@sphereon/ssi-sdk.oid4vci-holder 0.33.1-feature.vcdm2.4 → 0.33.1-feature.vcdm2.tsup.19

package/dist/agent/OID4VCIHolder.js

@@ -1,882 +0,0 @@
-import { CredentialOfferClient, MetadataClient, OpenID4VCIClient } from '@sphereon/oid4vci-client';
-import { DefaultURISchemes, getTypesFromAuthorizationDetails, getTypesFromCredentialOffer, getTypesFromObject, } from '@sphereon/oid4vci-common';
-import { SupportedDidMethodEnum } from '@sphereon/ssi-sdk-ext.did-utils';
-import { isManagedIdentifierDidOpts, isManagedIdentifierDidResult, isManagedIdentifierJwkResult, isManagedIdentifierKidResult, isManagedIdentifierResult, isManagedIdentifierX5cOpts, isManagedIdentifierX5cResult, } from '@sphereon/ssi-sdk-ext.identifier-resolution';
-import { signatureAlgorithmFromKey } from '@sphereon/ssi-sdk-ext.key-utils';
-import { ConnectionType, CorrelationIdentifierType, CredentialCorrelationType, CredentialRole, ensureRawDocument, IdentityOrigin, } from '@sphereon/ssi-sdk.data-store';
-import { CredentialMapper, JoseSignatureAlgorithm, Loggers, parseDid, } from '@sphereon/ssi-types';
-import { asArray, computeEntryHash } from '@veramo/utils';
-import { decodeJWT } from 'did-jwt';
-import { v4 as uuidv4 } from 'uuid';
-import { OID4VCIMachine } from '../machines/oid4vciMachine';
-import { OID4VCIHolderEvent, OID4VCIMachineServices, RequestType, } from '../types/IOID4VCIHolder';
-import { getBasicIssuerLocaleBranding, getCredentialBranding, getCredentialConfigsSupportedMerged, getIdentifierOpts, getIssuanceOpts, mapCredentialToAccept, selectCredentialLocaleBranding, startFirstPartApplicationMachine, verifyCredentialToAccept, } from '../services/OID4VCIHolderService';
-import 'cross-fetch/polyfill';
-import { defaultHasher } from '@sphereon/ssi-sdk.core';
-/**
- * {@inheritDoc IOID4VCIHolder}
- */
-// Exposing the methods here for any REST implementation
-export const oid4vciHolderContextMethods = [
-    'cmGetContacts',
-    'cmGetContact',
-    'cmAddContact',
-    'cmAddIdentity',
-    'ibCredentialLocaleBrandingFrom',
-    'ibAddCredentialBranding',
-    'dataStoreSaveVerifiableCredential',
-    'didManagerFind',
-    'didManagerGet',
-    'keyManagerSign',
-    'verifyCredential',
-];
-const logger = Loggers.DEFAULT.get('sphereon:oid4vci:holder');
-export function signCallback(identifier, context, nonce) {
-    return async (jwt, kid) => {
-        let resolution = await context.agent.identifierManagedGet(identifier);
-        const jwk = jwt.header.jwk ?? (resolution.method === 'jwk' ? resolution.jwk : undefined);
-        if (!resolution.issuer && !jwt.payload.iss) {
-            return Promise.reject(Error(`No issuer could be determined from the JWT ${JSON.stringify(jwt)} or identifier resolution`));
-        }
-        const header = jwt.header;
-        const payload = jwt.payload;
-        if (nonce) {
-            payload.nonce = nonce;
-        }
-        if (jwk && header.kid) {
-            console.log(`Deleting kid, as we are using a jwk and the oid4vci spec does not allow both to be present (which is not the case in the JOSE spec)`);
-            delete header.kid; // The OID4VCI spec does not allow a JWK with kid present although the JWS spec does
-        }
-        return (await context.agent.jwtCreateJwsCompactSignature({
-            issuer: { ...resolution, noIssPayloadUpdate: false },
-            protectedHeader: header,
-            payload,
-        })).jwt;
-    };
-}
-export async function verifyEBSICredentialIssuer(args) {
-    const { wrappedVc, issuerType = ['TI'] } = args;
-    const issuer = wrappedVc.decoded?.iss ??
