@credo-ts/openid4vc 0.6.1-pr-2091-20241119140918 → 0.6.1

package/build/openid4vc-issuer/OpenId4VcIssuerService.mjs

@@ -0,0 +1,881 @@
+import { OpenId4VcIssuerModuleConfig } from "./OpenId4VcIssuerModuleConfig.mjs";
+import { storeActorIdForContextCorrelationId } from "../shared/router/tenants.mjs";
+import "../shared/router/index.mjs";
+import { credoJwtIssuerToOpenId4VcJwtIssuer, decodeJwtIssuer, encodeJwtIssuer, getProofTypeFromPublicJwk, getPublicJwkFromDid, getSupportedJwaSignatureAlgorithms } from "../shared/utils.mjs";
+import { dynamicOid4vciClientAuthentication, getOid4vcCallbacks } from "../shared/callbacks.mjs";
+import { getCredentialConfigurationsSupportedForScopes, getOfferedCredentials } from "../shared/issuerMetadataUtils.mjs";
+import { OpenId4VciCredentialFormatProfile } from "../shared/models/OpenId4VciCredentialFormatProfile.mjs";
+import "../shared/index.mjs";
+import { __decorateMetadata } from "../_virtual/_@oxc-project_runtime@0.99.0/helpers/decorateMetadata.mjs";
+import { __decorate } from "../_virtual/_@oxc-project_runtime@0.99.0/helpers/decorate.mjs";
+import { OpenId4VcIssuanceSessionState } from "./OpenId4VcIssuanceSessionState.mjs";
+import { OpenId4VcVerifierApi } from "../openid4vc-verifier/OpenId4VcVerifierApi.mjs";
+import "../openid4vc-verifier/index.mjs";
+import { OpenId4VcIssuerEvents } from "./OpenId4VcIssuerEvents.mjs";
+import { OpenId4VcIssuanceSessionRecord } from "./repository/OpenId4VcIssuanceSessionRecord.mjs";
+import { OpenId4VcIssuanceSessionRepository } from "./repository/OpenId4VcIssuanceSessionRepository.mjs";
+import { OpenId4VcIssuerRecord } from "./repository/OpenId4VcIssuerRecord.mjs";
+import { OpenId4VcIssuerRepository } from "./repository/OpenId4VcIssuerRepository.mjs";
+import "./repository/index.mjs";
+import { generateTxCode } from "./util/txCode.mjs";
+import { AgentContext, ClaimFormat, CredoError, EventEmitter, JwsService, Jwt, JwtPayload, Kms, MdocApi, SdJwtVcApi, TypedArrayEncoder, W3cCredentialService, W3cV2CredentialService, injectable, joinUriParts, utils } from "@credo-ts/core";
+import { HashAlgorithm, Oauth2AuthorizationServer, Oauth2Client, Oauth2ErrorCodes, Oauth2ResourceServer, Oauth2ServerErrorResponseError, PkceCodeChallengeMethod, authorizationCodeGrantIdentifier, calculateJwkThumbprint, preAuthorizedCodeGrantIdentifier } from "@openid4vc/oauth2";
+import { Openid4vciDraftVersion, Openid4vciIssuer, extractScopesForCredentialConfigurationIds, getCredentialConfigurationsMatchingRequestFormat } from "@openid4vc/openid4vci";
+
+//#region src/openid4vc-issuer/OpenId4VcIssuerService.ts
+var _ref, _ref2, _ref3, _ref4, _ref5;
+let OpenId4VcIssuerService = class OpenId4VcIssuerService$1 {
+	constructor(w3cCredentialService, w3cV2CredentialService, openId4VcIssuerConfig, openId4VcIssuerRepository, openId4VcIssuanceSessionRepository) {
+		this.w3cCredentialService = w3cCredentialService;
+		this.w3cV2CredentialService = w3cV2CredentialService;
+		this.openId4VcIssuerConfig = openId4VcIssuerConfig;
+		this.openId4VcIssuerRepository = openId4VcIssuerRepository;
+		this.openId4VcIssuanceSessionRepository = openId4VcIssuanceSessionRepository;
+	}
+	async createStatelessCredentialOffer(agentContext, options) {
+		const { authorizationCodeFlowConfig, issuer, credentialConfigurationIds } = options;
+		const vcIssuer = this.getIssuer(agentContext);
+		const issuerMetadata = await this.getIssuerMetadata(agentContext, issuer);
+		if (Array.from(new Set(options.credentialConfigurationIds)).length !== credentialConfigurationIds.length) throw new CredoError("All offered credentials must have unique ids.");
+		extractScopesForCredentialConfigurationIds({
+			credentialConfigurationIds: options.credentialConfigurationIds,
+			issuerMetadata,
+			throwOnConfigurationWithoutScope: true
+		});
+		if (authorizationCodeFlowConfig.authorizationServerUrl === issuerMetadata.credentialIssuer.credential_issuer) throw new CredoError("Stateless offers can only be created for external authorization servers. Make sure to configure an external authorization server on the issuer record, and provide the authoriation server url.");
+		const { credentialOffer, credentialOfferObject } = await vcIssuer.createCredentialOffer({
+			credentialConfigurationIds: options.credentialConfigurationIds,
+			grants: { authorization_code: { authorization_server: authorizationCodeFlowConfig.authorizationServerUrl } },
+			credentialOfferScheme: options.baseUri,
+			issuerMetadata
+		});
+		return {
+			credentialOffer,
+			credentialOfferObject
+		};
+	}
+	async createCredentialOffer(agentContext, options) {
+		const { preAuthorizedCodeFlowConfig, authorizationCodeFlowConfig, issuer, credentialConfigurationIds, version = "v1.draft15", authorization } = options;
+		if (!preAuthorizedCodeFlowConfig && !authorizationCodeFlowConfig) throw new CredoError("Authorization Config or Pre-Authorized Config must be provided.");
+		const vcIssuer = this.getIssuer(agentContext);
+		const issuerMetadata = await this.getIssuerMetadata(agentContext, issuer);
+		const uniqueOfferedCredentials = Array.from(new Set(options.credentialConfigurationIds));
+		if (uniqueOfferedCredentials.length !== credentialConfigurationIds.length) throw new CredoError("All offered credentials must have unique ids.");
+		if (uniqueOfferedCredentials.length === 0) throw new CredoError("You need to offer at least one credential.");
+		const credentialOfferId = utils.uuid();
+		const hostedCredentialOfferUri = joinUriParts(issuerMetadata.credentialIssuer.credential_issuer, [this.openId4VcIssuerConfig.credentialOfferEndpointPath, credentialOfferId]);
+		if (options.authorizationCodeFlowConfig) extractScopesForCredentialConfigurationIds({
+			credentialConfigurationIds: options.credentialConfigurationIds,
+			issuerMetadata,
+			throwOnConfigurationWithoutScope: true
+		});
+		const grants = await this.getGrantsFromConfig(agentContext, {
+			issuer,
+			issuerMetadata,
+			preAuthorizedCodeFlowConfig,
+			authorizationCodeFlowConfig
+		});
+		const { credentialOffer, credentialOfferObject } = await vcIssuer.createCredentialOffer({
+			credentialConfigurationIds: options.credentialConfigurationIds,
+			grants,
+			credentialOfferUri: hostedCredentialOfferUri,
+			credentialOfferScheme: options.baseUri,
+			issuerMetadata: {
+				...issuerMetadata,
+				originalDraftVersion: version === "v1.draft11-14" ? Openid4vciDraftVersion.Draft11 : Openid4vciDraftVersion.Draft15
+			}
+		});
+		const createdAt = /* @__PURE__ */ new Date();
+		const expiresAt = utils.addSecondsToDate(createdAt, this.openId4VcIssuerConfig.statefulCredentialOfferExpirationInSeconds);
+		const chainedAuthorizationServerConfig = issuer.chainedAuthorizationServerConfigs?.find((config) => config.issuer === authorizationCodeFlowConfig?.authorizationServerUrl);
