@sphereon/ssi-sdk.oid4vci-holder 0.32.1-next.54 → 0.33.1-feature.vcdm2.4

package/dist/agent/OID4VCIHolder.js

@@ -1,36 +1,23 @@
-"use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.OID4VCIHolder = exports.oid4vciHolderContextMethods = void 0;
-exports.signCallback = signCallback;
-exports.verifyEBSICredentialIssuer = verifyEBSICredentialIssuer;
-const oid4vci_client_1 = require("@sphereon/oid4vci-client");
-const oid4vci_common_1 = require("@sphereon/oid4vci-common");
-const ssi_sdk_ext_did_utils_1 = require("@sphereon/ssi-sdk-ext.did-utils");
-const ssi_sdk_ext_identifier_resolution_1 = require("@sphereon/ssi-sdk-ext.identifier-resolution");
-const ssi_sdk_ext_key_utils_1 = require("@sphereon/ssi-sdk-ext.key-utils");
-const ssi_sdk_data_store_1 = require("@sphereon/ssi-sdk.data-store");
-const ssi_types_1 = require("@sphereon/ssi-types");
-const utils_1 = require("@veramo/utils");
-const did_jwt_1 = require("did-jwt");
-const uuid_1 = require("uuid");
-const oid4vciMachine_1 = require("../machines/oid4vciMachine");
-const IOID4VCIHolder_1 = require("../types/IOID4VCIHolder");
-const OID4VCIHolderService_1 = require("../services/OID4VCIHolderService");
-require("cross-fetch/polyfill");
+import { CredentialOfferClient, MetadataClient, OpenID4VCIClient } from '@sphereon/oid4vci-client';
+import { DefaultURISchemes, getTypesFromAuthorizationDetails, getTypesFromCredentialOffer, getTypesFromObject, } from '@sphereon/oid4vci-common';
+import { SupportedDidMethodEnum } from '@sphereon/ssi-sdk-ext.did-utils';
+import { isManagedIdentifierDidOpts, isManagedIdentifierDidResult, isManagedIdentifierJwkResult, isManagedIdentifierKidResult, isManagedIdentifierResult, isManagedIdentifierX5cOpts, isManagedIdentifierX5cResult, } from '@sphereon/ssi-sdk-ext.identifier-resolution';
+import { signatureAlgorithmFromKey } from '@sphereon/ssi-sdk-ext.key-utils';
+import { ConnectionType, CorrelationIdentifierType, CredentialCorrelationType, CredentialRole, ensureRawDocument, IdentityOrigin, } from '@sphereon/ssi-sdk.data-store';
+import { CredentialMapper, JoseSignatureAlgorithm, Loggers, parseDid, } from '@sphereon/ssi-types';
+import { asArray, computeEntryHash } from '@veramo/utils';
+import { decodeJWT } from 'did-jwt';
+import { v4 as uuidv4 } from 'uuid';
+import { OID4VCIMachine } from '../machines/oid4vciMachine';
+import { OID4VCIHolderEvent, OID4VCIMachineServices, RequestType, } from '../types/IOID4VCIHolder';
+import { getBasicIssuerLocaleBranding, getCredentialBranding, getCredentialConfigsSupportedMerged, getIdentifierOpts, getIssuanceOpts, mapCredentialToAccept, selectCredentialLocaleBranding, startFirstPartApplicationMachine, verifyCredentialToAccept, } from '../services/OID4VCIHolderService';
+import 'cross-fetch/polyfill';
+import { defaultHasher } from '@sphereon/ssi-sdk.core';
 /**
  * {@inheritDoc IOID4VCIHolder}
  */
 // Exposing the methods here for any REST implementation
-exports.oid4vciHolderContextMethods = [
+export const oid4vciHolderContextMethods = [
     'cmGetContacts',
     'cmGetContact',
     'cmAddContact',
@@ -43,12 +30,11 @@ exports.oid4vciHolderContextMethods = [
     'keyManagerSign',
     'verifyCredential',
 ];
-const logger = ssi_types_1.Loggers.DEFAULT.get('sphereon:oid4vci:holder');
-function signCallback(identifier, context, nonce) {
-    return (jwt, kid) => __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        let resolution = yield context.agent.identifierManagedGet(identifier);
-        const jwk = (_a = jwt.header.jwk) !== null && _a !== void 0 ? _a : (resolution.method === 'jwk' ? resolution.jwk : undefined);
+const logger = Loggers.DEFAULT.get('sphereon:oid4vci:holder');
+export function signCallback(identifier, context, nonce) {
+    return async (jwt, kid) => {
+        let resolution = await context.agent.identifierManagedGet(identifier);
+        const jwk = jwt.header.jwk ?? (resolution.method === 'jwk' ? resolution.jwk : undefined);
         if (!resolution.issuer && !jwt.payload.iss) {
             return Promise.reject(Error(`No issuer could be determined from the JWT ${JSON.stringify(jwt)} or identifier resolution`));
         }
@@ -61,78 +47,82 @@ function signCallback(identifier, context, nonce) {
             console.log(`Deleting kid, as we are using a jwk and the oid4vci spec does not allow both to be present (which is not the case in the JOSE spec)`);
             delete header.kid; // The OID4VCI spec does not allow a JWK with kid present although the JWS spec does
         }
-        return (yield context.agent.jwtCreateJwsCompactSignature({
-            issuer: Object.assign(Object.assign({}, resolution), { noIssPayloadUpdate: false }),
+        return (await context.agent.jwtCreateJwsCompactSignature({
+            issuer: { ...resolution, noIssPayloadUpdate: false },
             protectedHeader: header,
             payload,
         })).jwt;
-    });
+    };
 }
-function verifyEBSICredentialIssuer(args) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j;
-        const { wrappedVc, issuerType = ['TI'] } = args;
-        const issuer = (_b = (_a = wrappedVc.decoded) === null || _a === void 0 ? void 0 : _a.iss) !== null && _b !== void 0 ? _b : (typeof ((_d = (_c = wrappedVc.decoded) === null || _c === void 0 ? void 0 : _c.vc) === null || _d === void 0 ? void 0 : _d.issuer) === 'string' ? (_f = (_e = wrappedVc.decoded) === null || _e === void 0 ? void 0 : _e.vc) === null || _f === void 0 ? void 0 : _f.issuer : (_j = (_h = (_g = wrappedVc.decoded) === null || _g === void 0 ? void 0 : _g.vc) === null || _h === void 0 ? void 0 : _h.issuer) === null || _j === void 0 ? void 0 : _j.existingInstanceId);
-        if (!issuer) {
-            throw Error('The issuer of the VC is required to be present');
-        }
-        const url = `https://api-conformance.ebsi.eu/trusted-issuers-registry/v4/issuers/${issuer}`;
-        const response = yield fetch(url);
-        if (response.status !== 200) {
-            throw Error('The issuer of the VC cannot be trusted');
-        }
-        const payload = yield response.json();
-        if (!payload.attributes.some((a) => issuerType.includes(a.issuerType))) {
-            throw Error(`The issuer type is required to be one of: ${issuerType.join(', ')}`);
-        }
-        return payload;
-    });
+export async function verifyEBSICredentialIssuer(args) {
+    const { wrappedVc, issuerType = ['TI'] } = args;
+    const issuer = wrappedVc.decoded?.iss ??
+        (typeof wrappedVc.decoded?.vc?.issuer === 'string' ? wrappedVc.decoded?.vc?.issuer : wrappedVc.decoded?.vc?.issuer?.existingInstanceId);
+    if (!issuer) {
+        throw Error('The issuer of the VC is required to be present');
+    }
+    const url = `https://api-conformance.ebsi.eu/trusted-issuers-registry/v4/issuers/${issuer}`;
+    const response = await fetch(url);
+    if (response.status !== 200) {
+        throw Error('The issuer of the VC cannot be trusted');
+    }
+    const payload = await response.json();
+    if (!payload.attributes.some((a) => issuerType.includes(a.issuerType))) {
+        throw Error(`The issuer type is required to be one of: ${issuerType.join(', ')}`);
+    }
+    return payload;
 }
-class OID4VCIHolder {
+export class OID4VCIHolder {
+    hasher;
+    eventTypes = [
+        OID4VCIHolderEvent.CONTACT_IDENTITY_CREATED,
+        OID4VCIHolderEvent.CREDENTIAL_STORED,
+        OID4VCIHolderEvent.IDENTIFIER_CREATED,
+    ];
+    methods = {
+        oid4vciHolderStart: this.oid4vciHolderStart.bind(this),
+        oid4vciHolderGetIssuerMetadata: this.oid4vciHolderGetIssuerMetadata.bind(this),
+        oid4vciHolderGetMachineInterpreter: this.oid4vciHolderGetMachineInterpreter.bind(this),
+        oid4vciHolderCreateCredentialsToSelectFrom: this.oid4vciHolderCreateCredentialsToSelectFrom.bind(this),
+        oid4vciHolderGetContact: this.oid4vciHolderGetContact.bind(this),
+        oid4vciHolderGetCredentials: this.oid4vciHolderGetCredentials.bind(this),
+        oid4vciHolderGetCredential: this.oid4vciHolderGetCredential.bind(this),
+        oid4vciHolderAddContactIdentity: this.oid4vciHolderAddContactIdentity.bind(this),
+        oid4vciHolderAssertValidCredentials: this.oid4vciHolderAssertValidCredentials.bind(this),
+        oid4vciHolderStoreCredentialBranding: this.oid4vciHolderStoreCredentialBranding.bind(this),
+        oid4vciHolderStoreCredentials: this.oid4vciHolderStoreCredentials.bind(this),
+        oid4vciHolderSendNotification: this.oid4vciHolderSendNotification.bind(this),
+        oid4vciHolderGetIssuerBranding: this.oid4vciHolderGetIssuerBranding.bind(this),
+        oid4vciHolderStoreIssuerBranding: this.oid4vciHolderStoreIssuerBranding.bind(this),
+    };
+    vcFormatPreferences = ['vc+sd-jwt', 'mso_mdoc', 'jwt_vc_json', 'jwt_vc', 'ldp_vc'];
+    jsonldCryptographicSuitePreferences = [
+        'Ed25519Signature2018',
+        'EcdsaSecp256k1Signature2019',
+        'Ed25519Signature2020',
+        'JsonWebSignature2020',
+        // "JcsEd25519Signature2020"
+    ];
+    didMethodPreferences = [
+        SupportedDidMethodEnum.DID_JWK, // FIXME prefer JWK until we devise a method to detect when to use EBSI/jcs for did:key and when not
+        SupportedDidMethodEnum.DID_KEY,
+        SupportedDidMethodEnum.DID_OYD,
+        SupportedDidMethodEnum.DID_EBSI,
+        SupportedDidMethodEnum.DID_ION,
+    ];
+    jwtCryptographicSuitePreferences = [
+        JoseSignatureAlgorithm.ES256,
+        JoseSignatureAlgorithm.ES256K,
+        JoseSignatureAlgorithm.EdDSA,
+    ];
+    static DEFAULT_MOBILE_REDIRECT_URI = `${DefaultURISchemes.CREDENTIAL_OFFER}://`;
+    defaultAuthorizationRequestOpts = { redirectUri: OID4VCIHolder.DEFAULT_MOBILE_REDIRECT_URI };
+    onContactIdentityCreated;
+    onCredentialStored;
+    onIdentifierCreated;
+    onVerifyEBSICredentialIssuer;
     constructor(options) {
-        this.eventTypes = [
-            IOID4VCIHolder_1.OID4VCIHolderEvent.CONTACT_IDENTITY_CREATED,
-            IOID4VCIHolder_1.OID4VCIHolderEvent.CREDENTIAL_STORED,
-            IOID4VCIHolder_1.OID4VCIHolderEvent.IDENTIFIER_CREATED,
-        ];
-        this.methods = {
-            oid4vciHolderStart: this.oid4vciHolderStart.bind(this),
-            oid4vciHolderGetIssuerMetadata: this.oid4vciHolderGetIssuerMetadata.bind(this),
-            oid4vciHolderGetMachineInterpreter: this.oid4vciHolderGetMachineInterpreter.bind(this),
-            oid4vciHolderCreateCredentialsToSelectFrom: this.oid4vciHolderCreateCredentialsToSelectFrom.bind(this),
-            oid4vciHolderGetContact: this.oid4vciHolderGetContact.bind(this),
-            oid4vciHolderGetCredentials: this.oid4vciHolderGetCredentials.bind(this),
-            oid4vciHolderGetCredential: this.oid4vciHolderGetCredential.bind(this),
-            oid4vciHolderAddContactIdentity: this.oid4vciHolderAddContactIdentity.bind(this),
-            oid4vciHolderAssertValidCredentials: this.oid4vciHolderAssertValidCredentials.bind(this),
-            oid4vciHolderStoreCredentialBranding: this.oid4vciHolderStoreCredentialBranding.bind(this),