-        (typeof wrappedVc.decoded?.vc?.issuer === 'string' ? wrappedVc.decoded?.vc?.issuer : wrappedVc.decoded?.vc?.issuer?.existingInstanceId);
-    if (!issuer) {
-        throw Error('The issuer of the VC is required to be present');
-    }
-    const url = `https://api-conformance.ebsi.eu/trusted-issuers-registry/v4/issuers/${issuer}`;
-    const response = await fetch(url);
-    if (response.status !== 200) {
-        throw Error('The issuer of the VC cannot be trusted');
-    }
-    const payload = await response.json();
-    if (!payload.attributes.some((a) => issuerType.includes(a.issuerType))) {
-        throw Error(`The issuer type is required to be one of: ${issuerType.join(', ')}`);
-    }
-    return payload;
-}
-export class OID4VCIHolder {
-    hasher;
-    eventTypes = [
-        OID4VCIHolderEvent.CONTACT_IDENTITY_CREATED,
-        OID4VCIHolderEvent.CREDENTIAL_STORED,
-        OID4VCIHolderEvent.IDENTIFIER_CREATED,
-    ];
-    methods = {
-        oid4vciHolderStart: this.oid4vciHolderStart.bind(this),
-        oid4vciHolderGetIssuerMetadata: this.oid4vciHolderGetIssuerMetadata.bind(this),
-        oid4vciHolderGetMachineInterpreter: this.oid4vciHolderGetMachineInterpreter.bind(this),
-        oid4vciHolderCreateCredentialsToSelectFrom: this.oid4vciHolderCreateCredentialsToSelectFrom.bind(this),
-        oid4vciHolderGetContact: this.oid4vciHolderGetContact.bind(this),
-        oid4vciHolderGetCredentials: this.oid4vciHolderGetCredentials.bind(this),
-        oid4vciHolderGetCredential: this.oid4vciHolderGetCredential.bind(this),
-        oid4vciHolderAddContactIdentity: this.oid4vciHolderAddContactIdentity.bind(this),
-        oid4vciHolderAssertValidCredentials: this.oid4vciHolderAssertValidCredentials.bind(this),
-        oid4vciHolderStoreCredentialBranding: this.oid4vciHolderStoreCredentialBranding.bind(this),
-        oid4vciHolderStoreCredentials: this.oid4vciHolderStoreCredentials.bind(this),
-        oid4vciHolderSendNotification: this.oid4vciHolderSendNotification.bind(this),
-        oid4vciHolderGetIssuerBranding: this.oid4vciHolderGetIssuerBranding.bind(this),
-        oid4vciHolderStoreIssuerBranding: this.oid4vciHolderStoreIssuerBranding.bind(this),
-    };
-    vcFormatPreferences = ['vc+sd-jwt', 'mso_mdoc', 'jwt_vc_json', 'jwt_vc', 'ldp_vc'];
-    jsonldCryptographicSuitePreferences = [
-        'Ed25519Signature2018',
-        'EcdsaSecp256k1Signature2019',
-        'Ed25519Signature2020',
-        'JsonWebSignature2020',
-        // "JcsEd25519Signature2020"
-    ];
-    didMethodPreferences = [
-        SupportedDidMethodEnum.DID_JWK, // FIXME prefer JWK until we devise a method to detect when to use EBSI/jcs for did:key and when not
-        SupportedDidMethodEnum.DID_KEY,
-        SupportedDidMethodEnum.DID_OYD,
-        SupportedDidMethodEnum.DID_EBSI,
-        SupportedDidMethodEnum.DID_ION,
-    ];
-    jwtCryptographicSuitePreferences = [
-        JoseSignatureAlgorithm.ES256,
-        JoseSignatureAlgorithm.ES256K,
-        JoseSignatureAlgorithm.EdDSA,
-    ];
-    static DEFAULT_MOBILE_REDIRECT_URI = `${DefaultURISchemes.CREDENTIAL_OFFER}://`;
-    defaultAuthorizationRequestOpts = { redirectUri: OID4VCIHolder.DEFAULT_MOBILE_REDIRECT_URI };
-    onContactIdentityCreated;
-    onCredentialStored;
-    onIdentifierCreated;
-    onVerifyEBSICredentialIssuer;
-    constructor(options) {
-        const { onContactIdentityCreated, onCredentialStored, onIdentifierCreated, onVerifyEBSICredentialIssuer, vcFormatPreferences, jsonldCryptographicSuitePreferences, didMethodPreferences, jwtCryptographicSuitePreferences, defaultAuthorizationRequestOptions, hasher = defaultHasher, } = { ...options };
-        this.hasher = hasher;
-        if (vcFormatPreferences !== undefined && vcFormatPreferences.length > 0) {
-            this.vcFormatPreferences = vcFormatPreferences;
-        }
-        if (jsonldCryptographicSuitePreferences !== undefined && jsonldCryptographicSuitePreferences.length > 0) {
-            this.jsonldCryptographicSuitePreferences = jsonldCryptographicSuitePreferences;
-        }
-        if (didMethodPreferences !== undefined && didMethodPreferences.length > 0) {
-            this.didMethodPreferences = didMethodPreferences;
-        }
-        if (jwtCryptographicSuitePreferences !== undefined && jwtCryptographicSuitePreferences.length > 0) {
-            this.jwtCryptographicSuitePreferences = jwtCryptographicSuitePreferences;
-        }
-        if (defaultAuthorizationRequestOptions) {
-            this.defaultAuthorizationRequestOpts = defaultAuthorizationRequestOptions;
-        }
-        this.onContactIdentityCreated = onContactIdentityCreated;
-        this.onCredentialStored = onCredentialStored;
-        this.onIdentifierCreated = onIdentifierCreated;
-        this.onVerifyEBSICredentialIssuer = onVerifyEBSICredentialIssuer;
-    }
-    async onEvent(event, context) {
-        switch (event.type) {
-            case OID4VCIHolderEvent.CONTACT_IDENTITY_CREATED:
-                this.onContactIdentityCreated?.(event.data);
-                break;
-            case OID4VCIHolderEvent.CREDENTIAL_STORED:
-                this.onCredentialStored?.(event.data);
-                break;
-            case OID4VCIHolderEvent.IDENTIFIER_CREATED:
-                this.onIdentifierCreated?.(event.data);
-                break;
-            default:
-                return Promise.reject(Error(`Event type ${event.type} not supported`));
-        }
-    }
-    /**
-     * FIXME: This method can only be used locally. Creating the interpreter should be local to where the agent is running
-     */
-    async oid4vciHolderGetMachineInterpreter(opts, context) {
-        const authorizationRequestOpts = { ...this.defaultAuthorizationRequestOpts, ...opts.authorizationRequestOpts };
-        const services = {
-            [OID4VCIMachineServices.start]: (args) => this.oid4vciHolderStart({
-                ...args,
-                authorizationRequestOpts,
-            }, context),
-            [OID4VCIMachineServices.startFirstPartApplicationFlow]: (args) => startFirstPartApplicationMachine({ ...args, stateNavigationListener: opts.firstPartyStateNavigationListener }, context),
-            [OID4VCIMachineServices.createCredentialsToSelectFrom]: (args) => this.oid4vciHolderCreateCredentialsToSelectFrom(args, context),
-            [OID4VCIMachineServices.getContact]: (args) => this.oid4vciHolderGetContact(args, context),
