@sphereon/ssi-sdk.ebsi-support 0.33.1-next.2 → 0.33.1-next.68

package/dist/index.cjs

@@ -0,0 +1,3610 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __commonJS = (cb, mod) => function __require() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// plugin.schema.json
+var require_plugin_schema = __commonJS({
+  "plugin.schema.json"(exports, module2) {
+    module2.exports = {
+      IEBSIAuthorizationClient: {
+        components: {
+          schemas: {
+            EBSIAuthAccessTokenGetArgs: {
+              type: "object",
+              properties: {
+                vc: {
+                  type: "string"
+                },
+                definitionId: {
+                  $ref: "#/components/schemas/ScopeByDefinition"
+                },
+                did: {
+                  type: "string"
+                },
+                kid: {
+                  type: "string"
+                },
+                scope: {
+                  $ref: "#/components/schemas/EBSIScope"
+                },
+                apiOpts: {
+                  $ref: '#/components/schemas/Optional<ApiOpts,"version">'
+                }
+              },
+              required: ["vc", "definitionId", "did", "kid", "scope", "apiOpts"]
+            },
+            ScopeByDefinition: {
+              type: "string",
+              enum: ["didr_invite", "didr_write", "tir_invite", "tir_write", "timestamp_write", "tnt_authorise", "tnt_create", "tnt_write"]
+            },
+            EBSIScope: {
+              type: "string",
+              enum: [
+                "didr_write",
+                "didr_invite",
+                "tir_write",
+                "tir_invite",
+                "timestamp_write",
+                "tnt_authorise",
+                "tnt_create",
+                "tnt_write",
+                "did_authn"
+              ],
+              description: "The OpenID scope"
+            },
+            'Optional<ApiOpts,"version">': {
+              type: "object",
+              properties: {
+                environment: {
+                  $ref: "#/components/schemas/EbsiEnvironment"
+                },
+                version: {
+                  $ref: "#/components/schemas/EbsiApiVersion"
+                }
+              }
+            },
+            EbsiEnvironment: {
+              type: "string",
+              enum: ["pilot", "conformance", "conformance-test"]
+            },
+            EbsiApiVersion: {
+              type: "string",
+              enum: ["v3", "v4", "v5"]
+            },
+            GetAccessTokenResponse: {
+              anyOf: [
+                {
+                  $ref: "#/components/schemas/GetAccessTokenSuccessResponse"
+                },
+                {
+                  $ref: "#/components/schemas/ExceptionResponse"
+                }
+              ]
+            },
+            GetAccessTokenSuccessResponse: {
+              type: "object",
+              properties: {
+                access_token: {
+                  type: "string"
+                },
+                token_type: {
+                  $ref: "#/components/schemas/TokenType"
+                },
+                expires_in: {
+                  type: "number"
+                },
+                scope: {
+                  $ref: "#/components/schemas/EBSIScope"
+                },
+                id_token: {
+                  type: "string"
+                },
+                apiOpts: {
+                  $ref: "#/components/schemas/ApiOpts"
+                }
+              },
+              required: ["access_token", "token_type", "scope", "id_token", "apiOpts"]
+            },
+            TokenType: {
+              type: "string",
+              const: "Bearer"
+            },
+            ApiOpts: {
+              type: "object",
+              properties: {
+                environment: {
+                  $ref: "#/components/schemas/EbsiEnvironment"
+                },
+                version: {
+                  $ref: "#/components/schemas/EbsiApiVersion"
+                }
+              },
+              required: ["version"]
+            },
+            ExceptionResponse: {
+              type: "object",
+              properties: {
+                type: {
+                  type: "string"
+                },
+                title: {
+                  type: "string"
+                },
+                status: {
+                  type: "number"
+                },
+                detail: {
+                  type: "string"
+                },
+                instance: {
+                  type: "string"
+                }
+              }
+            },
+            GetOIDProviderJwksResponse: {
+              anyOf: [
+                {
+                  $ref: "#/components/schemas/GetOIDProviderJwksSuccessResponse"
+                },
+                {
+                  $ref: "#/components/schemas/ExceptionResponse"
+                }
+              ]
+            },
+            GetOIDProviderJwksSuccessResponse: {
+              type: "object",
+              properties: {
+                keys: {
+                  type: "array",
+                  items: {
+                    $ref: "#/components/schemas/JWK"
+                  }
+                }
+              },
+              required: ["keys"]
+            },
+            JWK: {
+              type: "object",
+              properties: {
+                alg: {
+                  type: "string",
+                  description: 'JWK "alg" (Algorithm) Parameter.'
+                },
+                crv: {
+                  type: "string"
+                },
+                d: {
+                  type: "string"
+                },
+                dp: {
+                  type: "string"
+                },
+                dq: {
+                  type: "string"
+                },
+                e: {
+                  type: "string"
+                },
+                ext: {
+                  type: "boolean",
+                  description: 'JWK "ext" (Extractable) Parameter.'
+                },
+                k: {
+                  type: "string"
+                },
+                key_ops: {
+                  type: "array",
+                  items: {
+                    type: "string"
+                  },
+                  description: 'JWK "key_ops" (Key Operations) Parameter.'
+                },
+                kid: {
+                  type: "string",
+                  description: 'JWK "kid" (Key ID) Parameter.'
+                },
+                kty: {
+                  type: "string",
+                  description: 'JWK "kty" (Key Type) Parameter.'
+                },
+                n: {
+                  type: "string"
+                },
+                oth: {
+                  type: "array",
+                  items: {
+                    type: "object",
+                    properties: {
+                      d: {
+                        type: "string"
+                      },
+                      r: {
+                        type: "string"
+                      },
+                      t: {
+                        type: "string"
+                      }
+                    }
+                  }
+                },
+                p: {
+                  type: "string"
+                },
+                q: {
+                  type: "string"
+                },
+                qi: {
+                  type: "string"
+                },
+                use: {
+                  type: "string",
+                  description: 'JWK "use" (Public Key Use) Parameter.'
+                },
+                x: {
+                  type: "string"
+                },
+                y: {
+                  type: "string"
+                },
+                x5c: {
+                  type: "array",
+                  items: {
+                    type: "string"
+                  },
+                  description: 'JWK "x5c" (X.509 Certificate Chain) Parameter.'
+                },
+                x5t: {
+                  type: "string",
+                  description: 'JWK "x5t" (X.509 Certificate SHA-1 Thumbprint) Parameter.'
+                },
+                "x5t#S256": {
+                  type: "string",
+                  description: '"x5t#S256" (X.509 Certificate SHA-256 Thumbprint) Parameter.'
+                },
+                x5u: {
+                  type: "string",
+                  description: 'JWK "x5u" (X.509 URL) Parameter.'
+                }
+              },
+              additionalProperties: {},
+              description: 'JSON Web Key ( {@link https://www.rfc-editor.org/rfc/rfc7517 | JWK } ). "RSA", "EC", "OKP", and "oct" key types are supported.'
+            },
+            GetPresentationDefinitionArgs: {
+              type: "object",
+              properties: {
+                scope: {
+                  $ref: "#/components/schemas/EBSIScope"
+                },
+                apiOpts: {
+                  $ref: "#/components/schemas/ApiOpts"
+                }
+              },
+              required: ["scope"]
+            },
+            GetPresentationDefinitionResponse: {
+              $ref: "#/components/schemas/GetPresentationDefinitionSuccessResponse"
+            },
+            GetPresentationDefinitionSuccessResponse: {
+              type: "object",
+              properties: {
+                format: {
+                  $ref: "#/components/schemas/Format"
+                },
+                id: {
+                  type: "string"
+                },
+                name: {
+                  type: "string"
+                },
+                purpose: {
+                  type: "string"
+                },
+                submission_requirements: {
+                  type: "array",
+                  items: {
+                    $ref: "#/components/schemas/SubmissionRequirement"
+                  }
+                },
+                input_descriptors: {
+                  type: "array",
+                  items: {
+                    $ref: "#/components/schemas/InputDescriptorV2"
+                  }
+                },
+                frame: {
+                  type: "object"
+                }
+              },
+              required: ["id", "input_descriptors"]
+            },
+            Format: {
+              type: "object",
+              properties: {
+                jwt: {
+                  $ref: "#/components/schemas/JwtObject"
+                },
+                jwt_vc: {
+                  $ref: "#/components/schemas/JwtObject"
+                },
+                jwt_vc_json: {
+                  $ref: "#/components/schemas/JwtObject"
+                },
+                jwt_vp: {
+                  $ref: "#/components/schemas/JwtObject"
+                },
+                jwt_vp_json: {
+                  $ref: "#/components/schemas/JwtObject"
+                },
+                ldp: {
+                  $ref: "#/components/schemas/LdpObject"
+                },
+                ldp_vc: {
+                  $ref: "#/components/schemas/LdpObject"
+                },
+                ldp_vp: {
+                  $ref: "#/components/schemas/LdpObject"
+                },
+                di: {
+                  $ref: "#/components/schemas/DiObject"
+                },
+                di_vc: {
+                  $ref: "#/components/schemas/DiObject"
+                },
+                di_vp: {
+                  $ref: "#/components/schemas/DiObject"
+                },
+                "vc+sd-jwt": {
+                  $ref: "#/components/schemas/SdJwtObject"
+                }
+              }
+            },
+            JwtObject: {
+              type: "object",
+              properties: {
+                alg: {
+                  type: "array",
+                  items: {
+                    type: "string"
+                  }
+                }
+              },
+              required: ["alg"]
+            },
+            LdpObject: {
+              type: "object",
+              properties: {
+                proof_type: {
+                  type: "array",
+                  items: {
+                    type: "string"
+                  }
+                }
+              },
+              required: ["proof_type"]
+            },
+            DiObject: {
+              type: "object",
+              properties: {
+                proof_type: {
+                  type: "array",
+                  items: {
+                    type: "string"
+                  }
+                },
+                cryptosuite: {
+                  type: "array",
+                  items: {
+                    type: "string"
+                  }
+                }
+              },
+              required: ["proof_type", "cryptosuite"]
+            },
+            SdJwtObject: {
+              type: "object",
+              properties: {
+                "sd-jwt_alg_values": {
+                  type: "array",
+                  items: {
+                    type: "string"
+                  }
+                },
+                "kb-jwt_alg_values": {
+                  type: "array",
+                  items: {
+                    type: "string"
+                  }
+                }
+              }
+            },
+            SubmissionRequirement: {
+              type: "object",
+              properties: {
+                name: {
+                  type: "string"
+                },
+                purpose: {
+                  type: "string"
+                },
+                rule: {
+                  $ref: "#/components/schemas/Rules"
+                },
+                count: {
+                  type: "number"
+                },
+                min: {
+                  type: "number"
+                },
+                max: {
+                  type: "number"
+                },
+                from: {
+                  type: "string"
+                },
+                from_nested: {
+                  type: "array",
+                  items: {
+                    $ref: "#/components/schemas/SubmissionRequirement"
+                  }
+                }
+              },
+              required: ["rule"]
+            },
+            Rules: {
+              type: "string",
+              enum: ["all", "pick"]
+            },
+            InputDescriptorV2: {
+              type: "object",
+              properties: {
+                id: {
+                  type: "string"
+                },
+                name: {
+                  type: "string"
+                },
+                purpose: {
+                  type: "string"
+                },
+                format: {
+                  $ref: "#/components/schemas/Format"
+                },
+                group: {
+                  type: "array",
+                  items: {
+                    type: "string"
+                  }
+                },
+                issuance: {
+                  type: "array",
+                  items: {
+                    $ref: "#/components/schemas/Issuance"
+                  }
+                },
+                constraints: {
+                  $ref: "#/components/schemas/ConstraintsV2"
+                }
+              },
+              required: ["id", "constraints"]
+            },
+            Issuance: {
+              type: "object",
+              properties: {
+                manifest: {
+                  type: "string"
+                }
+              },
+              additionalProperties: {}
+            },
+            ConstraintsV2: {
+              type: "object",
+              properties: {
+                limit_disclosure: {
+                  $ref: "#/components/schemas/Optionality"
+                },
+                statuses: {
+                  $ref: "#/components/schemas/Statuses"
+                },
+                fields: {
+                  type: "array",
+                  items: {
+                    $ref: "#/components/schemas/FieldV2"
+                  }
+                },
+                subject_is_issuer: {
+                  $ref: "#/components/schemas/Optionality"
+                },
+                is_holder: {
+                  type: "array",
+                  items: {
+                    $ref: "#/components/schemas/HolderSubject"
+                  }
+                },
+                same_subject: {
+                  type: "array",
+                  items: {
+                    $ref: "#/components/schemas/HolderSubject"
+                  }
+                }
+              }
+            },
+            Optionality: {
+              type: "string",
+              enum: ["required", "preferred"]
+            },
+            Statuses: {
+              type: "object",
+              properties: {
+                active: {
+                  $ref: "#/components/schemas/PdStatus"
+                },
+                suspended: {
+                  $ref: "#/components/schemas/PdStatus"
+                },
+                revoked: {
+                  $ref: "#/components/schemas/PdStatus"
+                }
+              }
+            },
+            PdStatus: {
+              type: "object",
+              properties: {
+                directive: {
+                  $ref: "#/components/schemas/Directives"
+                }
+              }
+            },
+            Directives: {
+              type: "string",
+              enum: ["required", "allowed", "disallowed"]
+            },
+            FieldV2: {
+              type: "object",
+              properties: {
+                id: {
+                  type: "string"
+                },
+                path: {
+                  type: "array",
+                  items: {
+                    type: "string"
+                  }
+                },
+                purpose: {
+                  type: "string"
+                },
+                filter: {
+                  $ref: "#/components/schemas/FilterV2"
+                },
+                predicate: {
+                  $ref: "#/components/schemas/Optionality"
+                },
+                name: {
+                  type: "string"
+                },
+                optional: {
+                  type: "boolean"
+                }
+              },
+              required: ["path"]
+            },
+            FilterV2: {
+              type: "object",
+              properties: {
+                const: {
+                  $ref: "#/components/schemas/OneOfNumberStringBoolean"
+                },
+                enum: {
+                  type: "array",
+                  items: {
+                    $ref: "#/components/schemas/OneOfNumberStringBoolean"
+                  }
+                },
+                exclusiveMinimum: {
+                  $ref: "#/components/schemas/OneOfNumberString"
+                },
+                exclusiveMaximum: {
+                  $ref: "#/components/schemas/OneOfNumberString"
+                },
+                format: {
+                  type: "string"
+                },
+                formatMaximum: {
+                  type: "string"
+                },
+                formatMinimum: {
+                  type: "string"
+                },
+                formatExclusiveMaximum: {
+                  type: "string"
+                },
+                formatExclusiveMinimum: {
+                  type: "string"
+                },
+                minLength: {
+                  type: "number"
+                },
+                maxLength: {
+                  type: "number"
+                },
+                minimum: {
