@credo-ts/openid4vc 0.6.0-pr-2195-20250322195244 → 0.6.0-pr-2324-20250625125220

package/build/openid4vc-issuer/OpenId4VcIssuerService.js

@@ -35,17 +35,17 @@ let OpenId4VcIssuerService = class OpenId4VcIssuerService {
         this.openId4VcIssuanceSessionRepository = openId4VcIssuanceSessionRepository;
     }
     async createStatelessCredentialOffer(agentContext, options) {
-        const { authorizationCodeFlowConfig, issuer, offeredCredentials } = options;
+        const { authorizationCodeFlowConfig, issuer, credentialConfigurationIds } = options;
         const vcIssuer = this.getIssuer(agentContext);
         const issuerMetadata = await this.getIssuerMetadata(agentContext, issuer);
-        const uniqueOfferedCredentials = Array.from(new Set(options.offeredCredentials));
-        if (uniqueOfferedCredentials.length !== offeredCredentials.length) {
+        const uniqueOfferedCredentials = Array.from(new Set(options.credentialConfigurationIds));
+        if (uniqueOfferedCredentials.length !== credentialConfigurationIds.length) {
             throw new core_1.CredoError('All offered credentials must have unique ids.');
         }
         // Check if all the offered credential configuration ids have a scope value. If not, it won't be possible to actually request
         // issuance of the credential later on
         (0, openid4vci_1.extractScopesForCredentialConfigurationIds)({
-            credentialConfigurationIds: options.offeredCredentials,
+            credentialConfigurationIds: options.credentialConfigurationIds,
             issuerMetadata,
             throwOnConfigurationWithoutScope: true,
         });
@@ -53,7 +53,7 @@ let OpenId4VcIssuerService = class OpenId4VcIssuerService {
             throw new core_1.CredoError('Stateless offers can only be created for external authorization servers. Make sure to configure an external authorization server on the issuer record, and provide the authoriation server url.');
         }
         const { credentialOffer, credentialOfferObject } = await vcIssuer.createCredentialOffer({
-            credentialConfigurationIds: options.offeredCredentials,
+            credentialConfigurationIds: options.credentialConfigurationIds,
             grants: {
                 authorization_code: {
                     authorization_server: authorizationCodeFlowConfig.authorizationServerUrl,
@@ -68,14 +68,14 @@ let OpenId4VcIssuerService = class OpenId4VcIssuerService {
         };
     }
     async createCredentialOffer(agentContext, options) {
-        const { preAuthorizedCodeFlowConfig, authorizationCodeFlowConfig, issuer, offeredCredentials, version = 'v1.draft11-13', } = options;
+        const { preAuthorizedCodeFlowConfig, authorizationCodeFlowConfig, issuer, credentialConfigurationIds, version = 'v1.draft11-15', authorization, } = options;
         if (!preAuthorizedCodeFlowConfig && !authorizationCodeFlowConfig) {
             throw new core_1.CredoError('Authorization Config or Pre-Authorized Config must be provided.');
         }
         const vcIssuer = this.getIssuer(agentContext);
         const issuerMetadata = await this.getIssuerMetadata(agentContext, issuer);
-        const uniqueOfferedCredentials = Array.from(new Set(options.offeredCredentials));
-        if (uniqueOfferedCredentials.length !== offeredCredentials.length) {
+        const uniqueOfferedCredentials = Array.from(new Set(options.credentialConfigurationIds));
+        if (uniqueOfferedCredentials.length !== credentialConfigurationIds.length) {
             throw new core_1.CredoError('All offered credentials must have unique ids.');
         }
         if (uniqueOfferedCredentials.length === 0) {
@@ -91,7 +91,7 @@ let OpenId4VcIssuerService = class OpenId4VcIssuerService {
         // issuance of the credential later on. For pre-auth it's not needed to add a scope.
         if (options.authorizationCodeFlowConfig) {
             (0, openid4vci_1.extractScopesForCredentialConfigurationIds)({
-                credentialConfigurationIds: options.offeredCredentials,
+                credentialConfigurationIds: options.credentialConfigurationIds,
                 issuerMetadata,
                 throwOnConfigurationWithoutScope: true,
             });
@@ -102,12 +102,12 @@ let OpenId4VcIssuerService = class OpenId4VcIssuerService {
             authorizationCodeFlowConfig,
         });
         const { credentialOffer, credentialOfferObject } = await vcIssuer.createCredentialOffer({
-            credentialConfigurationIds: options.offeredCredentials,
+            credentialConfigurationIds: options.credentialConfigurationIds,
             grants,
             credentialOfferUri: hostedCredentialOfferUri,
             credentialOfferScheme: options.baseUri,
             issuerMetadata: {
-                originalDraftVersion: version === 'v1.draft11-13' ? openid4vci_1.Openid4vciDraftVersion.Draft11 : openid4vci_1.Openid4vciDraftVersion.Draft14,
+                originalDraftVersion: version === 'v1.draft11-15' ? openid4vci_1.Openid4vciDraftVersion.Draft11 : openid4vci_1.Openid4vciDraftVersion.Draft15,
                 ...issuerMetadata,
             },
         });
@@ -128,6 +128,16 @@ let OpenId4VcIssuerService = class OpenId4VcIssuerService {
                     required: true,
                 }
                 : undefined,
+            dpop: authorization?.requireDpop
+                ? {
+                    required: true,
+                }
+                : undefined,
+            walletAttestation: authorization?.requireWalletAttestation
+                ? {
+                    required: true,
+                }