-            [OID4VCIMachineServices.getCredentials]: (args) => this.oid4vciHolderGetCredentials({ accessTokenOpts: args.accessTokenOpts ?? opts.accessTokenOpts, ...args }, context),
-            [OID4VCIMachineServices.addContactIdentity]: (args) => this.oid4vciHolderAddContactIdentity(args, context),
-            [OID4VCIMachineServices.getIssuerBranding]: (args) => this.oid4vciHolderGetIssuerBranding(args, context),
-            [OID4VCIMachineServices.storeIssuerBranding]: (args) => this.oid4vciHolderStoreIssuerBranding(args, context),
-            [OID4VCIMachineServices.assertValidCredentials]: (args) => this.oid4vciHolderAssertValidCredentials(args, context),
-            [OID4VCIMachineServices.storeCredentialBranding]: (args) => this.oid4vciHolderStoreCredentialBranding(args, context),
-            [OID4VCIMachineServices.storeCredentials]: (args) => this.oid4vciHolderStoreCredentials(args, context),
-            [OID4VCIMachineServices.sendNotification]: (args) => this.oid4vciHolderSendNotification(args, context),
-            [OID4VCIMachineServices.getFederationTrust]: (args) => this.getFederationTrust(args, context),
-        };
-        const oid4vciMachineInstanceArgs = {
-            ...opts,
-            authorizationRequestOpts,
-            services: {
-                ...services,
-                ...opts.services,
-            },
-        };
-        const { interpreter } = await OID4VCIMachine.newInstance(oid4vciMachineInstanceArgs, context);
-        return {
-            interpreter,
-        };
-    }
-    /**
-     * This method is run before the machine starts! So there is no concept of the state machine context or states yet
-     *
-     * The result of this method can be directly passed into the start method of the state machine
-     * @param args
-     * @param context
-     * @private
-     */
-    async oid4vciHolderStart(args, context) {
-        const { requestData } = args;
-        if (!requestData) {
-            throw Error(`Cannot start the OID4VCI holder flow without request data being provided`);
-        }
-        const { uri = undefined } = requestData;
-        if (!uri) {
-            return Promise.reject(Error('Missing request URI in context'));
-        }
-        const authorizationRequestOpts = { ...this.defaultAuthorizationRequestOpts, ...args.authorizationRequestOpts };
-        // We filter the details first against our vcformat prefs
-        authorizationRequestOpts.authorizationDetails = authorizationRequestOpts?.authorizationDetails
-            ? asArray(authorizationRequestOpts.authorizationDetails).filter((detail) => typeof detail === 'string' || this.vcFormatPreferences.includes(detail.format))
-            : undefined;
-        if (!authorizationRequestOpts.redirectUri) {
-            authorizationRequestOpts.redirectUri = OID4VCIHolder.DEFAULT_MOBILE_REDIRECT_URI;
-        }
-        if (authorizationRequestOpts.redirectUri.startsWith('http') && !authorizationRequestOpts.clientId) {
-            // At least set a default for a web based wallet.
-            // TODO: We really need (dynamic) client registration support
-            authorizationRequestOpts.clientId = authorizationRequestOpts.redirectUri;
-        }
-        let formats = this.vcFormatPreferences;
-        const authFormats = authorizationRequestOpts?.authorizationDetails
-            ?.map((detail) => (typeof detail === 'object' && 'format' in detail && detail.format ? detail.format : undefined))
-            .filter((format) => !!format)
-            .map((format) => format);
-        if (authFormats && authFormats.length > 0) {
-            formats = Array.from(new Set(authFormats));
-        }
-        let oid4vciClient;
-        let types = undefined;
-        let offer;
-        if (requestData.existingClientState) {
-            oid4vciClient = await OpenID4VCIClient.fromState({ state: requestData.existingClientState });
-            offer = oid4vciClient.credentialOffer;
-        }
-        else {
-            offer = requestData.credentialOffer;
-            if (uri.startsWith(RequestType.OPENID_INITIATE_ISSUANCE) ||
-                uri.startsWith(RequestType.OPENID_CREDENTIAL_OFFER) ||
-                uri.match(/https?:\/\/.*credential_offer(_uri)=?.*/)) {
-                if (!offer) {
-                    // Let's make sure to convert the URI to offer, as it matches the regexes. Normally this should already have happened at this point though
-                    offer = await CredentialOfferClient.fromURI(uri);
-                }
-            }
-            else {
-                if (!!offer) {
-                    logger.warning(`Non default URI used for credential offer: ${uri}`);
-                }
-            }
-            if (!offer) {
-                // else no offer, meaning we have an issuer URL
-                logger.log(`Issuer url received (no credential offer): ${uri}`);
-                oid4vciClient = await OpenID4VCIClient.fromCredentialIssuer({
-                    credentialIssuer: uri,
-                    authorizationRequest: authorizationRequestOpts,
-                    clientId: authorizationRequestOpts.clientId,
-                    createAuthorizationRequestURL: requestData.createAuthorizationRequestURL ?? true,
-                });
-            }
-            else {
-                logger.log(`Credential offer received: ${uri}`);
-                oid4vciClient = await OpenID4VCIClient.fromURI({
-                    uri,
-                    authorizationRequest: authorizationRequestOpts,
-                    clientId: authorizationRequestOpts.clientId,
-                    createAuthorizationRequestURL: requestData.createAuthorizationRequestURL ?? true,
-                });
-            }
-        }
-        if (offer) {
-            types = getTypesFromCredentialOffer(offer.original_credential_offer);
-        }
-        else {
-            types = asArray(authorizationRequestOpts.authorizationDetails)
-                .map((authReqOpts) => getTypesFromAuthorizationDetails(authReqOpts) ?? [])
-                .filter((inner) => inner.length > 0);
-        }
-        const serverMetadata = await oid4vciClient.retrieveServerMetadata();
-        const credentialsSupported = await getCredentialConfigsSupportedMerged({
-            client: oid4vciClient,
-            vcFormatPreferences: formats,
-            types,
-        });
-        const credentialBranding = await getCredentialBranding({ credentialsSupported, context });