+                  $ref: "#/components/schemas/OneOfNumberString"
+                },
+                maximum: {
+                  $ref: "#/components/schemas/OneOfNumberString"
+                },
+                not: {
+                  type: "object"
+                },
+                pattern: {
+                  type: "string"
+                },
+                type: {
+                  type: "string"
+                },
+                contains: {
+                  $ref: "#/components/schemas/FilterV2Base"
+                },
+                items: {
+                  $ref: "#/components/schemas/FilterV2BaseItems"
+                }
+              },
+              required: ["type"]
+            },
+            OneOfNumberStringBoolean: {
+              type: ["boolean", "number", "string"]
+            },
+            OneOfNumberString: {
+              type: ["number", "string"]
+            },
+            FilterV2Base: {
+              type: "object",
+              properties: {
+                const: {
+                  $ref: "#/components/schemas/OneOfNumberStringBoolean"
+                },
+                enum: {
+                  type: "array",
+                  items: {
+                    $ref: "#/components/schemas/OneOfNumberStringBoolean"
+                  }
+                },
+                exclusiveMinimum: {
+                  $ref: "#/components/schemas/OneOfNumberString"
+                },
+                exclusiveMaximum: {
+                  $ref: "#/components/schemas/OneOfNumberString"
+                },
+                format: {
+                  type: "string"
+                },
+                formatMaximum: {
+                  type: "string"
+                },
+                formatMinimum: {
+                  type: "string"
+                },
+                formatExclusiveMaximum: {
+                  type: "string"
+                },
+                formatExclusiveMinimum: {
+                  type: "string"
+                },
+                minLength: {
+                  type: "number"
+                },
+                maxLength: {
+                  type: "number"
+                },
+                minimum: {
+                  $ref: "#/components/schemas/OneOfNumberString"
+                },
+                maximum: {
+                  $ref: "#/components/schemas/OneOfNumberString"
+                },
+                not: {
+                  type: "object"
+                },
+                pattern: {
+                  type: "string"
+                },
+                type: {
+                  type: "string"
+                },
+                contains: {
+                  $ref: "#/components/schemas/FilterV2Base"
+                },
+                items: {
+                  $ref: "#/components/schemas/FilterV2BaseItems"
+                }
+              }
+            },
+            FilterV2BaseItems: {
+              type: "object",
+              properties: {
+                const: {
+                  $ref: "#/components/schemas/OneOfNumberStringBoolean"
+                },
+                enum: {
+                  type: "array",
+                  items: {
+                    $ref: "#/components/schemas/OneOfNumberStringBoolean"
+                  }
+                },
+                exclusiveMinimum: {
+                  $ref: "#/components/schemas/OneOfNumberString"
+                },
+                exclusiveMaximum: {
+                  $ref: "#/components/schemas/OneOfNumberString"
+                },
+                format: {
+                  type: "string"
+                },
+                formatMaximum: {
+                  type: "string"
+                },
+                formatMinimum: {
+                  type: "string"
+                },
+                formatExclusiveMaximum: {
+                  type: "string"
+                },
+                formatExclusiveMinimum: {
+                  type: "string"
+                },
+                minLength: {
+                  type: "number"
+                },
+                maxLength: {
+                  type: "number"
+                },
+                minimum: {
+                  $ref: "#/components/schemas/OneOfNumberString"
+                },
+                maximum: {
+                  $ref: "#/components/schemas/OneOfNumberString"
+                },
+                not: {
+                  type: "object"
+                },
+                pattern: {
+                  type: "string"
+                },
+                type: {
+                  type: "string"
+                },
+                contains: {
+                  $ref: "#/components/schemas/FilterV2Base"
+                },
+                items: {
+                  $ref: "#/components/schemas/FilterV2BaseItems"
+                }
+              },
+              required: ["type"]
+            },
+            HolderSubject: {
+              type: "object",
+              properties: {
+                field_id: {
+                  type: "array",
+                  items: {
+                    type: "string"
+                  }
+                },
+                directive: {
+                  $ref: "#/components/schemas/Optionality"
+                }
+              },
+              required: ["field_id", "directive"]
+            },
+            GetOIDProviderMetadataResponse: {
+              $ref: "#/components/schemas/EbsiOpenIDMetadata"
+            },
+            EbsiOpenIDMetadata: {
+              anyOf: [
+                {
+                  type: "object",
+                  properties: {
+                    presentation_definition_endpoint: {
+                      type: "string"
+                    },
+                    authorization_endpoint: {
+                      anyOf: [
+                        {
+                          $ref: "#/components/schemas/Schema"
+                        },
+                        {
+                          type: "string"
+                        }
+                      ]
+                    },
+                    issuer: {
+                      anyOf: [
+                        {
+                          $ref: "#/components/schemas/ResponseIss"
+                        },
+                        {
+                          type: "string"
+                        }
+                      ]
+                    },
+                    response_types_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/ResponseType"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/ResponseType"
+                        }
+                      ]
+                    },
+                    scopes_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/Scope"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/Scope"
+                        }
+                      ]
+                    },
+                    subject_types_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/SubjectType"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/SubjectType"
+                        }
+                      ]
+                    },
+                    id_token_signing_alg_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/SigningAlgo"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/SigningAlgo"
+                        }
+                      ]
+                    },
+                    request_object_signing_alg_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/SigningAlgo"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/SigningAlgo"
+                        }
+                      ]
+                    },
+                    subject_syntax_types_supported: {
+                      type: "array",
+                      items: {
+                        type: "string"
+                      }
+                    },
+                    token_endpoint: {
+                      type: "string"
+                    },
+                    userinfo_endpoint: {
+                      type: "string"
+                    },
+                    jwks_uri: {
+                      type: "string"
+                    },
+                    registration_endpoint: {
+                      type: "string"
+                    },
+                    response_modes_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/ResponseMode"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/ResponseMode"
+                        }
+                      ]
+                    },
+                    grant_types_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/GrantType"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/GrantType"
+                        }
+                      ]
+                    },
+                    acr_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/AuthenticationContextReferences"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/AuthenticationContextReferences"
+                        }
+                      ]
+                    },
+                    id_token_encryption_alg_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/SigningAlgo"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/SigningAlgo"
+                        }
+                      ]
+                    },
+                    id_token_encryption_enc_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            type: "string"
+                          }
+                        },
+                        {
+                          type: "string"
+                        }
+                      ],
+                      description: "OPTIONAL. JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]."
+                    },
+                    userinfo_signing_alg_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/SigningAlgo"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/SigningAlgo"
+                        }
+                      ]
+                    },
+                    userinfo_encryption_alg_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/SigningAlgo"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/SigningAlgo"
+                        }
+                      ]
+                    },
+                    userinfo_encryption_enc_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            type: "string"
+                          }
+                        },
+                        {
+                          type: "string"
+                        }
+                      ],
+                      description: "OPTIONAL. JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]."
+                    },
+                    request_object_encryption_alg_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/SigningAlgo"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/SigningAlgo"
+                        }
+                      ]
+                    },
+                    request_object_encryption_enc_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            type: "string"
+                          }
+                        },
+                        {
+                          type: "string"
+                        }
+                      ],
+                      description: "OPTIONAL. JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference."
+                    },
+                    token_endpoint_auth_methods_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/TokenEndpointAuthMethod"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/TokenEndpointAuthMethod"
+                        }
+                      ]
+                    },
+                    token_endpoint_auth_signing_alg_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/SigningAlgo"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/SigningAlgo"
+                        }
+                      ]
+                    },
+                    display_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {}
+                        },
+                        {}
+                      ],
+                      description: "OPTIONAL. JSON array containing a list of the display parameter values that the OpenID Provider supports. These values are described in Section 3.1.2.1 of OpenID Connect Core 1.0 [OpenID.Core]."
+                    },
+                    claim_types_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/ClaimType"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/ClaimType"
+                        }
+                      ],
+                      description: "OPTIONAL. JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. Values defined by this specification are normal, aggregated, and distributed. If omitted, the implementation supports only normal Claims."
+                    },
+                    claims_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            type: "string"
+                          }
+                        },
+                        {
+                          type: "string"
+                        }
+                      ],
+                      description: "RECOMMENDED. JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list."
+                    },
+                    service_documentation: {
+                      type: "string"
+                    },
+                    claims_locales_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            type: "string"
+                          }
+                        },
+                        {
+                          type: "string"
+                        }
+                      ]
+                    },
+                    ui_locales_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            type: "string"
+                          }
+                        },
+                        {
+                          type: "string"
+                        }
+                      ]
+                    },
+                    claims_parameter_supported: {
+                      type: "boolean"
+                    },
+                    request_parameter_supported: {
+                      type: "boolean"
+                    },
+                    request_uri_parameter_supported: {
+                      type: "boolean"
+                    },
+                    require_request_uri_registration: {
+                      type: "boolean"
+                    },
+                    op_policy_uri: {
+                      type: "string"
+                    },
+                    op_tos_uri: {
+                      type: "string"
+                    },
+                    client_id: {
+                      type: "string"
+                    },
+                    redirect_uris: {
+                      type: "array",
+                      items: {
+                        type: "string"
+                      }
+                    },
+                    client_name: {
+                      type: "string"
+                    },
+                    token_endpoint_auth_method: {
+                      type: "string"
+                    },
+                    application_type: {
+                      type: "string"
+                    },
+                    response_types: {
+                      type: "string"
+                    },
+                    grant_types: {
+                      type: "string"
+                    },
+                    vp_formats: {
+                      $ref: "#/components/schemas/Format"
+                    }
+                  }
+                },
+                {
+                  type: "object",
+                  properties: {
+                    presentation_definition_endpoint: {
+                      type: "string"
+                    },
+                    authorization_endpoint: {
+                      anyOf: [
+                        {
+                          $ref: "#/components/schemas/Schema"
+                        },
+                        {
+                          type: "string"
+                        }
+                      ]
+                    },
+                    issuer: {
+                      anyOf: [
+                        {
+                          $ref: "#/components/schemas/ResponseIss"
+                        },
+                        {
+                          type: "string"
+                        }
+                      ]
+                    },
+                    response_types_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/ResponseType"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/ResponseType"
+                        }
+                      ]
+                    },
+                    scopes_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/Scope"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/Scope"
+                        }
+                      ]
+                    },
+                    subject_types_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/SubjectType"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/SubjectType"
+                        }
+                      ]
+                    },
+                    id_token_signing_alg_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/SigningAlgo"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/SigningAlgo"
+                        }
+                      ]
+                    },
+                    request_object_signing_alg_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/SigningAlgo"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/SigningAlgo"
+                        }
+                      ]
+                    },
+                    subject_syntax_types_supported: {
+                      type: "array",
+                      items: {
+                        type: "string"
+                      }
+                    },
+                    token_endpoint: {
+                      type: "string"
+                    },
+                    userinfo_endpoint: {
+                      type: "string"
+                    },
+                    jwks_uri: {
+                      type: "string"
+                    },
+                    registration_endpoint: {
+                      type: "string"
+                    },
+                    response_modes_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/ResponseMode"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/ResponseMode"
+                        }
+                      ]
+                    },
+                    grant_types_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/GrantType"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/GrantType"
+                        }
+                      ]
+                    },
+                    acr_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/AuthenticationContextReferences"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/AuthenticationContextReferences"
+                        }
+                      ]
+                    },
+                    id_token_encryption_alg_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/SigningAlgo"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/SigningAlgo"
+                        }
+                      ]
+                    },
+                    id_token_encryption_enc_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            type: "string"
+                          }
+                        },
+                        {
+                          type: "string"
+                        }
+                      ],
+                      description: "OPTIONAL. JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]."
