openid4vp

type BindingAttributeConfig struct {
	// Paths lists claim paths that must ALL match across credentials (AND semantics).
	Paths []string `` /* 142-byte string literal not displayed */
}

type BindingConfidence string

type BindingEnforcement string

type BindingMethod string

type BindingResult struct {
	Method     BindingMethod     `json:"method"`
	Confidence BindingConfidence `json:"confidence"`
	Details    string            `json:"details,omitempty"`
	Error      string            `json:"error,omitempty"`
}

type ClaimQuery struct {
	// ID REQUIRED if claim_sets is present in the Credential Query; OPTIONAL otherwise.
	// A string identifying the particular claim. The value MUST be a non-empty string
	// consisting of alphanumeric, underscore (_), or hyphen (-) characters.
	// Within the particular claims array, the same id MUST NOT be present more than once.
	ID string `json:"-" yaml:"-"`

	// Path REQUIRED The value MUST be a non-empty array representing a claims path pointer
	// that specifies the path to a claim within the Credential, as defined in Section 7.
	// Elements are strings (object keys) or nil (representing null for array element access).
	Path []*string `json:"-" yaml:"-" validate:"required,min=1"`

	// Values OPTIONAL A non-empty array of strings, integers or boolean values that
	// specifies the expected values of the claim. If present, the Wallet SHOULD return
	// the claim only if the type and value of the claim both match exactly for at least
	// one of the elements in the array. See OpenID4VP Section 6.3 and 6.4.1.
	Values []any `json:"-" yaml:"-" validate:"omitnil,min=1"`
}

type ClaimTransformDef struct {
	Type   string            // Transform type: date_format, boolean_string, uppercase, lowercase, etc.
	Params map[string]string // Transform parameters
}

type ClaimValidation struct {
	// Rule is the validation rule to apply, e.g., "age_over".
	Rule string `json:"rule" yaml:"rule" validate:"required,oneof=age_over" doc_example:"\"age_over\""`

	// Path is the claim path to validate, e.g., ["birthdate"].
	Path []string `json:"path" yaml:"path" validate:"required,min=1,dive,required" doc_example:"[\"birthdate\"]"`

	// Value is the threshold or expected value for the validation.
	Value any `json:"value" yaml:"value" validate:"required" doc_example:"18"`
}

type ClaimsExtractor struct {
	// contains filtered or unexported fields
}

type Client struct {
	EphemeralKeyCache  *EphemeralEncryptionKeyCache
	RequestObjectCache *RequestObjectCache
}

type ClientMetadata struct {
	// JWKS OPTIONAL. A JSON Web Key Set, as defined in [RFC7591], that contains one or more public keys, such as those used by the Wallet as an input to a key agreement that may be used for encryption of the Authorization Response (see Section 8.3), or where the Wallet will require the public key of the Verifier to generate a Verifiable Presentation. This allows the Verifier to pass ephemeral keys specific to this Authorization Request. Public keys included in this parameter MUST NOT be used to verify the signature of signed Authorization Requests. Each JWK in the set MUST have a kid (Key ID) parameter that uniquely identifies the key within the context of the request.
	JWKS *Keys `json:"jwks,omitempty" bson:"jwks,omitempty" validate:"omitempty"`

	// encrypted_response_enc_values_supported: OPTIONAL. Non-empty array of strings, where each string is a JWE [RFC7516] enc algorithm that can be used as the content encryption algorithm for encrypting the Response. When a response_mode requiring encryption of the Response (such as dc_api.jwt or direct_post.jwt) is specified, this MUST be present for anything other than the default single value of A128GCM. Otherwise, this SHOULD be absent.
	EncryptedResponseEncValuesSupported []string `` /* 189-byte string literal not displayed */

	// vp_formats_supported: REQUIRED when not available to the Wallet via another mechanism. As defined in Section 11.1.
	// Per OpenID4VP spec, this is the properly formatted field for client_metadata in authorization requests
	VPFormatsSupported *VPFormatsSupported `json:"vp_formats_supported,omitempty" bson:"vp_formats_supported,omitempty"`

