@verana-labs/vs-agent-plugin-openid4vc 1.11.0

package/build/services/IssuerService.js

@@ -0,0 +1,185 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IssuerService = exports.OpenId4VcOfferNotFoundError = exports.OpenId4VcIssuerRequestError = void 0;
+const core_1 = require("@credo-ts/core");
+const config_1 = require("../config");
+const keyBinding_1 = require("../trust/keyBinding");
+const CertificateService_1 = require("./CertificateService");
+class OpenId4VcIssuerRequestError extends Error {
+}
+exports.OpenId4VcIssuerRequestError = OpenId4VcIssuerRequestError;
+class OpenId4VcOfferNotFoundError extends Error {
+}
+exports.OpenId4VcOfferNotFoundError = OpenId4VcOfferNotFoundError;
+class IssuerService {
+    constructor(agent, options) {
+        this.agent = agent;
+        this.options = options;
+        this.initialized = false;
+        this.mapCredentialRequest = async (input) => {
+            this.assertInitialized();
+            const signingCertificate = this.signingCertificateHandle();
+            const configuration = (0, config_1.findCredentialConfiguration)(this.options, input.credentialConfigurationId);
+            if (!configuration) {
+                throw new Error(`unknown credential configuration '${input.credentialConfigurationId}'`);
+            }
+            const claims = (0, config_1.parseOfferClaims)(configuration, input.issuanceSession.issuanceMetadata);
+            const issuedAt = Math.floor(Date.now() / 1000);
+            const payload = Object.assign(Object.assign({}, claims), { vct: configuration.vct, iat: issuedAt, exp: issuedAt + configuration.ttlSeconds });
+            return {
+                type: 'credentials',
+                format: core_1.ClaimFormat.SdJwtDc,
+                credentials: input.holderBinding.keys.map(holderKey => ({
+                    payload,
+                    holder: holderKey.method === 'did'
+                        ? { method: 'did', didUrl: holderKey.didUrl }
+                        : { method: 'jwk', jwk: holderKey.jwk },
+                    issuer: {
+                        method: 'x5c',
+                        x5c: signingCertificate.chain,
+                        issuer: this.options.publicApiBaseUrl,
+                    },
+                    disclosureFrame: { _sd: configuration.disclosureFrame },
+                    headerType: 'dc+sd-jwt',
+                })),
+            };
+        };
+    }
+    ensureInitialized() {
+        var _a;
+        (_a = this.initialization) !== null && _a !== void 0 ? _a : (this.initialization = this.initialize());
+        return this.initialization;
+    }
+    async createOffer(credentialConfigurationId, inputClaims) {
+        this.assertInitialized();
+        const configuration = (0, config_1.findCredentialConfiguration)(this.options, credentialConfigurationId);
+        if (!configuration) {
+            throw new OpenId4VcIssuerRequestError(`unknown credential configuration '${credentialConfigurationId}'`);
+        }
+        let claims;
+        try {
+            claims = (0, config_1.parseOfferClaims)(configuration, inputClaims);
+        }
+        catch (error) {
+            throw new OpenId4VcIssuerRequestError(error instanceof Error ? error.message : 'invalid claims');
+        }
+        const { credentialOffer, issuanceSession } = await this.issuerApi().createCredentialOffer({
+            issuerId: this.issuerOptions().id,
+            credentialConfigurationIds: [configuration.id],
+            preAuthorizedCodeFlowConfig: {},
+            issuanceMetadata: claims,
+        });
+        return { credentialOffer, issuanceSessionId: issuanceSession.id };
+    }
+    async getOfferState(id) {
+        this.assertInitialized();
+        let session;
+        try {
+            session = await this.issuerApi().getIssuanceSessionById(id);
+        }
+        catch (error) {
+            if (error instanceof core_1.RecordNotFoundError) {
+                throw new OpenId4VcOfferNotFoundError(`OpenID4VC offer '${id}' was not found`);
+            }
+            throw error;
+        }
+        return Object.assign({ id: session.id, state: session.state, createdAt: session.createdAt }, (session.expiresAt ? { expiresAt: session.expiresAt } : {}));
+    }
+    getVctMetadata(configurationId) {
+        const configuration = (0, config_1.findCredentialConfiguration)(this.options, configurationId);
+        if (!configuration)
+            return undefined;
+        return Object.assign(Object.assign({ vct: configuration.vct, name: configuration.name }, (configuration.description ? { description: configuration.description } : {})), { display: [
+                Object.assign({ locale: 'en', name: configuration.name }, (configuration.description ? { description: configuration.description } : {})),
+            ], claims: configuration.claims.map(claim => ({ path: [claim] })) });
+    }
+    async initialize() {
+        const agentDid = this.agent.did;
+        if (!agentDid)
+            throw new Error('OpenID4VC issuer initialization requires an agent DID');
+        const signingCertificate = await (0, CertificateService_1.loadSigningCertificate)(this.agent, this.issuerOptions().signing, this.options.publicApiBaseUrl, 'issuer');
+        const certificateDid = (0, CertificateService_1.didFromValidatedCertificate)(signingCertificate.certificate);
+        if (certificateDid !== agentDid) {
+            throw new Error('OpenID4VC issuer certificate DID does not match the agent DID');
+        }
+        await (0, CertificateService_1.publishDevelopmentSigningKey)(this.agent, signingCertificate, 'issuer');
+        const binding = await (0, keyBinding_1.verifyKeyBoundToDid)(this.agent, agentDid, signingCertificate.certificate.publicJwk.toJson(), ['assertionMethod'], (0, keyBinding_1.ownDidResolutionPolicy)(agentDid));
