@verana-labs/vs-agent-plugin-openid4vc 1.11.0

package/build/trust/TrustClient.js

@@ -0,0 +1,120 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TrustClient = void 0;
+const verdict_1 = require("./verdict");
+const TRUST_STATUSES = new Set(['TRUSTED', 'PARTIAL', 'UNTRUSTED']);
+class TrustClient {
+    constructor(options, fetchImplementation = globalThis.fetch) {
+        this.options = options;
+        this.fetchImplementation = fetchImplementation;
+        const resolverUrl = new URL(options.resolverUrl);
+        if (resolverUrl.username || resolverUrl.password) {
+            throw new Error('resolver URL must not contain credentials');
+        }
+        this.resolverUrl = resolverUrl;
+    }
+    async resolve(did) {
+        const url = this.endpoint('resolve', { did });
+        try {
+            const { response, body } = await this.request(url);
+            if (response.status === 404)
+                return { status: 'not_found' };
+            if (!response.ok)
+                return { status: 'unreachable' };
+            if (!isRecord(body) || !isVeranaTrustStatus(body.trustStatus)) {
+                return { status: 'unreachable' };
+            }
+            return { status: 'ok', trustStatus: body.trustStatus };
+        }
+        catch (_a) {
+            return { status: 'unreachable' };
+        }
+    }
+    async checkAuthorization(role, did, vtjscId) {
+        const url = this.endpoint(`${role}-authorization`, { did, vtjscId });
+        try {
+            const { response, body } = await this.request(url);
+            if (response.status === 404)
+                return false;
+            if (!response.ok)
+                return null;
+            return isRecord(body) && typeof body.authorized === 'boolean' ? body.authorized : null;
+        }
+        catch (_a) {
+            return null;
+        }
+    }
+    async verdictFor(role, did, vtjscId) {
+        if (!did) {
+            return {
+                verdict: 'UNTRUSTED',
+                evidence: {
+                    did,
+                    trustStatus: null,
+                    vtjscId,
+                    authorized: null,
+                    queries: [],
+                    note: 'no DID was available for trust resolution',
+                },
+            };
+        }
+        const resolutionUrl = this.endpoint('resolve', { did });
+        const resolution = await this.resolve(did);
+        const evidence = {
+            did,
+            trustStatus: resolution.status === 'ok' ? resolution.trustStatus : null,
+            vtjscId,
+            authorized: null,
+            queries: [resolutionUrl.toString()],
+        };
+        if (resolution.status !== 'ok' || resolution.trustStatus !== 'TRUSTED') {
+            return { verdict: (0, verdict_1.computeVerdict)(resolution, null), evidence };
+        }
+        if (!vtjscId) {
+            return {
+                verdict: 'TRUSTED_NOT_AUTHORIZED',
+                evidence: Object.assign(Object.assign({}, evidence), { note: 'no VTJSC identifier was available for authorization' }),
+            };
+        }
+        const authorizationUrl = this.endpoint(`${role}-authorization`, { did, vtjscId });
+        const authorized = await this.checkAuthorization(role, did, vtjscId);
+        evidence.authorized = authorized;
+        evidence.queries.push(authorizationUrl.toString());
+        return { verdict: (0, verdict_1.computeVerdict)(resolution, authorized), evidence };
+    }
+    endpoint(pathSegment, query) {
+        const url = new URL(this.resolverUrl);
+        const basePathSegments = url.pathname.split('/').filter(Boolean);
+        url.pathname = `/${[...basePathSegments, pathSegment].join('/')}`;
+        url.search = '';
+        url.hash = '';
+        const searchParams = new URLSearchParams();
+        for (const [key, value] of Object.entries(query))
+            searchParams.set(key, value);
+        url.search = searchParams.toString();
+        return url;
+    }
+    async request(url) {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), this.options.timeoutMs);
+        try {
+            const response = await this.fetchImplementation(url, {
+                headers: { accept: 'application/json' },
+                signal: controller.signal,
+            });
+            const body = response.ok ? await response.json() : undefined;
+            return { response, body };
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+}
+exports.TrustClient = TrustClient;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function isVeranaTrustStatus(value) {
+    return typeof value === 'string' && TRUST_STATUSES.has(value);
+}
+//# sourceMappingURL=TrustClient.js.map

