{"version":3,"file":"OpenId4VciHolderServiceOptions.mjs","names":[],"sources":["../../src/openid4vc-holder/OpenId4VciHolderServiceOptions.ts"],"sourcesContent":["import type {\n  AgentContext,\n  Kms,\n  MdocRecord,\n  SdJwtVcRecord,\n  W3cCredentialRecord,\n  W3cV2CredentialRecord,\n} from '@credo-ts/core'\nimport type { CredentialOfferObject, IssuerMetadataResult } from '@openid4vc/openid4vci'\nimport { AuthorizationFlow as OpenId4VciAuthorizationFlow } from '@openid4vc/openid4vci'\nimport type {\n  OpenId4VcCredentialHolderBinding,\n  OpenId4VciAccessTokenResponse,\n  OpenId4VciCredentialConfigurationSupportedWithFormats,\n  OpenId4VciCredentialConfigurationsSupportedWithFormats,\n  OpenId4VciMetadata,\n} from '../shared'\nimport { OpenId4VciCredentialFormatProfile } from '../shared/models/OpenId4VciCredentialFormatProfile'\n\nexport { OpenId4VciAuthorizationFlow }\n\nexport type OpenId4VciSupportedCredentialFormats =\n  | OpenId4VciCredentialFormatProfile.JwtVcJson\n  | OpenId4VciCredentialFormatProfile.JwtVcJsonLd\n  | OpenId4VciCredentialFormatProfile.SdJwtVc\n  | OpenId4VciCredentialFormatProfile.SdJwtDc\n  | OpenId4VciCredentialFormatProfile.LdpVc\n  | OpenId4VciCredentialFormatProfile.MsoMdoc\n\nexport const openId4VciSupportedCredentialFormats: OpenId4VciSupportedCredentialFormats[] = [\n  OpenId4VciCredentialFormatProfile.JwtVcJson,\n  OpenId4VciCredentialFormatProfile.JwtVcJsonLd,\n  OpenId4VciCredentialFormatProfile.SdJwtVc,\n  OpenId4VciCredentialFormatProfile.SdJwtDc,\n  OpenId4VciCredentialFormatProfile.LdpVc,\n  OpenId4VciCredentialFormatProfile.MsoMdoc,\n]\n\nexport interface OpenId4VciDpopRequestOptions {\n  jwk: Kms.PublicJwk\n  alg: Kms.KnownJwaSignatureAlgorithm\n  nonce?: string\n}\n\n/**\n * 'credential_accepted' The Credential was successfully stored in the Wallet.\n * 'credential_deleted' when the unsuccessful Credential issuance was caused by a user action.\n * 'credential_failure' otherwise.\n */\nexport type OpenId4VciNotificationEvent = 'credential_accepted' | 'credential_failure' | 'credential_deleted'\n\nexport type OpenId4VciRequestTokenResponse = {\n  accessToken: string\n  refreshToken?: string\n  cNonce?: string\n  dpop?: OpenId4VciDpopRequestOptions\n  authorizationServer?: string\n\n  accessTokenResponse: OpenId4VciAccessTokenResponse\n}\n\nexport interface OpenId4VciCredentialResponse {\n  credentialConfigurationId: string\n  credentialConfiguration: OpenId4VciCredentialConfigurationSupportedWithFormats\n\n  /**\n   * The record containing the credentials returned in the OpenID4VCI credential response\n   *\n   * The credential is returned as a record, which can be provided to the\n   * respective `store()` method of each credential-specific API.\n   *\n   * The record contains the credential instance (instances in case of batch issuance)\n   * along with metadata such as the VCT Type Metadata (in case of SD-JWT)\n   */\n  record: SdJwtVcRecord | MdocRecord | W3cCredentialRecord | W3cV2CredentialRecord\n\n  notificationId?: string\n}\n\nexport interface OpenId4VciDeferredCredentialResponse {\n  credentialConfigurationId: string\n  credentialConfiguration: OpenId4VciCredentialConfigurationSupportedWithFormats\n  transactionId: string\n  interval?: number\n  notificationId?: string\n  /**\n   * Mapping from JWK thumbprint values to KMS key ids that were submitted in the credential request.\n   * These should be used when retrieving the deferred credentials, to store the associated kms key id\n   * for each received credential.