@sphereon/ssi-sdk.siopv2-oid4vp-op-auth 0.34.1-next.91 → 0.36.1-feat.SSISDK.83.3

package/dist/index.cjs

@@ -67,7 +67,6 @@ __export(index_exports, {
   DID_PREFIX: () => DID_PREFIX,
   DidAuthSiopOpAuthenticator: () => DidAuthSiopOpAuthenticator,
   LOGGER_NAMESPACE: () => LOGGER_NAMESPACE,
-  OID4VP: () => OID4VP,
   OID4VPCallbackStateListener: () => OID4VPCallbackStateListener,
   OpSession: () => OpSession,
   Siopv2HolderEvent: () => Siopv2HolderEvent,
@@ -85,6 +84,7 @@ __export(index_exports, {
   createOID4VPPresentationSignCallback: () => createOID4VPPresentationSignCallback,
   createOP: () => createOP,
   createOPBuilder: () => createOPBuilder,
+  createVerifiablePresentationForFormat: () => createVerifiablePresentationForFormat,
   didAuthSiopOpAuthenticatorMethods: () => didAuthSiopOpAuthenticatorMethods,
   getSigningAlgo: () => getSigningAlgo,
   schema: () => plugin_schema_default
@@ -423,8 +423,8 @@ var plugin_schema_default = {
 };
 
 // src/agent/DidAuthSiopOpAuthenticator.ts
-var import_did_auth_siop5 = require("@sphereon/did-auth-siop");
-var import_ssi_sdk6 = require("@sphereon/ssi-sdk.data-store");
+var import_did_auth_siop4 = require("@sphereon/did-auth-siop");
+var import_ssi_sdk7 = require("@sphereon/ssi-sdk.data-store-types");
 var import_ssi_types7 = require("@sphereon/ssi-types");
 var import_uuid2 = require("uuid");
 
@@ -451,10 +451,8 @@ __name(createOID4VPPresentationSignCallback, "createOID4VPPresentationSignCallba
 async function createOPBuilder({ opOptions, idOpts: idOpts1, context }) {
   const eventEmitter = opOptions.eventEmitter ?? new import_events.EventEmitter();
   const builder = import_did_auth_siop.OP.builder().withResponseMode(opOptions.responseMode ?? import_did_auth_siop.ResponseMode.DIRECT_POST).withSupportedVersions(opOptions.supportedVersions ?? [
-    import_did_auth_siop.SupportedVersion.SIOPv2_ID1,
-    import_did_auth_siop.SupportedVersion.JWT_VC_PRESENTATION_PROFILE_v1,
-    import_did_auth_siop.SupportedVersion.SIOPv2_D11,
-    import_did_auth_siop.SupportedVersion.SIOPv2_D12_OID4VP_D18
+    import_did_auth_siop.SupportedVersion.OID4VP_v1,
+    import_did_auth_siop.SupportedVersion.SIOPv2_OID4VP_D28
   ]).withExpiresIn(opOptions.expiresIn ?? 300).withEventEmitter(eventEmitter).withRegistration({
     passBy: import_did_auth_siop.PassBy.VALUE
   });
@@ -582,32 +580,205 @@ function getSigningAlgo(type) {
 __name(getSigningAlgo, "getSigningAlgo");
 
