@vess-id/mdl 0.0.1 → 0.0.2

package/README.md

@@ -71,6 +71,8 @@ import fs from "node:fs";
 
 ## Issuing a credential
 
+### Traditional approach with private key
+
 ```js
 import { MDoc, Document } from "@vess-id/mdl";
 import { inspect } from "node:util";
@@ -90,14 +92,106 @@ import { inspect } from "node:util";
     .sign({
       issuerPrivateKey,
       issuerCertificate,
+      alg: 'ES256',
     });
 
   const mdoc = new MDoc([document]).encode();
 
-  inspect(encoded);
+  inspect(mdoc);
 })();
 ```
 
+### Using external signer (HSM, KMS, or remote signing)
+
+```js
+import { MDoc, Document, CoseSign1Signer, CoseSign1ContextualSigner } from "@vess-id/mdl";
+
+(async () => {
+  // Basic signer - receives only the data to sign
+  const basicSigner: CoseSign1Signer = async (data: Uint8Array) => {
+    // Send data to HSM/KMS/remote service for signing
+    const signature = await externalSigningService.sign(data);
+    return new Uint8Array(signature);
+  };
+
+  // Or use contextual signer for more control
+  const contextualSigner: CoseSign1ContextualSigner = async (context) => {
+    console.log('Signing algorithm:', context.algorithm);
+    console.log('Payload size:', context.payload.length);
+    
+    // Use context information for signing
+    const signature = await externalSigningService.signWithContext({
+      data: context.data,
+      algorithm: context.algorithm,
+      // ... other context data
+    });
+    return new Uint8Array(signature);
+  };
+  // Mark as contextual signer
+  (contextualSigner as any).isContextualSigner = true;
+
+  const document = await new Document("org.iso.18013.5.1.mDL")
+    .addIssuerNameSpace("org.iso.18013.5.1", {
+      family_name: "Jones",
+      given_name: "Ava",
+      birth_date: "2007-03-25",
+    })
+    .useDigestAlgorithm("SHA-256")
+    .addValidityInfo({
+      signed: new Date(),
+    })
+    .addDeviceKeyInfo({ deviceKey: publicKeyJWK })
+    .sign({
+      signer: basicSigner, // or contextualSigner
+      issuerCertificate,
+      alg: 'ES256',
+    });
+
+  const mdoc = new MDoc([document]).encode();
+})();
+```
+
+### Real-world examples
+
+#### AWS KMS Integration
+```js
+import { KMSClient, SignCommand } from "@aws-sdk/client-kms";
+import { CoseSign1Signer } from "@vess-id/mdl";
+
+const kmsClient = new KMSClient({ region: "us-east-1" });
+
+const kmsSigner: CoseSign1Signer = async (data: Uint8Array) => {
+  const command = new SignCommand({
+    KeyId: "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012",
+    Message: data,
+    SigningAlgorithm: "ECDSA_SHA_256",
+  });
+  
+  const response = await kmsClient.send(command);
+  return new Uint8Array(response.Signature!);
+};
+```
+
+#### Hardware Security Module (HSM)
+```js
+import { CoseSign1Signer } from "@vess-id/mdl";
+
+const hsmSigner: CoseSign1Signer = async (data: Uint8Array) => {
+  // Example using PKCS#11
+  const session = await hsm.openSession();
+  try {
+    const signature = await session.sign({
+      mechanism: "ECDSA",
+      data: data,
+      keyHandle: privateKeyHandle,
+    });
+    return new Uint8Array(signature);
+  } finally {
+    await session.close();
+  }
+};
+```
+
 ## Generating a device response
 
 ```js

package/lib/index.d.ts

@@ -10,3 +10,4 @@ export { DeviceResponse } from './mdoc/model/DeviceResponse';
 export { MDLError, MDLParseError } from './mdoc/errors';
 export { VerificationAssessmentId } from './mdoc/checkCallback';
 export { getCborEncodeDecodeOptions, setCborEncodeDecodeOptions } from './cbor';
+export { CoseSign1Signer, CoseSign1ContextualSigner, CoseSign1SignerCallback, CoseSign1SigningContext, SupportedAlgs } from './mdoc/model/types';

package/lib/mdoc/model/Document.d.ts

@@ -1,5 +1,5 @@
 import * as jose from 'jose';
-import { DigestAlgorithm, DocType, SupportedAlgs, ValidityInfo } from './types';
+import { DigestAlgorithm, DocType, SupportedAlgs, ValidityInfo, CoseSign1SignerCallback } from './types';
 import { IssuerSignedDocument } from './IssuerSignedDocument';
 /**
  * Use this class when building new documents.
@@ -67,7 +67,8 @@ export declare class Document {
      * @returns {Promise<IssuerSignedDoc>} - The signed document
      */
     sign(params: {
-        issuerPrivateKey: jose.JWK | Uint8Array;
+        issuerPrivateKey?: jose.JWK | Uint8Array;
+        signer?: CoseSign1SignerCallback;
         issuerCertificate: string | Uint8Array | Array<string | Uint8Array>;
         alg: SupportedAlgs;
         kid?: string | Uint8Array;

package/lib/mdoc/model/Document.js

@@ -200,6 +200,13 @@ class Document {
         if (!__classPrivateFieldGet(this, _Document_issuerNameSpaces, "f")) {
             throw new Error('No namespaces added');
         }
+        // Validate that either issuerPrivateKey or signer is provided, but not both
+        if (!params.issuerPrivateKey && !params.signer) {
+            throw new Error('Either issuerPrivateKey or signer must be provided');
+        }
+        if (params.issuerPrivateKey && params.signer) {
+            throw new Error('Cannot provide both issuerPrivateKey and signer');
+        }
         let issuerCertificateChain;
         if (Array.isArray(params.issuerCertificate)) {
             issuerCertificateChain = params.issuerCertificate.flatMap((cert) => (typeof cert === 'string' ? (0, utils_1.fromPEM)(cert) : [cert]));
@@ -210,10 +217,14 @@ class Document {
         else {
             issuerCertificateChain = [params.issuerCertificate];
         }
-        const issuerPrivateKeyJWK = params.issuerPrivateKey instanceof Uint8Array ?
-            (0, cose_kit_1.COSEKeyToJWK)(params.issuerPrivateKey) :
-            params.issuerPrivateKey;
-        const issuerPrivateKey = await jose.importJWK(issuerPrivateKeyJWK);
+        let issuerPrivateKeyJWK;
+        let issuerPrivateKey;
+        if (params.issuerPrivateKey) {
+            issuerPrivateKeyJWK = params.issuerPrivateKey instanceof Uint8Array ?