	// authorization_signed_response_alg: OPTIONAL. As defined in [JARM].
	AuthorizationSignedResponseALG string `` /* 152-byte string literal not displayed */
	// authorization_encrypted_response_alg: OPTIONAL. As defined in [JARM].
	AuthorizationEncryptedResponseALG string `` /* 175-byte string literal not displayed */
	// authorization_encrypted_response_enc: OPTIONAL. As defined in [JARM].
	AuthorizationEncryptedResponseENC string `` /* 178-byte string literal not displayed */
}

type CombinedBindingResult struct {
	// Bound indicates whether the verifier considers the credentials bound to the same holder.
	Bound bool `json:"bound"`
	// HighestConfidence is the best confidence level achieved across all methods.
	HighestConfidence BindingConfidence `json:"highest_confidence"`
	// Results contains individual results per method.
	Results []BindingResult `json:"results"`
}

type CombinedBindingVerifier struct {
	Config CombinedPresentationConfig
}

type CombinedPresentationConfig struct {
	// Enabled activates combined presentation binding verification.
	Enabled bool `yaml:"enabled" json:"enabled"`
	// Enforcement determines how binding verification results are handled:
	//   - "enforce": reject the presentation if binding cannot be established
	//   - "warn": log a warning but allow the presentation through (per ARF 3.0 ACP_08)
	//   - "disabled": skip binding verification entirely
	Enforcement BindingEnforcement `yaml:"enforcement" json:"enforcement" validate:"omitempty,oneof=enforce warn disabled" default:"warn"`
	// BindingAttributes configures attribute-based binding checks.
	BindingAttributes []BindingAttributeConfig `yaml:"binding_attributes,omitempty" json:"binding_attributes,omitempty" validate:"omitempty,dive"`
	// KeyBindingEnabled activates key-based binding (cnf.jwk / device key comparison).
	// Cross-format comparison (SD-JWT cnf.jwk vs mDoc device key) is always
	// supported since both are converted to RFC 7638 JWK thumbprints.
	KeyBindingEnabled bool `yaml:"key_binding_enabled" json:"key_binding_enabled"`
}

type Config struct {
	// EphemeralKeyTTL specifies the TTL for ephemeral encryption keys.
	// If not set or zero, DefaultEphemeralKeyTTL (10 minutes) is used.
	EphemeralKeyTTL time.Duration

	// RequestObjectTTL specifies the TTL for request objects.
	// If not set or zero, DefaultRequestObjectTTL (10 minutes) is used.
	RequestObjectTTL time.Duration
}

type Constraints struct {
	LimitDisclosure string  `json:"limit_disclosure,omitempty"`
	Fields          []Field `json:"fields,omitempty"`
}

type CredentialQuery struct {
	// ID REQUIRED. A string identifying the Credential in the response and, if provided, the constraints in credential_sets. The value MUST be a non-empty string consisting of alphanumeric, underscore (_), or hyphen (-) characters. Within the Authorization Request, the same id MUST NOT be present more than once.
	ID string `json:"id" yaml:"id" validate:"required"`

	// Format REQUIRED. A string that specifies the format of the requested Credential. Valid Credential Format Identifier values are defined in Appendix B.
	Format string `json:"format" yaml:"format" validate:"required"`

	// Multiple OPTIONAL. A boolean which indicates whether multiple Credentials can be returned for this Credential Query. If omitted, the default value is false.
	Multiple bool `json:"multiple,omitempty" yaml:"multiple,omitempty"`

	// Meta REQUIRED. An object defining additional properties requested by the Verifier that apply to the metadata and validity data of the Credential. The properties of this object are defined per Credential Format. Examples of those are in Appendix B.3.5 and Appendix B.2.3. If empty, no specific constraints are placed on the metadata or validity of the requested Credential.
	Meta MetaQuery `json:"meta" yaml:"meta" validate:"required"`

	// TrustedAuthorities OPTIONAL. A non-empty array of objects as defined in Section 6.1.1 that specifies expected authorities or trust frameworks that certify Issuers, that the Verifier will accept. Every Credential returned by the Wallet SHOULD match at least one of the conditions present in the corresponding trusted_authorities array if present.
	TrustedAuthorities []TrustedAuthority `json:"trusted_authorities,omitempty" yaml:"trusted_authorities,omitempty"`

	// RequireCryptographicHolderBinding OPTIONAL. Spec default is true when omitted; nil pointer preserves that distinction from an explicit false.
	RequireCryptographicHolderBinding *bool `json:"require_cryptographic_holder_binding,omitempty" yaml:"require_cryptographic_holder_binding,omitempty"`

	// Claims OPTIONAL. A non-empty array of objects as defined in Section 6.3 that specifies claims in the requested Credential. Verifiers MUST NOT point to the same claim more than once in a single query. Wallets SHOULD ignore such duplicate claim queries.
	Claims []ClaimQuery `json:"claims,omitempty" yaml:"claims,omitempty"`