+                : undefined,
             // TODO: how to mix pre-auth and auth? Need to do state checks
             preAuthorizedCode: credentialOfferObject.grants?.[oauth2_1.preAuthorizedCodeGrantIdentifier]?.['pre-authorized_code'],
             userPin: preAuthorizedCodeFlowConfig?.txCode
@@ -153,25 +163,95 @@ let OpenId4VcIssuerService = class OpenId4VcIssuerService {
         ]);
         const { issuanceSession } = options;
         const issuer = await this.getIssuerByIssuerId(agentContext, options.issuanceSession.issuerId);
-        const vcIssuer = this.getIssuer(agentContext);
+        const vcIssuer = this.getIssuer(agentContext, { issuanceSessionId: issuanceSession.id });
         const issuerMetadata = await this.getIssuerMetadata(agentContext, issuer);
         const parsedCredentialRequest = vcIssuer.parseCredentialRequest({
+            issuerMetadata,
             credentialRequest: options.credentialRequest,
         });
-        const { credentialRequest, credentialIdentifier, format, proofs } = parsedCredentialRequest;
+        const { credentialRequest, credentialIdentifier, format, } = parsedCredentialRequest;
         if (credentialIdentifier) {
             throw new oauth2_1.Oauth2ServerErrorResponseError({
                 error: oauth2_1.Oauth2ErrorCodes.InvalidCredentialRequest,
                 error_description: `Using unsupported 'credential_identifier'`,
             });
         }
-        if (!format) {
+        if (credentialRequest.format && !format) {
+            throw new oauth2_1.Oauth2ServerErrorResponseError({
+                error: oauth2_1.Oauth2ErrorCodes.UnsupportedCredentialFormat,
+                error_description: `Unsupported credential request based on format '${credentialRequest.format}'`,
+            });
+        }
+        if (parsedCredentialRequest.credentialConfigurationId && !parsedCredentialRequest.credentialConfiguration) {
             throw new oauth2_1.Oauth2ServerErrorResponseError({
                 error: oauth2_1.Oauth2ErrorCodes.UnsupportedCredentialFormat,
-                error_description: `Unsupported credential format '${credentialRequest.format}'`,
+                error_description: `Unsupported credential request based on credential configuration id ${credentialRequest.credential_configuration_id}`,
             });
         }
-        if (!proofs?.jwt || proofs.jwt.length === 0) {
+        const { credentialConfiguration, credentialConfigurationId } = this.getCredentialConfigurationsForRequest({
+            issuanceSession,
+            issuerMetadata,
+            requestFormat: format,
+            credentialConfigurations: parsedCredentialRequest.credentialConfiguration && parsedCredentialRequest.credentialConfigurationId
+                ? {
+                    [parsedCredentialRequest.credentialConfigurationId]: parsedCredentialRequest.credentialConfiguration,
+                }
+                : undefined,
+            authorization: options.authorization,
+        });
+        const verifiedCredentialRequestProofs = await this.verifyCredentialRequestProofs(agentContext, {
+            issuanceSession,
+            issuer,
+            parsedCredentialRequest,
+            credentialConfiguration,
+            credentialConfigurationId,
+        });
+        const signedCredentials = await this.getSignedCredentials(agentContext, {
+            credentialRequest,
+            issuanceSession,
+            issuer,
+            credentialConfiguration,
+            credentialConfigurationId,
+            requestFormat: format,
+            authorization: options.authorization,
+            credentialRequestToCredentialMapper: options.credentialRequestToCredentialMapper,
+            credentialRequestProofs: verifiedCredentialRequestProofs,
+        });
+        // NOTE: nonce in credential response is deprecated in newer drafts, but for now we keep it in
+        const { cNonce, cNonceExpiresInSeconds } = await this.createNonce(agentContext, issuer);
+        const credentialResponse = vcIssuer.createCredentialResponse({
+            credential: credentialRequest.proof ? signedCredentials.credentials[0] : undefined,
+            credentials: credentialRequest.proofs ? signedCredentials.credentials : undefined,
+            cNonce,
+            cNonceExpiresInSeconds,
+            credentialRequest: parsedCredentialRequest,
+        });
+        issuanceSession.issuedCredentials.push(credentialConfigurationId);
+        const newState = issuanceSession.issuedCredentials.length >=
+            issuanceSession.credentialOfferPayload.credential_configuration_ids.length
+            ? OpenId4VcIssuanceSessionState_1.OpenId4VcIssuanceSessionState.Completed
+            : OpenId4VcIssuanceSessionState_1.OpenId4VcIssuanceSessionState.CredentialsPartiallyIssued;
+        await this.updateState(agentContext, issuanceSession, newState);
+        return {
+            credentialResponse,
+            issuanceSession,
+        };
+    }
+    async verifyCredentialRequestProofs(agentContext, options) {
+        const { parsedCredentialRequest, issuer, issuanceSession, credentialConfiguration, credentialConfigurationId } = options;
+        const { proofs } = parsedCredentialRequest;
+        const vcIssuer = this.getIssuer(agentContext, { issuanceSessionId: issuanceSession.id });
+        const issuerMetadata = await this.getIssuerMetadata(agentContext, issuer);
+        // FIXME: verify request against the configuration
+        // - key attestations required
+        // - proof types supported
+        // - signing alg values supported
+        // - key attestation level met.
