pub const RESPONSE_TYPE_VP_TOKEN: &str;

pub const RESPONSE_MODE_DIRECT_POST: &str;

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct PresentationDefinition {
/// Unique identifier for this definition.

pub id: String,
/// Optional human-readable name (shown to the holder during consent).

#[serde(skip_serializing_if = "Option::is_none")]
pub name: Option<String>,
/// Optional human-readable purpose explaining why the verifier needs

/// the credentials.

#[serde(skip_serializing_if = "Option::is_none")]
pub purpose: Option<String>,
/// One or more input descriptors, each describing a credential the

/// verifier requires.

pub input_descriptors: Vec<InputDescriptor>
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct InputDescriptor {
/// Unique identifier for this descriptor (the holder's

/// [`DescriptorMap`] entries reference it by ID).

pub id: String,
/// Optional name shown to the holder.

#[serde(skip_serializing_if = "Option::is_none")]
pub name: Option<String>,
/// Optional human-readable purpose.

#[serde(skip_serializing_if = "Option::is_none")]
pub purpose: Option<String>,
/// Constraints — field path expressions and filters the credential

/// must satisfy.

#[serde(default, skip_serializing_if = "Constraints::is_empty")]
pub constraints: Constraints
}

#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
pub struct Constraints {
/// One or more required field path expressions and filters.

#[serde(default, skip_serializing_if = "Vec::is_empty")]
pub fields: Vec<InputField>
}

pub fn is_empty(&self) -> bool;

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct InputField {
/// JSONPath expressions pointing to candidate locations in the credential.

pub path: Vec<String>,
/// Optional human-readable purpose.

#[serde(skip_serializing_if = "Option::is_none")]
pub purpose: Option<String>,
/// Optional JSON Schema filter the resolved value must satisfy.

#[serde(skip_serializing_if = "Option::is_none")]
pub filter: Option<serde_json::Value>
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct AuthorizationRequest {
/// OAuth 2.0 `response_type` — fixed to `"vp_token"` for OID4VP.

pub response_type: String,
/// OAuth 2.0 `response_mode` — typically `"direct_post"` for OID4VP.

pub response_mode: String,
/// Verifier identifier (audience). Becomes `proof.domain` on the

/// holder's signed presentation. MUST be cross-checked at verify time.

pub client_id: String,
/// Verifier-supplied nonce. Becomes `proof.challenge` on the holder's

/// signed presentation. MUST be cross-checked at verify time.

pub nonce: String,
/// Optional opaque state echoed back unchanged in the response.

#[serde(skip_serializing_if = "Option::is_none")]
pub state: Option<String>,
/// The presentation definition the holder must satisfy.

pub presentation_definition: PresentationDefinition
}

pub fn create_authorization_request(
    definition: PresentationDefinition,
    nonce: impl Into<String>,
    client_id: impl Into<String>,
) -> AuthorizationRequest;

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct PresentationSubmission {
/// Unique identifier for this submission.

pub id: String,
/// Identifier of the presentation definition this submission satisfies.

pub definition_id: String,
/// One descriptor map entry per credential in `vp_token`.

pub descriptor_map: Vec<DescriptorMap>
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct DescriptorMap {
/// Identifier of the [`InputDescriptor`] this credential satisfies.

pub id: String,
/// Proof format identifier from the OAS Spec §14.4 registry. Verifiers

/// route the credential to the matching verification routine based on

/// this value.

pub format: String,
/// JSONPath expression pointing to the credential within the `vp_token`.

/// `"$"` means the entire `vp_token` IS the credential (single-credential

/// case).

pub path: String
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Oid4vpResponse {
/// The signed [`OasPresentation`] (or, for non-OAS formats, an opaque

/// JSON value). For OAS attestation flows this is the W3C VP from

/// [`crate::presentation::sign_presentation`].

pub vp_token: serde_json::Value,
/// Submission map — one entry per credential in `vp_token`.

pub presentation_submission: PresentationSubmission,
/// Echoed `state` from the request, if the request included one.

#[serde(skip_serializing_if = "Option::is_none")]
pub state: Option<String>
}

pub fn create_oid4vp_response(
    request: &AuthorizationRequest,
    presentation: OasPresentation,
    descriptor_map: Vec<DescriptorMap>,
) -> Result<Oid4vpResponse, AttestationError>;

pub fn verify_oid4vp_response(
    response: &Oid4vpResponse,
    request: &AuthorizationRequest,
    holder_public_key: &[u8],
) -> Result<OasPresentation, AttestationError>;