	// ClaimSet OPTIONAL. A non-empty array containing arrays of identifiers for elements in claims that specifies which combinations of claims for the Credential are requested. The rules for selecting claims to send are defined in Section 6.4.1.
	ClaimSet [][]string `json:"claim_sets,omitempty" yaml:"claim_sets,omitempty" validate:"omitnil,min=1,dive,required,min=1,dive,required"`
}

type CredentialSetQuery struct {
	// Options REQUIRED A non-empty array, where each value in the array is a list of Credential Query identifiers representing one set of Credentials that satisfies the use case. The value of each element in the options array is a non-empty array of identifiers which reference elements in credentials.
	Options [][]string `json:"options" yaml:"options" validate:"required,min=1,dive,required,min=1,dive,required"`

	// Required OPTIONAL. Spec default is true when omitted; nil pointer preserves that distinction from an explicit false.
	Required *bool `json:"required,omitempty" yaml:"required,omitempty"`
}

type DCQL struct {
	// Credentials REQUIRED. A non-empty array of Credential Queries as defined in Section 6.1 that specify the requested Credentials.
	Credentials []CredentialQuery `json:"credentials" yaml:"credentials" validate:"required,min=1,dive,required"`

	// CredentialSets OPTIONAL. A non-empty array of Credential Set Queries as defined in Section 6.2 that specifies additional constraints on which of the requested Credentials to return.
	CredentialSets []CredentialSetQuery `json:"credential_sets,omitempty" yaml:"credential_sets,omitempty" validate:"omitnil,min=1,dive,required"`
}

type DCQLValidationError struct {
	Field   string
	Message string
}

type Descriptor struct {
	ID         string      `json:"id" validate:"required"`
	Path       string      `json:"path" validate:"required"`
	PathNested *Descriptor `json:"path_nested,omitempty"`
	Format     string      `json:"format" validate:"required,oneof=jwt jwt_vc jwt_vp ldp ldp_vc ldp_vp mso_mdoc ac_vc ac_vp sd_jwt"`
}

type DirectPostJWTResponse struct {
	Response string `json:"response"` // Encrypted JWT containing the Authorization Response
}

type DirectPostResponse struct {
	RedirectURI string `json:"redirect_uri,omitempty"` // Optional per spec
}

type EphemeralEncryptionKeyCache struct {
	// contains filtered or unexported fields
}

type ErrorResponse struct {
	ErrorCode        string `json:"error"`
	ErrorDescription string `json:"error_description,omitempty"`
	State            string `json:"state,omitempty"`
}

type Field struct {
	Name   string   `json:"name,omitempty"`
	Path   []string `json:"path"`
	Filter *Filter  `json:"filter,omitempty"`
}

type Filter struct {
	Type  string   `json:"type,omitempty"`
	Enum  []string `json:"enum,omitempty"`
	Const string   `json:"const,omitempty"`
}

type Format struct {
	Alg []string `json:"alg"`
}

type InputDescriptor struct {
	ID          string                         `json:"id"`
	Name        string                         `json:"name,omitempty"`
	Purpose     string                         `json:"purpose,omitempty"`
	Format      map[string]map[string][]string `json:"format,omitempty"`
	Group       []string                       `json:"group,omitempty"`
	Constraints Constraints                    `json:"constraints"`
}

type JWK struct {
	KTY string `json:"kty,omitempty" bson:"kty,omitempty" validate:"required,oneof=RSA EC OKP"`
	X   string `json:"x,omitempty" bson:"x,omitempty" validate:"omitempty"`
	Y   string `json:"y,omitempty" bson:"y,omitempty" validate:"omitempty"`
	CRV string `json:"crv,omitempty" bson:"crv,omitempty" validate:"omitempty,oneof=P-256 P-384 P-521 Ed25519 Ed448 X25519 X448"`
	N   string `json:"n,omitempty" bson:"n,omitempty" validate:"omitempty"`
	KID string `json:"kid,omitempty" bson:"kid,omitempty" validate:"omitempty"`
	E   string `json:"e,omitempty" bson:"e,omitempty" validate:"omitempty"`
	Use string `json:"use,omitempty" bson:"use,omitempty" validate:"omitempty,oneof=sig enc"`
	Alg string `json:"alg,omitempty" bson:"alg,omitempty"`
}

type JWTVCFormat struct {
	// AlgValues is a non-empty array containing identifiers of cryptographic algorithms supported.
	// If present, the alg JOSE header of the presented VC/VP MUST match one of the array values.
	AlgValues []string `json:"alg_values,omitempty" yaml:"alg_values,omitempty"`
}

type Keys struct {
	Keys []jwk.Key `json:"keys,omitempty" bson:"keys,omitempty" validate:"omitempty,dive"`
}

type LDPVCFormat struct {
	// ProofTypeValues is a non-empty array containing identifiers of proof types supported.
	// If present, the proof type of the presented VC/VP MUST match one of the array values.
	ProofTypeValues []string `` /* 134-byte string literal not displayed */

