@sphereon/ssi-sdk.oid4vci-holder 0.33.1-feature.vcdm2.tsup.32 → 0.33.1-next.2

package/dist/agent/OID4VCIHolder.js

@@ -0,0 +1,884 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OID4VCIHolder = exports.oid4vciHolderContextMethods = void 0;
+exports.signCallback = signCallback;
+exports.verifyEBSICredentialIssuer = verifyEBSICredentialIssuer;
+const oid4vci_client_1 = require("@sphereon/oid4vci-client");
+const oid4vci_common_1 = require("@sphereon/oid4vci-common");
+const ssi_sdk_ext_did_utils_1 = require("@sphereon/ssi-sdk-ext.did-utils");
+const ssi_sdk_ext_identifier_resolution_1 = require("@sphereon/ssi-sdk-ext.identifier-resolution");
+const ssi_sdk_ext_key_utils_1 = require("@sphereon/ssi-sdk-ext.key-utils");
+const ssi_sdk_data_store_1 = require("@sphereon/ssi-sdk.data-store");
+const ssi_types_1 = require("@sphereon/ssi-types");
+const utils_1 = require("@veramo/utils");
+const did_jwt_1 = require("did-jwt");
+const uuid_1 = require("uuid");
+const oid4vciMachine_1 = require("../machines/oid4vciMachine");
+const IOID4VCIHolder_1 = require("../types/IOID4VCIHolder");
+const OID4VCIHolderService_1 = require("../services/OID4VCIHolderService");
+require("cross-fetch/polyfill");
+const ssi_sdk_core_1 = require("@sphereon/ssi-sdk.core");
+/**
+ * {@inheritDoc IOID4VCIHolder}
+ */
+// Exposing the methods here for any REST implementation
+exports.oid4vciHolderContextMethods = [
+    'cmGetContacts',
+    'cmGetContact',
+    'cmAddContact',
+    'cmAddIdentity',
+    'ibCredentialLocaleBrandingFrom',
+    'ibAddCredentialBranding',
+    'dataStoreSaveVerifiableCredential',
+    'didManagerFind',
+    'didManagerGet',
+    'keyManagerSign',
+    'verifyCredential',
+];
+const logger = ssi_types_1.Loggers.DEFAULT.get('sphereon:oid4vci:holder');
+function signCallback(identifier, context, nonce) {
+    return (jwt, kid) => __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        let resolution = yield context.agent.identifierManagedGet(identifier);
+        const jwk = (_a = jwt.header.jwk) !== null && _a !== void 0 ? _a : (resolution.method === 'jwk' ? resolution.jwk : undefined);
+        if (!resolution.issuer && !jwt.payload.iss) {
+            return Promise.reject(Error(`No issuer could be determined from the JWT ${JSON.stringify(jwt)} or identifier resolution`));
+        }
+        const header = jwt.header;
+        const payload = jwt.payload;
+        if (nonce) {
+            payload.nonce = nonce;
+        }
+        if (jwk && header.kid) {
+            console.log(`Deleting kid, as we are using a jwk and the oid4vci spec does not allow both to be present (which is not the case in the JOSE spec)`);
+            delete header.kid; // The OID4VCI spec does not allow a JWK with kid present although the JWS spec does
+        }
+        return (yield context.agent.jwtCreateJwsCompactSignature({
+            issuer: Object.assign(Object.assign({}, resolution), { noIssPayloadUpdate: false }),
+            protectedHeader: header,
+            payload,
+        })).jwt;
+    });
+}
+function verifyEBSICredentialIssuer(args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+        const { wrappedVc, issuerType = ['TI'] } = args;
+        const issuer = (_b = (_a = wrappedVc.decoded) === null || _a === void 0 ? void 0 : _a.iss) !== null && _b !== void 0 ? _b : (typeof ((_d = (_c = wrappedVc.decoded) === null || _c === void 0 ? void 0 : _c.vc) === null || _d === void 0 ? void 0 : _d.issuer) === 'string' ? (_f = (_e = wrappedVc.decoded) === null || _e === void 0 ? void 0 : _e.vc) === null || _f === void 0 ? void 0 : _f.issuer : (_j = (_h = (_g = wrappedVc.decoded) === null || _g === void 0 ? void 0 : _g.vc) === null || _h === void 0 ? void 0 : _h.issuer) === null || _j === void 0 ? void 0 : _j.existingInstanceId);
+        if (!issuer) {
+            throw Error('The issuer of the VC is required to be present');
+        }
+        const url = `https://api-conformance.ebsi.eu/trusted-issuers-registry/v4/issuers/${issuer}`;
+        const response = yield fetch(url);
+        if (response.status !== 200) {
+            throw Error('The issuer of the VC cannot be trusted');
+        }
+        const payload = yield response.json();
+        if (!payload.attributes.some((a) => issuerType.includes(a.issuerType))) {
+            throw Error(`The issuer type is required to be one of: ${issuerType.join(', ')}`);
+        }
+        return payload;
+    });
+}
+class OID4VCIHolder {
+    constructor(options) {
+        this.eventTypes = [
+            IOID4VCIHolder_1.OID4VCIHolderEvent.CONTACT_IDENTITY_CREATED,
+            IOID4VCIHolder_1.OID4VCIHolderEvent.CREDENTIAL_STORED,
+            IOID4VCIHolder_1.OID4VCIHolderEvent.IDENTIFIER_CREATED,
+        ];
+        this.methods = {
+            oid4vciHolderStart: this.oid4vciHolderStart.bind(this),
+            oid4vciHolderGetIssuerMetadata: this.oid4vciHolderGetIssuerMetadata.bind(this),
+            oid4vciHolderGetMachineInterpreter: this.oid4vciHolderGetMachineInterpreter.bind(this),
+            oid4vciHolderCreateCredentialsToSelectFrom: this.oid4vciHolderCreateCredentialsToSelectFrom.bind(this),
+            oid4vciHolderGetContact: this.oid4vciHolderGetContact.bind(this),
+            oid4vciHolderGetCredentials: this.oid4vciHolderGetCredentials.bind(this),
+            oid4vciHolderGetCredential: this.oid4vciHolderGetCredential.bind(this),
+            oid4vciHolderAddContactIdentity: this.oid4vciHolderAddContactIdentity.bind(this),
+            oid4vciHolderAssertValidCredentials: this.oid4vciHolderAssertValidCredentials.bind(this),
+            oid4vciHolderStoreCredentialBranding: this.oid4vciHolderStoreCredentialBranding.bind(this),
+            oid4vciHolderStoreCredentials: this.oid4vciHolderStoreCredentials.bind(this),
+            oid4vciHolderSendNotification: this.oid4vciHolderSendNotification.bind(this),
+            oid4vciHolderGetIssuerBranding: this.oid4vciHolderGetIssuerBranding.bind(this),
+            oid4vciHolderStoreIssuerBranding: this.oid4vciHolderStoreIssuerBranding.bind(this),
+        };
+        this.vcFormatPreferences = ['vc+sd-jwt', 'mso_mdoc', 'jwt_vc_json', 'jwt_vc', 'ldp_vc'];
+        this.jsonldCryptographicSuitePreferences = [
+            'Ed25519Signature2018',
+            'EcdsaSecp256k1Signature2019',
+            'Ed25519Signature2020',
+            'JsonWebSignature2020',
+            // "JcsEd25519Signature2020"
+        ];
+        this.didMethodPreferences = [
+            ssi_sdk_ext_did_utils_1.SupportedDidMethodEnum.DID_JWK, // FIXME prefer JWK until we devise a method to detect when to use EBSI/jcs for did:key and when not
+            ssi_sdk_ext_did_utils_1.SupportedDidMethodEnum.DID_KEY,
+            ssi_sdk_ext_did_utils_1.SupportedDidMethodEnum.DID_OYD,
+            ssi_sdk_ext_did_utils_1.SupportedDidMethodEnum.DID_EBSI,
+            ssi_sdk_ext_did_utils_1.SupportedDidMethodEnum.DID_ION,
+        ];
+        this.jwtCryptographicSuitePreferences = [
+            ssi_types_1.JoseSignatureAlgorithm.ES256,
+            ssi_types_1.JoseSignatureAlgorithm.ES256K,
+            ssi_types_1.JoseSignatureAlgorithm.EdDSA,
+        ];
+        this.defaultAuthorizationRequestOpts = { redirectUri: OID4VCIHolder.DEFAULT_MOBILE_REDIRECT_URI };
