#Holder app integration

import {
  registerCredential,
  authenticate,
  isWebAuthnSupported,
  sealHolderKey,
  openHolderKey,
  KeyPair,
} from '@owlid/sdk'

if (!isWebAuthnSupported()) throw new Error('WebAuthn not available')

// 1. Register a passkey.
const cred = await registerCredential({
  rpName: 'My Wallet',
  rpId: 'wallet.example.com',
  userName: user.email,
  userVerification: 'required',
})

// 2. Mint the wallet's holder signing key + seal its 32-byte seed with the
//    passkey PRF. Returns { blob, credentialId } — persist the blob, and the
//    credentialId it reports, which is the passkey that actually supplied the
//    PRF output (pass null to let the browser show the passkey picker).
const holderKey = KeyPair.generate()
const { blob: wrapped } = await sealHolderKey(cred.credentialId, holderKey.toHex())

// 3. Later — UV gate, then open. Returns { seedHex, credentialId }.
await authenticate({
  rpId: 'wallet.example.com',
  credentialId: cred.credentialId,
  userVerification: 'required',
})
const { seedHex: holderKeyHex } = await openHolderKey(cred.credentialId, wrapped)

import { storage, proofStorage, SdJwtVc, buildCardShape } from '@owlid/sdk'

// addCredential(credential, wrappedKey) stores the SD-JWT VC and the
// PRF-wrapped holder key together, keyed by credentialId. credentialId
// and issuer are derived from the SD-JWT VC string itself.
const parsed = SdJwtVc.parse(sdJwtVc)
await storage.addCredential(
  {
    credentialId: parsed.credentialId(), // stable id used for revocation lookups
    sdJwtVc, // application/dc+sd-jwt string
    issuer: parsed.peekIssuer(), // did:web identifier
    providerId, // IdP that drove the flow ('didit', 'google', …)
    issuedAt: new Date().toISOString(),
    holderPublicKeyHex: holderKey.publicKeyHex(), // per-credential cnf key
    verifiedClaims, // disclosed claims kept locally for the wallet UI
    cardShape: buildCardShape(providerId, verifiedClaims), // per-IdP card UI
  },
  wrapped, // the blob from sealHolderKey() — see above
)

const list = await storage.listCredentials()
const keyBlob = await storage.getCredentialKeyWrapped(parsed.credentialId())

// IndexedDB-backed proof history for the "recent proofs" UI.
await proofStorage.saveProof({
  id: crypto.randomUUID(), // fresh per generation — a reused id overwrites the row
  predicateId: 'age_over_18', // stable id, matches a stored row back to its predicate
  name: 'Acme Bar', // display name — typically the verifier it was shown to
  claim: 'age_over_18', // the claim proven
  result: true, // boolean outcome
  presentation, // the SD-JWT VC presentation string
  createdAt: new Date().toISOString(),
})

import { presentSdJwtVc } from '@owlid/sdk'

// presentSdJwtVc(sdJwtVc, holderKeyHex, disclose, { aud, nonce }) — synchronous.
// holderKeyHex is the seedHex returned by openHolderKey().
const presentation = presentSdJwtVc(
  storedCredential.sdJwtVc,
  holderKeyHex,
  ['given_name', 'age_over_18'],
  { aud: verifierOrigin, nonce: verifierNonce }, // bound into the KB-JWT
)

import { respondToPresentation, OwlWallet, openHolderKey, storage } from '@owlid/sdk'

// An OwlWallet wraps your local storage + key-unseal + passkey resolution.
// It solves the verifier's DCQL query and signs the KB-JWTs.
const wallet = new OwlWallet(
  storage,
  async (credentialId, wrapped) => (await openHolderKey(credentialId, wrapped)).seedHex,
  async () => (await storage.loadWebAuthnCredential())?.credentialId ?? null,
)

await respondToPresentation(qrPayload, {
  wallet,
  // `request` is a PresentationRequest: { verifierName, dcql, nonce, … }
  onConsent: async (request) => ui.askApprove(request.verifierName, request.dcql),
})

import { decodeSessionEngagement, isPresentationEngagement, resolveWsUrl } from '@owlid/sdk'
import type { WsMessage, PresentationRequest, PresentationResponse } from '@owlid/sdk'

if (isPresentationEngagement(qrPayload)) {
  const engagement = decodeSessionEngagement(qrPayload)
  const ws = new WebSocket(`${resolveWsUrl(engagement!.ws!.url)}?role=holder`)

  ws.onmessage = async (e) => {
    const msg: WsMessage = JSON.parse(e.data)
    if (msg.type !== 'request') return
    const request = msg.payload as PresentationRequest

    // The wallet solves the DCQL query and signs one KB-JWT per
    // credential, all bound to the verifier's audience + nonce.
    const { vpToken, used } = await wallet.present({
      dcql: request.dcql,
      aud: request.verifierName,
      nonce: request.nonce,
    })

    const response: PresentationResponse = { sessionId: request.sessionId, vpToken, used }
    ws.send(JSON.stringify({ type: 'response', payload: response } satisfies WsMessage))
  }
}

await fetch(`${verificationUrl}/openid4vp/response`, {
  method: 'POST',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  body: new URLSearchParams({ vp_token: presentation, state: requestState }),
})

import { configure } from '@owlid/sdk'

configure({
  verificationUrl: 'https://api.owlid.app',
  issuerUrl: 'https://issuer.owlid.app',
  // Opt into a hosted proof server. Without `proofServerUrl` the SDK
  // falls back to in-process WASM regardless of `provingMode`.
  provingMode: 'proof-server',
  proofServerUrl: 'https://proofs.owlid.app',
})

const wallet = new OwlWallet(storage, unwrap, resolvePasskey, {
  provingConfig: {
    mode: 'proof-server',
    url: 'https://proofs.owlid.app',
    timeout: 60_000,
  },
})