	// CryptosuiteValues is a non-empty array containing identifiers of crypto suites supported.
	// Used when one of the algorithms in ProofTypeValues supports multiple crypto suites.
	CryptosuiteValues []string `` /* 161-byte string literal not displayed */
}

type MetaQuery struct {
	// VCTValues for SD-JWT VC format (dc+sd-jwt).
	// A non-empty array of strings that specifies allowed values for the type of the requested Verifiable Credential.
	// All elements in the array MUST be valid type identifiers as defined in [I-D.ietf-oauth-sd-jwt-vc].
	// The Wallet MAY return Credentials that inherit from any of the specified types.
	VCTValues []string `json:"vct_values,omitempty" yaml:"vct_values,omitempty"`

	// TypeValues for W3C VC format (ldp_vc, jwt_vc_json).
	// A non-empty array of string arrays specifying the fully expanded types (IRIs) that the Verifier accepts.
	// Each top-level array specifies one alternative to match the fully expanded type values of the Verifiable Credential.
	// Each inner array specifies a set of fully expanded types that MUST be present in the credential's type property.
	TypeValues [][]string `json:"type_values,omitempty" yaml:"type_values,omitempty"`

	// DoctypeValue for ISO mdoc format (mso_mdoc) and ZK-mdoc format (mso_mdoc_zk).
	// String that specifies an allowed value for the doctype of the requested Verifiable Credential.
	DoctypeValue string `json:"doctype_value,omitempty" yaml:"doctype_value,omitempty"`

	// ZKSystemType for ZK-mdoc format (mso_mdoc_zk) only.
	// A non-empty array of ZK proof system/circuit variants the Verifier is
	// willing to accept (e.g. Longfellow circuits for different attribute
	// counts). See ZKSystemTypeSpec and dcql_zk.go.
	ZKSystemType []ZKSystemTypeSpec `json:"zk_system_type,omitempty" yaml:"zk_system_type,omitempty"`

	// PPIDContext for ZK-mdoc format (mso_mdoc_zk) only.
	// An optional verifier-supplied string that further scopes a requested
	// pairwise pseudonym (PPID) beyond the verifier's own identity - see
	// pkg/mdoc.ComputeZkVerifierContext.
	PPIDContext string `json:"ppid_context,omitempty" yaml:"ppid_context,omitempty"`
}

type MsoMdocFormat struct {
	// IssuerAuthAlgValues is a non-empty array containing cryptographic algorithm identifiers
	// supported for IssuerAuth COSE signatures.
	IssuerAuthAlgValues []int `json:"issuerauth_alg_values,omitempty" yaml:"issuerauth_alg_values,omitempty"`

	// DeviceAuthAlgValues is a non-empty array containing cryptographic algorithm identifiers
	// supported for DeviceAuth COSE signatures or MACs.
	DeviceAuthAlgValues []int `json:"deviceauth_alg_values,omitempty" yaml:"deviceauth_alg_values,omitempty"`
}

type PresentationBuilder struct {
	// contains filtered or unexported fields
}

type PresentationDefinitionParameter struct {
	// ID The Presentation Definition MUST contain an id property. The value of this property MUST be a string.
	// The string SHOULD provide a unique ID for the desired context.
	ID string `json:"id" bson:"id" validate:"required"`

	// Name The Presentation Definition MAY contain a name property. If present, its value SHOULD be a
	// human-friendly string intended to constitute a distinctive designation of the Presentation Definition.
	Name string `json:"name,omitempty" bson:"name,omitempty"`

	// Purpose The Presentation Definition MAY contain a purpose property. If present, its value MUST be a
	// string that describes the purpose for which the Presentation Definition's inputs are being used for.
	Purpose string `json:"purpose,omitempty" bson:"purpose,omitempty"`

	// InputDescriptors The Presentation Definition MUST contain an input_descriptors property.
	// Its value MUST be an array of Input Descriptor Objects.
	InputDescriptors []InputDescriptor `json:"input_descriptors" bson:"input_descriptors" validate:"required,dive"`

	// SubmissionRequirements The Presentation Definition MAY contain a submission_requirements property.
	// If present, its value MUST be an array of Submission Requirement Objects.
	SubmissionRequirements []SubmissionRequirement `json:"submission_requirements,omitempty" bson:"submission_requirements,omitempty" validate:"omitempty,dive"`

