@europeum-ebsi/cli 0.0.0

package/dist/commands/conformance.js

@@ -0,0 +1,813 @@
+import Joi from "joi";
+import { base64url } from "multiformats/bases/base64";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { URLSearchParams } from "node:url";
+import { parse as qsParse, stringify as qsStringify } from "qs";
+import { estimateVcdmVersion, httpCall, red } from "../utils/index.js";
+import { compute, getUserPin } from "./compute.js";
+export async function authMockAuthorize(inputs, context) {
+    const [openIdCredentialIssuer, openIdConfiguration, requestedTypes, inputAlg, codeVerifier, issuerState,] = inputs;
+    const alg = inputAlg || "ES256";
+    Joi.assert(requestedTypes, Joi.array());
+    Joi.assert(alg, Joi.string().valid("ES256K", "ES256", "EdDSA", "RS256"));
+    const isPKCEChallenge = !!codeVerifier;
+    const authorizationServer = openIdCredentialIssuer.authorization_server ??
+        openIdCredentialIssuer.credential_issuer;
+    const clientId = context.client.didVersion === 1
+        ? context.client.clientId
+        : context.client.did;
+    let codeChallenge = "";
+    if (isPKCEChallenge) {
+        codeChallenge = base64url.baseEncode(createHash("sha256").update(codeVerifier).digest());
+    }
+    const clientMetadata = isPKCEChallenge
+        ? {
+            authorization_endpoint: "openid:",
+        }
+        : {
+            authorization_endpoint: `${context.client.clientId}/authorize`,
+            jwks_uri: `${context.client.clientId}/jwks`,
+            redirect_uris: [`${context.client.clientId}/code-cb`],
+        };
+    const authorizationDetails = [
+        {
+            format: "jwt_vc",
+            locations: [openIdCredentialIssuer.credential_issuer],
+            type: "openid_credential",
+            types: requestedTypes,
+        },
+    ];
+    const queryParams = {
+        client_id: clientId,
+        client_metadata: JSON.stringify(clientMetadata),
+        redirect_uri: isPKCEChallenge
+            ? "openid://callback"
+            : `${context.client.clientId}/code-cb`,
+        response_type: "code",
+        scope: "openid",
+        state: randomUUID(),
+        ...(isPKCEChallenge && {
+            code_challenge: codeChallenge,
+            code_challenge_method: "S256",
+        }),
+        ...(issuerState && { issuer_state: issuerState }),
+        authorization_details: JSON.stringify(authorizationDetails),
+    };
+    const jwtPayload = {
+        ...queryParams,
+        aud: authorizationServer,
+        authorization_details: authorizationDetails,
+        client_metadata: clientMetadata,
+        iss: clientId,
+    };
+    const requestParam = await context.client.signJWT(jwtPayload, {}, alg);
+    const responseAuthorize = await httpCall.get(`${openIdConfiguration.authorization_endpoint}?${new URLSearchParams({
+        ...queryParams,
+        request: requestParam,
+    }).toString()}`);
+    const { location } = responseAuthorize.headers;
+    const locationUrl = new URL(location);
+    if (locationUrl.searchParams.get("error"))
+        throw new Error(locationUrl.searchParams.toString());
+    const responseQueryParams = qsParse(locationUrl.search.slice(1));
+    return responseQueryParams;
+}
+export async function authMockDirectPostIdToken(inputs, context) {
+    const [openIdCredentialIssuer, issuerRequest, inputAlg, vcdmVersion] = inputs;
+    const alg = inputAlg || "ES256";
+    Joi.assert(alg, Joi.string().valid("ES256K", "ES256", "EdDSA", "RS256"));
+    const authorizationServer = openIdCredentialIssuer.authorization_server ??