\n   */\n  jwkThumbprintKmsKeyIdMapping?: Record<string, string>\n}\n\nexport interface OpenId4VciResolvedCredentialOffer {\n  metadata: IssuerMetadataResult\n  credentialOfferPayload: CredentialOfferObject\n\n  /**\n   * Offered credential configurations with known formats\n   */\n  offeredCredentialConfigurations: OpenId4VciCredentialConfigurationsSupportedWithFormats\n}\n\nexport type OpenId4VciResolvedAuthorizationRequest =\n  | {\n      openid4vpRequestUrl: string\n      authorizationFlow: OpenId4VciAuthorizationFlow.PresentationDuringIssuance\n      authSession: string\n\n      /**\n       * DPoP request options if DPoP was used for the authorization challenge request\n       */\n      dpop?: OpenId4VciDpopRequestOptions\n    }\n  | {\n      authorizationRequestUrl: string\n      authorizationFlow: OpenId4VciAuthorizationFlow.Oauth2Redirect\n      codeVerifier?: string\n\n      /**\n       * DPoP request options if DPoP was used for the pushed authorization reuqest\n       */\n      dpop?: OpenId4VciDpopRequestOptions\n    }\n\nexport interface OpenId4VciSendNotificationOptions {\n  metadata: IssuerMetadataResult\n\n  notificationId: string\n\n  /**\n   * The access token obtained through @see requestToken\n   */\n  accessToken: string\n\n  /**\n   * The notification event\n   *\n   * 'credential_accepted' The Credential was successfully stored in the Wallet.\n   * 'credential_deleted' when the unsuccessful Credential issuance was caused by a user action.\n   * 'credential_failure' otherwise.\n   */\n  notificationEvent: OpenId4VciNotificationEvent\n\n  dpop?: OpenId4VciDpopRequestOptions\n}\n\nexport interface OpenId4VcParseAndVerifyAuthorizationResponseOptions {\n  authorizationResponseRedirectUrl: string\n  resolvedCredentialOffer: OpenId4VciResolvedCredentialOffer\n}\n\nexport interface OpenId4VcAuthorizationCodeTokenRequestOptions {\n  resolvedCredentialOffer: OpenId4VciResolvedCredentialOffer\n  code: string\n  clientId: string\n  codeVerifier?: string\n  redirectUri?: string\n\n  txCode?: never\n\n  /**\n   * DPoP parameters to use in the request if supported by the authorization server.\n   *\n   * If DPoP was already used in the initiateAuthorization method, it should be provided\n   * here as well and be bound to the same key.\n   */\n  dpop?: OpenId4VciDpopRequestOptions\n\n  /**\n   * The wallet attestation to send to the issuer. This will only be used\n   * if client attestations are supported by the issuer, and should be provided\n   * if wallet attestation was provided in the authorization request as well.\n   *\n   * A Proof of Possession will be created based on the wallet attestation,\n   * so the key bound to the wallet attestation must be in the wallet.\n   */\n  walletAttestationJwt?: string\n}\n\n// TODO: support wallet attestation for pre-auth flow\nexport interface OpenId4VciPreAuthorizedTokenRequestOptions {\n  resolvedCredentialOffer: OpenId4VciResolvedCredentialOffer\n  txCode?: string\n\n  code?: undefined\n\n  /**\n   * DPoP parameters to use in the request if supported by the authorization server.\n   */\n  dpop?: OpenId4VciDpopRequestOptions\n\n  /**\n   * The wallet attestation to send to the issuer. This will only be used\n   * if client attestations are supported by the issuer.\n   *\n   * A Proof of Possession will be created based on the wallet attestation,\n   * so the key bound to the wallet attestation must be in the wallet.\n   */\n  walletAttestationJwt?: string\n}\n\nexport type OpenId4VciTokenRequestOptions =\n  | OpenId4VciPreAuthorizedTokenRequestOptions\n  | OpenId4VcAuthorizationCodeTokenRequestOptions\n\nexport type OpenId4VciTokenRefreshOptions = {\n  refreshToken: string\n\n  /**\n   * The issuer metadata.\n   */\n  issuerMetadata: IssuerMetadataResult\n\n  /**\n   * The authorization server where the refresh token was obtained from.