@sphereon/ssi-sdk.oid4vci-holder 0.34.1-feature.SSISDK.26.48 → 0.34.1-feature.SSISDK.26.54

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { AuthorizationChallengeCodeResponse, EndpointMetadataResult, CredentialOfferRequestWithBaseUrl, AuthzFlowType, AuthorizationRequestOpts, AuthorizationServerClientOpts, CredentialConfigurationSupported, ExperimentalSubjectIssuance, CredentialResponse, AuthorizationResponse, CredentialsSupportedDisplay, IssuerCredentialSubject, MetadataDisplay, NotificationRequest, Jwt } from '@sphereon/oid4vci-common';
+import { AuthorizationChallengeCodeResponse, EndpointMetadataResult, CredentialOfferRequestWithBaseUrl, AuthzFlowType, AuthorizationRequestOpts, AuthorizationServerClientOpts, CredentialConfigurationSupported, ExperimentalSubjectIssuance, CredentialResponseV1_0_15, CredentialResponse, AuthorizationResponse, CredentialsSupportedDisplay, IssuerCredentialSubject, MetadataDisplay, NotificationRequest, Jwt } from '@sphereon/oid4vci-common';
 import { IIdentifierResolution, ManagedIdentifierMethod, ManagedIdentifierOptsOrResult, ManagedIdentifierResult } from '@sphereon/ssi-sdk-ext.identifier-resolution';
 import { IJwtService } from '@sphereon/ssi-sdk-ext.jwt-service';
 import { IIdentifier, IPluginMethodMap, IAgentContext, ICredentialVerifier, ICredentialIssuer, IDIDManager, IResolver, IKeyManager, TKeyType, VerificationPolicies, TAgent, IAgentPlugin } from '@veramo/core';
@@ -356,6 +356,7 @@ declare enum OID4VCIMachineGuards {
     requirePinGuard = "oid4vciRequirePinGuard",
     requireAuthorizationGuard = "oid4vciRequireAuthorizationGuard",
     noAuthorizationGuard = "oid4vciNoAuthorizationGuard",
+    hasNonceEndpointGuard = "oid4vciHasNonceEndpointGuard ",
     hasAuthorizationResponse = "oid4vciHasAuthorizationResponse",
     hasNoContactIdentityGuard = "oid4vciHasNoContactIdentityGuard",
     verificationCodeGuard = "oid4vciVerificationCodeGuard",
@@ -482,7 +483,7 @@ type CredentialToAccept = {
     id?: string;
     types: string[];
     issuanceOpt: IssuanceOpts;
-    credentialResponse: CredentialResponse;
+    credentialResponse: CredentialResponseV1_0_15 | CredentialResponse;
 };
 type GetCredentialConfigsSupportedArgs = {
     client: OpenID4VCIClient;
@@ -667,7 +668,7 @@ type RequiredContext = IAgentContext<IIssuanceBranding & IContactManager & ICred
  * {@inheritDoc IOID4VCIHolder}
  */
 declare const oid4vciHolderContextMethods: Array<string>;
-declare function signCallback(identifier: ManagedIdentifierOptsOrResult, context: IAgentContext<IKeyManager & IDIDManager & IResolver & IIdentifierResolution & IJwtService>, nonce?: string): (jwt: Jwt, kid?: string) => Promise<string>;
+declare function signCallback(identifier: ManagedIdentifierOptsOrResult, context: IAgentContext<IKeyManager & IDIDManager & IResolver & IIdentifierResolution & IJwtService>, nonce?: string): (jwt: Jwt, kid?: string, noIssPayloadUpdate?: boolean) => Promise<string>;
 declare class OID4VCIHolder implements IAgentPlugin {
     private readonly hasher?;
     readonly eventTypes: Array<OID4VCIHolderEvent>;