+		const issuanceSessionRepository = this.openId4VcIssuanceSessionRepository;
+		const issuanceSession = new OpenId4VcIssuanceSessionRecord({
+			createdAt,
+			expiresAt,
+			credentialOfferPayload: credentialOfferObject,
+			credentialOfferUri: hostedCredentialOfferUri,
+			credentialOfferId,
+			issuerId: issuer.issuerId,
+			state: OpenId4VcIssuanceSessionState.OfferCreated,
+			authorization: credentialOfferObject.grants?.authorization_code?.issuer_state ? { issuerState: credentialOfferObject.grants?.authorization_code?.issuer_state } : void 0,
+			presentation: authorizationCodeFlowConfig?.requirePresentationDuringIssuance ? { required: true } : void 0,
+			dpop: authorization?.requireDpop ? { required: true } : void 0,
+			walletAttestation: authorization?.requireWalletAttestation ? { required: true } : void 0,
+			chainedIdentity: chainedAuthorizationServerConfig ? { externalAuthorizationServerUrl: chainedAuthorizationServerConfig.issuer } : void 0,
+			preAuthorizedCode: credentialOfferObject.grants?.[preAuthorizedCodeGrantIdentifier]?.["pre-authorized_code"],
+			userPin: preAuthorizedCodeFlowConfig?.txCode ? generateTxCode(agentContext, preAuthorizedCodeFlowConfig.txCode) : void 0,
+			generateRefreshTokens: options.generateRefreshTokens,
+			issuanceMetadata: options.issuanceMetadata,
+			openId4VciVersion: version
+		});
+		await issuanceSessionRepository.save(agentContext, issuanceSession);
+		this.emitStateChangedEvent(agentContext, issuanceSession, null);
+		return {
+			issuanceSession,
+			credentialOffer
+		};
+	}
+	async createCredentialResponse(agentContext, options) {
+		options.issuanceSession.assertState([
+			OpenId4VcIssuanceSessionState.OfferUriRetrieved,
+			OpenId4VcIssuanceSessionState.AccessTokenCreated,
+			OpenId4VcIssuanceSessionState.CredentialRequestReceived,
+			OpenId4VcIssuanceSessionState.CredentialsPartiallyIssued
+		]);
+		const { issuanceSession } = options;
+		const issuer = await this.getIssuerByIssuerId(agentContext, options.issuanceSession.issuerId);
+		const vcIssuer = this.getIssuer(agentContext, { issuanceSessionId: issuanceSession.id });
+		const issuerMetadata = await this.getIssuerMetadata(agentContext, issuer);
+		const parsedCredentialRequest = vcIssuer.parseCredentialRequest({
+			issuerMetadata,
+			credentialRequest: options.credentialRequest
+		});
+		const { credentialRequest, credentialIdentifier, format } = parsedCredentialRequest;
+		if (credentialIdentifier) throw new Oauth2ServerErrorResponseError({
+			error: Oauth2ErrorCodes.InvalidCredentialRequest,
+			error_description: `Using unsupported 'credential_identifier'`
+		});
+		if (credentialRequest.format && !format && !parsedCredentialRequest.credentialConfigurationId) throw new Oauth2ServerErrorResponseError({
+			error: Oauth2ErrorCodes.UnsupportedCredentialFormat,
+			error_description: `Unsupported credential request based on format '${credentialRequest.format}'`
+		});
+		if (parsedCredentialRequest.credentialConfigurationId && !parsedCredentialRequest.credentialConfiguration) throw new Oauth2ServerErrorResponseError({
+			error: Oauth2ErrorCodes.UnsupportedCredentialFormat,
+			error_description: `Unsupported credential request based on credential configuration id ${credentialRequest.credential_configuration_id}`
+		});
+		const { credentialConfiguration, credentialConfigurationId } = this.getCredentialConfigurationsForRequest({
+			issuanceSession,
+			issuerMetadata,
+			requestFormat: format,
+			credentialConfigurations: parsedCredentialRequest.credentialConfiguration && parsedCredentialRequest.credentialConfigurationId ? { [parsedCredentialRequest.credentialConfigurationId]: parsedCredentialRequest.credentialConfiguration } : void 0,
+			authorization: options.authorization
+		});
+		const verifiedCredentialRequestProofs = await this.verifyCredentialRequestProofs(agentContext, {
+			issuanceSession,
+			issuer,
+			parsedCredentialRequest,
+			credentialConfiguration,
+			credentialConfigurationId
+		});
+		const mapper = options.credentialRequestToCredentialMapper ?? this.openId4VcIssuerConfig.credentialRequestToCredentialMapper;
+		let verification;
+		if (issuanceSession.presentation?.openId4VcVerificationSessionId) {
+			const verifierApi = agentContext.dependencyManager.resolve(OpenId4VcVerifierApi);
+			const session = await verifierApi.getVerificationSessionById(issuanceSession.presentation.openId4VcVerificationSessionId);
+			const response = await verifierApi.getVerifiedAuthorizationResponse(issuanceSession.presentation.openId4VcVerificationSessionId);
+			if (response.presentationExchange) verification = {
+				session,
+				presentationExchange: response.presentationExchange
+			};
+			else if (response.dcql) verification = {
+				session,
+				dcql: response.dcql
+			};
+			else throw new CredoError(`Verified authorization response for verification session with id '${session.id}' does not have presentationExchange or dcql defined.`);
+		}
+		const signOptionsOrDeferral = await mapper({
+			agentContext,
+			issuanceSession,
+			holderBinding: verifiedCredentialRequestProofs,
+			credentialOffer: issuanceSession.credentialOfferPayload,
+			verification,
+			credentialRequest: options.credentialRequest,
+			credentialRequestFormat: format,
+			credentialConfiguration,
+			credentialConfigurationId,
+			authorization: options.authorization
+		});
+		let credentialResponse;
+		const { cNonce, cNonceExpiresInSeconds } = await this.createNonce(agentContext, issuer);
+		if (signOptionsOrDeferral.type === "deferral") {
+			credentialResponse = vcIssuer.createCredentialResponse({
+				transactionId: signOptionsOrDeferral.transactionId,
+				interval: signOptionsOrDeferral.interval,
+				cNonce,
+				cNonceExpiresInSeconds,
+				credentialRequest: parsedCredentialRequest
+			});
+			issuanceSession.transactions.push({
+				transactionId: signOptionsOrDeferral.transactionId,
+				numberOfCredentials: verifiedCredentialRequestProofs.keys.length,
+				credentialConfigurationId
+			});
+			const newState = issuanceSession.state === OpenId4VcIssuanceSessionState.CredentialsPartiallyIssued ? OpenId4VcIssuanceSessionState.CredentialsPartiallyIssued : OpenId4VcIssuanceSessionState.CredentialRequestReceived;
+			await this.updateExpiresAt(agentContext, issuanceSession, signOptionsOrDeferral.interval);
+			await this.updateState(agentContext, issuanceSession, newState);
+		} else {
+			const credentials = await this.getSignedCredentials(agentContext, signOptionsOrDeferral, {
+				issuanceSession,
+				credentialConfiguration,
+				expectedLength: verifiedCredentialRequestProofs.keys.length
+			});
+			credentialResponse = vcIssuer.createCredentialResponse({
+				credential: credentialRequest.proof ? credentials.credentials[0] : void 0,
+				credentials: credentialRequest.proofs ? issuanceSession.openId4VciVersion === "v1" || issuanceSession.openId4VciVersion === "v1.draft15" ? credentials.credentials.map((c) => ({ credential: c })) : credentials.credentials : void 0,
