@credo-ts/openid4vc 0.6.0-pr-2195-20250226092707 → 0.6.0-pr-2209-20250321171013

package/build/openid4vc-verifier/OpenId4VcSiopVerifierService.js

@@ -14,15 +14,17 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OpenId4VcSiopVerifierService = void 0;
 const core_1 = require("@credo-ts/core");
-const oauth2_1 = require("@openid4vc/oauth2");
-const openid4vp_1 = require("@openid4vc/openid4vp");
-const callbacks_1 = require("../shared/callbacks");
+const did_auth_siop_1 = require("@sphereon/did-auth-siop");
+const OpenID4VP_1 = require("@sphereon/did-auth-siop/dist/authorization-response/OpenID4VP");
+const rxjs_1 = require("rxjs");
 const router_1 = require("../shared/router");
+const transform_1 = require("../shared/transform");
 const utils_1 = require("../shared/utils");
 const OpenId4VcVerificationSessionState_1 = require("./OpenId4VcVerificationSessionState");
-const OpenId4VcVerifierEvents_1 = require("./OpenId4VcVerifierEvents");
 const OpenId4VcVerifierModuleConfig_1 = require("./OpenId4VcVerifierModuleConfig");
 const repository_1 = require("./repository");
+const OpenId4VcRelyingPartyEventEmitter_1 = require("./repository/OpenId4VcRelyingPartyEventEmitter");
+const OpenId4VcRelyingPartySessionManager_1 = require("./repository/OpenId4VcRelyingPartySessionManager");
 /**
  * @internal
  */
@@ -34,39 +36,27 @@ let OpenId4VcSiopVerifierService = class OpenId4VcSiopVerifierService {
         this.config = config;
         this.openId4VcVerificationSessionRepository = openId4VcVerificationSessionRepository;
     }
-    getOpenid4vpVerifier(agentContext) {
-        const callbacks = (0, callbacks_1.getOid4vcCallbacks)(agentContext);
-        const openid4vpClient = new openid4vp_1.Openid4vpVerifier({ callbacks });
-        return openid4vpClient;
-    }
     async createAuthorizationRequest(agentContext, options) {
         const nonce = await agentContext.wallet.generateNonce();
         const state = await agentContext.wallet.generateNonce();
-        const isDcApiRequest = options.responseMode === 'dc_api' || options.responseMode === 'dc_api.jwt';
-        const responseMode = options.responseMode ?? 'direct_post.jwt';
-        // No response url for DC API
+        // Correlation id will be the id of the verification session record
+        const correlationId = core_1.utils.uuid();
         let authorizationResponseUrl = (0, core_1.joinUriParts)(this.config.baseUrl, [
             options.verifier.verifierId,
             this.config.authorizationEndpoint.endpointPath,
         ]);
-        const jwtIssuer = options.requestSigner.method === 'none'
-            ? undefined
-            : options.requestSigner.method === 'x5c'
-                ? await (0, utils_1.requestSignerToJwtIssuer)(agentContext, {
-                    ...options.requestSigner,
-                    issuer: authorizationResponseUrl,
-                })
-                : await (0, utils_1.requestSignerToJwtIssuer)(agentContext, options.requestSigner);
+        const jwtIssuer = options.requestSigner.method === 'x5c'
+            ? await (0, utils_1.openIdTokenIssuerToJwtIssuer)(agentContext, {
+                ...options.requestSigner,
+                issuer: authorizationResponseUrl,
+            })
+            : await (0, utils_1.openIdTokenIssuerToJwtIssuer)(agentContext, options.requestSigner);
         let clientIdScheme;
         let clientId;
-        if (!jwtIssuer) {
-            if (!isDcApiRequest) {
-                throw new Error("requestSigner method 'none' is only supported for response mode 'dc_api' and 'dc_api.jwt'");
+        if (jwtIssuer.method === 'x5c') {
+            if (jwtIssuer.issuer !== authorizationResponseUrl) {
+                throw new core_1.CredoError(`The jwtIssuer's issuer field must match the verifier's authorizationResponseUrl '${authorizationResponseUrl}'.`);
             }
-            clientIdScheme = 'web-origin';
-            clientId = undefined;
-        }
-        else if (jwtIssuer?.method === 'x5c') {
             const leafCertificate = core_1.X509Service.getLeafCertificate(agentContext, { certificateChain: jwtIssuer.x5c });
             if (leafCertificate.sanDnsNames.includes((0, core_1.getDomainFromUrl)(jwtIssuer.issuer))) {
                 clientIdScheme = 'x509_san_dns';
@@ -82,354 +72,170 @@ let OpenId4VcSiopVerifierService = class OpenId4VcSiopVerifierService {
                 throw new core_1.CredoError(`With jwtIssuer 'method' 'x5c' the jwtIssuer's 'issuer' field must either match the match a sanDnsName (FQDN) or sanUriName in the leaf x509 chain's leaf certificate.`);
             }
         }
-        else if (jwtIssuer?.method === 'did') {
+        else if (jwtIssuer.method === 'did') {
             clientId = jwtIssuer.didUrl.split('#')[0];
             clientIdScheme = 'did';
         }
         else {
             throw new core_1.CredoError(`Unsupported jwt issuer method '${options.requestSigner.method}'. Only 'did' and 'x5c' are supported.`);
         }
-        // We always use shortened URIs currently
-        const hostedAuthorizationRequestUri = !isDcApiRequest
-            ? (0, core_1.joinUriParts)(this.config.baseUrl, [
-                options.verifier.verifierId,
-                this.config.authorizationRequestEndpoint.endpointPath,
-                // It doesn't really matter what the url is, as long as it's unique
-                core_1.utils.uuid(),
-            ])
-            : // No hosted request needed when using DC API
-                undefined;
-        const client_id = clientIdScheme === 'did' || clientIdScheme === 'https' ? clientId : `${clientIdScheme}:${clientId}`;
-        const client_metadata = await this.getClientMetadata(agentContext, {
-            responseMode,
-            verifier: options.verifier,
+        const relyingParty = await this.getRelyingParty(agentContext, options.verifier, {
+            presentationDefinition: options.presentationExchange?.definition,
             authorizationResponseUrl,
+            clientId,
+            clientIdScheme,
+            responseMode: options.responseMode,
         });
-        const requestParamsBase = {
+        // We always use shortened URIs currently
+        const hostedAuthorizationRequestUri = (0, core_1.joinUriParts)(this.config.baseUrl, [
+            options.verifier.verifierId,
+            this.config.authorizationRequestEndpoint.endpointPath,
+            // It doesn't really matter what the url is, as long as it's unique
+            core_1.utils.uuid(),
+        ]);
+        // This is very unfortunate, but storing state in sphereon's SiOP-OID4VP library
+        // is done async, so we can't be certain yet that the verification session record
+        // is created already when we have created the authorization request. So we need to
+        // wait for a short while before we can be certain that the verification session record
+        // is created. To not use arbitrary timeouts, we wait for the specific RecordSavedEvent
+        // that is emitted when the verification session record is created.