+                    },
+                    userinfo_signing_alg_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/SigningAlgo"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/SigningAlgo"
+                        }
+                      ]
+                    },
+                    userinfo_encryption_alg_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/SigningAlgo"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/SigningAlgo"
+                        }
+                      ]
+                    },
+                    userinfo_encryption_enc_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            type: "string"
+                          }
+                        },
+                        {
+                          type: "string"
+                        }
+                      ],
+                      description: "OPTIONAL. JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]."
+                    },
+                    request_object_encryption_alg_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/SigningAlgo"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/SigningAlgo"
+                        }
+                      ]
+                    },
+                    request_object_encryption_enc_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            type: "string"
+                          }
+                        },
+                        {
+                          type: "string"
+                        }
+                      ],
+                      description: "OPTIONAL. JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference."
+                    },
+                    token_endpoint_auth_methods_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/TokenEndpointAuthMethod"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/TokenEndpointAuthMethod"
+                        }
+                      ]
+                    },
+                    token_endpoint_auth_signing_alg_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/SigningAlgo"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/SigningAlgo"
+                        }
+                      ]
+                    },
+                    display_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {}
+                        },
+                        {}
+                      ],
+                      description: "OPTIONAL. JSON array containing a list of the display parameter values that the OpenID Provider supports. These values are described in Section 3.1.2.1 of OpenID Connect Core 1.0 [OpenID.Core]."
+                    },
+                    claim_types_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/ClaimType"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/ClaimType"
+                        }
+                      ],
+                      description: "OPTIONAL. JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. Values defined by this specification are normal, aggregated, and distributed. If omitted, the implementation supports only normal Claims."
+                    },
+                    claims_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            type: "string"
+                          }
+                        },
+                        {
+                          type: "string"
+                        }
+                      ],
+                      description: "RECOMMENDED. JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list."
+                    },
+                    service_documentation: {
+                      type: "string"
+                    },
+                    claims_locales_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            type: "string"
+                          }
+                        },
+                        {
+                          type: "string"
+                        }
+                      ]
+                    },
+                    ui_locales_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            type: "string"
+                          }
+                        },
+                        {
+                          type: "string"
+                        }
+                      ]
+                    },
+                    claims_parameter_supported: {
+                      type: "boolean"
+                    },
+                    request_parameter_supported: {
+                      type: "boolean"
+                    },
+                    request_uri_parameter_supported: {
+                      type: "boolean"
+                    },
+                    require_request_uri_registration: {
+                      type: "boolean"
+                    },
+                    op_policy_uri: {
+                      type: "string"
+                    },
+                    op_tos_uri: {
+                      type: "string"
+                    },
+                    client_id: {
+                      type: "string"
+                    },
+                    redirect_uris: {
+                      type: "array",
+                      items: {
+                        type: "string"
+                      }
+                    },
+                    client_name: {
+                      type: "string"
+                    },
+                    token_endpoint_auth_method: {
+                      type: "string"
+                    },
+                    application_type: {
+                      type: "string"
+                    },
+                    response_types: {
+                      type: "string"
+                    },
+                    grant_types: {
+                      type: "string"
+                    },
+                    vp_formats: {
+                      $ref: "#/components/schemas/Format"
+                    },
+                    logo_uri: {
+                      type: "string"
+                    },
+                    client_purpose: {
+                      type: "string"
+                    }
+                  }
+                },
+                {
+                  type: "object",
+                  properties: {
+                    presentation_definition_endpoint: {
+                      type: "string"
+                    },
+                    authorization_endpoint: {
+                      anyOf: [
+                        {
+                          $ref: "#/components/schemas/Schema"
+                        },
+                        {
+                          type: "string"
+                        }
+                      ]
+                    },
+                    issuer: {
+                      anyOf: [
+                        {
+                          $ref: "#/components/schemas/ResponseIss"
+                        },
+                        {
+                          type: "string"
+                        }
+                      ]
+                    },
+                    response_types_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/ResponseType"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/ResponseType"
+                        }
+                      ]
+                    },
+                    scopes_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/Scope"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/Scope"
+                        }
+                      ]
+                    },
+                    subject_types_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/SubjectType"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/SubjectType"
+                        }
+                      ]
+                    },
+                    id_token_signing_alg_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/SigningAlgo"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/SigningAlgo"
+                        }
+                      ]
+                    },
+                    request_object_signing_alg_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/SigningAlgo"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/SigningAlgo"
+                        }
+                      ]
+                    },
+                    subject_syntax_types_supported: {
+                      type: "array",
+                      items: {
+                        type: "string"
+                      }
+                    },
+                    token_endpoint: {
+                      type: "string"
+                    },
+                    userinfo_endpoint: {
+                      type: "string"
+                    },
+                    jwks_uri: {
+                      type: "string"
+                    },
+                    registration_endpoint: {
+                      type: "string"
+                    },
+                    response_modes_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/ResponseMode"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/ResponseMode"
+                        }
+                      ]
+                    },
+                    grant_types_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/GrantType"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/GrantType"
+                        }
+                      ]
+                    },
+                    acr_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/AuthenticationContextReferences"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/AuthenticationContextReferences"
+                        }
+                      ]
+                    },
+                    id_token_encryption_alg_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/SigningAlgo"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/SigningAlgo"
+                        }
+                      ]
+                    },
+                    id_token_encryption_enc_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            type: "string"
+                          }
+                        },
+                        {
+                          type: "string"
+                        }
+                      ],
+                      description: "OPTIONAL. JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]."
+                    },
+                    userinfo_signing_alg_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/SigningAlgo"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/SigningAlgo"
+                        }
+                      ]
+                    },
+                    userinfo_encryption_alg_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/SigningAlgo"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/SigningAlgo"
+                        }
+                      ]
+                    },
+                    userinfo_encryption_enc_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            type: "string"
+                          }
+                        },
+                        {
+                          type: "string"
+                        }
+                      ],
+                      description: "OPTIONAL. JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]."
+                    },
+                    request_object_encryption_alg_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/SigningAlgo"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/SigningAlgo"
+                        }
+                      ]
+                    },
+                    request_object_encryption_enc_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            type: "string"
+                          }
+                        },
+                        {
+                          type: "string"
+                        }
+                      ],
+                      description: "OPTIONAL. JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference."
+                    },
+                    token_endpoint_auth_methods_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/TokenEndpointAuthMethod"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/TokenEndpointAuthMethod"
+                        }
+                      ]
+                    },
+                    token_endpoint_auth_signing_alg_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/SigningAlgo"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/SigningAlgo"
+                        }
+                      ]
+                    },
+                    display_values_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {}
+                        },
+                        {}
+                      ],
+                      description: "OPTIONAL. JSON array containing a list of the display parameter values that the OpenID Provider supports. These values are described in Section 3.1.2.1 of OpenID Connect Core 1.0 [OpenID.Core]."