 // src/session/OID4VP.ts
-var OID4VP = class _OID4VP {
-  static {
-    __name(this, "OID4VP");
+var import_utils = require("@sphereon/pex/dist/main/lib/utils/index.js");
+var import_ssi_sdk_ext2 = require("@sphereon/ssi-sdk-ext.identifier-resolution");
+var import_ssi_sdk2 = require("@sphereon/ssi-sdk.sd-jwt");
+var import_ssi_types = require("@sphereon/ssi-types");
+
+// src/types/IDidAuthSiopOpAuthenticator.ts
+var LOGGER_NAMESPACE = "sphereon:siopv2-oid4vp:op-auth";
+var DEFAULT_JWT_PROOF_TYPE = "JwtProof2020";
+
+// src/types/siop-service/index.ts
+var Siopv2HolderEvent = /* @__PURE__ */ (function(Siopv2HolderEvent2) {
+  Siopv2HolderEvent2["CONTACT_IDENTITY_CREATED"] = "contact_identity_created";
+  Siopv2HolderEvent2["IDENTIFIER_CREATED"] = "identifier_created";
+  return Siopv2HolderEvent2;
+})({});
+var SupportedLanguage = /* @__PURE__ */ (function(SupportedLanguage2) {
+  SupportedLanguage2["ENGLISH"] = "en";
+  SupportedLanguage2["DUTCH"] = "nl";
+  return SupportedLanguage2;
+})({});
+
+// src/types/machine/index.ts
+var Siopv2MachineStates = /* @__PURE__ */ (function(Siopv2MachineStates2) {
+  Siopv2MachineStates2["createConfig"] = "createConfig";
+  Siopv2MachineStates2["getSiopRequest"] = "getSiopRequest";
+  Siopv2MachineStates2["getSelectableCredentials"] = "getSelectableCredentials";
+  Siopv2MachineStates2["retrieveContact"] = "retrieveContact";
+  Siopv2MachineStates2["transitionFromSetup"] = "transitionFromSetup";
+  Siopv2MachineStates2["addContact"] = "addContact";
+  Siopv2MachineStates2["addContactIdentity"] = "addContactIdentity";
+  Siopv2MachineStates2["selectCredentials"] = "selectCredentials";
+  Siopv2MachineStates2["sendResponse"] = "sendResponse";
+  Siopv2MachineStates2["handleError"] = "handleError";
+  Siopv2MachineStates2["aborted"] = "aborted";
+  Siopv2MachineStates2["declined"] = "declined";
+  Siopv2MachineStates2["error"] = "error";
+  Siopv2MachineStates2["done"] = "done";
+  return Siopv2MachineStates2;
+})({});
+var Siopv2MachineAddContactStates = /* @__PURE__ */ (function(Siopv2MachineAddContactStates2) {
+  Siopv2MachineAddContactStates2["idle"] = "idle";
+  Siopv2MachineAddContactStates2["executing"] = "executing";
+  Siopv2MachineAddContactStates2["next"] = "next";
+  return Siopv2MachineAddContactStates2;
+})({});
+var Siopv2MachineEvents = /* @__PURE__ */ (function(Siopv2MachineEvents2) {
+  Siopv2MachineEvents2["NEXT"] = "NEXT";
+  Siopv2MachineEvents2["PREVIOUS"] = "PREVIOUS";
+  Siopv2MachineEvents2["DECLINE"] = "DECLINE";
+  Siopv2MachineEvents2["SET_CONTACT_ALIAS"] = "SET_CONTACT_ALIAS";
+  Siopv2MachineEvents2["SET_CONTACT_CONSENT"] = "SET_CONTACT_CONSENT";
+  Siopv2MachineEvents2["CREATE_CONTACT"] = "CREATE_CONTACT";
+  Siopv2MachineEvents2["SET_SELECTED_CREDENTIALS"] = "SET_SELECTED_CREDENTIALS";
+  return Siopv2MachineEvents2;
+})({});
+var Siopv2MachineGuards = /* @__PURE__ */ (function(Siopv2MachineGuards2) {
+  Siopv2MachineGuards2["hasNoContactGuard"] = "Siopv2HasNoContactGuard";
+  Siopv2MachineGuards2["createContactGuard"] = "Siopv2CreateContactGuard";
+  Siopv2MachineGuards2["hasContactGuard"] = "Siopv2HasContactGuard";
+  Siopv2MachineGuards2["hasAuthorizationRequestGuard"] = "Siopv2HasAuthorizationRequestGuard";
+  Siopv2MachineGuards2["hasSelectableCredentialsAndContactGuard"] = "Siopv2HasSelectableCredentialsAndContactGuard";
+  Siopv2MachineGuards2["hasSelectedRequiredCredentialsGuard"] = "Siopv2HasSelectedRequiredCredentialsGuard";
+  Siopv2MachineGuards2["siopOnlyGuard"] = "Siopv2IsSiopOnlyGuard";
+  Siopv2MachineGuards2["siopWithOID4VPGuard"] = "Siopv2IsSiopWithOID4VPGuard";
+  return Siopv2MachineGuards2;
+})({});
+var Siopv2MachineServices = /* @__PURE__ */ (function(Siopv2MachineServices2) {
+  Siopv2MachineServices2["getSiopRequest"] = "getSiopRequest";
+  Siopv2MachineServices2["getSelectableCredentials"] = "getSelectableCredentials";
+  Siopv2MachineServices2["retrieveContact"] = "retrieveContact";
+  Siopv2MachineServices2["addContactIdentity"] = "addContactIdentity";
+  Siopv2MachineServices2["sendResponse"] = "sendResponse";
+  Siopv2MachineServices2["createConfig"] = "createConfig";
+  return Siopv2MachineServices2;
+})({});
+
+// src/types/identifier/index.ts
+var DID_PREFIX = "did";
+
+// src/session/OID4VP.ts
+var CLOCK_SKEW = 120;
+var logger = import_ssi_types.Loggers.DEFAULT.get(LOGGER_NAMESPACE);
+function extractOriginalCredential(credential) {
+  if (typeof credential === "string") {
+    return credential;
+  }
+  if ("digitalCredential" in credential) {
+    const udc = credential;
+    if (udc.originalVerifiableCredential) {
+      return udc.originalVerifiableCredential;
+    }
+    return udc.uniformVerifiableCredential;
   }
-  //private readonly session: OpSession
-  // private readonly allIdentifiers: string[]
-  // private readonly hasher?: HasherSync
-  constructor(args) {
+  if ("original" in credential) {
+    return credential.original;
   }
-  static async init(session, allIdentifiers, hasher) {
-    return new _OID4VP({
-      session,
-      allIdentifiers: allIdentifiers ?? await session.getSupportedDIDs(),
-      hasher
-    });
+  return credential;
+}
+__name(extractOriginalCredential, "extractOriginalCredential");
+function getIdentifierString(identifier) {
+  if ("opts" in identifier && "method" in identifier) {
+    if ((0, import_ssi_sdk_ext2.isManagedIdentifierDidResult)(identifier)) {
+      return identifier.did;
+    }
   }
-};
+  return identifier.issuer ?? identifier.kid ?? "";
+}
+__name(getIdentifierString, "getIdentifierString");
+async function createVerifiablePresentationForFormat(credential, identifier, context) {
+  const { nonce, audience, agent, clockSkew = CLOCK_SKEW } = context;
+  const originalCredential = extractOriginalCredential(credential);
+  const documentFormat = import_ssi_types.CredentialMapper.detectDocumentType(originalCredential);
+  logger.debug(`Creating VP for format: ${documentFormat}`);
+  switch (documentFormat) {
+    case import_ssi_types.DocumentFormat.SD_JWT_VC: {
+      const decodedSdJwt = await import_ssi_types.CredentialMapper.decodeSdJwtVcAsync(typeof originalCredential === "string" ? originalCredential : originalCredential.compactSdJwtVc, import_ssi_sdk2.defaultGenerateDigest);
+      const hashAlg = decodedSdJwt.signedPayload._sd_alg ?? "sha-256";
+      const sdHash = (0, import_utils.calculateSdHash)(decodedSdJwt.compactSdJwtVc, hashAlg, import_ssi_sdk2.defaultGenerateDigest);
+      const kbJwtPayload = {
+        iat: Math.floor(Date.now() / 1e3 - clockSkew),
+        sd_hash: sdHash,
+        nonce,
+        aud: audience
+      };
+      const presentationResult = await agent.createSdJwtPresentation({
+        presentation: decodedSdJwt.compactSdJwtVc,
+        kb: {
+          payload: kbJwtPayload
+        }
+      });
+      return presentationResult.presentation;
+    }
+    case import_ssi_types.DocumentFormat.JSONLD: {
+      const vcObject = typeof originalCredential === "string" ? JSON.parse(originalCredential) : originalCredential;
+      const vpObject = {
+        "@context": [
+          "https://www.w3.org/2018/credentials/v1"
+        ],
+        type: [
+          "VerifiablePresentation"
+        ],
+        verifiableCredential: [
+          vcObject
+        ]
+      };
+      return await agent.createVerifiablePresentation({
+        presentation: vpObject,
+        proofFormat: "lds",
+        challenge: nonce,
+        domain: audience,
+        keyRef: identifier.kmsKeyRef || identifier.kid
+      });
+    }
+    case import_ssi_types.DocumentFormat.MSO_MDOC: {
+      logger.warning("mso_mdoc format has basic support - production use requires proper mdoc VP token implementation");
+      return originalCredential;
+    }
+    default: {
+      const vcJwt = typeof originalCredential === "string" ? originalCredential : JSON.stringify(originalCredential);
+      const identifierString = getIdentifierString(identifier);
+      const vpPayload = {
+        iss: identifierString,
+        aud: audience,
+        nonce,
+        vp: {
+          "@context": [
+            "https://www.w3.org/2018/credentials/v1"
+          ],
+          type: [
+            "VerifiablePresentation"
+          ],
+          holder: identifierString,
+          verifiableCredential: [
+            vcJwt
+          ]
+        },
+        iat: Math.floor(Date.now() / 1e3 - clockSkew),
+        exp: Math.floor(Date.now() / 1e3 + 600 + clockSkew)
+      };
+      const vpJwt = await agent.createVerifiablePresentation({
+        presentation: vpPayload.vp,
+        proofFormat: "jwt",
+        domain: audience,
+        challenge: nonce,
+        keyRef: identifier.kmsKeyRef || identifier.kid
+      });
+      return vpJwt.proof?.jwt || vpJwt;
+    }
+  }
+}
+__name(createVerifiablePresentationForFormat, "createVerifiablePresentationForFormat");
 