-            oid4vciHolderStoreCredentials: this.oid4vciHolderStoreCredentials.bind(this),
-            oid4vciHolderSendNotification: this.oid4vciHolderSendNotification.bind(this),
-            oid4vciHolderGetIssuerBranding: this.oid4vciHolderGetIssuerBranding.bind(this),
-            oid4vciHolderStoreIssuerBranding: this.oid4vciHolderStoreIssuerBranding.bind(this),
-        };
-        this.vcFormatPreferences = ['vc+sd-jwt', 'mso_mdoc', 'jwt_vc_json', 'jwt_vc', 'ldp_vc'];
-        this.jsonldCryptographicSuitePreferences = [
-            'Ed25519Signature2018',
-            'EcdsaSecp256k1Signature2019',
-            'Ed25519Signature2020',
-            'JsonWebSignature2020',
-            // "JcsEd25519Signature2020"
-        ];
-        this.didMethodPreferences = [
-            ssi_sdk_ext_did_utils_1.SupportedDidMethodEnum.DID_JWK, // FIXME prefer JWK until we devise a method to detect when to use EBSI/jcs for did:key and when not
-            ssi_sdk_ext_did_utils_1.SupportedDidMethodEnum.DID_KEY,
-            ssi_sdk_ext_did_utils_1.SupportedDidMethodEnum.DID_OYD,
-            ssi_sdk_ext_did_utils_1.SupportedDidMethodEnum.DID_EBSI,
-            ssi_sdk_ext_did_utils_1.SupportedDidMethodEnum.DID_ION,
-        ];
-        this.jwtCryptographicSuitePreferences = [
-            ssi_types_1.JoseSignatureAlgorithm.ES256,
-            ssi_types_1.JoseSignatureAlgorithm.ES256K,
-            ssi_types_1.JoseSignatureAlgorithm.EdDSA,
-        ];
-        this.defaultAuthorizationRequestOpts = { redirectUri: OID4VCIHolder.DEFAULT_MOBILE_REDIRECT_URI };
-        const { onContactIdentityCreated, onCredentialStored, onIdentifierCreated, onVerifyEBSICredentialIssuer, vcFormatPreferences, jsonldCryptographicSuitePreferences, didMethodPreferences, jwtCryptographicSuitePreferences, defaultAuthorizationRequestOptions, hasher, } = Object.assign({}, options);
+        const { onContactIdentityCreated, onCredentialStored, onIdentifierCreated, onVerifyEBSICredentialIssuer, vcFormatPreferences, jsonldCryptographicSuitePreferences, didMethodPreferences, jwtCryptographicSuitePreferences, defaultAuthorizationRequestOptions, hasher = defaultHasher, } = { ...options };
         this.hasher = hasher;
         if (vcFormatPreferences !== undefined && vcFormatPreferences.length > 0) {
             this.vcFormatPreferences = vcFormatPreferences;
@@ -154,51 +144,56 @@ class OID4VCIHolder {
         this.onIdentifierCreated = onIdentifierCreated;
         this.onVerifyEBSICredentialIssuer = onVerifyEBSICredentialIssuer;
     }
-    onEvent(event, context) {
-        return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c;
-            switch (event.type) {
-                case IOID4VCIHolder_1.OID4VCIHolderEvent.CONTACT_IDENTITY_CREATED:
-                    (_a = this.onContactIdentityCreated) === null || _a === void 0 ? void 0 : _a.call(this, event.data);
-                    break;
-                case IOID4VCIHolder_1.OID4VCIHolderEvent.CREDENTIAL_STORED:
-                    (_b = this.onCredentialStored) === null || _b === void 0 ? void 0 : _b.call(this, event.data);
-                    break;
-                case IOID4VCIHolder_1.OID4VCIHolderEvent.IDENTIFIER_CREATED:
-                    (_c = this.onIdentifierCreated) === null || _c === void 0 ? void 0 : _c.call(this, event.data);
-                    break;
-                default:
-                    return Promise.reject(Error(`Event type ${event.type} not supported`));
-            }
-        });
+    async onEvent(event, context) {
+        switch (event.type) {
+            case OID4VCIHolderEvent.CONTACT_IDENTITY_CREATED:
+                this.onContactIdentityCreated?.(event.data);
+                break;
+            case OID4VCIHolderEvent.CREDENTIAL_STORED:
+                this.onCredentialStored?.(event.data);
+                break;
+            case OID4VCIHolderEvent.IDENTIFIER_CREATED:
+                this.onIdentifierCreated?.(event.data);
+                break;
+            default:
+                return Promise.reject(Error(`Event type ${event.type} not supported`));
+        }
     }
     /**
      * FIXME: This method can only be used locally. Creating the interpreter should be local to where the agent is running
      */
-    oid4vciHolderGetMachineInterpreter(opts, context) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const authorizationRequestOpts = Object.assign(Object.assign({}, this.defaultAuthorizationRequestOpts), opts.authorizationRequestOpts);
-            const services = {
-                [IOID4VCIHolder_1.OID4VCIMachineServices.start]: (args) => this.oid4vciHolderStart(Object.assign(Object.assign({}, args), { authorizationRequestOpts }), context),
-                [IOID4VCIHolder_1.OID4VCIMachineServices.startFirstPartApplicationFlow]: (args) => (0, OID4VCIHolderService_1.startFirstPartApplicationMachine)(Object.assign(Object.assign({}, args), { stateNavigationListener: opts.firstPartyStateNavigationListener }), context),
-                [IOID4VCIHolder_1.OID4VCIMachineServices.createCredentialsToSelectFrom]: (args) => this.oid4vciHolderCreateCredentialsToSelectFrom(args, context),
-                [IOID4VCIHolder_1.OID4VCIMachineServices.getContact]: (args) => this.oid4vciHolderGetContact(args, context),
-                [IOID4VCIHolder_1.OID4VCIMachineServices.getCredentials]: (args) => { var _a; return this.oid4vciHolderGetCredentials(Object.assign({ accessTokenOpts: (_a = args.accessTokenOpts) !== null && _a !== void 0 ? _a : opts.accessTokenOpts }, args), context); },
-                [IOID4VCIHolder_1.OID4VCIMachineServices.addContactIdentity]: (args) => this.oid4vciHolderAddContactIdentity(args, context),
-                [IOID4VCIHolder_1.OID4VCIMachineServices.getIssuerBranding]: (args) => this.oid4vciHolderGetIssuerBranding(args, context),
-                [IOID4VCIHolder_1.OID4VCIMachineServices.storeIssuerBranding]: (args) => this.oid4vciHolderStoreIssuerBranding(args, context),
-                [IOID4VCIHolder_1.OID4VCIMachineServices.assertValidCredentials]: (args) => this.oid4vciHolderAssertValidCredentials(args, context),
-                [IOID4VCIHolder_1.OID4VCIMachineServices.storeCredentialBranding]: (args) => this.oid4vciHolderStoreCredentialBranding(args, context),
-                [IOID4VCIHolder_1.OID4VCIMachineServices.storeCredentials]: (args) => this.oid4vciHolderStoreCredentials(args, context),
-                [IOID4VCIHolder_1.OID4VCIMachineServices.sendNotification]: (args) => this.oid4vciHolderSendNotification(args, context),
-                [IOID4VCIHolder_1.OID4VCIMachineServices.getFederationTrust]: (args) => this.getFederationTrust(args, context),
-            };
-            const oid4vciMachineInstanceArgs = Object.assign(Object.assign({}, opts), { authorizationRequestOpts, services: Object.assign(Object.assign({}, services), opts.services) });
-            const { interpreter } = yield oid4vciMachine_1.OID4VCIMachine.newInstance(oid4vciMachineInstanceArgs, context);
-            return {
-                interpreter,
-            };
-        });
+    async oid4vciHolderGetMachineInterpreter(opts, context) {
+        const authorizationRequestOpts = { ...this.defaultAuthorizationRequestOpts, ...opts.authorizationRequestOpts };
+        const services = {
+            [OID4VCIMachineServices.start]: (args) => this.oid4vciHolderStart({
+                ...args,
+                authorizationRequestOpts,
+            }, context),
+            [OID4VCIMachineServices.startFirstPartApplicationFlow]: (args) => startFirstPartApplicationMachine({ ...args, stateNavigationListener: opts.firstPartyStateNavigationListener }, context),
+            [OID4VCIMachineServices.createCredentialsToSelectFrom]: (args) => this.oid4vciHolderCreateCredentialsToSelectFrom(args, context),
+            [OID4VCIMachineServices.getContact]: (args) => this.oid4vciHolderGetContact(args, context),
+            [OID4VCIMachineServices.getCredentials]: (args) => this.oid4vciHolderGetCredentials({ accessTokenOpts: args.accessTokenOpts ?? opts.accessTokenOpts, ...args }, context),
+            [OID4VCIMachineServices.addContactIdentity]: (args) => this.oid4vciHolderAddContactIdentity(args, context),
+            [OID4VCIMachineServices.getIssuerBranding]: (args) => this.oid4vciHolderGetIssuerBranding(args, context),
+            [OID4VCIMachineServices.storeIssuerBranding]: (args) => this.oid4vciHolderStoreIssuerBranding(args, context),
+            [OID4VCIMachineServices.assertValidCredentials]: (args) => this.oid4vciHolderAssertValidCredentials(args, context),
+            [OID4VCIMachineServices.storeCredentialBranding]: (args) => this.oid4vciHolderStoreCredentialBranding(args, context),
+            [OID4VCIMachineServices.storeCredentials]: (args) => this.oid4vciHolderStoreCredentials(args, context),
+            [OID4VCIMachineServices.sendNotification]: (args) => this.oid4vciHolderSendNotification(args, context),
+            [OID4VCIMachineServices.getFederationTrust]: (args) => this.getFederationTrust(args, context),
+        };
+        const oid4vciMachineInstanceArgs = {
+            ...opts,
+            authorizationRequestOpts,
+            services: {
+                ...services,
+                ...opts.services,
+            },
+        };
+        const { interpreter } = await OID4VCIMachine.newInstance(oid4vciMachineInstanceArgs, context);
+        return {
+            interpreter,
+        };
     }
     /**
      * This method is run before the machine starts! So there is no concept of the state machine context or states yet
@@ -208,307 +203,327 @@ class OID4VCIHolder {
      * @param context
      * @private
      */
-    oid4vciHolderStart(args, context) {
-        return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c;
-            const { requestData } = args;
-            if (!requestData) {
-                throw Error(`Cannot start the OID4VCI holder flow without request data being provided`);
-            }
-            const { uri = undefined } = requestData;
-            if (!uri) {
-                return Promise.reject(Error('Missing request URI in context'));
-            }
-            const authorizationRequestOpts = Object.assign(Object.assign({}, this.defaultAuthorizationRequestOpts), args.authorizationRequestOpts);
-            // We filter the details first against our vcformat prefs
-            authorizationRequestOpts.authorizationDetails = (authorizationRequestOpts === null || authorizationRequestOpts === void 0 ? void 0 : authorizationRequestOpts.authorizationDetails)
-                ? (0, utils_1.asArray)(authorizationRequestOpts.authorizationDetails).filter((detail) => typeof detail === 'string' || this.vcFormatPreferences.includes(detail.format))
-                : undefined;
-            if (!authorizationRequestOpts.redirectUri) {
-                authorizationRequestOpts.redirectUri = OID4VCIHolder.DEFAULT_MOBILE_REDIRECT_URI;
-            }
-            if (authorizationRequestOpts.redirectUri.startsWith('http') && !authorizationRequestOpts.clientId) {
-                // At least set a default for a web based wallet.