+        const allowedProofTypes = credentialConfiguration.proof_types_supported ?? {
+            jwt: { proof_signing_alg_values_supported: (0, utils_1.getSupportedJwaSignatureAlgorithms)(agentContext) },
+        };
+        const [proofType, proofValue] = Object.entries(proofs ?? {})[0] ?? [];
+        if (!proofType || !proofValue || proofValue.length === 0) {
             const { cNonce, cNonceExpiresInSeconds } = await this.createNonce(agentContext, issuer);
             throw new oauth2_1.Oauth2ServerErrorResponseError({
                 error: oauth2_1.Oauth2ErrorCodes.InvalidProof,
@@ -180,38 +260,66 @@ let OpenId4VcIssuerService = class OpenId4VcIssuerService {
                 c_nonce_expires_in: cNonceExpiresInSeconds,
             });
         }
+        if (proofType !== 'jwt' && proofType !== 'attestation') {
+            throw new oauth2_1.Oauth2ServerErrorResponseError({
+                error: oauth2_1.Oauth2ErrorCodes.InvalidProof,
+                error_description: `Proof type '${proofType}' is not supported `,
+            });
+        }
+        const supportedProofType = allowedProofTypes[proofType];
+        if (!supportedProofType) {
+            throw new oauth2_1.Oauth2ServerErrorResponseError({
+                error: oauth2_1.Oauth2ErrorCodes.InvalidProof,
+                error_description: `Proof type '${proofType}' is not supported for credential configuration '${credentialConfigurationId}'`,
+            });
+        }
+        if (proofType === 'attestation' && proofValue.length !== 1) {
+            throw new oauth2_1.Oauth2ServerErrorResponseError({
+                error: oauth2_1.Oauth2ErrorCodes.InvalidProof,
+                error_description: "Only a single proofs entry is supported for proof type 'attestation'",
+            });
+        }
         await this.updateState(agentContext, issuanceSession, OpenId4VcIssuanceSessionState_1.OpenId4VcIssuanceSessionState.CredentialRequestReceived);
-        let previousNonce = undefined;
-        const proofSigners = [];
-        for (const jwt of proofs.jwt) {
-            const { signer, payload } = await vcIssuer.verifyCredentialRequestJwtProof({
+        if (proofType === 'attestation') {
+            const keyAttestationJwt = proofValue[0];
+            const keyAttestation = await vcIssuer.verifyCredentialRequestAttestationProof({
                 issuerMetadata,
-                jwt,
-                clientId: options.issuanceSession.clientId,
+                keyAttestationJwt,
             });
-            if (!payload.nonce) {
-                const { cNonce, cNonceExpiresInSeconds } = await this.createNonce(agentContext, issuer);
+            if (!supportedProofType.proof_signing_alg_values_supported.includes(keyAttestation.header.alg)) {
                 throw new oauth2_1.Oauth2ServerErrorResponseError({
                     error: oauth2_1.Oauth2ErrorCodes.InvalidProof,
-                    error_description: 'Missing nonce in proof(s) in credential request',
-                    c_nonce: cNonce,
-                    c_nonce_expires_in: cNonceExpiresInSeconds,
+                    error_description: `Proof signing alg value '${keyAttestation.header.alg}' is not supported for proof type 'attestation' in credentail configuration '${credentialConfigurationId}'`,
                 });
             }
-            // Set previous nonce if not yet set (first iteration)
-            if (!previousNonce)
-                previousNonce = payload.nonce;
-            if (previousNonce !== payload.nonce) {
+            if (!keyAttestation.payload.nonce) {
                 const { cNonce, cNonceExpiresInSeconds } = await this.createNonce(agentContext, issuer);
                 throw new oauth2_1.Oauth2ServerErrorResponseError({
                     error: oauth2_1.Oauth2ErrorCodes.InvalidProof,
-                    error_description: 'Not all nonce values in proofs are equal',
+                    error_description: 'Missing nonce in attestation proof in credential request. If no nonce is present in the attestation, use the jwt proof type instead',
                     c_nonce: cNonce,
                     c_nonce_expires_in: cNonceExpiresInSeconds,
                 });
             }
-            // Verify the nonce
-            await this.verifyNonce(agentContext, issuer, payload.nonce).catch(async (error) => {
+            if (supportedProofType.key_attestations_required && keyAttestation) {
+                const expectedKeyStorage = supportedProofType.key_attestations_required.key_storage;
+                const expectedUserAuthentication = supportedProofType.key_attestations_required.user_authentication;
+                if (expectedKeyStorage &&
+                    !expectedKeyStorage.some((keyStorage) => keyAttestation.payload.key_storage?.includes(keyStorage))) {
+                    throw new oauth2_1.Oauth2ServerErrorResponseError({
+                        error: oauth2_1.Oauth2ErrorCodes.InvalidProof,
+                        error_description: `Insufficent key_storage for key attestation. Proof type 'attestation' for credential configuration '${credentialConfigurationId}', expects one of key_storage values ${expectedKeyStorage.join(', ')}`,
+                    });
+                }
+                if (expectedUserAuthentication &&
+                    !expectedUserAuthentication.some((userAuthentication) => keyAttestation.payload.user_authentication?.includes(userAuthentication))) {
+                    throw new oauth2_1.Oauth2ServerErrorResponseError({
+                        error: oauth2_1.Oauth2ErrorCodes.InvalidProof,
+                        error_description: `Insufficent user_authentication for key attestation. Proof type 'attestation' for credential configuration '${credentialConfigurationId}', expects one of user_authentication values ${expectedUserAuthentication.join(', ')}`,
+                    });
+                }
+            }
+            await this.verifyNonce(agentContext, issuer, keyAttestation.payload.nonce).catch(async (error) => {
                 const { cNonce, cNonceExpiresInSeconds } = await this.createNonce(agentContext, issuer);
                 throw new oauth2_1.Oauth2ServerErrorResponseError({
                     error: oauth2_1.Oauth2ErrorCodes.InvalidNonce,
@@ -222,36 +330,167 @@ let OpenId4VcIssuerService = class OpenId4VcIssuerService {
                     cause: error,
                 });
             });
-            proofSigners.push(signer);
+            return {
+                bindingMethod: 'jwk',
+                keys: keyAttestation.payload.attested_keys.map((attestedKey) => {
+                    return {
+                        method: 'jwk',
+                        jwk: core_1.Kms.PublicJwk.fromUnknown(attestedKey),
+                    };
+                }),
+                proofType: 'attestation',
+                // It's up to the credential request mapper to ensure we trust the key attestation signer
+                // For x5c it's kinda covered already.