+				cNonce,
+				cNonceExpiresInSeconds,
+				credentialRequest: parsedCredentialRequest
+			});
+			issuanceSession.issuedCredentials.push(credentialConfigurationId);
+			const newState = issuanceSession.issuedCredentials.length >= issuanceSession.credentialOfferPayload.credential_configuration_ids.length ? OpenId4VcIssuanceSessionState.Completed : OpenId4VcIssuanceSessionState.CredentialsPartiallyIssued;
+			await this.updateState(agentContext, issuanceSession, newState);
+		}
+		return {
+			credentialResponse,
+			issuanceSession
+		};
+	}
+	async createDeferredCredentialResponse(agentContext, options) {
+		options.issuanceSession.assertState([OpenId4VcIssuanceSessionState.CredentialRequestReceived, OpenId4VcIssuanceSessionState.CredentialsPartiallyIssued]);
+		const transaction = options.issuanceSession.transactions.find((tx) => tx.transactionId === options.deferredCredentialRequest.transaction_id);
+		if (!transaction) throw new CredoError("OpenId4VcIssuanceSessionRecord does not contain transaction with given transaction_id.");
+		const { issuanceSession } = options;
+		const issuer = await this.getIssuerByIssuerId(agentContext, options.issuanceSession.issuerId);
+		const vcIssuer = this.getIssuer(agentContext, { issuanceSessionId: issuanceSession.id });
+		const credentialConfigurationId = transaction.credentialConfigurationId;
+		const credentialConfiguration = issuer.credentialConfigurationsSupported[transaction.credentialConfigurationId];
+		if (!credentialConfiguration) throw new CredoError("Issuer does not contain credential configuration for the given credential configuration id.");
+		const mapper = options.deferredCredentialRequestToCredentialMapper ?? this.openId4VcIssuerConfig.deferredCredentialRequestToCredentialMapper;
+		if (!mapper) throw new CredoError("OpenId4VcIssuerService does not have a defined deferredCredentialRequestToCredentialMapper.");
+		const signOptionsOrDeferral = await mapper({
+			agentContext,
+			issuanceSession,
+			deferredCredentialRequest: options.deferredCredentialRequest,
+			authorization: options.authorization
+		});
+		let deferredCredentialResponse;
+		if (signOptionsOrDeferral.type === "deferral") {
+			deferredCredentialResponse = vcIssuer.createDeferredCredentialResponse({
+				interval: signOptionsOrDeferral.interval,
+				transactionId: signOptionsOrDeferral.transactionId
+			});
+			await this.updateExpiresAt(agentContext, issuanceSession, signOptionsOrDeferral.interval);
+		} else {
+			const credentials = await this.getSignedCredentials(agentContext, signOptionsOrDeferral, {
+				issuanceSession,
+				credentialConfiguration,
+				expectedLength: transaction.numberOfCredentials
+			});
+			deferredCredentialResponse = vcIssuer.createDeferredCredentialResponse({ credentials: credentials.credentials.map((c) => ({ credential: c })) });
+			issuanceSession.issuedCredentials.push(credentialConfigurationId);
+			issuanceSession.transactions = issuanceSession.transactions?.filter((tx) => tx.transactionId !== transaction.transactionId);
+			const newState = issuanceSession.issuedCredentials.length >= issuanceSession.credentialOfferPayload.credential_configuration_ids.length ? OpenId4VcIssuanceSessionState.Completed : OpenId4VcIssuanceSessionState.CredentialsPartiallyIssued;
+			await this.updateState(agentContext, issuanceSession, newState);
+		}
+		return {
+			deferredCredentialResponse,
+			issuanceSession
+		};
+	}
+	async verifyCredentialRequestProofs(agentContext, options) {
+		const { parsedCredentialRequest, issuer, issuanceSession, credentialConfiguration, credentialConfigurationId } = options;
+		const { proofs } = parsedCredentialRequest;
+		const vcIssuer = this.getIssuer(agentContext, { issuanceSessionId: issuanceSession.id });
+		const issuerMetadata = await this.getIssuerMetadata(agentContext, issuer);
+		const allowedProofTypes = credentialConfiguration.proof_types_supported ?? { jwt: { proof_signing_alg_values_supported: getSupportedJwaSignatureAlgorithms(agentContext) } };
+		const [proofType, proofValue] = Object.entries(proofs ?? {})[0] ?? [];
+		if (!proofType || !proofValue || proofValue.length === 0) {
+			const { cNonce, cNonceExpiresInSeconds } = await this.createNonce(agentContext, issuer);
+			throw new Oauth2ServerErrorResponseError({
+				error: Oauth2ErrorCodes.InvalidProof,
+				error_description: "Missing required proof(s) in credential request",
+				c_nonce: cNonce,
+				c_nonce_expires_in: cNonceExpiresInSeconds
+			});
+		}
+		if (proofType !== "jwt" && proofType !== "attestation") throw new Oauth2ServerErrorResponseError({
+			error: Oauth2ErrorCodes.InvalidProof,
+			error_description: `Proof type '${proofType}' is not supported `
+		});
+		const supportedProofType = allowedProofTypes[proofType];
+		if (!supportedProofType) throw new Oauth2ServerErrorResponseError({
+			error: Oauth2ErrorCodes.InvalidProof,
+			error_description: `Proof type '${proofType}' is not supported for credential configuration '${credentialConfigurationId}'`
+		});
+		if (proofType === "attestation" && proofValue.length !== 1) throw new Oauth2ServerErrorResponseError({
+			error: Oauth2ErrorCodes.InvalidProof,
+			error_description: "Only a single proofs entry is supported for proof type 'attestation'"
+		});
+		await this.updateState(agentContext, issuanceSession, OpenId4VcIssuanceSessionState.CredentialRequestReceived);
+		if (proofType === "attestation") {
+			const keyAttestationJwt = proofValue[0];
+			const keyAttestation = await vcIssuer.verifyCredentialRequestAttestationProof({
+				issuerMetadata,
+				keyAttestationJwt
+			});
+			if (!supportedProofType.proof_signing_alg_values_supported.includes(keyAttestation.header.alg)) throw new Oauth2ServerErrorResponseError({
+				error: Oauth2ErrorCodes.InvalidProof,
+				error_description: `Proof signing alg value '${keyAttestation.header.alg}' is not supported for proof type 'attestation' in credential configuration '${credentialConfigurationId}'`
+			});
+			if (!keyAttestation.payload.nonce) {
+				const { cNonce, cNonceExpiresInSeconds } = await this.createNonce(agentContext, issuer);
+				throw new Oauth2ServerErrorResponseError({
+					error: Oauth2ErrorCodes.InvalidProof,
+					error_description: "Missing nonce in attestation proof in credential request. If no nonce is present in the attestation, use the jwt proof type instead",
+					c_nonce: cNonce,
+					c_nonce_expires_in: cNonceExpiresInSeconds
+				});
+			}
+			if (supportedProofType.key_attestations_required && keyAttestation) {
+				const expectedKeyStorage = supportedProofType.key_attestations_required.key_storage;
+				const expectedUserAuthentication = supportedProofType.key_attestations_required.user_authentication;
