@sphereon/ssi-sdk.siopv2-oid4vp-rp-auth 0.34.1-fix.80 → 0.34.1-next.278

package/dist/index.js

@@ -1,363 +1,359 @@
 var __defProp = Object.defineProperty;
-var __getOwnPropNames = Object.getOwnPropertyNames;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
-var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-};
 
 // plugin.schema.json
-var require_plugin_schema = __commonJS({
-  "plugin.schema.json"(exports, module) {
-    module.exports = {
-      IDidAuthSiopOpAuthenticator: {
-        components: {
-          schemas: {
-            IGetSiopSessionArgs: {
-              type: "object",
-              properties: {
-                sessionId: {
-                  type: "string"
-                },
-                additionalProperties: false
-              },
-              required: ["sessionId"],
-              description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.getSessionForSiop } "
+var plugin_schema_default = {
+  IDidAuthSiopOpAuthenticator: {
+    components: {
+      schemas: {
+        IGetSiopSessionArgs: {
+          type: "object",
+          properties: {
+            sessionId: {
+              type: "string"
             },
-            IRegisterSiopSessionArgs: {
+            additionalProperties: false
+          },
+          required: ["sessionId"],
+          description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.getSessionForSiop } "
+        },
+        IRegisterSiopSessionArgs: {
+          type: "object",
+          properties: {
+            identifier: {
               type: "object",
               properties: {
-                identifier: {
-                  type: "object",
-                  properties: {
-                    did: {
-                      type: "string"
-                    },
-                    alias: {
-                      type: "string"
-                    },
-                    provider: {
-                      type: "string"
-                    },
-                    controllerKeyId: {
-                      type: "string"
-                    },
-                    keys: {
-                      type: "array",
-                      items: {
-                        type: "object",
-                        properties: {
-                          additionalProperties: true
-                        }
-                      }
-                    },
-                    services: {
-                      type: "array",
-                      items: {
-                        type: "object",
-                        properties: {
-                          additionalProperties: true
-                        }
-                      }
-                    }
-                  },
-                  additionalProperties: false,
-                  required: ["did", "provider", "keys", "services"]
-                },
-                sessionId: {
+                did: {
                   type: "string"
                 },
-                expiresIn: {
-                  type: "number"
-                },
-                additionalProperties: false
-              },
-              required: ["identifier"],
-              description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.registerSessionForSiop } "
-            },
-            IRemoveSiopSessionArgs: {
-              type: "object",
-              properties: {
-                sessionId: {
+                alias: {
                   type: "string"
                 },
-                additionalProperties: false
-              },
-              required: ["sessionId"],
-              description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.removeSessionForSiop } "
-            },
-            IAuthenticateWithSiopArgs: {
-              type: "object",
-              properties: {
-                sessionId: {
+                provider: {
                   type: "string"
                 },
-                stateId: {
+                controllerKeyId: {
                   type: "string"
                 },
-                redirectUrl: {
-                  type: "string"
+                keys: {
+                  type: "array",
+                  items: {
+                    type: "object",
+                    properties: {
+                      additionalProperties: true
+                    }
+                  }
                 },
-                additionalProperties: false
+                services: {
+                  type: "array",
+                  items: {
+                    type: "object",
+                    properties: {
+                      additionalProperties: true
+                    }
+                  }
+                }
               },
-              required: ["sessionId", "stateId", "redirectUrl"],
-              description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.authenticateWithSiop } "
+              additionalProperties: false,
+              required: ["did", "provider", "keys", "services"]
+            },
+            sessionId: {
+              type: "string"
             },
-            IResponse: {
+            expiresIn: {
+              type: "number"
+            },
+            additionalProperties: false
+          },
+          required: ["identifier"],
+          description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.registerSessionForSiop } "
+        },
+        IRemoveSiopSessionArgs: {
+          type: "object",
+          properties: {
+            sessionId: {
+              type: "string"
+            },
+            additionalProperties: false
+          },
+          required: ["sessionId"],
+          description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.removeSessionForSiop } "
+        },
+        IAuthenticateWithSiopArgs: {
+          type: "object",
+          properties: {
+            sessionId: {
+              type: "string"
+            },
+            stateId: {
+              type: "string"