+        const { onContactIdentityCreated, onCredentialStored, onIdentifierCreated, onVerifyEBSICredentialIssuer, vcFormatPreferences, jsonldCryptographicSuitePreferences, didMethodPreferences, jwtCryptographicSuitePreferences, defaultAuthorizationRequestOptions, hasher = ssi_sdk_core_1.defaultHasher, } = Object.assign({}, options);
+        this.hasher = hasher;
+        if (vcFormatPreferences !== undefined && vcFormatPreferences.length > 0) {
+            this.vcFormatPreferences = vcFormatPreferences;
+        }
+        if (jsonldCryptographicSuitePreferences !== undefined && jsonldCryptographicSuitePreferences.length > 0) {
+            this.jsonldCryptographicSuitePreferences = jsonldCryptographicSuitePreferences;
+        }
+        if (didMethodPreferences !== undefined && didMethodPreferences.length > 0) {
+            this.didMethodPreferences = didMethodPreferences;
+        }
+        if (jwtCryptographicSuitePreferences !== undefined && jwtCryptographicSuitePreferences.length > 0) {
+            this.jwtCryptographicSuitePreferences = jwtCryptographicSuitePreferences;
+        }
+        if (defaultAuthorizationRequestOptions) {
+            this.defaultAuthorizationRequestOpts = defaultAuthorizationRequestOptions;
+        }
+        this.onContactIdentityCreated = onContactIdentityCreated;
+        this.onCredentialStored = onCredentialStored;
+        this.onIdentifierCreated = onIdentifierCreated;
+        this.onVerifyEBSICredentialIssuer = onVerifyEBSICredentialIssuer;
+    }
+    onEvent(event, context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            switch (event.type) {
+                case IOID4VCIHolder_1.OID4VCIHolderEvent.CONTACT_IDENTITY_CREATED:
+                    (_a = this.onContactIdentityCreated) === null || _a === void 0 ? void 0 : _a.call(this, event.data);
+                    break;
+                case IOID4VCIHolder_1.OID4VCIHolderEvent.CREDENTIAL_STORED:
+                    (_b = this.onCredentialStored) === null || _b === void 0 ? void 0 : _b.call(this, event.data);
+                    break;
+                case IOID4VCIHolder_1.OID4VCIHolderEvent.IDENTIFIER_CREATED:
+                    (_c = this.onIdentifierCreated) === null || _c === void 0 ? void 0 : _c.call(this, event.data);
+                    break;
+                default:
+                    return Promise.reject(Error(`Event type ${event.type} not supported`));
+            }
+        });
+    }
+    /**
+     * FIXME: This method can only be used locally. Creating the interpreter should be local to where the agent is running
+     */
+    oid4vciHolderGetMachineInterpreter(opts, context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const authorizationRequestOpts = Object.assign(Object.assign({}, this.defaultAuthorizationRequestOpts), opts.authorizationRequestOpts);
+            const services = {
+                [IOID4VCIHolder_1.OID4VCIMachineServices.start]: (args) => this.oid4vciHolderStart(Object.assign(Object.assign({}, args), { authorizationRequestOpts }), context),
+                [IOID4VCIHolder_1.OID4VCIMachineServices.startFirstPartApplicationFlow]: (args) => (0, OID4VCIHolderService_1.startFirstPartApplicationMachine)(Object.assign(Object.assign({}, args), { stateNavigationListener: opts.firstPartyStateNavigationListener }), context),
+                [IOID4VCIHolder_1.OID4VCIMachineServices.createCredentialsToSelectFrom]: (args) => this.oid4vciHolderCreateCredentialsToSelectFrom(args, context),
+                [IOID4VCIHolder_1.OID4VCIMachineServices.getContact]: (args) => this.oid4vciHolderGetContact(args, context),
+                [IOID4VCIHolder_1.OID4VCIMachineServices.getCredentials]: (args) => { var _a; return this.oid4vciHolderGetCredentials(Object.assign({ accessTokenOpts: (_a = args.accessTokenOpts) !== null && _a !== void 0 ? _a : opts.accessTokenOpts }, args), context); },
+                [IOID4VCIHolder_1.OID4VCIMachineServices.addContactIdentity]: (args) => this.oid4vciHolderAddContactIdentity(args, context),
+                [IOID4VCIHolder_1.OID4VCIMachineServices.getIssuerBranding]: (args) => this.oid4vciHolderGetIssuerBranding(args, context),
+                [IOID4VCIHolder_1.OID4VCIMachineServices.storeIssuerBranding]: (args) => this.oid4vciHolderStoreIssuerBranding(args, context),
+                [IOID4VCIHolder_1.OID4VCIMachineServices.assertValidCredentials]: (args) => this.oid4vciHolderAssertValidCredentials(args, context),
+                [IOID4VCIHolder_1.OID4VCIMachineServices.storeCredentialBranding]: (args) => this.oid4vciHolderStoreCredentialBranding(args, context),
+                [IOID4VCIHolder_1.OID4VCIMachineServices.storeCredentials]: (args) => this.oid4vciHolderStoreCredentials(args, context),
+                [IOID4VCIHolder_1.OID4VCIMachineServices.sendNotification]: (args) => this.oid4vciHolderSendNotification(args, context),
+                [IOID4VCIHolder_1.OID4VCIMachineServices.getFederationTrust]: (args) => this.getFederationTrust(args, context),
+            };
+            const oid4vciMachineInstanceArgs = Object.assign(Object.assign({}, opts), { authorizationRequestOpts, services: Object.assign(Object.assign({}, services), opts.services) });
+            const { interpreter } = yield oid4vciMachine_1.OID4VCIMachine.newInstance(oid4vciMachineInstanceArgs, context);
+            return {
+                interpreter,
+            };
+        });
+    }
+    /**
+     * This method is run before the machine starts! So there is no concept of the state machine context or states yet
+     *
+     * The result of this method can be directly passed into the start method of the state machine
+     * @param args
+     * @param context
+     * @private
+     */
+    oid4vciHolderStart(args, context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            const { requestData } = args;
+            if (!requestData) {
+                throw Error(`Cannot start the OID4VCI holder flow without request data being provided`);
+            }
+            const { uri = undefined } = requestData;
+            if (!uri) {
+                return Promise.reject(Error('Missing request URI in context'));
+            }
+            const authorizationRequestOpts = Object.assign(Object.assign({}, this.defaultAuthorizationRequestOpts), args.authorizationRequestOpts);
+            // We filter the details first against our vcformat prefs
+            authorizationRequestOpts.authorizationDetails = (authorizationRequestOpts === null || authorizationRequestOpts === void 0 ? void 0 : authorizationRequestOpts.authorizationDetails)
+                ? (0, utils_1.asArray)(authorizationRequestOpts.authorizationDetails).filter((detail) => typeof detail === 'string' || this.vcFormatPreferences.includes(detail.format))
+                : undefined;
+            if (!authorizationRequestOpts.redirectUri) {
+                authorizationRequestOpts.redirectUri = OID4VCIHolder.DEFAULT_MOBILE_REDIRECT_URI;
+            }
+            if (authorizationRequestOpts.redirectUri.startsWith('http') && !authorizationRequestOpts.clientId) {
+                // At least set a default for a web based wallet.