+                keyAttestation,
+            };
         }
-        const signedCredentials = await this.getSignedCredentials(agentContext, {
-            credentialRequest,
-            issuanceSession,
-            issuer,
-            requestFormat: format,
-            authorization: options.authorization,
-            credentialRequestToCredentialMapper: options.credentialRequestToCredentialMapper,
-            proofSigners,
-        });
-        // NOTE: nonce in credential response is deprecated in newer drafts, but for now we keep it in
-        const { cNonce, cNonceExpiresInSeconds } = await this.createNonce(agentContext, issuer);
-        const credentialResponse = vcIssuer.createCredentialResponse({
-            credential: credentialRequest.proof ? signedCredentials.credentials[0] : undefined,
-            credentials: credentialRequest.proofs ? signedCredentials.credentials : undefined,
-            cNonce,
-            cNonceExpiresInSeconds,
-            credentialRequest: parsedCredentialRequest,
+        if (proofType === 'jwt') {
+            let firstNonce = undefined;
+            const proofSigners = [];
+            for (const jwt of proofValue) {
+                const { signer, payload, header, keyAttestation } = await vcIssuer.verifyCredentialRequestJwtProof({
+                    issuerMetadata,
+                    jwt,
+                    clientId: options.issuanceSession.clientId,
+                });
+                // TOOD: we should probably do this check before signature verification, but we then we
+                // first need to decode the jwt
+                if (!supportedProofType.proof_signing_alg_values_supported.includes(header.alg)) {
+                    throw new oauth2_1.Oauth2ServerErrorResponseError({
+                        error: oauth2_1.Oauth2ErrorCodes.InvalidProof,
+                        error_description: `Proof signing alg value '${header.alg}' is not supported for proof type 'jwt' in credentail configuration '${credentialConfigurationId}'`,
+                    });
+                }
+                if (signer.method !== 'jwk' && signer.method !== 'did') {
+                    throw new oauth2_1.Oauth2ServerErrorResponseError({
+                        error: oauth2_1.Oauth2ErrorCodes.InvalidProof,
+                        error_description: "Only 'jwk' and 'did' binding methods supported for jwt proof",
+                    });
+                }
+                if (proofSigners[0] && signer.method !== proofSigners[0].method) {
+                    throw new oauth2_1.Oauth2ServerErrorResponseError({
+                        error: oauth2_1.Oauth2ErrorCodes.InvalidProof,
+                        error_description: "All proofs must be signed using the same binding method. Found a mix of 'did' and 'jwk'",
+                    });
+                }
+                if (proofSigners[0] && signer.alg !== proofSigners[0].alg) {
+                    throw new oauth2_1.Oauth2ServerErrorResponseError({
+                        error: oauth2_1.Oauth2ErrorCodes.InvalidProof,
+                        error_description: "All proofs must be signed using the same alg value. Found a mix of different 'alg' values.",
+                    });
+                }
+                if (keyAttestation && signer.method === 'did') {
+                    throw new oauth2_1.Oauth2ServerErrorResponseError({
+                        error: oauth2_1.Oauth2ErrorCodes.InvalidProof,
+                        error_description: "Binding method 'did' is not supported when a key attestation is provided.",
+                    });
+                }
+                if (supportedProofType.key_attestations_required && !keyAttestation) {
+                    throw new oauth2_1.Oauth2ServerErrorResponseError({
+                        error: oauth2_1.Oauth2ErrorCodes.InvalidProof,
+                        error_description: `Missing required key attestation. Key attestations are required for proof type 'jwt' in credentail configuration '${credentialConfigurationId}'`,
+                    });
+                }
+                if (supportedProofType.key_attestations_required && keyAttestation) {
+                    const expectedKeyStorage = supportedProofType.key_attestations_required.key_storage;
+                    const expectedUserAuthentication = supportedProofType.key_attestations_required.user_authentication;
+                    if (expectedKeyStorage &&
+                        !expectedKeyStorage.some((keyStorage) => keyAttestation.payload.key_storage?.includes(keyStorage))) {
+                        throw new oauth2_1.Oauth2ServerErrorResponseError({
+                            error: oauth2_1.Oauth2ErrorCodes.InvalidProof,
+                            error_description: `Insufficent key_storage for key attestation. Proof type 'jwt' for credential configuration '${credentialConfigurationId}', expects one of key_storage values ${expectedKeyStorage.join(', ')}`,
+                        });
+                    }
+                    if (expectedUserAuthentication &&
+                        !expectedUserAuthentication.some((userAuthentication) => keyAttestation.payload.user_authentication?.includes(userAuthentication))) {
+                        throw new oauth2_1.Oauth2ServerErrorResponseError({
+                            error: oauth2_1.Oauth2ErrorCodes.InvalidProof,
+                            error_description: `Insufficent user_authentication for key attestation. Proof type 'jwt' for credential configuration '${credentialConfigurationId}', expects one of user_authentication values ${expectedUserAuthentication.join(', ')}`,
+                        });
+                    }
+                }
+                if (keyAttestation && proofValue.length > 1) {
+                    throw new oauth2_1.Oauth2ServerErrorResponseError({
+                        error: oauth2_1.Oauth2ErrorCodes.InvalidProof,
+                        error_description: "Only a single proofs entry is supported when jwt proof header contains  'key_attestation'",
+                    });
+                }
+                if (!payload.nonce) {
+                    const { cNonce, cNonceExpiresInSeconds } = await this.createNonce(agentContext, issuer);
+                    throw new oauth2_1.Oauth2ServerErrorResponseError({
+                        error: oauth2_1.Oauth2ErrorCodes.InvalidProof,
+                        error_description: 'Missing nonce in proof(s) in credential request',
+                        c_nonce: cNonce,
+                        c_nonce_expires_in: cNonceExpiresInSeconds,
+                    });
+                }
+                // Set previous nonce if not yet set (first iteration)
+                if (!firstNonce)