+				if (expectedKeyStorage && !expectedKeyStorage.some((keyStorage) => keyAttestation.payload.key_storage?.includes(keyStorage))) throw new Oauth2ServerErrorResponseError({
+					error: Oauth2ErrorCodes.InvalidProof,
+					error_description: `Insufficient key_storage for key attestation. Proof type 'attestation' for credential configuration '${credentialConfigurationId}', expects one of key_storage values ${expectedKeyStorage.join(", ")}`
+				});
+				if (expectedUserAuthentication && !expectedUserAuthentication.some((userAuthentication) => keyAttestation.payload.user_authentication?.includes(userAuthentication))) throw new Oauth2ServerErrorResponseError({
+					error: Oauth2ErrorCodes.InvalidProof,
+					error_description: `Insufficient user_authentication for key attestation. Proof type 'attestation' for credential configuration '${credentialConfigurationId}', expects one of user_authentication values ${expectedUserAuthentication.join(", ")}`
+				});
+			}
+			await this.verifyNonce(agentContext, issuer, keyAttestation.payload.nonce).catch(async (error) => {
+				const { cNonce, cNonceExpiresInSeconds } = await this.createNonce(agentContext, issuer);
+				throw new Oauth2ServerErrorResponseError({
+					error: Oauth2ErrorCodes.InvalidNonce,
+					error_description: "Invalid nonce in credential request",
+					c_nonce: cNonce,
+					c_nonce_expires_in: cNonceExpiresInSeconds
+				}, { cause: error });
+			});
+			return {
+				bindingMethod: "jwk",
+				keys: keyAttestation.payload.attested_keys.map((attestedKey) => {
+					return {
+						method: "jwk",
+						jwk: Kms.PublicJwk.fromUnknown(attestedKey)
+					};
+				}),
+				proofType: "attestation",
+				keyAttestation
+			};
+		}
+		if (proofType === "jwt") {
+			let firstNonce;
+			const proofSigners = [];
+			for (const jwt of proofValue) {
+				const { signer, payload, header, keyAttestation } = await vcIssuer.verifyCredentialRequestJwtProof({
+					issuerMetadata,
+					jwt,
+					clientId: options.issuanceSession.clientId
+				});
+				if (!supportedProofType.proof_signing_alg_values_supported.includes(header.alg)) throw new Oauth2ServerErrorResponseError({
+					error: Oauth2ErrorCodes.InvalidProof,
+					error_description: `Proof signing alg value '${header.alg}' is not supported for proof type 'jwt' in credential configuration '${credentialConfigurationId}'`
+				});
+				if (signer.method !== "jwk" && signer.method !== "did") throw new Oauth2ServerErrorResponseError({
+					error: Oauth2ErrorCodes.InvalidProof,
+					error_description: "Only 'jwk' and 'did' binding methods supported for jwt proof"
+				});
+				if (proofSigners[0] && signer.method !== proofSigners[0].method) throw new Oauth2ServerErrorResponseError({
+					error: Oauth2ErrorCodes.InvalidProof,
+					error_description: "All proofs must be signed using the same binding method. Found a mix of 'did' and 'jwk'"
+				});
+				if (proofSigners[0] && signer.alg !== proofSigners[0].alg) throw new Oauth2ServerErrorResponseError({
+					error: Oauth2ErrorCodes.InvalidProof,
+					error_description: "All proofs must be signed using the same alg value. Found a mix of different 'alg' values."
+				});
+				if (keyAttestation && signer.method === "did") throw new Oauth2ServerErrorResponseError({
+					error: Oauth2ErrorCodes.InvalidProof,
+					error_description: "Binding method 'did' is not supported when a key attestation is provided."
+				});
+				if (supportedProofType.key_attestations_required && !keyAttestation) throw new Oauth2ServerErrorResponseError({
+					error: Oauth2ErrorCodes.InvalidProof,
+					error_description: `Missing required key attestation. Key attestations are required for proof type 'jwt' in credential configuration '${credentialConfigurationId}'`
+				});
+				if (supportedProofType.key_attestations_required && keyAttestation) {
+					const expectedKeyStorage = supportedProofType.key_attestations_required.key_storage;
+					const expectedUserAuthentication = supportedProofType.key_attestations_required.user_authentication;
+					if (expectedKeyStorage && !expectedKeyStorage.some((keyStorage) => keyAttestation.payload.key_storage?.includes(keyStorage))) throw new Oauth2ServerErrorResponseError({
+						error: Oauth2ErrorCodes.InvalidProof,
+						error_description: `Insufficient key_storage for key attestation. Proof type 'jwt' for credential configuration '${credentialConfigurationId}', expects one of key_storage values ${expectedKeyStorage.join(", ")}`
+					});
+					if (expectedUserAuthentication && !expectedUserAuthentication.some((userAuthentication) => keyAttestation.payload.user_authentication?.includes(userAuthentication))) throw new Oauth2ServerErrorResponseError({
+						error: Oauth2ErrorCodes.InvalidProof,
+						error_description: `Insufficient user_authentication for key attestation. Proof type 'jwt' for credential configuration '${credentialConfigurationId}', expects one of user_authentication values ${expectedUserAuthentication.join(", ")}`
+					});
+				}
+				if (keyAttestation && proofValue.length > 1) throw new Oauth2ServerErrorResponseError({
+					error: Oauth2ErrorCodes.InvalidProof,
+					error_description: "Only a single proofs entry is supported when jwt proof header contains  'key_attestation'"
+				});
+				if (!payload.nonce) {
+					const { cNonce, cNonceExpiresInSeconds } = await this.createNonce(agentContext, issuer);
+					throw new Oauth2ServerErrorResponseError({
+						error: Oauth2ErrorCodes.InvalidProof,
+						error_description: "Missing nonce in proof(s) in credential request",
+						c_nonce: cNonce,
+						c_nonce_expires_in: cNonceExpiresInSeconds
+					});
+				}
+				if (!firstNonce) firstNonce = payload.nonce;
+				if (firstNonce !== payload.nonce) {
+					const { cNonce, cNonceExpiresInSeconds } = await this.createNonce(agentContext, issuer);
+					throw new Oauth2ServerErrorResponseError({
+						error: Oauth2ErrorCodes.InvalidProof,
+						error_description: "Not all nonce values in proofs are equal",
+						c_nonce: cNonce,
+						c_nonce_expires_in: cNonceExpiresInSeconds
+					});
+				}
+				if (keyAttestation?.payload.nonce && keyAttestation.payload.nonce !== payload.nonce) throw new Oauth2ServerErrorResponseError({
+					error: Oauth2ErrorCodes.InvalidProof,
+					error_description: "If a nonce is present in the key attestation, the nonce in the proof jwt must be equal to the nonce in the key attestation"
+				});
+				await this.verifyNonce(agentContext, issuer, payload.nonce).catch(async (error) => {
+					const { cNonce, cNonceExpiresInSeconds } = await this.createNonce(agentContext, issuer);
+					throw new Oauth2ServerErrorResponseError({
+						error: Oauth2ErrorCodes.InvalidNonce,
+						error_description: "Invalid nonce in credential request",
+						c_nonce: cNonce,
+						c_nonce_expires_in: cNonceExpiresInSeconds
+					}, { cause: error });