+        openIdCredentialIssuer.credential_issuer;
+    const { nonce, state } = issuerRequest;
+    const iat = Math.floor(Date.now() / 1000);
+    const exp = iat + 5 * 60;
+    const idTokenDirectPost = await context.client.signJWT({
+        aud: authorizationServer,
+        exp,
+        iat,
+        iss: context.client.did,
+        nonce,
+        sub: context.client.did,
+    }, { typ: vcdmVersion === "1.1" ? "JWT" : "vp+jwt" }, alg);
+    const responseDirectPost = await httpCall.post(issuerRequest.redirect_uri, new URLSearchParams({
+        id_token: idTokenDirectPost,
+        state,
+        vcdm_version: vcdmVersion,
+    }).toString(), {
+        headers: {
+            "content-type": "application/x-www-form-urlencoded",
+        },
+    });
+    const { location } = responseDirectPost.headers;
+    const locationUrl = new URL(location);
+    if (locationUrl.searchParams.get("error"))
+        throw new Error(locationUrl.searchParams.toString());
+    const responseQueryParams = qsParse(locationUrl.search.slice(1));
+    return responseQueryParams;
+}
+export async function authMockDirectPostVpToken(inputs) {
+    const [issuerRequest, vpJwt, type, vcdmVersion] = inputs;
+    const { state } = issuerRequest;
+    const presentationSubmission = type === "holder"
+        ? {
+            definition_id: "holder-wallet-qualification-presentation",
+            descriptor_map: [
+                {
+                    format: "jwt_vp",
+                    id: "same-device-authorised-in-time-credential",
+                    path: "$",
+                    path_nested: {
+                        format: "jwt_vc",
+                        id: "same-device-authorised-in-time-credential",
+                        path: "$.vp.verifiableCredential[0]",
+                    },
+                },
+                {
+                    format: "jwt_vp",
+                    id: "cross-device-authorised-in-time-credential",
+                    path: "$",
+                    path_nested: {
+                        format: "jwt_vc",
+                        id: "cross-device-authorised-in-time-credential",
+                        path: "$.vp.verifiableCredential[1]",
+                    },
+                },
+                {
+                    format: "jwt_vp",
+                    id: "same-device-authorised-deferred-credential",
+                    path: "$",
+                    path_nested: {
+                        format: "jwt_vc",
+                        id: "same-device-authorised-deferred-credential",
+                        path: "$.vp.verifiableCredential[2]",
+                    },
+                },
+                {
+                    format: "jwt_vp",
+                    id: "cross-device-authorised-deferred-credential",
+                    path: "$",
+                    path_nested: {
+                        format: "jwt_vc",
+                        id: "cross-device-authorised-deferred-credential",
+                        path: "$.vp.verifiableCredential[3]",
+                    },
+                },
+                {
+                    format: "jwt_vp",
+                    id: "same-device-pre-authorised-in-time-credential",
+                    path: "$",
+                    path_nested: {
+                        format: "jwt_vc",
+                        id: "same-device-pre-authorised-in-time-credential",
+                        path: "$.vp.verifiableCredential[4]",
+                    },
+                },
+                {
+                    format: "jwt_vp",
+                    id: "cross-device-pre-authorised-in-time-credential",
+                    path: "$",
+                    path_nested: {
+                        format: "jwt_vc",
+                        id: "cross-device-pre-authorised-in-time-credential",
+                        path: "$.vp.verifiableCredential[5]",
+                    },
+                },
+                {
+                    format: "jwt_vp",
+                    id: "same-device-pre-authorised-deferred-credential",
+                    path: "$",
+                    path_nested: {
+                        format: "jwt_vc",
+                        id: "same-device-pre-authorised-deferred-credential",
+                        path: "$.vp.verifiableCredential[6]",
+                    },
+                },
+                {
+                    format: "jwt_vp",
+                    id: "cross-device-pre-authorised-deferred-credential",
+                    path: "$",
+                    path_nested: {
+                        format: "jwt_vc",
+                        id: "cross-device-pre-authorised-deferred-credential",
+                        path: "$.vp.verifiableCredential[7]",
+                    },
+                },
+            ],
+            id: randomUUID(),
+        }
+        : {
+            definition_id: "va-to-onboard-presentation",
+            descriptor_map: [
+                {
+                    format: "jwt_vp",
+                    id: "verifiable-authorisation-to-onboard",
+                    path: "$",
+                    path_nested: {
+                        format: "jwt_vc",
+                        id: "verifiable-authorisation-to-onboard",
+                        path: "$.vp.verifiableCredential[0]",
+                    },
+                },
+            ],
+            id: randomUUID(),
+        };
+    const responseDirectPost = await httpCall.post(issuerRequest.redirect_uri, new URLSearchParams({
+        presentation_submission: JSON.stringify(presentationSubmission),
+        state,
+        vcdm_version: vcdmVersion,
+        vp_token: vpJwt,
+    }).toString(), {
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+        },
+    });
+    const { location } = responseDirectPost.headers;
+    const locationUrl = new URL(location);
+    if (locationUrl.searchParams.get("error"))
+        throw new Error(locationUrl.searchParams.toString());
+    const responseQueryParams = qsParse(locationUrl.search.slice(1));
+    return responseQueryParams;
+}
+export async function authMockToken(inputs, context) {
+    const [openIdCredentialIssuer, openIdConfiguration, code, inputAlg, codeVerifier, type,] = inputs;
+    const alg = inputAlg || "ES256";
+    const isPKCEChallenge = !!codeVerifier;
+    const authorizationServer = openIdCredentialIssuer.authorization_server ??
