@sphereon/ssi-sdk.siopv2-oid4vp-rp-auth 0.34.1-feature.FIDES.1.274 → 0.34.1-feature.IDK.11.48

package/dist/index.js

@@ -1,359 +1,363 @@
 var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __commonJS = (cb, mod) => function __require() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
 
 // plugin.schema.json
-var plugin_schema_default = {
-  IDidAuthSiopOpAuthenticator: {
-    components: {
-      schemas: {
-        IGetSiopSessionArgs: {
-          type: "object",
-          properties: {
-            sessionId: {
-              type: "string"
+var require_plugin_schema = __commonJS({
+  "plugin.schema.json"(exports, module) {
+    module.exports = {
+      IDidAuthSiopOpAuthenticator: {
+        components: {
+          schemas: {
+            IGetSiopSessionArgs: {
+              type: "object",
+              properties: {
+                sessionId: {
+                  type: "string"
+                },
+                additionalProperties: false
+              },
+              required: ["sessionId"],
+              description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.getSessionForSiop } "
             },
-            additionalProperties: false
-          },
-          required: ["sessionId"],
-          description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.getSessionForSiop } "
-        },
-        IRegisterSiopSessionArgs: {
-          type: "object",
-          properties: {
-            identifier: {
+            IRegisterSiopSessionArgs: {
               type: "object",
               properties: {
-                did: {
+                identifier: {
+                  type: "object",
+                  properties: {
+                    did: {
+                      type: "string"
+                    },
+                    alias: {
+                      type: "string"
+                    },
+                    provider: {
+                      type: "string"
+                    },
+                    controllerKeyId: {
+                      type: "string"
+                    },
+                    keys: {
+                      type: "array",
+                      items: {
+                        type: "object",
+                        properties: {
+                          additionalProperties: true
+                        }
+                      }
+                    },
+                    services: {
+                      type: "array",
+                      items: {
+                        type: "object",
+                        properties: {
+                          additionalProperties: true
+                        }
+                      }
+                    }
+                  },
+                  additionalProperties: false,
+                  required: ["did", "provider", "keys", "services"]
+                },
+                sessionId: {
                   type: "string"
                 },
-                alias: {
+                expiresIn: {
+                  type: "number"
+                },
+                additionalProperties: false
+              },
+              required: ["identifier"],
+              description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.registerSessionForSiop } "
+            },
+            IRemoveSiopSessionArgs: {
+              type: "object",
+              properties: {
+                sessionId: {
                   type: "string"
                 },
-                provider: {
+                additionalProperties: false
+              },
+              required: ["sessionId"],
+              description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.removeSessionForSiop } "
+            },
+            IAuthenticateWithSiopArgs: {
+              type: "object",
+              properties: {
+                sessionId: {
                   type: "string"
                 },
-                controllerKeyId: {
+                stateId: {
                   type: "string"
                 },
-                keys: {
-                  type: "array",
-                  items: {
-                    type: "object",
-                    properties: {
-                      additionalProperties: true
-                    }
-                  }
+                redirectUrl: {
+                  type: "string"
                 },
-                services: {
-                  type: "array",
-                  items: {
-                    type: "object",
-                    properties: {
-                      additionalProperties: true
-                    }
-                  }
-                }
+                additionalProperties: false
               },
-              additionalProperties: false,
-              required: ["did", "provider", "keys", "services"]
-            },
-            sessionId: {
-              type: "string"
+              required: ["sessionId", "stateId", "redirectUrl"],
+              description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.authenticateWithSiop } "
             },
-            expiresIn: {
-              type: "number"
-            },
-            additionalProperties: false
-          },
-          required: ["identifier"],
-          description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.registerSessionForSiop } "
-        },
-        IRemoveSiopSessionArgs: {
-          type: "object",
-          properties: {
-            sessionId: {
-              type: "string"
-            },
-            additionalProperties: false
-          },
-          required: ["sessionId"],
-          description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.removeSessionForSiop } "
-        },
-        IAuthenticateWithSiopArgs: {
-          type: "object",
-          properties: {
-            sessionId: {
-              type: "string"
-            },
-            stateId: {
-              type: "string"
-            },
-            redirectUrl: {
-              type: "string"