package/build/trust/TrustClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TrustClient.js","sourceRoot":"","sources":["../../src/trust/TrustClient.ts"],"names":[],"mappings":";;;AASA,uCAA0C;AAE1C,MAAM,cAAc,GAAG,IAAI,GAAG,CAAoB,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAA;AAEtF,MAAa,WAAW;IAGtB,YACmB,OAA2B,EAC3B,sBAAoC,UAAU,CAAC,KAAK;QADpD,YAAO,GAAP,OAAO,CAAoB;QAC3B,wBAAmB,GAAnB,mBAAmB,CAAiC;QAErE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAChD,IAAI,WAAW,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;QAC9D,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,WAAW,CAAA;IAChC,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,GAAW;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;QAE7C,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;YAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;YAElD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC9D,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;YAClC,CAAC;YAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAA;QACxD,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;QAClC,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAAC,IAAe,EAAE,GAAW,EAAE,OAAe;QAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,gBAAgB,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;QAEpE,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,KAAK,CAAA;YACzC,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAA;YAE7B,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAA;QACxF,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,UAAU,CACrB,IAAe,EACf,GAAkB,EAClB,OAAsB;QAEtB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO;gBACL,OAAO,EAAE,WAAW;gBACpB,QAAQ,EAAE;oBACR,GAAG;oBACH,WAAW,EAAE,IAAI;oBACjB,OAAO;oBACP,UAAU,EAAE,IAAI;oBAChB,OAAO,EAAE,EAAE;oBACX,IAAI,EAAE,2CAA2C;iBAClD;aACF,CAAA;QACH,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;QACvD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1C,MAAM,QAAQ,GAAkB;YAC9B,GAAG;YACH,WAAW,EAAE,UAAU,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;YACvE,OAAO;YACP,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;SACpC,CAAA;QAED,IAAI,UAAU,CAAC,MAAM,KAAK,IAAI,IAAI,UAAU,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACvE,OAAO,EAAE,OAAO,EAAE,IAAA,wBAAc,EAAC,UAAU,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAA;QAChE,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,wBAAwB;gBACjC,QAAQ,kCAAO,QAAQ,KAAE,IAAI,EAAE,qDAAqD,GAAE;aACvF,CAAA;QACH,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,gBAAgB,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;QACjF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;QACpE,QAAQ,CAAC,UAAU,GAAG,UAAU,CAAA;QAChC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC,CAAA;QAElD,OAAO,EAAE,OAAO,EAAE,IAAA,wBAAc,EAAC,UAAU,EAAE,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAA;IACtE,CAAC;IAEO,QAAQ,CAAC,WAAmB,EAAE,KAA6B;QACjE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACrC,MAAM,gBAAgB,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAChE,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,gBAAgB,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;QACjE,GAAG,CAAC,MAAM,GAAG,EAAE,CAAA;QACf,GAAG,CAAC,IAAI,GAAG,EAAE,CAAA;QAEb,MAAM,YAAY,GAAG,IAAI,eAAe,EAAE,CAAA;QAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAC9E,GAAG,CAAC,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAA;QAEpC,OAAO,GAAG,CAAA;IACZ,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,GAAQ;QAC5B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAE5E,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE;gBACnD,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAA;YACF,MAAM,IAAI,GAAY,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;YAErE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;QAC3B,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAA;QACvB,CAAC;IACH,CAAC;CACF;AA7HD,kCA6HC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,cAAc,CAAC,GAAG,CAAC,KAA0B,CAAC,CAAA;AACpF,CAAC"}