+        const eventEmitter = agentContext.dependencyManager.resolve(core_1.EventEmitter);
+        const verificationSessionCreatedPromise = (0, rxjs_1.firstValueFrom)(eventEmitter
+            .observable(core_1.RepositoryEventTypes.RecordSaved)
+            .pipe((0, rxjs_1.filter)((e) => e.metadata.contextCorrelationId === agentContext.contextCorrelationId), (0, rxjs_1.filter)((e) => e.payload.record.id === correlationId && e.payload.record.verifierId === options.verifier.verifierId), (0, rxjs_1.first)(), (0, rxjs_1.timeout)({
+            first: 10000,
+            meta: 'OpenId4VcSiopVerifierService.createAuthorizationRequest',
+        }), (0, rxjs_1.map)((e) => e.payload.record)));
+        const authorizationRequest = await relyingParty.createAuthorizationRequest({
+            correlationId,
             nonce,
-            presentation_definition: options.presentationExchange?.definition,
-            dcql_query: options.dcql?.query,
-            transaction_data: options.transactionData?.map((entry) => core_1.JsonEncoder.toBase64URL(entry)),
-            response_mode: responseMode,
-            response_type: 'vp_token',
-            client_metadata,
-        };
-        const authorizationRequestPayload = requestParamsBase.response_mode === 'dc_api.jwt' || requestParamsBase.response_mode === 'dc_api'
-            ? {
-                ...requestParamsBase,
-                // No client_id for unsigned requests
-                client_id: jwtIssuer ? client_id : undefined,
-                response_mode: requestParamsBase.response_mode,
-                expected_origins: options.expectedOrigins,
-            }
-            : {
-                ...requestParamsBase,
-                client_id: client_id,
-                state,
-                response_uri: authorizationResponseUrl,
-            };
-        const openid4vpVerifier = this.getOpenid4vpVerifier(agentContext);
-        const authorizationRequest = await openid4vpVerifier.createOpenId4vpAuthorizationRequest({
-            jar: jwtIssuer
-                ? {
-                    jwtSigner: jwtIssuer,
-                    // FIXME: cast can be removed when PR 41 is merged in oid4vc-ts
-                    requestUri: hostedAuthorizationRequestUri,
-                }
-                : undefined,
-            requestParams: authorizationRequestPayload,
-        });
-        const verificationSession = new repository_1.OpenId4VcVerificationSessionRecord({
-            // Only store payload for unsiged requests
-            authorizationRequestPayload: authorizationRequest.jar ? undefined : authorizationRequestPayload,
-            authorizationRequestJwt: authorizationRequest.jar?.requestObjectJwt,
-            authorizationRequestUri: authorizationRequest.jar?.requestUri,
-            state: OpenId4VcVerificationSessionState_1.OpenId4VcVerificationSessionState.RequestCreated,
-            verifierId: options.verifier.verifierId,
+            state,
+            requestByReferenceURI: hostedAuthorizationRequestUri,
+            jwtIssuer,
         });
-        await this.openId4VcVerificationSessionRepository.save(agentContext, verificationSession);
-        this.emitStateChangedEvent(agentContext, verificationSession, null);
-        return {
-            authorizationRequest: authorizationRequest.authRequest,
-            verificationSession,
-            authorizationRequestObject: authorizationRequest.authRequestObject,
-        };
-    }
-    getDcqlVerifiedResponse(agentContext, _dcqlQuery, presentation) {
-        const dcqlService = agentContext.dependencyManager.resolve(core_1.DcqlService);
-        const dcqlQuery = dcqlService.validateDcqlQuery(_dcqlQuery);
-        const dcqlPresentationEntries = Object.entries(presentation);
-        const dcqlPresentation = Object.fromEntries(dcqlPresentationEntries.map((presentation) => {
-            const [credentialId, vpTokenPresentationParseResult] = presentation;
-            return [credentialId, this.decodePresentation(agentContext, { vpTokenPresentationParseResult })];
-        }));
-        const dcqlPresentationResult = dcqlService.assertValidDcqlPresentation(dcqlPresentation, dcqlQuery);
-        return {
-            query: dcqlQuery,
-            presentation: dcqlPresentation,
-            presentationResult: dcqlPresentationResult,
-        };
-    }
-    async parseAuthorizationResponse(agentContext, options) {
-        const { verifierId, responsePayload } = options;
-        let verificationSession;
-        let parsedAuthResponse;
-        let rawResponsePayload = responsePayload;
-        try {
-            parsedAuthResponse = await (0, openid4vp_1.parseOpenid4vpAuthorizationResponse)({
-                responsePayload,
-                callbacks: {
-                    ...(0, callbacks_1.getOid4vcCallbacks)(agentContext),
-                    getOpenid4vpAuthorizationRequest: async (responsePayload) => {
-                        const { state, nonce } = responsePayload;
-                        rawResponsePayload = responsePayload;
-                        const session = await this.findVerificationSessionForAuthorizationResponse(agentContext, {
-                            authorizationResponseParams: { state, nonce },
-                            verifierId,
-                        });
-                        if (!session) {
-                            agentContext.config.logger.warn(`No verification session found for incoming authorization response for verifier ${verifierId}`);
-                            throw new core_1.CredoError(`No state or nonce provided in authorization response for verifier ${verifierId}`);
-                        }
-                        verificationSession = session;
-                        const authorizationRequest = (0, openid4vp_1.parseOpenid4vpAuthorizationRequestPayload)({
-                            authorizationRequest: verificationSession.request,
-                        });
-                        if (authorizationRequest.type !== 'openid4vp' && authorizationRequest.type !== 'openid4vp_dc_api') {
-                            throw new core_1.CredoError(`Invalid authorization request jwt. Expected 'openid4vp' or 'openid4vp_dc_api' request, received '${authorizationRequest.type}'.`);
-                        }
-                        if (authorizationRequest.params.client_id) {
-                            return {
-                                authorizationRequest: {
-                                    ...authorizationRequest.params,
-                                    client_id: authorizationRequest.params.client_id,
-                                },
-                            };
-                        }
-                        if (!options.origin) {
-                            throw new core_1.CredoError('Origin must be provided when client id is not set.');
-                        }
-                        return {
-                            authorizationRequest: {
-                                ...authorizationRequest.params,
-                                client_id: authorizationRequest.params.client_id ?? `web-origin:${options.origin}`,
-                            },
-                        };
-                    },
-                },
-            });
-        }
-        catch (error) {
-            if (verificationSession?.state === OpenId4VcVerificationSessionState_1.OpenId4VcVerificationSessionState.RequestUriRetrieved ||
-                verificationSession?.state === OpenId4VcVerificationSessionState_1.OpenId4VcVerificationSessionState.RequestCreated) {
-                const parsed = openid4vp_1.zOpenid4vpAuthorizationResponse.safeParse(rawResponsePayload);
-                verificationSession.authorizationResponsePayload = parsed.success ? parsed.data : undefined;
-                verificationSession.errorMessage = error.message;
-                await this.updateState(agentContext, verificationSession, OpenId4VcVerificationSessionState_1.OpenId4VcVerificationSessionState.Error);
-            }
-            throw error;
+        // NOTE: it's not possible to set the uri scheme when using the RP to create an auth request, only lower level
+        // functions allow this. So we need to replace the uri scheme manually.