-            },
-            additionalProperties: false
-          },
-          required: ["sessionId", "stateId", "redirectUrl"],
-          description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.authenticateWithSiop } "
-        },
-        IResponse: {
-          type: "object",
-          properties: {
-            status: {
-              type: "number"
-            },
-            additionalProperties: true
-          },
-          required: ["status"],
-          description: "Result of {@link DidAuthSiopOpAuthenticator.authenticateWithSiop & DidAuthSiopOpAuthenticator.sendSiopAuthenticationResponse } "
-        },
-        IGetSiopAuthenticationRequestFromRpArgs: {
-          type: "object",
-          properties: {
-            sessionId: {
-              type: "string"
-            },
-            stateId: {
-              type: "string"
-            },
-            redirectUrl: {
-              type: "string"
-            },
-            additionalProperties: false
-          },
-          required: ["sessionId", "stateId", "redirectUrl"],
-          description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.getSiopAuthenticationRequestFromRP } "
-        },
-        ParsedAuthenticationRequestURI: {
-          type: "object",
-          properties: {
-            jwt: {
-              type: "string"
-            },
-            requestPayload: {
+            IResponse: {
               type: "object",
               properties: {
+                status: {
+                  type: "number"
+                },
                 additionalProperties: true
-              }
+              },
+              required: ["status"],
+              description: "Result of {@link DidAuthSiopOpAuthenticator.authenticateWithSiop & DidAuthSiopOpAuthenticator.sendSiopAuthenticationResponse } "
             },
-            registration: {
+            IGetSiopAuthenticationRequestFromRpArgs: {
               type: "object",
               properties: {
-                additionalProperties: true
-              }
-            },
-            additionalProperties: false
-          },
-          required: ["jwt", "requestPayload", "registration"],
-          description: "Result of {@link DidAuthSiopOpAuthenticator.getSiopAuthenticationRequestFromRP } "
-        },
-        IGetSiopAuthenticationRequestDetailsArgs: {
-          type: "object",
-          properties: {
-            sessionId: {
-              type: "string"
+                sessionId: {
+                  type: "string"
+                },
+                stateId: {
+                  type: "string"
+                },
+                redirectUrl: {
+                  type: "string"
+                },
+                additionalProperties: false
+              },
+              required: ["sessionId", "stateId", "redirectUrl"],
+              description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.getSiopAuthenticationRequestFromRP } "
             },
-            verifiedAuthenticationRequest: {
+            ParsedAuthenticationRequestURI: {
               type: "object",
               properties: {
-                additionalProperties: true
-              }
+                jwt: {
+                  type: "string"
+                },
+                requestPayload: {
+                  type: "object",
+                  properties: {
+                    additionalProperties: true
+                  }
+                },
+                registration: {
+                  type: "object",
+                  properties: {
+                    additionalProperties: true
+                  }
+                },
+                additionalProperties: false
+              },
+              required: ["jwt", "requestPayload", "registration"],
+              description: "Result of {@link DidAuthSiopOpAuthenticator.getSiopAuthenticationRequestFromRP } "
             },
-            credentialFilter: {
+            IGetSiopAuthenticationRequestDetailsArgs: {
               type: "object",
               properties: {
-                additionalProperties: true
-              }
-            },
-            additionalProperties: false
-          },
-          required: ["sessionId", "verifiedAuthenticationRequest"],
-          description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.getSiopAuthenticationRequestDetails } "
-        },
-        IAuthRequestDetails: {
-          type: "object",
-          properties: {
-            id: {
-              type: "string"
-            },
-            alsoKnownAs: {
-              type: "array",
-              items: {
-                type: "string"
-              }
+                sessionId: {
+                  type: "string"
+                },
+                verifiedAuthenticationRequest: {
+                  type: "object",
+                  properties: {
+                    additionalProperties: true
+                  }
+                },
+                credentialFilter: {
+                  type: "object",
+                  properties: {
+                    additionalProperties: true
+                  }
+                },
+                additionalProperties: false
+              },
+              required: ["sessionId", "verifiedAuthenticationRequest"],
+              description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.getSiopAuthenticationRequestDetails } "
             },
-            vpResponseOpts: {
+            IAuthRequestDetails: {
               type: "object",
               properties: {
-                additionalProperties: true
-              }
-            },
-            additionalProperties: false
-          },
-          required: ["id", "vpResponseOpts"],
-          description: "Result of {@link DidAuthSiopOpAuthenticator.getSiopAuthenticationRequestDetails } "
-        },
-        IVerifySiopAuthenticationRequestUriArgs: {
-          type: "object",
-          properties: {
-            sessionId: {
