@openid4vc/openid4vci 0.3.0-alpha-20250820113635 → 0.3.0-alpha-20250825150235

package/dist/index.mjs

@@ -240,7 +240,7 @@ import { joinUriParts } from "@openid4vc/utils";
 // src/metadata/credential-issuer/z-credential-issuer-metadata.ts
 import { zCompactJwt } from "@openid4vc/oauth2";
 import { zHttpsUrl as zHttpsUrl2 } from "@openid4vc/utils";
-import z12 from "zod";
+import z13 from "zod";
 
 // src/formats/credential/mso-mdoc/z-mso-mdoc.ts
 import z5 from "zod";
@@ -399,25 +399,28 @@ var zMsoMdocCredentialRequestFormatDraft14 = z5.object({
 
 // src/formats/credential/sd-jwt-vc/z-sd-jwt-vc.ts
 import z6 from "zod";
-var zSdJwtVcFormatIdentifier = z6.literal("vc+sd-jwt");
-var zSdJwtVcCredentialIssuerMetadataDraft16 = zCredentialConfigurationSupportedCommon.extend({
+var zLegacySdJwtVcFormatIdentifier = z6.literal("vc+sd-jwt");
+var zLegacySdJwtVcCredentialIssuerMetadataDraft16 = zCredentialConfigurationSupportedCommon.extend({
   vct: z6.string(),
-  format: zSdJwtVcFormatIdentifier,
+  format: zLegacySdJwtVcFormatIdentifier,
   order: z6.optional(z6.array(z6.string())),
   credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({
     claims: z6.array(zCredentialConfigurationSupportedClaimsDraft14).optional()
-  }).optional()
+  }).optional(),
+  credential_definition: z6.optional(z6.never())
 });
-var zSdJwtVcCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
+var zLegacySdJwtVcCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
   vct: z6.string(),
-  format: zSdJwtVcFormatIdentifier,
+  format: zLegacySdJwtVcFormatIdentifier,
   claims: z6.optional(zCredentialConfigurationSupportedClaimsDraft14),
-  order: z6.optional(z6.array(z6.string()))
+  order: z6.optional(z6.array(z6.string())),
+  credential_definition: z6.optional(z6.never())
 });
-var zSdJwtVcCredentialRequestFormatDraft14 = z6.object({
-  format: zSdJwtVcFormatIdentifier,
+var zLegacySdJwtVcCredentialRequestFormatDraft14 = z6.object({
+  format: zLegacySdJwtVcFormatIdentifier,
   vct: z6.string(),
-  claims: z6.optional(zCredentialConfigurationSupportedClaimsDraft14)
+  claims: z6.optional(zCredentialConfigurationSupportedClaimsDraft14),
+  credential_definition: z6.optional(z6.never())
 });
 
 // src/formats/credential/sd-jwt-dc/z-sd-jwt-dc.ts
@@ -459,7 +462,7 @@ var zClaimValueSchemaDraft14 = z8.union([
 var zW3cVcCredentialSubjectDraft14 = z8.record(z8.string(), zClaimValueSchemaDraft14);
 var zW3cVcJsonLdCredentialDefinition = z8.object({
   "@context": z8.array(z8.string()),
-  type: z8.array(z8.string())
+  type: z8.array(z8.string()).nonempty()
 }).passthrough();
 var zW3cVcJsonLdCredentialDefinitionDraft14 = zW3cVcJsonLdCredentialDefinition.extend({
   credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
@@ -618,7 +621,7 @@ var zJwtVcJsonLdCredentialRequestDraft14To11 = zJwtVcJsonLdCredentialRequestForm
 import z11 from "zod";
 var zJwtVcJsonFormatIdentifier = z11.literal("jwt_vc_json");
 var zJwtVcJsonCredentialDefinition = z11.object({
-  type: z11.array(z11.string())
+  type: z11.array(z11.string()).nonempty()
 }).passthrough();
 var zJwtVcJsonCredentialDefinitionDraft14 = zJwtVcJsonCredentialDefinition.extend({
   credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
@@ -692,6 +695,28 @@ var zJwtVcJsonCredentialRequestDraft14To11 = zJwtVcJsonCredentialRequestFormatDr
   ...credentialDefinition
 })).pipe(zJwtVcJsonCredentialRequestDraft11);
 