+                // TODO: We really need (dynamic) client registration support
+                authorizationRequestOpts.clientId = authorizationRequestOpts.redirectUri;
+            }
+            let formats = this.vcFormatPreferences;
+            const authFormats = (_a = authorizationRequestOpts === null || authorizationRequestOpts === void 0 ? void 0 : authorizationRequestOpts.authorizationDetails) === null || _a === void 0 ? void 0 : _a.map((detail) => (typeof detail === 'object' && 'format' in detail && detail.format ? detail.format : undefined)).filter((format) => !!format).map((format) => format);
+            if (authFormats && authFormats.length > 0) {
+                formats = Array.from(new Set(authFormats));
+            }
+            let oid4vciClient;
+            let types = undefined;
+            let offer;
+            if (requestData.existingClientState) {
+                oid4vciClient = yield oid4vci_client_1.OpenID4VCIClient.fromState({ state: requestData.existingClientState });
+                offer = oid4vciClient.credentialOffer;
+            }
+            else {
+                offer = requestData.credentialOffer;
+                if (uri.startsWith(IOID4VCIHolder_1.RequestType.OPENID_INITIATE_ISSUANCE) ||
+                    uri.startsWith(IOID4VCIHolder_1.RequestType.OPENID_CREDENTIAL_OFFER) ||
+                    uri.match(/https?:\/\/.*credential_offer(_uri)=?.*/)) {
+                    if (!offer) {
+                        // Let's make sure to convert the URI to offer, as it matches the regexes. Normally this should already have happened at this point though
+                        offer = yield oid4vci_client_1.CredentialOfferClient.fromURI(uri);
+                    }
+                }
+                else {
+                    if (!!offer) {
+                        logger.warning(`Non default URI used for credential offer: ${uri}`);
+                    }
+                }
+                if (!offer) {
+                    // else no offer, meaning we have an issuer URL
+                    logger.log(`Issuer url received (no credential offer): ${uri}`);
+                    oid4vciClient = yield oid4vci_client_1.OpenID4VCIClient.fromCredentialIssuer({
+                        credentialIssuer: uri,
+                        authorizationRequest: authorizationRequestOpts,
+                        clientId: authorizationRequestOpts.clientId,
+                        createAuthorizationRequestURL: (_b = requestData.createAuthorizationRequestURL) !== null && _b !== void 0 ? _b : true,
+                    });
+                }
+                else {
+                    logger.log(`Credential offer received: ${uri}`);
+                    oid4vciClient = yield oid4vci_client_1.OpenID4VCIClient.fromURI({
+                        uri,
+                        authorizationRequest: authorizationRequestOpts,
+                        clientId: authorizationRequestOpts.clientId,
+                        createAuthorizationRequestURL: (_c = requestData.createAuthorizationRequestURL) !== null && _c !== void 0 ? _c : true,
+                    });
+                }
+            }
+            if (offer) {
+                types = (0, oid4vci_common_1.getTypesFromCredentialOffer)(offer.original_credential_offer);
+            }
+            else {
+                types = (0, utils_1.asArray)(authorizationRequestOpts.authorizationDetails)
+                    .map((authReqOpts) => { var _a; return (_a = (0, oid4vci_common_1.getTypesFromAuthorizationDetails)(authReqOpts)) !== null && _a !== void 0 ? _a : []; })
+                    .filter((inner) => inner.length > 0);
+            }
+            const serverMetadata = yield oid4vciClient.retrieveServerMetadata();
+            const credentialsSupported = yield (0, OID4VCIHolderService_1.getCredentialConfigsSupportedMerged)({
+                client: oid4vciClient,
+                vcFormatPreferences: formats,
+                types,
+            });
+            const credentialBranding = yield (0, OID4VCIHolderService_1.getCredentialBranding)({ credentialsSupported, context });
+            const authorizationCodeURL = oid4vciClient.authorizationURL;
+            if (authorizationCodeURL) {
+                logger.log(`authorization code URL ${authorizationCodeURL}`);
+            }
+            const oid4vciClientState = JSON.parse(yield oid4vciClient.exportState());
+            return {
+                authorizationCodeURL,
+                credentialBranding,
+                credentialsSupported,
+                serverMetadata,
+                oid4vciClientState,
+            };
+        });
+    }
+    oid4vciHolderCreateCredentialsToSelectFrom(args, context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { credentialBranding, locale, selectedCredentials /*, openID4VCIClientState*/, credentialsSupported } = args;
+            // const client = await OpenID4VCIClient.fromState({ state: openID4VCIClientState! }) // TODO see if we need the check openID4VCIClientState defined
+            /*const credentialsSupported = await getCredentialConfigsSupportedBySingleTypeOrId({
+                                      client,
+                                      vcFormatPreferences: this.vcFormatPreferences,
+                                    })*/
+            logger.info(`Credentials supported ${Object.keys(credentialsSupported).join(', ')}`);
+            const credentialSelection = yield Promise.all(Object.entries(credentialsSupported).map((_a) => __awaiter(this, [_a], void 0, function* ([id, credentialConfigSupported]) {
+                // FIXME this allows for duplicate VerifiableCredential, which the user has no idea which ones those are and we also have a branding map with unique keys, so some branding will not match
+                // const defaultCredentialType = 'VerifiableCredential'
+                var _b, _c, _d;
+                const credentialTypes = (0, oid4vci_common_1.getTypesFromObject)(credentialConfigSupported);
+                // const credentialType = id /*?? credentialTypes?.find((type) => type !== defaultCredentialType) ?? defaultCredentialType*/
+                const localeBranding = !credentialBranding
+                    ? undefined
+                    : ((_b = credentialBranding === null || credentialBranding === void 0 ? void 0 : credentialBranding[id]) !== null && _b !== void 0 ? _b : (_c = Object.entries(credentialBranding)
+                        .find(([type, _brandings]) => {
+                        credentialTypes && type in credentialTypes;
+                    })) === null || _c === void 0 ? void 0 : _c.map(([type, supported]) => supported));
+                const credentialAlias = (_d = (yield (0, OID4VCIHolderService_1.selectCredentialLocaleBranding)({
+                    locale,
+                    localeBranding,
+                }))) === null || _d === void 0 ? void 0 : _d.alias;
+                return {
+                    id: (0, uuid_1.v4)(),
+                    credentialId: id,
+                    credentialTypes: credentialTypes !== null && credentialTypes !== void 0 ? credentialTypes : (0, utils_1.asArray)(id),
+                    credentialAlias: credentialAlias !== null && credentialAlias !== void 0 ? credentialAlias : id,
+                    isSelected: false,
+                };
+            })));
+            // TODO find better place to do this, would be nice if the machine does this?