+                (0, cose_kit_1.COSEKeyToJWK)(params.issuerPrivateKey) :
+                params.issuerPrivateKey;
+            issuerPrivateKey = await jose.importJWK(issuerPrivateKeyJWK);
+        }
         const valueDigests = new Map(await Promise.all(Object.entries(__classPrivateFieldGet(this, _Document_issuerNameSpaces, "f")).map(async ([namespace, items]) => {
             const digestMap = new Map();
             await Promise.all(items.map(async (item, index) => {
@@ -233,10 +244,18 @@ class Document {
         const payload = (0, cbor_1.cborEncode)(cbor_1.DataItem.fromData(mso));
         const protectedHeader = { alg: params.alg };
         const unprotectedHeader = {
-            kid: params.kid ?? issuerPrivateKeyJWK.kid,
+            kid: params.kid ?? issuerPrivateKeyJWK?.kid,
             x5chain: issuerCertificateChain.length === 1 ? issuerCertificateChain[0] : issuerCertificateChain,
         };
-        const issuerAuth = await IssuerAuth_1.default.sign(protectedHeader, unprotectedHeader, payload, issuerPrivateKey);
+        let issuerAuth;
+        if (params.signer) {
+            // Use the callback signer
+            issuerAuth = await IssuerAuth_1.default.signWithCallback(protectedHeader, unprotectedHeader, payload, params.signer, params.alg);
+        }
+        else {
+            // Use the traditional private key signing
+            issuerAuth = await IssuerAuth_1.default.sign(protectedHeader, unprotectedHeader, payload, issuerPrivateKey);
+        }
         const issuerSigned = {
             issuerAuth,
             nameSpaces: __classPrivateFieldGet(this, _Document_issuerNameSpaces, "f"),
@@ -246,4 +265,4 @@ class Document {
 }
 exports.Document = Document;
 _Document_issuerNameSpaces = new WeakMap(), _Document_deviceKeyInfo = new WeakMap(), _Document_validityInfo = new WeakMap(), _Document_digestAlgorithm = new WeakMap();
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiRG9jdW1lbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvbWRvYy9tb2RlbC9Eb2N1bWVudC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSwyQ0FBNkI7QUFDN0IsdUNBQThGO0FBQzlGLG9DQUFtQztBQUNuQyxxQ0FBd0U7QUFDeEUsMERBQXVEO0FBQ3ZELDhEQUFzQztBQUV0QyxpRUFBOEQ7QUFFOUQsTUFBTSxVQUFVLEdBQUcsbUJBQW1CLENBQUM7QUFFdkMsTUFBTSxRQUFRLEdBQUcsQ0FBQyxJQUFVLEVBQUUsS0FBYSxFQUFRLEVBQUU7SUFDbkQsTUFBTSxDQUFDLEdBQUcsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUM7SUFDbkMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLEdBQUcsS0FBSyxDQUFDLENBQUM7SUFDMUMsT0FBTyxDQUFDLENBQUM7QUFDWCxDQUFDLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBYSxRQUFRO0lBV25CLFlBQVksTUFBZSx1QkFBdUI7UUFUbEQscUNBQXNDLEVBQUUsRUFBQztRQUN6QywwQ0FBOEI7UUFDOUIsaUNBQThCO1lBQzVCLE1BQU0sRUFBRSxJQUFJLElBQUksRUFBRTtZQUNsQixTQUFTLEVBQUUsSUFBSSxJQUFJLEVBQUU7WUFDckIsVUFBVSxFQUFFLFFBQVEsQ0FBQyxJQUFJLElBQUksRUFBRSxFQUFFLENBQUMsQ0FBQztTQUNwQyxFQUFDO1FBQ0Ysb0NBQW9DLFNBQVMsRUFBQztRQUc1QyxJQUFJLENBQUMsT0FBTyxHQUFHLEdBQUcsQ0FBQztJQUNyQixDQUFDO0lBRUQsNkRBQTZEO0lBQ3JELGNBQWMsQ0FBQyxNQUEyQjtRQUNoRCxPQUFPO1FBQ1AsZ0VBQWdFO0lBQ2xFLENBQUM7SUFFRDs7Ozs7O09BTUc7SUFDSCxrQkFBa0IsQ0FBQyxTQUF1QyxFQUFFLE1BQTJCO1FBQ3JGLElBQUksU0FBUyxLQUFLLFVBQVUsRUFBRSxDQUFDO1lBQzdCLElBQUksQ0FBQyxjQUFjLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDOUIsQ0FBQztRQUVELHVCQUFBLElBQUksa0NBQWtCLENBQUMsU0FBUyxDQUFDLEdBQUcsdUJBQUEsSUFBSSxrQ0FBa0IsQ0FBQyxTQUFTLENBQUMsSUFBSSxFQUFFLENBQUM7UUFFNUUsTUFBTSxZQUFZLEdBQUcsQ0FBQyxHQUFXLEVBQUUsS0FBVSxFQUFFLEVBQUU7WUFDL0MsSUFBSSxZQUFZLEdBQUcsS0FBSyxDQUFDO1lBRXpCLElBQUksU0FBUyxLQUFLLFVBQVUsRUFBRSxDQUFDO2dCQUM3QixrRkFBa0Y7Z0JBQ2xGLElBQUksQ0FBQyxZQUFZLEVBQUUsWUFBWSxFQUFFLGFBQWEsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLEVBQUUsQ0FBQztvQkFDM0YsWUFBWSxHQUFHLElBQUksZUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDO2dCQUNyQyxDQUFDO2dCQUVELElBQUksR0FBRyxLQUFLLG9CQUFvQixJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztvQkFDekQsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLEVBQUUsRUFBRTt3QkFDckIsSUFBSSxPQUFPLENBQUMsQ0FBQyxVQUFVLEtBQUssUUFBUSxFQUFFLENBQUM7NEJBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxDQUFDLFVBQVUsR0FBRyxJQUFJLGVBQVEsQ0FBQyxDQUFDLENBQUMsVUFBVSxDQUFDLENBQUM7d0JBQUMsQ0FBQzt3QkFDbEcsSUFBSSxPQUFPLENBQUMsQ0FBQyxXQUFXLEtBQUssUUFBUSxFQUFFLENBQUM7NEJBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxDQUFDLFdBQVcsR0FBRyxJQUFJLGVBQVEsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLENBQUM7d0JBQUMsQ0FBQztvQkFDdkcsQ0FBQyxDQUFDLENBQUM7Z0JBQ0wsQ0FBQztZQUNILENBQUM7WUFFRCxNQUFNLFFBQVEsR0FBRyx1QkFBQSxJQUFJLGtDQUFrQixDQUFDLFNBQVMsQ0FBQyxDQUFDLE1BQU0sQ0FBQztZQUMxRCxNQUFNLGdCQUFnQixHQUFHLG1DQUFnQixDQUFDLE1BQU0sQ0FBQyxRQUFRLEVBQUUsR0FBRyxFQUFFLFlBQVksQ0FBQyxDQUFDO1lBQzlFLHVCQUFBLElBQUksa0NBQWtCLENBQUMsU0FBUyxDQUFDLENBQUMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLENBQUM7UUFDM0QsQ0FBQyxDQUFDO1FBRUYsS0FBSyxNQUFNLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxJQUFJLE1BQU0sQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztZQUNsRCxZQUFZLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQzNCLENBQUM7UUFFRCxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFRDs7Ozs7T0FLRztJQUNILGtCQUFrQixDQUFDLFNBQWlCO1FBQ2xDLE1BQU0sU0FBUyxHQUFHLHVCQUFBLElBQUksa0NBQWtCLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDcEQsT0FBTyxNQUFNLENBQUMsV0FBVyxDQUN2QixTQUFTLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxJQUFJLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FDckUsQ0FBQztJQUNKLENBQUM7SUFFRDs7Ozs7O09BTUc7SUFDSCxnQkFBZ0IsQ0FBQyxFQUFFLFNBQVMsRUFBd0M7UUFDbEUsTUFBTSxnQkFBZ0IsR0FDcEIsU0FBUyxZQUFZLFVBQVUsQ0FBQyxDQUFDO1lBQy9CLFNBQVMsQ0FBQyxDQUFDO1lBQ1gsSUFBQSx5QkFBYyxFQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzlCLE1BQU0sY0FBYyxHQUFHLElBQUEsaUJBQVUsRUFBQyxnQkFBZ0IsQ0FBQyxDQUFDO1FBRXBELHVCQUFBLElBQUksMkJBQWtCO1lBQ3BCLFNBQVMsRUFBRSxjQUFjO1NBQzFCLE1BQUEsQ0FBQztRQUVGLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUVEOzs7Ozs7Ozs7T0FTRztJQUNILGVBQWUsQ0FBQyxPQUE4QixFQUFFO1FBQzlDLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxNQUFNLElBQUksSUFBSSxJQUFJLEVBQUUsQ0FBQztRQUN6QyxNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsU0FBUyxJQUFJLE1BQU0sQ0FBQztRQUMzQyxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsVUFBVSxJQUFJLFFBQVEsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDMUQsdUJBQUEsSUFBSSwwQkFBaUI7WUFDbkIsTUFBTTtZQUNOLFNBQVM7WUFDVCxVQUFVO1NBQ1gsTUFBQSxDQUFDO1FBRUYsSUFBSSxJQUFJLENBQUMsY0FBYyxFQUFFLENBQUM7WUFDeEIsdUJBQUEsSUFBSSw4QkFBYyxDQUFDLGNBQWMsR0FBRyxJQUFJLENBQUMsY0FBYyxDQUFDO1FBQzFELENBQUM7UUFFRCxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFRDs7Ozs7OztPQU9HO0lBQ0gsa0JBQWtCLENBQUMsZUFBZ0M7UUFDakQsdUJBQUEsSUFBSSw2QkFBb0IsZUFBZSxNQUFBLENBQUM7UUFDeEMsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRUQ7Ozs7Ozs7OztPQVNHO0lBQ0gsS0FBSyxDQUFDLElBQUksQ0FBQyxNQUtWO1FBQ0MsSUFBSSxDQUFDLHVCQUFBLElBQUksa0NBQWtCLEVBQUUsQ0FBQztZQUM1QixNQUFNLElBQUksS0FBSyxDQUFDLHFCQUFxQixDQUFDLENBQUM7UUFDekMsQ0FBQztRQUVELElBQUksc0JBQW9DLENBQUM7UUFFekMsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxpQkFBaUIsQ0FBQyxFQUFFLENBQUM7WUFDNUMsc0JBQXNCLEdBQUcsTUFBTSxDQUFDLGlCQUFpQixDQUFDLE9BQU8sQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsQ0FBQyxPQUFPLElBQUksS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLElBQUEsZUFBTyxFQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUMzSCxDQUFDO2FBQU0sSUFBSSxPQUFPLE1BQU0sQ0FBQyxpQkFBaUIsS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUN4RCxzQkFBc0IsR0FBRyxJQUFBLGVBQU8sRUFBQyxNQUFNLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUM3RCxDQUFDO2FBQU0sQ0FBQztZQUNOLHNCQUFzQixHQUFHLENBQUMsTUFBTSxDQUFDLGlCQUFpQixDQUFDLENBQUM7UUFDdEQsQ0FBQztRQUVELE1BQU0sbUJBQW1CLEdBQUcsTUFBTSxDQUFDLGdCQUFnQixZQUFZLFVBQVUsQ0FBQyxDQUFDO1lBQ3pFLElBQUEsdUJBQVksRUFBQyxNQUFNLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDO1lBQ3ZDLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQztRQUUxQixNQUFNLGdCQUFnQixHQUFHLE1BQU0sSUFBSSxDQUFDLFNBQVMsQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDO1FBRW5FLE1BQU0sWUFBWSxHQUFHLElBQUksR0FBRyxDQUFDLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLHVCQUFBLElBQUksa0NBQWtCLENBQUMsQ0FBQyxHQUFHLENBQUMsS0FBSyxFQUFFLENBQUMsU0FBUyxFQUFFLEtBQUssQ0FBQyxFQUFFLEVBQUU7WUFDckgsTUFBTSxTQUFTLEdBQUcsSUFBSSxHQUFHLEVBQXNCLENBQUM7WUFDaEQsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsS0FBSyxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsRUFBRTtnQkFDaEQsTUFBTSxJQUFJLEdBQUcsTUFBTSxJQUFJLENBQUMsZUFBZSxDQUFDLHVCQUFBLElBQUksaUNBQWlCLENBQUMsQ0FBQztnQkFDL0QsU0FBUyxDQUFDLEdBQUcsQ0FBQyxLQUFLLEVBQUUsSUFBSSxVQUFVLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztZQUM3QyxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQ0osT0FBTyxDQUFDLFNBQVMsRUFBRSxTQUFTLENBQXNDLENBQUM7UUFDckUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBRUwsTUFBTSxHQUFHLEdBQVE7WUFDZixPQUFPLEVBQUUsS0FBSztZQUNkLGVBQWUsRUFBRSx1QkFBQSxJQUFJLGlDQUFpQjtZQUN0QyxZQUFZO1lBQ1osYUFBYSxFQUFFLHVCQUFBLElBQUksK0JBQWU7WUFDbEMsT0FBTyxFQUFFLElBQUksQ0FBQyxPQUFPO1lBQ3JCLFlBQVksRUFBRSx1QkFBQSxJQUFJLDhCQUFjO1NBQ2pDLENBQUM7UUFFRixNQUFNLE9BQU8sR0FBRyxJQUFBLGlCQUFVLEVBQUMsZUFBUSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO1FBQ25ELE1BQU0sZUFBZSxHQUFxQixFQUFFLEdBQUcsRUFBRSxNQUFNLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDOUQsTUFBTSxpQkFBaUIsR0FBdUI7WUFDNUMsR0FBRyxFQUFFLE1BQU0sQ0FBQyxHQUFHLElBQUksbUJBQW1CLENBQUMsR0FBRztZQUMxQyxPQUFPLEVBQUUsc0JBQXNCLENBQUMsTUFBTSxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsc0JBQXNCLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLHNCQUFzQjtTQUNsRyxDQUFDO1FBRUYsTUFBTSxVQUFVLEdBQUcsTUFBTSxvQkFBVSxDQUFDLElBQUksQ0FDdEMsZUFBZSxFQUNmLGlCQUFpQixFQUNqQixPQUFPLEVBQ1AsZ0JBQWdCLENBQ2pCLENBQUM7UUFFRixNQUFNLFlBQVksR0FBRztZQUNuQixVQUFVO1lBQ1YsVUFBVSxFQUFFLHVCQUFBLElBQUksa0NBQWtCO1NBQ25DLENBQUM7UUFFRixPQUFPLElBQUksMkNBQW9CLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxZQUFZLENBQUMsQ0FBQztJQUM5RCxDQUFDO0NBQ0Y7QUFyTkQsNEJBcU5DIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiRG9jdW1lbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvbWRvYy9tb2RlbC9Eb2N1bWVudC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSwyQ0FBNkI7QUFFN0IsdUNBQThGO0FBQzlGLG9DQUFtQztBQUNuQyxxQ0FBd0U7QUFDeEUsMERBQXVEO0FBQ3ZELDhEQUFzQztBQUV0QyxpRUFBOEQ7QUFFOUQsTUFBTSxVQUFVLEdBQUcsbUJBQW1CLENBQUM7QUFFdkMsTUFBTSxRQUFRLEdBQUcsQ0FBQyxJQUFVLEVBQUUsS0FBYSxFQUFRLEVBQUU7SUFDbkQsTUFBTSxDQUFDLEdBQUcsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUM7SUFDbkMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLEdBQUcsS0FBSyxDQUFDLENBQUM7SUFDMUMsT0FBTyxDQUFDLENBQUM7QUFDWCxDQUFDLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBYSxRQUFRO0lBV25CLFlBQVksTUFBZSx1QkFBdUI7UUFUbEQscUNBQXNDLEVBQUUsRUFBQztRQUN6QywwQ0FBOEI7UUFDOUIsaUNBQThCO1lBQzVCLE1BQU0sRUFBRSxJQUFJLElBQUksRUFBRTtZQUNsQixTQUFTLEVBQUUsSUFBSSxJQUFJLEVBQUU7WUFDckIsVUFBVSxFQUFFLFFBQVEsQ0FBQyxJQUFJLElBQUksRUFBRSxFQUFFLENBQUMsQ0FBQztTQUNwQyxFQUFDO1FBQ0Ysb0NBQW9DLFNBQVMsRUFBQztRQUc1QyxJQUFJLENBQUMsT0FBTyxHQUFHLEdBQUcsQ0FBQztJQUNyQixDQUFDO0lBRUQsNkRBQTZEO0lBQ3JELGNBQWMsQ0FBQyxNQUEyQjtRQUNoRCxPQUFPO1FBQ1AsZ0VBQWdFO0lBQ2xFLENBQUM7SUFFRDs7Ozs7O09BTUc7SUFDSCxrQkFBa0IsQ0FBQyxTQUF1QyxFQUFFLE1BQTJCO1FBQ3JGLElBQUksU0FBUyxLQUFLLFVBQVUsRUFBRSxDQUFDO1lBQzdCLElBQUksQ0FBQyxjQUFjLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDOUIsQ0FBQztRQUVELHVCQUFBLElBQUksa0NBQWtCLENBQUMsU0FBUyxDQUFDLEdBQUcsdUJBQUEsSUFBSSxrQ0FBa0IsQ0FBQyxTQUFTLENBQUMsSUFBSSxFQUFFLENBQUM7UUFFNUUsTUFBTSxZQUFZLEdBQUcsQ0FBQyxHQUFXLEVBQUUsS0FBVSxFQUFFLEVBQUU7WUFDL0MsSUFBSSxZQUFZLEdBQUcsS0FBSyxDQUFDO1lBRXpCLElBQUksU0FBUyxLQUFLLFVBQVUsRUFBRSxDQUFDO2dCQUM3QixrRkFBa0Y7Z0JBQ2xGLElBQUksQ0FBQyxZQUFZLEVBQUUsWUFBWSxFQUFFLGFBQWEsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLEVBQUUsQ0FBQztvQkFDM0YsWUFBWSxHQUFHLElBQUksZUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDO2dCQUNyQyxDQUFDO2dCQUVELElBQUksR0FBRyxLQUFLLG9CQUFvQixJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztvQkFDekQsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLEVBQUUsRUFBRTt3QkFDckIsSUFBSSxPQUFPLENBQUMsQ0FBQyxVQUFVLEtBQUssUUFBUSxFQUFFLENBQUM7NEJBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxDQUFDLFVBQVUsR0FBRyxJQUFJLGVBQVEsQ0FBQyxDQUFDLENBQUMsVUFBVSxDQUFDLENBQUM7d0JBQUMsQ0FBQzt3QkFDbEcsSUFBSSxPQUFPLENBQUMsQ0FBQyxXQUFXLEtBQUssUUFBUSxFQUFFLENBQUM7NEJBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxDQUFDLFdBQVcsR0FBRyxJQUFJLGVBQVEsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLENBQUM7d0JBQUMsQ0FBQztvQkFDdkcsQ0FBQyxDQUFDLENBQUM7Z0JBQ0wsQ0FBQztZQUNILENBQUM7WUFFRCxNQUFNLFFBQVEsR0FBRyx1QkFBQSxJQUFJLGtDQUFrQixDQUFDLFNBQVMsQ0FBQyxDQUFDLE1BQU0sQ0FBQztZQUMxRCxNQUFNLGdCQUFnQixHQUFHLG1DQUFnQixDQUFDLE1BQU0sQ0FBQyxRQUFRLEVBQUUsR0FBRyxFQUFFLFlBQVksQ0FBQyxDQUFDO1lBQzlFLHVCQUFBLElBQUksa0NBQWtCLENBQUMsU0FBUyxDQUFDLENBQUMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLENBQUM7UUFDM0QsQ0FBQyxDQUFDO1FBRUYsS0FBSyxNQUFNLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxJQUFJLE1BQU0sQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztZQUNsRCxZQUFZLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQzNCLENBQUM7UUFFRCxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFRDs7Ozs7T0FLRztJQUNILGtCQUFrQixDQUFDLFNBQWlCO1FBQ2xDLE1BQU0sU0FBUyxHQUFHLHVCQUFBLElBQUksa0NBQWtCLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDcEQsT0FBTyxNQUFNLENBQUMsV0FBVyxDQUN2QixTQUFTLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxJQUFJLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FDckUsQ0FBQztJQUNKLENBQUM7SUFFRDs7Ozs7O09BTUc7SUFDSCxnQkFBZ0IsQ0FBQyxFQUFFLFNBQVMsRUFBd0M7UUFDbEUsTUFBTSxnQkFBZ0IsR0FDcEIsU0FBUyxZQUFZLFVBQVUsQ0FBQyxDQUFDO1lBQy9CLFNBQVMsQ0FBQyxDQUFDO1lBQ1gsSUFBQSx5QkFBYyxFQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzlCLE1BQU0sY0FBYyxHQUFHLElBQUEsaUJBQVUsRUFBQyxnQkFBZ0IsQ0FBQyxDQUFDO1FBRXBELHVCQUFBLElBQUksMkJBQWtCO1lBQ3BCLFNBQVMsRUFBRSxjQUFjO1NBQzFCLE1BQUEsQ0FBQztRQUVGLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUVEOzs7Ozs7Ozs7T0FTRztJQUNILGVBQWUsQ0FBQyxPQUE4QixFQUFFO1FBQzlDLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxNQUFNLElBQUksSUFBSSxJQUFJLEVBQUUsQ0FBQztRQUN6QyxNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsU0FBUyxJQUFJLE1BQU0sQ0FBQztRQUMzQyxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsVUFBVSxJQUFJLFFBQVEsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDMUQsdUJBQUEsSUFBSSwwQkFBaUI7WUFDbkIsTUFBTTtZQUNOLFNBQVM7WUFDVCxVQUFVO1NBQ1gsTUFBQSxDQUFDO1FBRUYsSUFBSSxJQUFJLENBQUMsY0FBYyxFQUFFLENBQUM7WUFDeEIsdUJBQUEsSUFBSSw4QkFBYyxDQUFDLGNBQWMsR0FBRyxJQUFJLENBQUMsY0FBYyxDQUFDO1FBQzFELENBQUM7UUFFRCxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFRDs7Ozs7OztPQU9HO0lBQ0gsa0JBQWtCLENBQUMsZUFBZ0M7UUFDakQsdUJBQUEsSUFBSSw2QkFBb0IsZUFBZSxNQUFBLENBQUM7UUFDeEMsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRUQ7Ozs7Ozs7OztPQVNHO0lBQ0gsS0FBSyxDQUFDLElBQUksQ0FBQyxNQU1WO1FBQ0MsSUFBSSxDQUFDLHVCQUFBLElBQUksa0NBQWtCLEVBQUUsQ0FBQztZQUM1QixNQUFNLElBQUksS0FBSyxDQUFDLHFCQUFxQixDQUFDLENBQUM7UUFDekMsQ0FBQztRQUVELDRFQUE0RTtRQUM1RSxJQUFJLENBQUMsTUFBTSxDQUFDLGdCQUFnQixJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQy9DLE1BQU0sSUFBSSxLQUFLLENBQUMsb0RBQW9ELENBQUMsQ0FBQztRQUN4RSxDQUFDO1FBQ0QsSUFBSSxNQUFNLENBQUMsZ0JBQWdCLElBQUksTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQzdDLE1BQU0sSUFBSSxLQUFLLENBQUMsaURBQWlELENBQUMsQ0FBQztRQUNyRSxDQUFDO1FBRUQsSUFBSSxzQkFBb0MsQ0FBQztRQUV6QyxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLGlCQUFpQixDQUFDLEVBQUUsQ0FBQztZQUM1QyxzQkFBc0IsR0FBRyxNQUFNLENBQUMsaUJBQWlCLENBQUMsT0FBTyxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxDQUFDLE9BQU8sSUFBSSxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsSUFBQSxlQUFPLEVBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQzNILENBQUM7YUFBTSxJQUFJLE9BQU8sTUFBTSxDQUFDLGlCQUFpQixLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQ3hELHNCQUFzQixHQUFHLElBQUEsZUFBTyxFQUFDLE1BQU0sQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1FBQzdELENBQUM7YUFBTSxDQUFDO1lBQ04sc0JBQXNCLEdBQUcsQ0FBQyxNQUFNLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUN0RCxDQUFDO1FBRUQsSUFBSSxtQkFBeUMsQ0FBQztRQUM5QyxJQUFJLGdCQUFxQyxDQUFDO1FBRTFDLElBQUksTUFBTSxDQUFDLGdCQUFnQixFQUFFLENBQUM7WUFDNUIsbUJBQW1CLEdBQUcsTUFBTSxDQUFDLGdCQUFnQixZQUFZLFVBQVUsQ0FBQyxDQUFDO2dCQUNuRSxJQUFBLHVCQUFZLEVBQUMsTUFBTSxDQUFDLGdCQUFnQixDQUFDLENBQUMsQ0FBQztnQkFDdkMsTUFBTSxDQUFDLGdCQUFnQixDQUFDO1lBQzFCLGdCQUFnQixHQUFHLE1BQU0sSUFBSSxDQUFDLFNBQVMsQ0FBQyxtQkFBbUIsQ0FBWSxDQUFDO1FBQzFFLENBQUM7UUFFRCxNQUFNLFlBQVksR0FBRyxJQUFJLEdBQUcsQ0FBQyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyx1QkFBQSxJQUFJLGtDQUFrQixDQUFDLENBQUMsR0FBRyxDQUFDLEtBQUssRUFBRSxDQUFDLFNBQVMsRUFBRSxLQUFLLENBQUMsRUFBRSxFQUFFO1lBQ3JILE1BQU0sU0FBUyxHQUFHLElBQUksR0FBRyxFQUFzQixDQUFDO1lBQ2hELE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEtBQUssRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLEVBQUU7Z0JBQ2hELE1BQU0sSUFBSSxHQUFHLE1BQU0sSUFBSSxDQUFDLGVBQWUsQ0FBQyx1QkFBQSxJQUFJLGlDQUFpQixDQUFDLENBQUM7Z0JBQy9ELFNBQVMsQ0FBQyxHQUFHLENBQUMsS0FBSyxFQUFFLElBQUksVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7WUFDN0MsQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUNKLE9BQU8sQ0FBQyxTQUFTLEVBQUUsU0FBUyxDQUFzQyxDQUFDO1FBQ3JFLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUVMLE1BQU0sR0FBRyxHQUFRO1lBQ2YsT0FBTyxFQUFFLEtBQUs7WUFDZCxlQUFlLEVBQUUsdUJBQUEsSUFBSSxpQ0FBaUI7WUFDdEMsWUFBWTtZQUNaLGFBQWEsRUFBRSx1QkFBQSxJQUFJLCtCQUFlO1lBQ2xDLE9BQU8sRUFBRSxJQUFJLENBQUMsT0FBTztZQUNyQixZQUFZLEVBQUUsdUJBQUEsSUFBSSw4QkFBYztTQUNqQyxDQUFDO1FBRUYsTUFBTSxPQUFPLEdBQUcsSUFBQSxpQkFBVSxFQUFDLGVBQVEsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztRQUNuRCxNQUFNLGVBQWUsR0FBcUIsRUFBRSxHQUFHLEVBQUUsTUFBTSxDQUFDLEdBQUcsRUFBRSxDQUFDO1FBQzlELE1BQU0saUJBQWlCLEdBQXVCO1lBQzVDLEdBQUcsRUFBRSxNQUFNLENBQUMsR0FBRyxJQUFJLG1CQUFtQixFQUFFLEdBQUc7WUFDM0MsT0FBTyxFQUFFLHNCQUFzQixDQUFDLE1BQU0sS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLHNCQUFzQixDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxzQkFBc0I7U0FDbEcsQ0FBQztRQUVGLElBQUksVUFBc0IsQ0FBQztRQUUzQixJQUFJLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNsQiwwQkFBMEI7WUFDMUIsVUFBVSxHQUFHLE1BQU0sb0JBQVUsQ0FBQyxnQkFBZ0IsQ0FDNUMsZUFBZSxFQUNmLGlCQUFpQixFQUNqQixPQUFPLEVBQ1AsTUFBTSxDQUFDLE1BQU0sRUFDYixNQUFNLENBQUMsR0FBRyxDQUNYLENBQUM7UUFDSixDQUFDO2FBQU0sQ0FBQztZQUNOLDBDQUEwQztZQUMxQyxVQUFVLEdBQUcsTUFBTSxvQkFBVSxDQUFDLElBQUksQ0FDaEMsZUFBZSxFQUNmLGlCQUFpQixFQUNqQixPQUFPLEVBQ1AsZ0JBQWlCLENBQ2xCLENBQUM7UUFDSixDQUFDO1FBRUQsTUFBTSxZQUFZLEdBQUc7WUFDbkIsVUFBVTtZQUNWLFVBQVUsRUFBRSx1QkFBQSxJQUFJLGtDQUFrQjtTQUNuQyxDQUFDO1FBRUYsT0FBTyxJQUFJLDJDQUFvQixDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsWUFBWSxDQUFDLENBQUM7SUFDOUQsQ0FBQztDQUNGO0FBaFBELDRCQWdQQyJ9

package/lib/mdoc/model/IssuerAuth.d.ts

@@ -1,7 +1,7 @@
 import { ProtectedHeaders, Sign1, UnprotectedHeaders } from 'cose-kit';
 import { X509Certificate } from '@peculiar/x509';
 import { KeyLike } from 'jose';
-import { MSO } from './types';
+import { MSO, CoseSign1SignerCallback, SupportedAlgs } from './types';
 /**
  * The IssuerAuth which is a COSE_Sign1 message
  * as defined in https://www.iana.org/assignments/cose/cose.xhtml#messages
@@ -14,4 +14,9 @@ export default class IssuerAuth extends Sign1 {
     get countryName(): string;
     get stateOrProvince(): string;
     static sign(protectedHeaders: ProtectedHeaders, unprotectedHeaders: UnprotectedHeaders | undefined, payload: Uint8Array, key: KeyLike | Uint8Array): Promise<IssuerAuth>;
+    /**
+     * Sign using a callback signer for COSE_Sign1
+     * This allows external signing (HSM, remote signing, etc.) without exposing private keys
+     */
+    static signWithCallback(protectedHeaders: ProtectedHeaders, unprotectedHeaders: UnprotectedHeaders | undefined, payload: Uint8Array, signer: CoseSign1SignerCallback, algorithm: SupportedAlgs): Promise<IssuerAuth>;