 // src/session/OpSession.ts
 var import_did_auth_siop2 = require("@sphereon/did-auth-siop");
-var import_ssi_sdk_ext2 = require("@sphereon/ssi-sdk-ext.did-utils");
-var import_ssi_sdk2 = require("@sphereon/ssi-sdk.core");
-var import_ssi_types = require("@sphereon/ssi-types");
-var import_uuid = require("uuid");
+var import_ssi_sdk_ext3 = require("@sphereon/ssi-sdk-ext.did-utils");
+var import_ssi_sdk3 = require("@sphereon/ssi-sdk.core");
 var import_ssi_types2 = require("@sphereon/ssi-types");
-var logger = import_ssi_types2.Loggers.DEFAULT.get("sphereon:oid4vp:OpSession");
+var import_uuid = require("uuid");
+var logger2 = import_ssi_types2.Loggers.DEFAULT.get("sphereon:oid4vp:OpSession");
 var OpSession = class _OpSession {
   static {
     __name(this, "OpSession");
@@ -671,14 +842,14 @@ var OpSession = class _OpSession {
       didPrefix,
       agentMethods
     });
-    logger.debug(`RP supports subject syntax types: ${JSON.stringify(this.getSubjectSyntaxTypesSupported())}`);
+    logger2.debug(`RP supports subject syntax types: ${JSON.stringify(this.getSubjectSyntaxTypesSupported())}`);
     if (rpMethods.dids.length === 0) {
-      logger.debug(`RP does not support DIDs. Supported: ${JSON.stringify(this.getSubjectSyntaxTypesSupported())}`);
+      logger2.debug(`RP does not support DIDs. Supported: ${JSON.stringify(this.getSubjectSyntaxTypesSupported())}`);
       return [];
     }
     let intersection;
     if (rpMethods.dids.includes("did")) {
-      intersection = agentMethods && agentMethods.length > 0 ? agentMethods : (await (0, import_ssi_sdk_ext2.getAgentDIDMethods)(this.context)).map((method) => convertDidMethod(method, didPrefix));
+      intersection = agentMethods && agentMethods.length > 0 ? agentMethods : (await (0, import_ssi_sdk_ext3.getAgentDIDMethods)(this.context)).map((method) => convertDidMethod(method, didPrefix));
     } else if (!agentMethods || agentMethods.length === 0) {
       intersection = rpMethods.dids?.map((method) => convertDidMethod(method, didPrefix));
     } else {
@@ -691,7 +862,7 @@ var OpSession = class _OpSession {
   }
   getAgentDIDMethodsSupported(opts) {
     const agentMethods = this.options.supportedDIDMethods?.map((method) => convertDidMethod(method, opts.didPrefix));
-    logger.debug(`agent methods: ${JSON.stringify(agentMethods)}`);
+    logger2.debug(`agent methods: ${JSON.stringify(agentMethods)}`);
     return agentMethods;
   }
   async getSubjectSyntaxTypesSupported() {
@@ -702,15 +873,15 @@ var OpSession = class _OpSession {
   async getRPDIDMethodsSupported(opts) {
     let keyType;
     const agentMethods = (opts.agentMethods ?? this.getAgentDIDMethodsSupported(opts))?.map((method) => convertDidMethod(method, opts.didPrefix)) ?? [];
-    logger.debug(`agent methods supported: ${JSON.stringify(agentMethods)}`);
+    logger2.debug(`agent methods supported: ${JSON.stringify(agentMethods)}`);
     const authReq = await this.getAuthorizationRequest();
     const subjectSyntaxTypesSupported = authReq.registrationMetadataPayload?.subject_syntax_types_supported?.map((method) => convertDidMethod(method, opts.didPrefix)).filter((val) => !val.startsWith("did"));
-    logger.debug(`subject syntax types supported in rp method supported: ${JSON.stringify(subjectSyntaxTypesSupported)}`);
+    logger2.debug(`subject syntax types supported in rp method supported: ${JSON.stringify(subjectSyntaxTypesSupported)}`);
     const aud = await authReq.authorizationRequest.getMergedProperty("aud");
     let rpMethods = [];
     if (aud && aud.startsWith("did:")) {
-      const didMethod = convertDidMethod((0, import_ssi_types.parseDid)(aud).method, opts.didPrefix);
-      logger.debug(`aud did method: ${didMethod}`);
+      const didMethod = convertDidMethod((0, import_ssi_types2.parseDid)(aud).method, opts.didPrefix);
+      logger2.debug(`aud did method: ${didMethod}`);
       if (subjectSyntaxTypesSupported && subjectSyntaxTypesSupported.length > 0 && !subjectSyntaxTypesSupported.includes("did") && !subjectSyntaxTypesSupported.includes(didMethod)) {
         throw Error(`The aud DID method ${didMethod} is not in the supported types ${subjectSyntaxTypesSupported}`);
       }
@@ -725,7 +896,7 @@ var OpSession = class _OpSession {
     const isEBSI = rpMethods.length === 0 && (authReq.issuer?.includes(".ebsi.eu") || authReq.authorizationRequest.getMergedProperty("client_id")?.includes(".ebsi.eu"));
     let codecName = void 0;
     if (isEBSI && (!aud || !aud.startsWith("http"))) {
-      logger.debug(`EBSI detected, adding did:key to supported DID methods for RP`);
+      logger2.debug(`EBSI detected, adding did:key to supported DID methods for RP`);
       const didKeyMethod = convertDidMethod("did:key", opts.didPrefix);
       if (!agentMethods?.includes(didKeyMethod)) {
         throw Error(`EBSI detected, but agent did not support did:key. Please reconfigure agent`);
@@ -744,13 +915,13 @@ var OpSession = class _OpSession {
   }
   async getSupportedIdentifiers(opts) {
     const methods = await this.getSupportedDIDMethods(true);
-    logger.debug(`supported DID methods (did: prefix = true): ${JSON.stringify(methods)}`);
+    logger2.debug(`supported DID methods (did: prefix = true): ${JSON.stringify(methods)}`);
     if (methods.length === 0) {
       throw Error(`No DID methods are supported`);
     }
     const identifiers = await this.context.agent.didManagerFind().then((ids) => ids.filter((id) => methods.includes(id.provider)));
     if (identifiers.length === 0) {
-      logger.debug(`No identifiers available in agent supporting methods ${JSON.stringify(methods)}`);
+      logger2.debug(`No identifiers available in agent supporting methods ${JSON.stringify(methods)}`);
       if (opts?.createInCaseNoDIDFound !== false) {
         const { codecName, keyType } = await this.getRPDIDMethodsSupported({
           didPrefix: true,
@@ -764,11 +935,11 @@ var OpSession = class _OpSession {
             type: keyType
           }
         });
-        logger.debug(`Created a new identifier for the SIOP interaction: ${identifier.did}`);
+        logger2.debug(`Created a new identifier for the SIOP interaction: ${identifier.did}`);
         identifiers.push(identifier);
       }
     }
-    logger.debug(`supported identifiers: ${JSON.stringify(identifiers.map((id) => id.did))}`);
+    logger2.debug(`supported identifiers: ${JSON.stringify(identifiers.map((id) => id.did))}`);
     return identifiers;
   }
   async getSupportedDIDs() {
@@ -777,9 +948,6 @@ var OpSession = class _OpSession {
   async getRedirectUri() {
     return Promise.resolve(this.verifiedAuthorizationRequest.responseURI);
   }
-  async getOID4VP(args) {
-    return await OID4VP.init(this, args.allIdentifiers ?? [], args.hasher);
-  }
   async createJarmResponseCallback({ responseOpts }) {
     const agent = this.context.agent;
     return /* @__PURE__ */ __name(async function jarmResponse(opts) {
@@ -793,8 +961,8 @@ var OpSession = class _OpSession {
         protectedHeader: {},
         alg: requestObjectPayload.client_metadata.authorization_encrypted_response_alg ?? "ECDH-ES",
         enc: requestObjectPayload.client_metadata.authorization_encrypted_response_enc ?? "A256GCM",
-        apv: (0, import_ssi_sdk2.encodeBase64url)(opts.requestObjectPayload.nonce),
-        apu: (0, import_ssi_sdk2.encodeBase64url)((0, import_uuid.v4)()),
+        apv: (0, import_ssi_sdk3.encodeBase64url)(opts.requestObjectPayload.nonce),
+        apu: (0, import_ssi_sdk3.encodeBase64url)((0, import_uuid.v4)()),
         payload: authResponse,
         issuer: responseOpts.issuer,
         audience: responseOpts.audience
@@ -808,7 +976,7 @@ var OpSession = class _OpSession {
   async sendAuthorizationResponse(args) {
     const { responseSignerOpts, dcqlResponse, isFirstParty } = args;
     const resolveOpts = this.options.resolveOpts ?? {
-      resolver: (0, import_ssi_sdk_ext2.getAgentResolver)(this.context, {
+      resolver: (0, import_ssi_sdk_ext3.getAgentResolver)(this.context, {
         uniresolverResolution: true,
         localResolution: true,
         resolverResolution: true
@@ -859,80 +1027,6 @@ function convertDidMethod(didMethod, didPrefix) {
 }
 __name(convertDidMethod, "convertDidMethod");
 