+        let authorizationRequestUri = (await authorizationRequest.uri()).encodedUri;
+        if (options.presentationExchange && !options.idToken) {
+            authorizationRequestUri = authorizationRequestUri.replace('openid://', 'openid4vp://');
         }
-        if (parsedAuthResponse.authResponsePayload.presentation_submission &&
-            typeof parsedAuthResponse.authResponsePayload.presentation_submission === 'string') {
-            const decoded = decodeURIComponent(parsedAuthResponse.authResponsePayload.presentation_submission);
-            const parsed = JSON.parse(decoded);
-            parsedAuthResponse.authResponsePayload.presentation_submission = parsed;
-            if (parsedAuthResponse.type === 'pex') {
-                parsedAuthResponse.pex.presentationSubmission = parsed;
-            }
-        }
-        if (!verificationSession) {
-            throw new core_1.CredoError('Missing verification session, cannot verify authorization response.');
-        }
-        // FIXME: export JarmMode from openid4vp
-        if (parsedAuthResponse.jarm && `${parsedAuthResponse.jarm.type}` !== 'Encrypted') {
-            throw new oauth2_1.Oauth2ServerErrorResponseError({
-                error: oauth2_1.Oauth2ErrorCodes.InvalidRequest,
-                error_description: `Only encrypted JARM responses are supported, received '${parsedAuthResponse.jarm.type}'.`,
-            });
+        else {
+            authorizationRequestUri = authorizationRequestUri.replace('openid4vp://', 'openid://');
         }
+        const verificationSession = await verificationSessionCreatedPromise;
         return {
-            ...parsedAuthResponse,
+            authorizationRequest: authorizationRequestUri,
             verificationSession,
         };
     }
     async verifyAuthorizationResponse(agentContext, options) {
-        const openid4vpVerifier = this.getOpenid4vpVerifier(agentContext);
-        const result = await this.parseAuthorizationResponse(agentContext, {
-            verifierId: options.verifierId,
-            responsePayload: options.authorizationResponse,
-            origin: options.origin,
-        });
-        result.verificationSession.assertState([
+        // Assert state
+        options.verificationSession.assertState([
             OpenId4VcVerificationSessionState_1.OpenId4VcVerificationSessionState.RequestUriRetrieved,
             OpenId4VcVerificationSessionState_1.OpenId4VcVerificationSessionState.RequestCreated,
         ]);
-        const authorizationRequest = result.authRequestPayload;
-        let requestClientId = authorizationRequest.client_id;
-        const responseUri = 'response_uri' in authorizationRequest ? authorizationRequest.response_uri : undefined;
-        const transactionData = authorizationRequest.transaction_data
-            ? openid4vpVerifier.parseTransactionData({ transactionData: authorizationRequest.transaction_data })
-            : undefined;
-        const isDcApiRequest = authorizationRequest.response_mode === 'dc_api' || authorizationRequest.response_mode === 'dc_api.jwt';
-        if (isDcApiRequest) {
-            if (!options.origin)
-                throw new core_1.CredoError('origin is required for Digital Credentials API');
-            if (!requestClientId)
-                requestClientId = `web-origin:${options.origin}`;
-        }
-        else if (!requestClientId) {
-            throw new core_1.CredoError('Missing required client_id');
-        }
-        // validating the id token
-        // verifying the presentations
-        // validating the presentations against the presentation definition
-        // checking the revocation status of the presentations
-        // checking the nonce of the presentations matches the nonce of the request
-        let presentationVerificationResults = [];
-        if (result.type === 'dcql') {
-            const dcqlPresentationEntries = Object.entries(result.dcql.presentation);
-            const presentationVerificationPromises = dcqlPresentationEntries.map(async (presentation) => {
-                const [credentialId, vpTokenPresentationParseResult] = presentation;
-                return await this.verifyPresentations(agentContext, {
-                    correlationId: result.verificationSession.id,
-                    transactionData,
-                    nonce: authorizationRequest.nonce,
-                    audience: requestClientId,
-                    origin: options.origin,
-                    responseUri,
-                    mdocGeneratedNonce: result.jarm?.mdocGeneratedNonce,
-                    verificationSessionRecordId: result.verificationSession.id,
-                    vpTokenPresentationParseResult,
-                    credentialId,
-                });
-            });
-            presentationVerificationResults = await Promise.all(presentationVerificationPromises);
-        }
-        if (result.type === 'pex') {
-            const presentations = result.pex.presentations;
-            const pex = agentContext.dependencyManager.resolve(core_1.DifPresentationExchangeService);
-            pex.validatePresentationDefinition(result.pex.presentationDefinition);
-            pex.validatePresentationSubmission(result.pex.presentationSubmission);
-            const presentationsArray = Array.isArray(presentations) ? presentations : [presentations];
-            const presentationVerificationPromises = presentationsArray.map((presentation) => {
-                const inputDescriptor = result.pex.presentationSubmission.descriptor_map.find((descriptorMapEntry) => descriptorMapEntry.path === presentation.path);
-                if (!inputDescriptor) {
-                    throw new core_1.CredoError(`Could not map transaction data entry to input descriptor.`);
-                }
-                return this.verifyPresentations(agentContext, {
-                    correlationId: result.verificationSession.id,
-                    transactionData,
-                    nonce: authorizationRequest.nonce,
+        const authorizationRequest = await did_auth_siop_1.AuthorizationRequest.fromUriOrJwt(options.verificationSession.authorizationRequestJwt);
+        const verifier = await this.getVerifierByVerifierId(agentContext, options.verificationSession.verifierId);
+        const requestClientId = await authorizationRequest.getMergedProperty('client_id');
+        const requestNonce = await authorizationRequest.getMergedProperty('nonce');
+        const requestState = await authorizationRequest.getMergedProperty('state');
+        const responseUri = await authorizationRequest.getMergedProperty('response_uri');
+        const presentationDefinitionsWithLocation = await authorizationRequest.getPresentationDefinitions();
+        if (!requestNonce || !requestClientId || !requestState) {
+            throw new core_1.CredoError(`Unable to find nonce, state, or client_id in authorization request for verification session '${options.verificationSession.id}'`);
+        }
+        const authorizationResponseUrl = (0, core_1.joinUriParts)(this.config.baseUrl, [
+            options.verificationSession.verifierId,
+            this.config.authorizationEndpoint.endpointPath,
+        ]);
+        const relyingParty = await this.getRelyingParty(agentContext, verifier, {
+            presentationDefinition: presentationDefinitionsWithLocation?.[0]?.definition,
+            authorizationResponseUrl,
+            clientId: requestClientId,
+        });
+        // This is very unfortunate, but storing state in sphereon's SiOP-OID4VP library
+        // is done async, so we can't be certain yet that the verification session record
+        // is updated already when we have verified the authorization response. So we need to
+        // wait for a short while before we can be certain that the verification session record
+        // is updated. To not use arbitrary timeouts, we wait for the specific RecordUpdatedEvent
+        // that is emitted when the verification session record is updated.