-              type: "string"
+                id: {
+                  type: "string"
+                },
+                alsoKnownAs: {
+                  type: "array",
+                  items: {
+                    type: "string"
+                  }
+                },
+                vpResponseOpts: {
+                  type: "object",
+                  properties: {
+                    additionalProperties: true
+                  }
+                },
+                additionalProperties: false
+              },
+              required: ["id", "vpResponseOpts"],
+              description: "Result of {@link DidAuthSiopOpAuthenticator.getSiopAuthenticationRequestDetails } "
             },
-            ParsedAuthenticationRequestURI: {
+            IVerifySiopAuthenticationRequestUriArgs: {
               type: "object",
               properties: {
-                additionalProperties: true
-              }
+                sessionId: {
+                  type: "string"
+                },
+                ParsedAuthenticationRequestURI: {
+                  type: "object",
+                  properties: {
+                    additionalProperties: true
+                  }
+                },
+                additionalProperties: false
+              },
+              required: ["sessionId", "ParsedAuthenticationRequestURI"],
+              description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.verifySiopAuthenticationRequestURI } "
             },
-            additionalProperties: false
-          },
-          required: ["sessionId", "ParsedAuthenticationRequestURI"],
-          description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.verifySiopAuthenticationRequestURI } "
-        },
-        VerifiedAuthorizationRequest: {
-          type: "object",
-          properties: {
-            payload: {
+            VerifiedAuthorizationRequest: {
               type: "object",
               properties: {
-                additionalProperties: true
-              }
+                payload: {
+                  type: "object",
+                  properties: {
+                    additionalProperties: true
+                  }
+                },
+                presentationDefinitions: {
+                  type: "object",
+                  properties: {
+                    additionalProperties: true
+                  }
+                },
+                verifyOpts: {
+                  type: "object",
+                  properties: {
+                    additionalProperties: true
+                  }
+                },
+                additionalProperties: false
+              },
+              required: ["payload", "verifyOpts"],
+              description: "Result of {@link DidAuthSiopOpAuthenticator.verifySiopAuthenticationRequestURI } "
             },
-            presentationDefinitions: {
+            ISendSiopAuthenticationResponseArgs: {
               type: "object",
               properties: {
-                additionalProperties: true
-              }
+                sessionId: {
+                  type: "string"
+                },
+                verifiedAuthenticationRequest: {
+                  type: "object",
+                  properties: {
+                    additionalProperties: true
+                  }
+                },
+                verifiablePresentationResponse: {
+                  type: "object",
+                  properties: {
+                    additionalProperties: true
+                  }
+                },
+                additionalProperties: false
+              },
+              required: ["sessionId", "verifiedAuthenticationRequest"],
+              description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.sendSiopAuthenticationResponse } "
+            }
+          },
+          methods: {
+            getSessionForSiop: {
+              description: "Get SIOP session",
+              arguments: {
+                $ref: "#/components/schemas/IGetSiopSessionArgs"
+              },
+              returnType: "object"
             },
-            verifyOpts: {
-              type: "object",
-              properties: {
-                additionalProperties: true
+            registerSessionForSiop: {
+              description: "Register SIOP session",
+              arguments: {
+                $ref: "#/components/schemas/IRegisterSiopSessionArgs"
+              },
+              returnType: "object"
+            },
+            removeSessionForSiop: {
+              description: "Remove SIOP session",
+              arguments: {
+                $ref: "#/components/schemas/IRemoveSiopSessionArgs"
+              },
+              returnType: "boolean"
+            },
+            authenticateWithSiop: {
+              description: "Authenticate using DID Auth SIOP",
+              arguments: {
+                $ref: "#/components/schemas/IAuthenticateWithSiopArgs"
+              },
+              returnType: {
+                $ref: "#/components/schemas/Response"
               }
             },
-            additionalProperties: false
-          },
-          required: ["payload", "verifyOpts"],
-          description: "Result of {@link DidAuthSiopOpAuthenticator.verifySiopAuthenticationRequestURI } "
-        },
-        ISendSiopAuthenticationResponseArgs: {
-          type: "object",
-          properties: {
-            sessionId: {
-              type: "string"
+            getSiopAuthenticationRequestFromRP: {
+              description: "Get authentication request from RP",
+              arguments: {
+                $ref: "#/components/schemas/IGetSiopAuthenticationRequestFromRpArgs"
+              },
+              returnType: {
+                $ref: "#/components/schemas/ParsedAuthenticationRequestURI"
+              }
             },
-            verifiedAuthenticationRequest: {
-              type: "object",
-              properties: {