-// src/types/IDidAuthSiopOpAuthenticator.ts
-var LOGGER_NAMESPACE = "sphereon:siopv2-oid4vp:op-auth";
-var DEFAULT_JWT_PROOF_TYPE = "JwtProof2020";
-
-// src/types/siop-service/index.ts
-var Siopv2HolderEvent = /* @__PURE__ */ (function(Siopv2HolderEvent2) {
-  Siopv2HolderEvent2["CONTACT_IDENTITY_CREATED"] = "contact_identity_created";
-  Siopv2HolderEvent2["IDENTIFIER_CREATED"] = "identifier_created";
-  return Siopv2HolderEvent2;
-})({});
-var SupportedLanguage = /* @__PURE__ */ (function(SupportedLanguage2) {
-  SupportedLanguage2["ENGLISH"] = "en";
-  SupportedLanguage2["DUTCH"] = "nl";
-  return SupportedLanguage2;
-})({});
-
-// src/types/machine/index.ts
-var Siopv2MachineStates = /* @__PURE__ */ (function(Siopv2MachineStates2) {
-  Siopv2MachineStates2["createConfig"] = "createConfig";
-  Siopv2MachineStates2["getSiopRequest"] = "getSiopRequest";
-  Siopv2MachineStates2["getSelectableCredentials"] = "getSelectableCredentials";
-  Siopv2MachineStates2["retrieveContact"] = "retrieveContact";
-  Siopv2MachineStates2["transitionFromSetup"] = "transitionFromSetup";
-  Siopv2MachineStates2["addContact"] = "addContact";
-  Siopv2MachineStates2["addContactIdentity"] = "addContactIdentity";
-  Siopv2MachineStates2["selectCredentials"] = "selectCredentials";
-  Siopv2MachineStates2["sendResponse"] = "sendResponse";
-  Siopv2MachineStates2["handleError"] = "handleError";
-  Siopv2MachineStates2["aborted"] = "aborted";
-  Siopv2MachineStates2["declined"] = "declined";
-  Siopv2MachineStates2["error"] = "error";
-  Siopv2MachineStates2["done"] = "done";
-  return Siopv2MachineStates2;
-})({});
-var Siopv2MachineAddContactStates = /* @__PURE__ */ (function(Siopv2MachineAddContactStates2) {
-  Siopv2MachineAddContactStates2["idle"] = "idle";
-  Siopv2MachineAddContactStates2["executing"] = "executing";
-  Siopv2MachineAddContactStates2["next"] = "next";
-  return Siopv2MachineAddContactStates2;
-})({});
-var Siopv2MachineEvents = /* @__PURE__ */ (function(Siopv2MachineEvents2) {
-  Siopv2MachineEvents2["NEXT"] = "NEXT";
-  Siopv2MachineEvents2["PREVIOUS"] = "PREVIOUS";
-  Siopv2MachineEvents2["DECLINE"] = "DECLINE";
-  Siopv2MachineEvents2["SET_CONTACT_ALIAS"] = "SET_CONTACT_ALIAS";
-  Siopv2MachineEvents2["SET_CONTACT_CONSENT"] = "SET_CONTACT_CONSENT";
-  Siopv2MachineEvents2["CREATE_CONTACT"] = "CREATE_CONTACT";
-  Siopv2MachineEvents2["SET_SELECTED_CREDENTIALS"] = "SET_SELECTED_CREDENTIALS";
-  return Siopv2MachineEvents2;
-})({});
-var Siopv2MachineGuards = /* @__PURE__ */ (function(Siopv2MachineGuards2) {
-  Siopv2MachineGuards2["hasNoContactGuard"] = "Siopv2HasNoContactGuard";
-  Siopv2MachineGuards2["createContactGuard"] = "Siopv2CreateContactGuard";
-  Siopv2MachineGuards2["hasContactGuard"] = "Siopv2HasContactGuard";
-  Siopv2MachineGuards2["hasAuthorizationRequestGuard"] = "Siopv2HasAuthorizationRequestGuard";
-  Siopv2MachineGuards2["hasSelectableCredentialsAndContactGuard"] = "Siopv2HasSelectableCredentialsAndContactGuard";
-  Siopv2MachineGuards2["hasSelectedRequiredCredentialsGuard"] = "Siopv2HasSelectedRequiredCredentialsGuard";
-  Siopv2MachineGuards2["siopOnlyGuard"] = "Siopv2IsSiopOnlyGuard";
-  Siopv2MachineGuards2["siopWithOID4VPGuard"] = "Siopv2IsSiopWithOID4VPGuard";
-  return Siopv2MachineGuards2;
-})({});
-var Siopv2MachineServices = /* @__PURE__ */ (function(Siopv2MachineServices2) {
-  Siopv2MachineServices2["getSiopRequest"] = "getSiopRequest";
-  Siopv2MachineServices2["getSelectableCredentials"] = "getSelectableCredentials";
-  Siopv2MachineServices2["retrieveContact"] = "retrieveContact";
-  Siopv2MachineServices2["addContactIdentity"] = "addContactIdentity";
-  Siopv2MachineServices2["sendResponse"] = "sendResponse";
-  Siopv2MachineServices2["createConfig"] = "createConfig";
-  return Siopv2MachineServices2;
-})({});
-
-// src/types/identifier/index.ts
-var DID_PREFIX = "did";
-
 // src/machine/Siopv2Machine.ts
 var import_xstate = require("xstate");
 