+        if (binding === 'unresolvable') {
+            throw new Error('OpenID4VC issuer DID could not be resolved for assertionMethod key binding');
+        }
+        if (binding !== 'bound') {
+            throw new Error('OpenID4VC issuer certificate key is not bound to the agent DID assertionMethod');
+        }
+        await this.createOrUpdateIssuer(signingCertificate);
+        this.signingCertificate = signingCertificate;
+        this.initialized = true;
+    }
+    async createOrUpdateIssuer(signingCertificate) {
+        const issuer = this.issuerOptions();
+        const issuerId = issuer.id;
+        const metadata = {
+            issuerId,
+            display: [{ name: issuer.displayName, locale: 'en' }],
+            credentialConfigurationsSupported: this.credentialConfigurationsSupported(),
+        };
+        try {
+            await this.issuerApi().getIssuerByIssuerId(issuerId);
+        }
+        catch (error) {
+            if (!(error instanceof core_1.RecordNotFoundError))
+                throw error;
+            await this.issuerApi().createIssuer(Object.assign(Object.assign({}, metadata), { metadataSigner: {
+                    method: 'x5c',
+                    x5c: signingCertificate.development
+                        ? signingCertificate.chain
+                        : signingCertificate.chain.filter((certificate, index, chain) => index !== chain.length - 1 || certificate.subject !== certificate.issuer),
+                } }));
+            return;
+        }
+        await this.issuerApi().updateIssuerMetadata(metadata);
+    }
+    credentialConfigurationsSupported() {
+        return Object.fromEntries(this.options.credentialConfigurations.map(configuration => [
+            configuration.id,
+            {
+                format: 'dc+sd-jwt',
+                vct: configuration.vct,
+                cryptographic_binding_methods_supported: ['jwk'],
+                credential_signing_alg_values_supported: ['ES256'],
+                proof_types_supported: { jwt: { proof_signing_alg_values_supported: ['ES256'] } },
+                credential_metadata: {
+                    display: [
+                        Object.assign(Object.assign({ name: configuration.name }, (configuration.description ? { description: configuration.description } : {})), { locale: 'en' }),
+                    ],
+                    claims: configuration.claims.map(claim => ({ path: [claim] })),
+                },
+            },
+        ]));
+    }
+    issuerApi() {
+        var _a;
+        const issuer = (_a = this.agent.modules.openId4Vc) === null || _a === void 0 ? void 0 : _a.issuer;
+        if (!issuer)
+            throw new Error('OpenID4VC issuer API is not enabled on this agent');
+        return issuer;
+    }
+    issuerOptions() {
+        const issuer = this.options.issuer;
+        if (!issuer)
+            throw new Error('OpenID4VC issuer capability is not configured');
+        return issuer;
+    }
+    signingCertificateHandle() {
+        const signingCertificate = this.signingCertificate;
+        if (!signingCertificate)
+            throw new Error('OpenID4VC issuer service is not initialized');
+        return signingCertificate;
+    }
+    assertInitialized() {
+        if (!this.initialized || !this.signingCertificate) {
+            throw new Error('OpenID4VC issuer service is not initialized');
+        }
+    }
+}
+exports.IssuerService = IssuerService;
+//# sourceMappingURL=IssuerService.js.map

package/build/services/IssuerService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IssuerService.js","sourceRoot":"","sources":["../../src/services/IssuerService.ts"],"names":[],"mappings":";;;AASA,yCAAiE;AAEjE,sCAAyE;AACzE,oDAAiF;AAEjF,6DAK6B;AAgC7B,MAAa,2BAA4B,SAAQ,KAAK;CAAG;AAAzD,kEAAyD;AACzD,MAAa,2BAA4B,SAAQ,KAAK;CAAG;AAAzD,kEAAyD;AAEzD,MAAa,aAAa;IAKxB,YACmB,KAA2B,EAC3B,OAA+B;QAD/B,UAAK,GAAL,KAAK,CAAsB;QAC3B,YAAO,GAAP,OAAO,CAAwB;QAJ1C,gBAAW,GAAG,KAAK,CAAA;QA+EpB,yBAAoB,GAAkD,KAAK,EAAC,KAAK,EAAC,EAAE;YACzF,IAAI,CAAC,iBAAiB,EAAE,CAAA;YACxB,MAAM,kBAAkB,GAAG,IAAI,CAAC,wBAAwB,EAAE,CAAA;YAC1D,MAAM,aAAa,GAAG,IAAA,oCAA2B,EAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,yBAAyB,CAAC,CAAA;YAChG,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,CAAC,yBAAyB,GAAG,CAAC,CAAA;YAC1F,CAAC;YAED,MAAM,MAAM,GAAG,IAAA,yBAAgB,EAAC,aAAa,EAAE,KAAK,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAA;YACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAK,CAAC,CAAA;YAC/C,MAAM,OAAO,mCACR,MAAM,KACT,GAAG,EAAE,aAAa,CAAC,GAAG,EACtB,GAAG,EAAE,QAAQ,EACb,GAAG,EAAE,QAAQ,GAAG,aAAa,CAAC,UAAU,GACzC,CAAA;YAED,OAAO;gBACL,IAAI,EAAE,aAAa;gBACnB,MAAM,EAAE,kBAAW,CAAC,OAAO;gBAC3B,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;oBACtD,OAAO;oBACP,MAAM,EACJ,SAAS,CAAC,MAAM,KAAK,KAAK;wBACxB,CAAC,CAAC,EAAE,MAAM,EAAE,KAAc,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE;wBACtD,CAAC,CAAC,EAAE,MAAM,EAAE,KAAc,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE;oBACpD,MAAM,EAAE;wBACN,MAAM,EAAE,KAAc;wBACtB,GAAG,EAAE,kBAAkB,CAAC,KAAK;wBAC7B,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB;qBACtC;oBACD,eAAe,EAAE,EAAE,GAAG,EAAE,aAAa,CAAC,eAAe,EAAE;oBACvD,UAAU,EAAE,WAAoB;iBACjC,CAAC,CAAC;aACJ,CAAA;QACH,CAAC,CAAA;IA7GE,CAAC;IAEG,iBAAiB;;QACtB,MAAA,IAAI,CAAC,cAAc,oCAAnB,IAAI,CAAC,cAAc,GAAK,IAAI,CAAC,UAAU,EAAE,EAAA;QACzC,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAEM,KAAK,CAAC,WAAW,CACtB,yBAAiC,EACjC,WAAoB;QAEpB,IAAI,CAAC,iBAAiB,EAAE,CAAA;QACxB,MAAM,aAAa,GAAG,IAAA,oCAA2B,EAAC,IAAI,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAA;QAC1F,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,2BAA2B,CAAC,qCAAqC,yBAAyB