+        const eventEmitter = agentContext.dependencyManager.resolve(core_1.EventEmitter);
+        const verificationSessionUpdatedPromise = (0, rxjs_1.firstValueFrom)(eventEmitter
+            .observable(core_1.RepositoryEventTypes.RecordUpdated)
+            .pipe((0, rxjs_1.filter)((e) => e.metadata.contextCorrelationId === agentContext.contextCorrelationId), (0, rxjs_1.filter)((e) => e.payload.record.id === options.verificationSession.id &&
+            e.payload.record.verifierId === options.verificationSession.verifierId &&
+            (e.payload.record.state === OpenId4VcVerificationSessionState_1.OpenId4VcVerificationSessionState.ResponseVerified ||
+                e.payload.record.state === OpenId4VcVerificationSessionState_1.OpenId4VcVerificationSessionState.Error)), (0, rxjs_1.first)(), (0, rxjs_1.timeout)({
+            first: 10000,
+            meta: 'OpenId4VcSiopVerifierService.verifyAuthorizationResponse',
+        }), (0, rxjs_1.map)((e) => e.payload.record)));
+        await relyingParty.verifyAuthorizationResponse(options.authorizationResponse, {
+            audience: requestClientId,
+            correlationId: options.verificationSession.id,
+            state: requestState,
+            presentationDefinitions: presentationDefinitionsWithLocation,
+            verification: {
+                presentationVerificationCallback: this.getPresentationVerificationCallback(agentContext, {
+                    correlationId: options.verificationSession.id,
+                    nonce: requestNonce,
                     audience: requestClientId,
                     responseUri,
-                    mdocGeneratedNonce: result.jarm?.mdocGeneratedNonce,
-                    verificationSessionRecordId: result.verificationSession.id,
-                    vpTokenPresentationParseResult: presentation,
-                    credentialId: inputDescriptor.id,
-                });
-            });
-            presentationVerificationResults = await Promise.all(presentationVerificationPromises);
-        }
-        try {
-            const errorMessages = presentationVerificationResults
-                .map((result, index) => (!result.verified ? `\t- [${index}]: ${result.reason}` : undefined))
-                .filter((i) => i !== undefined);
-            if (errorMessages.length > 0) {
-                throw new core_1.CredoError(`One or more presentations failed verification. \n\t${errorMessages.join('\n')}`);
-            }
-            // Validate the presentations against the query
-            if (result.type === 'pex') {
-                const pex = agentContext.dependencyManager.resolve(core_1.DifPresentationExchangeService);
-                const presentations = presentationVerificationResults
-                    .map((p) => (p.verified ? p.presentation : undefined))
-                    .filter((p) => p !== undefined);
-                pex.validatePresentation(
-                // FIXME: type. it should always be an object as we created it
-                result.pex.presentationDefinition, presentations, result.pex.presentationSubmission);
-            }
-            else {
-                const dcql = agentContext.dependencyManager.resolve(core_1.DcqlService);
-                const presentations = presentationVerificationResults.reduce((all, p) => (p.verified ? { ...all, [p.credentialId]: p.presentation } : all), {});
-                // FIXME: type for this parameter
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                dcql.assertValidDcqlPresentation(presentations, result.dcql.query);
-            }
-            const transactionDataMeta = [];
-            for (const result of presentationVerificationResults) {
-                if (result.verified && result.transactionDataMeta) {
-                    transactionDataMeta.push([result.transactionDataMeta.credentialId, result.transactionDataMeta]);
-                }
-            }
-            if (transactionData) {
-                const inputDescriptorToTransactionDataMeta = Object.fromEntries(transactionDataMeta);
-                if (!transactionData.every((tdEntry) => {
-                    return tdEntry.credential_ids.some((credentialId) => inputDescriptorToTransactionDataMeta[credentialId]);
-                })) {
-                    throw new core_1.CredoError('One ore more required transaction data entries were not found in the signed transaction data.');
-                }
-            }
-        }
-        catch (error) {
-            result.verificationSession.errorMessage = error.message;
-            await this.updateState(agentContext, result.verificationSession, OpenId4VcVerificationSessionState_1.OpenId4VcVerificationSessionState.Error);
-            throw error;
-        }
-        result.verificationSession.authorizationResponsePayload = result.authResponsePayload;
-        await this.updateState(agentContext, result.verificationSession, OpenId4VcVerificationSessionState_1.OpenId4VcVerificationSessionState.ResponseVerified);
-        const verifiedAuthorizationResponse = await this.getVerifiedAuthorizationResponse(agentContext, result.verificationSession);
-        return { ...verifiedAuthorizationResponse, verificationSession: result.verificationSession };
+                    mdocGeneratedNonce: options.jarmHeader?.apu
+                        ? core_1.TypedArrayEncoder.toUtf8String(core_1.TypedArrayEncoder.fromBase64(options.jarmHeader.apu))
+                        : undefined,
+                    verificationSessionRecordId: options.verificationSession.id,
+                }),
+            },
+        });
+        const verificationSession = await verificationSessionUpdatedPromise;
+        const verifiedAuthorizationResponse = await this.getVerifiedAuthorizationResponse(verificationSession);
+        return {
+            ...verifiedAuthorizationResponse,
+            verificationSession: await verificationSessionUpdatedPromise,
+        };
     }
-    async getVerifiedAuthorizationResponse(agentContext, verificationSession) {
+    async getVerifiedAuthorizationResponse(verificationSession) {
         verificationSession.assertState(OpenId4VcVerificationSessionState_1.OpenId4VcVerificationSessionState.ResponseVerified);
         if (!verificationSession.authorizationResponsePayload) {
             throw new core_1.CredoError('No authorization response payload found in the verification session.');
         }
-        const openid4vpAuthorizationResponsePayload = verificationSession.authorizationResponsePayload;
-        const openid4vpVerifier = this.getOpenid4vpVerifier(agentContext);
-        const authorizationRequest = openid4vpVerifier.parseOpenid4vpAuthorizationRequestPayload({
-            authorizationRequest: verificationSession.request,
-        });
-        if (authorizationRequest.provided !== 'jwt' || authorizationRequest.type === 'jar') {
-            throw new core_1.CredoError('Invalid authorization request jwt');
-        }
-        const result = openid4vpVerifier.validateOpenid4vpAuthorizationResponse({
-            authorizationRequest: authorizationRequest.params,
-            authorizationResponse: openid4vpAuthorizationResponsePayload,