+        openIdCredentialIssuer.credential_issuer;
+    const queryParams = type === "preAuthorised"
+        ? {
+            grant_type: "urn:ietf:params:oauth:grant-type:pre-authorized_code",
+            "pre-authorized_code": code,
+            user_pin: getUserPin(context.client.did),
+        }
+        : {
+            code,
+            grant_type: "authorization_code",
+            ...(!isPKCEChallenge && {
+                client_assertion_type: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
+                client_id: context.client.clientId,
+                redirect_uri: `${context.client.clientId}/code-cb`,
+            }),
+            ...(isPKCEChallenge && {
+                client_id: context.client.did,
+                code_verifier: codeVerifier,
+                redirect_uri: "openid://callback",
+            }),
+        };
+    const iat = Math.floor(Date.now() / 1000);
+    const exp = iat + 5 * 60;
+    const jwtPayload = {
+        ...queryParams,
+        aud: authorizationServer,
+        exp,
+        iat,
+        iss: context.client.clientId,
+        sub: context.client.clientId,
+    };
+    const clientAssertion = await context.client.signJWT(jwtPayload, {}, alg);
+    const responseToken = await httpCall.post(openIdConfiguration.token_endpoint, new URLSearchParams({
+        ...queryParams,
+        client_assertion: clientAssertion,
+    }).toString(), {
+        headers: {
+            "content-type": "application/x-www-form-urlencoded",
+        },
+    });
+    return responseToken.data;
+}
+export async function check(inputs, context) {
+    const [intent, inputVcdmVersion, preAuthorizedCode, userPin] = inputs;
+    const apiUrl = context.config.api.conformance.url;
+    const vcdmVersion = inputVcdmVersion
+        ? Number(inputVcdmVersion).toFixed(1)
+        : "1.1";
+    const response = await httpCall.post(`${apiUrl}/check`, {
+        data: {
+            clientId: context.client.clientId,
+            credentialIssuer: context.client.clientId,
+            credentialIssuerDid: context.client.did,
+            did: context.client.did,
+            issuerState: context.client.issuerState,
+            ...(preAuthorizedCode && {
+                preAuthorizedCode,
+                userPin,
+            }),
+            vcdmVersion,
+        },
+        intent,
+    });
+    if (!response.data.success) {
+        red(response.data.errors);
+        throw new Error(`check ${intent} failed: ${response.data.errors
+            ? JSON.stringify(response.data.errors)
+            : "unknown error"}`);
+    }
+    return response.data;
+}
+export async function clientMockInitiate(context) {
+    const apiUrl = context.config.api.conformance.url;
+    const { accreditationUrl, issuerState, proxyId } = context.rtVars["user"];
+    const response = await httpCall.post(`${apiUrl}/client-mock/initiate`, {
+        did: context.client.did,
+        keys: Object.keys(context.client.keys).map((keyName) => {
+            const key = context.client.keys[keyName];
+            return {
+                ...key.privateKeyJwk,
+                kid: key.kid,
+            };
+        }),
+        ...(accreditationUrl && { attributeUrl: accreditationUrl }),
+        ...(proxyId && { proxyId }),
+        ...(issuerState && { issuerState }),
+    });
+    context.client.clientId = `${apiUrl}/client-mock/${context.client.did}`;
+    context.rtVars["user"].clientId =
+        context.client.clientId;
+    return response.data;
+}
+export async function clientMockUpdateBitstringList(inputs, context) {
+    const [statusIndex, statusListIndex, value] = inputs;
+    const apiUrl = context.config.api.conformance.url;
+    const response = await httpCall.post(`${apiUrl}/client-mock/updateBitstringStatusList`, {
+        did: context.client.did,
+        id: statusIndex.toString(),
+        position: Number(statusListIndex),
+        value: Number(value),
+    });
+    return response.data;
+}
+export async function clientMockUpdateList(inputs, context) {
+    const [statusIndex, statusListIndex, value] = inputs;
+    const apiUrl = context.config.api.conformance.url;