+            },
+            redirectUrl: {
+              type: "string"
+            },
+            additionalProperties: false
+          },
+          required: ["sessionId", "stateId", "redirectUrl"],
+          description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.authenticateWithSiop } "
+        },
+        IResponse: {
+          type: "object",
+          properties: {
+            status: {
+              type: "number"
+            },
+            additionalProperties: true
+          },
+          required: ["status"],
+          description: "Result of {@link DidAuthSiopOpAuthenticator.authenticateWithSiop & DidAuthSiopOpAuthenticator.sendSiopAuthenticationResponse } "
+        },
+        IGetSiopAuthenticationRequestFromRpArgs: {
+          type: "object",
+          properties: {
+            sessionId: {
+              type: "string"
+            },
+            stateId: {
+              type: "string"
+            },
+            redirectUrl: {
+              type: "string"
+            },
+            additionalProperties: false
+          },
+          required: ["sessionId", "stateId", "redirectUrl"],
+          description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.getSiopAuthenticationRequestFromRP } "
+        },
+        ParsedAuthenticationRequestURI: {
+          type: "object",
+          properties: {
+            jwt: {
+              type: "string"
+            },
+            requestPayload: {
               type: "object",
               properties: {
-                status: {
-                  type: "number"
-                },
                 additionalProperties: true
-              },
-              required: ["status"],
-              description: "Result of {@link DidAuthSiopOpAuthenticator.authenticateWithSiop & DidAuthSiopOpAuthenticator.sendSiopAuthenticationResponse } "
+              }
             },
-            IGetSiopAuthenticationRequestFromRpArgs: {
+            registration: {
               type: "object",
               properties: {
-                sessionId: {
-                  type: "string"
-                },
-                stateId: {
-                  type: "string"
-                },
-                redirectUrl: {
-                  type: "string"
-                },
-                additionalProperties: false
-              },
-              required: ["sessionId", "stateId", "redirectUrl"],
-              description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.getSiopAuthenticationRequestFromRP } "
+                additionalProperties: true
+              }
             },
-            ParsedAuthenticationRequestURI: {
+            additionalProperties: false
+          },
+          required: ["jwt", "requestPayload", "registration"],
+          description: "Result of {@link DidAuthSiopOpAuthenticator.getSiopAuthenticationRequestFromRP } "
+        },
+        IGetSiopAuthenticationRequestDetailsArgs: {
+          type: "object",
+          properties: {
+            sessionId: {
+              type: "string"
+            },
+            verifiedAuthenticationRequest: {
               type: "object",
               properties: {
-                jwt: {
-                  type: "string"
-                },
-                requestPayload: {
-                  type: "object",
-                  properties: {
-                    additionalProperties: true
-                  }
-                },
-                registration: {
-                  type: "object",
-                  properties: {
-                    additionalProperties: true
-                  }
-                },
-                additionalProperties: false
-              },
-              required: ["jwt", "requestPayload", "registration"],
-              description: "Result of {@link DidAuthSiopOpAuthenticator.getSiopAuthenticationRequestFromRP } "
+                additionalProperties: true
+              }
             },
-            IGetSiopAuthenticationRequestDetailsArgs: {
+            credentialFilter: {
               type: "object",
               properties: {
-                sessionId: {
-                  type: "string"
-                },
-                verifiedAuthenticationRequest: {
-                  type: "object",
-                  properties: {
-                    additionalProperties: true
-                  }
-                },
-                credentialFilter: {
-                  type: "object",
-                  properties: {
-                    additionalProperties: true
-                  }
-                },
-                additionalProperties: false
-              },
-              required: ["sessionId", "verifiedAuthenticationRequest"],
-              description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.getSiopAuthenticationRequestDetails } "
+                additionalProperties: true
+              }
+            },
+            additionalProperties: false
+          },
+          required: ["sessionId", "verifiedAuthenticationRequest"],
+          description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.getSiopAuthenticationRequestDetails } "
+        },
+        IAuthRequestDetails: {
+          type: "object",
+          properties: {
+            id: {
+              type: "string"
+            },
+            alsoKnownAs: {
+              type: "array",
+              items: {
+                type: "string"
+              }
             },
-            IAuthRequestDetails: {
+            vpResponseOpts: {
               type: "object",
               properties: {
-                id: {
-                  type: "string"
-                },
-                alsoKnownAs: {
-                  type: "array",
-                  items: {
-                    type: "string"
-                  }
-                },
-                vpResponseOpts: {
-                  type: "object",
-                  properties: {