-        const authorizationCodeURL = oid4vciClient.authorizationURL;
-        if (authorizationCodeURL) {
-            logger.log(`authorization code URL ${authorizationCodeURL}`);
-        }
-        const oid4vciClientState = JSON.parse(await oid4vciClient.exportState());
-        return {
-            authorizationCodeURL,
-            credentialBranding,
-            credentialsSupported,
-            serverMetadata,
-            oid4vciClientState,
-        };
-    }
-    async oid4vciHolderCreateCredentialsToSelectFrom(args, context) {
-        const { credentialBranding, locale, selectedCredentials /*, openID4VCIClientState*/, credentialsSupported } = args;
-        // const client = await OpenID4VCIClient.fromState({ state: openID4VCIClientState! }) // TODO see if we need the check openID4VCIClientState defined
-        /*const credentialsSupported = await getCredentialConfigsSupportedBySingleTypeOrId({
-                                  client,
-                                  vcFormatPreferences: this.vcFormatPreferences,
-                                })*/
-        logger.info(`Credentials supported ${Object.keys(credentialsSupported).join(', ')}`);
-        const credentialSelection = await Promise.all(Object.entries(credentialsSupported).map(async ([id, credentialConfigSupported]) => {
-            // FIXME this allows for duplicate VerifiableCredential, which the user has no idea which ones those are and we also have a branding map with unique keys, so some branding will not match
-            // const defaultCredentialType = 'VerifiableCredential'
-            const credentialTypes = getTypesFromObject(credentialConfigSupported);
-            // const credentialType = id /*?? credentialTypes?.find((type) => type !== defaultCredentialType) ?? defaultCredentialType*/
-            const localeBranding = !credentialBranding
-                ? undefined
-                : (credentialBranding?.[id] ??
-                    Object.entries(credentialBranding)
-                        .find(([type, _brandings]) => {
-                        credentialTypes && type in credentialTypes;
-                    })
-                        ?.map(([type, supported]) => supported));
-            const credentialAlias = (await selectCredentialLocaleBranding({
-                locale,
-                localeBranding,
-            }))?.alias;
-            return {
-                id: uuidv4(),
-                credentialId: id,
-                credentialTypes: credentialTypes ?? asArray(id),
-                credentialAlias: credentialAlias ?? id,
-                isSelected: false,
-            };
-        }));
-        // TODO find better place to do this, would be nice if the machine does this?
-        if (credentialSelection.length >= 1) {
-            credentialSelection.map((sel) => selectedCredentials.push(sel.credentialId));
-        }
-        logger.log(`Credential selection ${JSON.stringify(credentialSelection)}`);
-        return credentialSelection;
-    }
-    async oid4vciHolderGetContact(args, context) {
-        const { serverMetadata } = args;
-        if (serverMetadata === undefined) {
-            return Promise.reject(Error('Missing serverMetadata in context'));
-        }
-        const names = new Set(serverMetadata.credentialIssuerMetadata?.display
-            ?.map((display) => display.name)
-            .filter((name) => name != undefined)
-            .map((name) => name) ?? []);
-        const name = names.size > 0 ? Array.from(names)[0] : undefined;
-        const correlationId = new URL(serverMetadata.issuer).hostname;
-        const filter = [
-            {
-                identities: {
-                    identifier: {
-                        correlationId,
-                    },
-                },
-            },
-        ];
-        if (name) {
-            filter.push({
-                contact: {
-                    legalName: name,
-                },
-            });
-            filter.push({
-                contact: {
-                    displayName: name,
-                },
-            });
-        }
-        const parties = await context.agent.cmGetContacts({
-            filter,
-        });
-        if (parties.length > 1) {
-            logger.warning(`Get contacts returned more than one result: ${parties.length}, ${parties.map((party) => party.contact.displayName).join(',')}`);
-        }
-        const party = parties.length >= 1 ? parties[0] : undefined;
-        logger.log(`Party involved: `, party);
-        return party;
-    }
-    async oid4vciHolderGetCredentials(args, context) {
-        const { verificationCode, openID4VCIClientState, didMethodPreferences = this.didMethodPreferences, issuanceOpt, accessTokenOpts } = args;
-        logger.debug(`Getting credentials`, issuanceOpt, accessTokenOpts);
-        if (!openID4VCIClientState) {
-            return Promise.reject(Error('Missing openID4VCI client state in context'));
-        }
-        const client = await OpenID4VCIClient.fromState({ state: openID4VCIClientState });
-        const credentialsSupported = await getCredentialConfigsSupportedMerged({
-            client,
-            vcFormatPreferences: this.vcFormatPreferences,
-            configurationIds: args.selectedCredentials,
-        });
-        const serverMetadata = await client.retrieveServerMetadata();
-        const issuanceOpts = await getIssuanceOpts({
-            client,
-            credentialsSupported,
-            serverMetadata,
-            context,
-            didMethodPreferences: Array.isArray(didMethodPreferences) && didMethodPreferences.length > 0 ? didMethodPreferences : this.didMethodPreferences,
-            jwtCryptographicSuitePreferences: this.jwtCryptographicSuitePreferences,
-            jsonldCryptographicSuitePreferences: this.jsonldCryptographicSuitePreferences,
-            ...(issuanceOpt && { forceIssuanceOpt: issuanceOpt }),
-        });
-        const getCredentials = issuanceOpts.map(async (issuanceOpt) => await this.oid4vciHolderGetCredential({
-            issuanceOpt,
-            pin: verificationCode,
-            client,
-            accessTokenOpts,
-        }, context));
-        const allCredentials = await Promise.all(getCredentials);
-        logger.log(`Credentials received`, allCredentials);
-        return allCredentials;
-    }
-    async oid4vciHolderGetCredential(args, context) {
-        const { issuanceOpt, pin, client, accessTokenOpts } = args;