+            if (credentialSelection.length >= 1) {
+                credentialSelection.map((sel) => selectedCredentials.push(sel.credentialId));
+            }
+            logger.log(`Credential selection ${JSON.stringify(credentialSelection)}`);
+            return credentialSelection;
+        });
+    }
+    oid4vciHolderGetContact(args, context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            const { serverMetadata } = args;
+            if (serverMetadata === undefined) {
+                return Promise.reject(Error('Missing serverMetadata in context'));
+            }
+            const names = new Set((_c = (_b = (_a = serverMetadata.credentialIssuerMetadata) === null || _a === void 0 ? void 0 : _a.display) === null || _b === void 0 ? void 0 : _b.map((display) => display.name).filter((name) => name != undefined).map((name) => name)) !== null && _c !== void 0 ? _c : []);
+            const name = names.size > 0 ? Array.from(names)[0] : undefined;
+            const correlationId = new URL(serverMetadata.issuer).hostname;
+            const filter = [
+                {
+                    identities: {
+                        identifier: {
+                            correlationId,
+                        },
+                    },
+                },
+            ];
+            if (name) {
+                filter.push({
+                    contact: {
+                        legalName: name,
+                    },
+                });
+                filter.push({
+                    contact: {
+                        displayName: name,
+                    },
+                });
+            }
+            const parties = yield context.agent.cmGetContacts({
+                filter,
+            });
+            if (parties.length > 1) {
+                logger.warning(`Get contacts returned more than one result: ${parties.length}, ${parties.map((party) => party.contact.displayName).join(',')}`);
+            }
+            const party = parties.length >= 1 ? parties[0] : undefined;
+            logger.log(`Party involved: `, party);
+            return party;
+        });
+    }
+    oid4vciHolderGetCredentials(args, context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { verificationCode, openID4VCIClientState, didMethodPreferences = this.didMethodPreferences, issuanceOpt, accessTokenOpts } = args;
+            logger.debug(`Getting credentials`, issuanceOpt, accessTokenOpts);
+            if (!openID4VCIClientState) {
+                return Promise.reject(Error('Missing openID4VCI client state in context'));
+            }
+            const client = yield oid4vci_client_1.OpenID4VCIClient.fromState({ state: openID4VCIClientState });
+            const credentialsSupported = yield (0, OID4VCIHolderService_1.getCredentialConfigsSupportedMerged)({
+                client,
+                vcFormatPreferences: this.vcFormatPreferences,
+                configurationIds: args.selectedCredentials,
+            });
+            const serverMetadata = yield client.retrieveServerMetadata();
+            const issuanceOpts = yield (0, OID4VCIHolderService_1.getIssuanceOpts)(Object.assign({ client,
+                credentialsSupported,
+                serverMetadata,
+                context, didMethodPreferences: Array.isArray(didMethodPreferences) && didMethodPreferences.length > 0 ? didMethodPreferences : this.didMethodPreferences, jwtCryptographicSuitePreferences: this.jwtCryptographicSuitePreferences, jsonldCryptographicSuitePreferences: this.jsonldCryptographicSuitePreferences }, (issuanceOpt && { forceIssuanceOpt: issuanceOpt })));
+            const getCredentials = issuanceOpts.map((issuanceOpt) => __awaiter(this, void 0, void 0, function* () {
+                return yield this.oid4vciHolderGetCredential({
+                    issuanceOpt,
+                    pin: verificationCode,
+                    client,
+                    accessTokenOpts,
+                }, context);
+            }));
+            const allCredentials = yield Promise.all(getCredentials);
+            logger.log(`Credentials received`, allCredentials);
+            return allCredentials;
+        });
+    }
+    oid4vciHolderGetCredential(args, context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+            const { issuanceOpt, pin, client, accessTokenOpts } = args;
+            logger.info(`Getting credential`, issuanceOpt);
+            if (!issuanceOpt) {
+                return Promise.reject(Error(`Cannot get credential issuance options`));
+            }
+            const identifier = yield (0, OID4VCIHolderService_1.getIdentifierOpts)({ issuanceOpt, context });
+            issuanceOpt.identifier = identifier;
+            logger.info(`ID opts`, identifier);
+            const alg = yield (0, ssi_sdk_ext_key_utils_1.signatureAlgorithmFromKey)({ key: identifier.key });
+            // The VCI lib either expects a jwk or a kid
+            const jwk = (0, ssi_sdk_ext_identifier_resolution_1.isManagedIdentifierJwkResult)(identifier) ? identifier.jwk : undefined;
+            const callbacks = {
+                signCallback: signCallback(identifier, context),
+            };
+            try {
+                // We need to make sure we have acquired the access token
+                if (!client.clientId) {
+                    client.clientId = (0, ssi_sdk_ext_identifier_resolution_1.isManagedIdentifierDidResult)(identifier) ? identifier.did : identifier.issuer;
+                }
+                let asOpts = undefined;
+                let kid = (_b = (_a = accessTokenOpts === null || accessTokenOpts === void 0 ? void 0 : accessTokenOpts.clientOpts) === null || _a === void 0 ? void 0 : _a.kid) !== null && _b !== void 0 ? _b : identifier.kid;
+                if (accessTokenOpts === null || accessTokenOpts === void 0 ? void 0 : accessTokenOpts.clientOpts) {
+                    const clientId = (_d = (_c = accessTokenOpts.clientOpts.clientId) !== null && _c !== void 0 ? _c : client.clientId) !== null && _d !== void 0 ? _d : identifier.issuer;