-                    additionalProperties: true
-                  }
-                },
-                additionalProperties: false
-              },
-              required: ["id", "vpResponseOpts"],
-              description: "Result of {@link DidAuthSiopOpAuthenticator.getSiopAuthenticationRequestDetails } "
+                additionalProperties: true
+              }
+            },
+            additionalProperties: false
+          },
+          required: ["id", "vpResponseOpts"],
+          description: "Result of {@link DidAuthSiopOpAuthenticator.getSiopAuthenticationRequestDetails } "
+        },
+        IVerifySiopAuthenticationRequestUriArgs: {
+          type: "object",
+          properties: {
+            sessionId: {
+              type: "string"
             },
-            IVerifySiopAuthenticationRequestUriArgs: {
+            ParsedAuthenticationRequestURI: {
               type: "object",
               properties: {
-                sessionId: {
-                  type: "string"
-                },
-                ParsedAuthenticationRequestURI: {
-                  type: "object",
-                  properties: {
-                    additionalProperties: true
-                  }
-                },
-                additionalProperties: false
-              },
-              required: ["sessionId", "ParsedAuthenticationRequestURI"],
-              description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.verifySiopAuthenticationRequestURI } "
+                additionalProperties: true
+              }
             },
-            VerifiedAuthorizationRequest: {
+            additionalProperties: false
+          },
+          required: ["sessionId", "ParsedAuthenticationRequestURI"],
+          description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.verifySiopAuthenticationRequestURI } "
+        },
+        VerifiedAuthorizationRequest: {
+          type: "object",
+          properties: {
+            payload: {
               type: "object",
               properties: {
-                payload: {
-                  type: "object",
-                  properties: {
-                    additionalProperties: true
-                  }
-                },
-                presentationDefinitions: {
-                  type: "object",
-                  properties: {
-                    additionalProperties: true
-                  }
-                },
-                verifyOpts: {
-                  type: "object",
-                  properties: {
-                    additionalProperties: true
-                  }
-                },
-                additionalProperties: false
-              },
-              required: ["payload", "verifyOpts"],
-              description: "Result of {@link DidAuthSiopOpAuthenticator.verifySiopAuthenticationRequestURI } "
+                additionalProperties: true
+              }
             },
-            ISendSiopAuthenticationResponseArgs: {
+            presentationDefinitions: {
               type: "object",
               properties: {
-                sessionId: {
-                  type: "string"
-                },
-                verifiedAuthenticationRequest: {
-                  type: "object",
-                  properties: {
-                    additionalProperties: true
-                  }
-                },
-                verifiablePresentationResponse: {
-                  type: "object",
-                  properties: {
-                    additionalProperties: true
-                  }
-                },
-                additionalProperties: false
-              },
-              required: ["sessionId", "verifiedAuthenticationRequest"],
-              description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.sendSiopAuthenticationResponse } "
-            }
-          },
-          methods: {
-            getSessionForSiop: {
-              description: "Get SIOP session",
-              arguments: {
-                $ref: "#/components/schemas/IGetSiopSessionArgs"
-              },
-              returnType: "object"
-            },
-            registerSessionForSiop: {
-              description: "Register SIOP session",
-              arguments: {
-                $ref: "#/components/schemas/IRegisterSiopSessionArgs"
-              },
-              returnType: "object"
-            },
-            removeSessionForSiop: {
-              description: "Remove SIOP session",
-              arguments: {
-                $ref: "#/components/schemas/IRemoveSiopSessionArgs"
-              },
-              returnType: "boolean"
-            },
-            authenticateWithSiop: {
-              description: "Authenticate using DID Auth SIOP",
-              arguments: {
-                $ref: "#/components/schemas/IAuthenticateWithSiopArgs"
-              },
-              returnType: {
-                $ref: "#/components/schemas/Response"
+                additionalProperties: true
               }
             },
-            getSiopAuthenticationRequestFromRP: {
-              description: "Get authentication request from RP",
-              arguments: {
-                $ref: "#/components/schemas/IGetSiopAuthenticationRequestFromRpArgs"
-              },
-              returnType: {
-                $ref: "#/components/schemas/ParsedAuthenticationRequestURI"
+            verifyOpts: {
+              type: "object",
+              properties: {
+                additionalProperties: true
               }
             },
-            getSiopAuthenticationRequestDetails: {
-              description: "Get authentication request details",
-              arguments: {
-                $ref: "#/components/schemas/IGetSiopAuthenticationRequestDetailsArgs"
-              },
-              returnType: {
-                $ref: "#/components/schemas/IAuthRequestDetails"
-              }
+            additionalProperties: false
+          },
+          required: ["payload", "verifyOpts"],