	// Format The Presentation Definition MAY contain a format property. If present, its value MUST be an object
	// with one or more properties matching the registered Claim Format Designations.
	Format map[string]Format `json:"format,omitempty" bson:"format,omitempty"`
}

type PresentationRequestTemplate interface {
	GetID() string
	GetOIDCScopes() []string
	GetDCQLQuery() *DCQL
}

type PresentationSubmission struct {
	ID            string       `json:"id" validate:"required"`
	DefinitionID  string       `json:"definition_id" validate:"required"`
	DescriptorMap []Descriptor `json:"descriptor_map" validate:"required,dive,required"`
}

type QRReply struct {
	Base64Image string `json:"base64_image" bson:"base64_image" validate:"required"`
	URI         string `json:"uri" bson:"uri" validate:"required"`
}

type RequestObject struct {
	// ISS MAY be present in the Request Object. However, if it is present, the Wallet MUST ignore it.
	ISS string `json:"iss" uri:"iss" validate:"required,url"`

	AUD string `json:"aud,omitempty" bson:"aud,omitempty" validate:"required"`

	IAT int64 `json:"iat,omitempty" bson:"iat,omitempty" validate:"required"`

	// ResponseType        REQUIRED.  Value MUST be set to "code".
	ResponseType string `json:"response_type" uri:"response_type" validate:"required,eq=code"`

	// REQUIRED. Defined in [RFC6749]. This specification defines additional requirements to enable the use of Client Identifier Prefixes as described in Section 5.9. The Client Identifier can be created by parties other than the Wallet and it is considered unique within the context of the Wallet when used in combination with the Client Identifier Prefix.
	ClientID string `json:"client_id" uri:"client_id" validate:"required"`

	// RedirectURI OPTIONAL.  As described in Section 3.1.2.
	RedirectURI string `json:"redirect_uri,omitempty" uri:"redirect_uri" validate:"omitempty,url"`

	// Scope OPTIONAL.  The scope of the access request as described by Section 3.3.
	Scope string `json:"scope,omitempty" uri:"scope" validate:"omitempty"`

	//  State REQUIRED under the conditions defined in Section 5.3. Otherwise, state is OPTIONAL. state values MUST only contain ASCII URL safe characters (uppercase and lowercase letters, decimal digits, hyphen, period, underscore, and tilde).
	State string `json:"state,omitempty" uri:"state" validate:"omitempty"`

	// Nonce REQUIRED. A case-sensitive String representing a value to securely bind Verifiable Presentation(s) provided by the Wallet to the particular transaction. The Verifier MUST create a fresh, cryptographically random number with sufficient entropy for every Authorization Request, store it with its current session, and pass it in the nonce Authorization Request Parameter to the Wallet. See Section 14.1 for details. Values MUST only contain ASCII URL safe characters (uppercase and lowercase letters, decimal digits, hyphen, period, underscore, and tilde).
	Nonce string `json:"nonce" uri:"nonce" validate:"required"`

	// ResponseMode REQUIRED. Defined in [OAuth.Responses]. This parameter can be used (through the new Response Mode direct_post) to ask the Wallet to send the response to the Verifier via an HTTPS connection (see Section 8.2 for more details). It can also be used to request that the resulting response be encrypted (see Section 8.3 for more details).
	ResponseMode string `` /* 126-byte string literal not displayed */

	// dcql_query
	DCQLQuery *DCQL `json:"dcql_query,omitempty" bson:"dcql_query,omitempty" validate:"omitempty,dive"`

	// ClientMetadata OPTIONAL. A JSON object containing the Verifier metadata values. It MUST be UTF-8 encoded.
	ClientMetadata *ClientMetadata `json:"client_metadata,omitempty" validate:"omitempty"`

	// RequestURIMethod: OPTIONAL. A string determining the HTTP method to be used when the request_uri parameter is included in the same request. Two case-sensitive valid values are defined in this specification: get and post. If request_uri_method value is get, the Wallet MUST send the request to retrieve the Request Object using the HTTP GET method, i.e., as defined in [RFC9101]. If request_uri_method value is post, a supporting Wallet MUST send the request using the HTTP POST method as detailed in Section 5.10. If the request_uri_method parameter is not present, the Wallet MUST process the request_uri parameter as defined in [RFC9101]. Wallets not supporting the post method will send a GET request to the Request URI (default behavior as defined in [RFC9101]). request_uri_method parameter MUST NOT be present if a request_uri parameter is not present. If the Verifier set the request_uri_method parameter value to post and there is no other means to convey its capabilities to the Wallet, it SHOULD add the client_metadata parameter to the Authorization Request. This enables the Wallet to assess the Verifier's capabilities, allowing it to transmit only the relevant capabilities through the wallet_metadata parameter in the Request URI POST request.
	RequestURIMethod string `json:"request_uri_method,omitempty" bson:"request_uri_method,omitempty" validate:"omitempty,oneof=get post"`