+// src/formats/credential/w3c-vc/z-w3c-sd-jwt-vc.ts
+import z12 from "zod";
+var zSdJwtW3VcFormatIdentifier = z12.literal("vc+sd-jwt");
+var zSdJwtW3VcCredentialDefinition = z12.object({
+  type: z12.array(z12.string()).nonempty()
+}).passthrough();
+var zSdJwtW3VcCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
+  format: zSdJwtW3VcFormatIdentifier,
+  credential_definition: zSdJwtW3VcCredentialDefinition,
+  credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({
+    claims: zIssuerMetadataClaimsDescription.optional()
+  }).optional(),
+  // FIXME(vc+sd-jwt): remove when dropping support for legacy vc+sd-jwt. Allows type narrowing.
+  vct: z12.optional(z12.never())
+});
+var zSdJwtW3VcCredentialRequestFormatDraft14 = z12.object({
+  format: zSdJwtW3VcFormatIdentifier,
+  credential_definition: zSdJwtW3VcCredentialDefinition,
+  // FIXME(vc+sd-jwt): remove when dropping support for legacy vc+sd-jwt. Allows type narrowing.
+  vct: z12.optional(z12.never())
+});
+
 // src/metadata/credential-issuer/z-credential-issuer-metadata.ts
 var allCredentialIssuerMetadataFormats = [
   zSdJwtDcCredentialIssuerMetadata,
@@ -699,14 +724,15 @@ var allCredentialIssuerMetadataFormats = [
   zJwtVcJsonLdCredentialIssuerMetadata,
   zLdpVcCredentialIssuerMetadata,
   zJwtVcJsonCredentialIssuerMetadata,
-  zSdJwtVcCredentialIssuerMetadataDraft16,
+  zSdJwtW3VcCredentialIssuerMetadata,
+  zLegacySdJwtVcCredentialIssuerMetadataDraft16,
   zSdJwtDcCredentialIssuerMetadataDraft15,
   zMsoMdocCredentialIssuerMetadataDraft15,
   zJwtVcJsonLdCredentialIssuerMetadataDraft15,
   zLdpVcCredentialIssuerMetadataDraft15,
   zJwtVcJsonCredentialIssuerMetadataDraft15,
   zMsoMdocCredentialIssuerMetadataDraft14,
-  zSdJwtVcCredentialIssuerMetadataDraft14,
+  zLegacySdJwtVcCredentialIssuerMetadataDraft14,
   zJwtVcJsonLdCredentialIssuerMetadataDraft14,
   zLdpVcCredentialIssuerMetadataDraft14,
   zJwtVcJsonCredentialIssuerMetadataDraft14
@@ -714,13 +740,13 @@ var allCredentialIssuerMetadataFormats = [
 var allCredentialIssuerMetadataFormatIdentifiers = allCredentialIssuerMetadataFormats.map(
   (format) => format.shape.format.value
 );
-var zCredentialConfigurationSupportedWithFormats = z12.union([zCredentialConfigurationSupportedCommon, zCredentialConfigurationSupportedCommonDraft15]).transform((data, ctx) => {
+var zCredentialConfigurationSupportedWithFormats = z13.union([zCredentialConfigurationSupportedCommon, zCredentialConfigurationSupportedCommonDraft15]).transform((data, ctx) => {
   if (!allCredentialIssuerMetadataFormatIdentifiers.includes(data.format)) return data;
   const validators = allCredentialIssuerMetadataFormats.filter(
     (formatValidator) => formatValidator.shape.format.value === data.format
   );
-  const result = z12.object({}).passthrough().and(
-    validators.length > 1 ? z12.union(
+  const result = z13.object({}).passthrough().and(
+    validators.length > 1 ? z13.union(
       validators
     ) : validators[0]
   ).safeParse(data);
@@ -730,52 +756,52 @@ var zCredentialConfigurationSupportedWithFormats = z12.union([zCredentialConfigu
   for (const issue of result.error.issues) {
     ctx.addIssue(issue);
   }
-  return z12.NEVER;
+  return z13.NEVER;
 });
-var zCredentialIssuerMetadataDisplayEntry = z12.object({
-  name: z12.string().optional(),
-  locale: z12.string().optional(),
-  logo: z12.object({
+var zCredentialIssuerMetadataDisplayEntry = z13.object({
+  name: z13.string().optional(),
+  locale: z13.string().optional(),
+  logo: z13.object({
     // FIXME: make required again, but need to support draft 11 first
-    uri: z12.string().optional(),
-    alt_text: z12.string().optional()
+    uri: z13.string().optional(),
+    alt_text: z13.string().optional()
   }).passthrough().optional()
 }).passthrough();
-var zCredentialIssuerMetadataDraft14Draft15Draft16 = z12.object({
+var zCredentialIssuerMetadataDraft14Draft15Draft16 = z13.object({
   credential_issuer: zHttpsUrl2,
-  authorization_servers: z12.array(zHttpsUrl2).optional(),
+  authorization_servers: z13.array(zHttpsUrl2).optional(),
   credential_endpoint: zHttpsUrl2,
   deferred_credential_endpoint: zHttpsUrl2.optional(),
   notification_endpoint: zHttpsUrl2.optional(),
   // Added after draft 14, but needed for proper
   nonce_endpoint: zHttpsUrl2.optional(),
-  credential_response_encryption: z12.object({
-    alg_values_supported: z12.array(z12.string()),
-    enc_values_supported: z12.array(z12.string()),
-    encryption_required: z12.boolean()
+  credential_response_encryption: z13.object({
+    alg_values_supported: z13.array(z13.string()),