\n   */\n  authorizationServer?: string\n\n  /**\n   * DPoP parameters to use in the request if supported by the authorization server.\n   */\n  dpop?: OpenId4VciDpopRequestOptions\n\n  /**\n   * The client id used for authorization. Only required if authorization_code flow was used.\n   */\n  clientId?: string\n\n  /**\n   * The wallet attestation to send to the issuer. This will only be used\n   * if client attestations are supported by the issuer, and should be provided\n   * if wallet attestation was provided in the authorization request as well.\n   *\n   * A Proof of Possession will be created based on the wallet attestation,\n   * so the key bound to the wallet attestation must be in the wallet.\n   */\n  walletAttestationJwt?: string\n}\n\nexport interface OpenId4VciRetrieveAuthorizationCodeUsingPresentationOptions {\n  resolvedCredentialOffer: OpenId4VciResolvedCredentialOffer\n  dpop?: OpenId4VciDpopRequestOptions\n\n  /**\n   * The wallet attestation to send to the issuer. This will only be used\n   * if client attestations are supported by the issuer, and should be provided\n   * if wallet attestation was provided in the authorization request as well.\n   *\n   * A Proof of Possession will be created based on the wallet attestation,\n   * so the key bound to the wallet attestation must be in the wallet.\n   */\n  walletAttestationJwt?: string\n\n  /**\n   * auth session returned at an earlier call to the authorization challenge endpoint\n   */\n  authSession: string\n\n  /**\n   * Presentation during issuance session returned by the verifier after submitting a valid presentation\n   */\n  presentationDuringIssuanceSession?: string\n}\n\nexport interface OpenId4VciCredentialRequestOptions extends Omit<OpenId4VciAcceptCredentialOfferOptions, 'userPin'> {\n  resolvedCredentialOffer: OpenId4VciResolvedCredentialOffer\n  accessToken: string\n  cNonce?: string\n  dpop?: OpenId4VciDpopRequestOptions\n\n  /**\n   * The client id used for authorization. Only required if authorization_code flow was used.\n   */\n  clientId?: string\n}\n\n/**\n * Options that are used to accept a credential offer for both the pre-authorized code flow and authorization code flow.\n * NOTE: Merge with @see OpenId4VciCredentialRequestOptions for 0.6\n */\nexport interface OpenId4VciAcceptCredentialOfferOptions {\n  /**\n   * This is the list of credentials configuration ids that will be requested from the issuer.\n   * Should be a list of ids of the credentials that are included in the credential offer.\n   * If not provided all offered credentials will be requested.\n   */\n  credentialConfigurationIds?: string[]\n\n  verifyCredentialStatus?: boolean\n\n  /**\n   * A list of allowed proof of possession signature algorithms in order of preference.\n   *\n   * Note that the signature algorithms must be supported by the wallet implementation.\n   * Signature algorithms that are not supported by the wallet will be ignored.\n   *\n   * The proof of possession (pop) signature algorithm is used in the credential request\n   * to bind the credential to a did. In most cases the JWA signature algorithm\n   * that is used in the pop will determine the cryptographic suite that is used\n   * for signing the credential, but this not a requirement for the spec. E.g. if the\n   * pop uses EdDsa, the credential will most commonly also use EdDsa, or Ed25519Signature2018/2020.\n   */\n  allowedProofOfPossessionSignatureAlgorithms?: Kms.KnownJwaSignatureAlgorithm[]\n\n  /**\n   * A function that should resolve key material for binding the to-be-issued credential\n   * to the holder based on the options passed. This key material will be used for signing\n   * the proof of possession included in the credential request.