+          description: "Result of {@link DidAuthSiopOpAuthenticator.verifySiopAuthenticationRequestURI } "
+        },
+        ISendSiopAuthenticationResponseArgs: {
+          type: "object",
+          properties: {
+            sessionId: {
+              type: "string"
             },
-            verifySiopAuthenticationRequestURI: {
-              description: "Verify authentication request URI",
-              arguments: {
-                $ref: "#/components/schemas/IVerifySiopAuthenticationRequestUriArgs"
-              },
-              returnType: {
-                $ref: "#/components/schemas/VerifiedAuthorizationRequest"
+            verifiedAuthenticationRequest: {
+              type: "object",
+              properties: {
+                additionalProperties: true
               }
             },
-            sendSiopAuthenticationResponse: {
-              description: "Send authentication response",
-              arguments: {
-                $ref: "#/components/schemas/ISendSiopAuthenticationResponseArgs"
-              },
-              returnType: {
-                $ref: "#/components/schemas/IRequiredContext"
+            verifiablePresentationResponse: {
+              type: "object",
+              properties: {
+                additionalProperties: true
               }
-            }
+            },
+            additionalProperties: false
+          },
+          required: ["sessionId", "verifiedAuthenticationRequest"],
+          description: "Arguments needed for {@link DidAuthSiopOpAuthenticator.sendSiopAuthenticationResponse } "
+        }
+      },
+      methods: {
+        getSessionForSiop: {
+          description: "Get SIOP session",
+          arguments: {
+            $ref: "#/components/schemas/IGetSiopSessionArgs"
+          },
+          returnType: "object"
+        },
+        registerSessionForSiop: {
+          description: "Register SIOP session",
+          arguments: {
+            $ref: "#/components/schemas/IRegisterSiopSessionArgs"
+          },
+          returnType: "object"
+        },
+        removeSessionForSiop: {
+          description: "Remove SIOP session",
+          arguments: {
+            $ref: "#/components/schemas/IRemoveSiopSessionArgs"
+          },
+          returnType: "boolean"
+        },
+        authenticateWithSiop: {
+          description: "Authenticate using DID Auth SIOP",
+          arguments: {
+            $ref: "#/components/schemas/IAuthenticateWithSiopArgs"
+          },
+          returnType: {
+            $ref: "#/components/schemas/Response"
+          }
+        },
+        getSiopAuthenticationRequestFromRP: {
+          description: "Get authentication request from RP",
+          arguments: {
+            $ref: "#/components/schemas/IGetSiopAuthenticationRequestFromRpArgs"
+          },
+          returnType: {
+            $ref: "#/components/schemas/ParsedAuthenticationRequestURI"
+          }
+        },
+        getSiopAuthenticationRequestDetails: {
+          description: "Get authentication request details",
+          arguments: {
+            $ref: "#/components/schemas/IGetSiopAuthenticationRequestDetailsArgs"
+          },
+          returnType: {
+            $ref: "#/components/schemas/IAuthRequestDetails"
+          }
+        },
+        verifySiopAuthenticationRequestURI: {
+          description: "Verify authentication request URI",
+          arguments: {
+            $ref: "#/components/schemas/IVerifySiopAuthenticationRequestUriArgs"
+          },
+          returnType: {
+            $ref: "#/components/schemas/VerifiedAuthorizationRequest"
+          }
+        },
+        sendSiopAuthenticationResponse: {
+          description: "Send authentication response",
+          arguments: {
+            $ref: "#/components/schemas/ISendSiopAuthenticationResponseArgs"
+          },
+          returnType: {
+            $ref: "#/components/schemas/IRequiredContext"
           }
         }
       }
-    };
+    }
   }
-});
+};
 
 // src/agent/SIOPv2RP.ts
 import { AuthorizationResponseStateStatus, decodeUriAsJson } from "@sphereon/did-auth-siop";
 import { getAgentResolver as getAgentResolver2 } from "@sphereon/ssi-sdk-ext.did-utils";
+import { shaHasher as defaultHasher2 } from "@sphereon/ssi-sdk.core";
+import { validate as isValidUUID2 } from "uuid";
 import { CredentialMapper as CredentialMapper2 } from "@sphereon/ssi-types";
+import { DcqlQuery } from "dcql";
 
 // src/functions.ts
-import { InMemoryRPSessionManager, PassBy, PropertyTarget, ResponseMode, ResponseType, RevocationVerification, RP, Scope, SubjectType, SupportedVersion } from "@sphereon/did-auth-siop";
+import { ClientIdentifierPrefix, InMemoryRPSessionManager, PassBy, PropertyTarget, ResponseMode, ResponseType, RevocationVerification, RP, Scope, SubjectType, SupportedVersion } from "@sphereon/did-auth-siop";
 import { SigningAlgo } from "@sphereon/oid4vc-common";
 import { getAgentDIDMethods, getAgentResolver } from "@sphereon/ssi-sdk-ext.did-utils";
 import { isExternalIdentifierOIDFEntityIdOpts, isManagedIdentifierDidOpts, isManagedIdentifierDidResult, isManagedIdentifierX5cOpts } from "@sphereon/ssi-sdk-ext.identifier-resolution";
 import { CredentialMapper } from "@sphereon/ssi-types";
 import { EventEmitter } from "events";
+import { validate as isValidUUID } from "uuid";
 import { defaultHasher } from "@sphereon/ssi-sdk.core";
 function getRequestVersion(rpOptions) {
   if (Array.isArray(rpOptions.supportedVersions) && rpOptions.supportedVersions.length > 0) {
     return rpOptions.supportedVersions[0];
   }
-  return SupportedVersion.JWT_VC_PRESENTATION_PROFILE_v1;
+  return SupportedVersion.OID4VP_v1;
 }
 __name(getRequestVersion, "getRequestVersion");
 function getWellKnownDIDVerifyCallback(siopIdentifierOpts, context) {
@@ -372,12 +368,40 @@ function getWellKnownDIDVerifyCallback(siopIdentifierOpts, context) {
   };
 }