+                    if (client.isEBSI() && (clientId === null || clientId === void 0 ? void 0 : clientId.startsWith('http')) && (kid === null || kid === void 0 ? void 0 : kid.includes('#'))) {
+                        kid = kid.split('#')[1];
+                    }
+                    //todo: investigate if the jwk should be used here as well if present
+                    const clientOpts = Object.assign(Object.assign({}, accessTokenOpts.clientOpts), { clientId,
+                        kid, 
+                        // @ts-ignore
+                        alg: (_e = accessTokenOpts.clientOpts.alg) !== null && _e !== void 0 ? _e : alg, signCallbacks: (_f = accessTokenOpts.clientOpts.signCallbacks) !== null && _f !== void 0 ? _f : callbacks });
+                    asOpts = {
+                        clientOpts,
+                    };
+                }
+                yield client.acquireAccessToken(Object.assign({ clientId: client.clientId, pin, authorizationResponse: JSON.parse(yield client.exportState()).authorizationCodeResponse, additionalRequestParams: accessTokenOpts === null || accessTokenOpts === void 0 ? void 0 : accessTokenOpts.additionalRequestParams }, (asOpts && { asOpts })));
+                // FIXME: This type mapping is wrong. It should use credential_identifier in case the access token response has authorization details
+                const types = (0, oid4vci_common_1.getTypesFromObject)(issuanceOpt);
+                const id = 'id' in issuanceOpt && issuanceOpt.id ? issuanceOpt.id : undefined;
+                const credentialTypes = (0, utils_1.asArray)((_h = (_g = issuanceOpt.credentialConfigurationId) !== null && _g !== void 0 ? _g : types) !== null && _h !== void 0 ? _h : id);
+                if (!credentialTypes || credentialTypes.length === 0) {
+                    return Promise.reject(Error('cannot determine credential id to request'));
+                }
+                const credentialDefinition = this.getCredentialDefinition(issuanceOpt);
+                const credentialResponse = yield client.acquireCredentials(Object.assign(Object.assign(Object.assign(Object.assign({}, (credentialDefinition && { context: credentialDefinition['@context'] })), { credentialTypes, proofCallbacks: callbacks, format: issuanceOpt.format, 
+                    // TODO: We need to update the machine and add notifications support for actual deferred credentials instead of just waiting/retrying
+                    deferredCredentialAwait: true }), (!jwk && { kid })), { // vci client either wants a jwk or kid. If we have used the jwk method do not provide the kid
+                    jwk,
+                    alg, jti: (0, uuid_1.v4)() }));
+                const credential = {
+                    id: (_j = issuanceOpt.credentialConfigurationId) !== null && _j !== void 0 ? _j : id,
+                    types: types !== null && types !== void 0 ? types : (0, utils_1.asArray)(credentialTypes),
+                    issuanceOpt,
+                    credentialResponse,
+                };
+                return (0, OID4VCIHolderService_1.mapCredentialToAccept)({ credentialToAccept: credential, hasher: this.hasher });
+            }
+            catch (error) {
+                return Promise.reject(error);
+            }
+        });
+    }
+    oid4vciHolderAddContactIdentity(args, context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { credentialsToAccept, contact } = args;
+            if (!contact) {
+                return Promise.reject(Error('Missing contact in context'));
+            }
+            if (credentialsToAccept === undefined || credentialsToAccept.length === 0) {
+                return Promise.reject(Error('Missing credential offers in context'));
+            }
+            let correlationId = credentialsToAccept[0].correlationId;
+            let identifierType = ssi_sdk_data_store_1.CorrelationIdentifierType.DID;
+            if (!correlationId.toLowerCase().startsWith('did:')) {
+                identifierType = ssi_sdk_data_store_1.CorrelationIdentifierType.URL;
+                if (correlationId.startsWith('http')) {
+                    correlationId = new URL(correlationId).hostname;
+                }
+            }
+            const identity = Object.assign({ alias: credentialsToAccept[0].correlationId, origin: ssi_sdk_data_store_1.IdentityOrigin.EXTERNAL, roles: [ssi_sdk_data_store_1.CredentialRole.ISSUER], identifier: {
+                    type: identifierType,
+                    correlationId,
+                } }, (identifierType === ssi_sdk_data_store_1.CorrelationIdentifierType.URL && {
+                connection: {
+                    type: ssi_sdk_data_store_1.ConnectionType.OPENID_CONNECT,
+                    config: {
+                        clientId: '138d7bf8-c930-4c6e-b928-97d3a4928b01',
+                        clientSecret: '03b3955f-d020-4f2a-8a27-4e452d4e27a0',
+                        scopes: ['auth'],
+                        issuer: 'https://example.com/app-test',
+                        redirectUrl: 'app:/callback',
+                        dangerouslyAllowInsecureHttpRequests: true,
+                        clientAuthMethod: 'post',
+                    },
+                },
+            }));
+            yield context.agent.emit(IOID4VCIHolder_1.OID4VCIHolderEvent.CONTACT_IDENTITY_CREATED, {
+                contactId: contact.id,
+                identity,
+            });
+            logger.log(`Contact added: ${correlationId}`);
+            return context.agent.cmAddIdentity({ contactId: contact.id, identity });
+        });
+    }
+    oid4vciHolderGetIssuerBranding(args, context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            const { serverMetadata, contact } = args;
+            // Here we are fetching issuer branding for a contact. If no contact is found that means we encounter this contact for the first time. This also means we do not have any branding for the contact.