-                additionalProperties: true
+            getSiopAuthenticationRequestDetails: {
+              description: "Get authentication request details",
+              arguments: {
+                $ref: "#/components/schemas/IGetSiopAuthenticationRequestDetailsArgs"
+              },
+              returnType: {
+                $ref: "#/components/schemas/IAuthRequestDetails"
               }
             },
-            verifiablePresentationResponse: {
-              type: "object",
-              properties: {
-                additionalProperties: true
+            verifySiopAuthenticationRequestURI: {
+              description: "Verify authentication request URI",
+              arguments: {
+                $ref: "#/components/schemas/IVerifySiopAuthenticationRequestUriArgs"
+              },
+              returnType: {
+                $ref: "#/components/schemas/VerifiedAuthorizationRequest"
               }
             },
-            additionalProperties: false
-          },
-          required: ["sessionId", "verifiedAuthenticationRequest"],
-          description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.sendSiopAuthenticationResponse } "
-        }
-      },
-      methods: {
-        getSessionForSiop: {
-          description: "Get SIOP session",
-          arguments: {
-            $ref: "#/components/schemas/IGetSiopSessionArgs"
-          },
-          returnType: "object"
-        },
-        registerSessionForSiop: {
-          description: "Register SIOP session",
-          arguments: {
-            $ref: "#/components/schemas/IRegisterSiopSessionArgs"
-          },
-          returnType: "object"
-        },
-        removeSessionForSiop: {
-          description: "Remove SIOP session",
-          arguments: {
-            $ref: "#/components/schemas/IRemoveSiopSessionArgs"
-          },
-          returnType: "boolean"
-        },
-        authenticateWithSiop: {
-          description: "Authenticate using DID Auth SIOP",
-          arguments: {
-            $ref: "#/components/schemas/IAuthenticateWithSiopArgs"
-          },
-          returnType: {
-            $ref: "#/components/schemas/Response"
-          }
-        },
-        getSiopAuthenticationRequestFromRP: {
-          description: "Get authentication request from RP",
-          arguments: {
-            $ref: "#/components/schemas/IGetSiopAuthenticationRequestFromRpArgs"
-          },
-          returnType: {
-            $ref: "#/components/schemas/ParsedAuthenticationRequestURI"
-          }
-        },
-        getSiopAuthenticationRequestDetails: {
-          description: "Get authentication request details",
-          arguments: {
-            $ref: "#/components/schemas/IGetSiopAuthenticationRequestDetailsArgs"
-          },
-          returnType: {
-            $ref: "#/components/schemas/IAuthRequestDetails"
-          }
-        },
-        verifySiopAuthenticationRequestURI: {
-          description: "Verify authentication request URI",
-          arguments: {
-            $ref: "#/components/schemas/IVerifySiopAuthenticationRequestUriArgs"
-          },
-          returnType: {
-            $ref: "#/components/schemas/VerifiedAuthorizationRequest"
-          }
-        },
-        sendSiopAuthenticationResponse: {
-          description: "Send authentication response",
-          arguments: {
-            $ref: "#/components/schemas/ISendSiopAuthenticationResponseArgs"
-          },
-          returnType: {
-            $ref: "#/components/schemas/IRequiredContext"
+            sendSiopAuthenticationResponse: {
+              description: "Send authentication response",
+              arguments: {
+                $ref: "#/components/schemas/ISendSiopAuthenticationResponseArgs"
+              },
+              returnType: {
+                $ref: "#/components/schemas/IRequiredContext"
+              }
+            }
           }
         }
       }
-    }
+    };
   }
-};
+});
 
 // src/agent/SIOPv2RP.ts
 import { AuthorizationResponseStateStatus, decodeUriAsJson } from "@sphereon/did-auth-siop";
 import { getAgentResolver as getAgentResolver2 } from "@sphereon/ssi-sdk-ext.did-utils";
-import { shaHasher as defaultHasher2 } from "@sphereon/ssi-sdk.core";
-import { validate as isValidUUID2 } from "uuid";
 import { CredentialMapper as CredentialMapper2 } from "@sphereon/ssi-types";
-import { DcqlQuery } from "dcql";
 
 // src/functions.ts
-import { ClientIdentifierPrefix, InMemoryRPSessionManager, PassBy, PropertyTarget, ResponseMode, ResponseType, RevocationVerification, RP, Scope, SubjectType, SupportedVersion } from "@sphereon/did-auth-siop";
+import { InMemoryRPSessionManager, PassBy, PropertyTarget, ResponseMode, ResponseType, RevocationVerification, RP, Scope, SubjectType, SupportedVersion } from "@sphereon/did-auth-siop";
 import { SigningAlgo } from "@sphereon/oid4vc-common";
 import { getAgentDIDMethods, getAgentResolver } from "@sphereon/ssi-sdk-ext.did-utils";
 import { isExternalIdentifierOIDFEntityIdOpts, isManagedIdentifierDidOpts, isManagedIdentifierDidResult, isManagedIdentifierX5cOpts } from "@sphereon/ssi-sdk-ext.identifier-resolution";
 import { CredentialMapper } from "@sphereon/ssi-types";
 import { EventEmitter } from "events";
-import { validate as isValidUUID } from "uuid";
 import { defaultHasher } from "@sphereon/ssi-sdk.core";
 function getRequestVersion(rpOptions) {
   if (Array.isArray(rpOptions.supportedVersions) && rpOptions.supportedVersions.length > 0) {
     return rpOptions.supportedVersions[0];
   }
-  return SupportedVersion.OID4VP_v1;
+  return SupportedVersion.JWT_VC_PRESENTATION_PROFILE_v1;
 }
 __name(getRequestVersion, "getRequestVersion");
 function getWellKnownDIDVerifyCallback(siopIdentifierOpts, context) {
@@ -368,40 +372,12 @@ function getWellKnownDIDVerifyCallback(siopIdentifierOpts, context) {
   };
 }
 __name(getWellKnownDIDVerifyCallback, "getWellKnownDIDVerifyCallback");
-function getDcqlQueryLookupCallback(context) {