package/build/trust/keyBinding.d.ts

@@ -0,0 +1,14 @@
+import type { KeyBindingResult, TrustVerdict } from './types';
+import type { BaseAgent, DidPurpose } from '@credo-ts/core';
+type BindingPurpose = Extract<DidPurpose, 'assertionMethod' | 'authentication'>;
+type DidResolverAgent = Pick<BaseAgent, 'dids'>;
+export declare const DEFAULT_DID_RESOLUTION_TIMEOUT_MS = 5000;
+export declare const MAX_DID_RESOLUTION_TIMEOUT_MS = 30000;
+export interface DidResolutionPolicy {
+    allowedWebHosts: string[];
+    timeoutMs: number;
+}
+export declare function ownDidResolutionPolicy(did: string, timeoutMs?: number): DidResolutionPolicy;
+export declare function verifyKeyBoundToDid(agent: DidResolverAgent, did: string | null, certificatePublicJwk: unknown, purposes: BindingPurpose[], resolutionPolicy: DidResolutionPolicy): Promise<KeyBindingResult>;
+export declare function blockingBindingVerdict(did: string | null, vtjscId: string | null, binding: Exclude<KeyBindingResult, 'bound'>): TrustVerdict;
+export {};

package/build/trust/keyBinding.js

@@ -0,0 +1,171 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_DID_RESOLUTION_TIMEOUT_MS = exports.DEFAULT_DID_RESOLUTION_TIMEOUT_MS = void 0;
+exports.ownDidResolutionPolicy = ownDidResolutionPolicy;
+exports.verifyKeyBoundToDid = verifyKeyBoundToDid;
+exports.blockingBindingVerdict = blockingBindingVerdict;
+const core_1 = require("@credo-ts/core");
+const node_net_1 = require("node:net");
+exports.DEFAULT_DID_RESOLUTION_TIMEOUT_MS = 5000;
+exports.MAX_DID_RESOLUTION_TIMEOUT_MS = 30000;
+const NON_PUBLIC_IPS = createNonPublicIpBlockList();
+function ownDidResolutionPolicy(did, timeoutMs = exports.DEFAULT_DID_RESOLUTION_TIMEOUT_MS) {
+    const host = didWebHost(did);
+    return { allowedWebHosts: host ? [host] : [], timeoutMs };
+}
+async function verifyKeyBoundToDid(agent, did, certificatePublicJwk, purposes, resolutionPolicy) {
+    var _a, _b;
+    if (!did)
+        return 'unbound';
+    let certificateKey;
+    try {
+        certificateKey = core_1.Kms.PublicJwk.fromUnknown(certificatePublicJwk);
+    }
+    catch (_c) {
+        return 'unbound';
+    }
+    if (!isResolutionAllowed(did, resolutionPolicy))
+        return 'unresolvable';
+    let didDocument;
+    try {
+        const resolution = await withTimeout(agent.dids.resolve(did, { useCache: false, persistInCache: false }), resolutionPolicy.timeoutMs);
+        if (((_a = resolution.didResolutionMetadata) === null || _a === void 0 ? void 0 : _a.error) || !resolution.didDocument)
+            return 'unresolvable';
+        if (resolution.didDocument.id !== did)
+            return 'unresolvable';
+        didDocument = resolution.didDocument;
+    }
+    catch (_d) {
+        return 'unresolvable';
+    }
+    for (const purpose of purposes) {
+        for (const entry of (_b = didDocument[purpose]) !== null && _b !== void 0 ? _b : []) {
+            let verificationMethod;
+            try {
+                verificationMethod =
+                    typeof entry === 'string' ? didDocument.dereferenceVerificationMethod(entry) : entry;
+            }
+            catch (_e) {
+                continue;
+            }
+            try {
+                const methodKey = (0, core_1.getPublicJwkFromVerificationMethod)(verificationMethod);
+                if (certificateKey.equals(methodKey))
+                    return 'bound';
+            }
+            catch (_f) {
+                continue;
+            }
+        }
+    }
+    return 'unbound';
+}
+function isResolutionAllowed(did, policy) {
+    if (!Number.isInteger(policy.timeoutMs) ||
+        policy.timeoutMs <= 0 ||
+        policy.timeoutMs > exports.MAX_DID_RESOLUTION_TIMEOUT_MS ||
+        !Array.isArray(policy.allowedWebHosts)) {