+                    firstNonce = payload.nonce;
+                if (firstNonce !== payload.nonce) {
+                    const { cNonce, cNonceExpiresInSeconds } = await this.createNonce(agentContext, issuer);
+                    throw new oauth2_1.Oauth2ServerErrorResponseError({
+                        error: oauth2_1.Oauth2ErrorCodes.InvalidProof,
+                        error_description: 'Not all nonce values in proofs are equal',
+                        c_nonce: cNonce,
+                        c_nonce_expires_in: cNonceExpiresInSeconds,
+                    });
+                }
+                // Verify the nonce
+                await this.verifyNonce(agentContext, issuer, payload.nonce).catch(async (error) => {
+                    const { cNonce, cNonceExpiresInSeconds } = await this.createNonce(agentContext, issuer);
+                    throw new oauth2_1.Oauth2ServerErrorResponseError({
+                        error: oauth2_1.Oauth2ErrorCodes.InvalidNonce,
+                        error_description: 'Invalid nonce in credential request',
+                        c_nonce: cNonce,
+                        c_nonce_expires_in: cNonceExpiresInSeconds,
+                    }, {
+                        cause: error,
+                    });
+                });
+                if (keyAttestation) {
+                    return {
+                        proofType: 'jwt',
+                        bindingMethod: 'jwk',
+                        keys: keyAttestation.payload.attested_keys.map((attestedKey) => {
+                            return {
+                                method: 'jwk',
+                                jwk: core_1.Kms.PublicJwk.fromUnknown(attestedKey),
+                            };
+                        }),
+                        keyAttestation,
+                    };
+                }
+                proofSigners.push(signer);
+            }
+            if (proofSigners[0].method === 'did') {
+                const signers = proofSigners;
+                return {
+                    proofType: 'jwt',
+                    bindingMethod: 'did',
+                    keys: signers.map((signer) => ({
+                        didUrl: signer.didUrl,
+                        method: 'did',
+                        jwk: core_1.Kms.PublicJwk.fromUnknown(signer.publicJwk),
+                    })),
+                };
+            }
+            return {
+                proofType: 'jwt',
+                bindingMethod: 'jwk',
+                keys: proofSigners.map((signer) => {
+                    return {
+                        method: 'jwk',
+                        jwk: core_1.Kms.PublicJwk.fromUnknown(signer.publicJwk),
+                    };
+                }),
+            };
+        }
+        // This will not happen, but to make TS happy
+        throw new oauth2_1.Oauth2ServerErrorResponseError({
+            error: oauth2_1.Oauth2ErrorCodes.InvalidProof,
+            error_description: 'Missing required proof(s) in credential request',
         });
-        issuanceSession.issuedCredentials.push(signedCredentials.credentialConfigurationId);
-        const newState = issuanceSession.issuedCredentials.length >=
-            issuanceSession.credentialOfferPayload.credential_configuration_ids.length
-            ? OpenId4VcIssuanceSessionState_1.OpenId4VcIssuanceSessionState.Completed
-            : OpenId4VcIssuanceSessionState_1.OpenId4VcIssuanceSessionState.CredentialsPartiallyIssued;
-        await this.updateState(agentContext, issuanceSession, newState);
-        return {
-            credentialResponse,
-            issuanceSession,
-        };
     }
     async findIssuanceSessionsByQuery(agentContext, query, queryOptions) {
         return this.openId4VcIssuanceSessionRepository.findByQuery(agentContext, query, queryOptions);
@@ -272,17 +511,18 @@ let OpenId4VcIssuerService = class OpenId4VcIssuerService {
         return this.openId4VcIssuerRepository.update(agentContext, issuer);
     }
     async createIssuer(agentContext, options) {
+        const kms = agentContext.resolve(core_1.Kms.KeyManagementApi);
         // TODO: ideally we can store additional data with a key, such as:
         // - createdAt
         // - purpose
-        const accessTokenSignerKey = await agentContext.wallet.createKey({
-            keyType: options.accessTokenSignerKeyType ?? core_1.KeyType.Ed25519,
+        const accessTokenSignerKey = await kms.createKey({
+            type: options.accessTokenSignerKeyType ?? { kty: 'OKP', crv: 'Ed25519' },
         });
         const openId4VcIssuer = new repository_1.OpenId4VcIssuerRecord({
             issuerId: options.issuerId ?? core_1.utils.uuid(),
             display: options.display,
             dpopSigningAlgValuesSupported: options.dpopSigningAlgValuesSupported,
-            accessTokenPublicKeyFingerprint: accessTokenSignerKey.fingerprint,
+            accessTokenPublicJwk: accessTokenSignerKey.publicJwk,
             authorizationServerConfigs: options.authorizationServerConfigs,
             credentialConfigurationsSupported: options.credentialConfigurationsSupported,
             batchCredentialIssuance: options.batchCredentialIssuance,
@@ -292,12 +532,17 @@ let OpenId4VcIssuerService = class OpenId4VcIssuerService {
         return openId4VcIssuer;
     }
     async rotateAccessTokenSigningKey(agentContext, issuer, options) {
-        const accessTokenSignerKey = await agentContext.wallet.createKey({
-            keyType: options?.accessTokenSignerKeyType ?? core_1.KeyType.Ed25519,
+        const kms = agentContext.resolve(core_1.Kms.KeyManagementApi);
+        const previousKey = issuer.resolvedAccessTokenPublicJwk;
+        const accessTokenSignerKey = await kms.createKey({
+            type: options?.accessTokenSignerKeyType ?? { kty: 'OKP', crv: 'Ed25519' },
         });
-        // TODO: ideally we can remove the previous key
-        issuer.accessTokenPublicKeyFingerprint = accessTokenSignerKey.fingerprint;
+        issuer.accessTokenPublicJwk = accessTokenSignerKey.publicJwk;
         await this.openId4VcIssuerRepository.update(agentContext, issuer);
+        // Remove previous key
+        await kms.deleteKey({
+            keyId: previousKey.keyId,
+        });
     }
     /**
      * @param fetchExternalAuthorizationServerMetadata defaults to false
@@ -356,18 +601,17 @@ let OpenId4VcIssuerService = class OpenId4VcIssuerService {
         const jwsService = agentContext.dependencyManager.resolve(core_1.JwsService);
         const cNonceExpiresInSeconds = this.openId4VcIssuerConfig.cNonceExpiresInSeconds;
         const cNonceExpiresAt = (0, utils_1.addSecondsToDate)(new Date(), cNonceExpiresInSeconds);
