@sphereon/ssi-sdk.siopv2-oid4vp-rp-auth 0.32.1-next.54 → 0.33.1-feature.jose.vcdm.55

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA;;GAEG;AACH,MAAM,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;AACtC,wBAAM;AACf,6CAA2C;AAAlC,oGAAA,QAAQ,OAAA;AACjB,oDAAiC"}
+{"version":3,"sources":["../plugin.schema.json","../src/agent/SIOPv2RP.ts","../src/functions.ts","../src/RPInstance.ts","../src/types/ISIOPv2RP.ts","../src/index.ts"],"sourcesContent":["{\n  \"IDidAuthSiopOpAuthenticator\": {\n    \"components\": {\n      \"schemas\": {\n        \"IGetSiopSessionArgs\": {\n          \"type\": \"object\",\n          \"properties\": {\n            \"sessionId\": {\n              \"type\": \"string\"\n            },\n            \"additionalProperties\": false\n          },\n          \"required\": [\"sessionId\"],\n          \"description\": \"Arguments needed for {@link DidAuthSiopOpAuthenticator.getSessionForSiop } \"\n        },\n        \"IRegisterSiopSessionArgs\": {\n          \"type\": \"object\",\n          \"properties\": {\n            \"identifier\": {\n              \"type\": \"object\",\n              \"properties\": {\n                \"did\": {\n                  \"type\": \"string\"\n                },\n                \"alias\": {\n                  \"type\": \"string\"\n                },\n                \"provider\": {\n                  \"type\": \"string\"\n                },\n                \"controllerKeyId\": {\n                  \"type\": \"string\"\n                },\n                \"keys\": {\n                  \"type\": \"array\",\n                  \"items\": {\n                    \"type\": \"object\",\n                    \"properties\": {\n                      \"additionalProperties\": true\n                    }\n                  }\n                },\n                \"services\": {\n                  \"type\": \"array\",\n                  \"items\": {\n                    \"type\": \"object\",\n                    \"properties\": {\n                      \"additionalProperties\": true\n                    }\n                  }\n                }\n              },\n              \"additionalProperties\": false,\n              \"required\": [\"did\", \"provider\", \"keys\", \"services\"]\n            },\n            \"sessionId\": {\n              \"type\": \"string\"\n            },\n            \"expiresIn\": {\n              \"type\": \"number\"\n            },\n            \"additionalProperties\": false\n          },\n          \"required\": [\"identifier\"],\n          \"description\": \"Arguments needed for {@link DidAuthSiopOpAuthenticator.registerSessionForSiop } \"\n        },\n        \"IRemoveSiopSessionArgs\": {\n          \"type\": \"object\",\n          \"properties\": {\n            \"sessionId\": {\n              \"type\": \"string\"\n            },\n            \"additionalProperties\": false\n          },\n          \"required\": [\"sessionId\"],\n          \"description\": \"Arguments needed for {@link DidAuthSiopOpAuthenticator.removeSessionForSiop } \"\n        },\n        \"IAuthenticateWithSiopArgs\": {\n          \"type\": \"object\",\n          \"properties\": {\n            \"sessionId\": {\n              \"type\": \"string\"\n            },\n            \"stateId\": {\n              \"type\": \"string\"\n            },\n            \"redirectUrl\": {\n              \"type\": \"string\"\n            },\n            \"additionalProperties\": false\n          },\n          \"required\": [\"sessionId\", \"stateId\", \"redirectUrl\"],\n          \"description\": \"Arguments needed for {@link DidAuthSiopOpAuthenticator.authenticateWithSiop } \"\n        },\n        \"IResponse\": {\n          \"type\": \"object\",\n          \"properties\": {\n            \"status\": {\n              \"type\": \"number\"\n            },\n            \"additionalProperties\": true\n          },\n          \"required\": [\"status\"],\n          \"description\": \"Result of {@link DidAuthSiopOpAuthenticator.authenticateWithSiop & DidAuthSiopOpAuthenticator.sendSiopAuthenticationResponse } \"\n        },\n        \"IGetSiopAuthenticationRequestFromRpArgs\": {\n          \"type\": \"object\",\n          \"properties\": {\n            \"sessionId\": {\n              \"type\": \"string\"\n            },\n            \"stateId\": {\n              \"type\": \"string\"\n            },\n            \"redirectUrl\": {\n              \"type\": \"string\"\n            },\n            \"additionalProperties\": false\n          },\n          \"required\": [\"sessionId\", \"stateId\", \"redirectUrl\"],\n          \"description\": \"Arguments needed for {@link DidAuthSiopOpAuthenticator.getSiopAuthenticationRequestFromRP } \"\n        },\n        \"ParsedAuthenticationRequestURI\": {\n          \"type\": \"object\",\n          \"properties\": {\n            \"jwt\": {\n              \"type\": \"string\"\n            },\n            \"requestPayload\": {\n              \"type\": \"object\",\n              \"properties\": {\n                \"additionalProperties\": true\n              }\n            },\n            \"registration\": {\n              \"type\": \"object\",\n              \"properties\": {\n                \"additionalProperties\": true\n              }\n            },\n            \"additionalProperties\": false\n          },\n          \"required\": [\"jwt\", \"requestPayload\", \"registration\"],\n          \"description\": \"Result of {@link DidAuthSiopOpAuthenticator.getSiopAuthenticationRequestFromRP } \"\n        },\n        \"IGetSiopAuthenticationRequestDetailsArgs\": {\n          \"type\": \"object\",\n          \"properties\": {\n            \"sessionId\": {\n              \"type\": \"string\"\n            },\n            \"verifiedAuthenticationRequest\": {\n              \"type\": \"object\",\n              \"properties\": {\n                \"additionalProperties\": true\n              }\n            },\n            \"credentialFilter\": {\n              \"type\": \"object\",\n              \"properties\": {\n                \"additionalProperties\": true\n              }\n            },\n            \"additionalProperties\": false\n          },\n          \"required\": [\"sessionId\", \"verifiedAuthenticationRequest\"],\n          \"description\": \"Arguments needed for {@link DidAuthSiopOpAuthenticator.getSiopAuthenticationRequestDetails } \"\n        },\n        \"IAuthRequestDetails\": {\n          \"type\": \"object\",\n          \"properties\": {\n            \"id\": {\n              \"type\": \"string\"\n            },\n            \"alsoKnownAs\": {\n              \"type\": \"array\",\n              \"items\": {\n                \"type\": \"string\"\n              }\n            },\n            \"vpResponseOpts\": {\n              \"type\": \"object\",\n              \"properties\": {\n                \"additionalProperties\": true\n              }\n            },\n            \"additionalProperties\": false\n          },\n          \"required\": [\"id\", \"vpResponseOpts\"],\n          \"description\": \"Result of {@link DidAuthSiopOpAuthenticator.getSiopAuthenticationRequestDetails } \"\n        },\n        \"IVerifySiopAuthenticationRequestUriArgs\": {\n          \"type\": \"object\",\n          \"properties\": {\n            \"sessionId\": {\n              \"type\": \"string\"\n            },\n            \"ParsedAuthenticationRequestURI\": {\n              \"type\": \"object\",\n              \"properties\": {\n                \"additionalProperties\": true\n              }\n            },\n            \"additionalProperties\": false\n          },\n          \"required\": [\"sessionId\", \"ParsedAuthenticationRequestURI\"],\n          \"description\": \"Arguments needed for {@link DidAuthSiopOpAuthenticator.verifySiopAuthenticationRequestURI } \"\n        },\n        \"VerifiedAuthorizationRequest\": {\n          \"type\": \"object\",\n          \"properties\": {\n            \"payload\": {\n              \"type\": \"object\",\n              \"properties\": {\n                \"additionalProperties\": true\n              }\n            },\n            \"presentationDefinitions\": {\n              \"type\": \"object\",\n              \"properties\": {\n                \"additionalProperties\": true\n              }\n            },\n            \"verifyOpts\": {\n              \"type\": \"object\",\n              \"properties\": {\n                \"additionalProperties\": true\n              }\n            },\n            \"additionalProperties\": false\n          },\n          \"required\": [\"payload\", \"verifyOpts\"],\n          \"description\": \"Result of {@link DidAuthSiopOpAuthenticator.verifySiopAuthenticationRequestURI } \"\n        },\n        \"ISendSiopAuthenticationResponseArgs\": {\n          \"type\": \"object\",\n          \"properties\": {\n            \"sessionId\": {\n              \"type\": \"string\"\n            },\n            \"verifiedAuthenticationRequest\": {\n              \"type\": \"object\",\n              \"properties\": {\n                \"additionalProperties\": true\n              }\n            },\n            \"verifiablePresentationResponse\": {\n              \"type\": \"object\",\n              \"properties\": {\n                \"additionalProperties\": true\n              }\n            },\n            \"additionalProperties\": false\n          },\n          \"required\": [\"sessionId\", \"verifiedAuthenticationRequest\"],\n          \"description\": \"Arguments needed for {@link DidAuthSiopOpAuthenticator.sendSiopAuthenticationResponse } \"\n        }\n      },\n      \"methods\": {\n        \"getSessionForSiop\": {\n          \"description\": \"Get SIOP session\",\n          \"arguments\": {\n            \"$ref\": \"#/components/schemas/IGetSiopSessionArgs\"\n          },\n          \"returnType\": \"object\"\n        },\n        \"registerSessionForSiop\": {\n          \"description\": \"Register SIOP session\",\n          \"arguments\": {\n            \"$ref\": \"#/components/schemas/IRegisterSiopSessionArgs\"\n          },\n          \"returnType\": \"object\"\n        },\n        \"removeSessionForSiop\": {\n          \"description\": \"Remove SIOP session\",\n          \"arguments\": {\n            \"$ref\": \"#/components/schemas/IRemoveSiopSessionArgs\"\n          },\n          \"returnType\": \"boolean\"\n        },\n        \"authenticateWithSiop\": {\n          \"description\": \"Authenticate using DID Auth SIOP\",\n          \"arguments\": {\n            \"$ref\": \"#/components/schemas/IAuthenticateWithSiopArgs\"\n          },\n          \"returnType\": {\n            \"$ref\": \"#/components/schemas/Response\"\n          }\n        },\n        \"getSiopAuthenticationRequestFromRP\": {\n          \"description\": \"Get authentication request from RP\",\n          \"arguments\": {\n            \"$ref\": \"#/components/schemas/IGetSiopAuthenticationRequestFromRpArgs\"\n          },\n          \"returnType\": {\n            \"$ref\": \"#/components/schemas/ParsedAuthenticationRequestURI\"\n          }\n        },\n        \"getSiopAuthenticationRequestDetails\": {\n          \"description\": \"Get authentication request details\",\n          \"arguments\": {\n            \"$ref\": \"#/components/schemas/IGetSiopAuthenticationRequestDetailsArgs\"\n          },\n          \"returnType\": {\n            \"$ref\": \"#/components/schemas/IAuthRequestDetails\"\n          }\n        },\n        \"verifySiopAuthenticationRequestURI\": {\n          \"description\": \"Verify authentication request URI\",\n          \"arguments\": {\n            \"$ref\": \"#/components/schemas/IVerifySiopAuthenticationRequestUriArgs\"\n          },\n          \"returnType\": {\n            \"$ref\": \"#/components/schemas/VerifiedAuthorizationRequest\"\n          }\n        },\n        \"sendSiopAuthenticationResponse\": {\n          \"description\": \"Send authentication response\",\n          \"arguments\": {\n            \"$ref\": \"#/components/schemas/ISendSiopAuthenticationResponseArgs\"\n          },\n          \"returnType\": {\n            \"$ref\": \"#/components/schemas/IRequiredContext\"\n          }\n        }\n      }\n    }\n  }\n}\n","import {\n  AuthorizationRequestState,\n  AuthorizationResponsePayload,\n  AuthorizationResponseState,\n  AuthorizationResponseStateStatus,\n  decodeUriAsJson,\n  VerifiedAuthorizationResponse,\n} from '@sphereon/did-auth-siop'\nimport { getAgentResolver } from '@sphereon/ssi-sdk-ext.did-utils'\nimport {\n  AdditionalClaims,\n  CredentialMapper,\n  HasherSync,\n  ICredentialSubject,\n  IPresentation,\n  IVerifiableCredential,\n  IVerifiablePresentation,\n  JwtDecodedVerifiablePresentation,\n  MdocDeviceResponse,\n  MdocOid4vpMdocVpToken,\n  OriginalVerifiablePresentation,\n  SdJwtDecodedVerifiableCredential,\n} from '@sphereon/ssi-types'\nimport { IAgentPlugin } from '@veramo/core'\nimport {\n  AuthorizationResponseStateWithVerifiedData,\n  IAuthorizationRequestPayloads,\n  ICreateAuthRequestArgs,\n  IGetAuthRequestStateArgs,\n  IGetAuthResponseStateArgs,\n  IGetRedirectUriArgs,\n  ImportDefinitionsArgs,\n  IPEXInstanceOptions,\n  IRequiredContext,\n  IRPDefaultOpts,\n  IRPOptions,\n  ISiopRPInstanceArgs,\n  ISiopv2RPOpts,\n  IUpdateRequestStateArgs,\n  IVerifyAuthResponseStateArgs,\n  schema,\n  VerifiedDataMode,\n} from '../index'\nimport { RPInstance } from '../RPInstance'\n\nimport { ISIOPv2RP } from '../types/ISIOPv2RP'\nimport { shaHasher as defaultHasher } from '@sphereon/ssi-sdk.core'\nimport { DcqlQuery } from 'dcql'\n\nexport class SIOPv2RP implements IAgentPlugin {\n  private readonly opts: ISiopv2RPOpts\n  private static readonly _DEFAULT_OPTS_KEY = '_default'\n  private readonly instances: Map<string, RPInstance> = new Map()\n  readonly schema = schema.IDidAuthSiopOpAuthenticator\n\n  readonly methods: ISIOPv2RP = {\n    siopCreateAuthRequestURI: this.createAuthorizationRequestURI.bind(this),\n    siopCreateAuthRequestPayloads: this.createAuthorizationRequestPayloads.bind(this),\n    siopGetAuthRequestState: this.siopGetRequestState.bind(this),\n    siopGetAuthResponseState: this.siopGetResponseState.bind(this),\n    siopUpdateAuthRequestState: this.siopUpdateRequestState.bind(this),\n    siopDeleteAuthState: this.siopDeleteState.bind(this),\n    siopVerifyAuthResponse: this.siopVerifyAuthResponse.bind(this),\n    siopImportDefinitions: this.siopImportDefinitions.bind(this),\n    siopGetRedirectURI: this.siopGetRedirectURI.bind(this),\n  }\n\n  constructor(opts: ISiopv2RPOpts) {\n    this.opts = opts\n  }\n\n  public setDefaultOpts(rpDefaultOpts: IRPDefaultOpts, context: IRequiredContext) {\n    // We allow setting default options later, because in some cases you might want to query the agent for defaults. This cannot happen when the agent is being build (this is when the constructor is being called)\n    this.opts.defaultOpts = rpDefaultOpts\n    // We however do require the agent to be responsible for resolution, otherwise people might encounter strange errors, that are very hard to track down\n    if (\n      !this.opts.defaultOpts.identifierOpts.resolveOpts?.resolver ||\n      typeof this.opts.defaultOpts.identifierOpts.resolveOpts.resolver.resolve !