+    const response = await httpCall.post(`${apiUrl}/client-mock/updateList`, {
+        did: context.client.did,
+        id: statusIndex.toString(),
+        position: Number(statusListIndex),
+        value: Number(value),
+    });
+    return response.data;
+}
+export async function conformance(method, inputs, context) {
+    switch (method) {
+        case "authMockAuthorize": {
+            return authMockAuthorize(inputs, context);
+        }
+        case "authMockDirectPostIdToken": {
+            return authMockDirectPostIdToken(inputs, context);
+        }
+        case "authMockDirectPostVpToken": {
+            return authMockDirectPostVpToken(inputs);
+        }
+        case "authMockToken": {
+            return authMockToken(inputs, context);
+        }
+        case "check": {
+            return check(inputs, context);
+        }
+        case "clientMockInitiate": {
+            return clientMockInitiate(context);
+        }
+        case "clientMockUpdateBitstringList": {
+            return clientMockUpdateBitstringList(inputs, context);
+        }
+        case "clientMockUpdateList": {
+            return clientMockUpdateList(inputs, context);
+        }
+        case "get": {
+            return conformanceGet(inputs, context);
+        }
+        case "getCredential": {
+            return getCredential(inputs, context);
+        }
+        case "holder": {
+            return holder(inputs, context);
+        }
+        case "issuerMockCredential": {
+            return issuerMockCredential(inputs, context);
+        }
+        case "issuerMockDeferred": {
+            return issuerMockDeferred(inputs);
+        }
+        case "issuerMockInitiateCredentialOffer": {
+            return issuerMockInitiateCredentialOffer(inputs, context);
+        }
+        default: {
+            throw new Error(`Invalid method '${method}'`);
+        }
+    }
+}
+export async function conformanceGet(inputs, context) {
+    const apiUrl = context.config.api.conformance.url;
+    const urlPath = inputs.join("");
+    const url = urlPath.startsWith("http") ? urlPath : `${apiUrl}${urlPath}`;
+    const response = await httpCall.get(url, context.httpOpts);
+    return response.data;
+}
+export async function getCredential(inputs, context) {
+    const [type, inputAlg, inputVcdmVersion, inputVc, inputIssuer] = inputs;
+    const alg = inputAlg || "ES256";
+    const vcdmVersion = inputVcdmVersion
+        ? Number(inputVcdmVersion).toFixed(1)
+        : estimateVcdmVersion(inputVc);
+    const vc = inputVc ?? [];
+    const vcString = typeof vc === "string" ? vc : JSON.stringify(vc);
+    let openIdCredentialIssuerUrl;
+    if (inputIssuer) {
+        openIdCredentialIssuerUrl = inputIssuer.startsWith("http")
+            ? `${inputIssuer}/.well-known/openid-credential-issuer`
+            : `/client-mock/${inputIssuer}/.well-known/openid-credential-issuer`;
+    }
+    else {
+        openIdCredentialIssuerUrl =
+            "/issuer-mock/.well-known/openid-credential-issuer";
+    }
+    let requestedTypes;
+    switch (type) {
+        case "ctrevocable": {
+            requestedTypes = [
+                "VerifiableCredential",
+                "VerifiableAttestation",
+                "CTRevocable",
+            ];
+            break;
+        }
+        case "onboard": {
+            requestedTypes = [
+                "VerifiableCredential",
+                "VerifiableAttestation",
+                "VerifiableAuthorisationToOnboard",
+            ];
+            break;
+        }
+        case "qualification": {
+            requestedTypes = [
+                "VerifiableCredential",
+                "VerifiableAttestation",
+                "CTAAQualificationCredential",
+            ];
+            break;
+        }
+        case "roottao": {
+            requestedTypes =
+                vcdmVersion === "1.1"
+                    ? [
+                        "VerifiableCredential",
+                        "VerifiableAttestation",
+                        "VerifiableAuthorisationForTrustChain",
+                    ]
+                    : [
+                        "VerifiableCredential",
+                        "VerifiableAttestation",