-        logger.info(`Getting credential`, issuanceOpt);
-        if (!issuanceOpt) {
-            return Promise.reject(Error(`Cannot get credential issuance options`));
-        }
-        const identifier = await getIdentifierOpts({ issuanceOpt, context });
-        issuanceOpt.identifier = identifier;
-        logger.info(`ID opts`, identifier);
-        const alg = await signatureAlgorithmFromKey({ key: identifier.key });
-        // The VCI lib either expects a jwk or a kid
-        const jwk = isManagedIdentifierJwkResult(identifier) ? identifier.jwk : undefined;
-        const callbacks = {
-            signCallback: signCallback(identifier, context),
-        };
-        try {
-            // We need to make sure we have acquired the access token
-            if (!client.clientId) {
-                client.clientId = isManagedIdentifierDidResult(identifier) ? identifier.did : identifier.issuer;
-            }
-            let asOpts = undefined;
-            let kid = accessTokenOpts?.clientOpts?.kid ?? identifier.kid;
-            if (accessTokenOpts?.clientOpts) {
-                const clientId = accessTokenOpts.clientOpts.clientId ?? client.clientId ?? identifier.issuer;
-                if (client.isEBSI() && clientId?.startsWith('http') && kid?.includes('#')) {
-                    kid = kid.split('#')[1];
-                }
-                //todo: investigate if the jwk should be used here as well if present
-                const clientOpts = {
-                    ...accessTokenOpts.clientOpts,
-                    clientId,
-                    kid,
-                    // @ts-ignore
-                    alg: accessTokenOpts.clientOpts.alg ?? alg,
-                    signCallbacks: accessTokenOpts.clientOpts.signCallbacks ?? callbacks,
-                };
-                asOpts = {
-                    clientOpts,
-                };
-            }
-            await client.acquireAccessToken({
-                clientId: client.clientId,
-                pin,
-                authorizationResponse: JSON.parse(await client.exportState()).authorizationCodeResponse,
-                additionalRequestParams: accessTokenOpts?.additionalRequestParams,
-                ...(asOpts && { asOpts }),
-            });
-            // FIXME: This type mapping is wrong. It should use credential_identifier in case the access token response has authorization details
-            const types = getTypesFromObject(issuanceOpt);
-            const id = 'id' in issuanceOpt && issuanceOpt.id ? issuanceOpt.id : undefined;
-            const credentialTypes = asArray(issuanceOpt.credentialConfigurationId ?? types ?? id);
-            if (!credentialTypes || credentialTypes.length === 0) {
-                return Promise.reject(Error('cannot determine credential id to request'));
-            }
-            const credentialDefinition = this.getCredentialDefinition(issuanceOpt);
-            const credentialResponse = await client.acquireCredentials({
-                ...(credentialDefinition && { context: credentialDefinition['@context'] }),
-                credentialTypes,
-                proofCallbacks: callbacks,
-                format: issuanceOpt.format,
-                // TODO: We need to update the machine and add notifications support for actual deferred credentials instead of just waiting/retrying
-                deferredCredentialAwait: true,
-                ...(!jwk && { kid }), // vci client either wants a jwk or kid. If we have used the jwk method do not provide the kid
-                jwk,
-                alg,
-                jti: uuidv4(),
-            });
-            const credential = {
-                id: issuanceOpt.credentialConfigurationId ?? id,
-                types: types ?? asArray(credentialTypes),
-                issuanceOpt,
-                credentialResponse,
-            };
-            return mapCredentialToAccept({ credentialToAccept: credential, hasher: this.hasher });
-        }
-        catch (error) {
-            return Promise.reject(error);
-        }
-    }
-    async oid4vciHolderAddContactIdentity(args, context) {
-        const { credentialsToAccept, contact } = args;
-        if (!contact) {
-            return Promise.reject(Error('Missing contact in context'));
-        }
-        if (credentialsToAccept === undefined || credentialsToAccept.length === 0) {
-            return Promise.reject(Error('Missing credential offers in context'));
-        }
-        let correlationId = credentialsToAccept[0].correlationId;
-        let identifierType = CorrelationIdentifierType.DID;
-        if (!correlationId.toLowerCase().startsWith('did:')) {
-            identifierType = CorrelationIdentifierType.URL;
-            if (correlationId.startsWith('http')) {
-                correlationId = new URL(correlationId).hostname;
-            }
-        }
-        const identity = {
-            alias: credentialsToAccept[0].correlationId,
-            origin: IdentityOrigin.EXTERNAL,
-            roles: [CredentialRole.ISSUER],
-            identifier: {
-                type: identifierType,
-                correlationId,
-            },
-            ...(identifierType === CorrelationIdentifierType.URL && {
-                connection: {
-                    type: ConnectionType.OPENID_CONNECT,
-                    config: {
-                        clientId: '138d7bf8-c930-4c6e-b928-97d3a4928b01',
-                        clientSecret: '03b3955f-d020-4f2a-8a27-4e452d4e27a0',
-                        scopes: ['auth'],
-                        issuer: 'https://example.com/app-test',
-                        redirectUrl: 'app:/callback',
-                        dangerouslyAllowInsecureHttpRequests: true,
-                        clientAuthMethod: 'post',
-                    },
-                },
-            }),
-        };
-        await context.agent.emit(OID4VCIHolderEvent.CONTACT_IDENTITY_CREATED, {
-            contactId: contact.id,
-            identity,
-        });
-        logger.log(`Contact added: ${correlationId}`);
-        return context.agent.cmAddIdentity({ contactId: contact.id, identity });
-    }
-    async oid4vciHolderGetIssuerBranding(args, context) {
-        const { serverMetadata, contact } = args;
-        // Here we are fetching issuer branding for a contact. If no contact is found that means we encounter this contact for the first time. This also means we do not have any branding for the contact.