-                // TODO: We really need (dynamic) client registration support
-                authorizationRequestOpts.clientId = authorizationRequestOpts.redirectUri;
-            }
-            let formats = this.vcFormatPreferences;
-            const authFormats = (_a = authorizationRequestOpts === null || authorizationRequestOpts === void 0 ? void 0 : authorizationRequestOpts.authorizationDetails) === null || _a === void 0 ? void 0 : _a.map((detail) => (typeof detail === 'object' && 'format' in detail && detail.format ? detail.format : undefined)).filter((format) => !!format).map((format) => format);
-            if (authFormats && authFormats.length > 0) {
-                formats = Array.from(new Set(authFormats));
-            }
-            let oid4vciClient;
-            let types = undefined;
-            let offer;
-            if (requestData.existingClientState) {
-                oid4vciClient = yield oid4vci_client_1.OpenID4VCIClient.fromState({ state: requestData.existingClientState });
-                offer = oid4vciClient.credentialOffer;
-            }
-            else {
-                offer = requestData.credentialOffer;
-                if (uri.startsWith(IOID4VCIHolder_1.RequestType.OPENID_INITIATE_ISSUANCE) ||
-                    uri.startsWith(IOID4VCIHolder_1.RequestType.OPENID_CREDENTIAL_OFFER) ||
-                    uri.match(/https?:\/\/.*credential_offer(_uri)=?.*/)) {
-                    if (!offer) {
-                        // Let's make sure to convert the URI to offer, as it matches the regexes. Normally this should already have happened at this point though
-                        offer = yield oid4vci_client_1.CredentialOfferClient.fromURI(uri);
-                    }
-                }
-                else {
-                    if (!!offer) {
-                        logger.warning(`Non default URI used for credential offer: ${uri}`);
-                    }
-                }
+    async oid4vciHolderStart(args, context) {
+        const { requestData } = args;
+        if (!requestData) {
+            throw Error(`Cannot start the OID4VCI holder flow without request data being provided`);
+        }
+        const { uri = undefined } = requestData;
+        if (!uri) {
+            return Promise.reject(Error('Missing request URI in context'));
+        }
+        const authorizationRequestOpts = { ...this.defaultAuthorizationRequestOpts, ...args.authorizationRequestOpts };
+        // We filter the details first against our vcformat prefs
+        authorizationRequestOpts.authorizationDetails = authorizationRequestOpts?.authorizationDetails
+            ? asArray(authorizationRequestOpts.authorizationDetails).filter((detail) => typeof detail === 'string' || this.vcFormatPreferences.includes(detail.format))
+            : undefined;
+        if (!authorizationRequestOpts.redirectUri) {
+            authorizationRequestOpts.redirectUri = OID4VCIHolder.DEFAULT_MOBILE_REDIRECT_URI;
+        }
+        if (authorizationRequestOpts.redirectUri.startsWith('http') && !authorizationRequestOpts.clientId) {
+            // At least set a default for a web based wallet.
+            // TODO: We really need (dynamic) client registration support
+            authorizationRequestOpts.clientId = authorizationRequestOpts.redirectUri;
+        }
+        let formats = this.vcFormatPreferences;
+        const authFormats = authorizationRequestOpts?.authorizationDetails
+            ?.map((detail) => (typeof detail === 'object' && 'format' in detail && detail.format ? detail.format : undefined))
+            .filter((format) => !!format)
+            .map((format) => format);
+        if (authFormats && authFormats.length > 0) {
+            formats = Array.from(new Set(authFormats));
+        }
+        let oid4vciClient;
+        let types = undefined;
+        let offer;
+        if (requestData.existingClientState) {
+            oid4vciClient = await OpenID4VCIClient.fromState({ state: requestData.existingClientState });
+            offer = oid4vciClient.credentialOffer;
+        }
+        else {
+            offer = requestData.credentialOffer;
+            if (uri.startsWith(RequestType.OPENID_INITIATE_ISSUANCE) ||
+                uri.startsWith(RequestType.OPENID_CREDENTIAL_OFFER) ||
+                uri.match(/https?:\/\/.*credential_offer(_uri)=?.*/)) {
                 if (!offer) {
-                    // else no offer, meaning we have an issuer URL
-                    logger.log(`Issuer url received (no credential offer): ${uri}`);
-                    oid4vciClient = yield oid4vci_client_1.OpenID4VCIClient.fromCredentialIssuer({
-                        credentialIssuer: uri,
-                        authorizationRequest: authorizationRequestOpts,
-                        clientId: authorizationRequestOpts.clientId,
-                        createAuthorizationRequestURL: (_b = requestData.createAuthorizationRequestURL) !== null && _b !== void 0 ? _b : true,
-                    });
+                    // Let's make sure to convert the URI to offer, as it matches the regexes. Normally this should already have happened at this point though
+                    offer = await CredentialOfferClient.fromURI(uri);
                 }
-                else {
-                    logger.log(`Credential offer received: ${uri}`);
-                    oid4vciClient = yield oid4vci_client_1.OpenID4VCIClient.fromURI({
-                        uri,
-                        authorizationRequest: authorizationRequestOpts,
-                        clientId: authorizationRequestOpts.clientId,
-                        createAuthorizationRequestURL: (_c = requestData.createAuthorizationRequestURL) !== null && _c !== void 0 ? _c : true,
-                    });
+            }
+            else {
+                if (!!offer) {
+                    logger.warning(`Non default URI used for credential offer: ${uri}`);
                 }
             }
-            if (offer) {
-                types = (0, oid4vci_common_1.getTypesFromCredentialOffer)(offer.original_credential_offer);
+            if (!offer) {
+                // else no offer, meaning we have an issuer URL
+                logger.log(`Issuer url received (no credential offer): ${uri}`);
+                oid4vciClient = await OpenID4VCIClient.fromCredentialIssuer({
+                    credentialIssuer: uri,
+                    authorizationRequest: authorizationRequestOpts,
+                    clientId: authorizationRequestOpts.clientId,
+                    createAuthorizationRequestURL: requestData.createAuthorizationRequestURL ?? true,
+                });
             }
             else {
-                types = (0, utils_1.asArray)(authorizationRequestOpts.authorizationDetails)
-                    .map((authReqOpts) => { var _a; return (_a = (0, oid4vci_common_1.getTypesFromAuthorizationDetails)(authReqOpts)) !== null && _a !== void 0 ? _a : []; })
-                    .filter((inner) => inner.length > 0);
-            }
-            const serverMetadata = yield oid4vciClient.retrieveServerMetadata();
-            const credentialsSupported = yield (0, OID4VCIHolderService_1.getCredentialConfigsSupportedMerged)({
-                client: oid4vciClient,
-                vcFormatPreferences: formats,
-                types,
-            });
-            const credentialBranding = yield (0, OID4VCIHolderService_1.getCredentialBranding)({ credentialsSupported, context });
-            const authorizationCodeURL = oid4vciClient.authorizationURL;
-            if (authorizationCodeURL) {
-                logger.log(`authorization code URL ${authorizationCodeURL}`);
+                logger.log(`Credential offer received: ${uri}`);
+                oid4vciClient = await OpenID4VCIClient.fromURI({
+                    uri,
+                    authorizationRequest: authorizationRequestOpts,
+                    clientId: authorizationRequestOpts.clientId,
+                    createAuthorizationRequestURL: requestData.createAuthorizationRequestURL ?? true,
+                });
             }
-            const oid4vciClientState = JSON.parse(yield oid4vciClient.exportState());
-            return {
-                authorizationCodeURL,
-                credentialBranding,
-                credentialsSupported,
-                serverMetadata,
-                oid4vciClientState,
-            };
+        }
+        if (offer) {
+            types = getTypesFromCredentialOffer(offer.original_credential_offer);
+        }
+        else {
+            types = asArray(authorizationRequestOpts.authorizationDetails)
+                .map((authReqOpts) => getTypesFromAuthorizationDetails(authReqOpts) ?? [])
+                .filter((inner) => inner.length > 0);
+        }
+        const serverMetadata = await oid4vciClient.retrieveServerMetadata();
+        const credentialsSupported = await getCredentialConfigsSupportedMerged({
+            client: oid4vciClient,
+            vcFormatPreferences: formats,
+            types,
         });
+        const credentialBranding = await getCredentialBranding({ credentialsSupported, context });
+        const authorizationCodeURL = oid4vciClient.authorizationURL;
+        if (authorizationCodeURL) {
+            logger.log(`authorization code URL ${authorizationCodeURL}`);
+        }
+        const oid4vciClientState = JSON.parse(await oid4vciClient.exportState());
+        return {
+            authorizationCodeURL,
+            credentialBranding,
+            credentialsSupported,
+            serverMetadata,
+            oid4vciClientState,
+        };
     }
-    oid4vciHolderCreateCredentialsToSelectFrom(args, context) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const { credentialBranding, locale, selectedCredentials /*, openID4VCIClientState*/, credentialsSupported } = args;
-            // const client = await OpenID4VCIClient.fromState({ state: openID4VCIClientState! }) // TODO see if we need the check openID4VCIClientState defined
-            /*const credentialsSupported = await getCredentialConfigsSupportedBySingleTypeOrId({
-                                      client,
-                                      vcFormatPreferences: this.vcFormatPreferences,
-                                    })*/
-            logger.info(`Credentials supported ${Object.keys(credentialsSupported).join(', ')}`);
-            const credentialSelection = yield Promise.all(Object.entries(credentialsSupported).map((_a) => __awaiter(this, [_a], void 0, function* ([id, credentialConfigSupported]) {
-                // FIXME this allows for duplicate VerifiableCredential, which the user has no idea which ones those are and we also have a branding map with unique keys, so some branding will not match
-                // const defaultCredentialType = 'VerifiableCredential'
-                var _b, _c, _d;
-                const credentialTypes = (0, oid4vci_common_1.getTypesFromObject)(credentialConfigSupported);
-                // const credentialType = id /*?? credentialTypes?.find((type) => type !== defaultCredentialType) ?? defaultCredentialType*/
-                const localeBranding = !credentialBranding
-                    ? undefined
-                    : ((_b = credentialBranding === null || credentialBranding === void 0 ? void 0 : credentialBranding[id]) !== null && _b !== void 0 ? _b : (_c = Object.entries(credentialBranding)
+    async oid4vciHolderCreateCredentialsToSelectFrom(args, context) {
+        const { credentialBranding, locale, selectedCredentials /*, openID4VCIClientState*/, credentialsSupported } = args;
+        // const client = await OpenID4VCIClient.fromState({ state: openID4VCIClientState! }) // TODO see if we need the check openID4VCIClientState defined
+        /*const credentialsSupported = await getCredentialConfigsSupportedBySingleTypeOrId({
+                                  client,
+                                  vcFormatPreferences: this.vcFormatPreferences,
+                                })*/
+        logger.info(`Credentials supported ${Object.keys(credentialsSupported).join(', ')}`);
+        const credentialSelection = await Promise.all(Object.entries(credentialsSupported).map(async ([id, credentialConfigSupported]) => {
+            // FIXME this allows for duplicate VerifiableCredential, which the user has no idea which ones those are and we also have a branding map with unique keys, so some branding will not match
+            // const defaultCredentialType = 'VerifiableCredential'
+            const credentialTypes = getTypesFromObject(credentialConfigSupported);
+            // const credentialType = id /*?? credentialTypes?.find((type) => type !== defaultCredentialType) ?? defaultCredentialType*/
+            const localeBranding = !credentialBranding
+                ? undefined
+                : (credentialBranding?.[id] ??