-        });
-        const transactionData = authorizationRequest.params.transaction_data
-            ? openid4vpVerifier.parseTransactionData({ transactionData: authorizationRequest.params.transaction_data })
+        const authorizationResponse = await did_auth_siop_1.AuthorizationResponse.fromPayload(verificationSession.authorizationResponsePayload);
+        const authorizationRequest = await did_auth_siop_1.AuthorizationRequest.fromUriOrJwt(verificationSession.authorizationRequestJwt);
+        const idToken = authorizationResponse.idToken
+            ? { payload: await authorizationResponse.idToken?.payload() }
             : undefined;
         let presentationExchange = undefined;
-        const dcql = result.type === 'dcql'
-            ? this.getDcqlVerifiedResponse(agentContext, authorizationRequest.params.dcql_query, result.dcql.presentation)
-            : undefined;
-        const vpToken = (0, utils_1.parseIfJson)(openid4vpAuthorizationResponsePayload.vp_token);
-        const presentationDefinition = authorizationRequest.params
-            .presentation_definition;
-        if (presentationDefinition) {
-            if (!vpToken) {
-                throw new core_1.CredoError('Missing vp_token in the openid4vp authorization response.');
-            }
-            const rawPresentations = openid4vpVerifier.parsePresentationsFromVpToken({ vpToken });
-            const submission = openid4vpAuthorizationResponsePayload.presentation_submission;
+        const presentationDefinitions = await authorizationRequest.getPresentationDefinitions();
+        if (presentationDefinitions && presentationDefinitions.length > 0) {
+            const rawPresentations = authorizationResponse.payload.vp_token
+                ? await (0, OpenID4VP_1.extractPresentationsFromVpToken)(authorizationResponse.payload.vp_token, {
+                    hasher: core_1.Hasher.hash,
+                })
+                : [];
+            // TODO: Probably wise to check against request for the location of the submission_data
+            const submission = idToken?.payload?._vp_token?.presentation_submission ?? authorizationResponse.payload.presentation_submission;
             if (!submission) {
                 throw new core_1.CredoError('Unable to extract submission from the response.');
             }
-            const verifiablePresentations = rawPresentations.map((presentation) => this.getPresentationFromVpTokenParseResult(agentContext, presentation));
+            // FIXME: should return type be an array? As now it doesn't always match the submission
+            const verifiablePresentations = Array.isArray(rawPresentations)
+                ? rawPresentations.map(transform_1.getVerifiablePresentationFromSphereonWrapped)
+                : (0, transform_1.getVerifiablePresentationFromSphereonWrapped)(rawPresentations);
+            const definition = presentationDefinitions[0].definition;
             presentationExchange = {
-                definition: presentationDefinition,
+                definition,
                 submission,
-                presentations: verifiablePresentations,
-                descriptors: (0, core_1.extractPresentationsWithDescriptorsFromSubmission)(verifiablePresentations, submission, presentationDefinition),
+                // We always return this as an array
+                presentations: Array.isArray(verifiablePresentations) ? verifiablePresentations : [verifiablePresentations],
+                descriptors: (0, core_1.extractPresentationsWithDescriptorsFromSubmission)(verifiablePresentations, submission, definition),
             };
         }
-        if (!presentationExchange && !dcql) {
-            throw new core_1.CredoError('No presentationExchange or dcql found in the response.');
+        if (!idToken && !presentationExchange) {
+            throw new core_1.CredoError('No idToken or presentationExchange found in the response.');
         }
         return {
+            idToken,
             presentationExchange,
-            dcql,
-            transactionData,
         };
     }
     /**
@@ -440,8 +246,16 @@ let OpenId4VcSiopVerifierService = class OpenId4VcSiopVerifierService {
         let nonce;
         let state;
         if (authorizationResponse) {
-            const state = authorizationResponse.state;
-            if (!state) {
+            const authorizationResponseInstance = await did_auth_siop_1.AuthorizationResponse.fromPayload(authorizationResponse).catch(() => {
+                throw new core_1.CredoError(`Unable to parse authorization response payload. ${JSON.stringify(authorizationResponse)}`);
+            });
+            nonce = await authorizationResponseInstance.getMergedProperty('nonce', {
+                hasher: core_1.Hasher.hash,
+            });
+            state = await authorizationResponseInstance.getMergedProperty('state', {
+                hasher: core_1.Hasher.hash,
+            });
+            if (!nonce && !state) {
                 throw new core_1.CredoError('Could not extract nonce or state from authorization response. Unable to find OpenId4VcVerificationSession.');
             }
         }
@@ -483,18 +297,37 @@ let OpenId4VcSiopVerifierService = class OpenId4VcSiopVerifierService {
     async getVerificationSessionById(agentContext, verificationSessionId) {
         return this.openId4VcVerificationSessionRepository.getById(agentContext, verificationSessionId);
     }
-    async getClientMetadata(agentContext, options) {
-        const { responseMode, verifier } = options;
+    async getRelyingParty(agentContext, verifier, { idToken, presentationDefinition, clientId, clientIdScheme, authorizationResponseUrl, responseMode, }) {
         const signatureSuiteRegistry = agentContext.dependencyManager.resolve(core_1.SignatureSuiteRegistry);
         const supportedAlgs = (0, utils_1.getSupportedJwaSignatureAlgorithms)(agentContext);
         const supportedMdocAlgs = supportedAlgs.filter(core_1.isMdocSupportedSignatureAlgorithm);
         const supportedProofTypes = signatureSuiteRegistry.supportedProofTypes;
+        // Check: audience must be set to the issuer with dynamic disc otherwise self-issued.me/v2.
+        const builder = did_auth_siop_1.RP.builder();
+        const responseTypes = [];
+        if (!presentationDefinition && idToken === false) {
+            throw new core_1.CredoError('Either `presentationExchange` or `idToken` must be enabled');
+        }
+        if (presentationDefinition) {
+            responseTypes.push(did_auth_siop_1.ResponseType.VP_TOKEN);
+        }
+        if (idToken === true || !presentationDefinition) {
+            responseTypes.push(did_auth_siop_1.ResponseType.ID_TOKEN);
+        }
         // FIXME: we now manually remove did:peer, we should probably allow the user to configure this
         const supportedDidMethods = agentContext.dependencyManager
             .resolve(core_1.DidsApi)
             .supportedResolverMethods.filter((m) => m !== 'peer');
+        // The OpenId4VcRelyingPartyEventHandler is a global event handler that makes sure that
+        // all the events are handled, and that the correct context is used for the events.
