Get the issuance certificate from a TrustedEntity.

Helper to find a specific service type within a TrustedEntity.

Get the revocation certificate from a TrustedEntity.

Type guard to check if a config is for mso_mdoc format

Type guard to check if a config is for dc+sd-jwt format

Build an mso_mdoc credential configuration

Build a dc+sd-jwt credential configuration

Converts a TypedCredentialConfig to CredentialConfigurationSupported This is a type assertion helper since our types are derived from the SDK

Helper function to validate and transform IAE actions array.

Parse a certificate from a Base64-encoded DER string (as used in LoTE trust lists). Converts to PEM format which is more reliably parsed by

Convert base64url or base64 string to Uint8Array.

Bootstrap function to initialize the NestJS application.

Load TLS options from certificate and key files. Returns undefined if TLS is not enabled or files are not found.

Build a P-256 SubjectPublicKeyInfo around the raw uncompressed EC point so we can hand it to WebCrypto's SPKI importer.

Layout (DER): SEQUENCE { AlgorithmIdentifier, BIT STRING { 04 || x || y } } where AlgorithmIdentifier = SEQUENCE { id-ecPublicKey, prime256v1 OID }.

CKA_EC_POINT is specified as a DER-encoded OCTET STRING wrapping the raw ECPoint. Some HSM vendors return the unwrapped ECPoint directly, so we accept both.

Build PostgreSQL SSL settings from environment/config values.

Supported variables:

• DB_SSL=true|false
• DB_SSL_REJECT_UNAUTHORIZED=true|false
• DB_SSL_CA_PATH=/path/to/ca.crt
• DB_SSL_CERT_PATH=/path/to/client.crt
• DB_SSL_KEY_PATH=/path/to/client.key
• DB_SSL_KEY_PASSPHRASE=secret

Convert an ASN.1 DER-encoded ECDSA-Sig-Value (SEQUENCE { r, s }) to the raw r || s representation used by JOSE/COSE. coordLength is the curve coordinate size in bytes (32 for P-256).

Extract DPoP JWK thumbprint from DPoP JWT. Returns undefined if parsing fails or DPoP is not provided.

Extracts the raw cryptographic token from the presentation payload. Supporting Multi-Credential-Flows by evaluating the descriptor_map or falling back to ID-mapping.

Filter an OpenAPI document to only include paths matching (or not matching) a given predicate. Also prunes the tag list to only include tags that are actually referenced by the remaining paths.

Get the encryption service instance. Throws if not initialized.

Initialize the encryption transformer with an EncryptionService instance. Must be called during application bootstrap before any database operations.

Utility function to extract headers from an Express request

Convenience: derive a real WebCrypto public CryptoKey from a public JWK. Used by the cert builder to populate SubjectPublicKeyInfo / compute Subject- and AuthorityKeyIdentifier extensions.

Build an opaque CryptoKey-shaped value that routes WebCrypto sign operations through a KmsAdapter.

The returned object is NEVER usable for export, verify or any other native subtle operation — only for signing, and only when the KmsCryptoProvider is active (which is the default once the KmsProviderRegistry boots).