+        return false;
+    }
+    const requestedHost = didWebHost(did);
+    if (!requestedHost || isNonPublicHost(new URL(`https://${requestedHost}`).hostname))
+        return false;
+    return policy.allowedWebHosts.some(allowedHost => canonicalHost(allowedHost) === requestedHost);
+}
+function didWebHost(did) {
+    const parsed = (0, core_1.tryParseDid)(did);
+    if (!parsed || parsed.did !== did)
+        return undefined;
+    const components = parsed.id.split(':');
+    const encodedHost = parsed.method === 'web'
+        ? components[0]
+        : parsed.method === 'webvh' && components.length >= 2 && components[0]
+            ? components[1]
+            : undefined;
+    if (!encodedHost)
+        return undefined;
+    try {
+        return canonicalHost(decodeURIComponent(encodedHost));
+    }
+    catch (_a) {
+        return undefined;
+    }
+}
+function canonicalHost(value) {
+    try {
+        const url = new URL(`https://${value}`);
+        if (!url.hostname || url.username || url.password || url.pathname !== '/' || url.search || url.hash) {
+            return undefined;
+        }
+        return url.host.toLowerCase();
+    }
+    catch (_a) {
+        return undefined;
+    }
+}
+function isNonPublicHost(hostname) {
+    const normalized = hostname.replace(/^\[|\]$/g, '').toLowerCase();
+    if (normalized === 'localhost' ||
+        normalized.endsWith('.localhost') ||
+        normalized.endsWith('.local') ||
+        normalized.endsWith('.internal') ||
+        normalized === 'home.arpa' ||
+        normalized.endsWith('.home.arpa')) {
+        return true;
+    }
+    const ipVersion = (0, node_net_1.isIP)(normalized);
+    return ipVersion === 4
+        ? NON_PUBLIC_IPS.check(normalized, 'ipv4')
+        : ipVersion === 6
+            ? NON_PUBLIC_IPS.check(normalized, 'ipv6')
+            : false;
+}
+function createNonPublicIpBlockList() {
+    const blockList = new node_net_1.BlockList();
+    blockList.addSubnet('0.0.0.0', 8, 'ipv4');
+    blockList.addSubnet('10.0.0.0', 8, 'ipv4');
+    blockList.addSubnet('100.64.0.0', 10, 'ipv4');
+    blockList.addSubnet('127.0.0.0', 8, 'ipv4');
+    blockList.addSubnet('169.254.0.0', 16, 'ipv4');
+    blockList.addSubnet('172.16.0.0', 12, 'ipv4');
+    blockList.addSubnet('192.0.0.0', 24, 'ipv4');
+    blockList.addSubnet('192.168.0.0', 16, 'ipv4');
+    blockList.addSubnet('198.18.0.0', 15, 'ipv4');
+    blockList.addSubnet('224.0.0.0', 3, 'ipv4');
+    blockList.addSubnet('::', 128, 'ipv6');
+    blockList.addSubnet('::1', 128, 'ipv6');
+    blockList.addSubnet('::ffff:0:0', 96, 'ipv6');
+    blockList.addSubnet('fc00::', 7, 'ipv6');
+    blockList.addSubnet('fe80::', 10, 'ipv6');
+    blockList.addSubnet('ff00::', 8, 'ipv6');
+    return blockList;
+}
+async function withTimeout(operation, timeoutMs) {
+    let timeout;
+    const timeoutPromise = new Promise((_resolve, reject) => {
+        timeout = setTimeout(() => reject(new Error('DID resolution timed out')), timeoutMs);
+    });
+    try {
+        return await Promise.race([operation, timeoutPromise]);
+    }
+    finally {
+        if (timeout)
+            clearTimeout(timeout);
+    }
+}
+function blockingBindingVerdict(did, vtjscId, binding) {
+    return {
+        verdict: binding === 'unresolvable' ? 'RESOLVER_UNAVAILABLE' : 'UNTRUSTED',
+        evidence: {
+            did,
+            trustStatus: null,
+            vtjscId,
+            authorized: null,
+            queries: [],
+            note: binding === 'unresolvable'
+                ? 'the asserted DID could not be resolved for key binding'
+                : 'the certificate public key is not authorized by the asserted DID document',
+        },
+    };
+}
+//# sourceMappingURL=keyBinding.js.map