@@ -979,7 +1073,7 @@ var translate = Localization.translate;
 
 // src/machine/Siopv2Machine.ts
 var import_ssi_types3 = require("@sphereon/ssi-types");
-var logger2 = import_ssi_types3.Loggers.DEFAULT.get(LOGGER_NAMESPACE);
+var logger3 = import_ssi_types3.Loggers.DEFAULT.get(LOGGER_NAMESPACE);
 var Siopv2HasNoContactGuard = /* @__PURE__ */ __name((_ctx, _event) => {
   const { contact } = _ctx;
   return contact === void 0;
@@ -1309,7 +1403,7 @@ var Siopv2Machine = class {
     __name(this, "Siopv2Machine");
   }
   static newInstance(opts) {
-    logger2.info("New Siopv2Machine instance");
+    logger3.info("New Siopv2Machine instance");
     const interpreter = (0, import_xstate.interpret)(createSiopv2Machine(opts).withConfig({
       services: {
         ...opts?.services
@@ -1337,7 +1431,7 @@ var Siopv2Machine = class {
       });
     }
     interpreter.onTransition((snapshot) => {
-      logger2.info("onTransition to new state", snapshot.value);
+      logger3.info("onTransition to new state", snapshot.value);
     });
     return {
       interpreter
@@ -1346,12 +1440,12 @@ var Siopv2Machine = class {
 };
 
 // src/services/Siopv2MachineService.ts
-var import_did_auth_siop4 = require("@sphereon/did-auth-siop");
-var import_ssi_sdk_ext3 = require("@sphereon/ssi-sdk-ext.identifier-resolution");
-var import_ssi_sdk3 = require("@sphereon/ssi-sdk.credential-store");
-var import_ssi_sdk4 = require("@sphereon/ssi-sdk.data-store");
+var import_ssi_sdk_ext4 = require("@sphereon/ssi-sdk-ext.did-utils");
+var import_ssi_sdk_ext5 = require("@sphereon/ssi-sdk-ext.identifier-resolution");
+var import_ssi_sdk4 = require("@sphereon/ssi-sdk.core");
+var import_ssi_sdk5 = require("@sphereon/ssi-sdk.credential-store");
+var import_ssi_sdk6 = require("@sphereon/ssi-sdk.data-store-types");
 var import_ssi_types6 = require("@sphereon/ssi-types");
-var import_ssi_sdk5 = require("@sphereon/ssi-sdk.core");
 var import_dcql = require("dcql");
 
