Digital Credentials Harmonized Presentation - Editor's Copy

; ==========================================
; TOP-LEVEL REQUEST
; ==========================================

CredentialRequest = {
  payload:        1 => bstr,      ; CBOR-encoded RequestPayload
  ? reader_auth:  2 => COSE_Sign, ; Optional reader authentication (detached payload)
  * int => any                    ; RFU extensions
}

RequestPayload = {
  ScenarioSets:                     1 => { + ScenarioRef => ScenarioSet },
  CredentialQueries:                2 => { + CredentialRef => CredentialQuery },
  ? encryption_context:             3 => EncryptionContext,
  ? additional_encryption_contexts: 4 => { + int => EncryptionContext },
  * int => any                      ; RFU extensions
}

ScenarioRef   = int
CredentialRef = int

; ==========================================
; ENCRYPTION PARAMETERS
; ==========================================

EncryptionContext = {
  key:        1 => COSE_Key,
  nonce:      2 => bstr,
  algorithms: 3 => [ + int ],     ; COSE algorithm identifiers (e.g. HPKE ciphersuites)
  * int / tstr => any             ; RFU / application-specific extensions
}

; ==========================================
; SCENARIO SETS
; ==========================================

ScenarioSet = {
  mandatory:    1 => bool,
  combinations: 2 => [ + CredentialCombination ],
  purpose_id:   3 => [ controlled_id: tstr, + int ],
  ? extensions: 4 => { * int / tstr => any }, ; int = RFU, tstr = application-specific
  * int => any                    ; RFU extensions
}

CredentialCombination = [ + CredentialRef ]

; ==========================================
; CREDENTIAL QUERIES & EXTENSIONS
; ==========================================

CredentialQuery = {
  credential_format:    1 => tstr,
  credential_type:      2 => tstr,
  elements_dict:        3 => { + ElementRef => DataElementDef },
  requested_elements:   4 => ElementLogic,
  ? general_extensions: 5 => generalExtensions,
  ? format_extensions:  6 => formatExtensions,
  ? encryption_ref:     7 => int,   ; Key into additional_encryption_contexts; absent = use main
  * int => any                      ; RFU extensions
}

generalExtensions = {
  ? issuer_identifiers:               1 => IssuerIdentifiers,
  ? allow_multiple:                   2 => bool,
  ? credential_auth_data:             3 => { + int / tstr => any },
  ? support_no_cryptographic_binding: 4 => bool,
  * int / tstr => any             ; int = RFU, tstr = application-specific
}

formatExtensions = mdocExtensions / sdjwtExtensions / zkFormatExtensions

mdocExtensions = {
  ? issuer_alg_values: 1 => [ + int ],
  ? device_alg_values: 2 => [ + int ],
  * int / tstr => any             ; int = RFU, tstr = application-specific
}

sdjwtExtensions = {
  ? sd-jwt_alg_values: 1 => [ + tstr ],
  ? kb-jwt_alg_values: 2 => [ + tstr ],
  * int / tstr => any             ; int = RFU, tstr = application-specific
}

IssuerIdentifiers = {
  ? x509_ref: 1 => [ + bstr ],
  * int / tstr => [ + any ]       ; int = RFU, tstr = application-specific
}

; ==========================================
; DATA ELEMENTS & LOGIC
; ==========================================

ElementRef = int

DataElementDef = {
  path:               1 => [ + tstr ],
  ? value_match:      2 => any,
  intent_to_retain:   3 => bool,
  * int => any                    ; RFU extensions
}

; Conjunctive Normal Form (CNF): AND of OR of AND
ElementLogic = [ + OrGroup ]    ; Level 1 (AND): All OrGroups must be satisfied
OrGroup      = [ + AndGroup ]   ; Level 2 (OR):  At least one AndGroup must be satisfied
AndGroup     = [ + ElementRef ] ; Level 3 (AND): All referenced elements must be provided

; ==========================================
; TRANSACTION TRANSCRIPTS
; Deterministic CBOR encoding (RFC 8949 §4.2) is REQUIRED for all transcript values.
; ==========================================

; Used by the verifier: for reader authentication and as info parameter for response encryption.
ReaderTransactionTranscript = {
  request_hash:    1 => bstr,          ; SHA-256 of CBOR-encoded RequestPayload bytes
  channel_binding: 2 => ChannelBinding,
  * int / tstr => any                  ; RFU / application-specific extensions
}

; Used by the wallet: for mdoc device authentication, SD-JWT KB-JWT nonce, and response encryption.
; Includes the encryption_ref from the CredentialQuery for the credential being presented.
WalletTransactionTranscript = {
  request_hash:         1 => bstr,          ; Same value as in ReaderTransactionTranscript
  channel_binding:      2 => ChannelBinding,
  ? encryption_context: 3 => int,           ; The encryption_ref from CredentialQuery;
                                            ; absent when no application-layer encryption is used
  * int / tstr => any                       ; RFU / application-specific extensions
}

; ==========================================
; CHANNEL BINDING
; At most one engagement field and at most one transmission field are present per session.
; ==========================================

ChannelBinding = {
  ; --- Engagement fields (keys 1–9) ---
  ; Capture how the credential request was initiated.
  ? qr_device_engagement:              1 => bstr,  ; 18013-5 QR:              CBOR-encoded DeviceEngagement
  ? reverse_qr_device_engagement:      2 => bstr,  ; 18013-5 Reverse QR:      CBOR-encoded DeviceEngagement
  ? nfc_static_handover_engagement:    3 => bstr,  ; 18013-5 NFC static:      CBOR-encoded DeviceEngagement
  ? nfc_negotiated_handover_engagement: 4 => bstr, ; 18013-5 NFC negotiated:  CBOR-encoded DeviceEngagement
  ? oidc4vp_request_uri:               5 => tstr,  ; OID4VP:                  request_uri from the authorisation request
  ? oidc4vp_client_id:                 6 => tstr,  ; OID4VP:                  client_id from the authorisation request
  ? dc_api_origin:                     7 => tstr,  ; DC API:                  web origin (scheme://host[:port])

  ; --- Transmission fields (keys 10–19) ---
  ; Capture the data-transport channel over which the presentation is performed.
  ? ble_uuid:                 10 => bstr,           ; 18013-5 BLE (UUID):      EReaderKey bytes
  ? ble_l2cap:                11 => {               ; 18013-5 BLE L2CAP:       EReaderKey + PSM
                                   uuid: 1 => bstr, ;   Reader ephemeral public key
                                   psm:  2 => uint  ;   L2CAP Protocol/Service Multiplexer value
                                 },
  ? nfc_static_handover:      12 => bstr,           ; 18013-5 NFC static:      CBOR-encoded NFCHandover
  ? nfc_negotiated_handover:  13 => bstr,           ; 18013-5 NFC negotiated:  CBOR-encoded NFCHandover
  ? nfcv2:                    14 => bstr,           ; NFC v2:                  NFC v2 transmission data
  ? wifi_aware:               15 => bstr,           ; 18013-5 WiFi Aware:      engagement data

  * int / tstr => any                               ; RFU / application-specific extensions
}