	// TransactionData OPTIONAL. Array of base64url-encoded JSON objects with transaction details the Verifier requests the End-User to authorize (§8.4).
	TransactionData []string `json:"transaction_data,omitempty" bson:"transaction_data,omitempty" validate:"omitempty,dive,required"`

	// VerifierInfo OPTIONAL. A non-empty array of attestations about the Verifier relevant to the Credential Request. These attestations MAY include Verifier metadata, policies, trust status, or authorizations. Attestations are intended to support authorization decisions, inform Wallet policy enforcement, or enrich the End-User consent dialog.
	VerifierInfo []VerifierInfo `json:"verifier_info,omitempty" bson:"verifier_info,omitempty" validate:"omitempty,dive,required"`

	// ResponseURI REQUIRED when the Response Mode direct_post is used. The URL to which the Wallet MUST send the Authorization Response using an HTTP POST request as defined by the Response Mode direct_post. The Response URI receives all Authorization Response parameters as defined by the respective Response Type. When the response_uri parameter is present, the redirect_uri Authorization Request parameter MUST NOT be present. If the redirect_uri Authorization Request parameter is present when the Response Mode is direct_post, the Wallet MUST return an invalid_request Authorization Response error. The response_uri value MUST be a value that the client would be permitted to use as redirect_uri when following the rules defined in Section 5.9.
	ResponseURI string `json:"response_uri,omitempty" uri:"response_uri" validate:"required"`
}

type RequestObjectCache struct {
	// contains filtered or unexported fields
}

type ResponseParameters struct {
	// VPToken REQUIRED. The structure of this parameter depends on the query language used to request the presentations in the Authorization Request:
	VPToken string `json:"vp_token,omitempty" bson:"vp_token" validate:"omitempty,required_if=ResponseType vp_token"`

	Code    string `json:"code,omitempty" bson:"code"`
	ISS     string `json:"iss,omitempty" bson:"iss"`
	State   string `json:"state,omitempty" bson:"state"`
	IDToken string `json:"id_token,omitempty" bson:"id_token"`

	PresentationSubmission *PresentationSubmission `json:"presentation_submission,omitempty" bson:"presentation_submission"`
}

type SDJWTVCFormat struct {
	// SDJWTAlgValues is a non-empty array containing cryptographic algorithm identifiers
	// supported for the Issuer-signed JWT of an SD-JWT.
	SDJWTAlgValues []string `json:"sd-jwt_alg_values,omitempty" yaml:"sd-jwt_alg_values,omitempty"`

	// KBJWTAlgValues is a non-empty array containing cryptographic algorithm identifiers
	// supported for a Key Binding JWT (KB-JWT).
	KBJWTAlgValues []string `json:"kb-jwt_alg_values,omitempty" yaml:"kb-jwt_alg_values,omitempty"`
}

type StaticVC20KeyResolver struct {
	Key crypto.PublicKey
}

type SubmissionRequirement struct {
	Name  string `json:"name,omitempty"`
	Rule  string `json:"rule"`
	Count int    `json:"count,omitempty"`
	From  string `json:"from"`
}

type TransactionData struct {
	// Type REQUIRED. Collision-resistant identifier for the transaction data type.
	Type string `json:"type,omitempty" bson:"type,omitempty" validate:"required"`

	// CredentialIDS REQUIRED. Credential query IDs that can authorize this transaction.
	CredentialIDS []string `json:"credential_ids,omitempty" bson:"credential_ids,omitempty" validate:"required,dive,required"`
}

type TrustService struct{}

type TrustedAuthority struct {
	// REQUIRED. A string uniquely identifying the type of information about the issuer trust framework. Types defined by this specification are listed below.
	Type string `json:"type" yaml:"type" validate:"required,oneof=aki etsi_tl openid_federation"`

	// REQUIRED. A non-empty array of strings, where each string (value) contains information specific to the used Trusted Authorities Query type that allows the identification of an issuer, a trust framework, or a federation that an issuer belongs to.
	Values []string `json:"values" yaml:"values" validate:"required,min=1"`
}

type TrustedAuthorityMatcher interface {
	// MatchAKI checks if a credential's certificate chain contains a certificate
	// with the given Authority Key Identifier (base64url-encoded).
	MatchAKI(credentialCertChain [][]byte, aki string) bool

	// MatchETSI checks if a credential's issuer is present in the ETSI Trusted List.
	// The tlURL is the URL of the Trusted List or List of Trusted Lists.
	MatchETSI(credentialCertChain [][]byte, tlURL string) bool