 // src/utils/dcql.ts
@@ -1392,12 +1486,12 @@ function convertToDcqlCredentials(credential, hasher) {
 __name(convertToDcqlCredentials, "convertToDcqlCredentials");
 
 // src/services/Siopv2MachineService.ts
-var import_ssi_sdk_ext4 = require("@sphereon/ssi-sdk-ext.did-utils");
-var logger3 = import_ssi_types6.Loggers.DEFAULT.get(LOGGER_NAMESPACE);
+var CLOCK_SKEW2 = 120;
+var logger4 = import_ssi_types6.Loggers.DEFAULT.get(LOGGER_NAMESPACE);
 var siopSendAuthorizationResponse = /* @__PURE__ */ __name(async (connectionType, args, context) => {
   const { agent } = context;
   const { credentials } = args;
-  if (connectionType !== import_ssi_sdk4.ConnectionType.SIOPv2_OpenID4VP) {
+  if (connectionType !== import_ssi_sdk6.ConnectionType.SIOPv2_OpenID4VP) {
     return Promise.reject(Error(`No supported authentication provider for type: ${connectionType}`));
   }
   const session = await agent.siopGetOPSession({
@@ -1405,10 +1499,10 @@ var siopSendAuthorizationResponse = /* @__PURE__ */ __name(async (connectionType
   });
   const request = await session.getAuthorizationRequest();
   const aud = request.authorizationRequest.getMergedProperty("aud");
-  logger3.debug(`AUD: ${aud}`);
-  logger3.debug(JSON.stringify(request.authorizationRequest));
-  const domain = await request.authorizationRequest.getMergedProperty("client_id") ?? request.issuer ?? (request.versions.includes(import_did_auth_siop4.SupportedVersion.JWT_VC_PRESENTATION_PROFILE_v1) ? "https://self-issued.me/v2/openid-vc" : "https://self-issued.me/v2");
-  logger3.debug(`NONCE: ${session.nonce}, domain: ${domain}`);
+  logger4.debug(`AUD: ${aud}`);
+  logger4.debug(JSON.stringify(request.authorizationRequest));
+  const domain = await request.authorizationRequest.getMergedProperty("client_id") ?? request.issuer ?? "https://self-issued.me/v2";
+  logger4.debug(`NONCE: ${session.nonce}, domain: ${domain}`);
   const firstUniqueDC = credentials[0];
   if (typeof firstUniqueDC !== "object" || !("digitalCredential" in firstUniqueDC)) {
     return Promise.reject(Error("SiopMachine only supports UniqueDigitalCredentials for now"));
@@ -1416,10 +1510,12 @@ var siopSendAuthorizationResponse = /* @__PURE__ */ __name(async (connectionType
   let identifier;
   const digitalCredential = firstUniqueDC.digitalCredential;
   const firstVC = firstUniqueDC.uniformVerifiableCredential;
-  const holder = import_ssi_types6.CredentialMapper.isSdJwtDecodedCredential(firstVC) ? firstVC.decodedPayload.cnf?.jwk ? (
-    //doesn't apply to did:jwk only, as you can represent any DID key as a JWK. So whenever you encounter a JWK it doesn't mean it had to come from a did:jwk in the system. It just can always be represented as a did:jwk
-    `did:jwk:${(0, import_ssi_sdk5.encodeJoseBlob)(firstVC.decodedPayload.cnf?.jwk)}#0`
-  ) : firstVC.decodedPayload.sub : Array.isArray(firstVC.credentialSubject) ? firstVC.credentialSubject[0].id : firstVC.credentialSubject.id;
+  let holder;
+  if (import_ssi_types6.CredentialMapper.isSdJwtDecodedCredential(firstVC)) {
+    holder = firstVC.decodedPayload.cnf?.jwk ? `did:jwk:${(0, import_ssi_sdk4.encodeJoseBlob)(firstVC.decodedPayload.cnf?.jwk)}#0` : firstVC.decodedPayload.sub;
+  } else {
+    holder = Array.isArray(firstVC.credentialSubject) ? firstVC.credentialSubject[0].id : firstVC.credentialSubject.id;
+  }
   if (!digitalCredential.kmsKeyRef) {
     if (!holder) {
       return Promise.reject(`No holder found and no kmsKeyRef in DB. Cannot determine identifier to use`);
@@ -1429,10 +1525,10 @@ var siopSendAuthorizationResponse = /* @__PURE__ */ __name(async (connectionType
         identifier: holder
       });
     } catch (e) {
-      logger3.debug(`Holder DID not found: ${holder}`);
+      logger4.debug(`Holder DID not found: ${holder}`);
       throw e;
     }
-  } else if ((0, import_ssi_sdk_ext3.isOID4VCIssuerIdentifier)(digitalCredential.kmsKeyRef)) {
+  } else if ((0, import_ssi_sdk_ext5.isOID4VCIssuerIdentifier)(digitalCredential.kmsKeyRef)) {
     identifier = await session.context.agent.identifierManagedGetByOID4VCIssuer({
       identifier: firstUniqueDC.digitalCredential.kmsKeyRef
     });
@@ -1460,6 +1556,13 @@ var siopSendAuthorizationResponse = /* @__PURE__ */ __name(async (connectionType
   if (!queryResult.can_be_satisfied) {
     return Promise.reject(Error("Credentials do not match required query request"));
   }
+  const presentationContext = {
+    nonce: request.requestObject?.getPayload()?.nonce ?? session.nonce,
+    audience: domain,
+    agent: context.agent,
+    clockSkew: CLOCK_SKEW2,
+    hasher: args.hasher
+  };
   const presentation = {};
   const uniqueCredentials = Array.from(dcqlCredentialsWithCredentials.values());
   for (const [key, value] of Object.entries(queryResult.credential_matches)) {
@@ -1469,12 +1572,12 @@ var siopSendAuthorizationResponse = /* @__PURE__ */ __name(async (connectionType
       if (!vc) {
         continue;
       }
-      const originalVc = retrieveEncodedCredential(vc);
-      if (!originalVc) {
-        continue;
-      }
-      if (originalVc) {
-        presentation[key] = originalVc;
+      try {
+        const vp = await createVerifiablePresentationForFormat(vc, identifier, presentationContext);
+        presentation[key] = vp;
+      } catch (error) {
+        logger4.error(`Failed to create VP for credential ${key}:`, error);
+        throw error;
       }
     }
   }
@@ -1485,12 +1588,9 @@ var siopSendAuthorizationResponse = /* @__PURE__ */ __name(async (connectionType
       dcqlPresentation
     }
   });
-  logger3.debug(`Response: `, response);
+  logger4.debug(`Response: `, response);
   return response;
 }, "siopSendAuthorizationResponse");
-var retrieveEncodedCredential = /* @__PURE__ */ __name((credential) => {
-  return credential.originalVerifiableCredential !== void 0 && credential.originalVerifiableCredential !== null && credential?.originalVerifiableCredential?.compactSdJwtVc !== void 0 && credential?.originalVerifiableCredential?.compactSdJwtVc !== null ? credential.originalVerifiableCredential.compactSdJwtVc : credential.originalVerifiableCredential;
-}, "retrieveEncodedCredential");
 var getSelectableCredentials = /* @__PURE__ */ __name(async (dcqlQuery, context) => {
   const agentContext = {
     ...context,
@@ -1498,7 +1598,7 @@ var getSelectableCredentials = /* @__PURE__ */ __name(async (dcqlQuery, context)
   };
   const { agent } = agentContext;
   const uniqueVerifiableCredentials = await agent.crsGetUniqueCredentials({
-    filter: (0, import_ssi_sdk3.verifiableCredentialForRoleFilter)(import_ssi_sdk4.CredentialRole.HOLDER)
+    filter: (0, import_ssi_sdk5.verifiableCredentialForRoleFilter)(import_ssi_types6.CredentialRole.HOLDER)
   });
   const branding = await agent.ibGetCredentialBranding();
   const dcqlCredentialsWithCredentials = new Map(uniqueVerifiableCredentials.map((vc) => [
@@ -1569,7 +1669,7 @@ var translateCorrelationIdToName = /* @__PURE__ */ __name(async (correlationId,
 }, "translateCorrelationIdToName");
 