+				});
+				if (keyAttestation) return {
+					proofType: "jwt",
+					bindingMethod: "jwk",
+					keys: keyAttestation.payload.attested_keys.map((attestedKey) => {
+						return {
+							method: "jwk",
+							jwk: Kms.PublicJwk.fromUnknown(attestedKey)
+						};
+					}),
+					keyAttestation
+				};
+				proofSigners.push(signer);
+			}
+			if (proofSigners[0].method === "did") return {
+				proofType: "jwt",
+				bindingMethod: "did",
+				keys: proofSigners.map((signer) => ({
+					didUrl: signer.didUrl,
+					method: "did",
+					jwk: Kms.PublicJwk.fromUnknown(signer.publicJwk)
+				}))
+			};
+			return {
+				proofType: "jwt",
+				bindingMethod: "jwk",
+				keys: proofSigners.map((signer) => {
+					return {
+						method: "jwk",
+						jwk: Kms.PublicJwk.fromUnknown(signer.publicJwk)
+					};
+				})
+			};
+		}
+		throw new Oauth2ServerErrorResponseError({
+			error: Oauth2ErrorCodes.InvalidProof,
+			error_description: "Missing required proof(s) in credential request"
+		});
+	}
+	async findIssuanceSessionsByQuery(agentContext, query, queryOptions) {
+		return this.openId4VcIssuanceSessionRepository.findByQuery(agentContext, query, queryOptions);
+	}
+	async findSingleIssuanceSessionByQuery(agentContext, query) {
+		return this.openId4VcIssuanceSessionRepository.findSingleByQuery(agentContext, query);
+	}
+	async getIssuanceSessionById(agentContext, issuanceSessionId) {
+		return this.openId4VcIssuanceSessionRepository.getById(agentContext, issuanceSessionId);
+	}
+	async getAllIssuers(agentContext) {
+		return this.openId4VcIssuerRepository.getAll(agentContext);
+	}
+	async getIssuerByIssuerId(agentContext, issuerId) {
+		return this.openId4VcIssuerRepository.getByIssuerId(agentContext, issuerId);
+	}
+	async updateIssuer(agentContext, issuer) {
+		if (issuer.signedMetadata) {
+			const issuerMetadata = await this.getIssuerMetadata(agentContext, issuer, false);
+			issuer.signedMetadata = await this.createSignedMetadata(agentContext, issuerMetadata.credentialIssuer, decodeJwtIssuer(issuer.signedMetadata.signer));
+		}
+		await this.openId4VcIssuerRepository.update(agentContext, issuer);
+	}
+	async createIssuer(agentContext, options) {
+		const accessTokenSignerKey = await agentContext.resolve(Kms.KeyManagementApi).createKey({ type: options.accessTokenSignerKeyType ?? {
+			kty: "OKP",
+			crv: "Ed25519"
+		} });
+		const openId4VcIssuer = new OpenId4VcIssuerRecord({
+			issuerId: options.issuerId ?? utils.uuid(),
+			display: options.display,
+			dpopSigningAlgValuesSupported: options.dpopSigningAlgValuesSupported,
+			accessTokenPublicJwk: accessTokenSignerKey.publicJwk,
+			authorizationServerConfigs: options.authorizationServerConfigs,
+			credentialConfigurationsSupported: options.credentialConfigurationsSupported,
+			batchCredentialIssuance: options.batchCredentialIssuance
+		});
+		if (options.metadataSigner) {
+			const issuerMetadata = await this.getIssuerMetadata(agentContext, openId4VcIssuer, false);
+			openId4VcIssuer.signedMetadata = await this.createSignedMetadata(agentContext, issuerMetadata.credentialIssuer, options.metadataSigner);
+		}
+		await this.openId4VcIssuerRepository.save(agentContext, openId4VcIssuer);
+		await storeActorIdForContextCorrelationId(agentContext, openId4VcIssuer.issuerId);
+		return openId4VcIssuer;
+	}
+	async createSignedMetadata(agentContext, credentialIssuerMetadata, metadataSigner) {
+		return {
+			jwt: await this.getIssuer(agentContext).createSignedCredentialIssuerMetadataJwt({
+				credentialIssuerMetadata,
+				signer: await credoJwtIssuerToOpenId4VcJwtIssuer(agentContext, metadataSigner)
+			}),
+			signer: encodeJwtIssuer(metadataSigner)
+		};
+	}
+	async rotateAccessTokenSigningKey(agentContext, issuer, options) {
+		const kms = agentContext.resolve(Kms.KeyManagementApi);
+		const previousKey = issuer.resolvedAccessTokenPublicJwk;
+		issuer.accessTokenPublicJwk = (await kms.createKey({ type: options?.accessTokenSignerKeyType ?? {
+			kty: "OKP",
+			crv: "Ed25519"
+		} })).publicJwk;
+		await this.openId4VcIssuerRepository.update(agentContext, issuer);
+		await kms.deleteKey({ keyId: previousKey.keyId });
+	}
+	/**
+	* @param fetchExternalAuthorizationServerMetadata defaults to false
+	*/
+	async getIssuerMetadata(agentContext, issuerRecord, fetchExternalAuthorizationServerMetadata = false) {
+		const config = agentContext.dependencyManager.resolve(OpenId4VcIssuerModuleConfig);
+		const issuerUrl = joinUriParts(config.baseUrl, [issuerRecord.issuerId]);
+		const oauth2Client = this.getOauth2Client(agentContext);
+		const directAuthorizationServerConfigs = issuerRecord.directAuthorizationServerConfigs;
+		const extraAuthorizationServers = fetchExternalAuthorizationServerMetadata && directAuthorizationServerConfigs ? await Promise.all(directAuthorizationServerConfigs.map(async (server) => {
+			const metadata = await oauth2Client.fetchAuthorizationServerMetadata(server.issuer);
+			if (!metadata) throw new CredoError(`Authorization server metadata not found for issuer '${server.issuer}'`);
+			return metadata;
+		})) : [];
+		const authorizationServers = directAuthorizationServerConfigs && directAuthorizationServerConfigs.length > 0 ? [...directAuthorizationServerConfigs.map((authorizationServer) => authorizationServer.issuer), issuerUrl] : void 0;
+		const credentialIssuerMetadata = {
+			credential_issuer: issuerUrl,
+			credential_endpoint: joinUriParts(issuerUrl, [config.credentialEndpointPath]),
+			deferred_credential_endpoint: joinUriParts(issuerUrl, [config.deferredCredentialEndpointPath]),
+			credential_configurations_supported: issuerRecord.credentialConfigurationsSupported ?? {},
+			authorization_servers: authorizationServers,
+			display: issuerRecord.display,
+			nonce_endpoint: joinUriParts(issuerUrl, [config.nonceEndpointPath]),
+			batch_credential_issuance: issuerRecord.batchCredentialIssuance ? { batch_size: issuerRecord.batchCredentialIssuance.batchSize } : void 0
+		};
+		const issuerAuthorizationServer = {
+			issuer: issuerUrl,
+			token_endpoint: joinUriParts(issuerUrl, [config.accessTokenEndpointPath]),
+			"pre-authorized_grant_anonymous_access_supported": true,
+			jwks_uri: joinUriParts(issuerUrl, [config.jwksEndpointPath]),
+			grant_types_supported: [authorizationCodeGrantIdentifier, preAuthorizedCodeGrantIdentifier],
+			authorization_challenge_endpoint: joinUriParts(issuerUrl, [config.authorizationChallengeEndpointPath]),
+			authorization_endpoint: joinUriParts(issuerUrl, [config.authorizationEndpoint]),
+			pushed_authorization_request_endpoint: joinUriParts(issuerUrl, [config.pushedAuthorizationRequestEndpoint]),
+			require_pushed_authorization_requests: true,
+			code_challenge_methods_supported: [PkceCodeChallengeMethod.S256],
+			dpop_signing_alg_values_supported: issuerRecord.dpopSigningAlgValuesSupported
+		};
+		return {