+        const sphereonEventEmitter = agentContext.dependencyManager
+            .resolve(OpenId4VcRelyingPartyEventEmitter_1.OpenId4VcRelyingPartyEventHandler)
+            .getEventEmitterForVerifier(agentContext.contextCorrelationId, verifier.verifierId);
+        const mode = !responseMode || responseMode === 'direct_post'
+            ? did_auth_siop_1.ResponseMode.DIRECT_POST
+            : did_auth_siop_1.ResponseMode.DIRECT_POST_JWT;
         let jarmEncryptionJwk;
-        if ((0, openid4vp_1.isJarmResponseMode)(responseMode)) {
+        if (mode === did_auth_siop_1.ResponseMode.DIRECT_POST_JWT) {
             const key = await agentContext.wallet.createKey({ keyType: core_1.KeyType.P256 });
             jarmEncryptionJwk = { ...(0, core_1.getJwkFromKey)(key).toJson(), kid: key.fingerprint, use: 'enc' };
         }
@@ -502,20 +335,44 @@ let OpenId4VcSiopVerifierService = class OpenId4VcSiopVerifierService {
             ? {
                 jwks: { keys: [jarmEncryptionJwk] },
                 authorization_encrypted_response_alg: 'ECDH-ES',
-                // FIXME: we need to allow setting this, but also to fetch it based on the `request_uri` and
-                // `request_uri_method`
-                authorization_encrypted_response_enc: 'A128GCM',
+                authorization_encrypted_response_enc: 'A256GCM',
             }
             : undefined;
-        return {
+        builder
+            .withClientId(clientId)
+            .withResponseUri(authorizationResponseUrl)
+            .withIssuer(did_auth_siop_1.ResponseIss.SELF_ISSUED_V2)
+            .withAudience(did_auth_siop_1.RequestAud.SELF_ISSUED_V2)
+            .withIssuer(did_auth_siop_1.ResponseIss.SELF_ISSUED_V2)
+            .withSupportedVersions([
+            did_auth_siop_1.SupportedVersion.SIOPv2_D11,
+            did_auth_siop_1.SupportedVersion.SIOPv2_D12_OID4VP_D18,
+            did_auth_siop_1.SupportedVersion.SIOPv2_D12_OID4VP_D20,
+        ])
+            .withResponseMode(mode)
+            .withHasher(core_1.Hasher.hash)
+            // FIXME: should allow verification of revocation
+            // .withRevocationVerificationCallback()
+            .withRevocationVerification(did_auth_siop_1.RevocationVerification.NEVER)
+            .withSessionManager(new OpenId4VcRelyingPartySessionManager_1.OpenId4VcRelyingPartySessionManager(agentContext, verifier.verifierId))
+            .withEventEmitter(sphereonEventEmitter)
+            .withResponseType(responseTypes)
+            .withCreateJwtCallback((0, utils_1.getCreateJwtCallback)(agentContext))
+            .withVerifyJwtCallback((0, utils_1.getVerifyJwtCallback)(agentContext))
+            // TODO: we should probably allow some dynamic values here
+            .withClientMetadata({
             ...jarmClientMetadata,
             ...verifier.clientMetadata,
-            response_types_supported: ['vp_token'],
+            // FIXME: not passing client_id here means it will not be added
+            // to the authorization request url (not the signed payload). Need
+            // to fix that in Sphereon lib
+            client_id: clientId,
+            passBy: did_auth_siop_1.PassBy.VALUE,
+            response_types_supported: [did_auth_siop_1.ResponseType.VP_TOKEN],
             subject_syntax_types_supported: [
                 'urn:ietf:params:oauth:jwk-thumbprint',
                 ...supportedDidMethods.map((m) => `did:${m}`),
             ],
-            authorization_signed_response_alg: 'RS256',
             vp_formats: {
                 mso_mdoc: {
                     alg: supportedMdocAlgs,
@@ -542,249 +399,146 @@ let OpenId4VcSiopVerifierService = class OpenId4VcSiopVerifierService {
                     'kb-jwt_alg_values': supportedAlgs,
                     'sd-jwt_alg_values': supportedAlgs,
                 },
-                'dc+sd-jwt': {
-                    'kb-jwt_alg_values': supportedAlgs,
-                    'sd-jwt_alg_values': supportedAlgs,
-                },
             },
-        };
-    }
-    getPresentationFromVpTokenParseResult(agentContext, vpTokenPresentationParseResult) {
-        if (vpTokenPresentationParseResult.format === 'dc+sd-jwt') {
-            const sdJwtVcApi = agentContext.dependencyManager.resolve(core_1.SdJwtVcApi);
-            return sdJwtVcApi.fromCompact(vpTokenPresentationParseResult.presentation);
-        }
-        else if (vpTokenPresentationParseResult.format === 'mso_mdoc') {
-            return core_1.MdocDeviceResponse.fromBase64Url(vpTokenPresentationParseResult.presentation);
-        }
-        else if (vpTokenPresentationParseResult.format === 'jwt_vp_json') {
-            return core_1.W3cJwtVerifiablePresentation.fromSerializedJwt(vpTokenPresentationParseResult.presentation);
-        }
-        else if (vpTokenPresentationParseResult.format === 'ldp_vp') {
-            return core_1.JsonTransformer.fromJSON(vpTokenPresentationParseResult.presentation, core_1.W3cJsonLdVerifiablePresentation);
-        }
-        throw new core_1.CredoError(`Unsupported presentation format. ${vpTokenPresentationParseResult.format}`);
-    }
-    getTransactionDataMeta(options) {
-        const { vpTokenPresentationParseResult, transactionData, transactionDataResult, credentialId } = options;
-        if (!transactionData) {
-            throw new core_1.CredoError('Could not map transaction data result to the request');
-        }
-        const hashName = transactionDataResult.hashes_alg ?? 'sha-256';
-        const presentationHashes = transactionDataResult.hashes;
-        const transactionDataEntriesWithHash = transactionData.map((tdEntry) => {
-            const hash = core_1.TypedArrayEncoder.toBase64URL(core_1.Hasher.hash(core_1.JsonEncoder.toBase64URL(tdEntry), hashName));
-            return hash;
         });
-        for (const [idx, hash] of transactionDataEntriesWithHash.entries()) {
-            if (presentationHashes[idx] !== hash) {
-                throw new core_1.CredoError(`Transaction data entry ${idx} does not match hash ${hash}`);
-            }
-        }
-        return {
-            credentialId,
-            transactionData,
-            transactionDataResult,
-            path: vpTokenPresentationParseResult.path,
-        };
-    }
-    decodePresentation(agentContext, options) {
-        const { vpTokenPresentationParseResult } = options;
-        if (vpTokenPresentationParseResult.format === 'dc+sd-jwt') {
-            // TODO: it might be better here to look at the presentation submission to know
-            // If presentation includes a ~, we assume it's an SD-JWT-VC
-            const sdJwtVcApi = agentContext.dependencyManager.resolve(core_1.SdJwtVcApi);
-            const sdJwtVc = sdJwtVcApi.fromCompact(vpTokenPresentationParseResult.presentation);
-            return sdJwtVc;
+        if (clientIdScheme) {
+            builder.withClientIdScheme(clientIdScheme);
         }
-        else if (vpTokenPresentationParseResult.format === 'mso_mdoc') {
-            const mdocDeviceResponse = core_1.MdocDeviceResponse.fromBase64Url(vpTokenPresentationParseResult.presentation);
-            return mdocDeviceResponse;
+        if (presentationDefinition) {
+            builder.withPresentationDefinition({ definition: presentationDefinition }, [did_auth_siop_1.PropertyTarget.REQUEST_OBJECT]);
         }
-        else if (vpTokenPresentationParseResult.format === 'jwt_vp_json') {
-            return core_1.W3cJwtVerifiablePresentation.fromSerializedJwt(vpTokenPresentationParseResult.presentation);
-        }
-        else {
-            return core_1.JsonTransformer.fromJSON(vpTokenPresentationParseResult.presentation, core_1.W3cJsonLdVerifiablePresentation);
+        if (responseTypes.includes(did_auth_siop_1.ResponseType.ID_TOKEN)) {
+            builder.withScope('openid');
         }
+        return builder.build();
     }
-    async verifyPresentations(agentContext, options) {
-        const { vpTokenPresentationParseResult, transactionData } = options;
-        let transactionDataMeta = undefined;
-        try {
-            this.logger.debug(`Presentation response`, core_1.JsonTransformer.toJSON(vpTokenPresentationParseResult.presentation));
-            if (!vpTokenPresentationParseResult)
-                throw new core_1.CredoError('Did not receive a presentation for verification.');
-            const x509Config = agentContext.dependencyManager.resolve(core_1.X509ModuleConfig);