-        const key = core_1.Key.fromFingerprint(issuer.accessTokenPublicKeyFingerprint);
-        const jwk = (0, core_1.getJwkFromKey)(key);
+        const key = issuer.resolvedAccessTokenPublicJwk;
         const cNonce = await jwsService.createJwsCompact(agentContext, {
-            key,
+            keyId: key.keyId,
             payload: core_1.JwtPayload.fromJson({
                 iss: issuerMetadata.credentialIssuer.credential_issuer,
                 exp: (0, utils_1.dateToSeconds)(cNonceExpiresAt),
             }),
             protectedHeaderOptions: {
                 typ: 'credo+cnonce',
-                kid: issuer.accessTokenPublicKeyFingerprint,
-                alg: jwk.supportedSignatureAlgorithms[0],
+                kid: key.keyId,
+                alg: key.signatureAlgorithm,
             },
         });
         return {
@@ -384,8 +628,7 @@ let OpenId4VcIssuerService = class OpenId4VcIssuerService {
     async verifyNonce(agentContext, issuer, cNonce) {
         const issuerMetadata = await this.getIssuerMetadata(agentContext, issuer);
         const jwsService = agentContext.dependencyManager.resolve(core_1.JwsService);
-        const key = core_1.Key.fromFingerprint(issuer.accessTokenPublicKeyFingerprint);
-        const jwk = (0, core_1.getJwkFromKey)(key);
+        const key = issuer.resolvedAccessTokenPublicJwk;
         const jwt = core_1.Jwt.fromSerializedJwt(cNonce);
         jwt.payload.validate();
         if (jwt.payload.iss !== issuerMetadata.credentialIssuer.credential_issuer) {
@@ -396,17 +639,18 @@ let OpenId4VcIssuerService = class OpenId4VcIssuerService {
         }
         const verification = await jwsService.verifyJws(agentContext, {
             jws: cNonce,
-            jwkResolver: () => jwk,
+            jwsSigner: {
+                method: 'jwk',
+                jwk: key,
+            },
         });
-        if (!verification.signerKeys
-            .map((singerKey) => singerKey.fingerprint)
-            .includes(issuer.accessTokenPublicKeyFingerprint)) {
+        if (!verification.isValid) {
             throw new core_1.CredoError('Invalid nonce');
         }
     }
-    getIssuer(agentContext) {
+    getIssuer(agentContext, options = {}) {
         return new openid4vci_1.Openid4vciIssuer({
-            callbacks: (0, callbacks_1.getOid4vcCallbacks)(agentContext),
+            callbacks: (0, callbacks_1.getOid4vcCallbacks)(agentContext, options),
         });
     }
     getOauth2Client(agentContext) {
@@ -414,9 +658,9 @@ let OpenId4VcIssuerService = class OpenId4VcIssuerService {
             callbacks: (0, callbacks_1.getOid4vcCallbacks)(agentContext),
         });
     }
-    getOauth2AuthorizationServer(agentContext) {
+    getOauth2AuthorizationServer(agentContext, options = {}) {
         return new oauth2_1.Oauth2AuthorizationServer({
-            callbacks: (0, callbacks_1.getOid4vcCallbacks)(agentContext),
+            callbacks: (0, callbacks_1.getOid4vcCallbacks)(agentContext, options),
         });
     }
     getResourceServer(agentContext, issuerRecord) {
@@ -449,6 +693,7 @@ let OpenId4VcIssuerService = class OpenId4VcIssuerService {
         });
     }
     async getGrantsFromConfig(agentContext, config) {
+        const kms = agentContext.resolve(core_1.Kms.KeyManagementApi);
         const { preAuthorizedCodeFlowConfig, authorizationCodeFlowConfig, issuerMetadata } = config;
         // TOOD: export type
         const grants = {};
@@ -456,7 +701,7 @@ let OpenId4VcIssuerService = class OpenId4VcIssuerService {
         if (preAuthorizedCodeFlowConfig) {
             const { txCode, authorizationServerUrl, preAuthorizedCode } = preAuthorizedCodeFlowConfig;
             grants[oauth2_1.preAuthorizedCodeGrantIdentifier] = {
-                'pre-authorized_code': preAuthorizedCode ?? (await agentContext.wallet.generateNonce()),
+                'pre-authorized_code': preAuthorizedCode ?? core_1.TypedArrayEncoder.toBase64URL(kms.randomBytes({ length: 32 })),
                 tx_code: txCode,
                 authorization_server: config.issuerMetadata.credentialIssuer.authorization_servers
                     ? authorizationServerUrl
@@ -477,8 +722,7 @@ let OpenId4VcIssuerService = class OpenId4VcIssuerService {
                 issuer_state: 
                 // TODO: the issuer_state should not be guessable, so it's best if we generate it and now allow the user to provide it?
                 // but same is true for the pre-auth code and users of credo can also provide that value. We can't easily do unique constraint with askat
-                authorizationCodeFlowConfig.issuerState ??
-                    core_1.TypedArrayEncoder.toBase64URL(agentContext.wallet.getRandomValues(32)),
+                authorizationCodeFlowConfig.issuerState ?? core_1.TypedArrayEncoder.toBase64URL(kms.randomBytes({ length: 32 })),
                 authorization_server: config.issuerMetadata.credentialIssuer.authorization_servers
                     ? authorizationServerUrl
                     : undefined,
@@ -486,38 +730,23 @@ let OpenId4VcIssuerService = class OpenId4VcIssuerService {
         }
         return grants;
     }
-    async getHolderBindingFromRequestProofs(agentContext, proofSigners) {
-        const credentialHolderBindings = [];
-        for (const signer of proofSigners) {
-            if (signer.method === 'custom' || signer.method === 'x5c') {
-                throw new core_1.CredoError(`Only 'jwk' and 'did' based holder binding is supported`);
-            }
-            if (signer.method === 'jwk') {
-                const jwk = (0, core_1.getJwkFromJson)(signer.publicJwk);
-                credentialHolderBindings.push({
-                    method: 'jwk',
-                    jwk,
-                    key: jwk.key,
-                });
-            }
-            if (signer.method === 'did') {
-                const key = await (0, utils_1.getKeyFromDid)(agentContext, signer.didUrl);
-                credentialHolderBindings.push({
-                    method: 'did',
-                    didUrl: signer.didUrl,
-                    key,
-                });
-            }
-        }
-        return credentialHolderBindings;
-    }
     getCredentialConfigurationsForRequest(options) {
-        const { requestFormat, issuanceSession, issuerMetadata, authorization } = options;
+        const { requestFormat, issuanceSession, issuerMetadata, authorization, credentialConfigurations } = options;
         // Check against all credential configurations
-        const configurationsMatchingRequest = (0, openid4vci_1.getCredentialConfigurationsMatchingRequestFormat)({
-            requestFormat,
-            credentialConfigurations: issuerMetadata.credentialIssuer.credential_configurations_supported,