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { AuthorizationChallengeCodeResponse, EndpointMetadataResult, CredentialOfferRequestWithBaseUrl, AuthzFlowType, AuthorizationRequestOpts, AuthorizationServerClientOpts, CredentialConfigurationSupported, ExperimentalSubjectIssuance, CredentialResponse, AuthorizationResponse, CredentialsSupportedDisplay, IssuerCredentialSubject, MetadataDisplay, NotificationRequest, Jwt } from '@sphereon/oid4vci-common';
+import { AuthorizationChallengeCodeResponse, EndpointMetadataResult, CredentialOfferRequestWithBaseUrl, AuthzFlowType, AuthorizationRequestOpts, AuthorizationServerClientOpts, CredentialConfigurationSupported, ExperimentalSubjectIssuance, CredentialResponseV1_0_15, CredentialResponse, AuthorizationResponse, CredentialsSupportedDisplay, IssuerCredentialSubject, MetadataDisplay, NotificationRequest, Jwt } from '@sphereon/oid4vci-common';
 import { IIdentifierResolution, ManagedIdentifierMethod, ManagedIdentifierOptsOrResult, ManagedIdentifierResult } from '@sphereon/ssi-sdk-ext.identifier-resolution';
 import { IJwtService } from '@sphereon/ssi-sdk-ext.jwt-service';
 import { IIdentifier, IPluginMethodMap, IAgentContext, ICredentialVerifier, ICredentialIssuer, IDIDManager, IResolver, IKeyManager, TKeyType, VerificationPolicies, TAgent, IAgentPlugin } from '@veramo/core';
@@ -356,6 +356,7 @@ declare enum OID4VCIMachineGuards {
     requirePinGuard = "oid4vciRequirePinGuard",
     requireAuthorizationGuard = "oid4vciRequireAuthorizationGuard",
     noAuthorizationGuard = "oid4vciNoAuthorizationGuard",
+    hasNonceEndpointGuard = "oid4vciHasNonceEndpointGuard ",
     hasAuthorizationResponse = "oid4vciHasAuthorizationResponse",
     hasNoContactIdentityGuard = "oid4vciHasNoContactIdentityGuard",
     verificationCodeGuard = "oid4vciVerificationCodeGuard",
@@ -482,7 +483,7 @@ type CredentialToAccept = {
     id?: string;
     types: string[];
     issuanceOpt: IssuanceOpts;
-    credentialResponse: CredentialResponse;
+    credentialResponse: CredentialResponseV1_0_15 | CredentialResponse;
 };
 type GetCredentialConfigsSupportedArgs = {
     client: OpenID4VCIClient;
@@ -667,7 +668,7 @@ type RequiredContext = IAgentContext<IIssuanceBranding & IContactManager & ICred
  * {@inheritDoc IOID4VCIHolder}
  */
 declare const oid4vciHolderContextMethods: Array<string>;
-declare function signCallback(identifier: ManagedIdentifierOptsOrResult, context: IAgentContext<IKeyManager & IDIDManager & IResolver & IIdentifierResolution & IJwtService>, nonce?: string): (jwt: Jwt, kid?: string) => Promise<string>;
+declare function signCallback(identifier: ManagedIdentifierOptsOrResult, context: IAgentContext<IKeyManager & IDIDManager & IResolver & IIdentifierResolution & IJwtService>, nonce?: string): (jwt: Jwt, kid?: string, noIssPayloadUpdate?: boolean) => Promise<string>;
 declare class OID4VCIHolder implements IAgentPlugin {
     private readonly hasher?;
     readonly eventTypes: Array<OID4VCIHolderEvent>;

package/dist/index.js

@@ -60,6 +60,7 @@ import { DefaultURISchemes, getTypesFromAuthorizationDetails, getTypesFromCreden
 import { SupportedDidMethodEnum as SupportedDidMethodEnum2 } from "@sphereon/ssi-sdk-ext.did-utils";
 import { isManagedIdentifierDidOpts, isManagedIdentifierDidResult as isManagedIdentifierDidResult2, isManagedIdentifierJwkResult, isManagedIdentifierKidResult, isManagedIdentifierResult as isManagedIdentifierResult2, isManagedIdentifierX5cOpts, isManagedIdentifierX5cResult } from "@sphereon/ssi-sdk-ext.identifier-resolution";
 import { signatureAlgorithmFromKey } from "@sphereon/ssi-sdk-ext.key-utils";
+import { defaultHasher as defaultHasher2 } from "@sphereon/ssi-sdk.core";
 import { ConnectionType, CorrelationIdentifierType, CredentialCorrelationType, CredentialRole, ensureRawDocument, IdentityOrigin } from "@sphereon/ssi-sdk.data-store";
 import { CredentialMapper as CredentialMapper2, JoseSignatureAlgorithm as JoseSignatureAlgorithm2, Loggers, parseDid } from "@sphereon/ssi-types";
 import { asArray as asArray2, computeEntryHash } from "@veramo/utils";
@@ -149,6 +150,7 @@ var OID4VCIMachineGuards = /* @__PURE__ */ function(OID4VCIMachineGuards2) {
   OID4VCIMachineGuards2["requirePinGuard"] = "oid4vciRequirePinGuard";
   OID4VCIMachineGuards2["requireAuthorizationGuard"] = "oid4vciRequireAuthorizationGuard";
   OID4VCIMachineGuards2["noAuthorizationGuard"] = "oid4vciNoAuthorizationGuard";
+  OID4VCIMachineGuards2["hasNonceEndpointGuard"] = "oid4vciHasNonceEndpointGuard ";
   OID4VCIMachineGuards2["hasAuthorizationResponse"] = "oid4vciHasAuthorizationResponse";
   OID4VCIMachineGuards2["hasNoContactIdentityGuard"] = "oid4vciHasNoContactIdentityGuard";
   OID4VCIMachineGuards2["verificationCodeGuard"] = "oid4vciVerificationCodeGuard";
@@ -1604,7 +1606,13 @@ var selectCredentialLocaleBranding = /* @__PURE__ */ __name(async (args) => {
 }, "selectCredentialLocaleBranding");
 var verifyCredentialToAccept = /* @__PURE__ */ __name(async (args) => {
   const { mappedCredential, hasher, onVerifyEBSICredentialIssuer, schemaValidation, context } = args;
-  const credential = mappedCredential.credentialToAccept.credentialResponse.credential;
+  const credentialResponse = mappedCredential.credentialToAccept.credentialResponse;
+  let credential;
+  if ("credential" in credentialResponse) {
+    credential = credentialResponse.credential;
+  } else if ("credentials" in credentialResponse && credentialResponse.credentials && Array.isArray(credentialResponse.credentials) && credentialResponse.credentials.length > 0) {
+    credential = credentialResponse.credentials[0].credential;
+  }
   if (!credential) {
     return Promise.reject(Error("No credential found in credential response"));
   }
@@ -1660,7 +1668,12 @@ var verifyCredentialToAccept = /* @__PURE__ */ __name(async (args) => {
 var mapCredentialToAccept = /* @__PURE__ */ __name(async (args) => {
   const { credentialToAccept, hasher } = args;
   const credentialResponse = credentialToAccept.credentialResponse;
-  const verifiableCredential = credentialResponse.credential;
+  let verifiableCredential;
+  if ("credential" in credentialResponse) {
+    verifiableCredential = credentialResponse.credential;
+  } else if ("credentials" in credentialResponse && credentialResponse.credentials && Array.isArray(credentialResponse.credentials) && credentialResponse.credentials.length > 0) {
+    verifiableCredential = credentialResponse.credentials[0].credential;
+  }
   if (!verifiableCredential) {
     return Promise.reject(Error("No credential found in credential response"));
   }
@@ -1994,6 +2007,7 @@ var getIssuanceCryptoSuite = /* @__PURE__ */ __name(async (opts) => {
     case "jwt":
     case "jwt_vc_json":
     case "jwt_vc":
+    case "vc+sd-jwt":
     case "dc+sd-jwt":
     case "mso_mdoc": {
       const supportedPreferences = jwtCryptographicSuitePreferences.filter((suite) => signing_algs_supported.includes(suite));
@@ -2063,7 +2077,6 @@ var startFirstPartApplicationMachine = /* @__PURE__ */ __name(async (args, conte
 