package/build/trust/keyBinding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyBinding.js","sourceRoot":"","sources":["../../src/trust/keyBinding.ts"],"names":[],"mappings":";;;AAkBA,wDAMC;AAED,kDAmDC;AA0GD,wDAmBC;AAvMD,yCAAqF;AACrF,uCAA0C;AAK7B,QAAA,iCAAiC,GAAG,IAAK,CAAA;AACzC,QAAA,6BAA6B,GAAG,KAAM,CAAA;AACnD,MAAM,cAAc,GAAG,0BAA0B,EAAE,CAAA;AAOnD,SAAgB,sBAAsB,CACpC,GAAW,EACX,SAAS,GAAG,yCAAiC;IAE7C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;IAC5B,OAAO,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,CAAA;AAC3D,CAAC;AAEM,KAAK,UAAU,mBAAmB,CACvC,KAAuB,EACvB,GAAkB,EAClB,oBAA6B,EAC7B,QAA0B,EAC1B,gBAAqC;;IAErC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAA;IAE1B,IAAI,cAA6B,CAAA;IACjC,IAAI,CAAC;QACH,cAAc,GAAG,UAAG,CAAC,SAAS,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAA;IAClE,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,CAAC;QAAE,OAAO,cAAc,CAAA;IAEtE,IAAI,WAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,WAAW,CAClC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EACnE,gBAAgB,CAAC,SAAS,CAC3B,CAAA;QACD,IAAI,CAAA,MAAA,UAAU,CAAC,qBAAqB,0CAAE,KAAK,KAAI,CAAC,UAAU,CAAC,WAAW;YAAE,OAAO,cAAc,CAAA;QAC7F,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,KAAK,GAAG;YAAE,OAAO,cAAc,CAAA;QAC5D,WAAW,GAAG,UAAU,CAAC,WAAW,CAAA;IACtC,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,cAAc,CAAA;IACvB,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,MAAA,WAAW,CAAC,OAAO,CAAC,mCAAI,EAAE,EAAE,CAAC;YAC/C,IAAI,kBAAsC,CAAA;YAC1C,IAAI,CAAC;gBACH,kBAAkB;oBAChB,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,6BAA6B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;YACxF,CAAC;YAAC,WAAM,CAAC;gBACP,SAAQ;YACV,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,IAAA,yCAAkC,EAAC,kBAAkB,CAAC,CAAA;gBACxE,IAAI,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC;oBAAE,OAAO,OAAO,CAAA;YACtD,CAAC;YAAC,WAAM,CAAC;gBACP,SAAQ;YACV,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW,EAAE,MAA2B;IACnE,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC;QACnC,MAAM,CAAC,SAAS,IAAI,CAAC;QACrB,MAAM,CAAC,SAAS,GAAG,qCAA6B;QAChD,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,EACtC,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,CAAC,aAAa,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,WAAW,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAA;IAEjG,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,aAAa,CAAC,WAAW,CAAC,KAAK,aAAa,CAAC,CAAA;AACjG,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,MAAM,GAAG,IAAA,kBAAW,EAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG;QAAE,OAAO,SAAS,CAAA;IAEnD,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACvC,MAAM,WAAW,GACf,MAAM,CAAC,MAAM,KAAK,KAAK;QACrB,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QACf,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC;YACpE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YACf,CAAC,CAAC,SAAS,CAAA;IACjB,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAA;IAElC,IAAI,CAAC;QACH,OAAO,aAAa,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAA;IACvD,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,KAAK,EAAE,CAAC,CAAA;QACvC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACpG,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,OAAO,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;IAC/B,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IACjE,IACE,UAAU,KAAK,WAAW;QAC1B,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;QACjC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7B,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;QAChC,UAAU,KAAK,WAAW;QAC1B,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EACjC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,SAAS,GAAG,IAAA,eAAI,EAAC,UAAU,CAAC,CAAA;IAClC,OAAO,SAAS,KAAK,CAAC;QACpB,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC;QAC1C,CAAC,CAAC,SAAS,KAAK,CAAC;YACf,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC;YAC1C,CAAC,CAAC,KAAK,CAAA;AACb,CAAC;AAED,SAAS,0BAA0B;IACjC,MAAM,SAAS,GAAG,IAAI,oBAAS,EAAE,CAAA;IACjC,SAAS,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,EAAE,MAAM,CAAC,CAAA;IACzC,SAAS,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,EAAE,MAAM,CAAC,CAAA;IAC1C,SAAS,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;IAC7C,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,CAAC,CAAA;IAC3C,SAAS,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;IAC9C,SAAS,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;IAC7C,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;IAC5C,SAAS,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;IAC9C,SAAS,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;IAC7C,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,CAAC,CAAA;IAC3C,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;IACtC,SAAS,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;IACvC,SAAS,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;IAC7C,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,CAAA;IACxC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;IACzC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,CAAA;IACxC,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,KAAK,UAAU,WAAW,CAAI,SAAqB,EAAE,SAAiB;IACpE,IAAI,OAAkD,CAAA;IACtD,MAAM,cAAc,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QAC7D,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IACtF,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAA;IACxD,CAAC;YAAS,CAAC;QACT,IAAI,OAAO;YAAE,YAAY,CAAC,OAAO,CAAC,CAAA;IACpC,CAAC;AACH,CAAC;AAED,SAAgB,sBAAsB,CACpC,GAAkB,EAClB,OAAsB,EACtB,OAA2C;IAE3C,OAAO;QACL,OAAO,EAAE,OAAO,KAAK,cAAc,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,WAAW;QAC1E,QAAQ,EAAE;YACR,GAAG;YACH,WAAW,EAAE,IAAI;YACjB,OAAO;YACP,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,EAAE;YACX,IAAI,EACF,OAAO,KAAK,cAAc;gBACxB,CAAC,CAAC,wDAAwD;gBAC1D,CAAC,CAAC,2EAA2E;SAClF;KACF,CAAA;AACH,CAAC"}