+                    },
+                    claim_types_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/ClaimType"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/ClaimType"
+                        }
+                      ],
+                      description: "OPTIONAL. JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. Values defined by this specification are normal, aggregated, and distributed. If omitted, the implementation supports only normal Claims."
+                    },
+                    claims_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            type: "string"
+                          }
+                        },
+                        {
+                          type: "string"
+                        }
+                      ],
+                      description: "RECOMMENDED. JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list."
+                    },
+                    service_documentation: {
+                      type: "string"
+                    },
+                    claims_locales_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            type: "string"
+                          }
+                        },
+                        {
+                          type: "string"
+                        }
+                      ]
+                    },
+                    ui_locales_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            type: "string"
+                          }
+                        },
+                        {
+                          type: "string"
+                        }
+                      ]
+                    },
+                    claims_parameter_supported: {
+                      type: "boolean"
+                    },
+                    request_parameter_supported: {
+                      type: "boolean"
+                    },
+                    request_uri_parameter_supported: {
+                      type: "boolean"
+                    },
+                    require_request_uri_registration: {
+                      type: "boolean"
+                    },
+                    op_policy_uri: {
+                      type: "string"
+                    },
+                    op_tos_uri: {
+                      type: "string"
+                    },
+                    id_token_types_supported: {
+                      anyOf: [
+                        {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/IdTokenType"
+                          }
+                        },
+                        {
+                          $ref: "#/components/schemas/IdTokenType"
+                        }
+                      ]
+                    },
+                    vp_formats_supported: {
+                      $ref: "#/components/schemas/Format"
+                    }
+                  }
+                }
+              ]
+            },
+            Schema: {
+              type: "string",
+              enum: ["openid:", "openid-vc:"]
+            },
+            ResponseIss: {
+              type: "string",
+              enum: ["https://self-issued.me", "https://self-issued.me/v2", "https://self-issued.me/v2/openid-vc"]
+            },
+            ResponseType: {
+              type: "string",
+              enum: ["id_token", "vp_token"]
+            },
+            Scope: {
+              type: "string",
+              enum: ["openid", "openid did_authn", "profile", "email", "address", "phone"]
+            },
+            SubjectType: {
+              type: "string",
+              enum: ["public", "pairwise"]
+            },
+            SigningAlgo: {
+              type: "string",
+              enum: ["EdDSA", "RS256", "PS256", "ES256", "ES256K"]
+            },
+            ResponseMode: {
+              type: "string",
+              enum: ["fragment", "form_post", "post", "direct_post", "query"]
+            },
+            GrantType: {
+              type: "string",
+              enum: ["authorization_code", "implicit"]
+            },
+            AuthenticationContextReferences: {
+              type: "string",
+              enum: ["phr", "phrh"]
+            },
+            TokenEndpointAuthMethod: {
+              type: "string",
+              enum: ["client_secret_post", "client_secret_basic", "client_secret_jwt", "private_key_jwt"]
+            },
+            ClaimType: {
+              type: "string",
+              enum: ["normal", "aggregated", "distributed"]
+            },
+            IdTokenType: {
+              type: "string",
+              enum: ["subject_signed", "attester_signed"]
+            }
+          },
+          methods: {
+            ebsiAccessTokenGet: {
+              description: "",
+              arguments: {
+                $ref: "#/components/schemas/EBSIAuthAccessTokenGetArgs"
+              },
+              returnType: {
+                $ref: "#/components/schemas/GetAccessTokenResponse"
+              }
+            },
+            ebsiAuthorizationServerJwks: {
+              description: "",
+              arguments: {
+                $ref: "#/components/schemas/ApiOpts"
+              },
+              returnType: {
+                $ref: "#/components/schemas/GetOIDProviderJwksResponse"
+              }
+            },
+            ebsiPresentationDefinitionGet: {
+              description: "",
+              arguments: {
+                $ref: "#/components/schemas/GetPresentationDefinitionArgs"
+              },
+              returnType: {
+                $ref: "#/components/schemas/GetPresentationDefinitionResponse"
+              }
+            },
+            ebsiWellknownMetadata: {
+              description: "",
+              arguments: {
+                $ref: "#/components/schemas/ApiOpts"
+              },
+              returnType: {
+                $ref: "#/components/schemas/GetOIDProviderMetadataResponse"
+              }
+            }
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  EbsiDidProvider: () => EbsiDidProvider,
+  EbsiSupport: () => EbsiSupport,
+  TokenType: () => TokenType,
+  ebsiSupportMethods: () => ebsiSupportMethods,
+  logger: () => logger,
+  schema: () => schema
+});
+module.exports = __toCommonJS(index_exports);
+var import_ssi_types2 = require("@sphereon/ssi-types");
+
+// src/agent/EbsiSupport.ts
+var import_did_auth_siop2 = require("@sphereon/did-auth-siop");
+var import_oid4vci_common4 = require("@sphereon/oid4vci-common");
+var import_ssi_types = require("@sphereon/ssi-types");
+var import_cross_fetch4 = __toESM(require("cross-fetch"), 1);
+
+// src/did/functions.ts
+var import_random = require("@ethersproject/random");
+var import_oid4vci_common3 = require("@sphereon/oid4vci-common");
+var import_ssi_sdk_ext3 = require("@sphereon/ssi-sdk-ext.did-utils");
+var import_ssi_sdk_ext4 = require("@sphereon/ssi-sdk-ext.key-utils");
+var import_ethers = require("ethers");
+var import_base58 = require("multiformats/bases/base58");
+var import_from_string = require("uint8arrays/from-string");
+var import_to_string = require("uint8arrays/to-string");
+
+// src/functions/Attestation.ts
+var import_oid4vci_client = require("@sphereon/oid4vci-client");
+var import_oid4vci_common2 = require("@sphereon/oid4vci-common");
+var import_ssi_sdk_ext = require("@sphereon/ssi-sdk-ext.did-utils");
+var import_ssi_sdk_ext2 = require("@sphereon/ssi-sdk-ext.key-utils");
+var import_ssi_sdk3 = require("@sphereon/ssi-sdk.oid4vci-holder");
+var import_ssi_sdk4 = require("@sphereon/ssi-sdk.siopv2-oid4vp-op-auth");
+var import_waitFor = require("xstate/lib/waitFor");
+
+// src/functions/AttestationHeadlessCallbacks.ts
+var import_did_auth_siop = require("@sphereon/did-auth-siop");
+var import_oid4vci_common = require("@sphereon/oid4vci-common");
+var import_ssi_sdk = require("@sphereon/ssi-sdk.data-store");
+var import_ssi_sdk2 = require("@sphereon/ssi-sdk.oid4vci-holder");
+var import_cross_fetch = __toESM(require("cross-fetch"), 1);
+var addContactCallback = /* @__PURE__ */ __name((context) => {
+  return async (oid4vciMachine, state) => {
+    const { serverMetadata, hasContactConsent, contactAlias } = state.context;
+    if (!serverMetadata) {
+      return Promise.reject(Error("Missing serverMetadata in context"));
+    }
+    const issuerUrl = new URL(serverMetadata.issuer);
+    const correlationId = `${issuerUrl.protocol}//${issuerUrl.hostname}`;
+    let issuerName = (0, import_oid4vci_common.getIssuerName)(correlationId, serverMetadata.credentialIssuerMetadata);
+    const party = {
+      contact: {
+        displayName: issuerName,
+        legalName: issuerName
+      },
+      // FIXME maybe its nicer if we can also just use the id only
+      // TODO using the predefined party type from the contact migrations here
+      // TODO this is not used as the screen itself adds one, look at the params of the screen, this is not being passed in
+      partyType: {
+        id: "3875c12e-fdaa-4ef6-a340-c936e054b627",
+        origin: import_ssi_sdk.PartyOrigin.EXTERNAL,
+        type: import_ssi_sdk.PartyTypeType.ORGANIZATION,
+        name: "Sphereon_default_type",
+        tenantId: "95e09cfc-c974-4174-86aa-7bf1d5251fb4"
+      },
+      uri: correlationId,
+      identities: [
+        {
+          alias: correlationId,
+          roles: [
+            import_ssi_sdk.CredentialRole.ISSUER
+          ],
+          origin: import_ssi_sdk.IdentityOrigin.EXTERNAL,
+          identifier: {
+            type: import_ssi_sdk.CorrelationIdentifierType.URL,
+            correlationId: issuerUrl.hostname
+          },
+          // TODO WAL-476 add support for correct connection
+          connection: {
+            type: import_ssi_sdk.ConnectionType.OPENID_CONNECT,
+            config: {
+              clientId: "138d7bf8-c930-4c6e-b928-97d3a4928b01",
+              clientSecret: "03b3955f-d020-4f2a-8a27-4e452d4e27a0",
+              scopes: [
+                "auth"
+              ],
+              issuer: "https://example.com/app-test",
+              redirectUrl: "app:/callback",
+              dangerouslyAllowInsecureHttpRequests: true,
+              clientAuthMethod: "post"
+            }
+          }
+        }
+      ]
+    };
+    const onCreate = /* @__PURE__ */ __name(async ({ party: party2, issuerUrl: issuerUrl2, issuerName: issuerName2, correlationId: correlationId2 }) => {
+      const displayName = party2.contact.displayName ?? issuerName2;
+      const contacts = await context.agent.cmGetContacts({
+        filter: [
+          {
+            contact: {
+              // Searching on legalName as displayName is not unique, and we only support organizations for now
+              legalName: displayName
+            }
+          }
+        ]
+      });
+      if (contacts.length === 0 || !contacts[0]?.contact) {
+        const contact = await context.agent.cmAddContact({
+          ...party2,
+          displayName,
+          legalName: displayName,
+          contactType: {
+            type: import_ssi_sdk.PartyTypeType.ORGANIZATION,
+            name: displayName,
+            origin: import_ssi_sdk.PartyOrigin.EXTERNAL,
+            tenantId: party2.tenantId ?? "1"
+          }
+        });
+        oid4vciMachine.send({
+          type: import_ssi_sdk2.OID4VCIMachineEvents.CREATE_CONTACT,
+          data: contact
+        });
+      }
+    }, "onCreate");
+    const onConsentChange = /* @__PURE__ */ __name(async (hasConsent) => {
+      oid4vciMachine.send({
+        type: import_ssi_sdk2.OID4VCIMachineEvents.SET_CONTACT_CONSENT,
+        data: hasConsent
+      });
+    }, "onConsentChange");
+    const onAliasChange = /* @__PURE__ */ __name(async (alias) => {
+      oid4vciMachine.send({
+        type: import_ssi_sdk2.OID4VCIMachineEvents.SET_CONTACT_ALIAS,
+        data: alias
+      });
+    }, "onAliasChange");
+    if (!issuerName) {
+      issuerName = `EBSI unknown (${issuerUrl})`;
+    } else if (issuerName.startsWith("http")) {
+      issuerName = `EBSI ${issuerName.replace(/https?:\/\//, "")}`;
+    }
+    if (!contactAlias) {
+      return await onAliasChange(issuerName);
+    }
+    issuerName = contactAlias;
+    if (!hasContactConsent) {
+      return await onConsentChange(true);
+    }
+    await onCreate({
+      party,
+      issuerName,
+      issuerUrl: issuerUrl.toString(),
+      correlationId
+    });
+  };
+}, "addContactCallback");
+var handleErrorCallback = /* @__PURE__ */ __name((context) => {
+  return async (oid4vciMachine, state) => {
+    console.error(`error callback event: ${state.event}`, state.context.error);
+    logger.trace(state.event);
+  };
+}, "handleErrorCallback");
+var selectCredentialsCallback = /* @__PURE__ */ __name((context) => {
+  return async (oid4vciMachine, state) => {
+    const { contact, credentialToSelectFrom, selectedCredentials } = state.context;