+            const issuerCorrelationId = contact === null || contact === void 0 ? void 0 : contact.identities.filter((identity) => identity.roles.includes(ssi_sdk_data_store_1.CredentialRole.ISSUER)).map((identity) => identity.identifier.correlationId)[0];
+            if (issuerCorrelationId) {
+                const branding = yield context.agent.ibGetIssuerBranding({ filter: [{ issuerCorrelationId }] });
+                if (branding.length > 0) {
+                    return branding[0].localeBranding;
+                }
+            }
+            // We should have serverMetadata in the context else something went wrong
+            if (!serverMetadata) {
+                return Promise.reject(Error('Missing serverMetadata in context'));
+            }
+            return (0, OID4VCIHolderService_1.getBasicIssuerLocaleBranding)({
+                display: (_b = (_a = serverMetadata.credentialIssuerMetadata) === null || _a === void 0 ? void 0 : _a.display) !== null && _b !== void 0 ? _b : [],
+                dynamicRegistrationClientMetadata: serverMetadata.credentialIssuerMetadata,
+                context,
+            });
+        });
+    }
+    oid4vciHolderStoreIssuerBranding(args, context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { issuerBranding, contact } = args;
+            if (!issuerBranding || issuerBranding.length === 0 || issuerBranding[0].id) {
+                // FIXME we need better separation between a contact(issuer) we encountered before and it's branding vs a new contact and it's branding
+                return;
+            }
+            if (!contact) {
+                return Promise.reject(Error('Missing contact in context'));
+            }
+            const issuerCorrelationId = contact === null || contact === void 0 ? void 0 : contact.identities.filter((identity) => identity.roles.includes(ssi_sdk_data_store_1.CredentialRole.ISSUER)).map((identity) => identity.identifier.correlationId)[0];
+            // we check for issuer branding as adding an identity might also trigger storing the issuer branding
+            const branding = yield context.agent.ibGetIssuerBranding({ filter: [{ issuerCorrelationId }] });
+            if (branding.length > 0) {
+                return;
+            }
+            yield context.agent.ibAddIssuerBranding({
+                localeBranding: issuerBranding,
+                issuerCorrelationId,
+            });
+        });
+    }
+    oid4vciHolderAssertValidCredentials(args, context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { credentialsToAccept, issuanceOpt } = args;
+            return yield Promise.all(credentialsToAccept.map((credentialToAccept) => (0, OID4VCIHolderService_1.verifyCredentialToAccept)({
+                mappedCredential: credentialToAccept,
+                onVerifyEBSICredentialIssuer: this.onVerifyEBSICredentialIssuer,
+                hasher: this.hasher,
+                schemaValidation: issuanceOpt === null || issuanceOpt === void 0 ? void 0 : issuanceOpt.schemaValidation,
+                context,
+            })));
+        });
+    }
+    oid4vciHolderStoreCredentialBranding(args, context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { credentialBranding, serverMetadata, selectedCredentials, credentialsToAccept } = args;
+            if (serverMetadata === undefined) {
+                return Promise.reject(Error('Missing serverMetadata in context'));
+            }
+            else if (selectedCredentials.length === 0) {
+                logger.warning(`No credentials selected for issuer: ${serverMetadata.issuer}`);
+                return;
+            }
+            let counter = 0;
+            for (const credentialId of selectedCredentials) {
+                const localeBranding = credentialBranding === null || credentialBranding === void 0 ? void 0 : credentialBranding[credentialId];
+                if (localeBranding && localeBranding.length > 0) {
+                    const credential = credentialsToAccept.find((credAccept) => credAccept.credentialToAccept.id === credentialId || JSON.stringify(credAccept.types) === credentialId || credentialsToAccept[counter]);
+                    counter++;
+                    yield context.agent.ibAddCredentialBranding({
+                        vcHash: (0, utils_1.computeEntryHash)(credential.rawVerifiableCredential),
+                        issuerCorrelationId: new URL(serverMetadata.issuer).hostname,
+                        localeBranding,
+                    });
+                    logger.log(`Credential branding for issuer ${serverMetadata.issuer} and type ${credentialId} stored with locales ${localeBranding.map((b) => b.locale).join(',')}`);
+                }
+                else {
+                    logger.warning(`No credential branding found for issuer: ${serverMetadata.issuer} and type ${credentialId}`);
+                }
+            }
+        });
+    }
+    oid4vciHolderStoreCredentials(args, context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o;
+            function trimmed(input) {
+                const trim = input === null || input === void 0 ? void 0 : input.trim();
+                if (trim === '') {
+                    return undefined;
+                }
+                return trim;
+            }
+            const { credentialsToAccept, openID4VCIClientState, credentialsSupported, serverMetadata, selectedCredentials } = args;
+            const mappedCredentialToAccept = credentialsToAccept[0];
+            if (selectedCredentials && selectedCredentials.length > 1) {
+                logger.error(`More than 1 credential selected ${selectedCredentials.join(', ')}, but current service only stores 1 credential!`);
+            }
+            // TODO determine when and how we should store credentials without key kmsKeyRef & id method), this should be tested with the code below
+            const issuanceOpt = (_a = args.issuanceOpt) !== null && _a !== void 0 ? _a : mappedCredentialToAccept.credentialToAccept.issuanceOpt;
+            if (!issuanceOpt || !issuanceOpt.identifier) {
+                return Promise.reject(Error('issuanceOpt.identifier must me set in order to store a credential'));
+            }
+            const { kmsKeyRef, method } = issuanceOpt.identifier;
+            let persist = true;
+            const verifiableCredential = mappedCredentialToAccept.uniformVerifiableCredential;
+            const notificationId = mappedCredentialToAccept.credentialToAccept.credentialResponse.notification_id;
+            const subjectIssuance = mappedCredentialToAccept.credential_subject_issuance;
+            const notificationEndpoint = (_b = serverMetadata === null || serverMetadata === void 0 ? void 0 : serverMetadata.credentialIssuerMetadata) === null || _b === void 0 ? void 0 : _b.notification_endpoint;
+            let holderCredential = undefined;
+            if (!notificationEndpoint) {
+                logger.log(`Notifications not supported by issuer ${serverMetadata === null || serverMetadata === void 0 ? void 0 : serverMetadata.issuer}. Will not provide a notification`);
+            }
+            else if (notificationEndpoint && !notificationId) {
+                logger.warning(`Notification endpoint available in issuer metadata with value ${notificationEndpoint}, but no ${notificationId} provided. Will not send a notification to issuer ${serverMetadata === null || serverMetadata === void 0 ? void 0 : serverMetadata.issuer}`);
+            }
+            else if (notificationEndpoint && notificationId) {
+                logger.log(`Notification id ${notificationId} found, will send back a notification to ${notificationEndpoint}`);
+                let event = 'credential_accepted';
+                if (Array.isArray(subjectIssuance === null || subjectIssuance === void 0 ? void 0 : subjectIssuance.notification_events_supported)) {
+                    // experimental subject issuance, where a new credential is being created
+                    event = subjectIssuance.notification_events_supported.includes('credential_accepted_holder_signed')
+                        ? 'credential_accepted_holder_signed'
+                        : 'credential_deleted_holder_signed';
+                    logger.log(`Subject issuance/signing will be used, with event`, event);
+                    const issuerVC = mappedCredentialToAccept.credentialToAccept.credentialResponse.credential;
+                    const wrappedIssuerVC = ssi_types_1.CredentialMapper.toWrappedVerifiableCredential(issuerVC, { hasher: (_c = this.hasher) !== null && _c !== void 0 ? _c : ssi_sdk_core_1.defaultHasher });
+                    console.log(`Wrapped VC: ${wrappedIssuerVC.type}, ${wrappedIssuerVC.format}`);
+                    // We will use the subject of the VCI Issuer (the holder, as the issuer of the new credential, so the below is not a mistake!)