== 'function'\n    ) {\n      this.opts.defaultOpts.identifierOpts.resolveOpts = {\n        ...this.opts.defaultOpts.identifierOpts.resolveOpts,\n        resolver: getAgentResolver(context, { uniresolverResolution: true, resolverResolution: true, localResolution: true }),\n      }\n    }\n  }\n\n  private async createAuthorizationRequestURI(createArgs: ICreateAuthRequestArgs, context: IRequiredContext): Promise<string> {\n    return await this.getRPInstance({ definitionId: createArgs.definitionId, responseRedirectURI: createArgs.responseRedirectURI }, context)\n      .then((rp) => rp.createAuthorizationRequestURI(createArgs, context))\n      .then((URI) => URI.encodedUri)\n  }\n\n  private async createAuthorizationRequestPayloads(\n    createArgs: ICreateAuthRequestArgs,\n    context: IRequiredContext,\n  ): Promise<IAuthorizationRequestPayloads> {\n    return await this.getRPInstance({ definitionId: createArgs.definitionId }, context)\n      .then((rp) => rp.createAuthorizationRequest(createArgs, context))\n      .then(async (request) => {\n        const authRequest: IAuthorizationRequestPayloads = {\n          authorizationRequest: request.payload,\n          requestObject: await request.requestObjectJwt(),\n          requestObjectDecoded: await request.requestObject?.getPayload(),\n        }\n        return authRequest\n      })\n  }\n\n  private async siopGetRequestState(args: IGetAuthRequestStateArgs, context: IRequiredContext): Promise<AuthorizationRequestState | undefined> {\n    return await this.getRPInstance({ definitionId: args.definitionId }, context).then((rp) =>\n      rp.get(context).then((rp) => rp.sessionManager.getRequestStateByCorrelationId(args.correlationId, args.errorOnNotFound)),\n    )\n  }\n\n  private async siopGetResponseState(\n    args: IGetAuthResponseStateArgs,\n    context: IRequiredContext,\n  ): Promise<AuthorizationResponseStateWithVerifiedData | undefined> {\n    const rpInstance: RPInstance = await this.getRPInstance({ definitionId: args.definitionId }, context)\n    const authorizationResponseState: AuthorizationResponseState | undefined = await rpInstance\n      .get(context)\n      .then((rp) => rp.sessionManager.getResponseStateByCorrelationId(args.correlationId, args.errorOnNotFound))\n    if (authorizationResponseState === undefined) {\n      return undefined\n    }\n\n    const responseState = authorizationResponseState as AuthorizationResponseStateWithVerifiedData\n    if (\n      responseState.status === AuthorizationResponseStateStatus.VERIFIED &&\n      args.includeVerifiedData &&\n      args.includeVerifiedData !== VerifiedDataMode.NONE\n    ) {\n      let hasher: HasherSync | undefined\n      if (\n        CredentialMapper.isSdJwtEncoded(responseState.response.payload.vp_token as OriginalVerifiablePresentation) &&\n        (!rpInstance.rpOptions.credentialOpts?.hasher || typeof rpInstance.rpOptions.credentialOpts?.hasher !== 'function')\n      ) {\n        hasher = defaultHasher\n      }\n      // todo this should also include mdl-mdoc\n      const presentationDecoded = CredentialMapper.decodeVerifiablePresentation(\n        responseState.response.payload.vp_token as OriginalVerifiablePresentation,\n        //todo: later we want to conditionally pass in options for mdl-mdoc here\n        hasher,\n      )\n      switch (args.includeVerifiedData) {\n        case VerifiedDataMode.VERIFIED_PRESENTATION:\n          responseState.response.payload.verifiedData = this.presentationOrClaimsFrom(presentationDecoded)\n          break\n        case VerifiedDataMode.CREDENTIAL_SUBJECT_FLATTENED: // TODO debug cs-flat for SD-JWT\n          const allClaims: AdditionalClaims = {}\n          for (const credential of this.presentationOrClaimsFrom(presentationDecoded).verifiableCredential || []) {\n            const vc = credential as IVerifiableCredential\n            const schemaValidationResult = await context.agent.cvVerifySchema({\n              credential,\n              hasher,\n              validationPolicy: rpInstance.rpOptions.verificationPolicies?.schemaValidation,\n            })\n            if (!schemaValidationResult.result) {\n              responseState.status = AuthorizationResponseStateStatus.ERROR\n              responseState.error = new Error(schemaValidationResult.error)\n              return responseState\n            }\n\n            const credentialSubject = vc.credentialSubject as ICredentialSubject & AdditionalClaims\n            if (!('id' in allClaims)) {\n              allClaims['id'] = credentialSubject.id\n            }\n\n            Object.entries(credentialSubject).forEach(([key, value]) => {\n              if (!(key in allClaims)) {\n                allClaims[key] = value\n              }\n            })\n          }\n          responseState.verifiedData = allClaims\n          break\n      }\n    }\n    return responseState\n  }\n\n  private presentationOrClaimsFrom = (\n    presentationDecoded:\n      | JwtDecodedVerifiablePresentation\n      | IVerifiablePresentation\n      | SdJwtDecodedVerifiableCredential\n      | MdocOid4vpMdocVpToken\n      | MdocDeviceResponse,\n  ): AdditionalClaims | IPresentation =>\n    CredentialMapper.isSdJwtDecodedCredential(presentationDecoded)\n      ? presentationDecoded.decodedPayload\n      : CredentialMapper.toUniformPresentation(presentationDecoded as OriginalVerifiablePresentation)\n\n  private async siopUpdateRequestState(args: IUpdateRequestStateArgs, context: IRequiredContext): Promise<AuthorizationRequestState> {\n    if (args.state !== 'sent') {\n      throw Error(`Only 'sent' status is supported for this method at this point`)\n    }\n    return await this.getRPInstance({ definitionId: args.definitionId }, context)\n      // todo: In the SIOP library we need to update the signal method to be more like this method\n      .then((rp) =>\n        rp.get(context).then(async (rp) => {\n          await rp.signalAuthRequestRetrieved({\n            correlationId: args.correlationId,\n            error: args.error ? new Error(args.error) : undefined,\n          })\n          return (await rp.sessionManager.getRequestStateByCorrelationId(args.correlationId, true)) as AuthorizationRequestState\n        }),\n      )\n  }\n\n  private async siopDeleteState(args: IGetAuthResponseStateArgs, context: IRequiredContext): Promise<boolean> {\n    return await this.getRPInstance({ definitionId: args.definitionId }, context)\n      .then((rp) => rp.get(context).then((rp) => rp.sessionManager.deleteStateForCorrelationId(args.correlationId)))\n      .then(() => true)\n  }\n\n  private async siopVerifyAuthResponse(args: IVerifyAuthResponseStateArgs, context: IRequiredContext): Promise<VerifiedAuthorizationResponse> {\n    if (!args.authorizationResponse) {\n      throw Error('No SIOPv2 Authorization Response received')\n    }\n    const authResponse =\n      typeof args.authorizationResponse === 'string'\n        ? (decodeUriAsJson(args.authorizationResponse) as AuthorizationResponsePayload)\n        : args.authorizationResponse\n    return await this.getRPInstance({ definitionId: args.definitionId }, context).then((rp) =>\n      rp.get(context).then((rp) =>\n        rp.verifyAuthorizationResponse(authResponse, {\n          correlationId: args.correlationId,\n          ...(args.presentationDefinitions && !args.dcqlQuery ? { presentationDefinitions: args.presentationDefinitions } : {}),\n          ...(args.dcqlQuery ? { dcqlQuery: args.dcqlQuery as DcqlQuery } : {}), // TODO BEFORE PR, check compatibility and whether we can remove local type\n          audience: args.audience,\n        }),\n      ),\n    )\n  }\n\n  private async siopImportDefinitions(args: ImportDefinitionsArgs, context: IRequiredContext): Promise<void> {\n    const { definitions, tenantId, version, versionControlMode } = args\n    await Promise.all(\n      definitions.map(async (definitionPair) => {\n        const definitionPayload = definitionPair.definitionPayload\n        await context.agent.pexValidateDefinition({ definition: definitionPayload })\n\n        console.log(`persisting definition ${definitionPayload.id} / ${definitionPayload.name} with versionControlMode ${versionControlMode}`)\n        return context.agent.pdmPersistDefinition({\n          definitionItem: {\n            tenantId: tenantId,\n            version: version,\n            definitionPayload,\n            dcqlPayload: definitionPair.dcqlPayload,\n          },\n          opts: { versionControlMode: versionControlMode },\n        })\n      }),\n    )\n  }\n\n  private async siopGetRedirectURI(args: IGetRedirectUriArgs, context: IRequiredContext): Promise<string | undefined> {\n    const instanceId = args.definitionId ?? SIOPv2RP._DEFAULT_OPTS_KEY\n    if (this.instances.has(instanceId)) {\n      const rpInstance = this.instances.get(instanceId)\n      if (rpInstance !== undefined) {\n        const rp = await rpInstance.get(context)\n        return rp.getResponseRedirectUri({\n          correlation_id: args.correlationId,\n          correlationId: args.correlationId,\n          ...(args.state && { state: args.state }),\n        })\n      }\n    }\n    return undefined\n  }\n\n  async getRPInstance({ definitionId, responseRedirectURI }: ISiopRPInstanceArgs, context: IRequiredContext): Promise<RPInstance> {\n    const instanceId = definitionId ?? SIOPv2RP._DEFAULT_OPTS_KEY\n    if (!this.instances.has(instanceId)) {\n      const instanceOpts = this.getInstanceOpts(definitionId)\n      const rpOpts = await this.getRPOptions(context, { definitionId, responseRedirectURI: responseRedirectURI })\n      if (!rpOpts.identifierOpts.resolveOpts?.resolver || typeof rpOpts.identifierOpts.resolveOpts.resolver.resolve !== 'function') {\n        if (!rpOpts.identifierOpts?.resolveOpts) {\n          rpOpts.identifierOpts = { ...rpOpts.identifierOpts }\n          rpOpts.identifierOpts.resolveOpts = { ...rpOpts.identifierOpts.resolveOpts }\n        }\n        console.log('Using agent DID resolver for RP instance with definition id ' + definitionId)\n        rpOpts.identifierOpts.resolveOpts.resolver = getAgentResolver(context, {\n          uniresolverResolution: true,\n          localResolution: true,\n          resolverResolution: true,\n        })\n      }\n      this.instances.set(instanceId, new RPInstance({ rpOpts, pexOpts: instanceOpts }))\n    }\n    const rpInstance = this.instances.get(instanceId)!\n    if (responseRedirectURI) {\n      rpInstance.rpOptions.responseRedirectUri = responseRedirectURI\n    }\n    return rpInstance\n  }\n\n  async getRPOptions(context: IRequiredContext, opts: { definitionId?: string; responseRedirectURI?: string }): Promise<IRPOptions> {\n    const { definitionId, responseRedirectURI: responseRedirectURI } = opts\n    const options = this.getInstanceOpts(definitionId)?.rpOpts ?? this.opts.defaultOpts\n    if (!options) {\n      throw Error(`Could not get specific nor default options for definition ${definitionId}`)\n    }\n    if (this.opts.defaultOpts) {\n      if (!options.identifierOpts) {\n        options.identifierOpts = this.opts.defaultOpts?.identifierOpts\n      } else {\n        if (!options.identifierOpts.idOpts) {\n          options.identifierOpts.idOpts = this.opts.defaultOpts.identifierOpts.idOpts\n        }\n        if (!options.identifierOpts.supportedDIDMethods) {\n          options.identifierOpts.supportedDIDMethods = this.opts.defaultOpts.identifierOpts.supportedDIDMethods\n        }\n        if (!options.supportedVersions) {\n          options.supportedVersions = this.opts.defaultOpts.supportedVersions\n        }\n      }\n      if (!options.identifierOpts.resolveOpts || typeof options.identifierOpts.resolveOpts.resolver?.resolve !== 'function') {\n        options.identifierOpts.resolveOpts = {\n          ...this.opts.defaultOpts.identifierOpts.resolveOpts,\n          resolver:\n            this.opts.defaultOpts.identifierOpts?.resolveOpts?.resolver ??\n            getAgentResolver(context, { localResolution: true, resolverResolution: true, uniresolverResolution: true }),\n        }\n      }\n    }\n    if (responseRedirectURI !== undefined && responseRedirectURI !== options.responseRedirectUri) {\n      options.responseRedirectUri = responseRedirectURI\n    }\n    return options\n  }\n\n  getInstanceOpts(definitionId?: string): IPEXInstanceOptions | undefined {\n    if (!this.opts.instanceOpts) return undefined\n\n    const instanceOpt = definitionId ? this.opts.instanceOpts.find((i) => i.definitionId === definitionId) : undefined\n\n    return instanceOpt ?? this.getDefaultOptions(definitionId)\n  }\n\n  private getDefaultOptions(definitionId: string | undefined) {\n    if (!this.opts.instanceOpts) return undefined\n\n    const defaultOptions = this.opts.instanceOpts.find((i) => i.definitionId === 'default')\n    if (defaultOptions) {\n      const clonedOptions = { ...defaultOptions }\n      if (definitionId !== undefined) {\n        clonedOptions.definitionId = definitionId\n      }\n      return clonedOptions\n    }\n\n    return undefined\n  }\n}\n","import {\n  ClientIdScheme,\n  ClientMetadataOpts,\n  InMemoryRPSessionManager,\n  PassBy,\n  PresentationVerificationCallback,\n  PresentationVerificationResult,\n  PropertyTarget,\n  ResponseMode,\n  ResponseType,\n  RevocationVerification,\n  RP,\n  RPBuilder,\n  Scope,\n  SubjectType,\n  SupportedVersion,\n  VerifyJwtCallback,\n} from '@sphereon/did-auth-siop'\nimport { CreateJwtCallback, JwtHeader, JwtIssuer, JwtPayload, SigningAlgo } from '@sphereon/oid4vc-common'\nimport { IPresentationDefinition } from '@sphereon/pex'\nimport { getAgentDIDMethods, getAgentResolver } from '@sphereon/ssi-sdk-ext.did-utils'\nimport {\n  isExternalIdentifierOIDFEntityIdOpts,\n  isManagedIdentifierDidOpts,\n  isManagedIdentifierDidResult,\n  isManagedIdentifierX5cOpts,\n  ManagedIdentifierOptsOrResult,\n} from '@sphereon/ssi-sdk-ext.identifier-resolution'\nimport { JwtCompactResult } from '@sphereon/ssi-sdk-ext.jwt-service'\nimport { IVerifySdJwtPresentationResult } from '@sphereon/ssi-sdk.sd-jwt'\nimport { CredentialMapper, Hasher, OriginalVerifiableCredential, PresentationSubmission } from '@sphereon/ssi-types'\nimport { IVerifyCallbackArgs, IVerifyCredentialResult, VerifyCallback } from '@sphereon/wellknown-dids-client'\n// import { KeyAlgo, SuppliedSigner } from '@sphereon/ssi-sdk.core'\nimport { TKeyType } from '@veramo/core'\nimport { JWTVerifyOptions } from 'did-jwt'\nimport { Resolvable } from 'did-resolver'\nimport { EventEmitter } from 'events'\nimport { IPEXOptions, IRequiredContext, IRPOptions, ISIOPIdentifierOptions } from './types/ISIOPv2RP'\nimport { DcqlQuery } from 'dcql'\nimport { defaultHasher } from '@sphereon/ssi-sdk.core'\n\nexport function getRequestVersion(rpOptions: IRPOptions): SupportedVersion {\n  if (Array.isArray(rpOptions.supportedVersions) && rpOptions.supportedVersions.length > 0) {\n    return rpOptions.supportedVersions[0]\n  }\n  return SupportedVersion.JWT_VC_PRESENTATION_PROFILE_v1\n}\n\nfunction getWellKnownDIDVerifyCallback(siopIdentifierOpts: ISIOPIdentifierOptions, context: IRequiredContext) {\n  return siopIdentifierOpts.wellknownDIDVerifyCallback\n    ? siopIdentifierOpts.wellknownDIDVerifyCallback\n    : async (args: IVerifyCallbackArgs): Promise<IVerifyCredentialResult> => {\n        const result = await context.agent.cvVerifyCredential({\n          credential: args.credential as OriginalVerifiableCredential,\n          fetchRemoteContexts: true,\n        })\n        return { verified: result.result }\n      }\n}\n\nexport function getPresentationVerificationCallback(\n  idOpts: ManagedIdentifierOptsOrResult,\n  context: IRequiredContext,\n): PresentationVerificationCallback {\n  async function presentationVerificationCallback(\n    args: any, // FIXME any\n    presentationSubmission?: PresentationSubmission,\n  ): Promise<PresentationVerificationResult> {\n    if (CredentialMapper.isSdJwtEncoded(args)) {\n      const result: IVerifySdJwtPresentationResult = await context.agent.verifySdJwtPresentation({\n        presentation: args,\n        kb: true,\n      })\n      // fixme: investigate the correct way to handle this\n      return { verified: !!result.payload }\n    }\n\n    if (CredentialMapper.isMsoMdocOid4VPEncoded(args)) {\n      // TODO Funke reevaluate\n      if (context.agent.mdocOid4vpRPVerify === undefined) {\n        return Promise.reject('ImDLMdoc agent plugin must be enabled to support MsoMdoc types')\n      }\n      if (presentationSubmission !== undefined && presentationSubmission !== null) {\n        const verifyResult = await context.agent.mdocOid4vpRPVerify({\n          vp_token: args,\n          presentation_submission: presentationSubmission,\n        })\n        return { verified: !verifyResult.error }\n      }\n      throw Error(`mdocOid4vpRPVerify(...) method requires a presentation submission`)\n    }\n\n    const result = await context.agent.verifyPresentation({\n      presentation: args,\n      fetchRemoteContexts: true,\n      domain: (await context.agent.identifierManagedGet(idOpts)).kid?.split('#')[0],\n    })\n    return { verified: result.verified }\n  }\n\n  return presentationVerificationCallback\n}\n\nexport async function createRPBuilder(args: {\n  rpOpts: IRPOptions\n  pexOpts?: IPEXOptions | undefined\n  definition?: IPresentationDefinition\n  dcql?: DcqlQuery\n  context: IRequiredContext\n}): Promise<RPBuilder> {\n  const { rpOpts, pexOpts, context } = args\n  const { identifierOpts } = rpOpts\n  let definition: IPresentationDefinition | undefined = args.definition\n  let dcqlQuery: DcqlQuery | undefined = args.dcql\n\n  if (!definition && pexOpts && pexOpts.definitionId) {\n    const presentationDefinitionItems = await context.agent.pdmGetDefinitions({\n      filter: [\n        {\n          definitionId: pexOpts.definitionId,\n          version: pexOpts.version,\n          tenantId: pexOpts.tenantId,\n        },\n      ],\n    })\n\n    if (presentationDefinitionItems.length > 0) {\n      const presentationDefinitionItem = presentationDefinitionItems[0]\n      definition = presentationDefinitionItem.definitionPayload\n      if (!dcqlQuery && presentationDefinitionItem.dcqlPayload) {\n        dcqlQuery = presentationDefinitionItem.dcqlPayload as DcqlQuery // cast from DcqlQueryREST back to valibot DcqlQuery\n      }\n    }\n  }\n\n  const didMethods = identifierOpts.supportedDIDMethods ?? (await getAgentDIDMethods(context))\n  const eventEmitter = rpOpts.eventEmitter ?? new EventEmitter()\n\n  const defaultClientMetadata: ClientMetadataOpts = {\n    // FIXME: All of the below should be configurable. Some should come from builder, some should be determined by the agent.\n    // For now it is either preconfigured or everything passed in as a single object\n    idTokenSigningAlgValuesSupported: [SigningAlgo.EDDSA, SigningAlgo.ES256, SigningAlgo.ES256K], // added newly\n    requestObjectSigningAlgValuesSupported: [SigningAlgo.EDDSA, SigningAlgo.ES256, SigningAlgo.ES256K], // added newly\n    responseTypesSupported: [ResponseType.ID_TOKEN], // added newly\n    client_name: 'Sphereon',\n    vpFormatsSupported: {\n      jwt_vc: { alg: ['EdDSA', 'ES256K'] },\n      jwt_vp: { alg: ['ES256K', 'EdDSA'] },\n    },\n    scopesSupported: [Scope.OPENID_DIDAUTHN],\n    subjectTypesSupported: [SubjectType.PAIRWISE],\n    subject_syntax_types_supported: didMethods.map((method) => `did:${method}`),\n    passBy: PassBy.VALUE,\n  }\n\n  const resolver =\n    rpOpts.identifierOpts.resolveOpts?.resolver ??\n    getAgentResolver(context, {\n      resolverResolution: true,\n      localResolution: true,\n      uniresolverResolution: rpOpts.identifierOpts.resolveOpts?.noUniversalResolverFallback !== true,\n    })\n  //todo: probably wise to first look and see if we actually need the hasher to begin with\n  let hasher: Hasher | undefined = rpOpts.credentialOpts?.hasher\n  if (!rpOpts.credentialOpts?.hasher || typeof rpOpts.credentialOpts?.hasher !== 'function') {\n    hasher = defaultHasher\n  }\n\n  const builder = RP.builder({ requestVersion: getRequestVersion(rpOpts) })\n    .withScope('openid', PropertyTarget.REQUEST_OBJECT)\n    .withResponseMode(rpOpts.responseMode ?? ResponseMode.POST)\n    .withResponseType(ResponseType.VP_TOKEN, PropertyTarget.REQUEST_OBJECT)\n    // todo: move to options fill/correct method\n    .withSupportedVersions(\n      rpOpts.supportedVersions ?? [SupportedVersion.JWT_VC_PRESENTATION_PROFILE_v1, SupportedVersion.SIOPv2_ID1, SupportedVersion.SIOPv2_D11],\n    )\n\n    .withEventEmitter(eventEmitter)\n    .withSessionManager(rpOpts.sessionManager ?? new InMemoryRPSessionManager(eventEmitter))\n    .withClientMetadata(rpOpts.clientMetadataOpts ?? defaultClientMetadata, PropertyTarget.REQUEST_OBJECT)\n    .withVerifyJwtCallback(\n      rpOpts.verifyJwtCallback\n        ? rpOpts.verifyJwtCallback\n        : getVerifyJwtCallback(\n            {\n              resolver,\n              verifyOpts: {\n                wellknownDIDVerifyCallback: getWellKnownDIDVerifyCallback(rpOpts.identifierOpts, context),\n                checkLinkedDomain: 'if_present',\n              },\n            },\n            context,\n          ),\n    )\n    .withRevocationVerification(RevocationVerification.NEVER)\n    .withPresentationVerification(getPresentationVerificationCallback(identifierOpts.idOpts, context))\n\n  const oidfOpts = identifierOpts.oidfOpts\n  if (oidfOpts && isExternalIdentifierOIDFEntityIdOpts(oidfOpts)) {\n    builder.withEntityId(oidfOpts.identifier, PropertyTarget.REQUEST_OBJECT).withClientIdScheme('entity_id', PropertyTarget.REQUEST_OBJECT)\n  } else {\n    const resolution = await context.agent.identifierManagedGet(identifierOpts.idOpts)\n    builder\n      .withClientId(\n        resolution.issuer ?? (isManagedIdentifierDidResult(resolution) ? resolution.did : resolution.jwkThumbprint),\n        PropertyTarget.REQUEST_OBJECT,\n      )\n      .withClientIdScheme(\n        (resolution.clientIdScheme as ClientIdScheme) ?? (identifierOpts.idOpts.clientIdScheme as ClientIdScheme),\n        PropertyTarget.REQUEST_OBJECT,\n      )\n  }\n\n  if (hasher) {\n    builder.withHasher(hasher)\n  }\n  //fixme: this has been removed in the new version of did-auth-siop\n  /*if (!rpOpts.clientMetadataOpts?.subjectTypesSupported) {\n    // Do not update in case it is already provided via client metadata opts\n    didMethods.forEach((method) => builder.addDidMethod(method))\n  }*/\n  //fixme: this has been removed in the new version of did-auth-siop\n  // builder.withWellknownDIDVerifyCallback(getWellKnownDIDVerifyCallback(didOpts, context))\n\n  if (definition) {\n    builder.withPresentationDefinition({ definition }, PropertyTarget.REQUEST_OBJECT)\n  }\n  if (dcqlQuery) {\n    builder.withDcqlQuery(dcqlQuery)\n  }\n\n  if (rpOpts.responseRedirectUri) {\n    builder.withResponseRedirectUri(rpOpts.responseRedirectUri)\n  }\n\n  //const key = resolution.key\n  //fixme: this has been removed in the new version of did-auth-siop\n  //builder.withSuppliedSignature(SuppliedSigner(key, context, getSigningAlgo(key.type) as unknown as KeyAlgo), did, kid, getSigningAlgo(key.type))\n\n  /*if (isManagedIdentifierDidResult(resolution)) {\n    //fixme: only accepts dids in version used. New SIOP lib also accepts other types\n    builder.withSuppliedSignature(\n      SuppliedSigner(key, context, getSigningAlgo(key.type) as unknown as KeyAlgo),\n      resolution.did,\n      resolution.kid,\n      getSigningAlgo(key.type),\n    )\n  }*/\n  //fixme: signcallback and it's return type are not totally compatible with our CreateJwtCallbackBase\n  const createJwtCallback = signCallback(rpOpts.identifierOpts.idOpts, context)\n  builder.withCreateJwtCallback(createJwtCallback satisfies CreateJwtCallback<any>)\n  return builder\n}\n\nexport function signCallback(\n  idOpts: ManagedIdentifierOptsOrResult,\n  context: IRequiredContext,\n): (jwtIssuer: JwtIssuer, jwt: { header: JwtHeader; payload: JwtPayload }, kid?: string) => Promise<string> {\n  return async (jwtIssuer: JwtIssuer, jwt: { header: JwtHeader; payload: JwtPayload }, kid?: string) => {\n    if (!