+    if (selectedCredentials && selectedCredentials.length > 0) {
+      logger.info(`selected: ${selectedCredentials.join(", ")}`);
+      oid4vciMachine.send({
+        type: import_ssi_sdk2.OID4VCIMachineEvents.NEXT
+      });
+      return;
+    } else if (!contact) {
+      return Promise.reject(Error("Missing contact in context"));
+    }
+    const onSelectType = /* @__PURE__ */ __name(async (selectedCredentials2) => {
+      console.log(`Selected credentials: ${selectedCredentials2.join(", ")}`);
+      oid4vciMachine.send({
+        type: import_ssi_sdk2.OID4VCIMachineEvents.SET_SELECTED_CREDENTIALS,
+        data: selectedCredentials2
+      });
+    }, "onSelectType");
+    await onSelectType(credentialToSelectFrom.map((sel) => sel.credentialId));
+  };
+}, "selectCredentialsCallback");
+var authorizationCodeUrlCallback = /* @__PURE__ */ __name(({ authReqResult, vpLinkHandler }, context) => {
+  return async (oid4vciMachine, state) => {
+    const url = state.context.authorizationCodeURL;
+    console.log("navigateAuthorizationCodeURL: ", url);
+    if (!url) {
+      return Promise.reject(Error("Missing authorization URL in context"));
+    }
+    const onOpenAuthorizationUrl = /* @__PURE__ */ __name(async (url2) => {
+      console.log("onOpenAuthorizationUrl being invoked: ", url2);
+      oid4vciMachine.send({
+        type: import_ssi_sdk2.OID4VCIMachineEvents.INVOKED_AUTHORIZATION_CODE_REQUEST,
+        data: url2
+      });
+      const response = await (0, import_cross_fetch.default)(url2, {
+        redirect: "manual"
+      });
+      if (response.status < 301 || response.status > 302) {
+        throw Error(`When doing a headless auth, we expect to be redirected on getting the authz URL`);
+      }
+      const openidUri = response.headers.get("location");
+      if (!openidUri || !openidUri.startsWith("openid://")) {
+        let error = void 0;
+        if (openidUri) {
+          if (openidUri.includes("error")) {
+            error = "Authorization server error: ";
+            const decoded = (0, import_did_auth_siop.decodeUriAsJson)(openidUri);
+            if ("error" in decoded && decoded.error) {
+              error += decoded.error + ", ";
+            }
+            if ("error_description" in decoded && decoded.error_description) {
+              error += decoded.error_description;
+            }
+          }
+        }
+        throw Error(error ?? `Expected a openid:// URI to be returned from EBSI in headless mode. Returned: ${openidUri}, ${JSON.stringify(await response.text())}`);
+      }
+      console.log(`onOpenAuthorizationUrl after openUrl: ${url2}`);
+      const kid = authReqResult.authKey.meta?.jwkThumbprint ? `${authReqResult.identifier.did}#${authReqResult.authKey.meta.jwkThumbprint}` : authReqResult.identifier.kid;
+      await vpLinkHandler.handle(openidUri, {
+        idOpts: {
+          ...authReqResult.identifier,
+          kmsKeyRef: kid
+        }
+      });
+    }, "onOpenAuthorizationUrl");
+    await onOpenAuthorizationUrl(url);
+  };
+}, "authorizationCodeUrlCallback");
+var reviewCredentialsCallback = /* @__PURE__ */ __name((context) => {
+  return async (oid4vciMachine, state) => {
+    console.log(`# REVIEW CREDENTIALS:`);
+    console.log(JSON.stringify(state.context.credentialsToAccept, null, 2));
+    oid4vciMachine.send({
+      type: import_ssi_sdk2.OID4VCIMachineEvents.NEXT
+    });
+  };
+}, "reviewCredentialsCallback");
+var siopDoneCallback = /* @__PURE__ */ __name(({ oid4vciMachine }, context) => {
+  return async (oid4vpMachine, state) => {
+    if (!state.context.authorizationResponseData?.queryParams?.code) {
+      throw Error(`No code was returned from the authorization step`);
+    }
+    oid4vciMachine.interpreter.send({
+      type: import_ssi_sdk2.OID4VCIMachineEvents.PROVIDE_AUTHORIZATION_CODE_RESPONSE,
+      data: state.context.authorizationResponseData.url
+    });
+    console.log(`SIOP DONE!`);
+  };
+}, "siopDoneCallback");
+
+// src/functions/Attestation.ts
+var ebsiCreateAttestationAuthRequestURL = /* @__PURE__ */ __name(async ({ clientId: clientIdArg, credentialIssuer, credentialType, idOpts, redirectUri, requestObjectOpts, formats = [
+  "jwt_vc",
+  "jwt_vc_json"
+] }, context) => {
+  logger.info(`create attestation ${credentialType} auth req URL for ${clientIdArg} and issuer ${credentialIssuer}`);
+  const resolution = await context.agent.identifierManagedGetByDid(idOpts);
+  const identifier = resolution.identifier;
+  if (identifier.provider !== "did:ebsi" && identifier.provider !== "did:key") {
+    throw Error(`EBSI only supports did:key for natural persons and did:ebsi for legal persons. Provider: ${identifier.provider}, did: ${identifier.did}`);
+  }
+  const authKey = await (0, import_ssi_sdk_ext.getAuthenticationKey)({
+    identifier,
+    offlineWhenNoDIDRegistered: credentialType === "VerifiableAuthorisationToOnboard",
+    noVerificationMethodFallback: true,
+    keyType: "Secp256r1"
+  }, context);
+  const kid = authKey.meta?.jwkThumbprint ?? (0, import_ssi_sdk_ext2.calculateJwkThumbprintForKey)({
+    key: authKey
+  });
+  const clientId = clientIdArg ?? identifier.did;
+  const vciClient = await import_oid4vci_client.OpenID4VCIClient.fromCredentialIssuer({
+    credentialIssuer,
+    kid,
+    clientId,
+    createAuthorizationRequestURL: false,
+    retrieveServerMetadata: true
+  });
+  const allMatches = vciClient.getCredentialsSupported(false);
+  let arrayMatches;
+  if (Array.isArray(allMatches)) {
+    arrayMatches = allMatches;
+  } else {
+    arrayMatches = Object.entries(allMatches).map(([id, supported]) => {
+      supported.id = id;
+      return supported;
+    });
+  }
+  const supportedConfigurations = arrayMatches.filter((supported) => (0, import_oid4vci_common2.getTypesFromCredentialSupported)(supported, {
+    filterVerifiableCredential: false
+  }).includes(credentialType)).filter((supported) => (supported.format === "jwt_vc" || supported.format === "jwt_vc_json") && formats.includes(supported.format));
+  if (supportedConfigurations.length === 0) {
+    throw Error(`Could not find '${credentialType}' with format(s) '${formats.join(",")}' in list of supported types for issuer: ${credentialIssuer}`);
+  }
+  const authorizationDetails = supportedConfigurations.map((supported) => {
+    return {
+      type: "openid_credential",
+      format: supported.format,
+      types: (0, import_oid4vci_common2.getTypesFromCredentialSupported)(supported)
+    };
+  });
+  const signCallbacks = requestObjectOpts.signCallbacks ?? {
+    signCallback: (0, import_ssi_sdk3.signCallback)(idOpts, context)
+  };
+  const authorizationRequestOpts = {
+    redirectUri,
+    clientId,
+    authorizationDetails,
+    requestObjectOpts: {
+      ...requestObjectOpts,
+      signCallbacks,
+      kid: requestObjectOpts.kid ?? kid
+    }
+  };
+  const authorizationCodeURL = await vciClient.createAuthorizationRequestUrl({
+    authorizationRequest: authorizationRequestOpts
+  });
+  logger.info(`create attestation ${credentialType} auth req URL for ${clientIdArg} and issuer ${credentialIssuer}, result: ${authorizationCodeURL}`);
+  const jwaAlg = await (0, import_ssi_sdk_ext2.signatureAlgorithmFromKey)({
+    key: authKey
+  });
+  if (!(jwaAlg in import_oid4vci_common2.Alg)) {
+    return Promise.reject(Error(`${jwaAlg} is not supported`));
+  }
+  const alg = import_oid4vci_common2.Alg[jwaAlg];
+  return {
+    requestData: {
+      createAuthorizationRequestURL: false,
+      flowType: import_oid4vci_common2.AuthzFlowType.AUTHORIZATION_CODE_FLOW,
+      uri: credentialIssuer,
+      existingClientState: JSON.parse(await vciClient.exportState())
+    },
+    accessTokenOpts: {
+      clientOpts: {
+        alg,
+        clientId,
+        kid,
+        signCallbacks,
+        clientAssertionType: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
+      }
+    },
+    authorizationRequestOpts,
+    authorizationCodeURL,
+    identifier: resolution,
+    authKey,
+    didMethodPreferences: [
+      import_ssi_sdk_ext.SupportedDidMethodEnum.DID_EBSI,
+      import_ssi_sdk_ext.SupportedDidMethodEnum.DID_KEY
+    ]
+  };
+}, "ebsiCreateAttestationAuthRequestURL");
+var ebsiGetAttestationInterpreter = /* @__PURE__ */ __name(async ({ clientId, authReqResult }, context) => {
+  const identifier = authReqResult.identifier;
+  const vciStateCallbacks = /* @__PURE__ */ new Map();
+  const vpStateCallbacks = /* @__PURE__ */ new Map();
+  const oid4vciMachine = await context.agent.oid4vciHolderGetMachineInterpreter({
+    ...authReqResult,
+    issuanceOpt: {
+      identifier,
+      supportedPreferredDidMethod: import_ssi_sdk_ext.SupportedDidMethodEnum.DID_EBSI,
+      kid: authReqResult.authKey.meta?.jwkThumbprint ?? authReqResult.authKey.kid
+    },
+    clientOpts: {
+      clientAssertionType: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
+      kid: authReqResult.authKey.meta?.jwkThumbprint ?? authReqResult.authKey.kid,
+      clientId
+    },
+    didMethodPreferences: [
+      import_ssi_sdk_ext.SupportedDidMethodEnum.DID_EBSI,
+      import_ssi_sdk_ext.SupportedDidMethodEnum.DID_KEY
+    ],
+    stateNavigationListener: (0, import_ssi_sdk3.OID4VCICallbackStateListener)(vciStateCallbacks)
+  });
+  const vpLinkHandler = new import_ssi_sdk4.Siopv2OID4VPLinkHandler({
+    protocols: [
+      "openid:"
+    ],
+    // @ts-ignore
+    context,
+    noStateMachinePersistence: true,
+    stateNavigationListener: (0, import_ssi_sdk4.OID4VPCallbackStateListener)(vpStateCallbacks)
+  });
+  vpStateCallbacks.set(import_ssi_sdk4.Siopv2MachineStates.done, siopDoneCallback({
+    oid4vciMachine
+  }, context)).set(import_ssi_sdk4.Siopv2MachineStates.handleError, handleErrorCallback(context)).set(import_ssi_sdk4.Siopv2MachineStates.error, handleErrorCallback(context));
+  vciStateCallbacks.set(import_ssi_sdk3.OID4VCIMachineStates.handleError, handleErrorCallback(context)).set(import_ssi_sdk3.OID4VCIMachineStates.addContact, addContactCallback(context)).set(import_ssi_sdk3.OID4VCIMachineStates.selectCredentials, selectCredentialsCallback(context)).set(import_ssi_sdk3.OID4VCIMachineStates.initiateAuthorizationRequest, authorizationCodeUrlCallback({
+    authReqResult,
+    vpLinkHandler
+  }, context)).set(import_ssi_sdk3.OID4VCIMachineStates.reviewCredentials, reviewCredentialsCallback(context));
+  return oid4vciMachine.interpreter;
+}, "ebsiGetAttestationInterpreter");
+var ebsiGetAttestation = /* @__PURE__ */ __name(async ({ clientId, authReqResult, opts = {
+  timeout: 3e4
+} }, agentContext) => {
+  logger.info(`Getting EBSI attestation for ${authReqResult.identifier.did} and ${clientId}`);
+  const interpreter = await ebsiGetAttestationInterpreter({
+    clientId,
+    authReqResult
+  }, agentContext);
+  const state = await (0, import_waitFor.waitFor)(interpreter.start(), (state2) => state2.matches("done") || state2.matches("handleError") || state2.matches("error"), {
+    timeout: opts.timeout ?? 3e4
+  });
+  const { contactAlias, contact, credentialBranding, issuanceOpt, error, credentialsToAccept } = state.context;
+  if (state.matches("handleError") || state.matches("error")) {
+    logger.error(JSON.stringify(state.context.error));
+    throw Error(JSON.stringify(state.context.error));
+  }
+  const result = {
+    contactAlias,
+    contact,
+    credentialBranding,
+    identifier: issuanceOpt?.identifier ? await agentContext.agent.identifierManagedGet(issuanceOpt.identifier) : authReqResult.identifier,
+    error,
+    credentials: credentialsToAccept
+  };
+  logger.info(`EBSI attestation for ${authReqResult.identifier.did} and ${clientId}`, result);
+  return result;
+}, "ebsiGetAttestation");
+
+// src/functions/index.ts
+var getEbsiApiBaseUrl = /* @__PURE__ */ __name(({ environment = "pilot", version, system = "pilot" }) => {
+  return `https://api-${environment}.ebsi.eu/${system}/${version}`;
+}, "getEbsiApiBaseUrl");
+var wait = /* @__PURE__ */ __name(async (timeoutInMS) => {
+  return new Promise((resolve) => setTimeout(resolve, timeoutInMS));
+}, "wait");
+
+// src/did/services/EbsiRestService.ts
+var import_cross_fetch2 = __toESM(require("cross-fetch"), 1);
+var ebsiGetDidDocument = /* @__PURE__ */ __name(async (args) => {
+  const { params, apiOpts } = args;
+  const { did, validAt } = params;
+  if (!did) {
+    throw new Error("did parameter is required");
+  }
+  const query = validAt ? `?valid_at=${validAt}` : "";
+  const response = await (0, import_cross_fetch2.default)(`${ebsiGetRegistryAPIUrls({
+    ...apiOpts
+  }).query}/${did}${query}`);
+  const textBody = await response.text();
+  const json = textBody.startsWith("{") ? JSON.parse(textBody) : void 0;
+  if (response.status >= 300 || !json) {
+    return Promise.reject(new Error(json ?? textBody));