+                    Object.entries(credentialBranding)
                         .find(([type, _brandings]) => {
                         credentialTypes && type in credentialTypes;
-                    })) === null || _c === void 0 ? void 0 : _c.map(([type, supported]) => supported));
-                const credentialAlias = (_d = (yield (0, OID4VCIHolderService_1.selectCredentialLocaleBranding)({
-                    locale,
-                    localeBranding,
-                }))) === null || _d === void 0 ? void 0 : _d.alias;
-                return {
-                    id: (0, uuid_1.v4)(),
-                    credentialId: id,
-                    credentialTypes: credentialTypes !== null && credentialTypes !== void 0 ? credentialTypes : (0, utils_1.asArray)(id),
-                    credentialAlias: credentialAlias !== null && credentialAlias !== void 0 ? credentialAlias : id,
-                    isSelected: false,
-                };
-            })));
-            // TODO find better place to do this, would be nice if the machine does this?
-            if (credentialSelection.length >= 1) {
-                credentialSelection.map((sel) => selectedCredentials.push(sel.credentialId));
-            }
-            logger.log(`Credential selection ${JSON.stringify(credentialSelection)}`);
-            return credentialSelection;
-        });
+                    })
+                        ?.map(([type, supported]) => supported));
+            const credentialAlias = (await selectCredentialLocaleBranding({
+                locale,
+                localeBranding,
+            }))?.alias;
+            return {
+                id: uuidv4(),
+                credentialId: id,
+                credentialTypes: credentialTypes ?? asArray(id),
+                credentialAlias: credentialAlias ?? id,
+                isSelected: false,
+            };
+        }));
+        // TODO find better place to do this, would be nice if the machine does this?
+        if (credentialSelection.length >= 1) {
+            credentialSelection.map((sel) => selectedCredentials.push(sel.credentialId));
+        }
+        logger.log(`Credential selection ${JSON.stringify(credentialSelection)}`);
+        return credentialSelection;
     }
-    oid4vciHolderGetContact(args, context) {
-        return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c;
-            const { serverMetadata } = args;
-            if (serverMetadata === undefined) {
-                return Promise.reject(Error('Missing serverMetadata in context'));
-            }
-            const names = new Set((_c = (_b = (_a = serverMetadata.credentialIssuerMetadata) === null || _a === void 0 ? void 0 : _a.display) === null || _b === void 0 ? void 0 : _b.map((display) => display.name).filter((name) => name != undefined).map((name) => name)) !== null && _c !== void 0 ? _c : []);
-            const name = names.size > 0 ? Array.from(names)[0] : undefined;
-            const correlationId = new URL(serverMetadata.issuer).hostname;
-            const filter = [
-                {
-                    identities: {
-                        identifier: {
-                            correlationId,
-                        },
+    async oid4vciHolderGetContact(args, context) {
+        const { serverMetadata } = args;
+        if (serverMetadata === undefined) {
+            return Promise.reject(Error('Missing serverMetadata in context'));
+        }
+        const names = new Set(serverMetadata.credentialIssuerMetadata?.display
+            ?.map((display) => display.name)
+            .filter((name) => name != undefined)
+            .map((name) => name) ?? []);
+        const name = names.size > 0 ? Array.from(names)[0] : undefined;
+        const correlationId = new URL(serverMetadata.issuer).hostname;
+        const filter = [
+            {
+                identities: {
+                    identifier: {
+                        correlationId,
                     },
                 },
-            ];
-            if (name) {
-                filter.push({
-                    contact: {
-                        legalName: name,
-                    },
-                });
-                filter.push({
-                    contact: {
-                        displayName: name,
-                    },
-                });
-            }
-            const parties = yield context.agent.cmGetContacts({
-                filter,
+            },
+        ];
+        if (name) {
+            filter.push({
+                contact: {
+                    legalName: name,
+                },
             });
-            if (parties.length > 1) {
-                logger.warning(`Get contacts returned more than one result: ${parties.length}, ${parties.map((party) => party.contact.displayName).join(',')}`);
-            }
-            const party = parties.length >= 1 ? parties[0] : undefined;
-            logger.log(`Party involved: `, party);
-            return party;
+            filter.push({
+                contact: {
+                    displayName: name,
+                },
+            });
+        }
+        const parties = await context.agent.cmGetContacts({
+            filter,
         });
+        if (parties.length > 1) {
+            logger.warning(`Get contacts returned more than one result: ${parties.length}, ${parties.map((party) => party.contact.displayName).join(',')}`);
+        }
+        const party = parties.length >= 1 ? parties[0] : undefined;
+        logger.log(`Party involved: `, party);
+        return party;
     }
-    oid4vciHolderGetCredentials(args, context) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const { verificationCode, openID4VCIClientState, didMethodPreferences = this.didMethodPreferences, issuanceOpt, accessTokenOpts } = args;
-            logger.debug(`Getting credentials`, issuanceOpt, accessTokenOpts);
-            if (!openID4VCIClientState) {
-                return Promise.reject(Error('Missing openID4VCI client state in context'));
-            }
-            const client = yield oid4vci_client_1.OpenID4VCIClient.fromState({ state: openID4VCIClientState });
-            const credentialsSupported = yield (0, OID4VCIHolderService_1.getCredentialConfigsSupportedMerged)({
-                client,
-                vcFormatPreferences: this.vcFormatPreferences,
-                configurationIds: args.selectedCredentials,
-            });
-            const serverMetadata = yield client.retrieveServerMetadata();
-            const issuanceOpts = yield (0, OID4VCIHolderService_1.getIssuanceOpts)(Object.assign({ client,
-                credentialsSupported,
-                serverMetadata,
-                context, didMethodPreferences: Array.isArray(didMethodPreferences) && didMethodPreferences.length > 0 ? didMethodPreferences : this.didMethodPreferences, jwtCryptographicSuitePreferences: this.jwtCryptographicSuitePreferences, jsonldCryptographicSuitePreferences: this.jsonldCryptographicSuitePreferences }, (issuanceOpt && { forceIssuanceOpt: issuanceOpt })));
-            const getCredentials = issuanceOpts.map((issuanceOpt) => __awaiter(this, void 0, void 0, function* () {
-                return yield this.oid4vciHolderGetCredential({
-                    issuanceOpt,
-                    pin: verificationCode,
-                    client,
-                    accessTokenOpts,
-                }, context);
-            }));
-            const allCredentials = yield Promise.all(getCredentials);
-            logger.log(`Credentials received`, allCredentials);
-            return allCredentials;
+    async oid4vciHolderGetCredentials(args, context) {
+        const { verificationCode, openID4VCIClientState, didMethodPreferences = this.didMethodPreferences, issuanceOpt, accessTokenOpts } = args;
+        logger.debug(`Getting credentials`, issuanceOpt, accessTokenOpts);
+        if (!openID4VCIClientState) {
+            return Promise.reject(Error('Missing openID4VCI client state in context'));
+        }
+        const client = await OpenID4VCIClient.fromState({ state: openID4VCIClientState });
+        const credentialsSupported = await getCredentialConfigsSupportedMerged({
+            client,
+            vcFormatPreferences: this.vcFormatPreferences,
+            configurationIds: args.selectedCredentials,
         });
+        const serverMetadata = await client.retrieveServerMetadata();
+        const issuanceOpts = await getIssuanceOpts({
+            client,
+            credentialsSupported,
+            serverMetadata,
+            context,
+            didMethodPreferences: Array.isArray(didMethodPreferences) && didMethodPreferences.length > 0 ? didMethodPreferences : this.didMethodPreferences,
+            jwtCryptographicSuitePreferences: this.jwtCryptographicSuitePreferences,
+            jsonldCryptographicSuitePreferences: this.jsonldCryptographicSuitePreferences,
+            ...(issuanceOpt && { forceIssuanceOpt: issuanceOpt }),
+        });
+        const getCredentials = issuanceOpts.map(async (issuanceOpt) => await this.oid4vciHolderGetCredential({
+            issuanceOpt,
+            pin: verificationCode,
+            client,
+            accessTokenOpts,
+        }, context));
+        const allCredentials = await Promise.all(getCredentials);
+        logger.log(`Credentials received`, allCredentials);
+        return allCredentials;
     }
-    oid4vciHolderGetCredential(args, context) {
-        return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c, _d, _e, _f, _g, _h, _j;
-            const { issuanceOpt, pin, client, accessTokenOpts } = args;
-            logger.info(`Getting credential`, issuanceOpt);
-            if (!issuanceOpt) {
-                return Promise.reject(Error(`Cannot get credential issuance options`));
-            }
-            const identifier = yield (0, OID4VCIHolderService_1.getIdentifierOpts)({ issuanceOpt, context });
-            issuanceOpt.identifier = identifier;
-            logger.info(`ID opts`, identifier);
-            const alg = yield (0, ssi_sdk_ext_key_utils_1.signatureAlgorithmFromKey)({ key: identifier.key });
-            // The VCI lib either expects a jwk or a kid
-            const jwk = (0, ssi_sdk_ext_identifier_resolution_1.isManagedIdentifierJwkResult)(identifier) ? identifier.jwk : undefined;
-            const callbacks = {
-                signCallback: signCallback(identifier, context),
-            };
-            try {
-                // We need to make sure we have acquired the access token
-                if (!client.clientId) {
-                    client.clientId = (0, ssi_sdk_ext_identifier_resolution_1.isManagedIdentifierDidResult)(identifier) ? identifier.did : identifier.issuer;
-                }
-                let asOpts = undefined;
-                let kid = (_b = (_a = accessTokenOpts === null || accessTokenOpts === void 0 ? void 0 : accessTokenOpts.clientOpts) === null || _a === void 0 ? void 0 : _a.kid) !== null && _b !== void 0 ? _b : identifier.kid;
-                if (accessTokenOpts === null || accessTokenOpts === void 0 ? void 0 : accessTokenOpts.clientOpts) {
-                    const clientId = (_d = (_c = accessTokenOpts.clientOpts.clientId) !== null && _c !== void 0 ? _c : client.clientId) !== null && _d !== void 0 ? _d : identifier.issuer;
-                    if (client.isEBSI() && (clientId === null || clientId === void 0 ? void 0 : clientId.startsWith('http')) && (kid === null || kid === void 0 ? void 0 : kid.includes('#'))) {
-                        kid = kid.split('#')[1];
-                    }
-                    //todo: investigate if the jwk should be used here as well if present
-                    const clientOpts = Object.assign(Object.assign({}, accessTokenOpts.clientOpts), { clientId,
-                        kid, 
-                        // @ts-ignore
-                        alg: (_e = accessTokenOpts.clientOpts.alg) !== null && _e !== void 0 ? _e : alg, signCallbacks: (_f = accessTokenOpts.clientOpts.signCallbacks) !== null && _f !== void 0 ? _f : callbacks });
-                    asOpts = {
-                        clientOpts,
-                    };
-                }
-                yield client.acquireAccessToken(Object.assign({ clientId: client.clientId, pin, authorizationResponse: JSON.parse(yield client.exportState()).authorizationCodeResponse, additionalRequestParams: accessTokenOpts === null || accessTokenOpts === void 0 ? void 0 : accessTokenOpts.additionalRequestParams }, (asOpts && { asOpts })));