(isManagedIdentifierDidOpts(idOpts) || isManagedIdentifierX5cOpts(idOpts))) {\n      return Promise.reject(Error(`JWT issuer method ${jwtIssuer.method} not yet supported`))\n    }\n    const result: JwtCompactResult = await context.agent.jwtCreateJwsCompactSignature({\n      // FIXME fix cose-key inference\n      // @ts-ignore\n      issuer: { identifier: idOpts.identifier, kmsKeyRef: idOpts.kmsKeyRef, noIdentifierInHeader: false },\n      // FIXME fix JWK key_ops\n      // @ts-ignore\n      protectedHeader: jwt.header,\n      payload: jwt.payload,\n    })\n    return result.jwt\n  }\n}\n\nfunction getVerifyJwtCallback(\n  _opts: {\n    resolver?: Resolvable\n    verifyOpts?: JWTVerifyOptions & {\n      checkLinkedDomain: 'never' | 'if_present' | 'always'\n      wellknownDIDVerifyCallback?: VerifyCallback\n    }\n  },\n  context: IRequiredContext,\n): VerifyJwtCallback {\n  return async (_jwtVerifier, jwt) => {\n    const result = await context.agent.jwtVerifyJwsSignature({ jws: jwt.raw })\n    console.log(result.message)\n    return !result.error\n  }\n}\n\nexport async function createRP({ rpOptions, context }: { rpOptions: IRPOptions; context: IRequiredContext }): Promise<RP> {\n  return (await createRPBuilder({ rpOpts: rpOptions, context })).build()\n}\n\nexport function getSigningAlgo(type: TKeyType): SigningAlgo {\n  switch (type) {\n    case 'Ed25519':\n      return SigningAlgo.EDDSA\n    case 'Secp256k1':\n      return SigningAlgo.ES256K\n    case 'Secp256r1':\n      return SigningAlgo.ES256\n    // @ts-ignore\n    case 'RSA':\n      return SigningAlgo.RS256\n    default:\n      throw Error('Key type not yet supported')\n  }\n}\n","import { AuthorizationRequest, RP, URI } from '@sphereon/did-auth-siop'\nimport { ICreateAuthRequestArgs, IPEXOptions, IRequiredContext, IRPOptions } from './types/ISIOPv2RP'\nimport { IPresentationDefinition } from '@sphereon/pex'\nimport { createRPBuilder, getRequestVersion, getSigningAlgo } from './functions'\nimport { v4 as uuidv4 } from 'uuid'\nimport { JwtIssuer } from '@sphereon/oid4vc-common'\nimport {\n  ensureManagedIdentifierResult,\n  isManagedIdentifierDidResult,\n  isManagedIdentifierX5cResult,\n} from '@sphereon/ssi-sdk-ext.identifier-resolution'\n\nexport class RPInstance {\n  private _rp: RP | undefined\n  private readonly _pexOptions: IPEXOptions | undefined\n  private readonly _rpOptions: IRPOptions\n\n  public constructor({ rpOpts, pexOpts }: { rpOpts: IRPOptions; pexOpts?: IPEXOptions }) {\n    this._rpOptions = rpOpts\n    this._pexOptions = pexOpts\n  }\n\n  public async get(context: IRequiredContext): Promise<RP> {\n    if (!this._rp) {\n      const builder = await createRPBuilder({\n        rpOpts: this._rpOptions,\n        pexOpts: this._pexOptions,\n        context,\n      })\n      this._rp = builder.build()\n    }\n    return this._rp!\n  }\n\n  get rpOptions() {\n    return this._rpOptions\n  }\n\n  get pexOptions() {\n    return this._pexOptions\n  }\n\n  public hasDefinition(): boolean {\n    return this.definitionId !== undefined\n  }\n\n  get definitionId(): string | undefined {\n    return this.pexOptions?.definitionId\n  }\n\n  public async getPresentationDefinition(context: IRequiredContext): Promise<IPresentationDefinition | undefined> {\n    return this.definitionId\n      ? await context.agent.pexStoreGetDefinition({\n          definitionId: this.definitionId,\n          tenantId: this.pexOptions?.tenantId,\n        })\n      : undefined\n  }\n\n  public async createAuthorizationRequestURI(createArgs: Omit<ICreateAuthRequestArgs, 'definitionId'>, context: IRequiredContext): Promise<URI> {\n    const { correlationId, claims, requestByReferenceURI, responseURI, responseURIType } = createArgs\n    const nonce = createArgs.nonce ?? uuidv4()\n    const state = createArgs.state ?? correlationId\n    let jwtIssuer: JwtIssuer\n    const idOpts = this.rpOptions.identifierOpts.idOpts\n    const resolution = await ensureManagedIdentifierResult(idOpts, context)\n    if (isManagedIdentifierDidResult(resolution)) {\n      jwtIssuer = { didUrl: resolution.kid, method: 'did', alg: getSigningAlgo(resolution.key.type) }\n    } else if (isManagedIdentifierX5cResult(resolution)) {\n      if (!resolution.issuer) {\n        return Promise.reject('missing issuer in idOpts')\n      }\n      jwtIssuer = {\n        issuer: resolution.issuer,\n        x5c: resolution.x5c,\n        method: 'x5c',\n        alg: getSigningAlgo(resolution.key.type),\n      }\n    } else {\n      return Promise.reject(Error(`JWT issuer method ${resolution.method} not yet supported`))\n    }\n\n    return await this.get(context).then((rp) =>\n      rp.createAuthorizationRequestURI({\n        version: getRequestVersion(this.rpOptions),\n        correlationId,\n        nonce,\n        state,\n        claims,\n        requestByReferenceURI,\n        responseURI,\n        responseURIType,\n        jwtIssuer,\n      }),\n    )\n  }\n\n  public async createAuthorizationRequest(\n    createArgs: Omit<ICreateAuthRequestArgs, 'definitionId'>,\n    context: IRequiredContext,\n  ): Promise<AuthorizationRequest> {\n    const { correlationId, claims, requestByReferenceURI, responseURI, responseURIType } = createArgs\n    const nonce = createArgs.nonce ?? uuidv4()\n    const state = createArgs.state ?? correlationId\n    const idOpts = this.rpOptions.identifierOpts.idOpts\n    const resolution = await ensureManagedIdentifierResult(idOpts, context)\n\n    let jwtIssuer: JwtIssuer\n    if (isManagedIdentifierX5cResult(resolution) && resolution.issuer) {\n      jwtIssuer = {\n        method: resolution.method,\n        alg: getSigningAlgo(resolution.key.type),\n        x5c: resolution.x5c,\n        issuer: resolution.issuer,\n      }\n    } else if (isManagedIdentifierDidResult(resolution)) {\n      jwtIssuer = {\n        method: resolution.method,\n        alg: getSigningAlgo(resolution.key.type),\n        didUrl: resolution.did,\n      }\n    } else {\n      return Promise.reject(Error('Only did & x5c supported at present'))\n    }\n\n    return await this.get(context).then((rp) =>\n      rp.createAuthorizationRequest({\n        version: getRequestVersion(this.rpOptions),\n        correlationId,\n        nonce,\n        state,\n        claims,\n        requestByReferenceURI,\n        responseURIType,\n        responseURI,\n        jwtIssuer,\n      }),\n    )\n  }\n}\n","import {\n  AuthorizationRequestPayload,\n  AuthorizationRequestState,\n  AuthorizationResponsePayload,\n  AuthorizationResponseState,\n  ClaimPayloadCommonOpts,\n  ClientMetadataOpts,\n  IRPSessionManager,\n  PresentationDefinitionWithLocation,\n  PresentationVerificationCallback,\n  RequestObjectPayload,\n  ResponseMode,\n  ResponseURIType,\n  SupportedVersion,\n  VerifiablePresentationTypeFormat,\n  VerifiedAuthorizationResponse,\n  VerifyJwtCallback,\n  VPTokenLocation,\n} from '@sphereon/did-auth-siop'\nimport { ExternalIdentifierOIDFEntityIdOpts, IIdentifierResolution, ManagedIdentifierOptsOrResult } from '@sphereon/ssi-sdk-ext.identifier-resolution'\nimport { IAgentContext, ICredentialIssuer, ICredentialVerifier, IDIDManager, IKeyManager, IPluginMethodMap, IResolver } from '@veramo/core'\nimport { AdditionalClaims, DcqlQueryREST, HasherSync, W3CVerifiablePresentation } from '@sphereon/ssi-types'\n\nimport { Resolvable } from 'did-resolver'\nimport { DIDDocument } from '@sphereon/did-uni-client'\nimport { EventEmitter } from 'events'\nimport { IPresentationDefinition } from '@sphereon/pex'\nimport { IDIDOptions } from '@sphereon/ssi-sdk-ext.did-utils'\nimport { IPresentationExchange } from '@sphereon/ssi-sdk.presentation-exchange'\nimport { VerifyCallback } from '@sphereon/wellknown-dids-client'\nimport { AuthorizationRequestStateStatus } from '@sphereon/ssi-sdk.siopv2-oid4vp-common'\nimport { IPDManager, VersionControlMode } from '@sphereon/ssi-sdk.pd-manager'\nimport { CheckLinkedDomain } from '@sphereon/did-auth-siop-adapter'\nimport { ISDJwtPlugin } from '@sphereon/ssi-sdk.sd-jwt'\nimport { IJwtService } from '@sphereon/ssi-sdk-ext.jwt-service'\nimport { JwtIssuer } from '@sphereon/oid4vc-common'\nimport { ImDLMdoc } from '@sphereon/ssi-sdk.mdl-mdoc'\nimport { ICredentialValidation, SchemaValidation } from '@sphereon/ssi-sdk.credential-validation'\n\nexport enum VerifiedDataMode {\n  NONE = 'none',\n  VERIFIED_PRESENTATION = 'vp',\n  CREDENTIAL_SUBJECT_FLATTENED = 'cs-flat',\n}\n\nexport interface ISIOPv2RP extends IPluginMethodMap {\n  siopCreateAuthRequestURI(createArgs: ICreateAuthRequestArgs, context: IRequiredContext): Promise<string>\n  siopCreateAuthRequestPayloads(createArgs: ICreateAuthRequestArgs, context: IRequiredContext): Promise<IAuthorizationRequestPayloads>\n  siopGetAuthRequestState(args: IGetAuthRequestStateArgs, context: IRequiredContext): Promise<AuthorizationRequestState | undefined>\n  siopGetAuthResponseState(\n    args: IGetAuthResponseStateArgs,\n    context: IRequiredContext,\n  ): Promise<AuthorizationResponseStateWithVerifiedData | undefined>\n  siopUpdateAuthRequestState(args: IUpdateRequestStateArgs, context: IRequiredContext): Promise<AuthorizationRequestState>\n  siopDeleteAuthState(args: IDeleteAuthStateArgs, context: IRequiredContext): Promise<boolean>\n  siopVerifyAuthResponse(args: IVerifyAuthResponseStateArgs, context: IRequiredContext): Promise<VerifiedAuthorizationResponse>\n  siopImportDefinitions(args: ImportDefinitionsArgs, context: IRequiredContext): Promise<void>\n\n  siopGetRedirectURI(args: IGetRedirectUriArgs, context: IRequiredContext): Promise<string | undefined>\n}\n\nexport interface ISiopv2RPOpts {\n  defaultOpts?: IRPDefaultOpts\n  instanceOpts?: IPEXInstanceOptions[]\n}\n\nexport interface IRPDefaultOpts extends IRPOptions {}\n\nexport interface ICreateAuthRequestArgs {\n  definitionId: string\n  correlationId: string\n  responseURIType: ResponseURIType\n  responseURI: string\n  responseRedirectURI?: string\n  jwtIssuer?: JwtIssuer\n  requestByReferenceURI?: string\n  nonce?: string\n  state?: string\n  claims?: ClaimPayloadCommonOpts\n}\n\nexport interface IGetAuthRequestStateArgs {\n  correlationId: string\n  definitionId: string\n  errorOnNotFound?: boolean\n}\n\nexport interface IGetAuthResponseStateArgs {\n  correlationId: string\n  definitionId: string\n  errorOnNotFound?: boolean\n  progressRequestStateTo?: AuthorizationRequestStateStatus\n  includeVerifiedData?: VerifiedDataMode\n}\n\nexport interface IUpdateRequestStateArgs {\n  definitionId: string\n  correlationId: string\n  state: AuthorizationRequestStateStatus\n  error?: string\n}\n\nexport interface IDeleteAuthStateArgs {\n  correlationId: string\n  definitionId: string\n}\n\nexport interface IVerifyAuthResponseStateArgs {\n  authorizationResponse: string | AuthorizationResponsePayload\n  definitionId?: string\n  correlationId: string\n  audience?: string\n  presentationDefinitions?: PresentationDefinitionWithLocation | PresentationDefinitionWithLocation[]\n  dcqlQuery?: DcqlQueryREST\n}\n\nexport interface IDefinitionPair {\n  definitionPayload: IPresentationDefinition\n  dcqlPayload?: DcqlQueryREST\n}\n\nexport interface ImportDefinitionsArgs {\n  definitions: Array<IDefinitionPair>\n  tenantId?: string\n  version?: string\n  versionControlMode?: VersionControlMode\n}\n\nexport interface IGetRedirectUriArgs {\n  correlationId: string\n  definitionId?: string\n  state?: string\n}\n\nexport interface IAuthorizationRequestPayloads {\n  authorizationRequest: AuthorizationRequestPayload\n  requestObject?: string\n  requestObjectDecoded?: RequestObjectPayload\n}\n\nexport interface IPEXDefinitionPersistArgs extends IPEXInstanceOptions {\n  definition: IPresentationDefinition\n  ttl?: number\n}\n\nexport interface ISiopRPInstanceArgs {\n  definitionId?: string\n  responseRedirectURI?: string\n}\n\nexport interface IPEXInstanceOptions extends IPEXOptions {\n  rpOpts?: IRPOptions\n}\n\nexport interface IRPOptions {\n  responseMode?: ResponseMode\n  supportedVersions?: SupportedVersion[] // The supported version by the RP. The first version will be the default version\n  sessionManager?: IRPSessionManager\n  clientMetadataOpts?: ClientMetadataOpts\n  expiresIn?: number\n  eventEmitter?: EventEmitter\n  credentialOpts?: CredentialOpts\n  verificationPolicies?: VerificationPolicies\n  identifierOpts: ISIOPIdentifierOptions\n  verifyJwtCallback?: VerifyJwtCallback\n  responseRedirectUri?: string\n}\n\nexport interface IPEXOptions {\n  presentationVerifyCallback?: PresentationVerificationCallback\n  // definition?: IPresentationDefinition\n  definitionId: string\n  version?: string\n  tenantId?: string\n}\n\nexport type VerificationPolicies = {\n  schemaValidation: SchemaValidation\n}\n\nexport interface PerDidResolver {\n  didMethod: string\n  resolver: Resolvable\n}\n\nexport interface IAuthRequestDetails {\n  rpDIDDocument?: DIDDocument\n  id: string\n  verifiablePresentationMatches: IPresentationWithDefinition[]\n  alsoKnownAs?: string[]\n}\n\nexport interface IPresentationWithDefinition {\n  location: VPTokenLocation\n  definition: PresentationDefinitionWithLocation\n  format: VerifiablePresentationTypeFormat\n  presentation: W3CVerifiablePresentation\n}\n\nexport interface ISIOPIdentifierOptions extends Omit<IDIDOptions, 'idOpts'> {\n  // we replace the legacy idOpts with the Managed Identifier opts from the identifier resolution module\n  idOpts: ManagedIdentifierOptsOrResult\n  oidfOpts?: ExternalIdentifierOIDFEntityIdOpts\n  checkLinkedDomains?: CheckLinkedDomain\n  wellknownDIDVerifyCallback?: VerifyCallback\n}\n\n// todo make the necessary changes for mdl-mdoc types\nexport type CredentialOpts = {\n  hasher?: HasherSync\n}\n\nexport interface AuthorizationResponseStateWithVerifiedData extends AuthorizationResponseState {\n  verifiedData?: AdditionalClaims\n}\n\nexport type IRequiredContext = IAgentContext<\n  IResolver &\n    IDIDManager &\n    IKeyManager &\n    IIdentifierResolution &\n    ICredentialIssuer &\n    ICredentialValidation &\n    ICredentialVerifier &\n    IPresentationExchange &\n    IPDManager &\n    ISDJwtPlugin &\n    IJwtService &\n    ImDLMdoc\n>\n","/**\n * @public\n */\nconst schema = require('../plugin.schema.json')\nexport { schema }\nexport { SIOPv2RP } from './agent/SIOPv2RP'\nexport * from './types/ISIOPv2RP'\n"],"mappings":";;;;;;;;AAAA;AAAA;AAAA;AAAA,MACE,6BAA+B;AAAA,QAC7B,YAAc;AAAA,UACZ,SAAW;AAAA,YACT,qBAAuB;AAAA,cACrB,MAAQ;AAAA,cACR,YAAc;AAAA,gBACZ,WAAa;AAAA,kBACX,MAAQ;AAAA,gBACV;AAAA,gBACA,sBAAwB;AAAA,cAC1B;AAAA,cACA,UAAY,CAAC,WAAW;AAAA,cACxB,aAAe;AAAA,YACjB;AAAA,YACA,0BAA4B;AAAA,cAC1B,MAAQ;AAAA,cACR,YAAc;AAAA,gBACZ,YAAc;AAAA,kBACZ,MAAQ;AAAA,kBACR,YAAc;AAAA,oBACZ,KAAO;AAAA,sBACL,MAAQ;AAAA,oBACV;AAAA,oBACA,OAAS;AAAA,sBACP,MAAQ;AAAA,oBACV;AAAA,oBACA,UAAY;AAAA,sBACV,MAAQ;AAAA,oBACV;AAAA,oBACA,iBAAmB;AAAA,sBACjB,MAAQ;AAAA,oBACV;AAAA,oBACA,MAAQ;AAAA,sBACN,MAAQ;AAAA,sBACR,OAAS;AAAA,wBACP,MAAQ;AAAA,wBACR,YAAc;AAAA,0BACZ,sBAAwB;AAAA,wBAC1B;AAAA,sBACF;AAAA,oBACF;AAAA,oBACA,UAAY;AAAA,sBACV,MAAQ;AAAA,sBACR,OAAS;AAAA,wBACP,MAAQ;AAAA,wBACR,YAAc;AAAA,0BACZ,sBAAwB;AAAA,wBAC1B;AAAA,sBACF;AAAA,oBACF;AAAA,kBACF;AAAA,kBACA,sBAAwB;AAAA,kBACxB,UAAY,CAAC,OAAO,YAAY,QAAQ,UAAU;AAAA,gBACpD;AAAA,gBACA,WAAa;AAAA,kBACX,MAAQ;AAAA,gBACV;AAAA,gBACA,WAAa;AAAA,kBACX,MAAQ;AAAA,gBACV;AAAA,gBACA,sBAAwB;AAAA,cAC1B;AAAA,cACA,UAAY,CAAC,YAAY;AAAA,cACzB,aAAe;AAAA,YACjB;AAAA,YACA,wBAA0B;AAAA,cACxB,MAAQ;AAAA,cACR,YAAc;AAAA,gBACZ,WAAa;AAAA,kBACX,MAAQ;AAAA,gBACV;AAAA,gBACA,sBAAwB;AAAA,cAC1B;AAAA,cACA,UAAY,CAAC,WAAW;AAAA,cACxB,aAAe;AAAA,YACjB;AAAA,YACA,2BAA6B;AAAA,cAC3B,MAAQ;AAAA,cACR,YAAc;AAAA,gBACZ,WAAa;AAAA,kBACX,MAAQ;AAAA,gBACV;AAAA,gBACA,SAAW;AAAA,kBACT,MAAQ;AAAA,gBACV;AAAA,gBACA,aAAe;AAAA,kBACb,MAAQ;AAAA,gBACV;AAAA,gBACA,sBAAwB;AAAA,cAC1B;AAAA,cACA,UAAY,CAAC,aAAa,WAAW,aAAa;AAAA,cAClD,aAAe;AAAA,YACjB;AAAA,YACA,WAAa;AAAA,cACX,MAAQ;AAAA,cACR,YAAc;AAAA,gBACZ,QAAU;AAAA,kBACR,MAAQ;AAAA,gBACV;AAAA,gBACA,sBAAwB;AAAA,cAC1B;AAAA,cACA,UAAY,CAAC,QAAQ;AAAA,cACrB,aAAe;AAAA,YACjB;AAAA,YACA,yCAA2C;AAAA,cACzC,MAAQ;AAAA,cACR,YAAc;AAAA,gBACZ,WAAa;AAAA,kBACX,MAAQ;AAAA,gBACV;AAAA,gBACA,SAAW;AAAA,kBACT,MAAQ;AAAA,gBACV;AAAA,gBACA,aAAe;AAAA,kBACb,MAAQ;AAAA,gBACV;AAAA,gBACA,sBAAwB;AAAA,cAC1B;AAAA,cACA,UAAY,CAAC,aAAa,WAAW,aAAa;AAAA,cAClD,aAAe;AAAA,YACjB;AAAA,YACA,gCAAkC;AAAA,cAChC,MAAQ;AAAA,cACR,YAAc;AAAA,gBACZ,KAAO;AAAA,kBACL,MAAQ;AAAA,gBACV;AAAA,gBACA,gBAAkB;AAAA,kBAChB,MAAQ;AAAA,kBACR,YAAc;AAAA,oBACZ,sBAAwB;AAAA,kBAC1B;AAAA,gBACF;AAAA,gBACA,cAAgB;AAAA,kBACd,MAAQ;AAAA,kBACR,YAAc;AAAA,oBACZ,sBAAwB;AAAA,kBAC1B;AAAA,gBACF;AAAA,gBACA,sBAAwB;AAAA,cAC1B;AAAA,cACA,UAAY,CAAC,OAAO,kBAAkB,cAAc;AAAA,cACpD,aAAe;AAAA,YACjB;AAAA,YACA,0CAA4C;AAAA,cAC1C,MAAQ;AAAA,cACR,YAAc;AAAA,gBACZ,WAAa;AAAA,kBACX,MAAQ;AAAA,gBACV;AAAA,gBACA,+BAAiC;AAAA,kBAC/B,MAAQ;AAAA,kBACR,YAAc;AAAA,oBACZ,sBAAwB;AAAA,kBAC1B;AAAA,gBACF;AAAA,gBACA,kBAAoB;AAAA,kBAClB,MAAQ;AAAA,kBACR,YAAc;AAAA,oBACZ,sBAAwB;AAAA,kBAC1B;AAAA,gBACF;AAAA,gBACA,sBAAwB;AAAA,cAC1B;AAAA,cACA,UAAY,CAAC,aAAa,+BAA+B;AAAA,cACzD,aAAe;AAAA,YACjB;AAAA,YACA,qBAAuB;AAAA,cACrB,MAAQ;AAAA,cACR,YAAc;AAAA,gBACZ,IAAM;AAAA,kBACJ,MAAQ;AAAA,gBACV;AAAA,gBACA,aAAe;AAAA,kBACb,MAAQ;AAAA,kBACR,OAAS;AAAA,oBACP,MAAQ;AAAA,kBACV;AAAA,gBACF;AAAA,gBACA,gBAAkB;AAAA,kBAChB,MAAQ;AAAA,kBACR,YAAc;AAAA,oBACZ,sBAAwB;AAAA,kBAC1B;AAAA,gBACF;AAAA,gBACA,sBAAwB;AAAA,cAC1B;AAAA,cACA,UAAY,CAAC,MAAM,gBAAgB;AAAA,cACnC,aAAe;AAAA,YACjB;AAAA,YACA,yCAA2C;AAAA,cACzC,MAAQ;AAAA,cACR,YAAc;AAAA,gBACZ,WAAa;AAAA,kBACX,MAAQ;AAAA,gBACV;AAAA,gBACA,gCAAkC;AAAA,kBAChC,MAAQ;AAAA,kBACR,YAAc;AAAA,oBACZ,sBAAwB;AAAA,kBAC1B;AAAA,gBACF;AAAA,gBACA,sBAAwB;AAAA,cAC1B;AAAA,cACA,UAAY,CAAC,aAAa,gCAAgC;AAAA,cAC1D,aAAe;AAAA,YACjB;AAAA,YACA,8BAAgC;AAAA,cAC9B,MAAQ;AAAA,cACR,YAAc;AAAA,gBACZ,SAAW;AAAA,kBACT,MAAQ;AAAA,kBACR,YAAc;AAAA,oBACZ,sBAAwB;AAAA,kBAC1B;AAAA,gBACF;AAAA,gBACA,yBAA2B;AAAA,kBACzB,MAAQ;AAAA,kBACR,YAAc;AAAA,oBACZ,sBAAwB;AAAA,kBAC1B;AAAA,gBACF;AAAA,gBACA,YAAc;AAAA,kBACZ,MAAQ;AAAA,kBACR,YAAc;AAAA,oBACZ,sBAAwB;AAAA,kBAC1B;AAAA,gBACF;AAAA,gBACA,sBAAwB;AAAA,cAC1B;AAAA,cACA,UAAY,CAAC,WAAW,YAAY;AAAA,cACpC,aAAe;AAAA,YACjB;AAAA,YACA,qCAAuC;AAAA,cACrC,MAAQ;AAAA,cACR,YAAc;AAAA,gBACZ,WAAa;AAAA,kBACX,MAAQ;AAAA,gBACV;AAAA,gBACA,+BAAiC;AAAA,kBAC/B,MAAQ;AAAA,kBACR,YAAc;AAAA,oBACZ,sBAAwB;AAAA,kBAC1B;AAAA,gBACF;AAAA,gBACA,gCAAkC;AAAA,kBAChC,MAAQ;AAAA,kBACR,YAAc;AAAA,oBACZ,sBAAwB;AAAA,kBAC1B;AAAA,gBACF;AAAA,gBACA,sBAAwB;AAAA,cAC1B;AAAA,cACA,UAAY,CAAC,aAAa,+BAA+B;AAAA,cACzD,aAAe;AAAA,YACjB;AAAA,UACF;AAAA,UACA,SAAW;AAAA,YACT,mBAAqB;AAAA,cACnB,aAAe;AAAA,cACf,WAAa;AAAA,gBACX,MAAQ;AAAA,cACV;AAAA,cACA,YAAc;AAAA,YAChB;AAAA,YACA,wBAA0B;AAAA,cACxB,aAAe;AAAA,cACf,WAAa;AAAA,gBACX,MAAQ;AAAA,cACV;AAAA,cACA,YAAc;AAAA,YAChB;AAAA,YACA,sBAAwB;AAAA,cACtB,aAAe;AAAA,cACf,WAAa;AAAA,gBACX,MAAQ;AAAA,cACV;AAAA,cACA,YAAc;AAAA,YAChB;AAAA,YACA,sBAAwB;AAAA,cACtB,aAAe;AAAA,cACf,WAAa;AAAA,gBACX,MAAQ;AAAA,cACV;AAAA,cACA,YAAc;AAAA,gBACZ,MAAQ;AAAA,cACV;AAAA,YACF;AAAA,YACA,oCAAsC;AAAA,cACpC,aAAe;AAAA,cACf,WAAa;AAAA,gBACX,MAAQ;AAAA,cACV;AAAA,cACA,YAAc;AAAA,gBACZ,MAAQ;AAAA,cACV;AAAA,YACF;AAAA,YACA,qCAAuC;AAAA,cACrC,aAAe;AAAA,cACf,WAAa;AAAA,gBACX,MAAQ;AAAA,cACV;AAAA,cACA,YAAc;AAAA,gBACZ,MAAQ;AAAA,cACV;AAAA,YACF;AAAA,YACA,oCAAsC;AAAA,cACpC,aAAe;AAAA,cACf,WAAa;AAAA,gBACX,MAAQ;AAAA,cACV;AAAA,cACA,YAAc;AAAA,gBACZ,MAAQ;AAAA,cACV;AAAA,YACF;AAAA,YACA,gCAAkC;AAAA,cAChC,aAAe;AAAA,cACf,WAAa;AAAA,gBACX,MAAQ;AAAA,cACV;AAAA,cACA,YAAc;AAAA,gBACZ,MAAQ;AAAA,cACV;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA;AAAA;;;ACxUA,SAIEA,kCACAC,uBAEK;AACP,SAASC,oBAAAA,yBAAwB;AACjC,SAEEC,oBAAAA,yBAWK;;;ACtBP,SAGEC,0BACAC,QAGAC,gBACAC,cACAC,cACAC,wBACAC,IAEAC,OACAC,aACAC,wBAEK;AACP,SAA8DC,mBAAmB;AAEjF,SAASC,oBAAoBC,wBAAwB;AACrD,SACEC,sCACAC,4BACAC,8BACAC,kCAEK;AAGP,SAASC,wBAAsF;AAM/F,SAASC,oBAAoB;AAG7B,SAASC,qBAAqB;AAEvB,SAASC,kBAAkBC,WAAqB;AACrD,MAAIC,MAAMC,QAAQF,UAAUG,iBAAiB,KAAKH,UAAUG,kBAAkBC,SAAS,GAAG;AACxF,WAAOJ,UAAUG,kBAAkB,CAAA;EACrC;AACA,SAAOE,iBAAiBC;AAC1B;AALgBP;AAOhB,SAASQ,8BAA8BC,oBAA4CC,SAAyB;AAC1G,SAAOD,mBAAmBE,6BACtBF,mBAAmBE,6BACnB,OAAOC,SAAAA;AACL,UAAMC,SAAS,MAAMH,QAAQI,MAAMC,mBAAmB;MACpDC,YAAYJ,KAAKI;MACjBC,qBAAqB;IACvB,CAAA;AACA,WAAO;MAAEC,UAAUL,OAAOA;IAAO;EACnC;AACN;AAVSL;AAYF,SAASW,oCACdC,QACAV,SAAyB;AAEzB,iBAAeW,iCACbT,MACAU,wBAA+C;AAE/C,QAAIC,iBAAiBC,eAAeZ,IAAAA,GAAO;AACzC,YAAMC,UAAyC,MAAMH,QAAQI,MAAMW,wBAAwB;QACzFC,cAAcd;QACde,IAAI;MACN,CAAA;AAEA,aAAO;QAAET,UAAU,CAAC,CAACL,QAAOe;MAAQ;IACtC;AAEA,QAAIL,iBAAiBM,uBAAuBjB,IAAAA,GAAO;AAEjD,UAAIF,QAAQI,MAAMgB,uBAAuBC,QAAW;AAClD,eAAOC,QAAQC,OAAO,gEAAA;MACxB;AACA,UAAIX,2BAA2BS,UAAaT,2BAA2B,MAAM;AAC3E,cAAMY,eAAe,MAAMxB,QAAQI,MAAMgB,mBAAmB;UAC1DK,UAAUvB;UACVwB,yBAAyBd;QAC3B,CAAA;AACA,eAAO;UAAEJ,UAAU,CAACgB,aAAaG;QAAM;MACzC;AACA,YAAMC,MAAM,mEAAmE;IACjF;AAEA,UAAMzB,SAAS,MAAMH,QAAQI,MAAMyB,mBAAmB;MACpDb,cAAcd;MACdK,qBAAqB;MACrBuB,SAAS,MAAM9B,QAAQI,MAAM2B,qBAAqBrB,MAAAA,GAASsB,KAAKC,MAAM,GAAA,EAAK,CAAA;IAC7E,CAAA;AACA,WAAO;MAAEzB,UAAUL,OAAOK;IAAS;EACrC;AAlCeG;AAoCf,SAAOA;AACT;AAzCgBF;AA2ChB,eAAsByB,gBAAgBhC,MAMrC;AACC,QAAM,EAAEiC,QAAQC,SAASpC,QAAO,IAAKE;AACrC,QAAM,EAAEmC,eAAc,IAAKF;AAC3B,MAAIG,aAAkDpC,KAAKoC;AAC3D,MAAIC,YAAmCrC,KAAKsC;AAE5C,MAAI,CAACF,cAAcF,WAAWA,QAAQK,cAAc;AAClD,UAAMC,8BAA8B,MAAM1C,QAAQI,MAAMuC,kBAAkB;MACxEC,QAAQ;QACN;UACEH,cAAcL,QAAQK;UACtBI,SAAST,QAAQS;UACjBC,UAAUV,QAAQU;QACpB;;IAEJ,CAAA;AAEA,QAAIJ,4BAA4B/C,SAAS,GAAG;AAC1C,YAAMoD,6BAA6BL,4BAA4B,CAAA;AAC/DJ,mBAAaS,2BAA2BC;AACxC,UAAI,CAACT,aAAaQ,2BAA2BE,aAAa;AACxDV,oBAAYQ,2BAA2BE;MACzC;IACF;EACF;AAEA,QAAMC,aAAab,eAAec,uBAAwB,MAAMC,mBAAmBpD,OAAAA;AACnF,QAAMqD,eAAelB,OAAOkB,gBAAgB,IAAIC,aAAAA;AAEhD,QAAMC,wBAA4C;;;IAGhDC,kCAAkC;MAACC,YAAYC;MAAOD,YAAYE;MAAOF,YAAYG;;IACrFC,wCAAwC;MAACJ,YAAYC;MAAOD,YAAYE;MAAOF,YAAYG;;IAC3FE,wBAAwB;MAACC,aAAaC;;IACtCC,aAAa;IACbC,oBAAoB;MAClBC,QAAQ;QAAEC,KAAK;UAAC;UAAS;;MAAU;MACnCC,QAAQ;QAAED,KAAK;UAAC;UAAU;;MAAS;IACrC;IACAE,iBAAiB;MAACC,MAAMC;;IACxBC,uBAAuB;MAACC,YAAYC;;IACpCC,gCAAgC1B,WAAW2B,IAAI,CAACC,WAAW,OAAOA,MAAAA,EAAQ;IAC1EC,QAAQC,OAAOC;EACjB;AAEA,QAAMC,WACJ/C,OAAOE,eAAe8C,aAAaD,YACnCE,iBAAiBpF,SAAS;IACxBqF,oBAAoB;IACpBC,iBAAiB;IACjBC,uBAAuBpD,OAAOE,eAAe8C,aAAaK,gCAAgC;EAC5F,CAAA;AAEF,MAAIC,SAA6BtD,OAAOuD,gBAAgBD;AACxD,MAAI,CAACtD,OAAOuD,gBAAgBD,UAAU,OAAOtD,OAAOuD,gBAAgBD,WAAW,YAAY;AACzFA,aAASE;EACX;AAEA,QAAMC,UAAUC,GAAGD,QAAQ;IAAEE,gBAAgBxG,kBAAkB6C,MAAAA;EAAQ,CAAA,EACpE4D,UAAU,UAAUC,eAAeC,cAAc,EACjDC,iBAAiB/D,OAAOgE,gBAAgBC,aAAaC,IAAI,EACzDC,iBAAiBvC,aAAawC,UAAUP,eAAeC,cAAc,EAErEO,sBACCrE,OAAOzC,qBAAqB;IAACE,iBAAiBC;IAAgCD,iBAAiB6G;IAAY7G,iBAAiB8G;GAAW,EAGxIC,iBAAiBtD,YAAAA,EACjBuD,mBAAmBzE,OAAO0E,kBAAkB,IAAIC,yBAAyBzD,YAAAA,CAAAA,EACzE0D,mBAAmB5E,OAAO6E,sBAAsBzD,uBAAuByC,eAAeC,cAAc,EACpGgB,sBACC9E,OAAO+E,oBACH/E,OAAO+E,oBACPC,qBACE;IACEjC;IACAkC,YAAY;MACVnH,4BAA4BH,8BAA8BqC,OAAOE,gBAAgBrC,OAAAA;MACjFqH,mBAAmB;IACrB;EACF,GACArH,OAAAA,CAAAA,EAGPsH,2BAA2BC,uBAAuBC,KAAK,EACvDC,6BAA6BhH,oCAAoC4B,eAAe3B,QAAQV,OAAAA,CAAAA;AAE3F,QAAM0H,WAAWrF,eAAeqF;AAChC,MAAIA,YAAYC,qCAAqCD,QAAAA,GAAW;AAC9D9B,YAAQgC,aAAaF,SAASG,YAAY7B,eAAeC,cAAc,EAAE6B,mBAAmB,aAAa9B,eAAeC,cAAc;EACxI,OAAO;AACL,UAAM8B,aAAa,MAAM/H,QAAQI,MAAM2B,qBAAqBM,eAAe3B,MAAM;AACjFkF,YACGoC,aACCD,WAAWE,WAAWC,6BAA6BH,UAAAA,IAAcA,WAAWI,MAAMJ,WAAWK,gBAC7FpC,eAAeC,cAAc,EAE9B6B,mBACEC,WAAWM,kBAAsChG,eAAe3B,OAAO2H,gBACxErC,eAAeC,cAAc;EAEnC;AAEA,MAAIR,QAAQ;AACVG,YAAQ0C,WAAW7C,MAAAA;EACrB;AASA,MAAInD,YAAY;AACdsD,YAAQ2C,2BAA2B;MAAEjG;IAAW,GAAG0D,eAAeC,cAAc;EAClF;AACA,MAAI1D,WAAW;AACbqD,YAAQ4C,cAAcjG,SAAAA;EACxB;AAEA,MAAIJ,OAAOsG,qBAAqB;AAC9B7C,YAAQ8C,wBAAwBvG,OAAOsG,mBAAmB;EAC5D;AAgBA,QAAME,oBAAoBC,aAAazG,OAAOE,eAAe3B,QAAQV,OAAAA;AACrE4F,UAAQiD,sBAAsBF,iBAAAA;AAC9B,SAAO/C;AACT;AArJsB1D;AAuJf,SAAS0G,aACdlI,QACAV,SAAyB;AAEzB,SAAO,OAAO8I,WAAsBC,KAAiD/G,QAAAA;AACnF,QAAI,EAAEgH,2BAA2BtI,MAAAA,KAAWuI,2BAA2BvI,MAAAA,IAAU;AAC/E,aAAOY,QAAQC,OAAOK,MAAM,qBAAqBkH,UAAUhE,MAAM,oBAAoB,CAAA;IACvF;AACA,UAAM3E,SAA2B,MAAMH,QAAQI,MAAM8I,6BAA6B;;;MAGhFjB,QAAQ;QAAEJ,YAAYnH,OAAOmH;QAAYsB,WAAWzI,OAAOyI;QAAWC,sBAAsB;MAAM;;;MAGlGC,iBAAiBN,IAAIO;MACrBpI,SAAS6H,IAAI7H;IACf,CAAA;AACA,WAAOf,OAAO4I;EAChB;AACF;AAnBgBH;AAqBhB,SAASzB,qBACPoC,OAOAvJ,SAAyB;AAEzB,SAAO,OAAOwJ,cAAcT,QAAAA;AAC1B,UAAM5I,SAAS,MAAMH,QAAQI,MAAMqJ,sBAAsB;MAAEC,KAAKX,IAAIY;IAAI,CAAA;AACxEC,YAAQC,IAAI1J,OAAO2J,OAAO;AAC1B,WAAO,CAAC3J,OAAOwB;EACjB;AACF;AAfSwF;AAqBF,SAAS4C,eAAeC,MAAc;AAC3C,UAAQA,MAAAA;IACN,KAAK;AACH,aAAOC,YAAYC;IACrB,KAAK;AACH,aAAOD,YAAYE;IACrB,KAAK;AACH,aAAOF,YAAYG;;IAErB,KAAK;AACH,aAAOH,YAAYI;IACrB;AACE,YAAMC,MAAM,4BAAA;EAChB;AACF;AAdgBP;;;ACpShB,SAASQ,MAAMC,cAAc;AAE7B,SACEC,+BACAC,gCAAAA,+BACAC,oCACK;AAEA,IAAMC,aAAN,MAAMA;EATb,OASaA;;;EACHC;EACSC;EACAC;EAEjB,YAAmB,EAAEC,QAAQC,QAAO,GAAmD;AACrF,SAAKF,aAAaC;AAClB,SAAKF,cAAcG;EACrB;EAEA,MAAaC,IAAIC,SAAwC;AACvD,QAAI,CAAC,KAAKN,KAAK;AACb,YAAMO,UAAU,MAAMC,gBAAgB;QACpCL,QAAQ,KAAKD;QACbE,SAAS,KAAKH;QACdK;MACF,CAAA;AACA,WAAKN,MAAMO,QAAQE,MAAK;IAC1B;AACA,WAAO,KAAKT;EACd;EAEA,IAAIU,YAAY;AACd,WAAO,KAAKR;EACd;EAEA,IAAIS,aAAa;AACf,WAAO,KAAKV;EACd;EAEOW,gBAAyB;AAC9B,WAAO,KAAKC,iBAAiBC;EAC/B;EAEA,IAAID,eAAmC;AACrC,WAAO,KAAKF,YAAYE;EAC1B;EAEA,MAAaE,0BAA0BT,SAAyE;AAC9G,WAAO,KAAKO,eACR,MAAMP,QAAQU,MAAMC,sBAAsB;MACxCJ,cAAc,KAAKA;MACnBK,UAAU,KAAKP,YAAYO;IAC7B,CAAA,IACAJ;EACN;EAEA,MAAaK,8BAA8BC,YAA0Dd,SAAyC;AAC5I,UAAM,EAAEe,eAAeC,QAAQC,uBAAuBC,aAAaC,gBAAe,IAAKL;AACvF,UAAMM,QAAQN,WAAWM,SAASC,OAAAA;AAClC,UAAMC,QAAQR,WAAWQ,SAASP;AAClC,QAAIQ;AACJ,UAAMC,SAAS,KAAKpB,UAAUqB,eAAeD;AAC7C,UAAME,aAAa,MAAMC,8BAA8BH,QAAQxB,OAAAA;AAC/D,QAAI4B,8BAA6BF,UAAAA,GAAa;AAC5CH,kBAAY;QAAEM,QAAQH,WAAWI;QAAKC,QAAQ;QAAOC,KAAKC,eAAeP,WAAWQ,IAAIC,IAAI;MAAE;IAChG,WAAWC,6BAA6BV,UAAAA,GAAa;AACnD,UAAI,CAACA,WAAWW,QAAQ;AACtB,eAAOC,QAAQC,OAAO,0BAAA;MACxB;AACAhB,kBAAY;QACVc,QAAQX,WAAWW;QACnBG,KAAKd,WAAWc;QAChBT,QAAQ;QACRC,KAAKC,eAAeP,WAAWQ,IAAIC,IAAI;MACzC;IACF,OAAO;AACL,aAAOG,QAAQC,OAAOE,MAAM,qBAAqBf,WAAWK,MAAM,oBAAoB,CAAA;IACxF;AAEA,WAAO,MAAM,KAAKhC,IAAIC,OAAAA,EAAS0C,KAAK,CAACC,OACnCA,GAAG9B,8BAA8B;MAC/B+B,SAASC,kBAAkB,KAAKzC,SAAS;MACzCW;MACAK;MACAE;MACAN;MACAC;MACAC;MACAC;MACAI;IACF,CAAA,CAAA;EAEJ;EAEA,MAAauB,2BACXhC,YACAd,SAC+B;AAC/B,UAAM,EAAEe,eAAeC,QAAQC,uBAAuBC,aAAaC,gBAAe,IAAKL;AACvF,UAAMM,QAAQN,WAAWM,SAASC,OAAAA;AAClC,UAAMC,QAAQR,WAAWQ,SAASP;AAClC,UAAMS,SAAS,KAAKpB,UAAUqB,eAAeD;AAC7C,UAAME,aAAa,MAAMC,8BAA8BH,QAAQxB,OAAAA;AAE/D,QAAIuB;AACJ,QAAIa,6BAA6BV,UAAAA,KAAeA,WAAWW,QAAQ;AACjEd,kBAAY;QACVQ,QAAQL,WAAWK;QACnBC,KAAKC,eAAeP,WAAWQ,IAAIC,IAAI;QACvCK,KAAKd,WAAWc;QAChBH,QAAQX,WAAWW;MACrB;IACF,WAAWT,8BAA6BF,UAAAA,GAAa;AACnDH,kBAAY;QACVQ,QAAQL,WAAWK;QACnBC,KAAKC,eAAeP,WAAWQ,IAAIC,IAAI;QACvCN,QAAQH,WAAWqB;MACrB;IACF,OAAO;AACL,aAAOT,QAAQC,OAAOE,MAAM,qCAAA,CAAA;IAC9B;AAEA,WAAO,MAAM,KAAK1C,IAAIC,OAAAA,EAAS0C,KAAK,CAACC,OACnCA,GAAGG,2BAA2B;MAC5BF,SAASC,kBAAkB,KAAKzC,SAAS;MACzCW;MACAK;MACAE;MACAN;MACAC;MACAE;MACAD;MACAK;IACF,CAAA,CAAA;EAEJ;AACF;;;AF7FA,SAASyB,aAAaC,sBAAqB;AAGpC,IAAMC,WAAN,MAAMA,UAAAA;EAjDb,OAiDaA;;;EACMC;EACjB,OAAwBC,oBAAoB;EAC3BC,YAAqC,oBAAIC,IAAAA;EACjDC,SAASA,OAAOC;EAEhBC,UAAqB;IAC5BC,0BAA0B,KAAKC,8BAA8BC,KAAK,IAAI;IACtEC,+BAA+B,KAAKC,mCAAmCF,KAAK,IAAI;IAChFG,yBAAyB,KAAKC,oBAAoBJ,KAAK,IAAI;IAC3DK,0BAA0B,KAAKC,qBAAqBN,KAAK,IAAI;IAC7DO,4BAA4B,KAAKC,uBAAuBR,KAAK,IAAI;IACjES,qBAAqB,KAAKC,gBAAgBV,KAAK,IAAI;IACnDW,wBAAwB,KAAKA,uBAAuBX,KAAK,IAAI;IAC7DY,uBAAuB,KAAKA,sBAAsBZ,KAAK,IAAI;IAC3Da,oBAAoB,KAAKA,mBAAmBb,KAAK,IAAI;EACvD;EAEAc,YAAYvB,MAAqB;AAC/B,SAAKA,OAAOA;EACd;EAEOwB,eAAeC,eAA+BC,SAA2B;AAE9E,SAAK1B,KAAK2B,cAAcF;AAExB,QACE,CAAC,KAAKzB,KAAK2B,YAAYC,eAAeC,aAAaC,YACnD,OAAO,KAAK9B,KAAK2B,YAAYC,eAAeC,YAAYC,SAASC,YAAY,YAC7E;AACA,WAAK/B,KAAK2B,YAAYC,eAAeC,cAAc;QACjD,GAAG,KAAK7B,KAAK2B,YAAYC,eAAeC;QACxCC,UAAUE,kBAAiBN,SAAS;UAAEO,uBAAuB;UAAMC,oBAAoB;UAAMC,iBAAiB;QAAK,CAAA;MACrH;IACF;EACF;EAEA,MAAc3B,8BAA8B4B,YAAoCV,SAA4C;AAC1H,WAAO,MAAM,KAAKW,cAAc;MAAEC,cAAcF,WAAWE;MAAcC,qBAAqBH,WAAWG;IAAoB,GAAGb,OAAAA,EAC7Hc,KAAK,CAACC,OAAOA,GAAGjC,8BAA8B4B,YAAYV,OAAAA,CAAAA,EAC1Dc,KAAK,CAACE,QAAQA,IAAIC,UAAU;EACjC;EAEA,MAAchC,mCACZyB,YACAV,SACwC;AACxC,WAAO,MAAM,KAAKW,cAAc;MAAEC,cAAcF,WAAWE;IAAa,GAAGZ,OAAAA,EACxEc,KAAK,CAACC,OAAOA,GAAGG,2BAA2BR,YAAYV,OAAAA,CAAAA,EACvDc,KAAK,OAAOK,YAAAA;AACX,YAAMC,cAA6C;QACjDC,sBAAsBF,QAAQG;QAC9BC,eAAe,MAAMJ,QAAQK,iBAAgB;QAC7CC,sBAAsB,MAAMN,QAAQI,eAAeG,WAAAA;MACrD;AACA,aAAON;IACT,CAAA;EACJ;EAEA,MAAcjC,oBAAoBwC,MAAgC3B,SAA2E;AAC3I,WAAO,MAAM,KAAKW,cAAc;MAAEC,cAAce,KAAKf;IAAa,GAAGZ,OAAAA,EAASc,KAAK,CAACC,OAClFA,GAAGa,IAAI5B,OAAAA,EAASc,KAAK,CAACC,QAAOA,IAAGc,eAAeC,+BAA+BH,KAAKI,eAAeJ,KAAKK,eAAe,CAAA,CAAA;EAE1H;EAEA,MAAc3C,qBACZsC,MACA3B,SACiE;AACjE,UAAMiC,aAAyB,MAAM,KAAKtB,cAAc;MAAEC,cAAce,KAAKf;IAAa,GAAGZ,OAAAA;AAC7F,UAAMkC,6BAAqE,MAAMD,WAC9EL,IAAI5B,OAAAA,EACJc,KAAK,CAACC,OAAOA,GAAGc,eAAeM,gCAAgCR,KAAKI,eAAeJ,KAAKK,eAAe,CAAA;AAC1G,QAAIE,+BAA+BE,QAAW;AAC5C,aAAOA;IACT;AAEA,UAAMC,gBAAgBH;AACtB,QACEG,cAAcC,WAAWC,iCAAiCC,YAC1Db,KAAKc,uBACLd,KAAKc,wBAAwBC,iBAAiBC,MAC9C;AACA,UAAIC;AACJ,UACEC,kBAAiBC,eAAeT,cAAcU,SAASzB,QAAQ0B,QAAQ,MACtE,CAACf,WAAWgB,UAAUC,gBAAgBN,UAAU,OAAOX,WAAWgB,UAAUC,gBAAgBN,WAAW,aACxG;AACAA,iBAASO;MACX;AAEA,YAAMC,sBAAsBP,kBAAiBQ;QAC3ChB,cAAcU,SAASzB,QAAQ0B;;QAE/BJ;MAAAA;AAEF,cAAQjB,KAAKc,qBAAmB;QAC9B,KAAKC,iBAAiBY;AACpBjB,wBAAcU,SAASzB,QAAQiC,eAAe,KAAKC,yBAAyBJ,mBAAAA;AAC5E;QACF,KAAKV,iBAAiBe;AACpB,gBAAMC,YAA8B,CAAC;AACrC,qBAAWC,cAAc,KAAKH,yBAAyBJ,mBAAAA,EAAqBQ,wBAAwB,CAAA,GAAI;AACtG,kBAAMC,KAAKF;AACX,kBAAMG,yBAAyB,MAAM9D,QAAQ+D,MAAMC,eAAe;cAChEL;cACAf;cACAqB,kBAAkBhC,WAAWgB,UAAUiB,sBAAsBC;YAC/D,CAAA;AACA,gBAAI,CAACL,uBAAuBM,QAAQ;AAClC/B,4BAAcC,SAASC,iCAAiC8B;AACxDhC,4BAAciC,QAAQ,IAAIC,MAAMT,uBAAuBQ,KAAK;AAC5D,qBAAOjC;YACT;AAEA,kBAAMmC,oBAAoBX,GAAGW;AAC7B,gBAAI,EAAE,QAAQd,YAAY;AACxBA,wBAAU,IAAA,IAAQc,kBAAkBC;YACtC;AAEAC,mBAAOC,QAAQH,iBAAAA,EAAmBI,QAAQ,CAAC,CAACC,KAAKC,KAAAA,MAAM;AACrD,kBAAI,EAAED,OAAOnB,YAAY;AACvBA,0BAAUmB,GAAAA,IAAOC;cACnB;YACF,CAAA;UACF;AACAzC,wBAAckB,eAAeG;AAC7B;MACJ;IACF;AACA,WAAOrB;EACT;EAEQmB,2BAA2B,wBACjCJ,wBAOAP,kBAAiBkC,yBAAyB3B,mBAAAA,IACtCA,oBAAoB4B,iBACpBnC,kBAAiBoC,sBAAsB7B,mBAAAA,GAVV;EAYnC,MAAc7D,uBAAuBoC,MAA+B3B,SAA+D;AACjI,QAAI2B,KAAKuD,UAAU,QAAQ;AACzB,YAAMX,MAAM,+DAA+D;IAC7E;AACA,WAAO,MAAM,KAAK5D,cAAc;MAAEC,cAAce,KAAKf;IAAa,GAAGZ,OAAAA,EAElEc,KAAK,CAACC,OACLA,GAAGa,IAAI5B,OAAAA,EAASc,KAAK,OAAOC,QAAAA;AAC1B,YAAMA,IAAGoE,2BAA2B;QAClCpD,eAAeJ,KAAKI;QACpBuC,OAAO3C,KAAK2C,QAAQ,IAAIC,MAAM5C,KAAK2C,KAAK,IAAIlC;MAC9C,CAAA;AACA,aAAQ,MAAMrB,IAAGc,eAAeC,+BAA+BH,KAAKI,eAAe,IAAA;IACrF,CAAA,CAAA;EAEN;EAEA,MAActC,gBAAgBkC,MAAiC3B,SAA6C;AAC1G,WAAO,MAAM,KAAKW,cAAc;MAAEC,cAAce,KAAKf;IAAa,GAAGZ,OAAAA,EAClEc,KAAK,CAACC,OAAOA,GAAGa,IAAI5B,OAAAA,EAASc,KAAK,CAACC,QAAOA,IAAGc,eAAeuD,4BAA4BzD,KAAKI,aAAa,CAAA,CAAA,EAC1GjB,KAAK,MAAM,IAAA;EAChB;EAEA,MAAcpB,uBAAuBiC,MAAoC3B,SAAmE;AAC1I,QAAI,CAAC2B,KAAK0D,uBAAuB;AAC/B,YAAMd,MAAM,2CAAA;IACd;AACA,UAAMe,eACJ,OAAO3D,KAAK0D,0BAA0B,WACjCE,gBAAgB5D,KAAK0D,qBAAqB,IAC3C1D,KAAK0D;AACX,WAAO,MAAM,KAAK1E,cAAc;MAAEC,cAAce,KAAKf;IAAa,GAAGZ,OAAAA,EAASc,KAAK,CAACC,OAClFA,GAAGa,IAAI5B,OAAAA,EAASc,KAAK,CAACC,QACpBA,IAAGyE,4BAA4BF,cAAc;MAC3CvD,eAAeJ,KAAKI;MACpB,GAAIJ,KAAK8D,2BAA2B,CAAC9D,KAAK+D,YAAY;QAAED,yBAAyB9D,KAAK8D;MAAwB,IAAI,CAAC;MACnH,GAAI9D,KAAK+D,YAAY;QAAEA,WAAW/D,KAAK+D;MAAuB,IAAI,CAAC;MACnEC,UAAUhE,KAAKgE;IACjB,CAAA,CAAA,CAAA;EAGN;EAEA,MAAchG,sBAAsBgC,MAA6B3B,SAA0C;AACzG,UAAM,EAAE4F,aAAaC,UAAUC,SAASC,mBAAkB,IAAKpE;AAC/D,UAAMqE,QAAQC,IACZL,YAAYM,IAAI,OAAOC,mBAAAA;AACrB,YAAMC,oBAAoBD,eAAeC;AACzC,YAAMpG,QAAQ+D,MAAMsC,sBAAsB;QAAEC,YAAYF;MAAkB,CAAA;AAE1EG,cAAQC,IAAI,yBAAyBJ,kBAAkB3B,EAAE,MAAM2B,kBAAkBK,IAAI,4BAA4BV,kBAAAA,EAAoB;AACrI,aAAO/F,QAAQ+D,MAAM2C,qBAAqB;QACxCC,gBAAgB;UACdd;UACAC;UACAM;UACAQ,aAAaT,eAAeS;QAC9B;QACAtI,MAAM;UAAEyH;QAAuC;MACjD,CAAA;IACF,CAAA,CAAA;EAEJ;EAEA,MAAcnG,mBAAmB+B,MAA2B3B,SAAwD;AAClH,UAAM6G,aAAalF,KAAKf,gBAAgBvC,UAASE;AACjD,QAAI,KAAKC,UAAUsI,IAAID,UAAAA,GAAa;AAClC,YAAM5E,aAAa,KAAKzD,UAAUoD,IAAIiF,UAAAA;AACtC,UAAI5E,eAAeG,QAAW;AAC5B,cAAMrB,KAAK,MAAMkB,WAAWL,IAAI5B,OAAAA;AAChC,eAAOe,GAAGgG,uBAAuB;UAC/BC,gBAAgBrF,KAAKI;UACrBA,eAAeJ,KAAKI;UACpB,GAAIJ,KAAKuD,SAAS;YAAEA,OAAOvD,KAAKuD;UAAM;QACxC,CAAA;MACF;IACF;AACA,WAAO9C;EACT;EAEA,MAAMzB,cAAc,EAAEC,cAAcC,oBAAmB,GAAyBb,SAAgD;AAC9H,UAAM6G,aAAajG,gBAAgBvC,UAASE;AAC5C,QAAI,CAAC,KAAKC,UAAUsI,IAAID,UAAAA,GAAa;AACnC,YAAMI,eAAe,KAAKC,gBAAgBtG,YAAAA;AAC1C,YAAMuG,SAAS,MAAM,KAAKC,aAAapH,SAAS;QAAEY;QAAcC;MAAyC,CAAA;AACzG,UAAI,CAACsG,OAAOjH,eAAeC,aAAaC,YAAY,OAAO+G,OAAOjH,eAAeC,YAAYC,SAASC,YAAY,YAAY;AAC5H,YAAI,CAAC8G,OAAOjH,gBAAgBC,aAAa;AACvCgH,iBAAOjH,iBAAiB;YAAE,GAAGiH,OAAOjH;UAAe;AACnDiH,iBAAOjH,eAAeC,cAAc;YAAE,GAAGgH,OAAOjH,eAAeC;UAAY;QAC7E;AACAoG,gBAAQC,IAAI,iEAAiE5F,YAAAA;AAC7EuG,eAAOjH,eAAeC,YAAYC,WAAWE,kBAAiBN,SAAS;UACrEO,uBAAuB;UACvBE,iBAAiB;UACjBD,oBAAoB;QACtB,CAAA;MACF;AACA,WAAKhC,UAAU6I,IAAIR,YAAY,IAAIS,WAAW;QAAEH;QAAQI,SAASN;MAAa,CAAA,CAAA;IAChF;AACA,UAAMhF,aAAa,KAAKzD,UAAUoD,IAAIiF,UAAAA;AACtC,QAAIhG,qBAAqB;AACvBoB,iBAAWgB,UAAUuE,sBAAsB3G;IAC7C;AACA,WAAOoB;EACT;EAEA,MAAMmF,aAAapH,SAA2B1B,MAAoF;AAChI,UAAM,EAAEsC,cAAcC,oBAAwC,IAAKvC;AACnE,UAAMmJ,UAAU,KAAKP,gBAAgBtG,YAAAA,GAAeuG,UAAU,KAAK7I,KAAK2B;AACxE,QAAI,CAACwH,SAAS;AACZ,YAAMlD,MAAM,6DAA6D3D,YAAAA,EAAc;IACzF;AACA,QAAI,KAAKtC,KAAK2B,aAAa;AACzB,UAAI,CAACwH,QAAQvH,gBAAgB;AAC3BuH,gBAAQvH,iBAAiB,KAAK5B,KAAK2B,aAAaC;MAClD,OAAO;AACL,YAAI,CAACuH,QAAQvH,eAAewH,QAAQ;AAClCD,kBAAQvH,eAAewH,SAAS,KAAKpJ,KAAK2B,YAAYC,eAAewH;QACvE;AACA,YAAI,CAACD,QAAQvH,eAAeyH,qBAAqB;AAC/CF,kBAAQvH,eAAeyH,sBAAsB,KAAKrJ,KAAK2B,YAAYC,eAAeyH;QACpF;AACA,YAAI,CAACF,QAAQG,mBAAmB;AAC9BH,kBAAQG,oBAAoB,KAAKtJ,KAAK2B,YAAY2H;QACpD;MACF;AACA,UAAI,CAACH,QAAQvH,eAAeC,eAAe,OAAOsH,QAAQvH,eAAeC,YAAYC,UAAUC,YAAY,YAAY;AACrHoH,gBAAQvH,eAAeC,cAAc;UACnC,GAAG,KAAK7B,KAAK2B,YAAYC,eAAeC;UACxCC,UACE,KAAK9B,KAAK2B,YAAYC,gBAAgBC,aAAaC,YACnDE,kBAAiBN,SAAS;YAAES,iBAAiB;YAAMD,oBAAoB;YAAMD,uBAAuB;UAAK,CAAA;QAC7G;MACF;IACF;AACA,QAAIM,wBAAwBuB,UAAavB,wBAAwB4G,QAAQD,qBAAqB;AAC5FC,cAAQD,sBAAsB3G;IAChC;AACA,WAAO4G;EACT;EAEAP,gBAAgBtG,cAAwD;AACtE,QAAI,CAAC,KAAKtC,KAAK2I,aAAc,QAAO7E;AAEpC,UAAMyF,cAAcjH,eAAe,KAAKtC,KAAK2I,aAAaa,KAAK,CAACC,MAAMA,EAAEnH,iBAAiBA,YAAAA,IAAgBwB;AAEzG,WAAOyF,eAAe,KAAKG,kBAAkBpH,YAAAA;EAC/C;EAEQoH,kBAAkBpH,cAAkC;AAC1D,QAAI,CAAC,KAAKtC,KAAK2I,aAAc,QAAO7E;AAEpC,UAAM6F,iBAAiB,KAAK3J,KAAK2I,aAAaa,KAAK,CAACC,MAAMA,EAAEnH,iBAAiB,SAAA;AAC7E,QAAIqH,gBAAgB;AAClB,YAAMC,gBAAgB;QAAE,GAAGD;MAAe;AAC1C,UAAIrH,iBAAiBwB,QAAW;AAC9B8F,sBAActH,eAAeA;MAC/B;AACA,aAAOsH;IACT;AAEA,WAAO9F;EACT;AACF;;;AG9TO,IAAK+F,mBAAAA,yBAAAA,mBAAAA;;;;SAAAA;;;;ACpCZ,IAAMC,SAASC;","names":["AuthorizationResponseStateStatus","decodeUriAsJson","getAgentResolver","CredentialMapper","InMemoryRPSessionManager","PassBy","PropertyTarget","ResponseMode","ResponseType","RevocationVerification","RP","Scope","SubjectType","SupportedVersion","SigningAlgo","getAgentDIDMethods","getAgentResolver","isExternalIdentifierOIDFEntityIdOpts","isManagedIdentifierDidOpts","isManagedIdentifierDidResult","isManagedIdentifierX5cOpts","CredentialMapper","EventEmitter","defaultHasher","getRequestVersion","rpOptions","Array","isArray","supportedVersions","length","SupportedVersion","JWT_VC_PRESENTATION_PROFILE_v1","getWellKnownDIDVerifyCallback","siopIdentifierOpts","context","wellknownDIDVerifyCallback","args","result","agent","cvVerifyCredential","credential","fetchRemoteContexts","verified","getPresentationVerificationCallback","idOpts","presentationVerificationCallback","presentationSubmission","CredentialMapper","isSdJwtEncoded","verifySdJwtPresentation","presentation","kb","payload","isMsoMdocOid4VPEncoded","mdocOid4vpRPVerify","undefined","Promise","reject","verifyResult","vp_token","presentation_submission","error","Error","verifyPresentation","domain","identifierManagedGet","kid","split","createRPBuilder","rpOpts","pexOpts","identifierOpts","definition","dcqlQuery","dcql","definitionId","presentationDefinitionItems","pdmGetDefinitions","filter","version","tenantId","presentationDefinitionItem","definitionPayload","dcqlPayload","didMethods","supportedDIDMethods","getAgentDIDMethods","eventEmitter","EventEmitter","defaultClientMetadata","idTokenSigningAlgValuesSupported","SigningAlgo","EDDSA","ES256","ES256K","requestObjectSigningAlgValuesSupported","responseTypesSupported","ResponseType","ID_TOKEN","client_name","vpFormatsSupported","jwt_vc","alg","jwt_vp","scopesSupported","Scope","OPENID_DIDAUTHN","subjectTypesSupported","SubjectType","PAIRWISE","subject_syntax_types_supported","map","method","passBy","PassBy","VALUE","resolver","resolveOpts","getAgentResolver","resolverResolution","localResolution","uniresolverResolution","noUniversalResolverFallback","hasher","credentialOpts","defaultHasher","builder","RP","requestVersion","withScope","PropertyTarget","REQUEST_OBJECT","withResponseMode","responseMode","ResponseMode","POST","withResponseType","VP_TOKEN","withSupportedVersions","SIOPv2_ID1","SIOPv2_D11","withEventEmitter","withSessionManager","sessionManager","InMemoryRPSessionManager","withClientMetadata","clientMetadataOpts","withVerifyJwtCallback","verifyJwtCallback","getVerifyJwtCallback","verifyOpts","checkLinkedDomain","withRevocationVerification","RevocationVerification","NEVER","withPresentationVerification","oidfOpts","isExternalIdentifierOIDFEntityIdOpts","withEntityId","identifier","withClientIdScheme","resolution","withClientId","issuer","isManagedIdentifierDidResult","did","jwkThumbprint","clientIdScheme","withHasher","withPresentationDefinition","withDcqlQuery","responseRedirectUri","withResponseRedirectUri","createJwtCallback","signCallback","withCreateJwtCallback","jwtIssuer","jwt","isManagedIdentifierDidOpts","isManagedIdentifierX5cOpts","jwtCreateJwsCompactSignature","kmsKeyRef","noIdentifierInHeader","protectedHeader","header","_opts","_jwtVerifier","jwtVerifyJwsSignature","jws","raw","console","log","message","getSigningAlgo","type","SigningAlgo","EDDSA","ES256K","ES256","RS256","Error","v4","uuidv4","ensureManagedIdentifierResult","isManagedIdentifierDidResult","isManagedIdentifierX5cResult","RPInstance","_rp","_pexOptions","_rpOptions","rpOpts","pexOpts","get","context","builder","createRPBuilder","build","rpOptions","pexOptions","hasDefinition","definitionId","undefined","getPresentationDefinition","agent","pexStoreGetDefinition","tenantId","createAuthorizationRequestURI","createArgs","correlationId","claims","requestByReferenceURI","responseURI","responseURIType","nonce","uuidv4","state","jwtIssuer","idOpts","identifierOpts","resolution","ensureManagedIdentifierResult","isManagedIdentifierDidResult","didUrl","kid","method","alg","getSigningAlgo","key","type","isManagedIdentifierX5cResult","issuer","Promise","reject","x5c","Error","then","rp","version","getRequestVersion","createAuthorizationRequest","did","shaHasher","defaultHasher","SIOPv2RP","opts","_DEFAULT_OPTS_KEY","instances","Map","schema","IDidAuthSiopOpAuthenticator","methods","siopCreateAuthRequestURI","createAuthorizationRequestURI","bind","siopCreateAuthRequestPayloads","createAuthorizationRequestPayloads","siopGetAuthRequestState","siopGetRequestState","siopGetAuthResponseState","siopGetResponseState","siopUpdateAuthRequestState","siopUpdateRequestState","siopDeleteAuthState","siopDeleteState","siopVerifyAuthResponse","siopImportDefinitions","siopGetRedirectURI","constructor","setDefaultOpts","rpDefaultOpts","context","defaultOpts","identifierOpts","resolveOpts","resolver","resolve","getAgentResolver","uniresolverResolution","resolverResolution","localResolution","createArgs","getRPInstance","definitionId","responseRedirectURI","then","rp","URI","encodedUri","createAuthorizationRequest","request","authRequest","authorizationRequest","payload","requestObject","requestObjectJwt","requestObjectDecoded","getPayload","args","get","sessionManager","getRequestStateByCorrelationId","correlationId","errorOnNotFound","rpInstance","authorizationResponseState","getResponseStateByCorrelationId","undefined","responseState","status","AuthorizationResponseStateStatus","VERIFIED","includeVerifiedData","VerifiedDataMode","NONE","hasher","CredentialMapper","isSdJwtEncoded","response","vp_token","rpOptions","credentialOpts","defaultHasher","presentationDecoded","decodeVerifiablePresentation","VERIFIED_PRESENTATION","verifiedData","presentationOrClaimsFrom","CREDENTIAL_SUBJECT_FLATTENED","allClaims","credential","verifiableCredential","vc","schemaValidationResult","agent","cvVerifySchema","validationPolicy","verificationPolicies","schemaValidation","result","ERROR","error","Error","credentialSubject","id","Object","entries","forEach","key","value","isSdJwtDecodedCredential","decodedPayload","toUniformPresentation","state","signalAuthRequestRetrieved","deleteStateForCorrelationId","authorizationResponse","authResponse","decodeUriAsJson","verifyAuthorizationResponse","presentationDefinitions","dcqlQuery","audience","definitions","tenantId","version","versionControlMode","Promise","all","map","definitionPair","definitionPayload","pexValidateDefinition","definition","console","log","name","pdmPersistDefinition","definitionItem","dcqlPayload","instanceId","has","getResponseRedirectUri","correlation_id","instanceOpts","getInstanceOpts","rpOpts","getRPOptions","set","RPInstance","pexOpts","responseRedirectUri","options","idOpts","supportedDIDMethods","supportedVersions","instanceOpt","find","i","getDefaultOptions","defaultOptions","clonedOptions","VerifiedDataMode","schema","require"]}