-        const issuerCorrelationId = contact?.identities
-            .filter((identity) => identity.roles.includes(CredentialRole.ISSUER))
-            .map((identity) => identity.identifier.correlationId)[0];
-        if (issuerCorrelationId) {
-            const branding = await context.agent.ibGetIssuerBranding({ filter: [{ issuerCorrelationId }] });
-            if (branding.length > 0) {
-                return branding[0].localeBranding;
-            }
-        }
-        // We should have serverMetadata in the context else something went wrong
-        if (!serverMetadata) {
-            return Promise.reject(Error('Missing serverMetadata in context'));
-        }
-        return getBasicIssuerLocaleBranding({
-            display: serverMetadata.credentialIssuerMetadata?.display ?? [],
-            dynamicRegistrationClientMetadata: serverMetadata.credentialIssuerMetadata,
-            context,
-        });
-    }
-    async oid4vciHolderStoreIssuerBranding(args, context) {
-        const { issuerBranding, contact } = args;
-        if (!issuerBranding || issuerBranding.length === 0 || issuerBranding[0].id) {
-            // FIXME we need better separation between a contact(issuer) we encountered before and it's branding vs a new contact and it's branding
-            return;
-        }
-        if (!contact) {
-            return Promise.reject(Error('Missing contact in context'));
-        }
-        const issuerCorrelationId = contact?.identities
-            .filter((identity) => identity.roles.includes(CredentialRole.ISSUER))
-            .map((identity) => identity.identifier.correlationId)[0];
-        // we check for issuer branding as adding an identity might also trigger storing the issuer branding
-        const branding = await context.agent.ibGetIssuerBranding({ filter: [{ issuerCorrelationId }] });
-        if (branding.length > 0) {
-            return;
-        }
-        await context.agent.ibAddIssuerBranding({
-            localeBranding: issuerBranding,
-            issuerCorrelationId,
-        });
-    }
-    async oid4vciHolderAssertValidCredentials(args, context) {
-        const { credentialsToAccept, issuanceOpt } = args;
-        return await Promise.all(credentialsToAccept.map((credentialToAccept) => verifyCredentialToAccept({
-            mappedCredential: credentialToAccept,
-            onVerifyEBSICredentialIssuer: this.onVerifyEBSICredentialIssuer,
-            hasher: this.hasher,
-            schemaValidation: issuanceOpt?.schemaValidation,
-            context,
-        })));
-    }
-    async oid4vciHolderStoreCredentialBranding(args, context) {
-        const { credentialBranding, serverMetadata, selectedCredentials, credentialsToAccept } = args;
-        if (serverMetadata === undefined) {
-            return Promise.reject(Error('Missing serverMetadata in context'));
-        }
-        else if (selectedCredentials.length === 0) {
-            logger.warning(`No credentials selected for issuer: ${serverMetadata.issuer}`);
-            return;
-        }
-        let counter = 0;
-        for (const credentialId of selectedCredentials) {
-            const localeBranding = credentialBranding?.[credentialId];
-            if (localeBranding && localeBranding.length > 0) {
-                const credential = credentialsToAccept.find((credAccept) => credAccept.credentialToAccept.id === credentialId || JSON.stringify(credAccept.types) === credentialId || credentialsToAccept[counter]);
-                counter++;
-                await context.agent.ibAddCredentialBranding({
-                    vcHash: computeEntryHash(credential.rawVerifiableCredential),
-                    issuerCorrelationId: new URL(serverMetadata.issuer).hostname,
-                    localeBranding,
-                });
-                logger.log(`Credential branding for issuer ${serverMetadata.issuer} and type ${credentialId} stored with locales ${localeBranding.map((b) => b.locale).join(',')}`);
-            }
-            else {
-                logger.warning(`No credential branding found for issuer: ${serverMetadata.issuer} and type ${credentialId}`);
-            }
-        }
-    }
-    async oid4vciHolderStoreCredentials(args, context) {
-        function trimmed(input) {
-            const trim = input?.trim();
-            if (trim === '') {
-                return undefined;
-            }
-            return trim;
-        }
-        const { credentialsToAccept, openID4VCIClientState, credentialsSupported, serverMetadata, selectedCredentials } = args;
-        const mappedCredentialToAccept = credentialsToAccept[0];
-        if (selectedCredentials && selectedCredentials.length > 1) {
-            logger.error(`More than 1 credential selected ${selectedCredentials.join(', ')}, but current service only stores 1 credential!`);
-        }
-        // TODO determine when and how we should store credentials without key kmsKeyRef & id method), this should be tested with the code below
-        const issuanceOpt = args.issuanceOpt ?? mappedCredentialToAccept.credentialToAccept.issuanceOpt;
-        if (!issuanceOpt || !issuanceOpt.identifier) {
-            return Promise.reject(Error('issuanceOpt.identifier must me set in order to store a credential'));
-        }
-        const { kmsKeyRef, method } = issuanceOpt.identifier;
-        let persist = true;
-        const verifiableCredential = mappedCredentialToAccept.uniformVerifiableCredential;
-        const notificationId = mappedCredentialToAccept.credentialToAccept.credentialResponse.notification_id;
-        const subjectIssuance = mappedCredentialToAccept.credential_subject_issuance;
-        const notificationEndpoint = serverMetadata?.credentialIssuerMetadata?.notification_endpoint;
-        let holderCredential = undefined;
-        if (!notificationEndpoint) {
-            logger.log(`Notifications not supported by issuer ${serverMetadata?.issuer}. Will not provide a notification`);
-        }
-        else if (notificationEndpoint && !notificationId) {
-            logger.warning(`Notification endpoint available in issuer metadata with value ${notificationEndpoint}, but no ${notificationId} provided. Will not send a notification to issuer ${serverMetadata?.issuer}`);
-        }
-        else if (notificationEndpoint && notificationId) {
-            logger.log(`Notification id ${notificationId} found, will send back a notification to ${notificationEndpoint}`);
-            let event = 'credential_accepted';
-            if (Array.isArray(subjectIssuance?.notification_events_supported)) {
-                // experimental subject issuance, where a new credential is being created
-                event = subjectIssuance.notification_events_supported.includes('credential_accepted_holder_signed')
-                    ? 'credential_accepted_holder_signed'
-                    : 'credential_deleted_holder_signed';
-                logger.log(`Subject issuance/signing will be used, with event`, event);
-                const issuerVC = mappedCredentialToAccept.credentialToAccept.credentialResponse.credential;
-                const wrappedIssuerVC = CredentialMapper.toWrappedVerifiableCredential(issuerVC, { hasher: this.hasher ?? defaultHasher });
-                console.log(`Wrapped VC: ${wrappedIssuerVC.type}, ${wrappedIssuerVC.format}`);
-                // We will use the subject of the VCI Issuer (the holder, as the issuer of the new credential, so the below is not a mistake!)