-                // FIXME: This type mapping is wrong. It should use credential_identifier in case the access token response has authorization details
-                const types = (0, oid4vci_common_1.getTypesFromObject)(issuanceOpt);
-                const id = 'id' in issuanceOpt && issuanceOpt.id ? issuanceOpt.id : undefined;
-                const credentialTypes = (0, utils_1.asArray)((_h = (_g = issuanceOpt.credentialConfigurationId) !== null && _g !== void 0 ? _g : types) !== null && _h !== void 0 ? _h : id);
-                if (!credentialTypes || credentialTypes.length === 0) {
-                    return Promise.reject(Error('cannot determine credential id to request'));
+    async oid4vciHolderGetCredential(args, context) {
+        const { issuanceOpt, pin, client, accessTokenOpts } = args;
+        logger.info(`Getting credential`, issuanceOpt);
+        if (!issuanceOpt) {
+            return Promise.reject(Error(`Cannot get credential issuance options`));
+        }
+        const identifier = await getIdentifierOpts({ issuanceOpt, context });
+        issuanceOpt.identifier = identifier;
+        logger.info(`ID opts`, identifier);
+        const alg = await signatureAlgorithmFromKey({ key: identifier.key });
+        // The VCI lib either expects a jwk or a kid
+        const jwk = isManagedIdentifierJwkResult(identifier) ? identifier.jwk : undefined;
+        const callbacks = {
+            signCallback: signCallback(identifier, context),
+        };
+        try {
+            // We need to make sure we have acquired the access token
+            if (!client.clientId) {
+                client.clientId = isManagedIdentifierDidResult(identifier) ? identifier.did : identifier.issuer;
+            }
+            let asOpts = undefined;
+            let kid = accessTokenOpts?.clientOpts?.kid ?? identifier.kid;
+            if (accessTokenOpts?.clientOpts) {
+                const clientId = accessTokenOpts.clientOpts.clientId ?? client.clientId ?? identifier.issuer;
+                if (client.isEBSI() && clientId?.startsWith('http') && kid?.includes('#')) {
+                    kid = kid.split('#')[1];
                 }
-                const credentialResponse = yield client.acquireCredentials(Object.assign(Object.assign({ credentialTypes, proofCallbacks: callbacks, format: issuanceOpt.format, 
-                    // TODO: We need to update the machine and add notifications support for actual deferred credentials instead of just waiting/retrying
-                    deferredCredentialAwait: true }, (!jwk && { kid })), { // vci client either wants a jwk or kid. If we have used the jwk method do not provide the kid
-                    jwk,
-                    alg, jti: (0, uuid_1.v4)() }));
-                const credential = {
-                    id: (_j = issuanceOpt.credentialConfigurationId) !== null && _j !== void 0 ? _j : id,
-                    types: types !== null && types !== void 0 ? types : (0, utils_1.asArray)(credentialTypes),
-                    issuanceOpt,
-                    credentialResponse,
+                //todo: investigate if the jwk should be used here as well if present
+                const clientOpts = {
+                    ...accessTokenOpts.clientOpts,
+                    clientId,
+                    kid,
+                    // @ts-ignore
+                    alg: accessTokenOpts.clientOpts.alg ?? alg,
+                    signCallbacks: accessTokenOpts.clientOpts.signCallbacks ?? callbacks,
+                };
+                asOpts = {
+                    clientOpts,
                 };
-                return (0, OID4VCIHolderService_1.mapCredentialToAccept)({ credentialToAccept: credential, hasher: this.hasher });
-            }
-            catch (error) {
-                return Promise.reject(error);
             }
-        });
+            await client.acquireAccessToken({
+                clientId: client.clientId,
+                pin,
+                authorizationResponse: JSON.parse(await client.exportState()).authorizationCodeResponse,
+                additionalRequestParams: accessTokenOpts?.additionalRequestParams,
+                ...(asOpts && { asOpts }),
+            });
+            // FIXME: This type mapping is wrong. It should use credential_identifier in case the access token response has authorization details
+            const types = getTypesFromObject(issuanceOpt);
+            const id = 'id' in issuanceOpt && issuanceOpt.id ? issuanceOpt.id : undefined;
+            const credentialTypes = asArray(issuanceOpt.credentialConfigurationId ?? types ?? id);
+            if (!credentialTypes || credentialTypes.length === 0) {
+                return Promise.reject(Error('cannot determine credential id to request'));
+            }
+            const credentialDefinition = this.getCredentialDefinition(issuanceOpt);
+            const credentialResponse = await client.acquireCredentials({
+                ...(credentialDefinition && { context: credentialDefinition['@context'] }),
+                credentialTypes,
+                proofCallbacks: callbacks,
+                format: issuanceOpt.format,
+                // TODO: We need to update the machine and add notifications support for actual deferred credentials instead of just waiting/retrying
+                deferredCredentialAwait: true,
+                ...(!jwk && { kid }), // vci client either wants a jwk or kid. If we have used the jwk method do not provide the kid
+                jwk,
+                alg,
+                jti: uuidv4(),
+            });
+            const credential = {
+                id: issuanceOpt.credentialConfigurationId ?? id,
+                types: types ?? asArray(credentialTypes),
+                issuanceOpt,
+                credentialResponse,
+            };
+            return mapCredentialToAccept({ credentialToAccept: credential, hasher: this.hasher });
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
     }
-    oid4vciHolderAddContactIdentity(args, context) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const { credentialsToAccept, contact } = args;
-            if (!contact) {
-                return Promise.reject(Error('Missing contact in context'));
-            }
-            if (credentialsToAccept === undefined || credentialsToAccept.length === 0) {
-                return Promise.reject(Error('Missing credential offers in context'));
-            }
-            let correlationId = credentialsToAccept[0].correlationId;
-            let identifierType = ssi_sdk_data_store_1.CorrelationIdentifierType.DID;
-            if (!correlationId.toLowerCase().startsWith('did:')) {
-                identifierType = ssi_sdk_data_store_1.CorrelationIdentifierType.URL;
-                if (correlationId.startsWith('http')) {
-                    correlationId = new URL(correlationId).hostname;
-                }
+    async oid4vciHolderAddContactIdentity(args, context) {
+        const { credentialsToAccept, contact } = args;
+        if (!contact) {
+            return Promise.reject(Error('Missing contact in context'));
+        }
+        if (credentialsToAccept === undefined || credentialsToAccept.length === 0) {
+            return Promise.reject(Error('Missing credential offers in context'));
+        }
+        let correlationId = credentialsToAccept[0].correlationId;
+        let identifierType = CorrelationIdentifierType.DID;
+        if (!correlationId.toLowerCase().startsWith('did:')) {
+            identifierType = CorrelationIdentifierType.URL;
+            if (correlationId.startsWith('http')) {
+                correlationId = new URL(correlationId).hostname;
             }
-            const identity = Object.assign({ alias: credentialsToAccept[0].correlationId, origin: ssi_sdk_data_store_1.IdentityOrigin.EXTERNAL, roles: [ssi_sdk_data_store_1.CredentialRole.ISSUER], identifier: {
-                    type: identifierType,
-                    correlationId,
-                } }, (identifierType === ssi_sdk_data_store_1.CorrelationIdentifierType.URL && {
+        }
+        const identity = {
+            alias: credentialsToAccept[0].correlationId,
+            origin: IdentityOrigin.EXTERNAL,
+            roles: [CredentialRole.ISSUER],
+            identifier: {
+                type: identifierType,
+                correlationId,
+            },
+            ...(identifierType === CorrelationIdentifierType.URL && {
                 connection: {
-                    type: ssi_sdk_data_store_1.ConnectionType.OPENID_CONNECT,
+                    type: ConnectionType.OPENID_CONNECT,
                     config: {
                         clientId: '138d7bf8-c930-4c6e-b928-97d3a4928b01',
                         clientSecret: '03b3955f-d020-4f2a-8a27-4e452d4e27a0',
@@ -519,352 +534,349 @@ class OID4VCIHolder {
                         clientAuthMethod: 'post',
                     },
                 },
-            }));
-            yield context.agent.emit(IOID4VCIHolder_1.OID4VCIHolderEvent.CONTACT_IDENTITY_CREATED, {
-                contactId: contact.id,
-                identity,
-            });
-            logger.log(`Contact added: ${correlationId}`);
-            return context.agent.cmAddIdentity({ contactId: contact.id, identity });
-        });
-    }
-    oid4vciHolderGetIssuerBranding(args, context) {
-        return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b;
-            const { serverMetadata, contact } = args;
-            // Here we are fetching issuer branding for a contact. If no contact is found that means we encounter this contact for the first time. This also means we do not have any branding for the contact.
-            const issuerCorrelationId = contact === null || contact === void 0 ? void 0 : contact.identities.filter((identity) => identity.roles.includes(ssi_sdk_data_store_1.CredentialRole.ISSUER)).map((identity) => identity.identifier.correlationId)[0];
-            if (issuerCorrelationId) {
-                const branding = yield context.agent.ibGetIssuerBranding({ filter: [{ issuerCorrelationId }] });
-                if (branding.length > 0) {
-                    return branding[0].localeBranding;
-                }
-            }
-            // We should have serverMetadata in the context else something went wrong
-            if (!serverMetadata) {
-                return Promise.reject(Error('Missing serverMetadata in context'));
-            }
-            return (0, OID4VCIHolderService_1.getBasicIssuerLocaleBranding)({
-                display: (_b = (_a = serverMetadata.credentialIssuerMetadata) === null || _a === void 0 ? void 0 : _a.display) !== null && _b !== void 0 ? _b : [],
-                dynamicRegistrationClientMetadata: serverMetadata.credentialIssuerMetadata,
-                context,
-            });
+            }),
+        };
+        await context.agent.emit(OID4VCIHolderEvent.CONTACT_IDENTITY_CREATED, {
+            contactId: contact.id,
+            identity,
         });
+        logger.log(`Contact added: ${correlationId}`);
+        return context.agent.cmAddIdentity({ contactId: contact.id, identity });
     }
-    oid4vciHolderStoreIssuerBranding(args, context) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const { issuerBranding, contact } = args;
-            if (!issuerBranding || issuerBranding.length === 0 || issuerBranding[0].id) {
-                // FIXME we need better separation between a contact(issuer) we encountered before and it's branding vs a new contact and it's branding
-                return;
-            }
-            if (!contact) {
-                return Promise.reject(Error('Missing contact in context'));
-            }
-            const issuerCorrelationId = contact === null || contact === void 0 ? void 0 : contact.identities.filter((identity) => identity.roles.includes(ssi_sdk_data_store_1.CredentialRole.ISSUER)).map((identity) => identity.identifier.correlationId)[0];
-            // we check for issuer branding as adding an identity might also trigger storing the issuer branding
-            const branding = yield context.agent.ibGetIssuerBranding({ filter: [{ issuerCorrelationId }] });
+    async oid4vciHolderGetIssuerBranding(args, context) {
+        const { serverMetadata, contact } = args;
+        // Here we are fetching issuer branding for a contact. If no contact is found that means we encounter this contact for the first time. This also means we do not have any branding for the contact.