,GAAG,CAAC,CAAA;QAC1G,CAAC;QAED,IAAI,MAA+B,CAAA;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,IAAA,yBAAgB,EAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,2BAA2B,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAA;QAClG,CAAC;QAED,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,qBAAqB,CAAC;YACxF,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,EAAE;YACjC,0BAA0B,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;YAC9C,2BAA2B,EAAE,EAAE;YAC/B,gBAAgB,EAAE,MAAM;SACzB,CAAC,CAAA;QAEF,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,CAAC,EAAE,EAAE,CAAA;IACnE,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,EAAU;QACnC,IAAI,CAAC,iBAAiB,EAAE,CAAA;QAExB,IAAI,OAAuC,CAAA;QAC3C,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAA;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,0BAAmB,EAAE,CAAC;gBACzC,MAAM,IAAI,2BAA2B,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,CAAA;YAChF,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;QAED,uBACE,EAAE,EAAE,OAAO,CAAC,EAAE,EACd,KAAK,EAAE,OAAO,CAAC,KAAK,EACpB,SAAS,EAAE,OAAO,CAAC,SAAS,IACzB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC/D;IACH,CAAC;IAEM,cAAc,CAAC,eAAuB;QAC3C,MAAM,aAAa,GAAG,IAAA,oCAA2B,EAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAA;QAChF,IAAI,CAAC,aAAa;YAAE,OAAO,SAAS,CAAA;QAEpC,qCACE,GAAG,EAAE,aAAa,CAAC,GAAG,EACtB,IAAI,EAAE,aAAa,CAAC,IAAI,IACrB,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAChF,OAAO,EAAE;gCAEL,MAAM,EAAE,IAAI,EACZ,IAAI,EAAE,aAAa,CAAC,IAAI,IACrB,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAEnF,EACD,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAC/D;IACH,CAAC;IAuCO,KAAK,CAAC,UAAU;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAA;QAC/B,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;QAEvF,MAAM,kBAAkB,GAAG,MAAM,IAAA,2CAAsB,EACrD,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,aAAa,EAAE,CAAC,OAAO,EAC5B,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAC7B,QAAQ,CACT,CAAA;QACD,MAAM,cAAc,GAAG,IAAA,gDAA2B,EAAC,kBAAkB,CAAC,WAAW,CAAC,CAAA;QAClF,IAAI,cAAc,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;QAClF,CAAC;QACD,MAAM,IAAA,iDAA4B,EAAC,IAAI,CAAC,KAAK,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAA;QAE5E,MAAM,OAAO,GAAG,MAAM,IAAA,gCAAmB,EACvC,IAAI,CAAC,KAAK,EACV,QAAQ,EACR,kBAAkB,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,EAAE,EACjD,CAAC,iBAAiB,CAAC,EACnB,IAAA,mCAAsB,EAAC,QAAQ,CAAC,CACjC,CAAA;QACD,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAA;QAC/F,CAAC;QACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAA;QACnG,CAAC;QAED,MAAM,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,CAAA;QACnD,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAA;QAC5C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAA;IACzB,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,kBAA4C;QAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAA;QACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAA;QAC1B,MAAM,QAAQ,GAAG;YACf,QAAQ;YACR,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACrD,iCAAiC,EAAE,IAAI,CAAC,iCAAiC,EAAE;SAC5E,CAAA;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAA;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,0BAAmB,CAAC;gBAAE,MAAM,KAAK,CAAA;YACxD,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,YAAY,iCAC9B,QAAQ,KACX,cAAc,EAAE;oBACd,MAAM,EAAE,KAAc;oBACtB,GAAG,EAAE,kBAAkB,CAAC,WAAW;wBACjC,CAAC,CAAC,kBAAkB,CAAC,KAAK;wBAC1B,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAC7B,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAC5B,KAAK,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,OAAO,KAAK,WAAW,CAAC,MAAM,CAC3E;iBACN,IACD,CAAA;YACF,OAAM;QACR,CAAC;QAED,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IACvD,CAAC;IAEO,iCAAiC;QACvC,OAAO,MAAM,CAAC,WAAW,CACvB,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;YACzD,aAAa,CAAC,EAAE;YAChB;gBACE,MAAM,EAAE,WAAoB;gBAC5B,GAAG,EAAE,aAAa,CAAC,GAAG;gBACtB,uCAAuC,EAAE,CAAC,KAAK,CAAC;gBAChD,uCAAuC,EAAE,CAAC,OAAO,CAAC;gBAClD,qBAAqB,EAAE,EAAE,GAAG,EAAE,EAAE,kCAAkC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE;gBACjF,mBAAmB,EAAE;oBACnB,OAAO,EAAE;sDAEL,IAAI,EAAE,aAAa,CAAC,IAAI,IACrB,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAChF,MAAM,EAAE,IAAI;qBAEf;oBACD,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;iBAC/D;aACF;SACF,CAAC,CACH,CAAA;IACH,CAAC;IAEO,SAAS;;QACf,MAAM,MAAM,GAAG,MAAA,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,0CAAE,MAAM,CAAA;QACnD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;QACjF,OAAO,MAAM,CAAA;IACf,CAAC;IAEO,aAAa;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAA;QAClC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAC7E,OAAO,MAAM,CAAA;IACf,CAAC;IAEO,wBAAwB;QAC9B,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAA;QAClD,IAAI,CAAC,kBAAkB;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;QACvF,OAAO,kBAAkB,CAAA;IAC3B,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;QAChE,CAAC;IACH,CAAC;CACF;AAzOD,sCAyOC"}

package/build/services/VerifierService.d.ts

@@ -0,0 +1,57 @@
+import type { TrustVerdict } from '../trust/types';
+import type { OpenId4VcPluginOptions } from '../types';
+import type { BaseAgent } from '@credo-ts/core';
+import type { OpenId4VcVerificationSessionRecord, OpenId4VcVerifierApi } from '@credo-ts/openid4vc';
+type VerifierApi = Pick<OpenId4VcVerifierApi, 'getVerifierByVerifierId' | 'createVerifier' | 'updateVerifierMetadata' | 'createAuthorizationRequest' | 'getVerificationSessionById' | 'getVerifiedAuthorizationResponse'>;
+export type OpenId4VcVerifierAgent = Pick<BaseAgent, 'dids' | 'genericRecords' | 'kms' | 'x509'> & {
+    did?: string;
+    modules: {
+        openId4Vc?: {
+            verifier?: VerifierApi;
+        };
+    };
+};
+export interface OpenId4VcVerificationRequest {
