@sphereon/ssi-sdk.siopv2-oid4vp-op-auth 0.36.1-feature.vdx24.einvoice.inbox.127 → 0.36.1-feature.vdx24.einvoice.inbox.141

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sphereon/ssi-sdk.siopv2-oid4vp-op-auth",
-  "version": "0.36.1-feature.vdx24.einvoice.inbox.127+3fa475f6",
+  "version": "0.36.1-feature.vdx24.einvoice.inbox.141+59be75ed",
   "source": "src/index.ts",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -30,21 +30,21 @@
     "@sphereon/did-auth-siop-adapter": "0.20.1-next.13",
     "@sphereon/oid4vc-common": "0.20.1-next.13",
     "@sphereon/pex-models": "^2.3.2",
-    "@sphereon/ssi-sdk-ext.did-utils": "0.36.1-feature.vdx24.einvoice.inbox.127+3fa475f6",
-    "@sphereon/ssi-sdk-ext.identifier-resolution": "0.36.1-feature.vdx24.einvoice.inbox.127+3fa475f6",
-    "@sphereon/ssi-sdk-ext.jwt-service": "0.36.1-feature.vdx24.einvoice.inbox.127+3fa475f6",
-    "@sphereon/ssi-sdk.contact-manager": "0.36.1-feature.vdx24.einvoice.inbox.127+3fa475f6",
-    "@sphereon/ssi-sdk.core": "0.36.1-feature.vdx24.einvoice.inbox.127+3fa475f6",
-    "@sphereon/ssi-sdk.credential-store": "0.36.1-feature.vdx24.einvoice.inbox.127+3fa475f6",
-    "@sphereon/ssi-sdk.credential-validation": "0.36.1-feature.vdx24.einvoice.inbox.127+3fa475f6",
-    "@sphereon/ssi-sdk.data-store-types": "0.36.1-feature.vdx24.einvoice.inbox.127+3fa475f6",
-    "@sphereon/ssi-sdk.issuance-branding": "0.36.1-feature.vdx24.einvoice.inbox.127+3fa475f6",
-    "@sphereon/ssi-sdk.pd-manager": "0.36.1-feature.vdx24.einvoice.inbox.127+3fa475f6",
-    "@sphereon/ssi-sdk.presentation-exchange": "0.36.1-feature.vdx24.einvoice.inbox.127+3fa475f6",
-    "@sphereon/ssi-sdk.sd-jwt": "0.36.1-feature.vdx24.einvoice.inbox.127+3fa475f6",
-    "@sphereon/ssi-sdk.siopv2-oid4vp-common": "0.36.1-feature.vdx24.einvoice.inbox.127+3fa475f6",
-    "@sphereon/ssi-sdk.xstate-machine-persistence": "0.36.1-feature.vdx24.einvoice.inbox.127+3fa475f6",
-    "@sphereon/ssi-types": "0.36.1-feature.vdx24.einvoice.inbox.127+3fa475f6",
+    "@sphereon/ssi-sdk-ext.did-utils": "0.36.1-feature.vdx24.einvoice.inbox.141+59be75ed",
+    "@sphereon/ssi-sdk-ext.identifier-resolution": "0.36.1-feature.vdx24.einvoice.inbox.141+59be75ed",
+    "@sphereon/ssi-sdk-ext.jwt-service": "0.36.1-feature.vdx24.einvoice.inbox.141+59be75ed",
+    "@sphereon/ssi-sdk.contact-manager": "0.36.1-feature.vdx24.einvoice.inbox.141+59be75ed",
+    "@sphereon/ssi-sdk.core": "0.36.1-feature.vdx24.einvoice.inbox.141+59be75ed",
+    "@sphereon/ssi-sdk.credential-store": "0.36.1-feature.vdx24.einvoice.inbox.141+59be75ed",
+    "@sphereon/ssi-sdk.credential-validation": "0.36.1-feature.vdx24.einvoice.inbox.141+59be75ed",
+    "@sphereon/ssi-sdk.data-store-types": "0.36.1-feature.vdx24.einvoice.inbox.141+59be75ed",
+    "@sphereon/ssi-sdk.issuance-branding": "0.36.1-feature.vdx24.einvoice.inbox.141+59be75ed",
+    "@sphereon/ssi-sdk.pd-manager": "0.36.1-feature.vdx24.einvoice.inbox.141+59be75ed",
+    "@sphereon/ssi-sdk.presentation-exchange": "0.36.1-feature.vdx24.einvoice.inbox.141+59be75ed",
+    "@sphereon/ssi-sdk.sd-jwt": "0.36.1-feature.vdx24.einvoice.inbox.141+59be75ed",
+    "@sphereon/ssi-sdk.siopv2-oid4vp-common": "0.36.1-feature.vdx24.einvoice.inbox.141+59be75ed",
+    "@sphereon/ssi-sdk.xstate-machine-persistence": "0.36.1-feature.vdx24.einvoice.inbox.141+59be75ed",
+    "@sphereon/ssi-types": "0.36.1-feature.vdx24.einvoice.inbox.141+59be75ed",
     "@sphereon/wellknown-dids-client": "^0.1.3",
     "@veramo/core": "4.2.0",
     "@veramo/credential-w3c": "4.2.0",
@@ -58,8 +58,8 @@
   },
   "devDependencies": {
     "@sphereon/did-uni-client": "^0.6.3",
-    "@sphereon/ssi-sdk-ext.did-resolver-jwk": "0.36.1-feature.vdx24.einvoice.inbox.127+3fa475f6",
-    "@sphereon/ssi-sdk.agent-config": "0.36.1-feature.vdx24.einvoice.inbox.127+3fa475f6",
+    "@sphereon/ssi-sdk-ext.did-resolver-jwk": "0.36.1-feature.vdx24.einvoice.inbox.141+59be75ed",
+    "@sphereon/ssi-sdk.agent-config": "0.36.1-feature.vdx24.einvoice.inbox.141+59be75ed",
     "@types/i18n-js": "^3.8.9",
     "@types/lodash.memoize": "^4.1.9",
     "@types/sha.js": "^2.4.4",
@@ -101,5 +101,5 @@
     "OpenID Connect",
     "Authenticator"
   ],
-  "gitHead": "3fa475f6938149c7104b7ca746e6883aa44c3d24"
+  "gitHead": "59be75ed177899b72dca9876174a65b8fb7037a0"
 }