 }

package/lib/mdoc/model/IssuerAuth.js

@@ -44,8 +44,12 @@ class IssuerAuth extends cose_kit_1.Sign1 {
         const result = {
             ...decoded,
             validityInfo: mapValidityInfo(decoded.validityInfo),
-            validityDigests: decoded.validityDigests ? Object.fromEntries(decoded.validityDigests) : decoded.validityDigests,
-            deviceKeyInfo: decoded.deviceKeyInfo ? Object.fromEntries(decoded.deviceKeyInfo) : decoded.deviceKeyInfo,
+            validityDigests: decoded.validityDigests
+                ? Object.fromEntries(decoded.validityDigests)
+                : decoded.validityDigests,
+            deviceKeyInfo: decoded.deviceKeyInfo
+                ? Object.fromEntries(decoded.deviceKeyInfo)
+                : decoded.deviceKeyInfo,
         };
         __classPrivateFieldSet(this, _IssuerAuth_decodedPayload, result, "f");
         return result;
@@ -66,7 +70,76 @@ class IssuerAuth extends cose_kit_1.Sign1 {
         const sign1 = await cose_kit_1.Sign1.sign(protectedHeaders, unprotectedHeaders, payload, key);
         return new IssuerAuth(sign1.protectedHeaders, sign1.unprotectedHeaders, sign1.payload, sign1.signature);
     }
+    /**
+     * Sign using a callback signer for COSE_Sign1
+     * This allows external signing (HSM, remote signing, etc.) without exposing private keys
+     */
+    static async signWithCallback(protectedHeaders, unprotectedHeaders, payload, signer, algorithm) {
+        // Create the protected headers map and encode it
+        const protectedHeadersMap = new Map(Object.entries(protectedHeaders).map(([key, value]) => {
+            const numericKey = typeof key === 'string' ? parseInt(key, 10) : key;
+            return [numericKey, value];
+        }));
+        // Manually encode protected headers according to COSE specification
+        // Protected headers must be a CBOR-encoded map
+        const encodedProtectedHeaders = (0, cbor_1.cborEncode)(protectedHeadersMap);
+        // Create the Sig_structure as per COSE_Sign1 specification using the private Signature1 method
+        // This creates the data to be signed according to RFC 8152
+        const sigStructure = cose_kit_1.Sign1.Signature1(encodedProtectedHeaders, new Uint8Array(), payload);
+        let signature;
+        // Determine signer type based on marker properties or parameter inspection
+        const signerFunc = signer;
+        if (signerFunc.isContextualSigner) {
+            // Explicitly marked as contextual signer
+            const context = {
+                data: sigStructure,
+                protectedHeaders,
+                unprotectedHeaders,
+                algorithm,
+                payload,
+            };
+            signature = await signer(context);
+        }
+        else if (signerFunc.isBasicSigner || signer.length === 1) {
+            // Explicitly marked as basic signer or has single parameter
+            signature = await signer(sigStructure);
+        }
+        else {
+            // Try contextual first, then fall back to basic
+            try {
+                const context = {
+                    data: sigStructure,
+                    protectedHeaders,
+                    unprotectedHeaders,
+                    algorithm,
+                    payload,
+                };
+                signature = await signer(context);
+            }
+            catch (error) {
+                // If contextual signing failed, try basic signing
+                signature = await signer(sigStructure);
+            }
+        }
+        // Convert unprotected headers to Map if it's an object
+        let unprotectedHeadersMap;
+        if (unprotectedHeaders) {
+            if (unprotectedHeaders instanceof Map) {
+                unprotectedHeadersMap = unprotectedHeaders;
+            }
+            else {
+                unprotectedHeadersMap = new Map(Object.entries(unprotectedHeaders).map(([key, value]) => {
+                    const numericKey = typeof key === 'string' ? parseInt(key, 10) : key;
+                    return [numericKey, value];
+                }));
+            }
+        }
+        else {
+            unprotectedHeadersMap = new Map();
+        }
+        return new IssuerAuth(protectedHeadersMap, unprotectedHeadersMap, payload, signature);
+    }
 }
 _IssuerAuth_decodedPayload = new WeakMap(), _IssuerAuth_certificate = new WeakMap();