-            let isValid;
-            let reason = undefined;
-            let verifiablePresentation;
-            if (vpTokenPresentationParseResult.format === 'dc+sd-jwt') {
-                // TODO: it might be better here to look at the presentation submission to know
-                // If presentation includes a ~, we assume it's an SD-JWT-VC
-                const sdJwtVcApi = agentContext.dependencyManager.resolve(core_1.SdJwtVcApi);
-                const jwt = core_1.Jwt.fromSerializedJwt(vpTokenPresentationParseResult.presentation.split('~')[0]);
-                const sdJwtVc = sdJwtVcApi.fromCompact(vpTokenPresentationParseResult.presentation);
-                const certificateChain = (0, core_1.extractX509CertificatesFromJwt)(jwt);
-                let trustedCertificates = undefined;
-                if (certificateChain && x509Config.getTrustedCertificatesForVerification) {
-                    trustedCertificates = await x509Config.getTrustedCertificatesForVerification(agentContext, {
-                        certificateChain,
-                        verification: {
-                            type: 'credential',
-                            credential: sdJwtVc,
-                            openId4VcVerificationSessionId: options.verificationSessionRecordId,
+    getPresentationVerificationCallback(agentContext, options) {
+        return async (encodedPresentation, presentationSubmission) => {
+            try {
+                this.logger.debug('Presentation response', core_1.JsonTransformer.toJSON(encodedPresentation));
+                this.logger.debug('Presentation submission', presentationSubmission);
+                if (!encodedPresentation)
+                    throw new core_1.CredoError('Did not receive a presentation for verification.');
+                const x509Config = agentContext.dependencyManager.resolve(core_1.X509ModuleConfig);
+                let isValid;
+                let reason = undefined;
+                if (typeof encodedPresentation === 'string' && encodedPresentation.includes('~')) {
+                    // TODO: it might be better here to look at the presentation submission to know
+                    // If presentation includes a ~, we assume it's an SD-JWT-VC
+                    const sdJwtVcApi = agentContext.dependencyManager.resolve(core_1.SdJwtVcApi);
+                    const jwt = core_1.Jwt.fromSerializedJwt(encodedPresentation.split('~')[0]);
+                    const sdJwtVc = sdJwtVcApi.fromCompact(encodedPresentation);
+                    const certificateChain = (0, core_1.extractX509CertificatesFromJwt)(jwt);
+                    let trustedCertificates = undefined;
+                    if (certificateChain && x509Config.getTrustedCertificatesForVerification) {
+                        trustedCertificates = await x509Config.getTrustedCertificatesForVerification(agentContext, {
+                            certificateChain,
+                            verification: {
+                                type: 'credential',
+                                credential: sdJwtVc,
+                                openId4VcVerificationSessionId: options.verificationSessionRecordId,
+                            },
+                        });
+                    }
+                    if (!trustedCertificates) {
+                        // We also take from the config here to avoid the callback being called again
+                        trustedCertificates = x509Config.trustedCertificates ?? [];
+                    }
+                    const verificationResult = await sdJwtVcApi.verify({
+                        compactSdJwtVc: encodedPresentation,
+                        keyBinding: {
+                            audience: options.audience,
+                            nonce: options.nonce,
                         },
+                        trustedCertificates,
                     });
+                    isValid = verificationResult.verification.isValid;
+                    reason = verificationResult.isValid ? undefined : verificationResult.error.message;
                 }
-                if (!trustedCertificates) {
-                    // We also take from the config here to avoid the callback being called again
-                    trustedCertificates = x509Config.trustedCertificates ?? [];
-                }
-                const verificationResult = await sdJwtVcApi.verify({
-                    compactSdJwtVc: vpTokenPresentationParseResult.presentation,
-                    keyBinding: {
-                        audience: options.audience,
-                        nonce: options.nonce,
-                    },
-                    trustedCertificates,
-                });
-                if (verificationResult.sdJwtVc?.transactionData) {
-                    transactionDataMeta = this.getTransactionDataMeta({
-                        vpTokenPresentationParseResult,
-                        transactionData,
-                        transactionDataResult: verificationResult.sdJwtVc.transactionData,
-                        credentialId: options.credentialId,
-                    });
+                else if (typeof encodedPresentation === 'string' && !core_1.Jwt.format.test(encodedPresentation)) {
+                    if (!options.responseUri || !options.mdocGeneratedNonce) {
+                        isValid = false;
+                        reason = 'Mdoc device response verification failed. Response uri and the mdocGeneratedNonce are not set';
+                    }
+                    else {
+                        const mdocDeviceResponse = core_1.MdocDeviceResponse.fromBase64Url(encodedPresentation);
+                        if (mdocDeviceResponse.documents.length !== 1) {
+                            throw new core_1.CredoError('Only a single mdoc is supported per device response for OpenID4VP verification');
+                        }
+                        const document = mdocDeviceResponse.documents[0];
+                        const certificateChain = document.issuerSignedCertificateChain.map((cert) => core_1.X509Certificate.fromRawCertificate(cert));
+                        const trustedCertificates = await x509Config.getTrustedCertificatesForVerification?.(agentContext, {
+                            certificateChain,
+                            verification: {
+                                type: 'credential',
+                                credential: document,
+                                openId4VcVerificationSessionId: options.verificationSessionRecordId,
+                            },
+                        });
+                        await mdocDeviceResponse.verify(agentContext, {
+                            sessionTranscriptOptions: {
+                                clientId: options.audience,
+                                mdocGeneratedNonce: options.mdocGeneratedNonce,
+                                responseUri: options.responseUri,
+                                verifierGeneratedNonce: options.nonce,
+                            },
+                            trustedCertificates,
+                        });
+                        isValid = true;
+                    }
                 }
-                isValid = verificationResult.verification.isValid;
-                reason = verificationResult.isValid ? undefined : verificationResult.error.message;
-                verifiablePresentation = sdJwtVc;
-            }
-            else if (vpTokenPresentationParseResult.format === 'mso_mdoc') {
-                const mdocDeviceResponse = core_1.MdocDeviceResponse.fromBase64Url(vpTokenPresentationParseResult.presentation);
-                const trustedCertificates = (await Promise.all(mdocDeviceResponse.documents.map(async (mdoc) => {
-                    const certificateChain = mdoc.issuerSignedCertificateChain.map((cert) => core_1.X509Certificate.fromRawCertificate(cert));
-                    const trustedCertificates = await x509Config.getTrustedCertificatesForVerification?.(agentContext, {
-                        certificateChain,
-                        verification: {
-                            type: 'credential',
-                            credential: mdoc,
-                            openId4VcVerificationSessionId: options.verificationSessionRecordId,
-                        },