 __name(getWellKnownDIDVerifyCallback, "getWellKnownDIDVerifyCallback");
+function getDcqlQueryLookupCallback(context) {
+  async function dcqlQueryLookup(queryId, version, tenantId) {
+    const result = await context.agent.pdmGetDefinitions({
+      filter: [
+        {
+          queryId,
+          ...tenantId && {
+            tenantId
+          },
+          ...version && {
+            version
+          }
+        },
+        ...isValidUUID(queryId) ? [
+          {
+            id: queryId
+          }
+        ] : []
+      ]
+    });
+    if (result && result.length > 0) {
+      return result[0].query;
+    }
+    return Promise.reject(Error(`No dcql query found for queryId ${queryId}`));
+  }
+  __name(dcqlQueryLookup, "dcqlQueryLookup");
+  return dcqlQueryLookup;
+}
+__name(getDcqlQueryLookupCallback, "getDcqlQueryLookupCallback");
 function getPresentationVerificationCallback(idOpts, context) {
   async function presentationVerificationCallback(args, presentationSubmission) {
     if (CredentialMapper.isSdJwtEncoded(args)) {
       const result2 = await context.agent.verifySdJwtPresentation({
-        presentation: args,
-        kb: true
+        presentation: args
       });
       return {
         verified: !!result2.payload
@@ -412,28 +436,8 @@ function getPresentationVerificationCallback(idOpts, context) {
 }
 __name(getPresentationVerificationCallback, "getPresentationVerificationCallback");
 async function createRPBuilder(args) {
-  const { rpOpts, pexOpts, context } = args;
+  const { rpOpts, context } = args;
   const { identifierOpts } = rpOpts;
-  let definition = args.definition;
-  let dcqlQuery = args.dcql;
-  if (!definition && pexOpts && pexOpts.definitionId) {
-    const presentationDefinitionItems = await context.agent.pdmGetDefinitions({
-      filter: [
-        {
-          definitionId: pexOpts.definitionId,
-          version: pexOpts.version,
-          tenantId: pexOpts.tenantId
-        }
-      ]
-    });
-    if (presentationDefinitionItems.length > 0) {
-      const presentationDefinitionItem = presentationDefinitionItems[0];
-      definition = presentationDefinitionItem.definitionPayload;
-      if (!dcqlQuery && presentationDefinitionItem.dcqlPayload) {
-        dcqlQuery = presentationDefinitionItem.dcqlPayload;
-      }
-    }
-  }
   const didMethods = identifierOpts.supportedDIDMethods ?? await getAgentDIDMethods(context);
   const eventEmitter = rpOpts.eventEmitter ?? new EventEmitter();
   const defaultClientMetadata = {
@@ -488,34 +492,27 @@ async function createRPBuilder(args) {
   const builder = RP.builder({
     requestVersion: getRequestVersion(rpOpts)
   }).withScope("openid", PropertyTarget.REQUEST_OBJECT).withResponseMode(rpOpts.responseMode ?? ResponseMode.POST).withResponseType(ResponseType.VP_TOKEN, PropertyTarget.REQUEST_OBJECT).withSupportedVersions(rpOpts.supportedVersions ?? [
-    SupportedVersion.JWT_VC_PRESENTATION_PROFILE_v1,
-    SupportedVersion.SIOPv2_ID1,
-    SupportedVersion.SIOPv2_D11
+    SupportedVersion.OID4VP_v1,
+    SupportedVersion.SIOPv2_OID4VP_D28
   ]).withEventEmitter(eventEmitter).withSessionManager(rpOpts.sessionManager ?? new InMemoryRPSessionManager(eventEmitter)).withClientMetadata(rpOpts.clientMetadataOpts ?? defaultClientMetadata, PropertyTarget.REQUEST_OBJECT).withVerifyJwtCallback(rpOpts.verifyJwtCallback ? rpOpts.verifyJwtCallback : getVerifyJwtCallback({
     resolver,
     verifyOpts: {
       wellknownDIDVerifyCallback: getWellKnownDIDVerifyCallback(rpOpts.identifierOpts, context),
       checkLinkedDomain: "if_present"
     }
-  }, context)).withRevocationVerification(RevocationVerification.NEVER).withPresentationVerification(getPresentationVerificationCallback(identifierOpts.idOpts, context));
+  }, context)).withDcqlQueryLookup(getDcqlQueryLookupCallback(context)).withRevocationVerification(RevocationVerification.NEVER).withPresentationVerification(getPresentationVerificationCallback(identifierOpts.idOpts, context));
   const oidfOpts = identifierOpts.oidfOpts;
   if (oidfOpts && isExternalIdentifierOIDFEntityIdOpts(oidfOpts)) {
-    builder.withEntityId(oidfOpts.identifier, PropertyTarget.REQUEST_OBJECT).withClientIdScheme("entity_id", PropertyTarget.REQUEST_OBJECT);
+    builder.withEntityId(oidfOpts.identifier, PropertyTarget.REQUEST_OBJECT);
   } else {
     const resolution = await context.agent.identifierManagedGet(identifierOpts.idOpts);
-    builder.withClientId(resolution.issuer ?? (isManagedIdentifierDidResult(resolution) ? resolution.did : resolution.jwkThumbprint), PropertyTarget.REQUEST_OBJECT).withClientIdScheme(resolution.clientIdScheme ?? identifierOpts.idOpts.clientIdScheme, PropertyTarget.REQUEST_OBJECT);
+    const clientId = rpOpts.clientMetadataOpts?.client_id ?? resolution.issuer ?? (isManagedIdentifierDidResult(resolution) ? resolution.did : resolution.jwkThumbprint);
+    const clientIdPrefixed = prefixClientId(clientId);
+    builder.withClientId(clientIdPrefixed, PropertyTarget.REQUEST_OBJECT);
   }
   if (hasher) {
     builder.withHasher(hasher);
   }
-  if (definition) {
-    builder.withPresentationDefinition({
-      definition
-    }, PropertyTarget.REQUEST_OBJECT);
-  }
-  if (dcqlQuery) {
-    builder.withDcqlQuery(dcqlQuery);
-  }
   if (rpOpts.responseRedirectUri) {
     builder.withResponseRedirectUri(rpOpts.responseRedirectUri);
   }
@@ -572,6 +569,13 @@ function getSigningAlgo(type) {
   }
 }
 __name(getSigningAlgo, "getSigningAlgo");
+function prefixClientId(clientId) {
+  if (clientId.startsWith("did:")) {
+    return `${ClientIdentifierPrefix.DECENTRALIZED_IDENTIFIER}:${clientId}`;
+  }
+  return clientId;
+}
+__name(prefixClientId, "prefixClientId");
 
 // src/RPInstance.ts
 import { v4 as uuidv4 } from "uuid";
@@ -581,17 +585,16 @@ var RPInstance = class {
     __name(this, "RPInstance");
   }
   _rp;
-  _pexOptions;
+  _presentationOptions;
   _rpOptions;
   constructor({ rpOpts, pexOpts }) {
     this._rpOptions = rpOpts;
-    this._pexOptions = pexOpts;