-        });
+        const configurationsMatchingRequest = credentialConfigurations
+            ? credentialConfigurations
+            : requestFormat
+                ? (0, openid4vci_1.getCredentialConfigurationsMatchingRequestFormat)({
+                    requestFormat,
+                    credentialConfigurations: issuerMetadata.credentialIssuer.credential_configurations_supported,
+                })
+                : undefined;
+        if (!configurationsMatchingRequest) {
+            throw new oauth2_1.Oauth2ServerErrorResponseError({
+                error: oauth2_1.Oauth2ErrorCodes.InvalidCredentialRequest,
+                error_description: `Either 'credential_configuration_id' or 'format' needs to be defined'`,
+            });
+        }
         if (Object.keys(configurationsMatchingRequest).length === 0) {
             throw new oauth2_1.Oauth2ServerErrorResponseError({
                 error: oauth2_1.Oauth2ErrorCodes.InvalidCredentialRequest,
@@ -542,9 +771,12 @@ let OpenId4VcIssuerService = class OpenId4VcIssuerService {
         }
         // For pre-auth we allow all ids from the offer
         if (authorization.accessToken.payload['pre-authorized_code']) {
+            // We return the first one that matches all checks. Pre draft 15 it could be multiple entries, but only if you offer
+            // multiple credentials of the same type. We need to do checks on this, so we pick the first one
+            const [credentialConfigurationId, credentialConfiguration] = Object.entries(configurationsMatchingRequestAndOfferNotIssued)[0];
             return {
-                credentialConfigurations: configurationsMatchingRequestAndOfferNotIssued,
-                credentialConfigurationIds: Object.keys(configurationsMatchingRequestAndOfferNotIssued),
+                credentialConfigurationId,
+                credentialConfiguration,
             };
         }
         // Limit to scopes from the token
@@ -558,20 +790,16 @@ let OpenId4VcIssuerService = class OpenId4VcIssuerService {
                 status: 403,
             });
         }
+        // We return the first one that matches all checks. Pre draft 15 it could be multiple entries, but only if you offer
+        // multiple credentials of the same type. We need to do checks on this, so we pick the first one
+        const [credentialConfigurationId, credentialConfiguration] = Object.entries(configurationsMatchingRequestOfferScope)[0];
         return {
-            credentialConfigurations: configurationsMatchingRequestOfferScope,
-            credentialConfigurationIds: Object.keys(configurationsMatchingRequestOfferScope),
+            credentialConfigurationId,
+            credentialConfiguration: credentialConfiguration,
         };
     }
     async getSignedCredentials(agentContext, options) {
-        const { issuanceSession, issuer, requestFormat, authorization } = options;
-        const issuerMetadata = await this.getIssuerMetadata(agentContext, issuer);
-        const { credentialConfigurations, credentialConfigurationIds } = this.getCredentialConfigurationsForRequest({
-            issuanceSession,
-            issuerMetadata,
-            requestFormat,
-            authorization,
-        });
+        const { issuanceSession, credentialConfiguration, credentialConfigurationId, credentialRequestProofs } = options;
         const mapper = options.credentialRequestToCredentialMapper ?? this.openId4VcIssuerConfig.credentialRequestToCredentialMapper;
         let verification = undefined;
         // NOTE: this will throw an error if the verifier module is not registered and there is a
@@ -596,28 +824,24 @@ let OpenId4VcIssuerService = class OpenId4VcIssuerService {
                 throw new core_1.CredoError(`Verified authorization response for verification session with id '${session.id}' does not have presenationExchange or dcql defined.`);
             }
         }
-        const holderBindings = await this.getHolderBindingFromRequestProofs(agentContext, options.proofSigners);
         const signOptions = await mapper({
             agentContext,
             issuanceSession,
-            holderBindings,
+            holderBinding: credentialRequestProofs,
             credentialOffer: issuanceSession.credentialOfferPayload,
             verification,
             credentialRequest: options.credentialRequest,
             credentialRequestFormat: options.requestFormat,
-            // Macthing credential configuration ids
-            credentialConfigurationsSupported: credentialConfigurations,
-            credentialConfigurationIds,
+            // Macthing credential configuration
+            credentialConfiguration,
+            credentialConfigurationId,
             // Authorization
             authorization: options.authorization,
         });
-        if (!credentialConfigurationIds.includes(signOptions.credentialConfigurationId)) {
-            throw new core_1.CredoError(`Credential request to credential mapper returned credential configuration id '${signOptions.credentialConfigurationId}' but is not part of provided input credential configuration ids. Allowed values are '${credentialConfigurationIds.join(', ')}'.`);
-        }
-        // NOTE: we may want to allow a mismatch between this (as with new attestations not every key
-        // needs a separate proof), but for now it needs to match
-        if (signOptions.credentials.length !== holderBindings.length) {
-            throw new core_1.CredoError(`Credential request to credential mapper returned '${signOptions.credentials.length}' to be signed, while only '${holderBindings.length}' holder binding entries were provided. Make sure to return one credential for each holder binding entry`);
+        const expectedLength = credentialRequestProofs.keys.length;
+        // NOTE: we may want to allow a mismatch between this (as there is a match batch length), but for now it needs to match
+        if (signOptions.credentials.length !== expectedLength) {
+            throw new core_1.CredoError(`Credential request to credential mapper returned '${signOptions.credentials.length}' to be signed, while '${expectedLength}' holder binding entries were provided. Make sure to return one credential for each holder binding entry`);
         }
         if (signOptions.format === core_1.ClaimFormat.JwtVc || signOptions.format === core_1.ClaimFormat.LdpVc) {
             const oid4vciFormatMap = {
@@ -625,40 +849,44 @@ let OpenId4VcIssuerService = class OpenId4VcIssuerService {
                 [shared_1.OpenId4VciCredentialFormatProfile.JwtVcJsonLd]: core_1.ClaimFormat.JwtVc,
                 [shared_1.OpenId4VciCredentialFormatProfile.LdpVc]: core_1.ClaimFormat.LdpVc,
             };