+			originalDraftVersion: Openid4vciDraftVersion.V1,
+			credentialIssuer: credentialIssuerMetadata,
+			authorizationServers: [issuerAuthorizationServer, ...extraAuthorizationServers],
+			knownCredentialConfigurations: credentialIssuerMetadata.credential_configurations_supported,
+			signedMetadataJwt: issuerRecord.signedMetadata?.jwt
+		};
+	}
+	async createNonce(agentContext, issuer) {
+		const issuerMetadata = await this.getIssuerMetadata(agentContext, issuer);
+		const jwsService = agentContext.dependencyManager.resolve(JwsService);
+		const cNonceExpiresInSeconds = this.openId4VcIssuerConfig.cNonceExpiresInSeconds;
+		const cNonceExpiresAt = utils.addSecondsToDate(/* @__PURE__ */ new Date(), cNonceExpiresInSeconds);
+		const key = issuer.resolvedAccessTokenPublicJwk;
+		return {
+			cNonce: await jwsService.createJwsCompact(agentContext, {
+				keyId: key.keyId,
+				payload: JwtPayload.fromJson({
+					iss: issuerMetadata.credentialIssuer.credential_issuer,
+					exp: utils.dateToSeconds(cNonceExpiresAt)
+				}),
+				protectedHeaderOptions: {
+					typ: "credo+cnonce",
+					kid: key.keyId,
+					alg: key.signatureAlgorithm
+				}
+			}),
+			cNonceExpiresAt,
+			cNonceExpiresInSeconds
+		};
+	}
+	/**
+	* @todo nonces are very short lived (1 min), but it might be nice to also cache the nonces
+	* in the cache if we have 'seen' them. They will only be in the cache for a short time
+	* and it will prevent replay
+	*/
+	async verifyNonce(agentContext, issuer, cNonce) {
+		const issuerMetadata = await this.getIssuerMetadata(agentContext, issuer);
+		const jwsService = agentContext.dependencyManager.resolve(JwsService);
+		const key = issuer.resolvedAccessTokenPublicJwk;
+		const jwt = Jwt.fromSerializedJwt(cNonce);
+		jwt.payload.validate();
+		if (jwt.payload.iss !== issuerMetadata.credentialIssuer.credential_issuer) throw new CredoError(`Invalid 'iss' claim in cNonce jwt`);
+		if (jwt.header.typ !== "credo+cnonce") throw new CredoError(`Invalid 'typ' claim in cNonce jwt header`);
+		if (!(await jwsService.verifyJws(agentContext, {
+			jws: cNonce,
+			jwsSigner: {
+				method: "jwk",
+				jwk: key
+			}
+		})).isValid) throw new CredoError("Invalid nonce");
+	}
+	async createRefreshToken(agentContext, issuer, options) {
+		const issuerMetadata = await this.getIssuerMetadata(agentContext, issuer);
+		const jwsService = agentContext.dependencyManager.resolve(JwsService);
+		const expiresInSeconds = this.openId4VcIssuerConfig.refreshTokenExpiresInSeconds;
+		const expiresAt = utils.addSecondsToDate(/* @__PURE__ */ new Date(), expiresInSeconds);
+		const key = issuer.resolvedAccessTokenPublicJwk;
+		return await jwsService.createJwsCompact(agentContext, {
+			keyId: key.keyId,
+			payload: JwtPayload.fromJson({
+				iss: issuerMetadata.credentialIssuer.credential_issuer,
+				aud: issuerMetadata.credentialIssuer.credential_issuer,
+				exp: utils.dateToSeconds(expiresAt),
+				issuer_state: options.issuerState,
+				"pre-authorized_code": options.preAuthorizedCode,
+				cnf: options.dpop ? { jkt: await calculateJwkThumbprint({
+					hashAlgorithm: HashAlgorithm.Sha256,
+					hashCallback: getOid4vcCallbacks(agentContext).hash,
+					jwk: options.dpop.jwk
+				}) } : void 0
+			}),
+			protectedHeaderOptions: {
+				typ: "credo+refresh_token",
+				kid: key.keyId,
+				alg: key.signatureAlgorithm
+			}
+		});
+	}
+	parseRefreshToken(token) {
+		const jwt = Jwt.fromSerializedJwt(token);
+		jwt.payload.validate();
+		if (!jwt.payload.exp) throw new CredoError(`Missing 'exp' claim in refresh token jwt`);
+		if (jwt.header.typ !== "credo+refresh_token") throw new CredoError(`Invalid 'typ' claim in refresh token jwt header`);
+		const { "pre-authorized_code": preAuthorizedCode, issuer_state: issuerState, cnf } = jwt.payload.additionalClaims;
+		if (preAuthorizedCode && typeof preAuthorizedCode !== "string") throw new CredoError(`Invalid 'pre-authorized_code' claim in refresh token jwt payload`);
+		if (issuerState && typeof issuerState !== "string") throw new CredoError(`Invalid 'issuer_state' claim in refresh token jwt payload`);
+		if (!preAuthorizedCode && !issuerState) throw new CredoError(`Missing 'issuer_state' or 'pre-authorized_code' claim in refresh token jwt payload`);
+		let jwkThumbprint;
+		if (cnf) {
+			if (typeof cnf !== "object" || !("jkt" in cnf) || typeof cnf.jkt !== "string") throw new CredoError(`Invalid 'cnf' claim in refresh token jwt payload`);
+			jwkThumbprint = cnf.jkt;
+		}
+		return {
+			jwt,
+			expiresAt: /* @__PURE__ */ new Date(jwt.payload.exp * 1e3),
+			issuerState,
+			preAuthorizedCode,
+			dpop: jwkThumbprint ? { jwkThumbprint } : void 0
+		};
+	}
+	async verifyRefreshToken(agentContext, issuer, parsedRefreshToken, options = {}) {
+		const issuerMetadata = await this.getIssuerMetadata(agentContext, issuer);
+		const jwsService = agentContext.dependencyManager.resolve(JwsService);
+		const key = issuer.resolvedAccessTokenPublicJwk;
+		if (parsedRefreshToken.jwt.payload.iss !== issuerMetadata.credentialIssuer.credential_issuer) throw new CredoError(`Invalid 'iss' claim in refresh token jwt`);
+		if (parsedRefreshToken.jwt.payload.aud !== issuerMetadata.credentialIssuer.credential_issuer) throw new CredoError(`Invalid 'aud' claim in refresh token jwt`);
+		if (!(await jwsService.verifyJws(agentContext, {
+			jws: parsedRefreshToken.jwt.serializedJwt,
+			jwsSigner: {
+				method: "jwk",
+				jwk: key
+			}
+		})).isValid) throw new CredoError("Invalid refresh token");
+		if (options.dpop?.jwkThumbprint) {
+			if (parsedRefreshToken.dpop?.jwkThumbprint !== options.dpop.jwkThumbprint) throw new CredoError(`Invalid 'cnf.jkt' claim in refresh token jwt payload`);
+		}
+	}
+	getIssuer(agentContext, options = {}) {
+		return new Openid4vciIssuer({ callbacks: getOid4vcCallbacks(agentContext, options) });
+	}
+	getOauth2Client(agentContext, issuerRecord) {
+		return new Oauth2Client({ callbacks: {
+			...getOid4vcCallbacks(agentContext),
+			...issuerRecord ? { clientAuthentication: dynamicOid4vciClientAuthentication(agentContext, issuerRecord) } : {}
+		} });
+	}
+	getOauth2AuthorizationServer(agentContext, options = {}) {
+		return new Oauth2AuthorizationServer({ callbacks: getOid4vcCallbacks(agentContext, options) });
+	}
+	getResourceServer(agentContext, issuerRecord) {
+		return new Oauth2ResourceServer({ callbacks: {
+			...getOid4vcCallbacks(agentContext),
+			clientAuthentication: dynamicOid4vciClientAuthentication(agentContext, issuerRecord)
+		} });
+	}
+	/**
+	* Update the expiresAt field of the issuance session to ensure it remains
+	* valid during the deferral process. We set it to the maximum between the
+	* current expiresAt and the current time plus the configured expiration
+	* time or the interval multiplied by 2. This accounts for the chance of multiple
+	* deferrals happening, with longer intervals.