+    this._presentationOptions = pexOpts;
   }
   async get(context) {
     if (!this._rp) {
       const builder = await createRPBuilder({
         rpOpts: this._rpOptions,
-        pexOpts: this._pexOptions,
         context
       });
       this._rp = builder.build();
@@ -601,23 +604,11 @@ var RPInstance = class {
   get rpOptions() {
     return this._rpOptions;
   }
-  get pexOptions() {
-    return this._pexOptions;
-  }
-  hasDefinition() {
-    return this.definitionId !== void 0;
-  }
-  get definitionId() {
-    return this.pexOptions?.definitionId;
-  }
-  async getPresentationDefinition(context) {
-    return this.definitionId ? await context.agent.pexStoreGetDefinition({
-      definitionId: this.definitionId,
-      tenantId: this.pexOptions?.tenantId
-    }) : void 0;
+  get presentationOptions() {
+    return this._presentationOptions;
   }
   async createAuthorizationRequestURI(createArgs, context) {
-    const { correlationId, claims, requestByReferenceURI, responseURI, responseURIType } = createArgs;
+    const { correlationId, queryId, claims, requestByReferenceURI, responseURI, responseURIType, callback, responseRedirectURI } = createArgs;
     const nonce = createArgs.nonce ?? uuidv4();
     const state = createArgs.state ?? correlationId;
     let jwtIssuer;
@@ -645,17 +636,20 @@ var RPInstance = class {
     return await this.get(context).then((rp) => rp.createAuthorizationRequestURI({
       version: getRequestVersion(this.rpOptions),
       correlationId,
+      queryId,
       nonce,
       state,
       claims,
       requestByReferenceURI,
       responseURI,
       responseURIType,
-      jwtIssuer
+      jwtIssuer,
+      callback,
+      responseRedirectURI
     }));
   }
   async createAuthorizationRequest(createArgs, context) {
-    const { correlationId, claims, requestByReferenceURI, responseURI, responseURIType } = createArgs;
+    const { correlationId, claims, requestByReferenceURI, responseURI, responseURIType, responseRedirectURI } = createArgs;
     const nonce = createArgs.nonce ?? uuidv4();
     const state = createArgs.state ?? correlationId;
     const idOpts = this.rpOptions.identifierOpts.idOpts;
@@ -686,13 +680,13 @@ var RPInstance = class {
       requestByReferenceURI,
       responseURIType,
       responseURI,
-      jwtIssuer
+      jwtIssuer,
+      responseRedirectURI
     }));
   }
 };
 
 // src/agent/SIOPv2RP.ts
-import { shaHasher as defaultHasher2 } from "@sphereon/ssi-sdk.core";
 var SIOPv2RP = class _SIOPv2RP {
   static {
     __name(this, "SIOPv2RP");
@@ -700,7 +694,7 @@ var SIOPv2RP = class _SIOPv2RP {
   opts;
   static _DEFAULT_OPTS_KEY = "_default";
   instances = /* @__PURE__ */ new Map();
-  schema = schema.IDidAuthSiopOpAuthenticator;
+  schema = plugin_schema_default.IDidAuthSiopOpAuthenticator;
   methods = {
     siopCreateAuthRequestURI: this.createAuthorizationRequestURI.bind(this),
     siopCreateAuthRequestPayloads: this.createAuthorizationRequestPayloads.bind(this),
@@ -730,53 +724,72 @@ var SIOPv2RP = class _SIOPv2RP {
   }
   async createAuthorizationRequestURI(createArgs, context) {
     return await this.getRPInstance({
-      definitionId: createArgs.definitionId,
-      responseRedirectURI: createArgs.responseRedirectURI
+      createWhenNotPresent: true,
+      responseRedirectURI: createArgs.responseRedirectURI,
+      ...createArgs.useQueryIdInstance === true && {
+        queryId: createArgs.queryId
+      }
     }, context).then((rp) => rp.createAuthorizationRequestURI(createArgs, context)).then((URI) => URI.encodedUri);
   }
   async createAuthorizationRequestPayloads(createArgs, context) {
     return await this.getRPInstance({
-      definitionId: createArgs.definitionId
+      createWhenNotPresent: true,
+      queryId: createArgs.queryId
     }, context).then((rp) => rp.createAuthorizationRequest(createArgs, context)).then(async (request) => {
       const authRequest = {
         authorizationRequest: request.payload,
         requestObject: await request.requestObjectJwt(),
-        requestObjectDecoded: await request.requestObject?.getPayload()
+        requestObjectDecoded: request.requestObject?.getPayload()
       };
       return authRequest;
     });
   }
   async siopGetRequestState(args, context) {
     return await this.getRPInstance({
-      definitionId: args.definitionId
+      createWhenNotPresent: false,
+      queryId: args.queryId
     }, context).then((rp) => rp.get(context).then((rp2) => rp2.sessionManager.getRequestStateByCorrelationId(args.correlationId, args.errorOnNotFound)));
   }
   async siopGetResponseState(args, context) {
     const rpInstance = await this.getRPInstance({
-      definitionId: args.definitionId
+      createWhenNotPresent: false,
+      queryId: args.queryId
     }, context);
     const authorizationResponseState = await rpInstance.get(context).then((rp) => rp.sessionManager.getResponseStateByCorrelationId(args.correlationId, args.errorOnNotFound));
     if (authorizationResponseState === void 0) {
       return void 0;
     }
     const responseState = authorizationResponseState;
-    if (responseState.status === AuthorizationResponseStateStatus.VERIFIED && args.includeVerifiedData && args.includeVerifiedData !== VerifiedDataMode.NONE) {
+    if (responseState.status === AuthorizationResponseStateStatus.VERIFIED) {
       let hasher;
       if (CredentialMapper2.isSdJwtEncoded(responseState.response.payload.vp_token) && (!rpInstance.rpOptions.credentialOpts?.hasher || typeof rpInstance.rpOptions.credentialOpts?.hasher !== "function")) {
         hasher = defaultHasher2;
       }
-      const presentationDecoded = CredentialMapper2.decodeVerifiablePresentation(
-        responseState.response.payload.vp_token,
-        //todo: later we want to conditionally pass in options for mdl-mdoc here
-        hasher
-      );
-      switch (args.includeVerifiedData) {
-        case VerifiedDataMode.VERIFIED_PRESENTATION:
-          responseState.response.payload.verifiedData = this.presentationOrClaimsFrom(presentationDecoded);
-          break;
-        case VerifiedDataMode.CREDENTIAL_SUBJECT_FLATTENED:
-          const allClaims = {};
-          for (const credential of this.presentationOrClaimsFrom(presentationDecoded).verifiableCredential || []) {
+      const vpToken = responseState.response.payload.vp_token && JSON.parse(responseState.response.payload.vp_token);
+      const claims = [];
+      for (const [credentialQueryId, presentationValue] of Object.entries(vpToken)) {
+        let singleVP;
+        if (Array.isArray(presentationValue)) {
+          if (presentationValue.length === 0) {
+            throw Error(`DCQL query '${credentialQueryId}' has empty array of presentations`);
+          }
+          if (presentationValue.length > 1) {
+            throw Error(`DCQL query '${credentialQueryId}' has multiple presentations (${presentationValue.length}), but only one is supported atm`);
+          }
+          singleVP = presentationValue[0];
+        } else {
+          singleVP = presentationValue;
+        }
+        const presentationDecoded = CredentialMapper2.decodeVerifiablePresentation(
+          singleVP,
+          //todo: later we want to conditionally pass in options for mdl-mdoc here
+          hasher
+        );
+        console.log(`presentationDecoded: ${JSON.stringify(presentationDecoded)}`);
+        const allClaims = {};
+        const presentationOrClaims = this.presentationOrClaimsFrom(presentationDecoded);
+        if ("verifiableCredential" in presentationOrClaims) {
+          for (const credential of presentationOrClaims.verifiableCredential) {
             const vc = credential;
             const schemaValidationResult = await context.agent.cvVerifySchema({
               credential,
@@ -797,20 +810,43 @@ var SIOPv2RP = class _SIOPv2RP {
                 allClaims[key] = value;
               }
             });
+            claims.push({
+              id: credentialQueryId,
+              type: vc.type[0],
+              claims: allClaims
+            });
           }
-          responseState.verifiedData = allClaims;
-          break;
+        } else {
+          claims.push({
+            id: credentialQueryId,
+            type: presentationDecoded.decodedPayload.vct,
+            claims: presentationOrClaims
+          });
+        }
       }
+      responseState.verifiedData = {
+        ...responseState.response.payload.vp_token && {
+          authorization_response: {
+            vp_token: typeof responseState.response.payload.vp_token === "string" ? JSON.parse(responseState.response.payload.vp_token) : responseState.response.payload.vp_token
+          }
+        },
+        ...claims.length > 0 && {
+          credential_claims: claims
+        }
+      };
     }
     return responseState;
   }
-  presentationOrClaimsFrom = /* @__PURE__ */ __name((presentationDecoded) => CredentialMapper2.isSdJwtDecodedCredential(presentationDecoded) ? presentationDecoded.decodedPayload : CredentialMapper2.toUniformPresentation(presentationDecoded), "presentationOrClaimsFrom");
+  presentationOrClaimsFrom = /* @__PURE__ */ __name((presentationDecoded) => {
+    return CredentialMapper2.isSdJwtDecodedCredential(presentationDecoded) ? presentationDecoded.decodedPayload : CredentialMapper2.toUniformPresentation(presentationDecoded);
+  }, "presentationOrClaimsFrom");
   async siopUpdateRequestState(args, context) {
-    if (args.state !== "sent") {
-      throw Error(`Only 'sent' status is supported for this method at this point`);
+    if (args.state !== "authorization_request_created") {
+      throw Error(`Only 'authorization_request_created' status is supported for this method at this point`);
     }
     return await this.getRPInstance({
-      definitionId: args.definitionId
+      createWhenNotPresent: false,
+      queryId: args.queryId
     }, context).then((rp) => rp.get(context).then(async (rp2) => {
       await rp2.signalAuthRequestRetrieved({
         correlationId: args.correlationId,
@@ -821,7 +857,8 @@ var SIOPv2RP = class _SIOPv2RP {
   }
   async siopDeleteState(args, context) {
     return await this.getRPInstance({
-      definitionId: args.definitionId
+      createWhenNotPresent: false,
+      queryId: args.queryId
     }, context).then((rp) => rp.get(context).then((rp2) => rp2.sessionManager.deleteStateForCorrelationId(args.correlationId))).then(() => true);
   }
   async siopVerifyAuthResponse(args, context) {
@@ -830,29 +867,27 @@ var SIOPv2RP = class _SIOPv2RP {
     }
     const authResponse = typeof args.authorizationResponse === "string" ? decodeUriAsJson(args.authorizationResponse) : args.authorizationResponse;
     return await this.getRPInstance({
-      definitionId: args.definitionId
+      createWhenNotPresent: false,
+      queryId: args.queryId
     }, context).then((rp) => rp.get(context).then((rp2) => rp2.verifyAuthorizationResponse(authResponse, {
       correlationId: args.correlationId,
-      ...args.dcqlQuery ? {
+      ...args.dcqlQuery && {
         dcqlQuery: args.dcqlQuery
-      } : {},
+      },
       audience: args.audience
     })));
   }
   async siopImportDefinitions(args, context) {
-    const { definitions, tenantId, version, versionControlMode } = args;
-    await Promise.all(definitions.map(async (definitionPair) => {
-      const definitionPayload = definitionPair.definitionPayload;
-      await context.agent.pexValidateDefinition({
-        definition: definitionPayload
-      });
-      console.log(`persisting definition ${definitionPayload.id} / ${definitionPayload.name} with versionControlMode ${versionControlMode}`);
+    const { importItems, tenantId, version, versionControlMode } = args;
+    await Promise.all(importItems.map(async (importItem) => {
+      DcqlQuery.validate(importItem.query);
+      console.log(`persisting DCQL definition ${importItem.queryId} with versionControlMode ${versionControlMode}`);