-            const expectedClaimFormat = oid4vciFormatMap[options.requestFormat.format];
+            const expectedClaimFormat = oid4vciFormatMap[credentialConfiguration.format];
             if (signOptions.format !== expectedClaimFormat) {
                 throw new core_1.CredoError(`Invalid credential format returned by sign options. Expected '${expectedClaimFormat}', received '${signOptions.format}'.`);
             }
             return {
-                credentialConfigurationId: signOptions.credentialConfigurationId,
-                format: requestFormat.format,
+                format: credentialConfiguration.format,
                 credentials: (await Promise.all(signOptions.credentials.map((credential) => this.signW3cCredential(agentContext, signOptions.format, credential).then((signed) => signed.encoded)))),
             };
         }
         if (signOptions.format === core_1.ClaimFormat.SdJwtVc) {
-            if (signOptions.format !== requestFormat.format) {
-                throw new core_1.CredoError(`Invalid credential format returned by sign options. Expected '${requestFormat.format}', received '${signOptions.format}'.`);
+            if (credentialConfiguration.format !== shared_1.OpenId4VciCredentialFormatProfile.SdJwtVc &&
+                credentialConfiguration.format !== shared_1.OpenId4VciCredentialFormatProfile.SdJwtDc) {
+                throw new core_1.CredoError(`Invalid credential format returned by sign options. Expected '${core_1.ClaimFormat.SdJwtVc}', received '${signOptions.format}'.`);
             }
-            if (!signOptions.credentials.every((c) => c.payload.vct === requestFormat.vct)) {
-                throw new core_1.CredoError(`One or more vct values of the offered credential(s) do not match the vct of the requested credential. Offered ${Array.from(new Set(signOptions.credentials.map((c) => `'${c.payload.vct}'`))).join(', ')} Requested '${requestFormat.vct}'.`);
+            if (!signOptions.credentials.every((c) => c.payload.vct === credentialConfiguration.vct)) {
+                throw new core_1.CredoError(`One or more vct values of the offered credential(s) do not match the vct of the requested credential. Offered ${Array.from(new Set(signOptions.credentials.map((c) => `'${c.payload.vct}'`))).join(', ')} Requested '${credentialConfiguration.vct}'.`);
             }
             const sdJwtVcApi = agentContext.dependencyManager.resolve(core_1.SdJwtVcApi);
             return {
-                credentialConfigurationId: signOptions.credentialConfigurationId,
-                format: shared_1.OpenId4VciCredentialFormatProfile.SdJwtVc,
-                credentials: await Promise.all(signOptions.credentials.map((credential) => sdJwtVcApi.sign(credential).then((signed) => signed.compact))),
+                format: credentialConfiguration.format,
+                credentials: await Promise.all(signOptions.credentials.map((credential) => sdJwtVcApi
+                    .sign({
+                    ...credential,
+                    // Set header type based on the oid4vci format
+                    headerType: credentialConfiguration.format,
+                })
+                    .then((signed) => signed.compact))),
             };
         }
         if (signOptions.format === core_1.ClaimFormat.MsoMdoc) {
-            if (signOptions.format !== requestFormat.format) {
-                throw new core_1.CredoError(`Invalid credential format returned by sign options. Expected '${requestFormat.format}', received '${signOptions.format}'.`);
+            if (signOptions.format !== credentialConfiguration.format) {
+                throw new core_1.CredoError(`Invalid credential format returned by sign options. Expected '${credentialConfiguration.format}', received '${signOptions.format}'.`);
             }
-            if (!signOptions.credentials.every((c) => c.docType === requestFormat.doctype)) {
-                throw new core_1.CredoError(`One or more doctype values of the offered credential(s) do not match the doctype of the requested credential. Offered ${Array.from(new Set(signOptions.credentials.map((c) => `'${c.docType}'`))).join(', ')} Requested '${requestFormat.doctype}'.`);
+            if (!signOptions.credentials.every((c) => c.docType === credentialConfiguration.doctype)) {
+                throw new core_1.CredoError(`One or more doctype values of the offered credential(s) do not match the doctype of the requested credential. Offered ${Array.from(new Set(signOptions.credentials.map((c) => `'${c.docType}'`))).join(', ')} Requested '${credentialConfiguration.doctype}'.`);
             }
             const mdocApi = agentContext.dependencyManager.resolve(core_1.MdocApi);
             return {
-                credentialConfigurationId: signOptions.credentialConfigurationId,
                 format: shared_1.OpenId4VciCredentialFormatProfile.MsoMdoc,
                 credentials: await Promise.all(signOptions.credentials.map((credential) => mdocApi.sign(credential).then((signed) => signed.base64Url))),
             };
@@ -666,24 +894,16 @@ let OpenId4VcIssuerService = class OpenId4VcIssuerService {
         throw new core_1.CredoError(`Unsupported credential format ${signOptions.format}`);
     }
     async signW3cCredential(agentContext, format, options) {
-        const key = await (0, utils_1.getKeyFromDid)(agentContext, options.verificationMethod);
+        const publicJwk = await (0, utils_1.getPublicJwkFromDid)(agentContext, options.verificationMethod);
         if (format === core_1.ClaimFormat.JwtVc) {
-            const supportedSignatureAlgorithms = (0, core_1.getJwkFromKey)(key).supportedSignatureAlgorithms;
-            if (supportedSignatureAlgorithms.length === 0) {
-                throw new core_1.CredoError(`No supported JWA signature algorithms found for key with keyType ${key.keyType}`);
-            }
-            const alg = supportedSignatureAlgorithms[0];
-            if (!alg) {
-                throw new core_1.CredoError(`No supported JWA signature algorithms for key type ${key.keyType}`);
-            }
             return await this.w3cCredentialService.signCredential(agentContext, {
                 format: core_1.ClaimFormat.JwtVc,
                 credential: options.credential,
                 verificationMethod: options.verificationMethod,
-                alg,
+                alg: publicJwk.signatureAlgorithm,
             });
         }
-        const proofType = (0, utils_1.getProofTypeFromKey)(agentContext, key);
+        const proofType = (0, utils_1.getProofTypeFromPublicJwk)(agentContext, publicJwk);
         return await this.w3cCredentialService.signCredential(agentContext, {
             format: core_1.ClaimFormat.LdpVc,
             credential: options.credential,