	// MatchOpenIDFederation checks if a credential's issuer is part of an OpenID Federation
	// with the given Trust Anchor entity identifier.
	MatchOpenIDFederation(issuer string, trustAnchorEntityID string) bool
}

type VC20CreateRequest struct {
	// CredentialID is the unique ID for the credential (optional, generated if empty)
	CredentialID string
	// Types are the credential types (e.g., ["VerifiableCredential", "UniversityDegreeCredential"])
	Types []string
	// Subject is the credential subject (the entity the credential is about)
	Subject map[string]any
	// AdditionalContexts are extra JSON-LD contexts to include
	AdditionalContexts []string
	// ValidFrom is when the credential becomes valid (defaults to now)
	ValidFrom time.Time
	// ValidUntil is when the credential expires (optional)
	ValidUntil *time.Time
	// CredentialStatus for revocation (optional)
	CredentialStatus map[string]any
}

type VC20CreateResult struct {
	// CredentialJSON is the signed credential as JSON bytes
	CredentialJSON []byte
	// CredentialID is the credential's unique ID
	CredentialID string
	// Issuer is the issuer DID
	Issuer string
	// ValidFrom is when the credential is valid from
	ValidFrom time.Time
	// ValidUntil is when the credential expires (nil if no expiration)
	ValidUntil *time.Time
}

type VC20Handler struct {
	// contains filtered or unexported fields
}

type VC20HandlerOption func(*VC20Handler)

type VC20KeyResolver interface {
	// ResolveKey resolves a verification method to a public key.
	// verificationMethod can be:
	//   - Full DID URL: "did:key:z6Mk...#key-1"
	//   - DID with fragment: "did:web:example.com#keys-1"
	//   - HTTP URL: "https://example.com/keys/1"
	// Returns crypto.PublicKey which can be *ecdsa.PublicKey or ed25519.PublicKey
	ResolveKey(ctx context.Context, verificationMethod string) (crypto.PublicKey, error)
}

type VC20SignerConfig struct {
	// PrivateKey is the signing key (ecdsa.PrivateKey or ed25519.PrivateKey)
	PrivateKey crypto.PrivateKey
	// IssuerID is the DID or URI of the issuer (e.g., "did:web:example.com")
	IssuerID string
	// VerificationMethod is the full verification method URI (e.g., "did:web:example.com#key-1")
	VerificationMethod string
	// Cryptosuite specifies which suite to use: ecdsa-rdfc-2019, ecdsa-sd-2023, eddsa-rdfc-2022
	Cryptosuite string
}

type VC20VerificationResult struct {
	// Credential metadata
	ID             string     `json:"id,omitempty"`
	Issuer         string     `json:"issuer"`
	Subject        string     `json:"subject,omitempty"`
	Types          []string   `json:"type"`
	IssuanceDate   time.Time  `json:"validFrom"`
	ExpirationDate *time.Time `json:"validUntil,omitempty"`

	// Credential content
	CredentialSubject map[string]any `json:"credentialSubject"`

	// Proof metadata
	ProofType          string    `json:"proofType"`
	Cryptosuite        string    `json:"cryptosuite"`
	VerificationMethod string    `json:"verificationMethod"`
	ProofPurpose       string    `json:"proofPurpose"`
	ProofCreated       time.Time `json:"proofCreated"`

	// Selective disclosure info (for ecdsa-sd-2023)
	IsSelectiveDisclosure bool     `json:"isSelectiveDisclosure"`
	DisclosedPaths        []string `json:"disclosedPaths,omitempty"`

	// All claims as map for generic access
	Claims map[string]any `json:"claims"`

	// Raw credential JSON
	RawCredential json.RawMessage `json:"rawCredential"`
}

type VPBuildOptions struct {
	// HolderDID is the DID of the presentation holder
	HolderDID string

	// VerificationMethod is the full verification method URI (e.g., did:key:z6Mk...#key-1)
	VerificationMethod string

	// Nonce is the challenge/nonce from the verifier (required for OpenID4VP)
	Nonce string

	// Domain is the audience/domain for the presentation
	Domain string

	// Cryptosuite specifies which cryptosuite to use for signing
	// Supported: "ecdsa-rdfc-2019", "eddsa-rdfc-2022"
	Cryptosuite string

	// Created timestamp for the proof (defaults to now)
	Created time.Time
}

type VPBuilder struct {
	// contains filtered or unexported fields
}

type VPBuilderOption func(*VPBuilder)

type VPFormatsSupported struct {
	// LDPVC is the configuration for W3C VC Data Integrity format (ldp_vc)
	LDPVC *LDPVCFormat `json:"ldp_vc,omitempty" yaml:"ldp_vc,omitempty"`