-  async function dcqlQueryLookup(queryId, version, tenantId) {
-    const result = await context.agent.pdmGetDefinitions({
-      filter: [
-        {
-          queryId,
-          ...tenantId && {
-            tenantId
-          },
-          ...version && {
-            version
-          }
-        },
-        ...isValidUUID(queryId) ? [
-          {
-            id: queryId
-          }
-        ] : []
-      ]
-    });
-    if (result && result.length > 0) {
-      return result[0].query;
-    }
-    return Promise.reject(Error(`No dcql query found for queryId ${queryId}`));
-  }
-  __name(dcqlQueryLookup, "dcqlQueryLookup");
-  return dcqlQueryLookup;
-}
-__name(getDcqlQueryLookupCallback, "getDcqlQueryLookupCallback");
 function getPresentationVerificationCallback(idOpts, context) {
   async function presentationVerificationCallback(args, presentationSubmission) {
     if (CredentialMapper.isSdJwtEncoded(args)) {
       const result2 = await context.agent.verifySdJwtPresentation({
-        presentation: args
+        presentation: args,
+        kb: true
       });
       return {
         verified: !!result2.payload
@@ -436,8 +412,28 @@ function getPresentationVerificationCallback(idOpts, context) {
 }
 __name(getPresentationVerificationCallback, "getPresentationVerificationCallback");
 async function createRPBuilder(args) {
-  const { rpOpts, context } = args;
+  const { rpOpts, pexOpts, context } = args;
   const { identifierOpts } = rpOpts;
+  let definition = args.definition;
+  let dcqlQuery = args.dcql;
+  if (!definition && pexOpts && pexOpts.definitionId) {
+    const presentationDefinitionItems = await context.agent.pdmGetDefinitions({
+      filter: [
+        {
+          definitionId: pexOpts.definitionId,
+          version: pexOpts.version,
+          tenantId: pexOpts.tenantId
+        }
+      ]
+    });
+    if (presentationDefinitionItems.length > 0) {
+      const presentationDefinitionItem = presentationDefinitionItems[0];
+      definition = presentationDefinitionItem.definitionPayload;
+      if (!dcqlQuery && presentationDefinitionItem.dcqlPayload) {
+        dcqlQuery = presentationDefinitionItem.dcqlPayload;
+      }
+    }
+  }
   const didMethods = identifierOpts.supportedDIDMethods ?? await getAgentDIDMethods(context);
   const eventEmitter = rpOpts.eventEmitter ?? new EventEmitter();
   const defaultClientMetadata = {
@@ -492,27 +488,34 @@ async function createRPBuilder(args) {
   const builder = RP.builder({
     requestVersion: getRequestVersion(rpOpts)
   }).withScope("openid", PropertyTarget.REQUEST_OBJECT).withResponseMode(rpOpts.responseMode ?? ResponseMode.POST).withResponseType(ResponseType.VP_TOKEN, PropertyTarget.REQUEST_OBJECT).withSupportedVersions(rpOpts.supportedVersions ?? [
-    SupportedVersion.OID4VP_v1,
-    SupportedVersion.SIOPv2_OID4VP_D28
+    SupportedVersion.JWT_VC_PRESENTATION_PROFILE_v1,
+    SupportedVersion.SIOPv2_ID1,
+    SupportedVersion.SIOPv2_D11
   ]).withEventEmitter(eventEmitter).withSessionManager(rpOpts.sessionManager ?? new InMemoryRPSessionManager(eventEmitter)).withClientMetadata(rpOpts.clientMetadataOpts ?? defaultClientMetadata, PropertyTarget.REQUEST_OBJECT).withVerifyJwtCallback(rpOpts.verifyJwtCallback ? rpOpts.verifyJwtCallback : getVerifyJwtCallback({
     resolver,
     verifyOpts: {
       wellknownDIDVerifyCallback: getWellKnownDIDVerifyCallback(rpOpts.identifierOpts, context),
       checkLinkedDomain: "if_present"
     }
-  }, context)).withDcqlQueryLookup(getDcqlQueryLookupCallback(context)).withRevocationVerification(RevocationVerification.NEVER).withPresentationVerification(getPresentationVerificationCallback(identifierOpts.idOpts, context));
+  }, context)).withRevocationVerification(RevocationVerification.NEVER).withPresentationVerification(getPresentationVerificationCallback(identifierOpts.idOpts, context));
   const oidfOpts = identifierOpts.oidfOpts;
   if (oidfOpts && isExternalIdentifierOIDFEntityIdOpts(oidfOpts)) {
-    builder.withEntityId(oidfOpts.identifier, PropertyTarget.REQUEST_OBJECT);
+    builder.withEntityId(oidfOpts.identifier, PropertyTarget.REQUEST_OBJECT).withClientIdScheme("entity_id", PropertyTarget.REQUEST_OBJECT);
   } else {
     const resolution = await context.agent.identifierManagedGet(identifierOpts.idOpts);
-    const clientId = rpOpts.clientMetadataOpts?.client_id ?? resolution.issuer ?? (isManagedIdentifierDidResult(resolution) ? resolution.did : resolution.jwkThumbprint);
-    const clientIdPrefixed = prefixClientId(clientId);
-    builder.withClientId(clientIdPrefixed, PropertyTarget.REQUEST_OBJECT);
+    builder.withClientId(resolution.issuer ?? (isManagedIdentifierDidResult(resolution) ? resolution.did : resolution.jwkThumbprint), PropertyTarget.REQUEST_OBJECT).withClientIdScheme(resolution.clientIdScheme ?? identifierOpts.idOpts.clientIdScheme, PropertyTarget.REQUEST_OBJECT);
   }
   if (hasher) {
     builder.withHasher(hasher);
   }
+  if (definition) {
+    builder.withPresentationDefinition({
+      definition
+    }, PropertyTarget.REQUEST_OBJECT);
+  }
+  if (dcqlQuery) {
+    builder.withDcqlQuery(dcqlQuery);
+  }
   if (rpOpts.responseRedirectUri) {
     builder.withResponseRedirectUri(rpOpts.responseRedirectUri);
   }
@@ -569,13 +572,6 @@ function getSigningAlgo(type) {
   }
 }
 __name(getSigningAlgo, "getSigningAlgo");
-function prefixClientId(clientId) {
-  if (clientId.startsWith("did:")) {
-    return `${ClientIdentifierPrefix.DECENTRALIZED_IDENTIFIER}:${clientId}`;
-  }
-  return clientId;
-}
-__name(prefixClientId, "prefixClientId");
 
 // src/RPInstance.ts
 import { v4 as uuidv4 } from "uuid";
@@ -585,16 +581,17 @@ var RPInstance = class {
     __name(this, "RPInstance");
   }
   _rp;
-  _presentationOptions;
+  _pexOptions;
   _rpOptions;
   constructor({ rpOpts, pexOpts }) {
     this._rpOptions = rpOpts;
-    this._presentationOptions = pexOpts;
+    this._pexOptions = pexOpts;
   }
   async get(context) {
     if (!this._rp) {
