}
+export declare class OpenId4VcOfferNotFoundError extends Error {
+}
+export declare class IssuerService {
+    private readonly agent;
+    private readonly options;
+    private initialization?;
+    private signingCertificate?;
+    private initialized;
+    constructor(agent: OpenId4VcIssuerAgent, options: OpenId4VcPluginOptions);
+    ensureInitialized(): Promise<void>;
+    createOffer(credentialConfigurationId: string, inputClaims: unknown): Promise<OpenId4VcOfferResult>;
+    getOfferState(id: string): Promise<OpenId4VcOfferState>;
+    getVctMetadata(configurationId: string): SdJwtVcTypeMetadata | undefined;
+    mapCredentialRequest: OpenId4VciCredentialRequestToCredentialMapper;
+    private initialize;
+    private createOrUpdateIssuer;
+    private credentialConfigurationsSupported;
+    private issuerApi;
+    private issuerOptions;
+    private signingCertificateHandle;
+    private assertInitialized;
+}
+export {};