+                        // "VerifiableTrustModel",
+                        "VerifiableAuthorisationForTrustChain",
+                    ];
+            break;
+        }
+        case "tao": {
+            requestedTypes =
+                vcdmVersion === "1.1"
+                    ? [
+                        "VerifiableCredential",
+                        "VerifiableAttestation",
+                        "VerifiableAccreditation",
+                        "VerifiableAccreditationToAccredit",
+                    ]
+                    : [
+                        "VerifiableCredential",
+                        "VerifiableAttestation",
+                        "VerifiableTrustModel",
+                        "VerifiableAccreditationToAccredit",
+                    ];
+            break;
+        }
+        case "ti": {
+            requestedTypes =
+                vcdmVersion === "1.1"
+                    ? [
+                        "VerifiableCredential",
+                        "VerifiableAttestation",
+                        "VerifiableAccreditation",
+                        "VerifiableAccreditationToAttest",
+                    ]
+                    : [
+                        "VerifiableCredential",
+                        "VerifiableAttestation",
+                        "VerifiableTrustModel",
+                        "VerifiableAccreditationToAttest",
+                    ];
+            break;
+        }
+        default: {
+            throw new Error(`type ${type} is not supported`);
+        }
+    }
+    // conformance clientMockInitiate
+    console.log("==> conformance clientMockInitiate");
+    await clientMockInitiate(context);
+    // opIssuer: conformance get /issuer-mock/.well-known/openid-credential-issuer
+    console.log(`==> conformance get ${openIdCredentialIssuerUrl}`);
+    const opIssuer = (await conformanceGet([openIdCredentialIssuerUrl], context));
+    const authorizationServer = opIssuer.authorization_server ?? opIssuer.credential_issuer;
+    // opConf: conformance get opIssuer.authorization_server /.well-known/openid-configuration
+    console.log(`==> conformance get ${authorizationServer}/.well-known/openid-configuration`);
+    const opConf = (await conformanceGet([authorizationServer, "/.well-known/openid-configuration"], context));
+    // respAuthorize: conformance authMockAuthorize opIssuer opConf requestedTypes ES256
+    console.log(`==> conformance authMockAuthorize ${stringify(opIssuer, [
+        "authorization_server",
+        "credential_issuer",
+    ])} ${stringify(opConf, ["authorization_endpoint"])} ${JSON.stringify(requestedTypes)} ${alg}`);
+    const respAuthorize = await authMockAuthorize([opIssuer, opConf, requestedTypes, alg], context);
+    let code;
+    if (type === "roottao") {
+        const payloadJwt = { aud: opConf.issuer };
+        // vpJwt: compute createVpJwt vc {} {aud:opConf.issuer} alg vcdmVersion
+        console.log(`==> compute createVpJwt ${vcString} {} ${JSON.stringify(payloadJwt)} ${alg} ${vcdmVersion}`);
+        const vpJwt = (await compute("createVpJwt", [vc, {}, payloadJwt, alg, vcdmVersion], context));
+        // respDirectPost: conformance authMockDirectPostVpToken respAuthorize ES256
+        console.log(`==> conformance authMockDirectPostVpToken ${JSON.stringify(respAuthorize)} ${vpJwt} onboard ${vcdmVersion}`);
+        const respDirectPost = (await authMockDirectPostVpToken([
+            respAuthorize,
+            vpJwt,
+            "onboard",
+            vcdmVersion,
+        ]));
+        code = respDirectPost.code;
+    }
+    else {
+        // respDirectPost: conformance authMockDirectPostIdToken opIssuer respAuthorize ES256
+        console.log(`==> conformance authMockDirectPostIdToken ${stringify(opIssuer, [
+            "authorization_server",
+            "credential_issuer",
+        ])} ${JSON.stringify(respAuthorize)} ${alg} ${vcdmVersion}`);
+        const respDirectPost = (await authMockDirectPostIdToken([opIssuer, respAuthorize, alg, vcdmVersion], context));
+        code = respDirectPost.code;
+    }
+    // resToken: conformance authMockToken opIssuer opConf respDirectPost.code ES256