package/package.json

@@ -1,39 +1,52 @@
 {
   "name": "@sphereon/ssi-sdk.siopv2-oid4vp-rp-auth",
-  "version": "0.32.1-next.54+3b988a2b",
+  "version": "0.33.1-feature.jose.vcdm.55+6f02f6f8",
   "source": "src/index.ts",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    "react-native": "./dist/index.js",
+    "import": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "require": {
+      "types": "./dist/index.d.cts",
+      "require": "./dist/index.cjs"
+    }
+  },
   "veramo": {
     "pluginInterfaces": {
       "ISIOPv2RP": "./src/types/ISIOPv2RP.ts"
     }
   },
   "scripts": {
-    "build": "tsc --build",
-    "build:clean": "tsc --build --clean && tsc --build"
+    "build": "tsup --config ../../tsup.config.ts --tsconfig ../../tsconfig.tsup.json"
   },
   "dependencies": {
-    "@sphereon/did-auth-siop": "0.16.1-next.339",
-    "@sphereon/did-auth-siop-adapter": "0.16.1-next.339",
-    "@sphereon/oid4vc-common": "0.16.1-next.339",
+    "@sphereon/did-auth-siop": "0.17.1-feature.esm.cjs.39",
+    "@sphereon/did-auth-siop-adapter": "0.17.1-feature.esm.cjs.39",
+    "@sphereon/oid4vc-common": "0.17.1-feature.esm.cjs.39",
     "@sphereon/pex": "5.0.0-unstable.28",
-    "@sphereon/ssi-sdk-ext.did-utils": "0.27.0",
-    "@sphereon/ssi-sdk-ext.identifier-resolution": "0.27.0",
-    "@sphereon/ssi-sdk-ext.jwt-service": "0.27.0",
-    "@sphereon/ssi-sdk.core": "0.32.1-next.54+3b988a2b",
-    "@sphereon/ssi-sdk.credential-validation": "0.32.1-next.54+3b988a2b",
-    "@sphereon/ssi-sdk.kv-store-temp": "0.32.1-next.54+3b988a2b",
-    "@sphereon/ssi-sdk.mdl-mdoc": "0.32.1-next.54+3b988a2b",
-    "@sphereon/ssi-sdk.pd-manager": "0.32.1-next.54+3b988a2b",
-    "@sphereon/ssi-sdk.presentation-exchange": "0.32.1-next.54+3b988a2b",
-    "@sphereon/ssi-sdk.sd-jwt": "0.32.1-next.54+3b988a2b",
-    "@sphereon/ssi-sdk.siopv2-oid4vp-common": "0.32.1-next.54+3b988a2b",
-    "@sphereon/ssi-types": "0.32.1-next.54+3b988a2b",
+    "@sphereon/ssi-sdk-ext.did-utils": "0.28.1-feature.esm.cjs.18",
+    "@sphereon/ssi-sdk-ext.identifier-resolution": "0.28.1-feature.esm.cjs.18",
+    "@sphereon/ssi-sdk-ext.jwt-service": "0.28.1-feature.esm.cjs.18",
+    "@sphereon/ssi-sdk.core": "0.33.1-feature.jose.vcdm.55+6f02f6f8",
+    "@sphereon/ssi-sdk.credential-validation": "0.33.1-feature.jose.vcdm.55+6f02f6f8",
+    "@sphereon/ssi-sdk.kv-store-temp": "0.33.1-feature.jose.vcdm.55+6f02f6f8",
+    "@sphereon/ssi-sdk.mdl-mdoc": "0.33.1-feature.jose.vcdm.55+6f02f6f8",
+    "@sphereon/ssi-sdk.pd-manager": "0.33.1-feature.jose.vcdm.55+6f02f6f8",
+    "@sphereon/ssi-sdk.presentation-exchange": "0.33.1-feature.jose.vcdm.55+6f02f6f8",
+    "@sphereon/ssi-sdk.sd-jwt": "0.33.1-feature.jose.vcdm.55+6f02f6f8",
+    "@sphereon/ssi-sdk.siopv2-oid4vp-common": "0.33.1-feature.jose.vcdm.55+6f02f6f8",
+    "@sphereon/ssi-types": "0.33.1-feature.jose.vcdm.55+6f02f6f8",
     "@sphereon/wellknown-dids-client": "^0.1.3",
     "@veramo/core": "4.2.0",
     "@veramo/credential-w3c": "4.2.0",
     "cross-fetch": "^3.1.8",
+    "dcql": "0.2.19",
     "uuid": "^9.0.1"
   },
   "devDependencies": {
@@ -46,9 +59,8 @@
     "nock": "^13.5.4"
   },
   "files": [
-    ".yalc/**/*",
-    "dist/**/*",
-    "src/**/*",
+    "dist",
+    "src",
     "README.md",
     "plugin.schema.json",
     "LICENSE"
@@ -72,6 +84,5 @@
     "OpenID Connect",
     "Authenticator"
   ],
-  "nx": {},
-  "gitHead": "3b988a2bb62a7c4534a2670ea3a0985fd93d00f2"
+  "gitHead": "6f02f6f83679198268c6e1ea956be24cc1017234"
 }