+                else if (typeof encodedPresentation === 'string' && core_1.Jwt.format.test(encodedPresentation)) {
+                    const presentation = core_1.W3cJwtVerifiablePresentation.fromSerializedJwt(encodedPresentation);
+                    const certificateChain = (0, core_1.extractX509CertificatesFromJwt)(presentation.jwt);
+                    let trustedCertificates = undefined;
+                    if (certificateChain && x509Config.getTrustedCertificatesForVerification) {
+                        trustedCertificates = await x509Config.getTrustedCertificatesForVerification?.(agentContext, {
+                            certificateChain,
+                            verification: {
+                                type: 'credential',
+                                credential: presentation,
+                                openId4VcVerificationSessionId: options.verificationSessionRecordId,
+                            },
+                        });
+                    }
+                    if (!trustedCertificates) {
+                        trustedCertificates = x509Config.trustedCertificates ?? [];
+                    }
+                    const verificationResult = await this.w3cCredentialService.verifyPresentation(agentContext, {
+                        presentation: encodedPresentation,
+                        challenge: options.nonce,
+                        domain: options.audience,
+                        trustedCertificates,
                     });
-                    // TODO: could have some duplication but not a big issue
-                    return trustedCertificates ?? x509Config.trustedCertificates;
-                })))
-                    .filter((c) => c !== undefined)
-                    .flatMap((c) => c);
-                let sessionTranscriptOptions;
-                if (options.origin) {
-                    sessionTranscriptOptions = {
-                        type: 'openId4VpDcApi',
-                        clientId: options.audience,
-                        verifierGeneratedNonce: options.nonce,
-                        origin: options.origin,
-                    };
+                    isValid = verificationResult.isValid;
+                    reason = verificationResult.error?.message;
                 }
                 else {
-                    if (!options.mdocGeneratedNonce || !options.responseUri) {
-                        throw new core_1.CredoError('mdocGeneratedNonce and responseUri are required for mdoc openid4vp session transcript calculation');
-                    }
-                    sessionTranscriptOptions = {
-                        type: 'openId4Vp',
-                        clientId: options.audience,
-                        mdocGeneratedNonce: options.mdocGeneratedNonce,
-                        responseUri: options.responseUri,
-                        verifierGeneratedNonce: options.nonce,
-                    };
-                }
-                await mdocDeviceResponse.verify(agentContext, {
-                    sessionTranscriptOptions,
-                    trustedCertificates,
-                });
-                isValid = true;
-                verifiablePresentation = mdocDeviceResponse;
-            }
-            else if (vpTokenPresentationParseResult.format === 'jwt_vp_json') {
-                const sdJwtPresentation = core_1.W3cJwtVerifiablePresentation.fromSerializedJwt(vpTokenPresentationParseResult.presentation);
-                const certificateChain = (0, core_1.extractX509CertificatesFromJwt)(sdJwtPresentation.jwt);
-                let trustedCertificates = undefined;
-                if (certificateChain && x509Config.getTrustedCertificatesForVerification) {
-                    trustedCertificates = await x509Config.getTrustedCertificatesForVerification?.(agentContext, {
-                        certificateChain,
-                        verification: {
-                            type: 'credential',
-                            credential: sdJwtPresentation,
-                            openId4VcVerificationSessionId: options.verificationSessionRecordId,
-                        },
+                    const verificationResult = await this.w3cCredentialService.verifyPresentation(agentContext, {
+                        presentation: core_1.JsonTransformer.fromJSON(encodedPresentation, core_1.W3cJsonLdVerifiablePresentation),
+                        challenge: options.nonce,
+                        domain: options.audience,
                     });
+                    isValid = verificationResult.isValid;
+                    reason = verificationResult.error?.message;
                 }
-                if (!trustedCertificates) {
-                    trustedCertificates = x509Config.trustedCertificates ?? [];
+                if (!isValid) {
+                    throw new Error(reason);
                 }
-                const verificationResult = await this.w3cCredentialService.verifyPresentation(agentContext, {
-                    presentation: vpTokenPresentationParseResult.presentation,
-                    challenge: options.nonce,
-                    domain: options.audience,
-                    trustedCertificates,
-                });
-                isValid = verificationResult.isValid;
-                reason = verificationResult.error?.message;
-                verifiablePresentation = core_1.W3cJwtVerifiablePresentation.fromSerializedJwt(vpTokenPresentationParseResult.presentation);
+                return {
+                    verified: true,
+                };
             }
-            else {
-                const w3cJsonLdVerifiablePresentation = core_1.JsonTransformer.fromJSON(vpTokenPresentationParseResult.presentation, core_1.W3cJsonLdVerifiablePresentation);
-                const verificationResult = await this.w3cCredentialService.verifyPresentation(agentContext, {
-                    presentation: w3cJsonLdVerifiablePresentation,
-                    challenge: options.nonce,
-                    domain: options.audience,
+            catch (error) {
+                agentContext.config.logger.warn('Error occurred during verification of presentation', {
+                    error,
                 });
-                isValid = verificationResult.isValid;
-                reason = verificationResult.error?.message;
-                verifiablePresentation = w3cJsonLdVerifiablePresentation;
-            }
-            if (!isValid) {
-                throw new Error(reason);
+                return {
+                    verified: false,
+                    reason: error.message,
+                };
             }
-            return {
-                verified: true,
-                transactionDataMeta,
-                presentation: verifiablePresentation,
-                credentialId: options.credentialId,
-            };
-        }
-        catch (error) {
-            agentContext.config.logger.warn('Error occurred during verification of presentation', {
-                error,
-            });
-            return {
-                verified: false,
-                reason: error.message,
-                credentialId: options.credentialId,
-            };
-        }
-    }
-    /**
-     * Update the record to a new state and emit an state changed event. Also updates the record
-     * in storage.
-     */
-    async updateState(agentContext, verificationSession, newState) {
-        agentContext.config.logger.debug(`Updating openid4vc verification session record ${verificationSession.id} to state ${newState} (previous=${verificationSession.state})`);
-        const previousState = verificationSession.state;
-        verificationSession.state = newState;
-        await this.openId4VcVerificationSessionRepository.update(agentContext, verificationSession);
-        this.emitStateChangedEvent(agentContext, verificationSession, previousState);
-    }
-    emitStateChangedEvent(agentContext, verificationSession, previousState) {
-        const eventEmitter = agentContext.dependencyManager.resolve(core_1.EventEmitter);
-        eventEmitter.emit(agentContext, {
-            type: OpenId4VcVerifierEvents_1.OpenId4VcVerifierEvents.VerificationSessionStateChanged,
-            payload: {
-                verificationSession: verificationSession.clone(),
-                previousState,
-            },
-        });
+        };
     }
 };
 exports.OpenId4VcSiopVerifierService = OpenId4VcSiopVerifierService;