package/build/trust/types.d.ts

@@ -0,0 +1,28 @@
+export type TrustVerdictName = 'TRUSTED_AUTHORIZED' | 'TRUSTED_NOT_AUTHORIZED' | 'UNTRUSTED' | 'RESOLVER_UNAVAILABLE';
+export type VeranaTrustStatus = 'TRUSTED' | 'PARTIAL' | 'UNTRUSTED';
+export type TrustResolution = {
+    status: 'ok';
+    trustStatus: VeranaTrustStatus;
+} | {
+    status: 'not_found';
+} | {
+    status: 'unreachable';
+};
+export type TrustRole = 'issuer' | 'verifier';
+export type KeyBindingResult = 'bound' | 'unbound' | 'unresolvable';
+export interface TrustEvidence {
+    did: string | null;
+    trustStatus: VeranaTrustStatus | null;
+    vtjscId: string | null;
+    authorized: boolean | null;
+    queries: string[];
+    note?: string;
+}
+export interface TrustVerdict {
+    verdict: TrustVerdictName;
+    evidence: TrustEvidence;
+}
+export interface TrustClientOptions {
+    resolverUrl: string;
+    timeoutMs: number;
+}

package/build/trust/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/build/trust/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/trust/types.ts"],"names":[],"mappings":""}

package/build/trust/verdict.d.ts

@@ -0,0 +1,2 @@
+import type { TrustResolution, TrustVerdictName } from './types';
+export declare function computeVerdict(resolution: TrustResolution, authorized: boolean | null): TrustVerdictName;

package/build/trust/verdict.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeVerdict = computeVerdict;
+function computeVerdict(resolution, authorized) {
+    if (resolution.status === 'unreachable')
+        return 'RESOLVER_UNAVAILABLE';
+    if (resolution.status === 'not_found' || resolution.trustStatus !== 'TRUSTED')
+        return 'UNTRUSTED';
+    if (authorized === null)
+        return 'RESOLVER_UNAVAILABLE';
+    return authorized ? 'TRUSTED_AUTHORIZED' : 'TRUSTED_NOT_AUTHORIZED';
+}
+//# sourceMappingURL=verdict.js.map

package/build/trust/verdict.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verdict.js","sourceRoot":"","sources":["../../src/trust/verdict.ts"],"names":[],"mappings":";;AAEA,wCAMC;AAND,SAAgB,cAAc,CAAC,UAA2B,EAAE,UAA0B;IACpF,IAAI,UAAU,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,sBAAsB,CAAA;IACtE,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,WAAW,CAAA;IACjG,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,sBAAsB,CAAA;IAEtD,OAAO,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,wBAAwB,CAAA;AACrE,CAAC"}

package/build/types.d.ts

@@ -0,0 +1,55 @@
+import type { Kms } from '@credo-ts/core';
+export interface OpenId4VcConfiguredSigningMaterial {
+    certificateChain: string[];
+    privateJwk: Kms.KmsJwkPrivateEc;
+}
+export type OpenId4VcSigningOptions = {
+    configured: OpenId4VcConfiguredSigningMaterial;
+    development?: never;
+} | {
+    configured?: never;
+    development: {
+        enabled: true;
+        commonName: string;
+    };
+};
+export interface OpenId4VcCredentialConfiguration {
+    id: string;
+    format: 'dc+sd-jwt';
+    vct: string;
+    name: string;
+    description?: string;
+    vtjscId: string;
+    claims: string[];
+    disclosureFrame: string[];
+    ttlSeconds: number;
+}
+export interface OpenId4VcVerifierPolicy {
+    id: string;
+    credentialConfigurationId: string;
+    requestedClaims: string[];
+}
+export interface OpenId4VcPluginOptions {
+    publicApiBaseUrl: string;
+    issuer?: {
+        id: string;
+        displayName: string;
+        signing: OpenId4VcSigningOptions;
+        requireWalletAttestation?: boolean;
+        walletAttestationCertificates?: string[];
+    };
+    verifier?: {
+        id: string;
+        displayName: string;
+        signing: OpenId4VcSigningOptions;
+    };
+    trust?: {
+        resolverUrl: string;
+        timeoutMs: number;
+        allowedDidWebHosts: string[];
+        credentialIssuerCertificates: string[];
+        developmentCertificateFingerprints?: string[];
+    };
+    credentialConfigurations: OpenId4VcCredentialConfiguration[];
+    verifierPolicies: OpenId4VcVerifierPolicy[];
+}

package/build/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/build/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@verana-labs/vs-agent-plugin-openid4vc",
+  "main": "build/index",
+  "types": "build/index",
+  "exports": {
+    ".": {
+      "types": "./build/index.d.ts",
+      "require": "./build/index.js",
+      "default": "./build/index.js"
+    }
+  },
+  "version": "1.11.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/verana-labs/vs-agent"
+  },
+  "files": [
+    "build"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "license": "Apache-2.0",
+  "description": "OpenID4VC issuer and verifier plugin for VS Agent",
+  "dependencies": {
+    "@credo-ts/openid4vc": "0.7.1-pr-2704-20260630143332",
+    "@nestjs/common": "^10.0.0",
+    "class-validator": "0.14.1",
+    "express": "^4.18.1",
+    "@verana-labs/vs-agent-sdk": "1.11.0"
+  },
+  "peerDependencies": {
+    "@credo-ts/core": "0.7.1-pr-2704-20260630143332"
+  },
+  "devDependencies": {
+    "@credo-ts/askar": "0.7.1-pr-2704-20260630143332",
+    "@credo-ts/node": "0.7.1-pr-2704-20260630143332",
+    "@openwallet-foundation/askar-nodejs": "0.6.0"
+  },
+  "scripts": {
+    "build": "pnpm run clean && pnpm run compile",
+    "clean": "rimraf -rf ./build",
+    "compile": "tsc -p tsconfig.build.json",
+    "version": "pnpm version --allow-same-version",
+    "test": "vitest"
+  }
+}