\n   *\n   * This method will be called once for each of the credentials that are included\n   * in the credential offer.\n   *\n   * Based on the credential format, JWA signature algorithm, verification method types\n   * and binding methods (did methods, jwk), the resolver must return an object\n   * conformant to the `CredentialHolderBinding` interface, which will be used\n   * for the proof of possession signature.\n   */\n  credentialBindingResolver: OpenId4VciCredentialBindingResolver\n}\n\n/**\n * Options to request deferred credentials from the issuer.\n */\nexport interface OpenId4VciDeferredCredentialRequestOptions {\n  issuerMetadata: IssuerMetadataResult\n  transactionId: string\n  credentialConfigurationId: string\n  credentialConfiguration: OpenId4VciCredentialConfigurationSupportedWithFormats\n  verifyCredentialStatus?: boolean\n  accessToken: string\n  dpop?: OpenId4VciDpopRequestOptions\n\n  /**\n   * Mapping from JWK thumbprint values to KMS key ids that were submitted in the credential request.\n   * These were returned in the deferred credential return value in case JWKs were used in the proof\n   * of possession of the credential request\n   */\n  jwkThumbprintKmsKeyIdMapping?: Record<string, string>\n}\n\n/**\n * Options that are used for the authorization code flow.\n */\nexport interface OpenId4VciAuthCodeFlowOptions {\n  clientId: string\n\n  /**\n   * The wallet attestation to send to the issuer. This will only be used\n   * if client attestations and PAR are supported by the issuer.\n   *\n   * A Proof of Possesion will be created based on the wallet attestation,\n   * so the key bound to the wallet attestation must be in the wallet.\n   */\n  walletAttestationJwt?: string\n\n  redirectUri: string\n  scope?: string[]\n}\n\nexport interface OpenId4VciCredentialBindingOptions {\n  agentContext: AgentContext\n\n  /**\n   * The OpenID4VCI metadata, consisting of the draft version used,\n   * the issuer metadatan and the authorization server metadata\n   */\n  metadata: OpenId4VciMetadata\n\n  /**\n   * The credential format that will be requested from the issuer.\n   * E.g. `jwt_vc` or `ldp_vc`.\n   */\n  credentialFormat: OpenId4VciSupportedCredentialFormats\n\n  /**\n   * The max batch size as configured by the issuer. If the issuer has not indicated support for batch issuance\n   * this will be `1`.\n   */\n  issuerMaxBatchSize: number\n\n  /**\n   * The proof types supported by the credential issuer that are also supported\n   * by credo. Currently `jwt` and `attestation` are supported.\n   *\n   * Each proof type will list the supported algorithms, key types\n   * and whether key attesations are required\n   */\n  proofTypes: OpenId4VciProofOfPressionProofTypes\n\n  /**\n   * The id of the credential configuration that will be requested from the issuer.\n   */\n  credentialConfigurationId: string\n\n  /**\n   * The credential configuration that will be requested from the issuer.\n   */\n  credentialConfiguration: OpenId4VciCredentialConfigurationSupportedWithFormats\n\n  /**\n   * Whether the issuer supports the `did` cryptographic binding method,\n   * indicating they support all did methods. In most cases, they do not\n   * support all did methods, and it means we have to make an assumption\n   * about the did methods they support.\n   *\n   * If this value is `false`, the `supportedDidMethods` property will\n   * contain a list of supported did methods.\n   *\n   * NOTE: when key attestations are required for a specific proof type, support for did method\n   * binding is not supported at the moment, as there's no way to indicate which did the credential\n   * should be bound to.