@sphereon/ssi-sdk-ext.identifier-resolution 0.36.1-next.50 → 0.36.1-next.70

package/dist/index.js

@@ -1062,9 +1062,9 @@ var require_plugin_schema = __commonJS({
               type: "object"
             },
             DidDocumentJwks: {
-              $ref: '#/components/schemas/Record<Exclude<DIDDocumentSection,("publicKey"|"service")>,def-interface-.ts-36152-36877-.ts-0-63876[]>'
+              $ref: '#/components/schemas/Record<Exclude<DIDDocumentSection,("publicKey"|"service")>,def-interface-.ts-36172-36897-.ts-0-63936[]>'
             },
-            'Record<Exclude<DIDDocumentSection,("publicKey"|"service")>,def-interface-.ts-36152-36877-.ts-0-63876[]>': {
+            'Record<Exclude<DIDDocumentSection,("publicKey"|"service")>,def-interface-.ts-36172-36897-.ts-0-63936[]>': {
               type: "object",
               properties: {
                 verificationMethod: {
@@ -4780,7 +4780,6 @@ async function getManagedDidIdentifier(opts, context) {
     identifier = opts.identifier;
   }
   const did = identifier.did;
-  const keys = identifier?.keys;
   const extendedKey = await getFirstKeyWithRelation({
     ...opts,
     // Make sure we use offline mode if no pref was supplied. We are looking for managed DIDs after all. Could be it is not published yet
@@ -4789,19 +4788,57 @@ async function getManagedDidIdentifier(opts, context) {
     vmRelationship: opts.vmRelationship ?? "verificationMethod"
   }, context);
   const key = extendedKey;
-  const controllerKeyId = identifier.controllerKeyId;
   const jwk = toJwk(key.publicKeyHex, key.type, {
     key
   });
   const jwkThumbprint = key.meta?.jwkThumbprint ?? calculateJwkThumbprint({
     jwk
   });
-  let kid = opts.kid ?? extendedKey.meta?.verificationMethod?.id;
-  if (!kid.startsWith(did)) {
+  let kid = opts.kid ?? extendedKey.meta?.verificationMethod?.id ?? extendedKey.kid;
+  if (kid && !kid.startsWith(did)) {
     const hash = kid.startsWith("#") ? "" : "#";
     kid = `${did}${hash}${kid}`;
   }
   const issuer = opts.issuer ?? did;
+  let filteredKeys = identifier?.keys ?? [];
+  let isFiltered = false;
+  if (opts.kmsKeyRef) {
+    const keysByKmsKeyRef = filteredKeys.filter((k) => k.kid === opts.kmsKeyRef);
+    if (keysByKmsKeyRef.length > 0) {
+      filteredKeys = keysByKmsKeyRef;
+      isFiltered = true;
+    }
+  }
+  if (!isFiltered && opts.vmRelationship) {
+    const keysByVmRelationship = filteredKeys.filter((k) => {
+      const purposes = k.meta?.purposes;
+      if (!purposes || purposes.length === 0) {
+        return opts.vmRelationship === "verificationMethod";
+      }
+      return purposes.includes(opts.vmRelationship);
+    });
+    if (keysByVmRelationship.length > 0) {
+      filteredKeys = keysByVmRelationship;
+      isFiltered = true;
+    }
+  }
+  if (!isFiltered && typeof opts.identifier === "string" && opts.identifier.includes("#")) {
+    const fragment = opts.identifier.split("#")[1];
+    const keysByFragment = filteredKeys.filter((k) => {
+      const vmId = k.meta?.verificationMethod?.id;
+      return vmId === `${did}#${fragment}` || vmId === fragment || k.kid === fragment;
+    });
+    if (keysByFragment.length > 0) {
+      filteredKeys = keysByFragment;
+    }
+  }
+  const keys = filteredKeys;
+  const controllerKeyId = key.kid;
+  const filteredIdentifier = {
+    ...identifier,
+    keys: filteredKeys,
+    controllerKeyId
+  };
   return {
     method,
     key,
@@ -4813,7 +4850,7 @@ async function getManagedDidIdentifier(opts, context) {
     kid,
     keys,
     issuer,
-    identifier,
+    identifier: filteredIdentifier,
     clientId: opts.clientId,
     clientIdScheme: opts.clientIdScheme,
     opts
@@ -4933,10 +4970,10 @@ async function getManagedOID4VCIssuerIdentifier(opts, context) {
 }
 __name(getManagedOID4VCIssuerIdentifier, "getManagedOID4VCIssuerIdentifier");
 async function getManagedIdentifier(opts, context) {
-  let resolutionResult;
   if (isManagedIdentifierResult(opts)) {
-    opts;
+    return opts;
   }
+  let resolutionResult;
   if (isManagedIdentifierKidOpts(opts)) {
     resolutionResult = await getManagedKidIdentifier(opts, context);
   } else if (isManagedIdentifierDidOpts(opts)) {