package/src/services/Siopv2MachineService.ts

@@ -73,11 +73,23 @@ export const siopSendAuthorizationResponse = async (
   const firstVC = firstUniqueDC.uniformVerifiableCredential
 
   // Determine holder DID for identifier resolution
+  // For SD-JWT, check cnf claim first (key binding), then fall back to sub
   let holder: string | undefined
   if (CredentialMapper.isSdJwtDecodedCredential(firstVC)) {
-    //  TODO SDK-19: convert the JWK to hex and search for the appropriate key and associated DID
-    //  doesn't apply to did:jwk only, as you can represent any DID key as a
-    holder = firstVC.decodedPayload.cnf?.jwk ? `did:jwk:${encodeJoseBlob(firstVC.decodedPayload.cnf?.jwk)}#0` : firstVC.decodedPayload.sub
+    const cnf = firstVC.decodedPayload.cnf
+    if (cnf?.jwk) {
+      // cnf.jwk contains the raw JWK - compute did:jwk from it
+      // TODO SDK-19: convert the JWK to hex and search for the appropriate key and associated DID
+      holder = `did:jwk:${encodeJoseBlob(cnf.jwk)}#0`
+    } else if (cnf?.kid) {
+      // cnf.kid is a verification method reference (e.g., "did:web:example.com#key-1")
+      // Extract the DID part (everything before the fragment)
+      const kid = cnf.kid as string
+      holder = kid.includes('#') ? kid.split('#')[0] : kid
+    } else {
+      // Fall back to sub claim (credential subject)
+      holder = firstVC.decodedPayload.sub
+    }
   } else {
     holder = Array.isArray(firstVC.credentialSubject) ? firstVC.credentialSubject[0].id : firstVC.credentialSubject.id
   }

package/src/session/OID4VP.ts

@@ -101,11 +101,17 @@ export async function createVerifiablePresentationForFormat(
         aud: audience, // Always use the Client Identifier or Origin
       }
 
+      // Get the holder DID from the identifier to pass to createSdJwtPresentation
+      // This is needed because the credential's cnf.jwk thumbprint may not be registered as a key ID
+      const holder = getIdentifierString(identifier)
+      logger.debug(`Creating SD-JWT presentation with holder: ${holder}`)
+
       const presentationResult = await agent.createSdJwtPresentation({
         presentation: decodedSdJwt.compactSdJwtVc,
         kb: {
           payload: kbJwtPayload as any, // FIXME
         },
+        holder: holder, // Pass the holder DID explicitly to avoid JWK thumbprint lookup issues
       })
 
       return presentationResult.presentation