+        const issuerCorrelationId = contact?.identities
+            .filter((identity) => identity.roles.includes(CredentialRole.ISSUER))
+            .map((identity) => identity.identifier.correlationId)[0];
+        if (issuerCorrelationId) {
+            const branding = await context.agent.ibGetIssuerBranding({ filter: [{ issuerCorrelationId }] });
             if (branding.length > 0) {
-                return;
+                return branding[0].localeBranding;
             }
-            yield context.agent.ibAddIssuerBranding({
-                localeBranding: issuerBranding,
-                issuerCorrelationId,
-            });
+        }
+        // We should have serverMetadata in the context else something went wrong
+        if (!serverMetadata) {
+            return Promise.reject(Error('Missing serverMetadata in context'));
+        }
+        return getBasicIssuerLocaleBranding({
+            display: serverMetadata.credentialIssuerMetadata?.display ?? [],
+            dynamicRegistrationClientMetadata: serverMetadata.credentialIssuerMetadata,
+            context,
         });
     }
-    oid4vciHolderAssertValidCredentials(args, context) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const { credentialsToAccept, issuanceOpt } = args;
-            return yield Promise.all(credentialsToAccept.map((credentialToAccept) => (0, OID4VCIHolderService_1.verifyCredentialToAccept)({
-                mappedCredential: credentialToAccept,
-                onVerifyEBSICredentialIssuer: this.onVerifyEBSICredentialIssuer,
-                hasher: this.hasher,
-                schemaValidation: issuanceOpt === null || issuanceOpt === void 0 ? void 0 : issuanceOpt.schemaValidation,
-                context,
-            })));
+    async oid4vciHolderStoreIssuerBranding(args, context) {
+        const { issuerBranding, contact } = args;
+        if (!issuerBranding || issuerBranding.length === 0 || issuerBranding[0].id) {
+            // FIXME we need better separation between a contact(issuer) we encountered before and it's branding vs a new contact and it's branding
+            return;
+        }
+        if (!contact) {
+            return Promise.reject(Error('Missing contact in context'));
+        }
+        const issuerCorrelationId = contact?.identities
+            .filter((identity) => identity.roles.includes(CredentialRole.ISSUER))
+            .map((identity) => identity.identifier.correlationId)[0];
+        // we check for issuer branding as adding an identity might also trigger storing the issuer branding
+        const branding = await context.agent.ibGetIssuerBranding({ filter: [{ issuerCorrelationId }] });
+        if (branding.length > 0) {
+            return;
+        }
+        await context.agent.ibAddIssuerBranding({
+            localeBranding: issuerBranding,
+            issuerCorrelationId,
         });
     }
-    oid4vciHolderStoreCredentialBranding(args, context) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const { credentialBranding, serverMetadata, selectedCredentials, credentialsToAccept } = args;
-            if (serverMetadata === undefined) {
-                return Promise.reject(Error('Missing serverMetadata in context'));
+    async oid4vciHolderAssertValidCredentials(args, context) {
+        const { credentialsToAccept, issuanceOpt } = args;
+        return await Promise.all(credentialsToAccept.map((credentialToAccept) => verifyCredentialToAccept({
+            mappedCredential: credentialToAccept,
+            onVerifyEBSICredentialIssuer: this.onVerifyEBSICredentialIssuer,
+            hasher: this.hasher,
+            schemaValidation: issuanceOpt?.schemaValidation,
+            context,
+        })));
+    }
+    async oid4vciHolderStoreCredentialBranding(args, context) {
+        const { credentialBranding, serverMetadata, selectedCredentials, credentialsToAccept } = args;
+        if (serverMetadata === undefined) {
+            return Promise.reject(Error('Missing serverMetadata in context'));
+        }
+        else if (selectedCredentials.length === 0) {
+            logger.warning(`No credentials selected for issuer: ${serverMetadata.issuer}`);
+            return;
+        }
+        let counter = 0;
+        for (const credentialId of selectedCredentials) {
+            const localeBranding = credentialBranding?.[credentialId];
+            if (localeBranding && localeBranding.length > 0) {
+                const credential = credentialsToAccept.find((credAccept) => credAccept.credentialToAccept.id === credentialId || JSON.stringify(credAccept.types) === credentialId || credentialsToAccept[counter]);
+                counter++;
+                await context.agent.ibAddCredentialBranding({
+                    vcHash: computeEntryHash(credential.rawVerifiableCredential),
+                    issuerCorrelationId: new URL(serverMetadata.issuer).hostname,
+                    localeBranding,
+                });
+                logger.log(`Credential branding for issuer ${serverMetadata.issuer} and type ${credentialId} stored with locales ${localeBranding.map((b) => b.locale).join(',')}`);
+            }
+            else {
+                logger.warning(`No credential branding found for issuer: ${serverMetadata.issuer} and type ${credentialId}`);
             }
-            else if (selectedCredentials.length === 0) {
-                logger.warning(`No credentials selected for issuer: ${serverMetadata.issuer}`);
-                return;
+        }
+    }
+    async oid4vciHolderStoreCredentials(args, context) {
+        function trimmed(input) {
+            const trim = input?.trim();
+            if (trim === '') {
+                return undefined;
             }
-            let counter = 0;
-            for (const credentialId of selectedCredentials) {
-                const localeBranding = credentialBranding === null || credentialBranding === void 0 ? void 0 : credentialBranding[credentialId];
-                if (localeBranding && localeBranding.length > 0) {
-                    const credential = credentialsToAccept.find((credAccept) => credAccept.credentialToAccept.id === credentialId || JSON.stringify(credAccept.types) === credentialId || credentialsToAccept[counter]);
-                    counter++;
-                    yield context.agent.ibAddCredentialBranding({
-                        vcHash: (0, utils_1.computeEntryHash)(credential.rawVerifiableCredential),
-                        issuerCorrelationId: new URL(serverMetadata.issuer).hostname,
-                        localeBranding,
-                    });
-                    logger.log(`Credential branding for issuer ${serverMetadata.issuer} and type ${credentialId} stored with locales ${localeBranding.map((b) => b.locale).join(',')}`);
+            return trim;
+        }
+        const { credentialsToAccept, openID4VCIClientState, credentialsSupported, serverMetadata, selectedCredentials } = args;
+        const mappedCredentialToAccept = credentialsToAccept[0];
+        if (selectedCredentials && selectedCredentials.length > 1) {
+            logger.error(`More than 1 credential selected ${selectedCredentials.join(', ')}, but current service only stores 1 credential!`);
+        }
+        // TODO determine when and how we should store credentials without key kmsKeyRef & id method), this should be tested with the code below
+        const issuanceOpt = args.issuanceOpt ?? mappedCredentialToAccept.credentialToAccept.issuanceOpt;
+        if (!issuanceOpt || !issuanceOpt.identifier) {
+            return Promise.reject(Error('issuanceOpt.identifier must me set in order to store a credential'));
+        }
+        const { kmsKeyRef, method } = issuanceOpt.identifier;
+        let persist = true;
+        const verifiableCredential = mappedCredentialToAccept.uniformVerifiableCredential;
+        const notificationId = mappedCredentialToAccept.credentialToAccept.credentialResponse.notification_id;
+        const subjectIssuance = mappedCredentialToAccept.credential_subject_issuance;
+        const notificationEndpoint = serverMetadata?.credentialIssuerMetadata?.notification_endpoint;
+        let holderCredential = undefined;
+        if (!notificationEndpoint) {
+            logger.log(`Notifications not supported by issuer ${serverMetadata?.issuer}. Will not provide a notification`);
+        }
+        else if (notificationEndpoint && !notificationId) {
+            logger.warning(`Notification endpoint available in issuer metadata with value ${notificationEndpoint}, but no ${notificationId} provided. Will not send a notification to issuer ${serverMetadata?.issuer}`);
+        }
+        else if (notificationEndpoint && notificationId) {
+            logger.log(`Notification id ${notificationId} found, will send back a notification to ${notificationEndpoint}`);
+            let event = 'credential_accepted';
+            if (Array.isArray(subjectIssuance?.notification_events_supported)) {
+                // experimental subject issuance, where a new credential is being created
+                event = subjectIssuance.notification_events_supported.includes('credential_accepted_holder_signed')
+                    ? 'credential_accepted_holder_signed'
+                    : 'credential_deleted_holder_signed';
+                logger.log(`Subject issuance/signing will be used, with event`, event);
+                const issuerVC = mappedCredentialToAccept.credentialToAccept.credentialResponse.credential;
+                const wrappedIssuerVC = CredentialMapper.toWrappedVerifiableCredential(issuerVC, { hasher: this.hasher ?? defaultHasher });
+                console.log(`Wrapped VC: ${wrappedIssuerVC.type}, ${wrappedIssuerVC.format}`);
+                // We will use the subject of the VCI Issuer (the holder, as the issuer of the new credential, so the below is not a mistake!)
+                let issuer;
+                if (CredentialMapper.isWrappedSdJwtVerifiableCredential(wrappedIssuerVC)) {
+                    issuer = trimmed(wrappedIssuerVC.decoded?.sub);
                 }
-                else {
-                    logger.warning(`No credential branding found for issuer: ${serverMetadata.issuer} and type ${credentialId}`);
+                else if (CredentialMapper.isWrappedW3CVerifiableCredential(wrappedIssuerVC)) {
+                    issuer = trimmed(wrappedIssuerVC.credential?.sub) ?? trimmed(this.idFromW3cCredentialSubject(wrappedIssuerVC));
                 }
-            }
-        });
-    }
-    oid4vciHolderStoreCredentials(args, context) {
-        return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c, _d, _e, _f, _g, _h, _j;
-            function trimmed(input) {
-                const trim = input === null || input === void 0 ? void 0 : input.trim();
-                if (trim === '') {
-                    return undefined;
+                else if (CredentialMapper.isWrappedMdocCredential(wrappedIssuerVC)) {
+                    return Promise.reject(Error('mdoc not yet supported'));
                 }
-                return trim;
-            }
-            const { credentialsToAccept, openID4VCIClientState, credentialsSupported, serverMetadata, selectedCredentials } = args;
-            const mappedCredentialToAccept = credentialsToAccept[0];
-            if (selectedCredentials && selectedCredentials.length > 1) {
-                logger.error(`More than 1 credential selected ${selectedCredentials.join(', ')}, but current service only stores 1 credential!`);
-            }
-            // TODO determine when and how we should store credentials without key kmsKeyRef & id method), this should be tested with the code below
-            const issuanceOpt = (_a = args.issuanceOpt) !== null && _a !== void 0 ? _a : mappedCredentialToAccept.credentialToAccept.issuanceOpt;
-            if (!issuanceOpt || !issuanceOpt.identifier) {
-                return Promise.reject(Error('issuanceOpt.identifier must me set in order to store a credential'));
-            }
-            const { kmsKeyRef, method } = issuanceOpt.identifier;
-            let persist = true;
-            const verifiableCredential = mappedCredentialToAccept.uniformVerifiableCredential;
-            const notificationId = mappedCredentialToAccept.credentialToAccept.credentialResponse.notification_id;
-            const subjectIssuance = mappedCredentialToAccept.credential_subject_issuance;
-            const notificationEndpoint = (_b = serverMetadata === null || serverMetadata === void 0 ? void 0 : serverMetadata.credentialIssuerMetadata) === null || _b === void 0 ? void 0 : _b.notification_endpoint;
-            let holderCredential = undefined;
-            if (!notificationEndpoint) {
-                logger.log(`Notifications not supported by issuer ${serverMetadata === null || serverMetadata === void 0 ? void 0 : serverMetadata.issuer}. Will not provide a notification`);
-            }
-            else if (notificationEndpoint && !notificationId) {
-                logger.warning(`Notification endpoint available in issuer metadata with value ${notificationEndpoint}, but no ${notificationId} provided. Will not send a notification to issuer ${serverMetadata === null || serverMetadata === void 0 ? void 0 : serverMetadata.issuer}`);
-            }
-            else if (notificationEndpoint && notificationId) {
-                logger.log(`Notification id ${notificationId} found, will send back a notification to ${notificationEndpoint}`);
-                let event = 'credential_accepted';
-                if (Array.isArray(subjectIssuance === null || subjectIssuance === void 0 ? void 0 : subjectIssuance.notification_events_supported)) {
-                    // experimental subject issuance, where a new credential is being created
-                    event = subjectIssuance.notification_events_supported.includes('credential_accepted_holder_signed')
-                        ? 'credential_accepted_holder_signed'
-                        : 'credential_deleted_holder_signed';
-                    logger.log(`Subject issuance/signing will be used, with event`, event);
-                    const issuerVC = mappedCredentialToAccept.credentialToAccept.credentialResponse.credential;
-                    const wrappedIssuerVC = ssi_types_1.CredentialMapper.toWrappedVerifiableCredential(issuerVC, { hasher: this.hasher });
-                    console.log(`Wrapped VC: ${wrappedIssuerVC.type}, ${wrappedIssuerVC.format}`);
-                    // We will use the subject of the VCI Issuer (the holder, as the issuer of the new credential, so the below is not a mistake!)