	// JWTVCJson is the configuration for JWT-based W3C VC format (jwt_vc_json)
	JWTVCJson *JWTVCFormat `json:"jwt_vc_json,omitempty" yaml:"jwt_vc_json,omitempty"`

	// SDJWT is the configuration for SD-JWT VC format (dc+sd-jwt)
	SDJWT *SDJWTVCFormat `json:"dc+sd-jwt,omitempty" yaml:"dc+sd-jwt,omitempty"`

	// MsoMdoc is the configuration for ISO mdoc format (mso_mdoc)
	MsoMdoc *MsoMdocFormat `json:"mso_mdoc,omitempty" yaml:"mso_mdoc,omitempty"`
}

type VPResponse struct {
	VPToken map[string][]string `json:"vp_token,omitempty" bson:"vp_token" validate:"required"`
	State   string              `json:"state,omitempty" bson:"state" validate:"required"`
}

type VPTokenValidator struct {
	// Nonce from the Authorization Request
	Nonce string

	// ClientID (or Origin for DC API)
	ClientID string

	// ValidateFormat enables SD-JWT format validation (not cryptographic verification).
	// This only validates that the JWT structure is parseable — it does NOT verify
	// the actual cryptographic signature. Use TrustEvaluator for signature verification.
	ValidateFormat bool

	// CheckRevocation enables revocation status checks
	CheckRevocation bool

	// DCQLQuery is the original DCQL query from the request
	DCQLQuery *DCQL

	// TransactionData from the Authorization Request (raw base64url strings). When non-empty, the validator checks that the KB-JWT contains matching transaction_data_hashes.
	TransactionData []string
}

type VerificationFailedError struct {
	Step string
	Err  error
}

type VerificationRejectedError struct {
	Step   string
	Reason string
}

type VerifiedCredentialBinding struct {
	// Scope is the credential query ID / scope this credential was presented for.
	Scope string
	// HolderKeyThumbprint is the RFC 7638 SHA-256 thumbprint of the holder's public key
	// (from cnf.jwk for SD-JWT, or device key for mDoc). Empty if no key binding.
	HolderKeyThumbprint string
	// Claims is the verified credential claims map for attribute-based binding.
	Claims map[string]any
}

type VerifierInfo struct {
	//	Format: REQUIRED. A string that identifies the format of the attestation and how it is encoded. Ecosystems SHOULD use collision-resistant identifiers. Further processing of the attestation is determined by the type of the attestation, which is specified in a format-specific way.
	Format string `json:"format" bson:"format" validate:"required"`

	// Data: REQUIRED. An object or string containing an attestation (e.g. a JWT). The payload structure is defined on a per format level. It is at the discretion of the Wallet whether it uses the information from verifier_info. Factors that influence such Wallet's decision include, but are not limited to, trust framework the Wallet supports, specific policies defined by the Issuers or ecosystem, and profiles of this specification. If the Wallet uses information from verifier_info, the Wallet MUST validate the signature and ensure binding.
	Data string `json:"data" bson:"data" validate:"required"`

	// credential_ids: OPTIONAL. A non-empty array of strings each referencing a Credential requested by the Verifier for which the attestation is relevant. Each string matches the id field in a DCQL Credential Query. If omitted, the attestation is relevant to all requested Credentials.
	CredentialIDS []string `json:"credential_ids,omitempty" bson:"credential_ids,omitempty" validate:"omitempty,dive,required"`
}

type ZKSystemTypeSpec struct {
	// ID identifies this specific system+circuit combination
	// (e.g. "longfellow-libzk-v1_8_1_4259_2945"). A presented ZK document's
	// own `zkSystemId` (pkg/mdoc.ZkDocumentDataMdoc.ZkSystemID) is expected
	// to equal one of a request's ZKSystemType[].ID entries - this is how a
	// verifier confirms the wallet actually used a circuit it offered,
	// rather than some other one.
	ID string `json:"id" yaml:"id" validate:"required"`

	// System is the ZK proof system identifier (e.g. "longfellow-libzk-v1").
	// Params other than "id"/"system" are format-specific (circuit_hash,
	// num_attributes, block_enc_hash, block_enc_sig for Longfellow).
	System string `json:"system" yaml:"system" validate:"required"`

	// Params holds every other member of the wire object, as strings.
	// The json:"-"/yaml:"-" tags exist only so the default struct-tag
	// reflection codecs never touch this field directly - MarshalJSON/
	// UnmarshalJSON and MarshalYAML/UnmarshalYAML below fully own how
	// Params is (de)serialized (flattened to the top level, not nested
	// under a "params" key/property).
	Params map[string]string `json:"-" yaml:"-"`
}