 exports.default = IssuerAuth;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiSXNzdWVyQXV0aC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9tZG9jL21vZGVsL0lzc3VlckF1dGgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7QUFBQSx1Q0FBdUU7QUFDdkUseUNBQWlEO0FBRWpELHFDQUF3QztBQUN4QyxrREFBK0M7QUFHL0M7OztHQUdHO0FBQ0gsTUFBcUIsVUFBVyxTQUFRLGdCQUFLO0lBSTNDLFlBQ0UsZUFBa0QsRUFDbEQsaUJBQXVDLEVBQ3ZDLE9BQW1CLEVBQ25CLFNBQXFCO1FBRXJCLEtBQUssQ0FBQyxlQUFlLEVBQUUsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLFNBQVMsQ0FBQyxDQUFDO1FBVGhFLDZDQUFxQjtRQUNyQiwwQ0FBOEI7SUFTOUIsQ0FBQztJQUVELElBQVcsY0FBYztRQUN2QixJQUFJLHVCQUFBLElBQUksa0NBQWdCLEVBQUUsQ0FBQztZQUFDLE9BQU8sdUJBQUEsSUFBSSxrQ0FBZ0IsQ0FBQztRQUFDLENBQUM7UUFDMUQsSUFBSSxPQUFPLEdBQUcsSUFBQSxpQkFBVSxFQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUN2QyxPQUFPLEdBQUcsT0FBTyxZQUFZLG1CQUFRLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQztRQUMvRCxPQUFPLEdBQUcsTUFBTSxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUN0QyxNQUFNLGVBQWUsR0FBRyxDQUFDLFlBQXFDLEVBQUUsRUFBRTtZQUNoRSxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7Z0JBQUMsT0FBTyxZQUFZLENBQUM7WUFBQyxDQUFDO1lBQzNDLE9BQU8sTUFBTSxDQUFDLFdBQVcsQ0FBQyxDQUFDLEdBQUcsWUFBWSxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLEVBQUUsRUFBRTtnQkFDekUsT0FBTyxDQUFDLEdBQUcsRUFBRSxLQUFLLFlBQVksVUFBVSxDQUFDLENBQUMsQ0FBQyxJQUFBLGlCQUFVLEVBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQ3hFLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDTixDQUFDLENBQUM7UUFDRixNQUFNLE1BQU0sR0FBUTtZQUNsQixHQUFHLE9BQU87WUFDVixZQUFZLEVBQUUsZUFBZSxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUM7WUFDbkQsZUFBZSxFQUFFLE9BQU8sQ0FBQyxlQUFlLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLGVBQWUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsZUFBZTtZQUNoSCxhQUFhLEVBQUUsT0FBTyxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxhQUFhO1NBQ3pHLENBQUM7UUFDRix1QkFBQSxJQUFJLDhCQUFtQixNQUFNLE1BQUEsQ0FBQztRQUM5QixPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBRUQsSUFBVyxXQUFXO1FBQ3BCLElBQUksT0FBTyx1QkFBQSxJQUFJLCtCQUFhLEtBQUssV0FBVyxJQUFJLElBQUksQ0FBQyxPQUFPLEVBQUUsTUFBTSxFQUFFLENBQUM7WUFDckUsdUJBQUEsSUFBSSwyQkFBZ0IsSUFBSSxzQkFBZSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBQSxDQUFDO1FBQzNELENBQUM7UUFDRCxPQUFPLHVCQUFBLElBQUksK0JBQWEsQ0FBQztJQUMzQixDQUFDO0lBRUQsSUFBVyxXQUFXO1FBQ3BCLE9BQU8sSUFBSSxDQUFDLFdBQVcsRUFBRSxVQUFVLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3ZELENBQUM7SUFFRCxJQUFXLGVBQWU7UUFDeEIsT0FBTyxJQUFJLENBQUMsV0FBVyxFQUFFLFVBQVUsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDeEQsQ0FBQztJQUVELE1BQU0sQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUNmLGdCQUFrQyxFQUNsQyxrQkFBa0QsRUFDbEQsT0FBbUIsRUFDbkIsR0FBeUI7UUFFekIsTUFBTSxLQUFLLEdBQUcsTUFBTSxnQkFBSyxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsRUFBRSxrQkFBa0IsRUFBRSxPQUFPLEVBQUUsR0FBRyxDQUFDLENBQUM7UUFDbkYsT0FBTyxJQUFJLFVBQVUsQ0FDbkIsS0FBSyxDQUFDLGdCQUFnQixFQUN0QixLQUFLLENBQUMsa0JBQWtCLEVBQ3hCLEtBQUssQ0FBQyxPQUFPLEVBQ2IsS0FBSyxDQUFDLFNBQVMsQ0FDaEIsQ0FBQztJQUNKLENBQUM7Q0FDRjs7a0JBL0RvQixVQUFVIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiSXNzdWVyQXV0aC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9tZG9jL21vZGVsL0lzc3VlckF1dGgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7QUFBQSx1Q0FBdUU7QUFDdkUseUNBQWlEO0FBRWpELHFDQUFvRDtBQUNwRCxrREFBK0M7QUFRL0M7OztHQUdHO0FBQ0gsTUFBcUIsVUFBVyxTQUFRLGdCQUFLO0lBSTNDLFlBQ0UsZUFBa0QsRUFDbEQsaUJBQXVDLEVBQ3ZDLE9BQW1CLEVBQ25CLFNBQXFCO1FBRXJCLEtBQUssQ0FBQyxlQUFlLEVBQUUsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLFNBQVMsQ0FBQyxDQUFDO1FBVGhFLDZDQUFxQjtRQUNyQiwwQ0FBOEI7SUFTOUIsQ0FBQztJQUVELElBQVcsY0FBYztRQUN2QixJQUFJLHVCQUFBLElBQUksa0NBQWdCLEVBQUUsQ0FBQztZQUN6QixPQUFPLHVCQUFBLElBQUksa0NBQWdCLENBQUM7UUFDOUIsQ0FBQztRQUNELElBQUksT0FBTyxHQUFHLElBQUEsaUJBQVUsRUFBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDdkMsT0FBTyxHQUFHLE9BQU8sWUFBWSxtQkFBUSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUM7UUFDL0QsT0FBTyxHQUFHLE1BQU0sQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDdEMsTUFBTSxlQUFlLEdBQUcsQ0FBQyxZQUFxQyxFQUFFLEVBQUU7WUFDaEUsSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDO2dCQUNsQixPQUFPLFlBQVksQ0FBQztZQUN0QixDQUFDO1lBQ0QsT0FBTyxNQUFNLENBQUMsV0FBVyxDQUN2QixDQUFDLEdBQUcsWUFBWSxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLEVBQUUsRUFBRTtnQkFDL0MsT0FBTyxDQUFDLEdBQUcsRUFBRSxLQUFLLFlBQVksVUFBVSxDQUFDLENBQUMsQ0FBQyxJQUFBLGlCQUFVLEVBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQ3hFLENBQUMsQ0FBQyxDQUNILENBQUM7UUFDSixDQUFDLENBQUM7UUFDRixNQUFNLE1BQU0sR0FBUTtZQUNsQixHQUFHLE9BQU87WUFDVixZQUFZLEVBQUUsZUFBZSxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUM7WUFDbkQsZUFBZSxFQUFFLE9BQU8sQ0FBQyxlQUFlO2dCQUN0QyxDQUFDLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsZUFBZSxDQUFDO2dCQUM3QyxDQUFDLENBQUMsT0FBTyxDQUFDLGVBQWU7WUFDM0IsYUFBYSxFQUFFLE9BQU8sQ0FBQyxhQUFhO2dCQUNsQyxDQUFDLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDO2dCQUMzQyxDQUFDLENBQUMsT0FBTyxDQUFDLGFBQWE7U0FDMUIsQ0FBQztRQUNGLHVCQUFBLElBQUksOEJBQW1CLE1BQU0sTUFBQSxDQUFDO1FBQzlCLE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFFRCxJQUFXLFdBQVc7UUFDcEIsSUFBSSxPQUFPLHVCQUFBLElBQUksK0JBQWEsS0FBSyxXQUFXLElBQUksSUFBSSxDQUFDLE9BQU8sRUFBRSxNQUFNLEVBQUUsQ0FBQztZQUNyRSx1QkFBQSxJQUFJLDJCQUFnQixJQUFJLHNCQUFlLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFBLENBQUM7UUFDM0QsQ0FBQztRQUNELE9BQU8sdUJBQUEsSUFBSSwrQkFBYSxDQUFDO0lBQzNCLENBQUM7SUFFRCxJQUFXLFdBQVc7UUFDcEIsT0FBTyxJQUFJLENBQUMsV0FBVyxFQUFFLFVBQVUsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDdkQsQ0FBQztJQUVELElBQVcsZUFBZTtRQUN4QixPQUFPLElBQUksQ0FBQyxXQUFXLEVBQUUsVUFBVSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUN4RCxDQUFDO0lBRUQsTUFBTSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQ2YsZ0JBQWtDLEVBQ2xDLGtCQUFrRCxFQUNsRCxPQUFtQixFQUNuQixHQUF5QjtRQUV6QixNQUFNLEtBQUssR0FBRyxNQUFNLGdCQUFLLENBQUMsSUFBSSxDQUM1QixnQkFBZ0IsRUFDaEIsa0JBQWtCLEVBQ2xCLE9BQU8sRUFDUCxHQUFHLENBQ0osQ0FBQztRQUNGLE9BQU8sSUFBSSxVQUFVLENBQ25CLEtBQUssQ0FBQyxnQkFBZ0IsRUFDdEIsS0FBSyxDQUFDLGtCQUFrQixFQUN4QixLQUFLLENBQUMsT0FBTyxFQUNiLEtBQUssQ0FBQyxTQUFTLENBQ2hCLENBQUM7SUFDSixDQUFDO0lBRUQ7OztPQUdHO0lBQ0gsTUFBTSxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsQ0FDM0IsZ0JBQWtDLEVBQ2xDLGtCQUFrRCxFQUNsRCxPQUFtQixFQUNuQixNQUErQixFQUMvQixTQUF3QjtRQUV4QixpREFBaUQ7UUFDakQsTUFBTSxtQkFBbUIsR0FBRyxJQUFJLEdBQUcsQ0FDakMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxFQUFFLEVBQUU7WUFDcEQsTUFBTSxVQUFVLEdBQUcsT0FBTyxHQUFHLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUM7WUFDckUsT0FBTyxDQUFDLFVBQVUsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUM3QixDQUFDLENBQUMsQ0FDSCxDQUFDO1FBRUYsb0VBQW9FO1FBQ3BFLCtDQUErQztRQUMvQyxNQUFNLHVCQUF1QixHQUFHLElBQUEsaUJBQVUsRUFBQyxtQkFBbUIsQ0FBQyxDQUFDO1FBRWhFLCtGQUErRjtRQUMvRiwyREFBMkQ7UUFDM0QsTUFBTSxZQUFZLEdBQUksZ0JBQWEsQ0FBQyxVQUFVLENBQzVDLHVCQUF1QixFQUN2QixJQUFJLFVBQVUsRUFBRSxFQUNoQixPQUFPLENBQ1IsQ0FBQztRQUVGLElBQUksU0FBcUIsQ0FBQztRQUUxQiwyRUFBMkU7UUFDM0UsTUFBTSxVQUFVLEdBQUcsTUFBYSxDQUFDO1FBQ2pDLElBQUksVUFBVSxDQUFDLGtCQUFrQixFQUFFLENBQUM7WUFDbEMseUNBQXlDO1lBQ3pDLE1BQU0sT0FBTyxHQUE0QjtnQkFDdkMsSUFBSSxFQUFFLFlBQVk7Z0JBQ2xCLGdCQUFnQjtnQkFDaEIsa0JBQWtCO2dCQUNsQixTQUFTO2dCQUNULE9BQU87YUFDUixDQUFDO1lBQ0YsU0FBUyxHQUFHLE1BQ1YsTUFDRCxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ2IsQ0FBQzthQUFNLElBQUksVUFBVSxDQUFDLGFBQWEsSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzNELDREQUE0RDtZQUM1RCxTQUFTLEdBQUcsTUFBTyxNQUFvRCxDQUNyRSxZQUFZLENBQ2IsQ0FBQztRQUNKLENBQUM7YUFBTSxDQUFDO1lBQ04sZ0RBQWdEO1lBQ2hELElBQUksQ0FBQztnQkFDSCxNQUFNLE9BQU8sR0FBNEI7b0JBQ3ZDLElBQUksRUFBRSxZQUFZO29CQUNsQixnQkFBZ0I7b0JBQ2hCLGtCQUFrQjtvQkFDbEIsU0FBUztvQkFDVCxPQUFPO2lCQUNSLENBQUM7Z0JBQ0YsU0FBUyxHQUFHLE1BQ1YsTUFDRCxDQUFDLE9BQU8sQ0FBQyxDQUFDO1lBQ2IsQ0FBQztZQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0JBQ2Ysa0RBQWtEO2dCQUNsRCxTQUFTLEdBQUcsTUFBTyxNQUFvRCxDQUNyRSxZQUFZLENBQ2IsQ0FBQztZQUNKLENBQUM7UUFDSCxDQUFDO1FBRUQsdURBQXVEO1FBQ3ZELElBQUkscUJBQTJDLENBQUM7UUFDaEQsSUFBSSxrQkFBa0IsRUFBRSxDQUFDO1lBQ3ZCLElBQUksa0JBQWtCLFlBQVksR0FBRyxFQUFFLENBQUM7Z0JBQ3RDLHFCQUFxQixHQUFHLGtCQUFrQixDQUFDO1lBQzdDLENBQUM7aUJBQU0sQ0FBQztnQkFDTixxQkFBcUIsR0FBRyxJQUFJLEdBQUcsQ0FDN0IsTUFBTSxDQUFDLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxFQUFFLEVBQUU7b0JBQ3RELE1BQU0sVUFBVSxHQUNaLE9BQU8sR0FBRyxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDO29CQUN0RCxPQUFPLENBQUMsVUFBVSxFQUFFLEtBQUssQ0FBQyxDQUFDO2dCQUM3QixDQUFDLENBQUMsQ0FDSCxDQUFDO1lBQ0osQ0FBQztRQUNILENBQUM7YUFBTSxDQUFDO1lBQ04scUJBQXFCLEdBQUcsSUFBSSxHQUFHLEVBQUUsQ0FBQztRQUNwQyxDQUFDO1FBRUQsT0FBTyxJQUFJLFVBQVUsQ0FDbkIsbUJBQW1CLEVBQ25CLHFCQUFxQixFQUNyQixPQUFPLEVBQ1AsU0FBUyxDQUNWLENBQUM7SUFDSixDQUFDO0NBQ0Y7O2tCQWpMb0IsVUFBVSJ9

package/lib/mdoc/model/types.d.ts

@@ -1,4 +1,4 @@
-import { Mac0, Sign1 } from 'cose-kit';
+import { Mac0, Sign1, ProtectedHeaders, UnprotectedHeaders } from 'cose-kit';
 import { JWK } from 'jose';
 import IssuerAuth from './IssuerAuth';
 import { IssuerSignedDataItem, IssuerSignedItem } from '../IssuerSignedItem';
@@ -20,11 +20,11 @@ export type IssuerSigned = {
     issuerAuth: IssuerAuth;
     nameSpaces: IssuerNameSpaces;
 };
-export type DeviceAuth = {
+export type DeviceAuth = ({
     deviceMac: Mac0;
 } & {
     deviceSignature?: never;
-} | ({
+}) | ({
     deviceMac?: never;
 } & {
     deviceSignature: Sign1;
@@ -107,4 +107,20 @@ export type MSO = {
 export type DocType = 'org.iso.18013.5.1.mDL' | string;
 export type SupportedAlgs = 'ES256' | 'ES384' | 'ES512' | 'EdDSA';
 export type MacSupportedAlgs = 'HS256';
+export interface CoseSign1SigningContext {
+    data: Uint8Array;
+    protectedHeaders: ProtectedHeaders;
+    unprotectedHeaders?: UnprotectedHeaders;
+    algorithm: SupportedAlgs;
+    payload: Uint8Array;
+}
+export interface CoseSign1Signer {
+    (data: Uint8Array): Promise<Uint8Array>;
+    isBasicSigner?: true;
+}
+export interface CoseSign1ContextualSigner {
+    (context: CoseSign1SigningContext): Promise<Uint8Array>;
+    isContextualSigner?: true;
+}
+export type CoseSign1SignerCallback = CoseSign1Signer | CoseSign1ContextualSigner;
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vess-id/mdl",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "description": "Parse and and validate MDOC CBOR encoded binaries according to ISO 18013-5.",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",