package/src/agent/SIOPv2RP.ts

@@ -7,8 +7,20 @@ import {
   VerifiedAuthorizationResponse,
 } from '@sphereon/did-auth-siop'
 import { getAgentResolver } from '@sphereon/ssi-sdk-ext.did-utils'
-import { AdditionalClaims, CredentialMapper, Hasher, ICredentialSubject, IVerifiableCredential } from '@sphereon/ssi-types'
-import { OriginalVerifiablePresentation } from '@sphereon/ssi-types'
+import {
+  AdditionalClaims,
+  CredentialMapper,
+  HasherSync,
+  ICredentialSubject,
+  IPresentation,
+  IVerifiableCredential,
+  IVerifiablePresentation,
+  JwtDecodedVerifiablePresentation,
+  MdocDeviceResponse,
+  MdocOid4vpMdocVpToken,
+  OriginalVerifiablePresentation,
+  SdJwtDecodedVerifiableCredential,
+} from '@sphereon/ssi-types'
 import { IAgentPlugin } from '@veramo/core'
 import {
   AuthorizationResponseStateWithVerifiedData,
@@ -33,6 +45,7 @@ import { RPInstance } from '../RPInstance'
 
 import { ISIOPv2RP } from '../types/ISIOPv2RP'
 import { shaHasher as defaultHasher } from '@sphereon/ssi-sdk.core'
+import { DcqlQuery } from 'dcql'
 
 export class SIOPv2RP implements IAgentPlugin {
   private readonly opts: ISiopv2RPOpts
@@ -117,7 +130,7 @@ export class SIOPv2RP implements IAgentPlugin {
       args.includeVerifiedData &&
       args.includeVerifiedData !== VerifiedDataMode.NONE
     ) {
-      let hasher: Hasher | undefined
+      let hasher: HasherSync | undefined
       if (
         CredentialMapper.isSdJwtEncoded(responseState.response.payload.vp_token as OriginalVerifiablePresentation) &&
         (!rpInstance.rpOptions.credentialOpts?.hasher || typeof rpInstance.rpOptions.credentialOpts?.hasher !== 'function')
@@ -130,14 +143,13 @@ export class SIOPv2RP implements IAgentPlugin {
         //todo: later we want to conditionally pass in options for mdl-mdoc here
         hasher,
       )
-      const presentation = CredentialMapper.toUniformPresentation(presentationDecoded as OriginalVerifiablePresentation)
       switch (args.includeVerifiedData) {
         case VerifiedDataMode.VERIFIED_PRESENTATION:
-          responseState.response.payload.verifiedData = presentation
+          responseState.response.payload.verifiedData = this.presentationOrClaimsFrom(presentationDecoded)
           break
-        case VerifiedDataMode.CREDENTIAL_SUBJECT_FLATTENED:
+        case VerifiedDataMode.CREDENTIAL_SUBJECT_FLATTENED: // TODO debug cs-flat for SD-JWT
           const allClaims: AdditionalClaims = {}
-          for (const credential of presentation.verifiableCredential || []) {
+          for (const credential of this.presentationOrClaimsFrom(presentationDecoded).verifiableCredential || []) {
             const vc = credential as IVerifiableCredential
             const schemaValidationResult = await context.agent.cvVerifySchema({
               credential,
@@ -168,6 +180,18 @@ export class SIOPv2RP implements IAgentPlugin {
     return responseState
   }
 
+  private presentationOrClaimsFrom = (
+    presentationDecoded:
+      | JwtDecodedVerifiablePresentation
+      | IVerifiablePresentation
+      | SdJwtDecodedVerifiableCredential
+      | MdocOid4vpMdocVpToken
+      | MdocDeviceResponse,
+  ): AdditionalClaims | IPresentation =>
+    CredentialMapper.isSdJwtDecodedCredential(presentationDecoded)
+      ? presentationDecoded.decodedPayload
+      : CredentialMapper.toUniformPresentation(presentationDecoded as OriginalVerifiablePresentation)
+
   private async siopUpdateRequestState(args: IUpdateRequestStateArgs, context: IRequiredContext): Promise<AuthorizationRequestState> {
     if (args.state !== 'sent') {
       throw Error(`Only 'sent' status is supported for this method at this point`)
@@ -203,7 +227,8 @@ export class SIOPv2RP implements IAgentPlugin {
       rp.get(context).then((rp) =>
         rp.verifyAuthorizationResponse(authResponse, {
           correlationId: args.correlationId,
-          presentationDefinitions: args.presentationDefinitions,
+          ...(args.presentationDefinitions && !args.dcqlQuery ? { presentationDefinitions: args.presentationDefinitions } : {}),
+          ...(args.dcqlQuery ? { dcqlQuery: args.dcqlQuery as DcqlQuery } : {}), // TODO BEFORE PR, check compatibility and whether we can remove local type
           audience: args.audience,
         }),
       ),
@@ -213,15 +238,17 @@ export class SIOPv2RP implements IAgentPlugin {
   private async siopImportDefinitions(args: ImportDefinitionsArgs, context: IRequiredContext): Promise<void> {
     const { definitions, tenantId, version, versionControlMode } = args
     await Promise.all(
-      definitions.map(async (definition) => {
-        await context.agent.pexValidateDefinition({ definition: definition })
+      definitions.map(async (definitionPair) => {
+        const definitionPayload = definitionPair.definitionPayload
+        await context.agent.pexValidateDefinition({ definition: definitionPayload })
 
-        console.log(`persisting definition ${definition.id} / ${definition.name} with versionControlMode ${versionControlMode}`)
+        console.log(`persisting definition ${definitionPayload.id} / ${definitionPayload.name} with versionControlMode ${versionControlMode}`)
         return context.agent.pdmPersistDefinition({
           definitionItem: {
             tenantId: tenantId,
             version: version,
-            definitionPayload: definition,
+            definitionPayload,
+            dcqlPayload: definitionPair.dcqlPayload,
           },
           opts: { versionControlMode: versionControlMode },
         })

package/src/functions.ts

@@ -16,10 +16,11 @@ import {
   SupportedVersion,
   VerifyJwtCallback,
 } from '@sphereon/did-auth-siop'
-import { CreateJwtCallback, JwtHeader, JwtIssuer, JwtPayload } from '@sphereon/oid4vc-common'
+import { CreateJwtCallback, JwtHeader, JwtIssuer, JwtPayload, SigningAlgo } from '@sphereon/oid4vc-common'
 import { IPresentationDefinition } from '@sphereon/pex'
 import { getAgentDIDMethods, getAgentResolver } from '@sphereon/ssi-sdk-ext.did-utils'
 import {
+  isExternalIdentifierOIDFEntityIdOpts,
   isManagedIdentifierDidOpts,
   isManagedIdentifierDidResult,
   isManagedIdentifierX5cOpts,
@@ -27,17 +28,16 @@ import {
 } from '@sphereon/ssi-sdk-ext.identifier-resolution'
 import { JwtCompactResult } from '@sphereon/ssi-sdk-ext.jwt-service'
 import { IVerifySdJwtPresentationResult } from '@sphereon/ssi-sdk.sd-jwt'
-import { SigningAlgo } from '@sphereon/oid4vc-common'
 import { CredentialMapper, Hasher, OriginalVerifiableCredential, PresentationSubmission } from '@sphereon/ssi-types'
 import { IVerifyCallbackArgs, IVerifyCredentialResult, VerifyCallback } from '@sphereon/wellknown-dids-client'
 // import { KeyAlgo, SuppliedSigner } from '@sphereon/ssi-sdk.core'
 import { TKeyType } from '@veramo/core'
-import { createHash } from 'crypto'
 import { JWTVerifyOptions } from 'did-jwt'
 import { Resolvable } from 'did-resolver'
 import { EventEmitter } from 'events'
 import { IPEXOptions, IRequiredContext, IRPOptions, ISIOPIdentifierOptions } from './types/ISIOPv2RP'
-import { isExternalIdentifierOIDFEntityIdOpts } from '@sphereon/ssi-sdk-ext.identifier-resolution'
+import { DcqlQuery } from 'dcql'
+import { defaultHasher } from '@sphereon/ssi-sdk.core'
 
 export function getRequestVersion(rpOptions: IRPOptions): SupportedVersion {
   if (Array.isArray(rpOptions.supportedVersions) && rpOptions.supportedVersions.length > 0) {
@@ -80,14 +80,14 @@ export function getPresentationVerificationCallback(
       if (context.agent.mdocOid4vpRPVerify === undefined) {
         return Promise.reject('ImDLMdoc agent plugin must be enabled to support MsoMdoc types')
       }
-      if (!presentationSubmission) {
-        return Promise.reject('No presentationSubmission present')
+      if (presentationSubmission !== undefined && presentationSubmission !== null) {
+        const verifyResult = await context.agent.mdocOid4vpRPVerify({
+          vp_token: args,
+          presentation_submission: presentationSubmission,
+        })
+        return { verified: !verifyResult.error }
       }
-      const verifyResult = await context.agent.mdocOid4vpRPVerify({
-        vp_token: args,
-        presentation_submission: presentationSubmission,
-      })
-      return { verified: !verifyResult.error }
+      throw Error(`mdocOid4vpRPVerify(...) method requires a presentation submission`)
     }
 
     const result = await context.agent.verifyPresentation({
@@ -105,11 +105,13 @@ export async function createRPBuilder(args: {
   rpOpts: IRPOptions
   pexOpts?: IPEXOptions | undefined
   definition?: IPresentationDefinition
+  dcql?: DcqlQuery
   context: IRequiredContext
 }): Promise<RPBuilder> {
   const { rpOpts, pexOpts, context } = args
   const { identifierOpts } = rpOpts
   let definition: IPresentationDefinition | undefined = args.definition
+  let dcqlQuery: DcqlQuery | undefined = args.dcql
 
   if (!definition && pexOpts && pexOpts.definitionId) {
     const presentationDefinitionItems = await context.agent.pdmGetDefinitions({
@@ -122,7 +124,13 @@ export async function createRPBuilder(args: {
       ],
     })
 
-    definition = presentationDefinitionItems.length > 0 ? presentationDefinitionItems[0].definitionPayload : undefined
+    if (presentationDefinitionItems.length > 0) {
+      const presentationDefinitionItem = presentationDefinitionItems[0]
+      definition = presentationDefinitionItem.definitionPayload
+      if (!dcqlQuery && presentationDefinitionItem.dcqlPayload) {
+        dcqlQuery = presentationDefinitionItem.dcqlPayload as DcqlQuery // cast from DcqlQueryREST back to valibot DcqlQuery
+      }
+    }
   }
 
   const didMethods = identifierOpts.supportedDIDMethods ?? (await getAgentDIDMethods(context))
@@ -155,7 +163,7 @@ export async function createRPBuilder(args: {
   //todo: probably wise to first look and see if we actually need the hasher to begin with
   let hasher: Hasher | undefined = rpOpts.credentialOpts?.hasher
   if (!rpOpts.credentialOpts?.hasher || typeof rpOpts.credentialOpts?.hasher !== 'function') {
-    hasher = (data, algorithm) => createHash(algorithm).update(data).digest()
+    hasher = defaultHasher
   }
 
   const builder = RP.builder({ requestVersion: getRequestVersion(rpOpts) })
@@ -217,6 +225,9 @@ export async function createRPBuilder(args: {
   if (definition) {
     builder.withPresentationDefinition({ definition }, PropertyTarget.REQUEST_OBJECT)
   }
+  if (dcqlQuery) {
+    builder.withDcqlQuery(dcqlQuery)
+  }
 
   if (rpOpts.responseRedirectUri) {
     builder.withResponseRedirectUri(rpOpts.responseRedirectUri)

package/src/types/ISIOPv2RP.ts

@@ -1,13 +1,10 @@
-import { ClientMetadataOpts, VerifyJwtCallback } from '@sphereon/did-auth-siop'
-import { IIdentifierResolution, ManagedIdentifierOptsOrResult } from '@sphereon/ssi-sdk-ext.identifier-resolution'
-import { IAgentContext, ICredentialIssuer, ICredentialVerifier, IDIDManager, IKeyManager, IPluginMethodMap, IResolver } from '@veramo/core'
-import { AdditionalClaims, Hasher, W3CVerifiablePresentation } from '@sphereon/ssi-types'
 import {
   AuthorizationRequestPayload,
   AuthorizationRequestState,
   AuthorizationResponsePayload,
   AuthorizationResponseState,
   ClaimPayloadCommonOpts,
+  ClientMetadataOpts,
   IRPSessionManager,
   PresentationDefinitionWithLocation,
   PresentationVerificationCallback,
@@ -17,10 +14,12 @@ import {
   SupportedVersion,
   VerifiablePresentationTypeFormat,
   VerifiedAuthorizationResponse,
+  VerifyJwtCallback,
   VPTokenLocation,
 } from '@sphereon/did-auth-siop'
-
-import { ExternalIdentifierOIDFEntityIdOpts } from '@sphereon/ssi-sdk-ext.identifier-resolution'
+import { ExternalIdentifierOIDFEntityIdOpts, IIdentifierResolution, ManagedIdentifierOptsOrResult } from '@sphereon/ssi-sdk-ext.identifier-resolution'
+import { IAgentContext, ICredentialIssuer, ICredentialVerifier, IDIDManager, IKeyManager, IPluginMethodMap, IResolver } from '@veramo/core'
+import { AdditionalClaims, DcqlQueryREST, HasherSync, W3CVerifiablePresentation } from '@sphereon/ssi-types'
 
 import { Resolvable } from 'did-resolver'
 import { DIDDocument } from '@sphereon/did-uni-client'
@@ -112,10 +111,16 @@ export interface IVerifyAuthResponseStateArgs {
   correlationId: string
   audience?: string
   presentationDefinitions?: PresentationDefinitionWithLocation | PresentationDefinitionWithLocation[]
+  dcqlQuery?: DcqlQueryREST
+}
+
+export interface IDefinitionPair {
+  definitionPayload: IPresentationDefinition
+  dcqlPayload?: DcqlQueryREST
 }
 
 export interface ImportDefinitionsArgs {
-  definitions: Array<IPresentationDefinition>
+  definitions: Array<IDefinitionPair>
   tenantId?: string
   version?: string
   versionControlMode?: VersionControlMode
@@ -202,7 +207,7 @@ export interface ISIOPIdentifierOptions extends Omit<IDIDOptions, 'idOpts'> {
 
 // todo make the necessary changes for mdl-mdoc types
 export type CredentialOpts = {
-  hasher?: Hasher
+  hasher?: HasherSync
 }
 
 export interface AuthorizationResponseStateWithVerifiedData extends AuthorizationResponseState {

package/dist/RPInstance.d.ts

@@ -1,21 +0,0 @@
-import { AuthorizationRequest, RP, URI } from '@sphereon/did-auth-siop';
-import { ICreateAuthRequestArgs, IPEXOptions, IRequiredContext, IRPOptions } from './types/ISIOPv2RP';
-import { IPresentationDefinition } from '@sphereon/pex';
-export declare class RPInstance {
-    private _rp;
-    private readonly _pexOptions;
-    private readonly _rpOptions;
-    constructor({ rpOpts, pexOpts }: {
-        rpOpts: IRPOptions;
-        pexOpts?: IPEXOptions;
-    });
-    get(context: IRequiredContext): Promise<RP>;
-    get rpOptions(): IRPOptions;
-    get pexOptions(): IPEXOptions | undefined;
-    hasDefinition(): boolean;
-    get definitionId(): string | undefined;
-    getPresentationDefinition(context: IRequiredContext): Promise<IPresentationDefinition | undefined>;
-    createAuthorizationRequestURI(createArgs: Omit<ICreateAuthRequestArgs, 'definitionId'>, context: IRequiredContext): Promise<URI>;
-    createAuthorizationRequest(createArgs: Omit<ICreateAuthRequestArgs, 'definitionId'>, context: IRequiredContext): Promise<AuthorizationRequest>;
-}
-//# sourceMappingURL=RPInstance.d.ts.map

package/dist/RPInstance.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"RPInstance.d.ts","sourceRoot":"","sources":["../src/RPInstance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAA;AACvE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACrG,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AAUvD,qBAAa,UAAU;IACrB,OAAO,CAAC,GAAG,CAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAyB;IACrD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAY;gBAEpB,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;QAAE,MAAM,EAAE,UAAU,CAAC;QAAC,OAAO,CAAC,EAAE,WAAW,CAAA;KAAE;IAKxE,GAAG,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,EAAE,CAAC;IAYxD,IAAI,SAAS,eAEZ;IAED,IAAI,UAAU,4BAEb;IAEM,aAAa,IAAI,OAAO;IAI/B,IAAI,YAAY,IAAI,MAAM,GAAG,SAAS,CAErC;IAEY,yBAAyB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC;IASlG,6BAA6B,CAAC,UAAU,EAAE,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC;IAsChI,0BAA0B,CACrC,UAAU,EAAE,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,EACxD,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,oBAAoB,CAAC;CAuCjC"}