-                    let issuer;
-                    if (ssi_types_1.CredentialMapper.isWrappedSdJwtVerifiableCredential(wrappedIssuerVC)) {
-                        issuer = trimmed((_c = wrappedIssuerVC.decoded) === null || _c === void 0 ? void 0 : _c.sub);
-                    }
-                    else if (ssi_types_1.CredentialMapper.isWrappedW3CVerifiableCredential(wrappedIssuerVC)) {
-                        issuer = (_e = trimmed((_d = wrappedIssuerVC.credential) === null || _d === void 0 ? void 0 : _d.sub)) !== null && _e !== void 0 ? _e : trimmed(this.idFromW3cCredentialSubject(wrappedIssuerVC));
-                    }
-                    else if (ssi_types_1.CredentialMapper.isWrappedMdocCredential(wrappedIssuerVC)) {
-                        return Promise.reject(Error('mdoc not yet supported'));
-                    }
-                    if (!issuer) {
-                        issuer = trimmed((_f = verifiableCredential.credentialSubject) === null || _f === void 0 ? void 0 : _f.id);
-                    }
-                    if (!issuer && ((_g = openID4VCIClientState === null || openID4VCIClientState === void 0 ? void 0 : openID4VCIClientState.kid) === null || _g === void 0 ? void 0 : _g.startsWith('did:'))) {
-                        issuer = (0, ssi_types_1.parseDid)(openID4VCIClientState === null || openID4VCIClientState === void 0 ? void 0 : openID4VCIClientState.kid).did;
-                    }
-                    if (!issuer && ((_j = (_h = openID4VCIClientState === null || openID4VCIClientState === void 0 ? void 0 : openID4VCIClientState.jwk) === null || _h === void 0 ? void 0 : _h.kid) === null || _j === void 0 ? void 0 : _j.startsWith('did:'))) {
-                        issuer = (0, ssi_types_1.parseDid)(openID4VCIClientState.jwk.kid).did;
-                    }
-                    if (!issuer && (openID4VCIClientState === null || openID4VCIClientState === void 0 ? void 0 : openID4VCIClientState.clientId)) {
-                        issuer = trimmed(openID4VCIClientState.clientId);
-                    }
-                    if (!issuer && (openID4VCIClientState === null || openID4VCIClientState === void 0 ? void 0 : openID4VCIClientState.accessTokenResponse)) {
-                        const decodedJwt = (0, did_jwt_1.decodeJWT)(openID4VCIClientState.accessTokenResponse.access_token);
-                        issuer = decodedJwt.payload.sub;
-                    }
-                    if (!issuer && mappedCredentialToAccept.credentialToAccept.issuanceOpt.identifier) {
-                        const resolution = yield context.agent.identifierManagedGet(mappedCredentialToAccept.credentialToAccept.issuanceOpt.identifier);
-                        issuer = resolution.issuer;
-                    }
-                    if (!issuer) {
-                        throw Error(`We could not determine the issuer, which means we cannot sign the credential`);
-                    }
-                    logger.log(`Issuer for self-issued credential will be: ${issuer}`);
-                    const holderCredentialToSign = wrappedIssuerVC.decoded;
-                    let proofFormat = 'lds';
-                    if (wrappedIssuerVC.format.includes('jwt') && !wrappedIssuerVC.format.includes('mso_mdoc')) {
-                        holderCredentialToSign.iss = issuer;
-                        proofFormat = 'jwt';
-                    }
-                    if ('issuer' in holderCredentialToSign && !('iss' in holderCredentialToSign)) {
-                        holderCredentialToSign.issuer = issuer;
-                    }
-                    if ('sub' in holderCredentialToSign) {
-                        holderCredentialToSign.sub = issuer;
-                    }
-                    if ('credentialSubject' in holderCredentialToSign && !Array.isArray(holderCredentialToSign.credentialSubject)) {
-                        holderCredentialToSign.credentialSubject.id = issuer;
-                    }
-                    if ('vc' in holderCredentialToSign) {
-                        if (holderCredentialToSign.vc.credentialSubject) {
-                            holderCredentialToSign.vc.credentialSubject.id = issuer;
-                        }
-                        holderCredentialToSign.vc.issuer = issuer;
-                        delete holderCredentialToSign.vc.proof;
-                        delete holderCredentialToSign.vc.issuanceDate;
-                    }
-                    delete holderCredentialToSign.proof;
-                    delete holderCredentialToSign.issuanceDate;
-                    delete holderCredentialToSign.iat;
-                    logger.log(`Subject issuance/signing will sign credential of type ${proofFormat}:`, holderCredentialToSign);
-                    const issuedVC = yield context.agent.createVerifiableCredential({
-                        credential: holderCredentialToSign,
-                        fetchRemoteContexts: true,
-                        save: false,
-                        proofFormat,
-                    });
-                    if (!issuedVC) {
-                        throw Error(`Could not issue holder credential from the wallet`);
+                if (!issuer) {
+                    issuer = trimmed(verifiableCredential.credentialSubject?.id);
+                }
+                if (!issuer && openID4VCIClientState?.kid?.startsWith('did:')) {
+                    issuer = parseDid(openID4VCIClientState?.kid).did;
+                }
+                if (!issuer && openID4VCIClientState?.jwk?.kid?.startsWith('did:')) {
+                    issuer = parseDid(openID4VCIClientState.jwk.kid).did;
+                }
+                if (!issuer && openID4VCIClientState?.clientId) {
+                    issuer = trimmed(openID4VCIClientState.clientId);
+                }
+                if (!issuer && openID4VCIClientState?.accessTokenResponse) {
+                    const decodedJwt = decodeJWT(openID4VCIClientState.accessTokenResponse.access_token);
+                    issuer = decodedJwt.payload.sub;
+                }
+                if (!issuer && mappedCredentialToAccept.credentialToAccept.issuanceOpt.identifier) {
+                    const resolution = await context.agent.identifierManagedGet(mappedCredentialToAccept.credentialToAccept.issuanceOpt.identifier);
+                    issuer = resolution.issuer;
+                }
+                if (!issuer) {
+                    throw Error(`We could not determine the issuer, which means we cannot sign the credential`);
+                }
+                logger.log(`Issuer for self-issued credential will be: ${issuer}`);
+                const holderCredentialToSign = wrappedIssuerVC.decoded;
+                let proofFormat = 'lds';
+                if (wrappedIssuerVC.format.includes('jwt') && !wrappedIssuerVC.format.includes('mso_mdoc')) {
+                    holderCredentialToSign.iss = issuer;
+                    proofFormat = 'jwt';
+                }
+                if ('issuer' in holderCredentialToSign && !('iss' in holderCredentialToSign)) {
+                    holderCredentialToSign.issuer = issuer;
+                }
+                if ('sub' in holderCredentialToSign) {
+                    holderCredentialToSign.sub = issuer;
+                }
+                if ('credentialSubject' in holderCredentialToSign && !Array.isArray(holderCredentialToSign.credentialSubject)) {
+                    holderCredentialToSign.credentialSubject.id = issuer;
+                }
+                if ('vc' in holderCredentialToSign) {
+                    if (holderCredentialToSign.vc.credentialSubject) {
+                        holderCredentialToSign.vc.credentialSubject.id = issuer;
                     }
-                    logger.log(`Holder ${issuedVC.issuer} issued new credential with id ${issuedVC.id}`, issuedVC);
-                    holderCredential = ssi_types_1.CredentialMapper.storedCredentialToOriginalFormat(issuedVC);
-                    persist = event === 'credential_accepted_holder_signed';
+                    holderCredentialToSign.vc.issuer = issuer;
+                    delete holderCredentialToSign.vc.proof;
+                    delete holderCredentialToSign.vc.issuanceDate;
                 }
-                const notificationRequest = Object.assign(Object.assign({ notification_id: notificationId }, (holderCredential && { credential: holderCredential })), { event });
-                yield this.oid4vciHolderSendNotification({
-                    openID4VCIClientState,
-                    stored: persist,
-                    credentialsToAccept,
-                    credentialsSupported,
-                    notificationRequest,
-                    serverMetadata,
-                }, context);
-            }
-            const persistCredential = holderCredential
-                ? ssi_types_1.CredentialMapper.storedCredentialToOriginalFormat(holderCredential)
-                : mappedCredentialToAccept.rawVerifiableCredential;
-            if (!persist && holderCredential) {
-                logger.log(`Will not persist credential, since we are signing as a holder and the issuer asked not to persist`);
-            }
-            else {
-                logger.log(`Persisting credential`, persistCredential);
-                const issuer = ssi_types_1.CredentialMapper.issuerCorrelationIdFromIssuerType(verifiableCredential.issuer);
-                const [subjectCorrelationType, subjectCorrelationId] = this.determineSubjectCorrelation(issuanceOpt.identifier, issuer);
-                const persistedCredential = yield context.agent.crsAddCredential({
-                    credential: {
-                        rawDocument: (0, ssi_sdk_data_store_1.ensureRawDocument)(persistCredential),
-                        kmsKeyRef: kmsKeyRef,
-                        identifierMethod: method,
-                        credentialRole: ssi_sdk_data_store_1.CredentialRole.HOLDER,
-                        issuerCorrelationType: (issuer === null || issuer === void 0 ? void 0 : issuer.startsWith('did:')) ? ssi_sdk_data_store_1.CredentialCorrelationType.DID : ssi_sdk_data_store_1.CredentialCorrelationType.URL,
-                        issuerCorrelationId: issuer,
-                        subjectCorrelationType,
-                        subjectCorrelationId,
-                    },
-                });
-                yield context.agent.emit(IOID4VCIHolder_1.OID4VCIHolderEvent.CREDENTIAL_STORED, {
-                    credential: persistedCredential,
-                    vcHash: persistedCredential.hash,
+                delete holderCredentialToSign.proof;
+                delete holderCredentialToSign.issuanceDate;
+                delete holderCredentialToSign.iat;
+                logger.log(`Subject issuance/signing will sign credential of type ${proofFormat}:`, holderCredentialToSign);
+                const issuedVC = await context.agent.createVerifiableCredential({
+                    credential: holderCredentialToSign,
+                    fetchRemoteContexts: true,
+                    save: false,
+                    proofFormat,
                 });
-            }
-        });
+                if (!issuedVC) {
+                    throw Error(`Could not issue holder credential from the wallet`);
+                }
+                logger.log(`Holder ${issuedVC.issuer} issued new credential with id ${issuedVC.id}`, issuedVC);
+                holderCredential = CredentialMapper.storedCredentialToOriginalFormat(issuedVC);
+                persist = event === 'credential_accepted_holder_signed';
+            }
+            const notificationRequest = {
+                notification_id: notificationId,
+                ...(holderCredential && { credential: holderCredential }),
+                event,
+            };
+            await this.oid4vciHolderSendNotification({