+	*/
+	async updateExpiresAt(agentContext, issuanceSession, interval) {
+		const expiresAt = issuanceSession.expiresAt ?? utils.addSecondsToDate(issuanceSession.createdAt, this.openId4VcIssuerConfig.statefulCredentialOfferExpirationInSeconds);
+		issuanceSession.expiresAt = new Date(Math.max(expiresAt.getTime(), utils.addSecondsToDate(/* @__PURE__ */ new Date(), Math.max(this.openId4VcIssuerConfig.statefulCredentialOfferExpirationInSeconds, interval * 2)).getTime()));
+		await this.openId4VcIssuanceSessionRepository.update(agentContext, issuanceSession);
+	}
+	/**
+	* Update the record to a new state and emit an state changed event. Also updates the record
+	* in storage.
+	*/
+	async updateState(agentContext, issuanceSession, newState) {
+		agentContext.config.logger.debug(`Updating openid4vc issuance session record ${issuanceSession.id} to state ${newState} (previous=${issuanceSession.state})`);
+		const previousState = issuanceSession.state;
+		issuanceSession.state = newState;
+		await this.openId4VcIssuanceSessionRepository.update(agentContext, issuanceSession);
+		this.emitStateChangedEvent(agentContext, issuanceSession, previousState);
+	}
+	emitStateChangedEvent(agentContext, issuanceSession, previousState) {
+		agentContext.dependencyManager.resolve(EventEmitter).emit(agentContext, {
+			type: OpenId4VcIssuerEvents.IssuanceSessionStateChanged,
+			payload: {
+				issuanceSession: issuanceSession.clone(),
+				previousState
+			}
+		});
+	}
+	async getGrantsFromConfig(agentContext, config) {
+		const kms = agentContext.resolve(Kms.KeyManagementApi);
+		const { preAuthorizedCodeFlowConfig, authorizationCodeFlowConfig, issuer, issuerMetadata } = config;
+		const grants = {};
+		if (preAuthorizedCodeFlowConfig) {
+			const { txCode, authorizationServerUrl, preAuthorizedCode } = preAuthorizedCodeFlowConfig;
+			grants[preAuthorizedCodeGrantIdentifier] = {
+				"pre-authorized_code": preAuthorizedCode ?? TypedArrayEncoder.toBase64URL(kms.randomBytes({ length: 32 })),
+				tx_code: txCode,
+				authorization_server: config.issuerMetadata.credentialIssuer.authorization_servers ? authorizationServerUrl : void 0
+			};
+		}
+		if (authorizationCodeFlowConfig) {
+			const { requirePresentationDuringIssuance } = authorizationCodeFlowConfig;
+			let authorizationServerUrl = authorizationCodeFlowConfig.authorizationServerUrl;
+			if (requirePresentationDuringIssuance) {
+				if (authorizationServerUrl && authorizationServerUrl !== issuerMetadata.credentialIssuer.credential_issuer) throw new CredoError(`When 'requirePresentationDuringIssuance' is set, 'authorizationServerUrl' must be undefined or match the credential issuer identifier`);
+				authorizationServerUrl = issuerMetadata.credentialIssuer.credential_issuer;
+			}
+			if ((issuer.authorizationServerConfigs?.find((server) => server.issuer === authorizationServerUrl))?.type === "chained") authorizationServerUrl = issuerMetadata.credentialIssuer.credential_issuer;
+			grants.authorization_code = {
+				issuer_state: authorizationCodeFlowConfig.issuerState ?? TypedArrayEncoder.toBase64URL(kms.randomBytes({ length: 32 })),
+				authorization_server: config.issuerMetadata.credentialIssuer.authorization_servers ? authorizationServerUrl : void 0
+			};
+		}
+		return grants;
+	}
+	getCredentialConfigurationsForRequest(options) {
+		const { requestFormat, issuanceSession, issuerMetadata, authorization, credentialConfigurations } = options;
+		const configurationsMatchingRequest = credentialConfigurations ? credentialConfigurations : requestFormat ? getCredentialConfigurationsMatchingRequestFormat({
+			requestFormat,
+			issuerMetadata
+		}) : void 0;
+		if (!configurationsMatchingRequest) throw new Oauth2ServerErrorResponseError({
+			error: Oauth2ErrorCodes.InvalidCredentialRequest,
+			error_description: `Either 'credential_configuration_id' or 'format' needs to be defined'`
+		});
+		if (Object.keys(configurationsMatchingRequest).length === 0) throw new Oauth2ServerErrorResponseError({
+			error: Oauth2ErrorCodes.InvalidCredentialRequest,
+			error_description: "Credential request does not match any credential configuration"
+		});
+		const configurationsMatchingRequestAndOffer = getOfferedCredentials(issuanceSession.credentialOfferPayload.credential_configuration_ids, configurationsMatchingRequest, { ignoreNotFoundIds: true });
+		if (Object.keys(configurationsMatchingRequestAndOffer).length === 0) throw new Oauth2ServerErrorResponseError({
+			error: Oauth2ErrorCodes.InvalidCredentialRequest,
+			error_description: "Credential request does not match any credential configurations from credential offer"
+		});
+		const deferredCredentialConfigurationIds = issuanceSession.transactions.map((tx) => tx.credentialConfigurationId);
+		const configurationsMatchingRequestAndOfferNotIssued = getOfferedCredentials(issuanceSession.credentialOfferPayload.credential_configuration_ids.filter((id) => !issuanceSession.issuedCredentials.includes(id) && !deferredCredentialConfigurationIds.includes(id)), configurationsMatchingRequestAndOffer, { ignoreNotFoundIds: true });
+		if (Object.keys(configurationsMatchingRequestAndOfferNotIssued).length === 0) throw new Oauth2ServerErrorResponseError({
+			error: Oauth2ErrorCodes.InvalidCredentialRequest,
+			error_description: "Credential request does not match any credential configurations from credential offer that have not been issued yet"
+		});
+		if (authorization.accessToken.payload["pre-authorized_code"]) {
+			const [credentialConfigurationId$1, credentialConfiguration$1] = Object.entries(configurationsMatchingRequestAndOfferNotIssued)[0];
+			return {
+				credentialConfigurationId: credentialConfigurationId$1,
+				credentialConfiguration: credentialConfiguration$1
+			};
+		}
+		const configurationsMatchingRequestOfferScope = getCredentialConfigurationsSupportedForScopes(configurationsMatchingRequestAndOfferNotIssued, authorization.accessToken.payload.scope?.split(" ") ?? []);