-                let issuer;
-                if (CredentialMapper.isWrappedSdJwtVerifiableCredential(wrappedIssuerVC)) {
-                    issuer = trimmed(wrappedIssuerVC.decoded?.sub);
-                }
-                else if (CredentialMapper.isWrappedW3CVerifiableCredential(wrappedIssuerVC)) {
-                    issuer = trimmed(wrappedIssuerVC.credential?.sub) ?? trimmed(this.idFromW3cCredentialSubject(wrappedIssuerVC));
-                }
-                else if (CredentialMapper.isWrappedMdocCredential(wrappedIssuerVC)) {
-                    return Promise.reject(Error('mdoc not yet supported'));
-                }
-                if (!issuer) {
-                    issuer = trimmed(verifiableCredential.credentialSubject?.id);
-                }
-                if (!issuer && openID4VCIClientState?.kid?.startsWith('did:')) {
-                    issuer = parseDid(openID4VCIClientState?.kid).did;
-                }
-                if (!issuer && openID4VCIClientState?.jwk?.kid?.startsWith('did:')) {
-                    issuer = parseDid(openID4VCIClientState.jwk.kid).did;
-                }
-                if (!issuer && openID4VCIClientState?.clientId) {
-                    issuer = trimmed(openID4VCIClientState.clientId);
-                }
-                if (!issuer && openID4VCIClientState?.accessTokenResponse) {
-                    const decodedJwt = decodeJWT(openID4VCIClientState.accessTokenResponse.access_token);
-                    issuer = decodedJwt.payload.sub;
-                }
-                if (!issuer && mappedCredentialToAccept.credentialToAccept.issuanceOpt.identifier) {
-                    const resolution = await context.agent.identifierManagedGet(mappedCredentialToAccept.credentialToAccept.issuanceOpt.identifier);
-                    issuer = resolution.issuer;
-                }
-                if (!issuer) {
-                    throw Error(`We could not determine the issuer, which means we cannot sign the credential`);
-                }
-                logger.log(`Issuer for self-issued credential will be: ${issuer}`);
-                const holderCredentialToSign = wrappedIssuerVC.decoded;
-                let proofFormat = 'lds';
-                if (wrappedIssuerVC.format.includes('jwt') && !wrappedIssuerVC.format.includes('mso_mdoc')) {
-                    holderCredentialToSign.iss = issuer;
-                    proofFormat = 'jwt';
-                }
-                if ('issuer' in holderCredentialToSign && !('iss' in holderCredentialToSign)) {
-                    holderCredentialToSign.issuer = issuer;
-                }
-                if ('sub' in holderCredentialToSign) {
-                    holderCredentialToSign.sub = issuer;
-                }
-                if ('credentialSubject' in holderCredentialToSign && !Array.isArray(holderCredentialToSign.credentialSubject)) {
-                    holderCredentialToSign.credentialSubject.id = issuer;
-                }
-                if ('vc' in holderCredentialToSign) {
-                    if (holderCredentialToSign.vc.credentialSubject) {
-                        holderCredentialToSign.vc.credentialSubject.id = issuer;
-                    }
-                    holderCredentialToSign.vc.issuer = issuer;
-                    delete holderCredentialToSign.vc.proof;
-                    delete holderCredentialToSign.vc.issuanceDate;
-                }
-                delete holderCredentialToSign.proof;
-                delete holderCredentialToSign.issuanceDate;
-                delete holderCredentialToSign.iat;
-                logger.log(`Subject issuance/signing will sign credential of type ${proofFormat}:`, holderCredentialToSign);
-                const issuedVC = await context.agent.createVerifiableCredential({
-                    credential: holderCredentialToSign,
-                    fetchRemoteContexts: true,
-                    save: false,
-                    proofFormat,
-                });
-                if (!issuedVC) {
-                    throw Error(`Could not issue holder credential from the wallet`);
-                }
-                logger.log(`Holder ${issuedVC.issuer} issued new credential with id ${issuedVC.id}`, issuedVC);
-                holderCredential = CredentialMapper.storedCredentialToOriginalFormat(issuedVC);
-                persist = event === 'credential_accepted_holder_signed';
-            }
-            const notificationRequest = {
-                notification_id: notificationId,
-                ...(holderCredential && { credential: holderCredential }),
-                event,
-            };
-            await this.oid4vciHolderSendNotification({
-                openID4VCIClientState,
-                stored: persist,
-                credentialsToAccept,
-                credentialsSupported,
-                notificationRequest,
-                serverMetadata,
-            }, context);
-        }
-        const persistCredential = holderCredential
-            ? CredentialMapper.storedCredentialToOriginalFormat(holderCredential)
-            : mappedCredentialToAccept.rawVerifiableCredential;
-        if (!persist && holderCredential) {
-            logger.log(`Will not persist credential, since we are signing as a holder and the issuer asked not to persist`);
-        }
-        else {
-            logger.log(`Persisting credential`, persistCredential);
-            const issuer = CredentialMapper.issuerCorrelationIdFromIssuerType(verifiableCredential.issuer);
-            const [subjectCorrelationType, subjectCorrelationId] = this.determineSubjectCorrelation(issuanceOpt.identifier, issuer);