       const builder = await createRPBuilder({
         rpOpts: this._rpOptions,
+        pexOpts: this._pexOptions,
         context
       });
       this._rp = builder.build();
@@ -604,11 +601,23 @@ var RPInstance = class {
   get rpOptions() {
     return this._rpOptions;
   }
-  get presentationOptions() {
-    return this._presentationOptions;
+  get pexOptions() {
+    return this._pexOptions;
+  }
+  hasDefinition() {
+    return this.definitionId !== void 0;
+  }
+  get definitionId() {
+    return this.pexOptions?.definitionId;
+  }
+  async getPresentationDefinition(context) {
+    return this.definitionId ? await context.agent.pexStoreGetDefinition({
+      definitionId: this.definitionId,
+      tenantId: this.pexOptions?.tenantId
+    }) : void 0;
   }
   async createAuthorizationRequestURI(createArgs, context) {
-    const { correlationId, queryId, claims, requestByReferenceURI, responseURI, responseURIType, callback, responseRedirectURI } = createArgs;
+    const { correlationId, claims, requestByReferenceURI, responseURI, responseURIType } = createArgs;
     const nonce = createArgs.nonce ?? uuidv4();
     const state = createArgs.state ?? correlationId;
     let jwtIssuer;
@@ -636,20 +645,17 @@ var RPInstance = class {
     return await this.get(context).then((rp) => rp.createAuthorizationRequestURI({
       version: getRequestVersion(this.rpOptions),
       correlationId,
-      queryId,
       nonce,
       state,
       claims,
       requestByReferenceURI,
       responseURI,
       responseURIType,
-      jwtIssuer,
-      callback,
-      responseRedirectURI
+      jwtIssuer
     }));
   }
   async createAuthorizationRequest(createArgs, context) {
-    const { correlationId, claims, requestByReferenceURI, responseURI, responseURIType, responseRedirectURI } = createArgs;
+    const { correlationId, claims, requestByReferenceURI, responseURI, responseURIType } = createArgs;
     const nonce = createArgs.nonce ?? uuidv4();
     const state = createArgs.state ?? correlationId;
     const idOpts = this.rpOptions.identifierOpts.idOpts;
@@ -680,13 +686,13 @@ var RPInstance = class {
       requestByReferenceURI,
       responseURIType,
       responseURI,
-      jwtIssuer,
-      responseRedirectURI
+      jwtIssuer
     }));
   }
 };
 
 // src/agent/SIOPv2RP.ts
+import { shaHasher as defaultHasher2 } from "@sphereon/ssi-sdk.core";
 var SIOPv2RP = class _SIOPv2RP {
   static {
     __name(this, "SIOPv2RP");
@@ -694,7 +700,7 @@ var SIOPv2RP = class _SIOPv2RP {
   opts;
   static _DEFAULT_OPTS_KEY = "_default";
   instances = /* @__PURE__ */ new Map();
-  schema = plugin_schema_default.IDidAuthSiopOpAuthenticator;
+  schema = schema.IDidAuthSiopOpAuthenticator;
   methods = {
     siopCreateAuthRequestURI: this.createAuthorizationRequestURI.bind(this),
     siopCreateAuthRequestPayloads: this.createAuthorizationRequestPayloads.bind(this),
@@ -724,72 +730,53 @@ var SIOPv2RP = class _SIOPv2RP {
   }
   async createAuthorizationRequestURI(createArgs, context) {
     return await this.getRPInstance({
-      createWhenNotPresent: true,
-      responseRedirectURI: createArgs.responseRedirectURI,
-      ...createArgs.useQueryIdInstance === true && {
-        queryId: createArgs.queryId
-      }
+      definitionId: createArgs.definitionId,
+      responseRedirectURI: createArgs.responseRedirectURI
     }, context).then((rp) => rp.createAuthorizationRequestURI(createArgs, context)).then((URI) => URI.encodedUri);
   }
   async createAuthorizationRequestPayloads(createArgs, context) {
     return await this.getRPInstance({
-      createWhenNotPresent: true,
-      queryId: createArgs.queryId
+      definitionId: createArgs.definitionId
     }, context).then((rp) => rp.createAuthorizationRequest(createArgs, context)).then(async (request) => {
       const authRequest = {
         authorizationRequest: request.payload,
         requestObject: await request.requestObjectJwt(),
-        requestObjectDecoded: request.requestObject?.getPayload()
+        requestObjectDecoded: await request.requestObject?.getPayload()
       };
       return authRequest;
     });
   }
   async siopGetRequestState(args, context) {
     return await this.getRPInstance({
-      createWhenNotPresent: false,
-      queryId: args.queryId
+      definitionId: args.definitionId
     }, context).then((rp) => rp.get(context).then((rp2) => rp2.sessionManager.getRequestStateByCorrelationId(args.correlationId, args.errorOnNotFound)));
   }
   async siopGetResponseState(args, context) {
     const rpInstance = await this.getRPInstance({
-      createWhenNotPresent: false,
-      queryId: args.queryId
+      definitionId: args.definitionId
     }, context);
     const authorizationResponseState = await rpInstance.get(context).then((rp) => rp.sessionManager.getResponseStateByCorrelationId(args.correlationId, args.errorOnNotFound));
     if (authorizationResponseState === void 0) {
       return void 0;
     }
     const responseState = authorizationResponseState;
-    if (responseState.status === AuthorizationResponseStateStatus.VERIFIED) {
+    if (responseState.status === AuthorizationResponseStateStatus.VERIFIED && args.includeVerifiedData && args.includeVerifiedData !== VerifiedDataMode.NONE) {
       let hasher;
       if (CredentialMapper2.isSdJwtEncoded(responseState.response.payload.vp_token) && (!rpInstance.rpOptions.credentialOpts?.hasher || typeof rpInstance.rpOptions.credentialOpts?.hasher !== "function")) {
         hasher = defaultHasher2;
       }
-      const vpToken = responseState.response.payload.vp_token && JSON.parse(responseState.response.payload.vp_token);
-      const claims = [];
-      for (const [credentialQueryId, presentationValue] of Object.entries(vpToken)) {
-        let singleVP;
-        if (Array.isArray(presentationValue)) {
-          if (presentationValue.length === 0) {
-            throw Error(`DCQL query '${credentialQueryId}' has empty array of presentations`);
-          }