+                openID4VCIClientState,
+                stored: persist,
+                credentialsToAccept,
+                credentialsSupported,
+                notificationRequest,
+                serverMetadata,
+            }, context);
+        }
+        const persistCredential = holderCredential
+            ? CredentialMapper.storedCredentialToOriginalFormat(holderCredential)
+            : mappedCredentialToAccept.rawVerifiableCredential;
+        if (!persist && holderCredential) {
+            logger.log(`Will not persist credential, since we are signing as a holder and the issuer asked not to persist`);
+        }
+        else {
+            logger.log(`Persisting credential`, persistCredential);
+            const issuer = CredentialMapper.issuerCorrelationIdFromIssuerType(verifiableCredential.issuer);
+            const [subjectCorrelationType, subjectCorrelationId] = this.determineSubjectCorrelation(issuanceOpt.identifier, issuer);
+            const persistedCredential = await context.agent.crsAddCredential({
+                credential: {
+                    rawDocument: ensureRawDocument(persistCredential),
+                    kmsKeyRef: kmsKeyRef,
+                    identifierMethod: method,
+                    credentialRole: CredentialRole.HOLDER,
+                    issuerCorrelationType: issuer?.startsWith('did:') ? CredentialCorrelationType.DID : CredentialCorrelationType.URL,
+                    issuerCorrelationId: issuer,
+                    subjectCorrelationType,
+                    subjectCorrelationId,
+                },
+            });
+            await context.agent.emit(OID4VCIHolderEvent.CREDENTIAL_STORED, {
+                credential: persistedCredential,
+                vcHash: persistedCredential.hash,
+            });
+        }
     }
-    oid4vciHolderSendNotification(args, context) {
-        return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b;
-            const { serverMetadata, notificationRequest, openID4VCIClientState } = args;
-            const notificationEndpoint = (_a = serverMetadata === null || serverMetadata === void 0 ? void 0 : serverMetadata.credentialIssuerMetadata) === null || _a === void 0 ? void 0 : _a.notification_endpoint;
-            if (!notificationEndpoint) {
-                return;
-            }
-            else if (!openID4VCIClientState) {
-                return Promise.reject(Error('Missing openID4VCI client state in context'));
-            }
-            else if (!notificationRequest) {
-                return Promise.reject(Error('Missing notification request'));
-            }
-            logger.log(`Will send notification to ${notificationEndpoint}`, notificationRequest);
-            const client = yield oid4vci_client_1.OpenID4VCIClient.fromState({ state: openID4VCIClientState });
-            yield client.sendNotification({ notificationEndpoint }, notificationRequest, (_b = openID4VCIClientState === null || openID4VCIClientState === void 0 ? void 0 : openID4VCIClientState.accessTokenResponse) === null || _b === void 0 ? void 0 : _b.access_token);
-            logger.log(`Notification to ${notificationEndpoint} has been dispatched`);
-        });
+    async oid4vciHolderSendNotification(args, context) {
+        const { serverMetadata, notificationRequest, openID4VCIClientState } = args;
+        const notificationEndpoint = serverMetadata?.credentialIssuerMetadata?.notification_endpoint;
+        if (!notificationEndpoint) {
+            return;
+        }
+        else if (!openID4VCIClientState) {
+            return Promise.reject(Error('Missing openID4VCI client state in context'));
+        }
+        else if (!notificationRequest) {
+            return Promise.reject(Error('Missing notification request'));
+        }
+        logger.log(`Will send notification to ${notificationEndpoint}`, notificationRequest);
+        const client = await OpenID4VCIClient.fromState({ state: openID4VCIClientState });
+        await client.sendNotification({ notificationEndpoint }, notificationRequest, openID4VCIClientState?.accessTokenResponse?.access_token);
+        logger.log(`Notification to ${notificationEndpoint} has been dispatched`);
     }
-    getFederationTrust(args, context) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const { requestData, serverMetadata, trustAnchors } = args;
-            if (trustAnchors.length === 0) {
-                return Promise.reject(Error('No trust anchors found'));
-            }
-            if (!(requestData === null || requestData === void 0 ? void 0 : requestData.uri)) {
-                return Promise.reject(Error('Missing request URI in context'));
-            }
-            if (!serverMetadata) {
-                return Promise.reject(Error('Missing serverMetadata in context'));
-            }
-            const url = new URL(requestData === null || requestData === void 0 ? void 0 : requestData.uri);
-            const params = new URLSearchParams(url.search);
-            const openidFederation = params.get('openid_federation');
-            const entityIdentifier = openidFederation !== null && openidFederation !== void 0 ? openidFederation : serverMetadata.issuer;
-            const result = yield context.agent.identifierExternalResolveByOIDFEntityId({
-                method: 'entity_id',
-                trustAnchors: trustAnchors,
-                identifier: entityIdentifier,
-            });
-            return result.trustedAnchors;
+    async getFederationTrust(args, context) {
+        const { requestData, serverMetadata, trustAnchors } = args;
+        if (trustAnchors.length === 0) {
+            return Promise.reject(Error('No trust anchors found'));
+        }
+        if (!requestData?.uri) {
+            return Promise.reject(Error('Missing request URI in context'));
+        }
+        if (!serverMetadata) {
+            return Promise.reject(Error('Missing serverMetadata in context'));
+        }
+        const url = new URL(requestData?.uri);
+        const params = new URLSearchParams(url.search);
+        const openidFederation = params.get('openid_federation');
+        const entityIdentifier = openidFederation ?? serverMetadata.issuer;
+        if (entityIdentifier.startsWith('http://')) {
+            console.warn(`OpenID federation does not support http://, only https:// allowed; got: (${url.toString()})`);
+            // OIDF always needs to be https
+            return [];
+        }
+        const result = await context.agent.identifierExternalResolveByOIDFEntityId({
+            method: 'entity_id',
+            trustAnchors: trustAnchors,
+            identifier: entityIdentifier,
         });
+        return result.trustedAnchors;
     }
-    oid4vciHolderGetIssuerMetadata(args, context) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const { issuer, errorOnNotFound = true } = args;
-            return oid4vci_client_1.MetadataClient.retrieveAllMetadata(issuer, { errorOnNotFound });
-        });
+    async oid4vciHolderGetIssuerMetadata(args, context) {
+        const { issuer, errorOnNotFound = true } = args;
+        return MetadataClient.retrieveAllMetadata(issuer, { errorOnNotFound });
     }
     determineSubjectCorrelation(identifier, issuer) {
         switch (identifier.method) {
             case 'did':
-                if ((0, ssi_sdk_ext_identifier_resolution_1.isManagedIdentifierResult)(identifier) && (0, ssi_sdk_ext_identifier_resolution_1.isManagedIdentifierDidResult)(identifier)) {
-                    return [ssi_sdk_data_store_1.CredentialCorrelationType.DID, identifier.did];
+                if (isManagedIdentifierResult(identifier) && isManagedIdentifierDidResult(identifier)) {
+                    return [CredentialCorrelationType.DID, identifier.did];
                 }
-                else if ((0, ssi_sdk_ext_identifier_resolution_1.isManagedIdentifierDidOpts)(identifier)) {
-                    return [ssi_sdk_data_store_1.CredentialCorrelationType.DID, typeof identifier.identifier === 'string' ? identifier.identifier : identifier.identifier.did];
+                else if (isManagedIdentifierDidOpts(identifier)) {
+                    return [CredentialCorrelationType.DID, typeof identifier.identifier === 'string' ? identifier.identifier : identifier.identifier.did];
                 }
                 break;
             case 'kid':
-                if ((0, ssi_sdk_ext_identifier_resolution_1.isManagedIdentifierResult)(identifier) && (0, ssi_sdk_ext_identifier_resolution_1.isManagedIdentifierKidResult)(identifier)) {
-                    return [ssi_sdk_data_store_1.CredentialCorrelationType.KID, identifier.kid];
+                if (isManagedIdentifierResult(identifier) && isManagedIdentifierKidResult(identifier)) {
+                    return [CredentialCorrelationType.KID, identifier.kid];
                 }
-                else if ((0, ssi_sdk_ext_identifier_resolution_1.isManagedIdentifierDidOpts)(identifier)) {
-                    return [ssi_sdk_data_store_1.CredentialCorrelationType.KID, identifier.identifier];
+                else if (isManagedIdentifierDidOpts(identifier)) {
+                    return [CredentialCorrelationType.KID, identifier.identifier];
                 }
                 break;
             case 'x5c':
-                if ((0, ssi_sdk_ext_identifier_resolution_1.isManagedIdentifierResult)(identifier) && (0, ssi_sdk_ext_identifier_resolution_1.isManagedIdentifierX5cResult)(identifier)) {
-                    return [ssi_sdk_data_store_1.CredentialCorrelationType.X509_SAN, identifier.x5c.join('\r\n')];
+                if (isManagedIdentifierResult(identifier) && isManagedIdentifierX5cResult(identifier)) {
+                    return [CredentialCorrelationType.X509_SAN, identifier.x5c.join('\r\n')];
                 }
-                else if ((0, ssi_sdk_ext_identifier_resolution_1.isManagedIdentifierX5cOpts)(identifier)) {
-                    return [ssi_sdk_data_store_1.CredentialCorrelationType.X509_SAN, identifier.identifier.join('\r\n')];
+                else if (isManagedIdentifierX5cOpts(identifier)) {
+                    return [CredentialCorrelationType.X509_SAN, identifier.identifier.join('\r\n')];
                 }
                 break;
         }
-        return [ssi_sdk_data_store_1.CredentialCorrelationType.URL, issuer];
+        return [CredentialCorrelationType.URL, issuer];
     }
     idFromW3cCredentialSubject(wrappedIssuerVC) {
-        var _a, _b, _c, _d, _e;
-        if (Array.isArray((_a = wrappedIssuerVC.credential) === null || _a === void 0 ? void 0 : _a.credentialSubject)) {
-            if (((_b = wrappedIssuerVC.credential) === null || _b === void 0 ? void 0 : _b.credentialSubject.length) > 0) {
-                return (_c = wrappedIssuerVC.credential) === null || _c === void 0 ? void 0 : _c.credentialSubject[0].id;
+        if (Array.isArray(wrappedIssuerVC.credential?.credentialSubject)) {
+            if (wrappedIssuerVC.credential?.credentialSubject.length > 0) {
+                return wrappedIssuerVC.credential?.credentialSubject[0].id;
             }
         }
         else {
-            return (_e = (_d = wrappedIssuerVC.credential) === null || _d === void 0 ? void 0 : _d.credentialSubject) === null || _e === void 0 ? void 0 : _e.id;
+            return wrappedIssuerVC.credential?.credentialSubject?.id;
+        }
+        return undefined;
+    }
+    getCredentialDefinition(issuanceOpt) {
+        if (issuanceOpt.format == 'ldp_vc' || issuanceOpt.format == 'jwt_vc_json-ld') {
+            return issuanceOpt.credential_definition;
         }
         return undefined;
     }
 }
-exports.OID4VCIHolder = OID4VCIHolder;
-OID4VCIHolder.DEFAULT_MOBILE_REDIRECT_URI = `${oid4vci_common_1.DefaultURISchemes.CREDENTIAL_OFFER}://`;
 //# sourceMappingURL=OID4VCIHolder.js.map