\n   * https://github.com/openid/OpenID4VCI/issues/475\n   */\n  supportsAllDidMethods: boolean\n\n  /**\n   * A list of supported did methods. This is only used if the `supportsAllDidMethods`\n   * property is `false`. When this array is populated, the returned verification method\n   * MUST be based on one of these did methods.\n   *\n   * The did methods are returned in the format `did:<method>`, e.g. `did:web`.\n   *\n   * The value is undefined in the case the supported did methods could not be extracted.\n   * This is the case when the issuer didn't include the supported did methods in the issuer metadata.\n   *\n   * NOTE: an empty array (no did methods supported) has a different meaning from the value\n   * being undefined (the supported did methods could not be extracted). If `supportsAllDidMethods`\n   * is true, the value of this property MUST be ignored.\n   *\n   * NOTE: when key attestations are required for a specific proof type, support for did method\n   * binding is not supported at the moment, as there's no way to indicate which did the credential\n   * should be bound to.\n   * https://github.com/openid/OpenID4VCI/issues/475\n   */\n  supportedDidMethods?: string[]\n\n  /**\n   * Whether the issuer supports the `jwk` cryptographic binding method,\n   * indicating they support proof of possession signatures bound to a jwk.\n   */\n  supportsJwk: boolean\n\n  /**\n   * The cNonce that will be used for the credential request. May be used if dynamically creating a key attestation\n   * that must include the cNonce.\n   */\n  cNonce: string\n}\n\n/**\n * The proof of possession verification method resolver is a function that can be passed by the\n * user of the framework and allows them to determine which verification method should be used\n * for the proof of possession signature.\n */\nexport type OpenId4VciCredentialBindingResolver = (\n  options: OpenId4VciCredentialBindingOptions\n) => Promise<OpenId4VcCredentialHolderBinding> | OpenId4VcCredentialHolderBinding\n\nexport type OpenId4VciProofOfPressionProofTypes = Record<\n  'jwt' | 'attestation',\n  | {\n      /**\n       * The JWA Signature Algorithm(s) that can be used in the proof of possession.\n       * This is based on the `allowedProofOfPossessionSignatureAlgorithms` passed\n       * to the request credential method, and the supported proof type signature\n       * algorithms for the specific credential configuration\n       */\n      supportedSignatureAlgorithms: Kms.KnownJwaSignatureAlgorithm[]\n\n      /**\n       * Whether key attestations are required and which level needs to be met. If the object\n       * is not defined, it can be interpreted that key attestations are not required.\n       *\n       * OpenID4VCI defined common levels in https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#appendix-D.2, such as:\n       * - `iso_18045_high`\n       * - `iso_18045_moderate`\n       * - `iso_18045_enhanced-basic`\n       * - `iso_18045_basic`\n       *\n       * Other values may be defined and present as well. When key attestations are required you MUST return a key attestation.\n       * If `userAuthentication` or `keyStorage` are defined you MUST return a key attestation that reaches the level as required\n       *  by the `keyStorage` and `userAuthentication` values.\n       */\n      keyAttestationsRequired?: {\n        keyStorage?: string[]\n        userAuthentication?: string[]\n      }\n    }\n  | undefined\n>\n\n/**\n * @internal\n */\nexport interface OpenId4VciProofOfPossessionRequirements {\n  proofTypes: OpenId4VciProofOfPressionProofTypes\n  supportedDidMethods?: string[]\n  supportsAllDidMethods: boolean\n  supportsJwk: boolean\n}\n"],"mappings":";;;;AA6BA,MAAa,uCAA+E;CAC1F,kCAAkC;CAClC,kCAAkC;CAClC,kCAAkC;CAClC,kCAAkC;CAClC,kCAAkC;CAClC,kCAAkC;CACnC"}