+    console.log(`==> conformance authMockToken ${stringify(opIssuer, [
+        "authorization_server",
+        "credential_issuer",
+    ])} ${stringify(opConf, ["token_endpoint"])} ${code} ${alg}`);
+    const respToken = (await authMockToken([opIssuer, opConf, code, alg], context));
+    // using token resToken.access_token
+    console.log(`==> using token ${respToken.access_token}`);
+    context.httpOpts = {
+        headers: {
+            authorization: `Bearer ${respToken.access_token}`,
+        },
+    };
+    // resCredential: conformance issuerMockCredential opIssuer resToken.c_nonce requestedTypes ES256
+    console.log(`==> conformance issuerMockCredential ${stringify(opIssuer, [
+        "credential_issuer",
+    ])} ${respToken.c_nonce} ${JSON.stringify(requestedTypes)} ${alg} ${vcdmVersion}`);
+    const respCredential = (await issuerMockCredential([opIssuer, respToken.c_nonce, requestedTypes, alg, vcdmVersion], context));
+    let credential;
+    if (type === "roottao") {
+        console.log(`waiting 5.5 seconds...`);
+        await new Promise((r) => {
+            setTimeout(r, 5500);
+        });
+        // respDeferred: conformance issuerMockDeferred respDirectPost.acceptance_token
+        console.log(`==> conformance issuerMockDeferred ${stringify(opIssuer, [
+            "deferred_credential_endpoint",
+        ])} ${respCredential.acceptance_token}`);
+        const respDeferred = (await issuerMockDeferred([
+            opIssuer,
+            respCredential.acceptance_token,
+        ]));
+        credential = respDeferred.credential;
+    }
+    else {
+        credential = respCredential.credential;
+    }
+    // decodedCredential: compute decodeJWT resCredential.credential
+    console.log(`==> compute decodeJWT ${credential}`);
+    const decodedCredential = (await compute("decodeJWT", [credential], context));
+    let reservedAttributeId = "";
+    if (decodedCredential.payload.vc?.credentialSubject?.reservedAttributeId) {
+        reservedAttributeId =
+            decodedCredential.payload.vc.credentialSubject.reservedAttributeId;
+    }
+    return {
+        reservedAttributeId,
+        vc: credential,
+    };
+}
+export async function holder(inputs, context) {
+    const apiUrl = context.config.api.conformance.url;
+    const [credentialType, communicationType, inputAlg, inputVcdmVersion, inputVc, typeCredentialOffer, inputIssuer,] = inputs;
+    const alg = inputAlg || "ES256";
+    const vcdmVersion = inputVcdmVersion
+        ? Number(inputVcdmVersion).toFixed(1)
+        : estimateVcdmVersion(inputVc);
+    const vc = inputVc ?? [];
+    const vcString = typeof vc === "string" ? vc : JSON.stringify(vc);
+    const codeVerifier = randomBytes(50).toString("base64url");
+    const requestedTypes = [
+        "VerifiableCredential",
+        "VerifiableAttestation",
+        credentialType,
+    ];
+    let openIdCredentialIssuerUrl;
+    let initiateCredentialOfferEndpoint;
+    if (inputIssuer) {
+        if (inputIssuer.startsWith("http")) {
+            openIdCredentialIssuerUrl = `${inputIssuer}/.well-known/openid-credential-issuer`;
+            initiateCredentialOfferEndpoint = `${inputIssuer}/initiate-credential-offer`;
+        }
+        else {
+            openIdCredentialIssuerUrl = `/client-mock/${inputIssuer}/.well-known/openid-credential-issuer`;
+            initiateCredentialOfferEndpoint = `${apiUrl}/client-mock/${inputIssuer}/initiate-credential-offer`;
+        }
+    }
+    else {
+        openIdCredentialIssuerUrl =
+            "/issuer-mock/.well-known/openid-credential-issuer";
+        initiateCredentialOfferEndpoint = `${apiUrl}/issuer-mock/initiate-credential-offer`;
+    }
+    // credentialOffer: conformance issuerMockInitiateCredentialOffer initiateCredentialOfferEndpoint
+    console.log(`==> conformance issuerMockInitiateCredentialOffer ${initiateCredentialOfferEndpoint} ${credentialType}`);
+    let credentialOffer;
+    const validTypesIssuerState = [
+        "use-credential-offer",
+        "skip-credential-offer",
+    ];
+    if (typeCredentialOffer &&
+        !validTypesIssuerState.includes(typeCredentialOffer)) {