 // src/agent/DidAuthSiopOpAuthenticator.ts
-var logger4 = import_ssi_types7.Loggers.DEFAULT.options(LOGGER_NAMESPACE, {}).get(LOGGER_NAMESPACE);
+var logger5 = import_ssi_types7.Loggers.DEFAULT.options(LOGGER_NAMESPACE, {}).get(LOGGER_NAMESPACE);
 var didAuthSiopOpAuthenticatorMethods = [
   "cmGetContacts",
   "cmGetContact",
@@ -1723,11 +1823,11 @@ var DidAuthSiopOpAuthenticator = class {
         hasher: this.hasher
       }
     }));
-    logger4.debug(`session: ${JSON.stringify(session.id, null, 2)}`);
+    logger5.debug(`session: ${JSON.stringify(session.id, null, 2)}`);
     const verifiedAuthorizationRequest = await session.getAuthorizationRequest();
     const clientName = verifiedAuthorizationRequest.registrationMetadataPayload?.client_name;
     const url = verifiedAuthorizationRequest.responseURI ?? (args.url.includes("request_uri") ? decodeURIComponent(args.url.split("?request_uri=")[1].trim()) : verifiedAuthorizationRequest.issuer ?? verifiedAuthorizationRequest.registrationMetadataPayload?.client_id);
-    const uri = url.includes("://") ? new URL(url) : void 0;
+    const uri = url?.includes("://") ? new URL(url) : void 0;
     const correlationId = uri?.hostname ?? await this.determineCorrelationId(uri, verifiedAuthorizationRequest, clientName, context);
     const clientId = verifiedAuthorizationRequest.authorizationRequest.getMergedProperty("client_id");
     return {
@@ -1785,12 +1885,12 @@ var DidAuthSiopOpAuthenticator = class {
     if (correlationId) {
       const identity = {
         alias: correlationId,
-        origin: import_ssi_sdk6.IdentityOrigin.EXTERNAL,
+        origin: import_ssi_sdk7.IdentityOrigin.EXTERNAL,
         roles: [
-          import_ssi_sdk6.CredentialRole.ISSUER
+          import_ssi_types7.CredentialRole.ISSUER
         ],
         identifier: {
-          type: correlationId.startsWith("did:") ? import_ssi_sdk6.CorrelationIdentifierType.DID : import_ssi_sdk6.CorrelationIdentifierType.URL,
+          type: correlationId.startsWith("did:") ? import_ssi_sdk7.CorrelationIdentifierType.DID : import_ssi_sdk7.CorrelationIdentifierType.URL,
           correlationId
         }
       };
@@ -1802,7 +1902,7 @@ var DidAuthSiopOpAuthenticator = class {
         contactId: contact.id,
         identity: addedIdentity
       });
-      logger4.info(`Contact identity created: ${JSON.stringify(addedIdentity)}`);
+      logger5.info(`Contact identity created: ${JSON.stringify(addedIdentity)}`);
     }
   }
   async siopSendResponse(args, context) {
@@ -1813,7 +1913,7 @@ var DidAuthSiopOpAuthenticator = class {
     if (authorizationRequestData === void 0) {
       return Promise.reject(Error("Missing authorization request data in context"));
     }
-    const response = await siopSendAuthorizationResponse(import_ssi_sdk6.ConnectionType.SIOPv2_OpenID4VP, {
+    const response = await siopSendAuthorizationResponse(import_ssi_sdk7.ConnectionType.SIOPv2_OpenID4VP, {
       sessionId: didAuthConfig.sessionId,
       ...args.idOpts && {
         idOpts: args.idOpts
@@ -1831,7 +1931,7 @@ var DidAuthSiopOpAuthenticator = class {
     return {
       body: responseBody,
       url: response?.url,
-      queryParams: (0, import_did_auth_siop5.decodeUriAsJson)(response?.url)
+      queryParams: (0, import_did_auth_siop4.decodeUriAsJson)(response?.url)
     };
   }
   async siopGetSelectableCredentials(args, context) {
@@ -1845,7 +1945,7 @@ var DidAuthSiopOpAuthenticator = class {
 