-            const persistedCredential = await context.agent.crsAddCredential({
-                credential: {
-                    rawDocument: ensureRawDocument(persistCredential),
-                    kmsKeyRef: kmsKeyRef,
-                    identifierMethod: method,
-                    credentialRole: CredentialRole.HOLDER,
-                    issuerCorrelationType: issuer?.startsWith('did:') ? CredentialCorrelationType.DID : CredentialCorrelationType.URL,
-                    issuerCorrelationId: issuer,
-                    subjectCorrelationType,
-                    subjectCorrelationId,
-                },
-            });
-            await context.agent.emit(OID4VCIHolderEvent.CREDENTIAL_STORED, {
-                credential: persistedCredential,
-                vcHash: persistedCredential.hash,
-            });
-        }
-    }
-    async oid4vciHolderSendNotification(args, context) {
-        const { serverMetadata, notificationRequest, openID4VCIClientState } = args;
-        const notificationEndpoint = serverMetadata?.credentialIssuerMetadata?.notification_endpoint;
-        if (!notificationEndpoint) {
-            return;
-        }
-        else if (!openID4VCIClientState) {
-            return Promise.reject(Error('Missing openID4VCI client state in context'));
-        }
-        else if (!notificationRequest) {
-            return Promise.reject(Error('Missing notification request'));
-        }
-        logger.log(`Will send notification to ${notificationEndpoint}`, notificationRequest);
-        const client = await OpenID4VCIClient.fromState({ state: openID4VCIClientState });
-        await client.sendNotification({ notificationEndpoint }, notificationRequest, openID4VCIClientState?.accessTokenResponse?.access_token);
-        logger.log(`Notification to ${notificationEndpoint} has been dispatched`);
-    }
-    async getFederationTrust(args, context) {
-        const { requestData, serverMetadata, trustAnchors } = args;
-        if (trustAnchors.length === 0) {
-            return Promise.reject(Error('No trust anchors found'));
-        }
-        if (!requestData?.uri) {
-            return Promise.reject(Error('Missing request URI in context'));
-        }
-        if (!serverMetadata) {
-            return Promise.reject(Error('Missing serverMetadata in context'));
-        }
-        const url = new URL(requestData?.uri);
-        const params = new URLSearchParams(url.search);
-        const openidFederation = params.get('openid_federation');
-        const entityIdentifier = openidFederation ?? serverMetadata.issuer;
-        if (entityIdentifier.startsWith('http://')) {
-            console.warn(`OpenID federation does not support http://, only https:// allowed; got: (${url.toString()})`);
-            // OIDF always needs to be https
-            return [];
-        }
-        const result = await context.agent.identifierExternalResolveByOIDFEntityId({
-            method: 'entity_id',
-            trustAnchors: trustAnchors,
-            identifier: entityIdentifier,
-        });
-        return result.trustedAnchors;
-    }
-    async oid4vciHolderGetIssuerMetadata(args, context) {
-        const { issuer, errorOnNotFound = true } = args;
-        return MetadataClient.retrieveAllMetadata(issuer, { errorOnNotFound });
-    }
-    determineSubjectCorrelation(identifier, issuer) {
-        switch (identifier.method) {
-            case 'did':
-                if (isManagedIdentifierResult(identifier) && isManagedIdentifierDidResult(identifier)) {
-                    return [CredentialCorrelationType.DID, identifier.did];
-                }
-                else if (isManagedIdentifierDidOpts(identifier)) {
-                    return [CredentialCorrelationType.DID, typeof identifier.identifier === 'string' ? identifier.identifier : identifier.identifier.did];
-                }
-                break;
-            case 'kid':
-                if (isManagedIdentifierResult(identifier) && isManagedIdentifierKidResult(identifier)) {
-                    return [CredentialCorrelationType.KID, identifier.kid];
-                }
-                else if (isManagedIdentifierDidOpts(identifier)) {
-                    return [CredentialCorrelationType.KID, identifier.identifier];
-                }
-                break;
-            case 'x5c':
-                if (isManagedIdentifierResult(identifier) && isManagedIdentifierX5cResult(identifier)) {
-                    return [CredentialCorrelationType.X509_SAN, identifier.x5c.join('\r\n')];
-                }
-                else if (isManagedIdentifierX5cOpts(identifier)) {
-                    return [CredentialCorrelationType.X509_SAN, identifier.identifier.join('\r\n')];
-                }
-                break;
-        }
-        return [CredentialCorrelationType.URL, issuer];
-    }
-    idFromW3cCredentialSubject(wrappedIssuerVC) {
-        if (Array.isArray(wrappedIssuerVC.credential?.credentialSubject)) {
-            if (wrappedIssuerVC.credential?.credentialSubject.length > 0) {
-                return wrappedIssuerVC.credential?.credentialSubject[0].id;
-            }
-        }
-        else {
-            return wrappedIssuerVC.credential?.credentialSubject?.id;
-        }
-        return undefined;
-    }
-    getCredentialDefinition(issuanceOpt) {
-        if (issuanceOpt.format == 'ldp_vc' || issuanceOpt.format == 'jwt_vc_json-ld') {
-            return issuanceOpt.credential_definition;
-        }
-        return undefined;
-    }
-}
-//# sourceMappingURL=OID4VCIHolder.js.map