+    authorizationRequest: string;
+    verificationSessionId: string;
+}
+export interface OpenId4VcVerifiedCredentialResult {
+    vct: string;
+    disclosedClaims: Record<string, unknown>;
+}
+export interface OpenId4VcVerificationResult {
+    state: OpenId4VcVerificationSessionRecord['state'];
+    cryptographicVerified: boolean;
+    accepted: boolean;
+    trust?: TrustVerdict;
+    credential?: OpenId4VcVerifiedCredentialResult;
+}
+export declare class OpenId4VcVerifierRequestError extends Error {
+}
+export declare class UnknownVerificationSessionError extends Error {
+}
+export declare class VerifierService {
+    private readonly agent;
+    private readonly options;
+    private initialization?;
+    private signingCertificate?;
+    private initialized;
+    private readonly trustClient;
+    constructor(agent: OpenId4VcVerifierAgent, options: OpenId4VcPluginOptions);
+    ensureInitialized(): Promise<void>;
+    createRequest(policyId: string): Promise<OpenId4VcVerificationRequest>;
+    getResult(sessionId: string): Promise<OpenId4VcVerificationResult>;
+    private initialize;
+    private createOrUpdateVerifier;
+    private getSession;
+    private getVerifiedResponse;
+    private assertSessionOwnership;
+    private assertStableVerifiedSession;
+    private matchConfiguredPolicy;
+    private blockedResult;
+    private verifierApi;
+    private verifierOptions;
+    private trustOptions;
+    private signingCertificateHandle;
+}
+export {};

package/build/services/VerifierService.js

@@ -0,0 +1,289 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VerifierService = exports.UnknownVerificationSessionError = exports.OpenId4VcVerifierRequestError = void 0;
+const core_1 = require("@credo-ts/core");
+const openid4vc_1 = require("@credo-ts/openid4vc");
+const config_1 = require("../config");
+const TrustClient_1 = require("../trust/TrustClient");
+const keyBinding_1 = require("../trust/keyBinding");
+const CertificateService_1 = require("./CertificateService");
+class OpenId4VcVerifierRequestError extends Error {
+}
+exports.OpenId4VcVerifierRequestError = OpenId4VcVerifierRequestError;
+class UnknownVerificationSessionError extends Error {
+}
+exports.UnknownVerificationSessionError = UnknownVerificationSessionError;
+class VerifierService {
+    constructor(agent, options) {
+        this.agent = agent;
+        this.options = options;
+        this.initialized = false;
+        const trust = this.options.trust;
+        if (!trust)
+            throw new Error('OpenID4VC verifier requires trust configuration');
+        this.trustClient = new TrustClient_1.TrustClient(trust);
+    }
+    ensureInitialized() {
+        var _a;
+        (_a = this.initialization) !== null && _a !== void 0 ? _a : (this.initialization = this.initialize());
+        return this.initialization;
+    }
+    async createRequest(policyId) {
+        await this.ensureInitialized();
+        const policy = (0, config_1.findVerifierPolicy)(this.options, policyId);
+        if (!policy) {
+            throw new OpenId4VcVerifierRequestError(`unknown verifier policy '${policyId}'`);
+        }
+        const configuration = (0, config_1.findCredentialConfiguration)(this.options, policy.credentialConfigurationId);
+        if (!configuration) {
+            throw new OpenId4VcVerifierRequestError(`verifier policy '${policyId}' references an unknown credential configuration`);
+        }
+        const { authorizationRequest, verificationSession } = await this.verifierApi().createAuthorizationRequest({
+            verifierId: this.verifierOptions().id,
+            requestSigner: {
+                method: 'x5c',
+                x5c: this.signingCertificateHandle().chain,
+                clientIdPrefix: 'x509_hash',
+            },
+            responseMode: 'direct_post.jwt',
+            dcql: {
+                query: {
+                    credentials: [
+                        {
+                            id: configuration.id,
+                            format: 'dc+sd-jwt',
+                            meta: { vct_values: [configuration.vct] },
+                            claims: policy.requestedClaims.map(name => ({ path: [name] })),
+                        },
+                    ],
+                },
+            },
+        });
+        return {
+            authorizationRequest,
+            verificationSessionId: verificationSession.id,
+        };
+    }
+    async getResult(sessionId) {
+        var _a, _b;
+        const session = await this.getSession(sessionId);
+        this.assertSessionOwnership(session, sessionId);
+        if (session.state !== openid4vc_1.OpenId4VcVerificationSessionState.ResponseVerified) {
+            return {
+                state: session.state,
+                cryptographicVerified: false,
+                accepted: false,
+            };
+        }
+        const verified = await this.getVerifiedResponse(sessionId);
+        this.assertStableVerifiedSession(verified, sessionId);
+        const matched = this.matchConfiguredPolicy(verified);
+        if (!matched) {
+            return this.blockedResult(session.state, null, null, 'unbound');
+        }
+        const { policy } = matched;
+        const configuration = (0, config_1.findCredentialConfiguration)(this.options, policy.credentialConfigurationId);
+        if (!configuration) {
+            return this.blockedResult(session.state, null, null, 'unbound');
+        }
+        const presentation = (_b = (_a = verified.dcql) === null || _a === void 0 ? void 0 : _a.presentations[configuration.id]) === null || _b === void 0 ? void 0 : _b[0];
+        if (!isX5cSdJwtDcPresentation(presentation)) {
+            return this.blockedResult(session.state, null, configuration.vtjscId, 'unbound');