+		if (Object.keys(configurationsMatchingRequestOfferScope).length === 0) throw new Oauth2ServerErrorResponseError({
+			error: Oauth2ErrorCodes.InsufficientScope,
+			error_description: "Scope does not grant issuance for any requested credential configurations from credential offer"
+		}, { status: 403 });
+		const [credentialConfigurationId, credentialConfiguration] = Object.entries(configurationsMatchingRequestOfferScope)[0];
+		return {
+			credentialConfigurationId,
+			credentialConfiguration
+		};
+	}
+	async getSignedCredentials(agentContext, signOptions, options) {
+		const { credentialConfiguration, expectedLength } = options;
+		if (signOptions.credentials.length !== expectedLength) throw new CredoError(`Credential request to credential mapper returned '${signOptions.credentials.length}' to be signed, while '${expectedLength}' holder binding entries were provided. Make sure to return one credential for each holder binding entry`);
+		if (signOptions.format === ClaimFormat.JwtVc || signOptions.format === ClaimFormat.LdpVc) {
+			const expectedClaimFormat = {
+				[OpenId4VciCredentialFormatProfile.JwtVcJson]: ClaimFormat.JwtVc,
+				[OpenId4VciCredentialFormatProfile.JwtVcJsonLd]: ClaimFormat.JwtVc,
+				[OpenId4VciCredentialFormatProfile.LdpVc]: ClaimFormat.LdpVc
+			}[credentialConfiguration.format];
+			if (signOptions.format !== expectedClaimFormat) throw new CredoError(`Invalid credential format returned by sign options. Expected '${expectedClaimFormat}', received '${signOptions.format}'.`);
+			return {
+				format: credentialConfiguration.format,
+				credentials: await Promise.all(signOptions.credentials.map((credential) => this.signW3cCredential(agentContext, signOptions.format, credential).then((signed) => signed.encoded)))
+			};
+		}
+		if (signOptions.format === ClaimFormat.SdJwtDc) {
+			if (credentialConfiguration.format !== OpenId4VciCredentialFormatProfile.SdJwtVc && credentialConfiguration.format !== OpenId4VciCredentialFormatProfile.SdJwtDc) throw new CredoError(`Invalid credential format returned by sign options. Expected '${ClaimFormat.SdJwtDc}', received '${signOptions.format}'.`);
+			if (!signOptions.credentials.every((c) => c.payload.vct === credentialConfiguration.vct)) throw new CredoError(`One or more vct values of the offered credential(s) do not match the vct of the requested credential. Offered ${Array.from(new Set(signOptions.credentials.map((c) => `'${c.payload.vct}'`))).join(", ")} Requested '${credentialConfiguration.vct}'.`);
+			const sdJwtVcApi = agentContext.dependencyManager.resolve(SdJwtVcApi);
+			return {
+				format: credentialConfiguration.format,
+				credentials: await Promise.all(signOptions.credentials.map((credential) => sdJwtVcApi.sign({
+					...credential,
+					headerType: credentialConfiguration.format
+				}).then((signed) => signed.compact)))
+			};
+		}
+		if (signOptions.format === ClaimFormat.MsoMdoc) {
+			if (signOptions.format !== credentialConfiguration.format) throw new CredoError(`Invalid credential format returned by sign options. Expected '${credentialConfiguration.format}', received '${signOptions.format}'.`);
+			if (!signOptions.credentials.every((c) => c.docType === credentialConfiguration.doctype)) throw new CredoError(`One or more doctype values of the offered credential(s) do not match the doctype of the requested credential. Offered ${Array.from(new Set(signOptions.credentials.map((c) => `'${c.docType}'`))).join(", ")} Requested '${credentialConfiguration.doctype}'.`);
+			const mdocApi = agentContext.dependencyManager.resolve(MdocApi);
+			return {
+				format: OpenId4VciCredentialFormatProfile.MsoMdoc,
+				credentials: await Promise.all(signOptions.credentials.map((credential) => mdocApi.sign(credential).then((signed) => signed.base64Url)))
+			};
+		}
+		if (signOptions.format === ClaimFormat.SdJwtW3cVc) return {
+			format: credentialConfiguration.format,
+			credentials: await Promise.all(signOptions.credentials.map((credential) => this.w3cV2CredentialService.signCredential(agentContext, {
+				format: ClaimFormat.SdJwtW3cVc,
+				...credential
+			}).then((signed) => signed.encoded)))
+		};
+		throw new CredoError(`Unsupported credential format ${signOptions.format}`);
+	}
+	async signW3cCredential(agentContext, format, options) {
+		const publicJwk = await getPublicJwkFromDid(agentContext, options.verificationMethod);
+		if (format === ClaimFormat.JwtVc) return await this.w3cCredentialService.signCredential(agentContext, {
+			format: ClaimFormat.JwtVc,
+			credential: options.credential,
+			verificationMethod: options.verificationMethod,
+			alg: publicJwk.signatureAlgorithm
+		});
+		const proofType = getProofTypeFromPublicJwk(agentContext, publicJwk);
+		return await this.w3cCredentialService.signCredential(agentContext, {
+			format: ClaimFormat.LdpVc,
+			credential: options.credential,
+			verificationMethod: options.verificationMethod,
+			proofType
+		});
+	}
+};
+OpenId4VcIssuerService = __decorate([injectable(), __decorateMetadata("design:paramtypes", [
+	typeof (_ref = typeof W3cCredentialService !== "undefined" && W3cCredentialService) === "function" ? _ref : Object,
+	typeof (_ref2 = typeof W3cV2CredentialService !== "undefined" && W3cV2CredentialService) === "function" ? _ref2 : Object,
+	typeof (_ref3 = typeof OpenId4VcIssuerModuleConfig !== "undefined" && OpenId4VcIssuerModuleConfig) === "function" ? _ref3 : Object,
+	typeof (_ref4 = typeof OpenId4VcIssuerRepository !== "undefined" && OpenId4VcIssuerRepository) === "function" ? _ref4 : Object,
+	typeof (_ref5 = typeof OpenId4VcIssuanceSessionRepository !== "undefined" && OpenId4VcIssuanceSessionRepository) === "function" ? _ref5 : Object
+])], OpenId4VcIssuerService);
+
+//#endregion
+export { OpenId4VcIssuerService };
+//# sourceMappingURL=OpenId4VcIssuerService.mjs.map