-          if (presentationValue.length > 1) {
-            throw Error(`DCQL query '${credentialQueryId}' has multiple presentations (${presentationValue.length}), but only one is supported atm`);
-          }
-          singleVP = presentationValue[0];
-        } else {
-          singleVP = presentationValue;
-        }
-        const presentationDecoded = CredentialMapper2.decodeVerifiablePresentation(
-          singleVP,
-          //todo: later we want to conditionally pass in options for mdl-mdoc here
-          hasher
-        );
-        console.log(`presentationDecoded: ${JSON.stringify(presentationDecoded)}`);
-        const allClaims = {};
-        const presentationOrClaims = this.presentationOrClaimsFrom(presentationDecoded);
-        if ("verifiableCredential" in presentationOrClaims) {
-          for (const credential of presentationOrClaims.verifiableCredential) {
+      const presentationDecoded = CredentialMapper2.decodeVerifiablePresentation(
+        responseState.response.payload.vp_token,
+        //todo: later we want to conditionally pass in options for mdl-mdoc here
+        hasher
+      );
+      switch (args.includeVerifiedData) {
+        case VerifiedDataMode.VERIFIED_PRESENTATION:
+          responseState.response.payload.verifiedData = this.presentationOrClaimsFrom(presentationDecoded);
+          break;
+        case VerifiedDataMode.CREDENTIAL_SUBJECT_FLATTENED:
+          const allClaims = {};
+          for (const credential of this.presentationOrClaimsFrom(presentationDecoded).verifiableCredential || []) {
             const vc = credential;
             const schemaValidationResult = await context.agent.cvVerifySchema({
               credential,
@@ -810,43 +797,20 @@ var SIOPv2RP = class _SIOPv2RP {
                 allClaims[key] = value;
               }
             });
-            claims.push({
-              id: credentialQueryId,
-              type: vc.type[0],
-              claims: allClaims
-            });
           }
-        } else {
-          claims.push({
-            id: credentialQueryId,
-            type: presentationDecoded.decodedPayload.vct,
-            claims: presentationOrClaims
-          });
-        }
+          responseState.verifiedData = allClaims;
+          break;
       }
-      responseState.verifiedData = {
-        ...responseState.response.payload.vp_token && {
-          authorization_response: {
-            vp_token: typeof responseState.response.payload.vp_token === "string" ? JSON.parse(responseState.response.payload.vp_token) : responseState.response.payload.vp_token
-          }
-        },
-        ...claims.length > 0 && {
-          credential_claims: claims
-        }
-      };
     }
     return responseState;
   }
-  presentationOrClaimsFrom = /* @__PURE__ */ __name((presentationDecoded) => {
-    return CredentialMapper2.isSdJwtDecodedCredential(presentationDecoded) ? presentationDecoded.decodedPayload : CredentialMapper2.toUniformPresentation(presentationDecoded);
-  }, "presentationOrClaimsFrom");
+  presentationOrClaimsFrom = /* @__PURE__ */ __name((presentationDecoded) => CredentialMapper2.isSdJwtDecodedCredential(presentationDecoded) ? presentationDecoded.decodedPayload : CredentialMapper2.toUniformPresentation(presentationDecoded), "presentationOrClaimsFrom");
   async siopUpdateRequestState(args, context) {
-    if (args.state !== "authorization_request_created") {
-      throw Error(`Only 'authorization_request_created' status is supported for this method at this point`);
+    if (args.state !== "sent") {
+      throw Error(`Only 'sent' status is supported for this method at this point`);
     }
     return await this.getRPInstance({
-      createWhenNotPresent: false,
-      queryId: args.queryId
+      definitionId: args.definitionId
     }, context).then((rp) => rp.get(context).then(async (rp2) => {
       await rp2.signalAuthRequestRetrieved({
         correlationId: args.correlationId,
@@ -857,8 +821,7 @@ var SIOPv2RP = class _SIOPv2RP {
   }
   async siopDeleteState(args, context) {
     return await this.getRPInstance({
-      createWhenNotPresent: false,
-      queryId: args.queryId
+      definitionId: args.definitionId
     }, context).then((rp) => rp.get(context).then((rp2) => rp2.sessionManager.deleteStateForCorrelationId(args.correlationId))).then(() => true);
   }
   async siopVerifyAuthResponse(args, context) {
@@ -867,27 +830,32 @@ var SIOPv2RP = class _SIOPv2RP {
     }
     const authResponse = typeof args.authorizationResponse === "string" ? decodeUriAsJson(args.authorizationResponse) : args.authorizationResponse;
     return await this.getRPInstance({
-      createWhenNotPresent: false,
-      queryId: args.queryId
+      definitionId: args.definitionId
     }, context).then((rp) => rp.get(context).then((rp2) => rp2.verifyAuthorizationResponse(authResponse, {
       correlationId: args.correlationId,
-      ...args.dcqlQuery && {
+      ...args.presentationDefinitions && !args.dcqlQuery ? {
+        presentationDefinitions: args.presentationDefinitions
+      } : {},
+      ...args.dcqlQuery ? {
         dcqlQuery: args.dcqlQuery
-      },
+      } : {},
       audience: args.audience
     })));
   }
   async siopImportDefinitions(args, context) {
-    const { importItems, tenantId, version, versionControlMode } = args;
-    await Promise.all(importItems.map(async (importItem) => {
-      DcqlQuery.validate(importItem.query);
-      console.log(`persisting DCQL definition ${importItem.queryId} with versionControlMode ${versionControlMode}`);
+    const { definitions, tenantId, version, versionControlMode } = args;
+    await Promise.all(definitions.map(async (definitionPair) => {
+      const definitionPayload = definitionPair.definitionPayload;
+      await context.agent.pexValidateDefinition({
+        definition: definitionPayload
+      });
+      console.log(`persisting definition ${definitionPayload.id} / ${definitionPayload.name} with versionControlMode ${versionControlMode}`);