+        }
+        const disclosedClaims = configuredDisclosedClaims(presentation.prettyClaims, policy.requestedClaims);
+        if (presentation.prettyClaims.vct !== configuration.vct || !disclosedClaims) {
+            return this.blockedResult(session.state, null, configuration.vtjscId, 'unbound');
+        }
+        const issuerCertificate = presentation.issuer.x5c[0];
+        let issuerDid;
+        let issuerPublicJwk;
+        try {
+            issuerDid = (0, CertificateService_1.didFromValidatedCertificate)(issuerCertificate);
+            issuerPublicJwk = issuerCertificate.publicJwk.toJson();
+        }
+        catch (_c) {
+            return this.blockedResult(session.state, null, configuration.vtjscId, 'unbound');
+        }
+        const credential = { vct: configuration.vct, disclosedClaims };
+        const binding = await (0, keyBinding_1.verifyKeyBoundToDid)(this.agent, issuerDid, issuerPublicJwk, ['assertionMethod'], {
+            allowedWebHosts: this.trustOptions().allowedDidWebHosts,
+            timeoutMs: this.trustOptions().timeoutMs,
+        });
+        if (binding !== 'bound') {
+            return {
+                state: session.state,
+                cryptographicVerified: true,
+                accepted: false,
+                trust: (0, keyBinding_1.blockingBindingVerdict)(issuerDid, configuration.vtjscId, binding),
+                credential,
+            };
+        }
+        const trust = await this.trustClient.verdictFor('issuer', issuerDid, configuration.vtjscId);
+        return {
+            state: session.state,
+            cryptographicVerified: true,
+            accepted: trust.verdict === 'TRUSTED_AUTHORIZED',
+            trust,
+            credential,
+        };
+    }
+    async initialize() {
+        const agentDid = this.agent.did;
+        if (!agentDid)
+            throw new Error('OpenID4VC verifier initialization requires an agent DID');
+        const signingCertificate = await (0, CertificateService_1.loadSigningCertificate)(this.agent, this.verifierOptions().signing, this.options.publicApiBaseUrl, 'verifier');
+        const certificateDid = (0, CertificateService_1.didFromValidatedCertificate)(signingCertificate.certificate);
+        if (certificateDid !== agentDid) {
+            throw new Error('OpenID4VC verifier certificate DID does not match the agent DID');
+        }
+        await (0, CertificateService_1.publishDevelopmentSigningKey)(this.agent, signingCertificate, 'verifier');
+        const binding = await (0, keyBinding_1.verifyKeyBoundToDid)(this.agent, agentDid, signingCertificate.certificate.publicJwk.toJson(), ['authentication'], (0, keyBinding_1.ownDidResolutionPolicy)(agentDid, this.trustOptions().timeoutMs));
+        if (binding === 'unresolvable') {
+            throw new Error('OpenID4VC verifier DID could not be resolved for authentication key binding');
+        }
+        if (binding !== 'bound') {
+            throw new Error('OpenID4VC verifier certificate key is not bound to the agent DID authentication');
+        }
+        await this.createOrUpdateVerifier();
+        this.signingCertificate = signingCertificate;
+        this.initialized = true;
+    }
+    async createOrUpdateVerifier() {
+        const verifier = this.verifierOptions();
+        const metadata = {
+            verifierId: verifier.id,
+            clientMetadata: { client_name: verifier.displayName },
+        };
+        try {
+            await this.verifierApi().getVerifierByVerifierId(verifier.id);
+        }
+        catch (error) {
+            if (!(error instanceof core_1.RecordNotFoundError))
+                throw error;
+            await this.verifierApi().createVerifier(metadata);
+            return;
+        }
+        await this.verifierApi().updateVerifierMetadata(metadata);
+    }
+    async getSession(sessionId) {
+        try {
+            return await this.verifierApi().getVerificationSessionById(sessionId);
+        }
+        catch (error) {
+            if (error instanceof core_1.RecordNotFoundError) {
+                throw new UnknownVerificationSessionError(`OpenID4VC verification session '${sessionId}' was not found`);
+            }
+            throw error;
+        }
+    }
+    async getVerifiedResponse(sessionId) {
+        try {
+            return await this.verifierApi().getVerifiedAuthorizationResponse(sessionId);
+        }
+        catch (error) {
+            if (error instanceof core_1.RecordNotFoundError) {
+                throw new UnknownVerificationSessionError(`OpenID4VC verification session '${sessionId}' was not found`);
+            }
+            throw error;
+        }
+    }
+    assertSessionOwnership(session, sessionId) {
+        if (session.verifierId !== this.verifierOptions().id) {
+            throw new UnknownVerificationSessionError(`OpenID4VC verification session '${sessionId}' was not found`);
+        }
+    }
+    assertStableVerifiedSession(verified, sessionId) {
+        if (verified.verificationSession.id !== sessionId ||
+            verified.verificationSession.verifierId !== this.verifierOptions().id ||
+            verified.verificationSession.state !== openid4vc_1.OpenId4VcVerificationSessionState.ResponseVerified) {
+            throw new Error('OpenID4VC verification session changed while reading its verified result');
+        }
+    }
+    matchConfiguredPolicy(verified) {
+        var _a, _b, _c, _d;
+        const credentials = (_a = verified.dcql) === null || _a === void 0 ? void 0 : _a.query.credentials;
+        if (!credentials || credentials.length !== 1)
+            return undefined;
+        const query = credentials[0];
+        if (query.format !== 'dc+sd-jwt')