+        throw new Error(`invalid command for typeCredentialOffer. valid types: ${validTypesIssuerState.join(", ")}`);
+    }
+    const useCredentialOffer = typeCredentialOffer !== "skip-credential-offer";
+    const isPreauthorised = communicationType
+        .toLowerCase()
+        .startsWith("preauthorised");
+    if (useCredentialOffer) {
+        credentialOffer = await issuerMockInitiateCredentialOffer([initiateCredentialOfferEndpoint, credentialType], context);
+    }
+    else {
+        if (isPreauthorised)
+            throw new Error("For preauthorised credentials set use-credential-offer");
+    }
+    // opIssuer: conformance get /issuer-mock/.well-known/openid-credential-issuer
+    console.log(`==> conformance get ${openIdCredentialIssuerUrl}`);
+    const opIssuer = (await conformanceGet([openIdCredentialIssuerUrl], context));
+    const authorizationServer = opIssuer.authorization_server ?? opIssuer.credential_issuer;
+    // opConf: conformance get opIssuer.authorization_server /.well-known/openid-configuration
+    console.log(`==> conformance get ${authorizationServer}/.well-known/openid-configuration`);
+    const opConf = (await conformanceGet([authorizationServer, "/.well-known/openid-configuration"], context));
+    let code;
+    if (isPreauthorised) {
+        code =
+            credentialOffer.grants["urn:ietf:params:oauth:grant-type:pre-authorized_code"]?.["pre-authorized_code"];
+    }
+    else {
+        // respAuthorize: conformance authMockAuthorize opIssuer opConf requestedTypes ES256
+        let issuerState = "";
+        if (useCredentialOffer)
+            issuerState = credentialOffer.grants.authorization_code
+                ? credentialOffer.grants.authorization_code.issuer_state
+                : "";
+        console.log(`==> conformance authMockAuthorize ${stringify(opIssuer, [
+            "authorization_server",
+            "credential_issuer",
+        ])} ${stringify(opConf, ["authorization_endpoint"])} ${JSON.stringify(requestedTypes)} ${alg} ${codeVerifier} ${issuerState}`);
+        const respAuthorize = await authMockAuthorize([opIssuer, opConf, requestedTypes, alg, codeVerifier, issuerState], context);
+        if (credentialType === "CTWalletQualificationCredential") {
+            const payloadJwt = { aud: opConf.issuer };
+            // vpJwt: compute createVpJwt vc {} {aud:opConf.issuer} alg vcdmVersion
+            console.log(`==> compute createVpJwt ${vcString} {} ${JSON.stringify(payloadJwt)} ${alg} ${vcdmVersion ?? "1.1"}`);
+            const vpJwt = (await compute("createVpJwt", [vc, {}, payloadJwt, alg, vcdmVersion ?? "1.1"], context));
+            // respDirectPost: conformance authMockDirectPostVpToken respAuthorize ES256
+            console.log(`==> conformance authMockDirectPostVpToken ${JSON.stringify(respAuthorize)} ${vpJwt} holder ${vcdmVersion}`);
+            const respDirectPost = (await authMockDirectPostVpToken([
+                respAuthorize,
+                vpJwt,
+                "holder",
+                vcdmVersion,
+            ]));
+            code = respDirectPost.code;
+        }
+        else {
+            // respDirectPost: conformance authMockDirectPostIdToken opIssuer respAuthorize ES256
+            console.log(`==> conformance authMockDirectPostIdToken ${stringify(opIssuer, [
+                "authorization_server",
+                "credential_issuer",
+            ])} ${JSON.stringify(respAuthorize)} ${alg} ${vcdmVersion}`);
+            const respDirectPost = (await authMockDirectPostIdToken([opIssuer, respAuthorize, alg, vcdmVersion], context));
+            code = respDirectPost.code;
+        }
+    }
+    // resToken: conformance authMockToken opIssuer opConf respDirectPost.code ES256
+    console.log(`==> conformance authMockToken ${stringify(opIssuer, [
+        "authorization_server",
+        "credential_issuer",
+    ])} ${stringify(opConf, [
+        "token_endpoint",
+    ])} ${code} ${alg} ${codeVerifier}`);
+    const respToken = (await authMockToken([
+        opIssuer,
+        opConf,
+        code,
+        alg,
+        codeVerifier,
+        isPreauthorised ? "preAuthorised" : "",