 // src/agent/OID4VCIHolder.ts
 import "cross-fetch/polyfill";
-import { defaultHasher as defaultHasher2 } from "@sphereon/ssi-sdk.core";
 var oid4vciHolderContextMethods = [
   "cmGetContacts",
   "cmGetContact",
@@ -2079,7 +2092,7 @@ var oid4vciHolderContextMethods = [
 ];
 var logger = Loggers.DEFAULT.get("sphereon:oid4vci:holder");
 function signCallback(identifier, context, nonce) {
-  return async (jwt, kid) => {
+  return async (jwt, kid, noIssPayloadUpdate) => {
     let resolution = await context.agent.identifierManagedGet(identifier);
     const jwk = jwt.header.jwk ?? (resolution.method === "jwk" ? resolution.jwk : void 0);
     if (!resolution.issuer && !jwt.payload.iss) {
@@ -2097,7 +2110,7 @@ function signCallback(identifier, context, nonce) {
     return (await context.agent.jwtCreateJwsCompactSignature({
       issuer: {
         ...resolution,
-        noIssPayloadUpdate: false
+        noIssPayloadUpdate: noIssPayloadUpdate ?? false
       },
       protectedHeader: header,
       payload
@@ -2133,6 +2146,7 @@ var OID4VCIHolder = class _OID4VCIHolder {
   };
   vcFormatPreferences = [
     "dc+sd-jwt",
+    "vc+sd-jwt",
     "mso_mdoc",
     "jwt_vc_json",
     "jwt_vc",
@@ -2718,7 +2732,16 @@ var OID4VCIHolder = class _OID4VCIHolder {
       if (Array.isArray(subjectIssuance?.notification_events_supported)) {
         event = subjectIssuance.notification_events_supported.includes("credential_accepted_holder_signed") ? "credential_accepted_holder_signed" : "credential_deleted_holder_signed";
         logger.log(`Subject issuance/signing will be used, with event`, event);
-        const issuerVC = mappedCredentialToAccept.credentialToAccept.credentialResponse.credential;
+        const credentialResponse = mappedCredentialToAccept.credentialToAccept.credentialResponse;
+        let issuerVC;
+        if ("credential" in credentialResponse) {
+          issuerVC = credentialResponse.credential;
+        } else if ("credentials" in credentialResponse && credentialResponse.credentials && Array.isArray(credentialResponse.credentials) && credentialResponse.credentials.length > 0) {
+          issuerVC = credentialResponse.credentials[0].credential;
+        }
+        if (!issuerVC) {
+          return Promise.reject(Error("No credential found in credential response"));
+        }
         const wrappedIssuerVC = CredentialMapper2.toWrappedVerifiableCredential(issuerVC, {
           hasher: this.hasher ?? defaultHasher2
         });