+                    let issuer;
+                    if (ssi_types_1.CredentialMapper.isWrappedSdJwtVerifiableCredential(wrappedIssuerVC)) {
+                        issuer = trimmed((_d = wrappedIssuerVC.decoded) === null || _d === void 0 ? void 0 : _d.sub);
+                    }
+                    else if (ssi_types_1.CredentialMapper.isWrappedW3CVerifiableCredential(wrappedIssuerVC)) {
+                        // @ts-ignore
+                        issuer = (_j = (_f = trimmed((_e = wrappedIssuerVC.credential) === null || _e === void 0 ? void 0 : _e.sub)) !== null && _f !== void 0 ? _f : trimmed((_h = (_g = wrappedIssuerVC.credential) === null || _g === void 0 ? void 0 : _g.credentialSubject) === null || _h === void 0 ? void 0 : _h.id)) !== null && _j !== void 0 ? _j : trimmed(this.idFromW3cCredentialSubject(wrappedIssuerVC));
+                    }
+                    else if (ssi_types_1.CredentialMapper.isWrappedMdocCredential(wrappedIssuerVC)) {
+                        return Promise.reject(Error('mdoc not yet supported'));
+                    }
+                    if (!issuer) {
+                        issuer = trimmed((_k = verifiableCredential.credentialSubject) === null || _k === void 0 ? void 0 : _k.id);
+                    }
+                    if (!issuer && ((_l = openID4VCIClientState === null || openID4VCIClientState === void 0 ? void 0 : openID4VCIClientState.kid) === null || _l === void 0 ? void 0 : _l.startsWith('did:'))) {
+                        issuer = (0, ssi_types_1.parseDid)(openID4VCIClientState === null || openID4VCIClientState === void 0 ? void 0 : openID4VCIClientState.kid).did;
+                    }
+                    if (!issuer && ((_o = (_m = openID4VCIClientState === null || openID4VCIClientState === void 0 ? void 0 : openID4VCIClientState.jwk) === null || _m === void 0 ? void 0 : _m.kid) === null || _o === void 0 ? void 0 : _o.startsWith('did:'))) {
+                        issuer = (0, ssi_types_1.parseDid)(openID4VCIClientState.jwk.kid).did;
+                    }
+                    if (!issuer && (openID4VCIClientState === null || openID4VCIClientState === void 0 ? void 0 : openID4VCIClientState.clientId)) {
+                        issuer = trimmed(openID4VCIClientState.clientId);
+                    }
+                    if (!issuer && (openID4VCIClientState === null || openID4VCIClientState === void 0 ? void 0 : openID4VCIClientState.accessTokenResponse)) {
+                        const decodedJwt = (0, did_jwt_1.decodeJWT)(openID4VCIClientState.accessTokenResponse.access_token);
+                        issuer = decodedJwt.payload.sub;
+                    }
+                    if (!issuer && mappedCredentialToAccept.credentialToAccept.issuanceOpt.identifier) {
+                        const resolution = yield context.agent.identifierManagedGet(mappedCredentialToAccept.credentialToAccept.issuanceOpt.identifier);
+                        issuer = resolution.issuer;
+                    }
+                    if (!issuer) {
+                        throw Error(`We could not determine the issuer, which means we cannot sign the credential`);
+                    }
+                    logger.log(`Issuer for self-issued credential will be: ${issuer}`);
+                    const holderCredentialToSign = wrappedIssuerVC.decoded;
+                    let proofFormat = 'lds';
+                    if (wrappedIssuerVC.format.includes('jwt') && !wrappedIssuerVC.format.includes('mso_mdoc')) {
+                        holderCredentialToSign.iss = issuer;
+                        proofFormat = 'jwt';
+                    }
+                    if ('issuer' in holderCredentialToSign && !('iss' in holderCredentialToSign)) {
+                        holderCredentialToSign.issuer = issuer;
+                    }
+                    if ('sub' in holderCredentialToSign) {
+                        holderCredentialToSign.sub = issuer;
+                    }
+                    if ('credentialSubject' in holderCredentialToSign && !Array.isArray(holderCredentialToSign.credentialSubject)) {
+                        holderCredentialToSign.credentialSubject.id = issuer;
+                    }
+                    if ('vc' in holderCredentialToSign) {
+                        if (holderCredentialToSign.vc.credentialSubject) {
+                            holderCredentialToSign.vc.credentialSubject.id = issuer;
+                        }
+                        holderCredentialToSign.vc.issuer = issuer;
+                        delete holderCredentialToSign.vc.proof;
+                        delete holderCredentialToSign.vc.issuanceDate;
+                    }
+                    delete holderCredentialToSign.proof;
+                    delete holderCredentialToSign.issuanceDate;
+                    delete holderCredentialToSign.iat;
+                    logger.log(`Subject issuance/signing will sign credential of type ${proofFormat}:`, holderCredentialToSign);
+                    const issuedVC = yield context.agent.createVerifiableCredential({
+                        credential: ('vc' in holderCredentialToSign ? holderCredentialToSign.vc : holderCredentialToSign),
+                        fetchRemoteContexts: true,
+                        save: false,
+                        proofFormat,
+                    });
+                    if (!issuedVC) {
+                        throw Error(`Could not issue holder credential from the wallet`);
+                    }
+                    logger.log(`Holder ${issuedVC.issuer} issued new credential with id ${issuedVC.id}`, issuedVC);
+                    holderCredential = ssi_types_1.CredentialMapper.storedCredentialToOriginalFormat(issuedVC);
+                    persist = event === 'credential_accepted_holder_signed';
+                }
+                const notificationRequest = Object.assign(Object.assign({ notification_id: notificationId }, (holderCredential && { credential: holderCredential })), { event });
+                yield this.oid4vciHolderSendNotification({
+                    openID4VCIClientState,
+                    stored: persist,
+                    credentialsToAccept,
+                    credentialsSupported,
+                    notificationRequest,
+                    serverMetadata,
+                }, context);
+            }
+            const persistCredential = holderCredential
+                ? ssi_types_1.CredentialMapper.storedCredentialToOriginalFormat(holderCredential)
+                : mappedCredentialToAccept.rawVerifiableCredential;
+            if (!persist && holderCredential) {
+                logger.log(`Will not persist credential, since we are signing as a holder and the issuer asked not to persist`);
+            }
+            else {
+                logger.log(`Persisting credential`, persistCredential);
+                const issuer = ssi_types_1.CredentialMapper.issuerCorrelationIdFromIssuerType(verifiableCredential.issuer);
+                const [subjectCorrelationType, subjectCorrelationId] = this.determineSubjectCorrelation(issuanceOpt.identifier, issuer);
+                const persistedCredential = yield context.agent.crsAddCredential({
+                    credential: {
+                        rawDocument: (0, ssi_sdk_data_store_1.ensureRawDocument)(persistCredential),