+  }
+  return json;
+}, "ebsiGetDidDocument");
+var ebsiWaitTillDocumentAnchored = /* @__PURE__ */ __name(async (args) => {
+  const { did, startIntervalMS = 2e3, minIntervalMS = 500, decreaseIntervalMSPerStep = 250, maxWaitTime = 6e4, version = "v5", environment = "pilot", searchForObject } = args;
+  if (startIntervalMS < minIntervalMS) {
+    return Promise.reject(Error(`min interval ${minIntervalMS} needs to be smaller or equal to the start interval ${startIntervalMS}`));
+  } else if (decreaseIntervalMSPerStep < 0) {
+    return Promise.reject(Error(`decrease interval per step ${decreaseIntervalMSPerStep} needs to be bigger than zero`));
+  }
+  let interval = startIntervalMS;
+  let totalWaitTime = 0;
+  let didDocument;
+  let count = 0;
+  function logCalback() {
+    logger.debug(`Get DID Document; count ${count}: wait time: ${totalWaitTime}, ${did}`);
+  }
+  __name(logCalback, "logCalback");
+  while (!didDocument && totalWaitTime <= maxWaitTime) {
+    ++count;
+    try {
+      logCalback();
+      didDocument = await ebsiGetDidDocument({
+        params: {
+          did
+        },
+        apiOpts: {
+          environment,
+          version
+        }
+      });
+      if (searchForObject && didDocument) {
+        const didDocAsStr = JSON.stringify(didDocument);
+        const search = JSON.stringify(searchForObject);
+        const found = didDocAsStr.includes(search.substring(1, search.length - 1));
+        if (!found) {
+          logger.debug(`We did not find VM relationship or key ${JSON.stringify(searchForObject)} in DID document ${did}`);
+          didDocument = void 0;
+        }
+      }
+    } catch (e) {
+    }
+    if (!didDocument) {
+      await wait(interval);
+      totalWaitTime += interval;
+      interval = Math.max(interval - decreaseIntervalMSPerStep, minIntervalMS);
+    }
+  }
+  logCalback();
+  return {
+    didDocument,
+    totalWaitTime,
+    count
+  };
+}, "ebsiWaitTillDocumentAnchored");
+
+// src/did/services/EbsiRPCService.ts
+var import_cross_fetch3 = __toESM(require("cross-fetch"), 1);
+
+// src/did/types.ts
+var EBSI_DID_SPEC_INFOS = {
+  V1: {
+    type: "LEGAL_ENTITY",
+    method: "did:ebsi:",
+    version: 1,
+    didLength: 16,
+    privateKeyLength: 32
+  },
+  KEY: {
+    type: "NATURAL_PERSON",
+    method: "did:key:"
+  }
+};
+var EbsiPublicKeyPurpose = /* @__PURE__ */ function(EbsiPublicKeyPurpose2) {
+  EbsiPublicKeyPurpose2["Authentication"] = "authentication";
+  EbsiPublicKeyPurpose2["AssertionMethod"] = "assertionMethod";
+  EbsiPublicKeyPurpose2["CapabilityInvocation"] = "capabilityInvocation";
+  return EbsiPublicKeyPurpose2;
+}({});
+var JSON_RPC_VERSION = "2.0";
+var BASE_CONTEXT_DOC = JSON.stringify({
+  "@context": [
+    "https://www.w3.org/ns/did/v1",
+    "https://w3id.org/security/suites/jws-2020/v1"
+  ]
+});
+var EbsiRpcMethod = /* @__PURE__ */ function(EbsiRpcMethod2) {
+  EbsiRpcMethod2["INSERT_DID_DOCUMENT"] = "insertDidDocument";
+  EbsiRpcMethod2["UPDATE_DID_DOCUMENT"] = "updateBaseDocument";
+  EbsiRpcMethod2["ADD_VERIFICATION_METHOD"] = "addVerificationMethod";
+  EbsiRpcMethod2["ADD_VERIFICATION_RELATIONSHIP"] = "addVerificationRelationship";
+  EbsiRpcMethod2["ADD_SERVICE"] = "addService";
+  EbsiRpcMethod2["SEND_SIGNED_TRANSACTION"] = "sendSignedTransaction";
+  return EbsiRpcMethod2;
+}({});
+
+// src/did/services/EbsiRPCService.ts
+var callRpcMethod = /* @__PURE__ */ __name(async (args) => {
+  return callRpcMethodImpl({
+    ...args,
+    retries: 10
+  });
+}, "callRpcMethod");
+var callRpcMethodImpl = /* @__PURE__ */ __name(async (args) => {
+  const { params, rpcId, accessToken, rpcMethod, apiOpts, doNotThrowErrors = false, retries } = args;
+  const options = buildFetchOptions({
+    accessToken,
+    params,
+    rpcId,
+    rpcMethod
+  });
+  logger.debug(`RPC call:\r
+ ${JSON.stringify(options, null, 2)}`);
+  const rpcResponse = await (await (0, import_cross_fetch3.default)(ebsiGetRegistryAPIUrls({
+    ...apiOpts
+  }).mutate, options)).json();
+  let result = rpcResponse.result;
+  logger.debug(`RPC RESPONSE:\r
+${JSON.stringify(result ?? rpcResponse.error)}`);
+  if (rpcResponse.error !== void 0 && !doNotThrowErrors) {
+    logger.error(`RPC ERROR RESPONSE:`, rpcResponse);
+    if (rpcResponse.error.message.includes(`replacement fee too low`)) {
+      args.rpcId = randomRpcId();
+      if (retries <= 0) {
+        throw Error(rpcResponse.error.message);
+      }
+      logger.warning(`Replacement fee too low error. Waiting 1 sec. Retries: ${retries}`);
+      await wait(1e3);
+      return callRpcMethodImpl({
+        ...args,
+        retries: retries - 1
+      });
+    }
+    throw Error(rpcResponse.error.message);
+  }
+  return rpcResponse;
+}, "callRpcMethodImpl");
+var buildFetchOptions = /* @__PURE__ */ __name((args) => {
+  const { params, rpcId, accessToken, rpcMethod } = args;
+  const fetchReq = {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${accessToken}`
+    },
+    body: JSON.stringify({
+      jsonrpc: JSON_RPC_VERSION,
+      method: rpcMethod,
+      params,
+      id: rpcId
+    })
+  };
+  logger.debug(fetchReq);
+  return fetchReq;
+}, "buildFetchOptions");
+
+// src/did/functions.ts
+function generateEbsiMethodSpecificId(specInfo) {
+  const spec = specInfo ?? EBSI_DID_SPEC_INFOS.V1;
+  const length = spec.didLength ?? 16;
+  const result = new Uint8Array(length + (spec.version ? 1 : 0));
+  if (spec.version) {
+    result.set([
+      spec.version
+    ]);
+  }
+  result.set((0, import_random.randomBytes)(length), spec.version ? 1 : 0);
+  return import_base58.base58btc.encode(result);
+}
+__name(generateEbsiMethodSpecificId, "generateEbsiMethodSpecificId");
+function generateOrUseProvidedEbsiPrivateKeyHex(specInfo, privateKeyBytes) {
+  const spec = specInfo ?? EBSI_DID_SPEC_INFOS.V1;
+  const length = spec.didLength ? 2 * spec.didLength : 32;
+  if (privateKeyBytes) {
+    if (privateKeyBytes.length !== length) {
+      throw Error(`Invalid private key length supplied (${privateKeyBytes.length}. Expected ${length} for ${spec.type}`);
+    }
+    return (0, import_to_string.toString)(privateKeyBytes, "base16");
+  }
+  return (0, import_to_string.toString)((0, import_random.randomBytes)(length), "base16");
+}
+__name(generateOrUseProvidedEbsiPrivateKeyHex, "generateOrUseProvidedEbsiPrivateKeyHex");
+var formatEbsiPublicKey = /* @__PURE__ */ __name((args) => {
+  const { key, type } = args;
+  switch (type) {
+    case "Secp256k1": {
+      const bytes = (0, import_ethers.getBytes)("0x" + key.publicKeyHex, "key");
+      return import_ethers.SigningKey.computePublicKey(bytes, false);
+    }
+    case "Secp256r1": {
+      const jwk = (0, import_ssi_sdk_ext4.toJwk)(key.publicKeyHex, type, {
+        use: import_ssi_sdk_ext4.JwkKeyUse.Signature,
+        key
+      });
+      const jwkString = JSON.stringify(jwk, null, 2);
+      return `0x${(0, import_to_string.toString)((0, import_from_string.fromString)(jwkString), "base16")}`;
+    }
+    default:
+      throw new Error(`Unsupported EBSI key type: ${type}`);
+  }
+}, "formatEbsiPublicKey");
+var ebsiGetIssuerMock = /* @__PURE__ */ __name((args) => {
+  const { environment = "conformance", version = "v3" } = args;
+  if (environment === "pilot") {
+    throw Error(`EBSI Pilot network does not have a issuer mock server`);
+  }
+  return `${getEbsiApiBaseUrl({
+    environment,
+    version,
+    system: environment
+  })}/issuer-mock`;
+}, "ebsiGetIssuerMock");
+var ebsiGetRegistryAPIUrls = /* @__PURE__ */ __name((args) => {
+  const { environment = "pilot", version = "v5" } = args;
+  const baseUrl = `${getEbsiApiBaseUrl({
+    environment,
+    version,
+    system: "did-registry"
+  })}`;
+  return {
+    mutate: `${baseUrl}/jsonrpc`,
+    query: `${baseUrl}/identifiers`
+  };
+}, "ebsiGetRegistryAPIUrls");
+var determineWellknownEndpoint = /* @__PURE__ */ __name(({ environment, version, type, system = environment, mock }) => {
+  const url = `${getEbsiApiBaseUrl({
+    environment,
+    version,
+    system
+  })}${mock ? `/${mock}` : ""}/.well-known/${type}`;
+  logger.debug(`wellknown url: ${url}`);
+  return url;
+}, "determineWellknownEndpoint");
+var ebsiSignAndSendTransaction = /* @__PURE__ */ __name(async (args, context) => {
+  const { rpcRequest, accessToken, kid, apiOpts, previousTxResponse } = args;
+  const unsignedTxResponse = await callRpcMethod(rpcRequest);
+  const nonce = "result" in unsignedTxResponse ? unsignedTxResponse.result.nonce : void 0;
+  if (previousTxResponse && "result" in unsignedTxResponse && "nonce" in previousTxResponse && "nonce" in unsignedTxResponse.result && typeof unsignedTxResponse.result === "object" && previousTxResponse.nonce === unsignedTxResponse.result.nonce) {
+    await wait(1e3);
+    return await ebsiSignAndSendTransaction({
+      ...args,
+      previousTxResponse
+    }, context);
+  }
+  if ("error" in unsignedTxResponse && !!unsignedTxResponse.error) {
+    logger.error(JSON.stringify(unsignedTxResponse));
+    throw new Error(unsignedTxResponse.error.message ?? "Unknown error occurred");
+  }
+  const unsignedTx = unsignedTxResponse.result;
+  const agentUnsignedTx = JSON.parse(JSON.stringify(unsignedTx));
+  if (unsignedTx && "chainId" in unsignedTx && typeof unsignedTx.chainId === "string" && unsignedTx.chainId.toLowerCase().startsWith("0x")) {
+    agentUnsignedTx.chainId = Number.parseInt(unsignedTx.chainId, 16);
+  }
+  const signedRawTx = await context.agent.keyManagerSignEthTX({
+    kid,
+    transaction: agentUnsignedTx
+  });
+  const sig = import_ethers.Transaction.from(signedRawTx).signature;
+  const { r, s, v } = sig;
+  const sTResponse = await callRpcMethod({
+    params: [
+      {
+        protocol: "eth",
+        unsignedTransaction: unsignedTx,
+        r,
+        s,
+        v: `0x${v.toString(16)}`,
+        signedRawTransaction: signedRawTx
+      }
+    ],
+    rpcMethod: EbsiRpcMethod.SEND_SIGNED_TRANSACTION,
+    rpcId: unsignedTxResponse.id,
+    apiOpts,
+    accessToken
+  });
+  if ("status" in sTResponse) {
+    throw new Error(JSON.stringify(sTResponse, null, 2));
+  }
+  return {
+    ...sTResponse,
+    nonce
+  };
+}, "ebsiSignAndSendTransaction");
+var ebsiGenerateOrUseKeyPair = /* @__PURE__ */ __name(async (args, context) => {
+  const { keyOpts, keyType, kms, controllerKey = false } = args;
+  let privateKeyHex = generateOrUseProvidedEbsiPrivateKeyHex(EBSI_DID_SPEC_INFOS.V1, keyOpts?.privateKeyHex ? (0, import_from_string.fromString)(keyOpts.privateKeyHex, "base16") : void 0);
+  if (privateKeyHex.startsWith("0x")) {
+    privateKeyHex = privateKeyHex.substring(2);
+  }
+  if (!privateKeyHex || privateKeyHex.length !== 64) {
+    throw new Error("Private key should be 32 bytes / 64 chars hex");
+  }
+  const importableKey = await toMinimalImportableKey({
+    key: {
+      ...keyOpts,
+      privateKeyHex
+    },
+    type: keyType,
+    kms
+  });
+  if (keyType === "Secp256k1") {
+    importableKey.meta = {
+      ...importableKey.meta,
+      ebsi: {
+        anchored: false,
+        controllerKey
+      }
+    };
+  }
+  return importableKey;
+}, "ebsiGenerateOrUseKeyPair");
+var toMinimalImportableKey = /* @__PURE__ */ __name(async (args) => {
+  const { key, kms } = args;
+  const minimalImportableKey = {
+    ...key
+  };
+  const type = args.key?.type ?? args.type;
+  minimalImportableKey.kms = kms;
+  minimalImportableKey.type = type;
+  if (!minimalImportableKey.privateKeyHex) {
+    throw Error(`Minimal importable key needs a private key`);
+  }
+  minimalImportableKey.meta = {
+    purposes: assertedPurposes({
+      key
+    }) ?? setDefaultPurposes({
+      key,
+      type
+    }),
+    jwkThumbprint: (0, import_ssi_sdk_ext4.calculateJwkThumbprintForKey)({
+      key: minimalImportableKey,
+      digestAlgorithm: "sha256"
+    })
+  };
+  return minimalImportableKey;
+}, "toMinimalImportableKey");
+var assertedPurposes = /* @__PURE__ */ __name((args) => {
+  const { key } = args;
+  if (key?.purposes && key.purposes.length > 0) {
+    switch (key.type) {
+      case "Secp256k1": {
+        if (key?.purposes && key.purposes.length > 0 && key.purposes?.includes(EbsiPublicKeyPurpose.CapabilityInvocation)) {
+          return key.purposes;
+        }
+        throw new Error(`Secp256k1/ES256K key requires ${EbsiPublicKeyPurpose.CapabilityInvocation} purpose`);
+      }
+      case "Secp256r1": {
+        if (key?.purposes && key.purposes.length > 0 && key.purposes.includes(EbsiPublicKeyPurpose.AssertionMethod) && key.purposes.includes(EbsiPublicKeyPurpose.Authentication)) {
+          return key.purposes;
+        }
+        throw new Error(`Secp256r1/ES256 key requires ${[
+          EbsiPublicKeyPurpose.AssertionMethod,
+          EbsiPublicKeyPurpose.Authentication
+        ].join(", ")} purposes`);
+      }
+      default:
+        throw new Error(`Unsupported key type: ${key.type}`);
+    }
+  }
+  return key?.purposes;
+}, "assertedPurposes");
+var setDefaultPurposes = /* @__PURE__ */ __name((args) => {
+  const { key, type } = args;
+  if (!key?.purposes || key.purposes.length === 0) {
+    switch (type) {
+      case "Secp256k1":
+        return [
+          EbsiPublicKeyPurpose.CapabilityInvocation
+        ];
+      case "Secp256r1":
+        return [
+          EbsiPublicKeyPurpose.AssertionMethod,
+          EbsiPublicKeyPurpose.Authentication
+        ];
+      default:
+        throw new Error(`Unsupported key type: ${key?.type}`);
+    }
+  }
+  return key.purposes;
+}, "setDefaultPurposes");
+var randomRpcId = /* @__PURE__ */ __name(() => {
+  return Math.floor(Math.random() * Number.MAX_SAFE_INTEGER);
+}, "randomRpcId");
+var ebsiCreateDidOnLedger = /* @__PURE__ */ __name(async (args, context) => {
+  const { accessTokenOpts, notBefore = Math.floor(Date.now() / 1e3 - 60), notAfter = Math.floor(Date.now() / 1e3 + 10 * 365 * 24 * 60 * 60), baseDocument, identifier } = args;
+  const { clientId, redirectUri, environment, credentialIssuer } = accessTokenOpts;
+  const controllerKey = (0, import_ssi_sdk_ext3.getControllerKey)({
+    identifier
+  });
+  const secp256r1 = (0, import_ssi_sdk_ext3.getKeys)({
+    identifier,
+    keyType: "Secp256r1"
+  })?.[0];
+  let { attestationToOnboard, attestationToOnboardCredentialRole } = accessTokenOpts;
+  if (!controllerKey || !secp256r1) {
+    return Promise.reject(`No secp256k1 controller key and/or secp2561r key found for identifier ${identifier}`);
+  }
+  const from = (0, import_ssi_sdk_ext3.getEthereumAddressFromKey)({
+    key: controllerKey
+  });
+  if (!from) {
+    return Promise.reject(Error(`EBSI 'from' address expected for key ${controllerKey.publicKeyHex}`));
+  }
+  const did = identifier.did;
+  const kid = controllerKey.kid;
+  const idOpts = {
+    identifier,
+    kid
+  };
+  let rpcId = args.rpcId ?? randomRpcId();
+  const apiOpts = {
+    environment,
+    version: "v5"
+  };
+  const jwksUri = args.accessTokenOpts.jwksUri ?? `${clientId}/.well-known/jwks/dids/${encodeURIComponent(identifier.did)}.json`;
+  if (!attestationToOnboard) {
+    console.log(`No attestation to onboard present. Will get one`);
+    const authReqResult = await context.agent.ebsiCreateAttestationAuthRequestURL({
+      credentialIssuer,
+      idOpts,
+      formats: [
+        "jwt_vc"
+      ],
+      clientId,
+      redirectUri,
+      credentialType: "VerifiableAuthorisationToOnboard",
+      requestObjectOpts: {
+        iss: clientId,
+        requestObjectMode: import_oid4vci_common3.CreateRequestObjectMode.REQUEST_OBJECT,
+        jwksUri
+      }
+    });
+    const attestationResult = await context.agent.ebsiGetAttestation({
+      clientId,
+      authReqResult,
+      opts: {
+        timeout: 12e4
+      }
+    });
+    attestationToOnboard = attestationResult.credentials[0].rawVerifiableCredential;
+    console.log(`Attestation to onboard received`, attestationToOnboard);
+  }
+  const insertDidAccessTokenResponse = await context.agent.ebsiAccessTokenGet({
+    credentialRole: attestationToOnboardCredentialRole,
+    attestationCredential: attestationToOnboard,
+    jwksUri,
+    scope: "didr_invite",
+    idOpts,
+    redirectUri,
+    credentialIssuer,
+    clientId,
+    environment,
+    skipDidResolution: true
+  });
+  const insertDidDocRequest = {
+    params: [
+      {
+        from,
+        did,
+        baseDocument: baseDocument ?? BASE_CONTEXT_DOC,
+        vMethodId: (0, import_ssi_sdk_ext4.calculateJwkThumbprint)({
+          jwk: (0, import_ssi_sdk_ext4.toJwk)(controllerKey.publicKeyHex, "Secp256k1")
+        }),
+        isSecp256k1: true,
+        publicKey: formatEbsiPublicKey({
+          key: controllerKey,
+          type: "Secp256k1"
+        }),
+        notBefore,
+        notAfter
+      }
+    ],
+    rpcMethod: EbsiRpcMethod.INSERT_DID_DOCUMENT,
+    rpcId,
+    apiOpts,
+    accessToken: insertDidAccessTokenResponse.accessTokenResponse.access_token
+  };
+  const insertDidDocResponse = await ebsiSignAndSendTransaction({
+    rpcRequest: insertDidDocRequest,
+    kid,
+    accessToken: insertDidAccessTokenResponse.accessTokenResponse.access_token,
+    apiOpts
+  }, context);
+  let anchorTime = await ebsiWaitTillDocumentAnchored({
+    did,
+    ...apiOpts,
+    maxWaitTime: 3e4,
+    startIntervalMS: 2e3,
+    minIntervalMS: 500,
+    decreaseIntervalMSPerStep: 750
+  });
+  if (!anchorTime.didDocument) {
+    throw Error(`did ${did} was not registered on EBSI network ${apiOpts.environment} in 45 seconds`);
+  }
+  logger.debug(`Anchoring did ${did} on network ${apiOpts.environment} took ${anchorTime.totalWaitTime / 1e3} seconds in ${anchorTime.count} tries`);
+  idOpts.kid = (0, import_ssi_sdk_ext4.calculateJwkThumbprintForKey)({
+    key: controllerKey
+  });
+  const addVMAccessTokenResponse = await context.agent.ebsiAccessTokenGet({
+    credentialRole: attestationToOnboardCredentialRole,
+    // attestationCredential: attestationToOnboard,
+    jwksUri,
+    scope: "didr_write",
+    idOpts,
+    redirectUri,
+    credentialIssuer: void 0,
+    clientId,
+    environment,
+    skipDidResolution: true
+  });
+  const vMethodId = (0, import_ssi_sdk_ext4.calculateJwkThumbprint)({
+    jwk: (0, import_ssi_sdk_ext4.toJwk)(secp256r1.publicKeyHex, "Secp256r1")
+  });
+  const publicKey = formatEbsiPublicKey({
+    key: secp256r1,
+    type: "Secp256r1"
+  });
+  const addVerificationMethodRequest = {
+    params: [
+      {
+        from,
+        did,
+        isSecp256k1: false,
+        vMethodId,
+        publicKey
+      }
+    ],
+    rpcMethod: EbsiRpcMethod.ADD_VERIFICATION_METHOD,
+    rpcId,
+    apiOpts,
+    accessToken: addVMAccessTokenResponse.accessTokenResponse.access_token
+  };
+  const addVerificationMethodResponse = await ebsiSignAndSendTransaction({
+    rpcRequest: addVerificationMethodRequest,
+    previousTxResponse: insertDidDocResponse,
+    kid,
+    accessToken: addVMAccessTokenResponse.accessTokenResponse.access_token,
+    apiOpts
+  }, context);
+  await wait(2e3);
+  const addAssertionMethodRelationshipRequest = {
+    params: [
+      {
+        from,
+        did,
+        vMethodId,
+        name: "assertionMethod",
+        notAfter,
+        notBefore
+      }
+    ],
+    rpcMethod: EbsiRpcMethod.ADD_VERIFICATION_RELATIONSHIP,
+    rpcId,
+    apiOpts,
+    accessToken: addVMAccessTokenResponse.accessTokenResponse.access_token
+  };
+  const addAssertionMethodRelationshipResponse = await ebsiSignAndSendTransaction({
+    rpcRequest: addAssertionMethodRelationshipRequest,
+    previousTxResponse: addVerificationMethodResponse,
+    kid,
+    accessToken: addVMAccessTokenResponse.accessTokenResponse.access_token,
+    apiOpts
+  }, context);
+  anchorTime = await ebsiWaitTillDocumentAnchored({
+    did,
+    ...apiOpts,
+    maxWaitTime: 2e4,
+    minIntervalMS: 500,
+    decreaseIntervalMSPerStep: 500,
+    searchForObject: {
+      assertionMethod: [
+        `${did}#${vMethodId}`
+      ]
+    }
+  });
+  if (!anchorTime.didDocument) {
+    throw Error(`did ${did} assertionMethod id ${vMethodId} was not registered on EBSI network ${apiOpts.environment} in 20 seconds`);
+  }
+  logger.debug(`Anchoring assertionMethod ${vMethodId} for DID ${did} on network ${apiOpts.environment} took ${anchorTime.totalWaitTime / 1e3} seconds in ${anchorTime.count} tries`);
+  const addAuthenticationRelationshipRequest = {
+    params: [
+      {
+        from,
+        did,
+        vMethodId,
+        name: "authentication",
+        notAfter,
+        notBefore
+      }
+    ],
+    rpcMethod: EbsiRpcMethod.ADD_VERIFICATION_RELATIONSHIP,
+    rpcId,
+    apiOpts,
+    accessToken: addVMAccessTokenResponse.accessTokenResponse.access_token
+  };
+  const addAuthenticationRelationshipResponse = await ebsiSignAndSendTransaction({
+    rpcRequest: addAuthenticationRelationshipRequest,
+    previousTxResponse: addAssertionMethodRelationshipResponse,
+    kid,
+    accessToken: addVMAccessTokenResponse.accessTokenResponse.access_token,
+    apiOpts
+  }, context);
+  return {
+    identifier,
+    insertDidDoc: insertDidDocResponse,
+    addVerificationMethod: addVerificationMethodResponse,
+    addAuthenticationRelationship: addAuthenticationRelationshipResponse,
+    addAssertionMethodRelationship: addAssertionMethodRelationshipResponse
+  };
+}, "ebsiCreateDidOnLedger");
+
+// src/agent/EbsiSupport.ts
+var import_uuid = require("uuid");
+var import_did_auth_siop_adapter = require("@sphereon/did-auth-siop-adapter");
+var import_ssi_sdk5 = require("@sphereon/ssi-sdk.core");
+var ebsiSupportMethods = [
+  "ebsiCreateDidOnLedger",
+  "ebsiWellknownMetadata",
+  "ebsiAuthorizationServerJwks",
+  "ebsiPresentationDefinitionGet",
+  "ebsiAccessTokenGet",
+  "ebsiCreateAttestationAuthRequestURL",
+  "ebsiGetAttestation"
+];
+var EbsiSupport = class {
+  static {
+    __name(this, "EbsiSupport");
+  }
+  schema = schema.IEbsiSupport;
+  methods = {
+    ebsiCreateDidOnLedger: this.ebsiCreateDidOnLedger.bind(this),
+    ebsiWellknownMetadata: this.ebsiWellknownMetadata.bind(this),
+    ebsiAuthorizationServerJwks: this.ebsiAuthorizationServerJwks.bind(this),
+    ebsiPresentationDefinitionGet: this.ebsiPresentationDefinitionGet.bind(this),
+    ebsiAccessTokenGet: this.ebsiAccessTokenGet.bind(this),
+    ebsiCreateAttestationAuthRequestURL: ebsiCreateAttestationAuthRequestURL.bind(this),
+    ebsiGetAttestation: ebsiGetAttestation.bind(this)
+  };
+  async ebsiCreateDidOnLedger(args, context) {
+    return await ebsiCreateDidOnLedger(args, context);
+  }
+  async ebsiWellknownMetadata(args) {
+    const url = determineWellknownEndpoint(args);
+    return await (await (0, import_cross_fetch4.default)(url, {
+      method: "GET",
+      headers: {
+        Accept: "application/json"
+      }
+    })).json();
+  }
+  async ebsiAuthorizationServerJwks(args) {
+    const discoveryMetadata = await this.ebsiWellknownMetadata({
+      ...args,
+      type: "openid-configuration"
+    });
+    return await (await (0, import_cross_fetch4.default)(`${discoveryMetadata.jwks_uri}`, {
+      method: "GET",
+      headers: {
+        Accept: "application/jwk-set+json"
+      }
+    })).json();
+  }
+  async ebsiPresentationDefinitionGet(args) {
+    const { scope, apiOpts, openIDMetadata } = args;
+    const discoveryMetadata = openIDMetadata ?? await this.ebsiWellknownMetadata({
+      ...apiOpts,
+      type: "openid-configuration",
+      system: apiOpts?.mock ? "authorisation" : apiOpts?.system,
+      version: apiOpts?.version ?? "v4"
+    });
+    return await (await (0, import_cross_fetch4.default)(`${discoveryMetadata.presentation_definition_endpoint}?scope=openid%20${scope}`, {
+      method: "GET",
+      headers: {
+        Accept: "application/json"
+      }
+    })).json();
+  }
+  async ebsiAccessTokenGet(args, context) {
+    const { scope, idOpts, jwksUri, clientId, allVerifiableCredentials, redirectUri, environment, skipDidResolution = false } = args;
+    const identifier = await context.agent.identifierManagedGetByDid(idOpts);
+    console.log(`Getting access token for ${identifier.did}, scope ${scope} and clientId=${clientId}, skipDidResolution=${skipDidResolution}...`);
+    const openIDMetadata = await this.ebsiWellknownMetadata({
+      environment,
+      version: "v4",
+      mock: void 0,
+      system: "authorisation",
+      type: "openid-configuration"
+    });
+    const definitionResponse = await this.ebsiPresentationDefinitionGet({
+      ...args,
+      openIDMetadata,
+      apiOpts: {
+        environment,
+        version: "v4",
+        type: "openid-configuration"
+      }
+    });
+    const hasInputDescriptors = definitionResponse.input_descriptors.length > 0;
+    console.log(`PD response`, definitionResponse);
+    if (!hasInputDescriptors) {
+      console.warn(`No INPUT descriptor returned for scope ${scope}`);
+    }
+    let attestationCredential = args.attestationCredential;
+    if (hasInputDescriptors && !attestationCredential) {
+      if (allVerifiableCredentials && allVerifiableCredentials.length > 0) {
+        const pexResult2 = await context.agent.pexDefinitionFilterCredentials({
+          presentationDefinition: definitionResponse,
+          credentialFilterOpts: {
+            credentialRole: args.credentialRole,
+            verifiableCredentials: allVerifiableCredentials
+          }
+        });
+        if (pexResult2.filteredCredentials.length > 0) {
+          const filtered = pexResult2.filteredCredentials.map((cred) => import_ssi_types.CredentialMapper.toUniformCredential(cred, {
+            hasher: import_ssi_sdk5.defaultHasher
+          })).filter((cred) => {