 // src/machine/CallbackStateListener.ts
 var import_ssi_types8 = require("@sphereon/ssi-types");
-var logger5 = import_ssi_types8.Loggers.DEFAULT.options("sphereon:siopv2-oid4vp:op-auth", {
+var logger6 = import_ssi_types8.Loggers.DEFAULT.options("sphereon:siopv2-oid4vp:op-auth", {
   defaultLogLevel: import_ssi_types8.LogLevel.DEBUG,
   methods: [
     import_ssi_types8.LogMethod.CONSOLE
@@ -1854,21 +1954,21 @@ var logger5 = import_ssi_types8.Loggers.DEFAULT.options("sphereon:siopv2-oid4vp:
 var OID4VPCallbackStateListener = /* @__PURE__ */ __name((callbacks) => {
   return async (oid4vciMachine, state) => {
     if (state._event.type === "internal") {
-      logger5.debug("oid4vpCallbackStateListener: internal event");
+      logger6.debug("oid4vpCallbackStateListener: internal event");
       return;
     }
-    logger5.info(`VP state listener state: ${JSON.stringify(state.value)}`);
+    logger6.info(`VP state listener state: ${JSON.stringify(state.value)}`);
     if (!callbacks || callbacks.size === 0) {
-      logger5.info(`VP no callbacks registered for state: ${JSON.stringify(state.value)}`);
+      logger6.info(`VP no callbacks registered for state: ${JSON.stringify(state.value)}`);
       return;
     }
     for (const [stateKey, callback] of callbacks) {
       if (state.matches(stateKey)) {
-        logger5.log(`VP state callback for state: ${JSON.stringify(state.value)}, will execute...`);
-        await callback(oid4vciMachine, state).then(() => logger5.log(`VP state callback executed for state: ${JSON.stringify(state.value)}`)).catch((error) => {
-          logger5.error(`VP state callback failed for state: ${JSON.stringify(state.value)}, error: ${JSON.stringify(error?.message)}, ${JSON.stringify(state.event)}`);
+        logger6.log(`VP state callback for state: ${JSON.stringify(state.value)}, will execute...`);
+        await callback(oid4vciMachine, state).then(() => logger6.log(`VP state callback executed for state: ${JSON.stringify(state.value)}`)).catch((error) => {
+          logger6.error(`VP state callback failed for state: ${JSON.stringify(state.value)}, error: ${JSON.stringify(error?.message)}, ${JSON.stringify(state.event)}`);
           if (error.stack) {
-            logger5.error(error.stack);
+            logger6.error(error.stack);
           }
         });
         break;
@@ -1878,12 +1978,12 @@ var OID4VPCallbackStateListener = /* @__PURE__ */ __name((callbacks) => {
 }, "OID4VPCallbackStateListener");
 
 // src/link-handler/index.ts
-var import_ssi_sdk7 = require("@sphereon/ssi-sdk.agent-config");
-var import_ssi_sdk8 = require("@sphereon/ssi-sdk.core");
-var import_ssi_sdk9 = require("@sphereon/ssi-sdk.xstate-machine-persistence");
+var import_ssi_sdk8 = require("@sphereon/ssi-sdk.agent-config");
+var import_ssi_sdk9 = require("@sphereon/ssi-sdk.core");
+var import_ssi_sdk10 = require("@sphereon/ssi-sdk.xstate-machine-persistence");
 var import_ssi_types9 = require("@sphereon/ssi-types");
-var logger6 = import_ssi_types9.Loggers.DEFAULT.options(LOGGER_NAMESPACE, {}).get(LOGGER_NAMESPACE);
-var Siopv2OID4VPLinkHandler = class extends import_ssi_sdk8.LinkHandlerAdapter {
+var logger7 = import_ssi_types9.Loggers.DEFAULT.options(LOGGER_NAMESPACE, {}).get(LOGGER_NAMESPACE);
+var Siopv2OID4VPLinkHandler = class extends import_ssi_sdk9.LinkHandlerAdapter {
   static {
     __name(this, "Siopv2OID4VPLinkHandler");
   }
@@ -1902,15 +2002,15 @@ var Siopv2OID4VPLinkHandler = class extends import_ssi_sdk8.LinkHandlerAdapter {
     this.idOpts = args.idOpts;
   }
   async handle(url, opts) {
-    logger6.debug(`handling SIOP link: ${url}`);
+    logger7.debug(`handling SIOP link: ${url}`);
     const siopv2Machine = await this.context.agent.siopGetMachineInterpreter({
       url,
       idOpts: opts?.idOpts ?? this.idOpts,
       stateNavigationListener: this.stateNavigationListener
     });
     const interpreter = siopv2Machine.interpreter;
-    if (!this.noStateMachinePersistence && !opts?.machineState && (0, import_ssi_sdk7.contextHasPlugin)(this.context, "machineStatesFindActive")) {
-      const init = await (0, import_ssi_sdk9.interpreterStartOrResume)({
+    if (!this.noStateMachinePersistence && !opts?.machineState && (0, import_ssi_sdk8.contextHasPlugin)(this.context, "machineStatesFindActive")) {
+      const init = await (0, import_ssi_sdk10.interpreterStartOrResume)({
         interpreter,
         context: this.context,
         cleanupAllOtherInstances: true,
@@ -1918,10 +2018,10 @@ var Siopv2OID4VPLinkHandler = class extends import_ssi_sdk8.LinkHandlerAdapter {
         singletonCheck: true,
         noRegistration: this.noStateMachinePersistence
       });
-      logger6.debug(`SIOP machine started for link: ${url}`, init);
+      logger7.debug(`SIOP machine started for link: ${url}`, init);
     } else {
       interpreter.start(opts?.machineState);
-      logger6.debug(`SIOP machine started for link: ${url}`);
+      logger7.debug(`SIOP machine started for link: ${url}`);
     }
   }
 };