+    ], context));
+    // using token resToken.access_token
+    console.log(`==> using token ${respToken.access_token}`);
+    context.httpOpts = {
+        headers: {
+            authorization: `Bearer ${respToken.access_token}`,
+        },
+    };
+    // resCredential: conformance issuerMockCredential opIssuer resToken.c_nonce requestedTypes ES256
+    console.log(`==> conformance issuerMockCredential ${stringify(opIssuer, [
+        "credential_issuer",
+    ])} ${respToken.c_nonce} ${JSON.stringify(requestedTypes)} ${alg} ${vcdmVersion}`);
+    const respCredential = (await issuerMockCredential([opIssuer, respToken.c_nonce, requestedTypes, alg, vcdmVersion], context));
+    let credential;
+    const isDeferred = communicationType.toLowerCase().endsWith("deferred");
+    if (isDeferred) {
+        console.log(`waiting 5.5 seconds...`);
+        await new Promise((r) => {
+            setTimeout(r, 5500);
+        });
+        // respDeferred: conformance issuerMockDeferred respDirectPost.acceptance_token
+        console.log(`==> conformance issuerMockDeferred ${stringify(opIssuer, [
+            "deferred_credential_endpoint",
+        ])} ${respCredential.acceptance_token}`);
+        const respDeferred = (await issuerMockDeferred([
+            opIssuer,
+            respCredential.acceptance_token,
+        ]));
+        credential = respDeferred.credential;
+    }
+    else {
+        credential = respCredential.credential;
+    }
+    return credential;
+}
+export async function issuerMockCredential(inputs, context) {
+    const [openIdCredentialIssuer, nonce, requestedTypes, inputAlg, inputVcdmVersion,] = inputs;
+    const alg = inputAlg || "ES256";
+    const vcdmVersion = Number(inputVcdmVersion || "1.1").toFixed(1);
+    const clientId = context.client.didVersion === 1
+        ? context.client.clientId
+        : context.client.did;
+    const iat = Math.floor(Date.now() / 1000);
+    const exp = iat + 5 * 60;
+    const jwtPayload = {
+        aud: openIdCredentialIssuer.credential_issuer,
+        exp,
+        iat,
+        iss: clientId,
+        nonce,
+    };
+    const proofJwt = await context.client.signJWT(jwtPayload, {
+        typ: "openid4vci-proof+jwt",
+    }, alg);
+    const responseCredential = await httpCall.post(`${openIdCredentialIssuer.credential_issuer}/credential?vcdm_version=${vcdmVersion}`, {
+        format: "jwt_vc",
+        proof: {
+            jwt: proofJwt,
+            proof_type: "jwt",
+        },
+        types: requestedTypes,
+    }, context.httpOpts);
+    return responseCredential.data;
+}
+export async function issuerMockDeferred(inputs) {
+    const [openIdCredentialIssuer, acceptanceToken] = inputs;
+    const response = await httpCall.post(openIdCredentialIssuer.deferred_credential_endpoint, undefined, {
+        headers: {
+            authorization: `Bearer ${acceptanceToken}`,
+        },
+    });
+    return response.data;
+}
+export async function issuerMockInitiateCredentialOffer(inputs, context) {
+    const [initiateCredentialOfferEndpoint, credentialType] = inputs;
+    const requestParams = {
+        client_id: context.client.did,
+        credential_offer_endpoint: "openid-credential-offer://",
+        credential_type: credentialType,
+    };
+    let response = await httpCall.get(`${initiateCredentialOfferEndpoint}?${qsStringify(requestParams)}`);
+    const search = credentialType.startsWith("CTWalletSame")
+        ? new URL(response.headers.location).search
+        : new URL(response.data).search;
+    const parsedCredentialOffer = qsParse(search.slice(1));
+    if (parsedCredentialOffer.credential_offer_uri) {
+        response = await httpCall.get(parsedCredentialOffer.credential_offer_uri);
+        return response.data;
+    }
+    return qsParse(parsedCredentialOffer.credential_offer);
+}
+function stringify(obj, fields) {
+    if (typeof obj !== "object" || !obj)
+        throw new Error("not an object");
+    const newObj = {};
+    for (const f of fields) {
+        if (f in obj && obj[f])
+            newObj[f] = obj[f];
+    }
+    return JSON.stringify(newObj);
+}
+//# sourceMappingURL=conformance.js.map