+            if (!cred.expirationDate) {
+              return cred;
+            } else if (new Date(cred.expirationDate).getDate() >= Date.now()) {
+              return cred;
+            }
+            return void 0;
+          }).filter((cred) => !!cred);
+          if (filtered.length > 0) {
+            attestationCredential = filtered[0];
+          }
+        }
+      }
+      if (!attestationCredential) {
+        console.log(`No attestation credential present. Will get one from within access token method!`);
+        const credentialIssuer = args.credentialIssuer ?? ebsiGetIssuerMock({
+          environment
+        });
+        const authReqResult = await context.agent.ebsiCreateAttestationAuthRequestURL({
+          credentialIssuer,
+          idOpts,
+          formats: [
+            "jwt_vc"
+          ],
+          clientId,
+          redirectUri,
+          requestObjectOpts: {
+            iss: clientId,
+            requestObjectMode: import_oid4vci_common4.CreateRequestObjectMode.REQUEST_OBJECT,
+            jwksUri
+          },
+          credentialType: "VerifiableAuthorisationToOnboard"
+        });
+        const attestationResult = await context.agent.ebsiGetAttestation({
+          authReqResult,
+          clientId,
+          opts: {
+            timeout: 3e4
+          }
+        });
+        attestationCredential = attestationResult.credentials[0].rawVerifiableCredential;
+      }
+    }
+    const definition = {
+      definition: definitionResponse,
+      location: import_did_auth_siop2.PresentationDefinitionLocation.TOPLEVEL_PRESENTATION_DEF,
+      version: import_did_auth_siop2.SupportedVersion.SIOPv2_D11
+    };
+    const pexResult = hasInputDescriptors ? await context.agent.pexDefinitionFilterCredentials({
+      presentationDefinition: definitionResponse,
+      credentialFilterOpts: {
+        credentialRole: args.credentialRole,
+        verifiableCredentials: [
+          attestationCredential
+        ]
+      }
+    }) : {
+      // LOL, let's see whether we can trick PEX to create a VP without VCs
+      filteredCredentials: [],
+      id: definitionResponse.id,
+      selectResults: {
+        verifiableCredential: [],
+        areRequiredCredentialsPresent: "info"
+      }
+    };
+    const opSession = await context.agent.siopRegisterOPSession({
+      requestJwtOrUri: "",
+      op: {
+        checkLinkedDomains: import_did_auth_siop_adapter.CheckLinkedDomain.NEVER
+      },
+      providedPresentationDefinitions: [
+        definition
+      ]
+    });
+    const oid4vp = await opSession.getOID4VP({
+      allIdentifiers: [
+        identifier.did
+      ]
+    });
+    const vp = await oid4vp.createVerifiablePresentation(args.credentialRole, {
+      definition,
+      credentials: pexResult.filteredCredentials
+    }, {
+      proofOpts: {
+        domain: openIDMetadata.issuer,
+        nonce: (0, import_uuid.v4)(),
+        created: new Date(Date.now() - 12e4).toString()
+      },
+      holder: identifier.did,
+      idOpts,
+      skipDidResolution,
+      forceNoCredentialsInVP: !hasInputDescriptors
+    });
+    const presentationSubmission = hasInputDescriptors ? vp.presentationSubmission : {
+      id: (0, import_uuid.v4)(),
+      definition_id: definitionResponse.id,
+      descriptor_map: []
+    };
+    console.log(`Presentation submission`, presentationSubmission);
+    const tokenRequestArgs = {
+      grant_type: "vp_token",
+      vp_token: import_ssi_types.CredentialMapper.toCompactJWT(vp.verifiablePresentations[0]),
+      scope,
+      presentation_submission: presentationSubmission,
+      apiOpts: {
+        environment,
+        version: "v4"
+      },
+      openIDMetadata
+    };
+    console.log(`Access token request:\r
+${JSON.stringify(tokenRequestArgs)}`);
+    const accessTokenResponse = await this.getAccessToken(tokenRequestArgs);
+    console.log(`Access token response:\r
+${JSON.stringify(accessTokenResponse)}`);
+    if (!("access_token" in accessTokenResponse)) {
+      throw Error(`Error response: ${JSON.stringify(accessTokenResponse)}`);
+    }
+    return {
+      accessTokenResponse,
+      // vp,
+      scope,
+      // definition,
+      identifier
+    };
+  }
+  async getAccessToken(args) {
+    const { grant_type = "vp_token", scope, vp_token, presentation_submission, apiOpts, openIDMetadata } = args;
+    const discoveryMetadata = openIDMetadata ?? await this.ebsiWellknownMetadata({
+      ...apiOpts,
+      type: "openid-configuration"
+    });
+    const request = {
+      grant_type,
+      scope: `openid ${scope}`,
+      vp_token,
+      presentation_submission: JSON.stringify(presentation_submission)
+    };
+    return await (await (0, import_cross_fetch4.default)(`${discoveryMetadata.token_endpoint}`, {
+      method: "POST",
+      headers: {
+        ContentType: "application/x-www-form-urlencoded",
+        Accept: "application/json"
+      },
+      body: new URLSearchParams(request)
+    })).json();
+  }
+};
+
+// src/types/IEbsiSupport.ts
+var TokenType = /* @__PURE__ */ function(TokenType2) {
+  TokenType2["BEARER"] = "Bearer";
+  return TokenType2;
+}({});
+
+// src/did/EbsiDidProvider.ts
+var import_ssi_sdk_ext5 = require("@sphereon/ssi-sdk-ext.did-utils");
+var import_ssi_sdk_ext6 = require("@sphereon/ssi-sdk-ext.key-utils");
+var import_did_manager = require("@veramo/did-manager");
+var import_debug = __toESM(require("debug"), 1);
+var debug = (0, import_debug.default)("sphereon:did-provider-ebsi");
+var EbsiDidProvider = class _EbsiDidProvider extends import_did_manager.AbstractIdentifierProvider {
+  static {
+    __name(this, "EbsiDidProvider");
+  }
+  static PROVIDER = "did:ebsi";
+  defaultKms;
+  apiOpts;
+  constructor(options) {
+    super();
+    this.defaultKms = options.defaultKms;
+    this.apiOpts = options.apiOpts;
+  }
+  async createIdentifier(args, context) {
+    const { type, options, kms = this.defaultKms, alias } = args;
+    const { notBefore, notAfter, secp256k1Key, secp256r1Key, keys, accessTokenOpts, executeLedgerOperation = !!args.options?.accessTokenOpts, methodSpecificId = generateEbsiMethodSpecificId(EBSI_DID_SPEC_INFOS.V1), baseDocument, services } = {
+      ...options
+    };
+    if (executeLedgerOperation && !accessTokenOpts) {
+      throw new Error("Access token options must be provided to execute ledger operation");
+    }
+    const rpcId = options?.rpcId ?? randomRpcId();
+    if (type === EBSI_DID_SPEC_INFOS.KEY) {
+      return Promise.reject(Error(`Type ${type} not supported. Please use @sphereon/ssi-sdk-ext.did-provider-key for Natural Person EBSI DIDs`));
+    } else if (!kms) {
+      return Promise.reject(Error(`No KMS value provided`));
+    } else if (keys && keys.length > 0 && !executeLedgerOperation) {
+      return Promise.reject(Error(`Cannot add additional keys if ledger operation is not enabled at creation. Please add the keys later yourself`));
+    }
+    const secp256k1ImportKey = await ebsiGenerateOrUseKeyPair({
+      keyOpts: secp256k1Key,
+      keyType: "Secp256k1",
+      kms,
+      controllerKey: true
+    }, context);
+    const secp256k1ManagedKeyInfo = await context.agent.keyManagerImport(secp256k1ImportKey);
+    const secp256r1ImportKey = await ebsiGenerateOrUseKeyPair({
+      keyOpts: secp256r1Key,
+      keyType: "Secp256r1",
+      kms
+    }, context);
+    const secp256r1ManagedKeyInfo = await context.agent.keyManagerImport(secp256r1ImportKey);
+    const identifier = {
+      did: options.did && options.did.startsWith("did:ebsi:") ? options.did : `${EBSI_DID_SPEC_INFOS.V1.method}${methodSpecificId}`,
+      controllerKeyId: secp256k1ManagedKeyInfo.kid,
+      keys: [
+        secp256k1ManagedKeyInfo,
+        secp256r1ManagedKeyInfo
+      ],
+      alias,
+      services: services ?? [],
+      provider: _EbsiDidProvider.PROVIDER
+    };
+    const apiOpts = {
+      ...this.apiOpts
+    };
+    if (!apiOpts.environment) {
+      apiOpts.environment = accessTokenOpts?.environment ?? "pilot";
+    }
+    if (!apiOpts.version) {
+      apiOpts.version = "v5";
+    }
+    if (executeLedgerOperation) {
+      await ebsiCreateDidOnLedger({
+        identifier,
+        baseDocument,
+        accessTokenOpts,
+        rpcId,
+        notBefore,
+        notAfter
+      }, context);
+      if (keys && keys.length > 0) {
+        for (const keyOpts of keys) {
+          const key = await ebsiGenerateOrUseKeyPair({
+            keyOpts,
+            keyType: keyOpts.type ?? "Secp256r1",
+            kms
+          }, context);
+          const managedKeyInfo = await context.agent.keyManagerImport(key);
+          console.warn(`FIXME: Anchor additional key on EBSI`, managedKeyInfo);
+        }
+      }
+    }
+    debug("Created", identifier.did);
+    return identifier;
+  }
+  async addKey(args, context) {
+    const { identifier, key, options } = args;
+    const { accessToken, vmRelationships, apiOpts, rpcId = randomRpcId() } = options;
+    if (vmRelationships.length === 0) {
+      return Promise.reject(Error(`No verification method relationship provided`));
+    }
+    const controllerKey = (0, import_ssi_sdk_ext5.getControllerKey)({
+      identifier
+    });
+    const from = (0, import_ssi_sdk_ext5.getEthereumAddressFromKey)({
+      key: controllerKey
+    });
+    const kid = controllerKey.kid;
+    const did = identifier.did;
+    const addVerificationMethodRequest = {
+      params: [
+        {
+          from,
+          did,
+          isSecp256k1: true,
+          vMethodId: (0, import_ssi_sdk_ext6.calculateJwkThumbprint)({
+            jwk: (0, import_ssi_sdk_ext6.toJwk)(key.publicKeyHex, key.type)
+          }),
+          publicKey: formatEbsiPublicKey({
+            key,
+            type: key.type
+          })
+        }
+      ],
+      rpcMethod: EbsiRpcMethod.ADD_VERIFICATION_METHOD,
+      rpcId,
+      apiOpts,
+      accessToken
+    };
+    let rpcResponse = await ebsiSignAndSendTransaction({
+      rpcRequest: addVerificationMethodRequest,
+      kid,
+      accessToken,
+      apiOpts
+    }, context);
+    const vMethodId = (0, import_ssi_sdk_ext6.calculateJwkThumbprintForKey)({
+      key
+    });
+    for (const vmRelationshipsKey in vmRelationships) {
+      const addVerificationMethodRelationshipRequest = {
+        params: [
+          {
+            from,
+            did,
+            vMethodId,
+            name: vmRelationshipsKey,
+            notAfter: Date.now() / 1e3 - 6e4,
+            notBefore: Date.now() / 1e3 + 5 * 365 * 24 * 60 * 60
+          }
+        ],
+        rpcMethod: EbsiRpcMethod.ADD_VERIFICATION_RELATIONSHIP,
+        rpcId,
+        apiOpts,
+        accessToken
+      };
+      rpcResponse = await ebsiSignAndSendTransaction({
+        rpcRequest: addVerificationMethodRelationshipRequest,
+        previousTxResponse: rpcResponse,
+        kid,
+        accessToken,
+        apiOpts
+      }, context);
+    }
+  }
+  async addService(args, context) {
+    const { identifier, service, options } = args;
+    const { accessToken, apiOpts, rpcId = randomRpcId() } = options;
+    const controllerKey = (0, import_ssi_sdk_ext5.getControllerKey)({
+      identifier
+    });
+    const from = (0, import_ssi_sdk_ext5.getEthereumAddressFromKey)({
+      key: controllerKey
+    });
+    const did = identifier.did;
+    const kid = controllerKey.kid;
+    const addServiceRequest = {
+      params: [
+        {
+          from,
+          did,
+          service
+        }
+      ],
+      rpcMethod: EbsiRpcMethod.ADD_SERVICE,
+      rpcId,
+      apiOpts,
+      accessToken
+    };
+    return await ebsiSignAndSendTransaction({
+      rpcRequest: addServiceRequest,
+      kid,
+      accessToken,
+      apiOpts
+    }, context);
+  }
+  deleteIdentifier(args, context) {
+    return Promise.resolve(true);
+  }
+  removeKey(args, context) {
+    throw new Error(`Not (yet) implemented for the EBSI did provider`);
+  }
+  removeService(args, context) {
+    throw new Error(`Not (yet) implemented for the EBSI did provider`);
+  }
+  // TODO How does it work? Not inferable from the api: https://hub.ebsi.eu/apis/pilot/did-registry/v5/post-jsonrpc#updatebasedocument
+  async updateIdentifier(args, context) {
+    throw new Error(`Not (yet) implemented for the EBSI did provider`);
+  }
+};
+
+// src/did/EbsiDidResolver.ts
+var import_did_resolver = require("did-resolver");
+var import_ssi_sdk_ext7 = require("@sphereon/ssi-sdk-ext.did-resolver-ebsi");
+
+// src/index.ts
+var logger = import_ssi_types2.Loggers.DEFAULT.options("sphereon:ebsi-support", {
+  defaultLogLevel: import_ssi_types2.LogLevel.DEBUG,
+  methods: [
+    import_ssi_types2.LogMethod.CONSOLE,
+    import_ssi_types2.LogMethod.DEBUG_PKG
+  ]
+}).get("sphereon:ebsi-support");
+var schema = require_plugin_schema();
+//# sourceMappingURL=index.cjs.map