       return context.agent.pdmPersistDefinition({
         definitionItem: {
-          queryId: importItem.queryId,
           tenantId,
           version,
-          query: importItem.query
+          definitionPayload,
+          dcqlPayload: definitionPair.dcqlPayload
         },
         opts: {
           versionControlMode
@@ -896,12 +864,12 @@ var SIOPv2RP = class _SIOPv2RP {
     }));
   }
   async siopGetRedirectURI(args, context) {
-    const instanceId = args.queryId ?? _SIOPv2RP._DEFAULT_OPTS_KEY;
+    const instanceId = args.definitionId ?? _SIOPv2RP._DEFAULT_OPTS_KEY;
     if (this.instances.has(instanceId)) {
       const rpInstance = this.instances.get(instanceId);
       if (rpInstance !== void 0) {
         const rp = await rpInstance.get(context);
-        return await rp.getResponseRedirectUri({
+        return rp.getResponseRedirectUri({
           correlation_id: args.correlationId,
           correlationId: args.correlationId,
           ...args.state && {
@@ -912,40 +880,12 @@ var SIOPv2RP = class _SIOPv2RP {
     }
     return void 0;
   }
-  async getRPInstance({ createWhenNotPresent, queryId, responseRedirectURI }, context) {
-    let rpInstanceId = _SIOPv2RP._DEFAULT_OPTS_KEY;
-    let rpInstance;
-    if (queryId) {
-      if (this.instances.has(queryId)) {
-        rpInstanceId = queryId;
-        rpInstance = this.instances.get(rpInstanceId);
-      } else if (isValidUUID2(queryId)) {
-        try {
-          const pd = await context.agent.pdmGetDefinition({
-            itemId: queryId
-          });
-          if (this.instances.has(pd.queryId)) {
-            rpInstanceId = pd.queryId;
-            rpInstance = this.instances.get(rpInstanceId);
-          }
-        } catch (ignore) {
-        }
-      }
-      if (createWhenNotPresent) {
-        rpInstanceId = queryId;
-      } else {
-        rpInstance = this.instances.get(rpInstanceId);
-      }
-    } else {
-      rpInstance = this.instances.get(rpInstanceId);
-    }
-    if (!rpInstance) {
-      if (!createWhenNotPresent) {
-        return Promise.reject(`No RP instance found for key ${rpInstanceId}`);
-      }
-      const instanceOpts = this.getInstanceOpts(queryId);
+  async getRPInstance({ definitionId, responseRedirectURI }, context) {
+    const instanceId = definitionId ?? _SIOPv2RP._DEFAULT_OPTS_KEY;
+    if (!this.instances.has(instanceId)) {
+      const instanceOpts = this.getInstanceOpts(definitionId);
       const rpOpts = await this.getRPOptions(context, {
-        queryId,
+        definitionId,
         responseRedirectURI
       });
       if (!rpOpts.identifierOpts.resolveOpts?.resolver || typeof rpOpts.identifierOpts.resolveOpts.resolver.resolve !== "function") {
@@ -957,29 +897,29 @@ var SIOPv2RP = class _SIOPv2RP {
             ...rpOpts.identifierOpts.resolveOpts
           };
         }
-        console.log("Using agent DID resolver for RP instance with definition id " + queryId);
+        console.log("Using agent DID resolver for RP instance with definition id " + definitionId);
         rpOpts.identifierOpts.resolveOpts.resolver = getAgentResolver2(context, {
           uniresolverResolution: true,
           localResolution: true,
           resolverResolution: true
         });
       }
-      rpInstance = new RPInstance({
+      this.instances.set(instanceId, new RPInstance({
         rpOpts,
         pexOpts: instanceOpts
-      });
-      this.instances.set(rpInstanceId, rpInstance);
+      }));
     }
+    const rpInstance = this.instances.get(instanceId);
     if (responseRedirectURI) {
       rpInstance.rpOptions.responseRedirectUri = responseRedirectURI;
     }
     return rpInstance;
   }
   async getRPOptions(context, opts) {
-    const { queryId, responseRedirectURI } = opts;
-    const options = this.getInstanceOpts(queryId)?.rpOpts ?? this.opts.defaultOpts;
+    const { definitionId, responseRedirectURI } = opts;
+    const options = this.getInstanceOpts(definitionId)?.rpOpts ?? this.opts.defaultOpts;
     if (!options) {
-      throw Error(`Could not get specific nor default options for definition ${queryId}`);
+      throw Error(`Could not get specific nor default options for definition ${definitionId}`);
     }
     if (this.opts.defaultOpts) {
       if (!options.identifierOpts) {
@@ -1011,28 +951,40 @@ var SIOPv2RP = class _SIOPv2RP {
     }
     return options;
   }
-  getInstanceOpts(queryId) {
+  getInstanceOpts(definitionId) {
     if (!this.opts.instanceOpts) return void 0;
-    const instanceOpt = queryId ? this.opts.instanceOpts.find((i) => i.queryId === queryId) : void 0;
-    return instanceOpt ?? this.getDefaultOptions(queryId);
+    const instanceOpt = definitionId ? this.opts.instanceOpts.find((i) => i.definitionId === definitionId) : void 0;
+    return instanceOpt ?? this.getDefaultOptions(definitionId);
   }
-  getDefaultOptions(queryId) {
+  getDefaultOptions(definitionId) {
     if (!this.opts.instanceOpts) return void 0;
-    const defaultOptions = this.opts.instanceOpts.find((i) => i.queryId === "default");
+    const defaultOptions = this.opts.instanceOpts.find((i) => i.definitionId === "default");
     if (defaultOptions) {
       const clonedOptions = {
         ...defaultOptions
       };
-      if (queryId !== void 0) {
-        clonedOptions.queryId = queryId;
+      if (definitionId !== void 0) {
+        clonedOptions.definitionId = definitionId;
       }
       return clonedOptions;
     }
     return void 0;
   }
 };
+
+// src/types/ISIOPv2RP.ts
+var VerifiedDataMode = /* @__PURE__ */ (function(VerifiedDataMode2) {
+  VerifiedDataMode2["NONE"] = "none";
+  VerifiedDataMode2["VERIFIED_PRESENTATION"] = "vp";
+  VerifiedDataMode2["CREDENTIAL_SUBJECT_FLATTENED"] = "cs-flat";
+  return VerifiedDataMode2;
+})({});
+
+// src/index.ts
+var schema = require_plugin_schema();
 export {
   SIOPv2RP,
-  plugin_schema_default as schema
+  VerifiedDataMode,
+  schema
 };
 //# sourceMappingURL=index.js.map