+                        kmsKeyRef: kmsKeyRef,
+                        identifierMethod: method,
+                        credentialRole: ssi_sdk_data_store_1.CredentialRole.HOLDER,
+                        issuerCorrelationType: (issuer === null || issuer === void 0 ? void 0 : issuer.startsWith('did:')) ? ssi_sdk_data_store_1.CredentialCorrelationType.DID : ssi_sdk_data_store_1.CredentialCorrelationType.URL,
+                        issuerCorrelationId: issuer,
+                        subjectCorrelationType,
+                        subjectCorrelationId,
+                    },
+                });
+                yield context.agent.emit(IOID4VCIHolder_1.OID4VCIHolderEvent.CREDENTIAL_STORED, {
+                    credential: persistedCredential,
+                    vcHash: persistedCredential.hash,
+                });
+            }
+        });
+    }
+    oid4vciHolderSendNotification(args, context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            const { serverMetadata, notificationRequest, openID4VCIClientState } = args;
+            const notificationEndpoint = (_a = serverMetadata === null || serverMetadata === void 0 ? void 0 : serverMetadata.credentialIssuerMetadata) === null || _a === void 0 ? void 0 : _a.notification_endpoint;
+            if (!notificationEndpoint) {
+                return;
+            }
+            else if (!openID4VCIClientState) {
+                return Promise.reject(Error('Missing openID4VCI client state in context'));
+            }
+            else if (!notificationRequest) {
+                return Promise.reject(Error('Missing notification request'));
+            }
+            logger.log(`Will send notification to ${notificationEndpoint}`, notificationRequest);
+            const client = yield oid4vci_client_1.OpenID4VCIClient.fromState({ state: openID4VCIClientState });
+            yield client.sendNotification({ notificationEndpoint }, notificationRequest, (_b = openID4VCIClientState === null || openID4VCIClientState === void 0 ? void 0 : openID4VCIClientState.accessTokenResponse) === null || _b === void 0 ? void 0 : _b.access_token);
+            logger.log(`Notification to ${notificationEndpoint} has been dispatched`);
+        });
+    }
+    getFederationTrust(args, context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { requestData, serverMetadata, trustAnchors } = args;
+            if (trustAnchors.length === 0) {
+                return Promise.reject(Error('No trust anchors found'));
+            }
+            if (!(requestData === null || requestData === void 0 ? void 0 : requestData.uri)) {
+                return Promise.reject(Error('Missing request URI in context'));
+            }
+            if (!serverMetadata) {
+                return Promise.reject(Error('Missing serverMetadata in context'));
+            }
+            const url = new URL(requestData === null || requestData === void 0 ? void 0 : requestData.uri);
+            const params = new URLSearchParams(url.search);
+            const openidFederation = params.get('openid_federation');
+            const entityIdentifier = openidFederation !== null && openidFederation !== void 0 ? openidFederation : serverMetadata.issuer;
+            if (entityIdentifier.startsWith('http://')) {
+                console.warn(`OpenID federation does not support http://, only https:// allowed; got: (${url.toString()})`);
+                // OIDF always needs to be https
+                return [];
+            }
+            const result = yield context.agent.identifierExternalResolveByOIDFEntityId({
+                method: 'entity_id',
+                trustAnchors: trustAnchors,
+                identifier: entityIdentifier,
+            });
+            return result.trustedAnchors;
+        });
+    }
+    oid4vciHolderGetIssuerMetadata(args, context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { issuer, errorOnNotFound = true } = args;
+            return oid4vci_client_1.MetadataClient.retrieveAllMetadata(issuer, { errorOnNotFound });
+        });
+    }
+    determineSubjectCorrelation(identifier, issuer) {
+        switch (identifier.method) {
+            case 'did':
+                if ((0, ssi_sdk_ext_identifier_resolution_1.isManagedIdentifierResult)(identifier) && (0, ssi_sdk_ext_identifier_resolution_1.isManagedIdentifierDidResult)(identifier)) {
+                    return [ssi_sdk_data_store_1.CredentialCorrelationType.DID, identifier.did];
+                }
+                else if ((0, ssi_sdk_ext_identifier_resolution_1.isManagedIdentifierDidOpts)(identifier)) {
+                    return [ssi_sdk_data_store_1.CredentialCorrelationType.DID, typeof identifier.identifier === 'string' ? identifier.identifier : identifier.identifier.did];
+                }
+                break;
+            case 'kid':
+                if ((0, ssi_sdk_ext_identifier_resolution_1.isManagedIdentifierResult)(identifier) && (0, ssi_sdk_ext_identifier_resolution_1.isManagedIdentifierKidResult)(identifier)) {
+                    return [ssi_sdk_data_store_1.CredentialCorrelationType.KID, identifier.kid];
+                }
+                else if ((0, ssi_sdk_ext_identifier_resolution_1.isManagedIdentifierDidOpts)(identifier)) {
+                    return [ssi_sdk_data_store_1.CredentialCorrelationType.KID, identifier.identifier];
+                }
+                break;
+            case 'x5c':
+                if ((0, ssi_sdk_ext_identifier_resolution_1.isManagedIdentifierResult)(identifier) && (0, ssi_sdk_ext_identifier_resolution_1.isManagedIdentifierX5cResult)(identifier)) {
+                    return [ssi_sdk_data_store_1.CredentialCorrelationType.X509_SAN, identifier.x5c.join('\r\n')];
+                }
+                else if ((0, ssi_sdk_ext_identifier_resolution_1.isManagedIdentifierX5cOpts)(identifier)) {
+                    return [ssi_sdk_data_store_1.CredentialCorrelationType.X509_SAN, identifier.identifier.join('\r\n')];
+                }
+                break;
+        }
+        return [ssi_sdk_data_store_1.CredentialCorrelationType.URL, issuer];
+    }
+    idFromW3cCredentialSubject(wrappedIssuerVC) {
+        var _a, _b, _c, _d, _e;
+        if (Array.isArray((_a = wrappedIssuerVC.credential) === null || _a === void 0 ? void 0 : _a.credentialSubject)) {
+            if (((_b = wrappedIssuerVC.credential) === null || _b === void 0 ? void 0 : _b.credentialSubject.length) > 0) {
+                return (_c = wrappedIssuerVC.credential) === null || _c === void 0 ? void 0 : _c.credentialSubject[0].id;
+            }
+        }
+        else {
+            return (_e = (_d = wrappedIssuerVC.credential) === null || _d === void 0 ? void 0 : _d.credentialSubject) === null || _e === void 0 ? void 0 : _e.id;
+        }
+        return undefined;
+    }
+    getCredentialDefinition(issuanceOpt) {
+        if (issuanceOpt.format == 'ldp_vc' || issuanceOpt.format == 'jwt_vc_json-ld') {
+            return issuanceOpt.credential_definition;
+        }
+        return undefined;
+    }
+}
+exports.OID4VCIHolder = OID4VCIHolder;
+OID4VCIHolder.DEFAULT_MOBILE_REDIRECT_URI = `${oid4vci_common_1.DefaultURISchemes.CREDENTIAL_OFFER}://`;
+//# sourceMappingURL=OID4VCIHolder.js.map