+            return undefined;
+        const configuration = (0, config_1.findCredentialConfiguration)(this.options, query.id);
+        if (!configuration)
+            return undefined;
+        if (((_c = (_b = query.meta) === null || _b === void 0 ? void 0 : _b.vct_values) === null || _c === void 0 ? void 0 : _c.length) !== 1 || query.meta.vct_values[0] !== configuration.vct) {
+            return undefined;
+        }
+        const requestedClaims = (_d = query.claims) === null || _d === void 0 ? void 0 : _d.map(claim => {
+            const path = claim.path;
+            return path.length === 1 && typeof path[0] === 'string' ? path[0] : undefined;
+        });
+        if (!requestedClaims || requestedClaims.some(claim => claim === undefined))
+            return undefined;
+        const policy = this.options.verifierPolicies.find(candidate => candidate.credentialConfigurationId === configuration.id &&
+            equalStrings(candidate.requestedClaims, requestedClaims));
+        return policy ? { policy } : undefined;
+    }
+    blockedResult(state, did, vtjscId, binding) {
+        return {
+            state,
+            cryptographicVerified: true,
+            accepted: false,
+            trust: (0, keyBinding_1.blockingBindingVerdict)(did, vtjscId, binding),
+        };
+    }
+    verifierApi() {
+        var _a;
+        const verifier = (_a = this.agent.modules.openId4Vc) === null || _a === void 0 ? void 0 : _a.verifier;
+        if (!verifier)
+            throw new Error('OpenID4VC verifier API is not enabled on this agent');
+        return verifier;
+    }
+    verifierOptions() {
+        const verifier = this.options.verifier;
+        if (!verifier)
+            throw new Error('OpenID4VC verifier capability is not configured');
+        return verifier;
+    }
+    trustOptions() {
+        const trust = this.options.trust;
+        if (!trust)
+            throw new Error('OpenID4VC verifier requires trust configuration');
+        return trust;
+    }
+    signingCertificateHandle() {
+        if (!this.initialized || !this.signingCertificate) {
+            throw new Error('OpenID4VC verifier service is not initialized');
+        }
+        return this.signingCertificate;
+    }
+}
+exports.VerifierService = VerifierService;
+function isX5cSdJwtDcPresentation(value) {
+    if (!isRecord(value) || value.claimFormat !== core_1.ClaimFormat.SdJwtDc || !isRecord(value.prettyClaims)) {
+        return false;
+    }
+    if (!isRecord(value.issuer) || value.issuer.method !== 'x5c' || !Array.isArray(value.issuer.x5c)) {
+        return false;
+    }
+    const leaf = value.issuer.x5c[0];
+    return (isRecord(leaf) &&
+        Array.isArray(leaf.sanUriNames) &&
+        isRecord(leaf.publicJwk) &&
+        typeof leaf.publicJwk.toJson === 'function');
+}
+function configuredDisclosedClaims(claims, requestedClaims) {
+    const disclosedClaims = {};
+    for (const name of requestedClaims) {
+        if (!Object.prototype.hasOwnProperty.call(claims, name))
+            return undefined;
+        disclosedClaims[name] = claims[name];
+    }
+    return disclosedClaims;
+}
+function equalStrings(left, right) {
+    return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+//# sourceMappingURL=VerifierService.js.map

package/build/services/VerifierService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"VerifierService.js","sourceRoot":"","sources":["../../src/services/VerifierService.ts"],"names":[],"mappings":";;;AASA,yCAAiE;AACjE,mDAAuE;AAEvE,sCAA2E;AAC3E,sDAAkD;AAClD,oDAAyG;AAEzG,6DAK6B;AAuC7B,MAAa,6BAA8B,SAAQ,KAAK;CAAG;AAA3D,sEAA2D;AAC3D,MAAa,+BAAgC,SAAQ,KAAK;CAAG;AAA7D,0EAA6D;AAE7D,MAAa,eAAe;IAM1B,YACmB,KAA6B,EAC7B,OAA+B;QAD/B,UAAK,GAAL,KAAK,CAAwB;QAC7B,YAAO,GAAP,OAAO,CAAwB;QAL1C,gBAAW,GAAG,KAAK,CAAA;QAOzB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAA;QAChC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QAC9E,IAAI,CAAC,WAAW,GAAG,IAAI,yBAAW,CAAC,KAAK,CAAC,CAAA;IAC3C,CAAC;IAEM,iBAAiB;;QACtB,MAAA,IAAI,CAAC,cAAc,oCAAnB,IAAI,CAAC,cAAc,GAAK,IAAI,CAAC,UAAU,EAAE,EAAA;QACzC,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,QAAgB;QACzC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAA;QAE9B,MAAM,MAAM,GAAG,IAAA,2BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QACzD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,6BAA6B,CAAC,4BAA4B,QAAQ,GAAG,CAAC,CAAA;QAClF,CAAC;QACD,MAAM,aAAa,GAAG,IAAA,oCAA2B,EAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,yBAAyB,CAAC,CAAA;QACjG,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,6BAA6B,CACrC,oBAAoB,QAAQ,kDAAkD,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,0BAA0B,CACvG;YACE,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,EAAE;YACrC,aAAa,EAAE;gBACb,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,IAAI,CAAC,wBAAwB,EAAE,CAAC,KAAK;gBAC1C,cAAc,EAAE,WAAW;aAC5B;YACD,YAAY,EAAE,iBAAiB;YAC/B,IAAI,EAAE;gBACJ,KAAK,EAAE;oBACL,WAAW,EAAE;wBACX;4BACE,EAAE,EAAE,aAAa,CAAC,EAAE;4BACpB,MAAM,EAAE,WAAW;4BACnB,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE;4BACzC,MAAM,EAAE,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;yBAC/D;qBACF;iBACF;aACF;SACF,CACF,CAAA;QAED,OAAO;YACL,oBAAoB;YACpB,qBAAqB,EAAE,mBAAmB,CAAC,EAAE;SAC9C,CAAA;IACH,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,SAAiB;;QACtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;QAChD,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QAE/C,IAAI,OAAO,CAAC,KAAK,KAAK,6CAAiC,CAAC,gBAAgB,EAAE,CAAC;YACzE,OAAO;gBACL,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,qBAAqB,EAAE,KAAK;gBAC5B,QAAQ,EAAE,KAAK;aAChB,CAAA;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAA;QAC1D,IAAI,CAAC,2BAA2B,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;QAErD,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAA;QACpD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;QACjE,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;QAC1B,MAAM,aAAa,GAAG,IAAA,oCAA2B,EAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,yBAAyB,CAAC,CAAA;QACjG,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;QACjE,CAAC;QAED,MAAM,YAAY,GAAG,MAAA,MAAA,QAAQ,CAAC,IAAI,0CAAE,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC,0CAAG,CAAC,CAAC,CAAA;QACxE,IAAI,CAAC,wBAAwB,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QAClF,CAAC;QAED,MAAM,eAAe,GAAG,yBAAyB,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,eAAe,CAAC,CAAA;QACpG,IAAI,YAAY,CAAC,YAAY,CAAC,GAAG,KAAK,aAAa,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YAC5E,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QAClF,CAAC;QAED,MAAM,iBAAiB,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACpD,IAAI,SAAiB,CAAA;QACrB,IAAI,eAAwB,CAAA;QAC5B,IAAI,CAAC;YACH,SAAS,GAAG,IAAA,gDAA2B,EAAC,iBAAiB,CAAC,CAAA;YAC1D,eAAe,GAAG,iBAAiB,CAAC,SAAS,CAAC,MAAM,EAAE,CAAA;QACxD,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QAClF,CAAC;QAED,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,CAAA;QAC9D,MAAM,OAAO,GAAG,MAAM,IAAA,gCAAmB,EAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,iBAAiB,CAAC,EAAE;YACrG,eAAe,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,kBAAkB;YACvD,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,SAAS;SACzC,CAAC,CAAA;QACF,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,OAAO;gBACL,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,qBAAqB,EAAE,IAAI;gBAC3B,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,IAAA,mCAAsB,EAAC,SAAS,EAAE,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC;gBACxE,UAAU;aACX,CAAA;QACH,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,CAAA;QAC3F,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,qBAAqB,EAAE,IAAI;YAC3B,QAAQ,EAAE,KAAK,CAAC,OAAO,KAAK,oBAAoB;YAChD,KAAK;YACL,UAAU;SACX,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAA;QAC/B,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;QAEzF,MAAM,kBAAkB,GAAG,MAAM,IAAA,2CAAsB,EACrD,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,eAAe,EAAE,CAAC,OAAO,EAC9B,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAC7B,UAAU,CACX,CAAA;QACD,MAAM,cAAc,GAAG,IAAA,gDAA2B,EAAC,kBAAkB,CAAC,WAAW,CAAC,CAAA;QAClF,IAAI,cAAc,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;QACpF,CAAC;QACD,MAAM,IAAA,iDAA4B,EAAC,IAAI,CAAC,KAAK,EAAE,kBAAkB,EAAE,UAAU,CAAC,CAAA;QAE9E,MAAM,OAAO,GAAG,MAAM,IAAA,gCAAmB,EACvC,IAAI,CAAC,KAAK,EACV,QAAQ,EACR,kBAAkB,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,EAAE,EACjD,CAAC,gBAAgB,CAAC,EAClB,IAAA,mCAAsB,EAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,SAAS,CAAC,CAChE,CAAA;QACD,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAA;QAChG,CAAC;QACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAA;QACpG,CAAC;QAED,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAA;QACnC,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAA;QAC5C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAA;IACzB,CAAC;IAEO,KAAK,CAAC,sBAAsB;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAA;QACvC,MAAM,QAAQ,GAAG;YACf,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,cAAc,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE;SACtD,CAAA;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,0BAAmB,CAAC;gBAAE,MAAM,KAAK,CAAA;YACxD,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAA;YACjD,OAAM;QACR,CAAC;QAED,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAA;IAC3D,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,SAAiB;QACxC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,0BAA0B,CAAC,SAAS,CAAC,CAAA;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,0BAAmB,EAAE,CAAC;gBACzC,MAAM,IAAI,+BAA+B,CACvC,mCAAmC,SAAS,iBAAiB,CAC9D,CAAA;YACH,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,SAAiB;QACjD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,gCAAgC,CAAC,SAAS,CAAC,CAAA;QAC7E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,0BAAmB,EAAE,CAAC;gBACzC,MAAM,IAAI,+BAA+B,CACvC,mCAAmC,SAAS,iBAAiB,CAC9D,CAAA;YACH,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAEO,sBAAsB,CAAC,OAA2C,EAAE,SAAiB;QAC3F,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,+BAA+B,CAAC,mCAAmC,SAAS,iBAAiB,CAAC,CAAA;QAC1G,CAAC;IACH,CAAC;IAEO,2BAA2B,CACjC,QAAgD,EAChD,SAAiB;QAEjB,IACE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,KAAK,SAAS;YAC7C,QAAQ,CAAC,mBAAmB,CAAC,UAAU,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC,EAAE;YACrE,QAAQ,CAAC,mBAAmB,CAAC,KAAK,KAAK,6CAAiC,CAAC,gBAAgB,EACzF,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAA;QAC7F,CAAC;IACH,CAAC;IAEO,qBAAqB,CAC3B,QAAgD;;QAEhD,MAAM,WAAW,GAAG,MAAA,QAAQ,CAAC,IAAI,0CAAE,KAAK,CAAC,WAAW,CAAA;QACpD,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAA;QAE9D,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW;YAAE,OAAO,SAAS,CAAA;QAElD,MAAM,aAAa,GAAG,IAAA,oCAA2B,EAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;QACzE,IAAI,CAAC,aAAa;YAAE,OAAO,SAAS,CAAA;QACpC,IAAI,CAAA,MAAA,MAAA,KAAK,CAAC,IAAI,0CAAE,UAAU,0CAAE,MAAM,MAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,GAAG,EAAE,CAAC;YAC3F,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,MAAM,eAAe,GAAG,MAAA,KAAK,CAAC,MAAM,0CAAE,GAAG,CAAC,KAAK,CAAC,EAAE;YAChD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;YACvB,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/E,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;YAAE,OAAO,SAAS,CAAA;QAE5F,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAC/C,SAAS,CAAC,EAAE,CACV,SAAS,CAAC,yBAAyB,KAAK,aAAa,CAAC,EAAE;YACxD,YAAY,CAAC,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC,CAC3D,CAAA;QACD,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IACxC,CAAC;IAEO,aAAa,CACnB,KAAkD,EAClD,GAAkB,EAClB,OAAsB,EACtB,OAAmC;QAEnC,OAAO;YACL,KAAK;YACL,qBAAqB,EAAE,IAAI;YAC3B,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,IAAA,mCAAsB,EAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC;SACrD,CAAA;IACH,CAAC;IAEO,WAAW;;QACjB,MAAM,QAAQ,GAAG,MAAA,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,0CAAE,QAAQ,CAAA;QACvD,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;QACrF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAEO,eAAe;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAA;QACtC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QACjF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAEO,YAAY;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAA;QAChC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QAC9E,OAAO,KAAK,CAAA;IACd,CAAC;IAEO,wBAAwB;QAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAClE,CAAC;QACD,OAAO,IAAI,CAAC,kBAAkB,CAAA;IAChC,CAAC;CACF;AA5SD,0CA4SC;AAMD,SAAS,wBAAwB,CAAC,KAAc;IAC9C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,WAAW,KAAK,kBAAW,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACnG,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACjG,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,IAAI,GAAY,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IACzC,OAAO,CACL,QAAQ,CAAC,IAAI,CAAC;QACd,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;QACxB,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,UAAU,CAC5C,CAAA;AACH,CAAC;AAED,SAAS,yBAAyB,CAChC,MAA+B,EAC/B,eAAyB;IAEzB,MAAM,eAAe,GAA4B,EAAE,CAAA;IACnD,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;YAAE,OAAO,SAAS,CAAA;QACzE,eAAe,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;IACtC,CAAC;IACD,OAAO,eAAe,CAAA;AACxB,CAAC;AAED,SAAS,YAAY,CAAC,IAAc,EAAE,KAAgC;IACpE,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;AAC7F,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC"}

package/build/trust/CertificateTrust.d.ts

@@ -0,0 +1,7 @@
+import type { OpenId4VcPluginOptions } from '../types';
+import type { X509Certificate } from '@credo-ts/core';
+export declare function trustedCertificatesForVerification(options: OpenId4VcPluginOptions, verification: {
+    type: string;
+    certificateChain: X509Certificate[];
+}): string[] | undefined;
+export declare function certificateFingerprint(certificate: X509Certificate): string;

package/build/trust/CertificateTrust.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.trustedCertificatesForVerification = trustedCertificatesForVerification;
+exports.certificateFingerprint = certificateFingerprint;
+const node_crypto_1 = require("node:crypto");
+function trustedCertificatesForVerification(options, verification) {
+    var _a, _b, _c, _d, _e;
+    if (verification.type === 'credential') {
+        if ((_a = options.trust) === null || _a === void 0 ? void 0 : _a.credentialIssuerCertificates.length) {
+            return options.trust.credentialIssuerCertificates;
+        }
+        const leaf = verification.certificateChain[0];
+        const fingerprint = leaf ? certificateFingerprint(leaf) : undefined;
+        return fingerprint && ((_c = (_b = options.trust) === null || _b === void 0 ? void 0 : _b.developmentCertificateFingerprints) === null || _c === void 0 ? void 0 : _c.includes(fingerprint))
+            ? [leaf.toString('base64')]
+            : undefined;
+    }
+    if (verification.type === 'oauth2ClientAttestation') {
+        return ((_e = (_d = options.issuer) === null || _d === void 0 ? void 0 : _d.walletAttestationCertificates) === null || _e === void 0 ? void 0 : _e.length)
+            ? options.issuer.walletAttestationCertificates
+            : undefined;
+    }
+    return undefined;
+}
+function certificateFingerprint(certificate) {
+    const digest = (0, node_crypto_1.createHash)('sha256').update(certificate.rawCertificate).digest('hex');
+    return `SHA256:${digest}`;
+}
+//# sourceMappingURL=CertificateTrust.js.map

package/build/trust/CertificateTrust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CertificateTrust.js","sourceRoot":"","sources":["../../src/trust/CertificateTrust.ts"],"names":[],"mappings":";;AAKA,gFAuBC;AAED,wDAGC;AA9BD,6CAAwC;AAExC,SAAgB,kCAAkC,CAChD,OAA+B,EAC/B,YAAmE;;IAEnE,IAAI,YAAY,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACvC,IAAI,MAAA,OAAO,CAAC,KAAK,0CAAE,4BAA4B,CAAC,MAAM,EAAE,CAAC;YACvD,OAAO,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAA;QACnD,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAA;QAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACnE,OAAO,WAAW,KAAI,MAAA,MAAA,OAAO,CAAC,KAAK,0CAAE,kCAAkC,0CAAE,QAAQ,CAAC,WAAW,CAAC,CAAA;YAC5F,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC3B,CAAC,CAAC,SAAS,CAAA;IACf,CAAC;IAED,IAAI,YAAY,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;QACpD,OAAO,CAAA,MAAA,MAAA,OAAO,CAAC,MAAM,0CAAE,6BAA6B,0CAAE,MAAM;YAC1D,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,6BAA6B;YAC9C,CAAC,CAAC,SAAS,CAAA;IACf,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAgB,sBAAsB,CAAC,WAA4B;IACjE,MAAM,MAAM,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACpF,OAAO,UAAU,MAAM,EAAE,CAAA;AAC3B,CAAC"}

package/build/trust/TrustClient.d.ts

@@ -0,0 +1,12 @@
+import type { TrustClientOptions, TrustResolution, TrustRole, TrustVerdict } from './types';
+export declare class TrustClient {
+    private readonly options;
+    private readonly fetchImplementation;
+    private readonly resolverUrl;
+    constructor(options: TrustClientOptions, fetchImplementation?: typeof fetch);
+    resolve(did: string): Promise<TrustResolution>;
+    checkAuthorization(role: TrustRole, did: string, vtjscId: string): Promise<boolean | null>;
+    verdictFor(role: TrustRole, did: string | null, vtjscId: string | null): Promise<TrustVerdict>;
+    private endpoint;
+    private request;
+}