Support vp_token values that are credential response objects.

Author: dlongley

CHANGELOG.md

@@ -1,5 +1,11 @@
 # @digitalbazaar/oid4-client Changelog
 
+## 5.11.0 - 2026-mm-dd
+
+### Added
+- Support parsing `vp_token` values that are DCQL credential response
+  wrappers.
+
 ## 5.10.0 - 2026-03-30
 
 ### Added

lib/oid4vp/verifier.js

@@ -1,10 +1,11 @@
 /*!
- * Copyright (c) 2023-2026 Digital Bazaar, Inc. All rights reserved.
+ * Copyright (c) 2023-2026 Digital Bazaar, Inc.
  */
 import * as base64url from 'base64url-universal';
 import {createNamedError, parseJSON} from '../util.js';
 import {calculateJwkThumbprint} from 'jose';
 import {decryptAnnexCResponse} from './mdl.js';
+import {isObject} from '../query/util.js';
 import {decrypt as jwtDecrypt} from './jwt.js';
 
 // start of JSON object, array, or string
@@ -68,33 +69,48 @@ export async function parseAuthorizationResponse({
 
   // if payload is set but not a Uint8Array (ISO 18013-7 Annex C case)...
   if(payload && !(payload instanceof Uint8Array)) {
-    // `vp_token` is either:
+    // `vp_token` may be an already parsed object with keys that identify
+    // credential response query IDs and values that are arrays with one
+    // or more corresponding presentations; in this case we remove this wrapper
+    // and we presently assume a single query was responded to with a single
+    // presentation
+    const {vp_token} = payload;
+    let vpToken;
+    if(isObject(vp_token)) {
+      const keys = Object.keys(vp_token);
+      if(keys.length > 0) {
+        vpToken = vp_token[keys[0]]?.[0];
+      }
+    } else {
+      vpToken = vp_token;
+    }
+
+    // `vpToken` is either:
     // 1. a JSON object (a VP)
     // 2. a JSON array (of something; unknown media type)
     // 3. a JSON string (a quoted JWT: "<JWT>")
     // 4. a JWT (starts with 'ey'...)
     // 5. a base64url-encoded mDL device response
     // 6. unknown
-    const {vp_token} = payload;
-    if(typeof vp_token === 'string') {
-      if(VP_TOKEN_JSON_PREFIXES.has(vp_token[0])) {
+    if(typeof vpToken === 'string') {
+      if(VP_TOKEN_JSON_PREFIXES.has(vpToken[0])) {
         // cases: 1-3 - JSON
-        parsed.vpToken = parseJSON(vp_token, 'vp_token');
+        parsed.vpToken = parseJSON(vpToken, 'vp_token');
         if(typeof parsed.vpToken === 'string') {
           vpTokenMediaType = 'application/jwt';
         } else if(!Array.isArray(parsed.vpToken)) {
           vpTokenMediaType = 'application/vp';
         }
       } else {
         // cases 4-5: JWT or mDL device response
-        parsed.vpToken = vp_token;
+        parsed.vpToken = vpToken;
         // if does not look like a JWT, assume mDL device response
-        vpTokenMediaType = vp_token.startsWith('ey') ?
+        vpTokenMediaType = vpToken.startsWith('ey') ?
           'application/jwt' : 'application/mdl-vp-token';
       }
     } else {
       // unknown case
-      parsed.vpToken = vp_token;
+      parsed.vpToken = vpToken;
     }
   }