       return context.agent.pdmPersistDefinition({
         definitionItem: {
+          queryId: importItem.queryId,
           tenantId,
           version,
-          definitionPayload,
-          dcqlPayload: definitionPair.dcqlPayload
+          query: importItem.query
         },
         opts: {
           versionControlMode
@@ -861,12 +896,12 @@ var SIOPv2RP = class _SIOPv2RP {
     }));
   }
   async siopGetRedirectURI(args, context) {
-    const instanceId = args.definitionId ?? _SIOPv2RP._DEFAULT_OPTS_KEY;
+    const instanceId = args.queryId ?? _SIOPv2RP._DEFAULT_OPTS_KEY;
     if (this.instances.has(instanceId)) {
       const rpInstance = this.instances.get(instanceId);
       if (rpInstance !== void 0) {
         const rp = await rpInstance.get(context);
-        return rp.getResponseRedirectUri({
+        return await rp.getResponseRedirectUri({
           correlation_id: args.correlationId,
           correlationId: args.correlationId,
           ...args.state && {
@@ -877,12 +912,40 @@ var SIOPv2RP = class _SIOPv2RP {
     }
     return void 0;
   }
-  async getRPInstance({ definitionId, responseRedirectURI }, context) {
-    const instanceId = definitionId ?? _SIOPv2RP._DEFAULT_OPTS_KEY;
-    if (!this.instances.has(instanceId)) {
-      const instanceOpts = this.getInstanceOpts(definitionId);
+  async getRPInstance({ createWhenNotPresent, queryId, responseRedirectURI }, context) {
+    let rpInstanceId = _SIOPv2RP._DEFAULT_OPTS_KEY;
+    let rpInstance;
+    if (queryId) {
+      if (this.instances.has(queryId)) {
+        rpInstanceId = queryId;
+        rpInstance = this.instances.get(rpInstanceId);
+      } else if (isValidUUID2(queryId)) {
+        try {
+          const pd = await context.agent.pdmGetDefinition({
+            itemId: queryId
+          });
+          if (this.instances.has(pd.queryId)) {
+            rpInstanceId = pd.queryId;
+            rpInstance = this.instances.get(rpInstanceId);
+          }
+        } catch (ignore) {
+        }
+      }
+      if (createWhenNotPresent) {
+        rpInstanceId = queryId;
+      } else {
+        rpInstance = this.instances.get(rpInstanceId);
+      }
+    } else {
+      rpInstance = this.instances.get(rpInstanceId);
+    }
+    if (!rpInstance) {
+      if (!createWhenNotPresent) {
+        return Promise.reject(`No RP instance found for key ${rpInstanceId}`);
+      }
+      const instanceOpts = this.getInstanceOpts(queryId);
       const rpOpts = await this.getRPOptions(context, {
-        definitionId,
+        queryId,
         responseRedirectURI
       });
       if (!rpOpts.identifierOpts.resolveOpts?.resolver || typeof rpOpts.identifierOpts.resolveOpts.resolver.resolve !== "function") {
@@ -894,29 +957,29 @@ var SIOPv2RP = class _SIOPv2RP {
             ...rpOpts.identifierOpts.resolveOpts
           };
         }
-        console.log("Using agent DID resolver for RP instance with definition id " + definitionId);
+        console.log("Using agent DID resolver for RP instance with definition id " + queryId);
         rpOpts.identifierOpts.resolveOpts.resolver = getAgentResolver2(context, {
           uniresolverResolution: true,
           localResolution: true,
           resolverResolution: true
         });
       }
-      this.instances.set(instanceId, new RPInstance({
+      rpInstance = new RPInstance({
         rpOpts,
         pexOpts: instanceOpts
-      }));
+      });
+      this.instances.set(rpInstanceId, rpInstance);
     }
-    const rpInstance = this.instances.get(instanceId);
     if (responseRedirectURI) {
       rpInstance.rpOptions.responseRedirectUri = responseRedirectURI;
     }
     return rpInstance;
   }
   async getRPOptions(context, opts) {
-    const { definitionId, responseRedirectURI } = opts;
-    const options = this.getInstanceOpts(definitionId)?.rpOpts ?? this.opts.defaultOpts;
+    const { queryId, responseRedirectURI } = opts;
+    const options = this.getInstanceOpts(queryId)?.rpOpts ?? this.opts.defaultOpts;
     if (!options) {
-      throw Error(`Could not get specific nor default options for definition ${definitionId}`);
+      throw Error(`Could not get specific nor default options for definition ${queryId}`);
     }
     if (this.opts.defaultOpts) {
       if (!options.identifierOpts) {
@@ -948,40 +1011,28 @@ var SIOPv2RP = class _SIOPv2RP {
     }
     return options;
   }
-  getInstanceOpts(definitionId) {
+  getInstanceOpts(queryId) {
     if (!this.opts.instanceOpts) return void 0;
-    const instanceOpt = definitionId ? this.opts.instanceOpts.find((i) => i.definitionId === definitionId) : void 0;
-    return instanceOpt ?? this.getDefaultOptions(definitionId);
+    const instanceOpt = queryId ? this.opts.instanceOpts.find((i) => i.queryId === queryId) : void 0;
+    return instanceOpt ?? this.getDefaultOptions(queryId);
   }
-  getDefaultOptions(definitionId) {
+  getDefaultOptions(queryId) {
     if (!this.opts.instanceOpts) return void 0;
-    const defaultOptions = this.opts.instanceOpts.find((i) => i.definitionId === "default");
+    const defaultOptions = this.opts.instanceOpts.find((i) => i.queryId === "default");
     if (defaultOptions) {
       const clonedOptions = {
         ...defaultOptions
       };
-      if (definitionId !== void 0) {
-        clonedOptions.definitionId = definitionId;
+      if (queryId !== void 0) {
+        clonedOptions.queryId = queryId;
       }
       return clonedOptions;
     }
     return void 0;
   }
 };
-
-// src/types/ISIOPv2RP.ts
-var VerifiedDataMode = /* @__PURE__ */ function(VerifiedDataMode2) {
-  VerifiedDataMode2["NONE"] = "none";
-  VerifiedDataMode2["VERIFIED_PRESENTATION"] = "vp";
-  VerifiedDataMode2["CREDENTIAL_SUBJECT_FLATTENED"] = "cs-flat";
-  return VerifiedDataMode2;
-}({});
-
-// src/index.ts
-var schema = require_plugin_schema();
 export {
   SIOPv2RP,
-  VerifiedDataMode,
-  schema
+  plugin_schema_default as schema
 };
 //# sourceMappingURL=index.js.map