+    enc_values_supported: z13.array(z13.string()),
+    encryption_required: z13.boolean()
   }).passthrough().optional(),
-  batch_credential_issuance: z12.object({
-    batch_size: z12.number().positive()
+  batch_credential_issuance: z13.object({
+    batch_size: z13.number().positive()
   }).passthrough().optional(),
   signed_metadata: zCompactJwt.optional(),
-  display: z12.array(zCredentialIssuerMetadataDisplayEntry).optional(),
-  credential_configurations_supported: z12.record(z12.string(), zCredentialConfigurationSupportedWithFormats)
+  display: z13.array(zCredentialIssuerMetadataDisplayEntry).optional(),
+  credential_configurations_supported: z13.record(z13.string(), zCredentialConfigurationSupportedWithFormats)
 }).passthrough();
-var zCredentialConfigurationSupportedDraft11To16 = z12.object({
-  id: z12.string().optional(),
-  format: z12.string(),
-  cryptographic_suites_supported: z12.array(z12.string()).optional(),
-  display: z12.array(
-    z12.object({
-      logo: z12.object({
-        url: z12.string().url().optional()
+var zCredentialConfigurationSupportedDraft11To16 = z13.object({
+  id: z13.string().optional(),
+  format: z13.string(),
+  cryptographic_suites_supported: z13.array(z13.string()).optional(),
+  display: z13.array(
+    z13.object({
+      logo: z13.object({
+        url: z13.string().url().optional()
       }).passthrough().optional(),
-      background_image: z12.object({
-        url: z12.string().url().optional()
+      background_image: z13.object({
+        url: z13.string().url().optional()
       }).passthrough().optional()
     }).passthrough()
   ).optional(),
-  claims: z12.any().optional()
+  claims: z13.any().optional()
 }).passthrough().transform(({ cryptographic_suites_supported, display, claims, id, ...rest }) => ({
   ...rest,
   ...cryptographic_suites_supported ? { credential_signing_alg_values_supported: cryptographic_suites_supported } : {},
@@ -818,7 +844,7 @@ var zCredentialConfigurationSupportedDraft11To16 = z12.object({
   for (const issue of result.error.issues) {
     ctx.addIssue(issue);
   }
-  return z12.NEVER;
+  return z13.NEVER;
 }).pipe(zCredentialConfigurationSupportedWithFormats);
 var zCredentialConfigurationSupportedDraft16To15 = zCredentialConfigurationSupportedWithFormats.transform(
   ({ credential_metadata, ...rest }) => ({
@@ -827,8 +853,8 @@ var zCredentialConfigurationSupportedDraft16To15 = zCredentialConfigurationSuppo
   })
 );
 var zCredentialConfigurationSupportedDraft16To11 = zCredentialConfigurationSupportedDraft16To15.and(
-  z12.object({
-    id: z12.string()
+  z13.object({
+    id: z13.string()
   }).passthrough()
 ).transform(({ id, credential_signing_alg_values_supported, display, proof_types_supported, scope, ...rest }) => ({
   ...rest,
@@ -848,15 +874,15 @@ var zCredentialConfigurationSupportedDraft16To11 = zCredentialConfigurationSuppo
   } : {},
   id
 })).pipe(
-  z12.union([
+  z13.union([
     zLdpVcCredentialIssuerMetadataDraft14To11,
     zJwtVcJsonCredentialIssuerMetadataDraft14To11,
     zJwtVcJsonLdCredentialIssuerMetadataDraft14To11,
     // To handle unrecognized formats and not error immediately we allow the common format as well
     // but they can't use any of the format identifiers that have a specific transformation. This way if a format is
     // has a transformation it NEEDS to use the format specific transformation, and otherwise we fall back to the common validation
-    z12.object({
-      format: z12.string().refine(
+    z13.object({
+      format: z13.string().refine(
         (input) => ![
           zLdpVcFormatIdentifier.value,
           zJwtVcJsonFormatIdentifier.value,
@@ -866,11 +892,11 @@ var zCredentialConfigurationSupportedDraft16To11 = zCredentialConfigurationSuppo
     }).passthrough()
   ])
 );
-var zCredentialIssuerMetadataDraft11To16 = z12.object({
-  authorization_server: z12.string().optional(),
-  credentials_supported: z12.array(
-    z12.object({
-      id: z12.string().optional()
+var zCredentialIssuerMetadataDraft11To16 = z13.object({
+  authorization_server: z13.string().optional(),
+  credentials_supported: z13.array(
+    z13.object({
+      id: z13.string().optional()
     }).passthrough()
   )
 }).passthrough().transform(({ authorization_server, credentials_supported, ...rest }) => {
@@ -883,9 +909,9 @@ var zCredentialIssuerMetadataDraft11To16 = z12.object({
     )
   };
 }).pipe(
-  z12.object({
+  z13.object({
     // Update from v11 structure to v14 structure
-    credential_configurations_supported: z12.record(z12.string(), zCredentialConfigurationSupportedDraft11To16)
+    credential_configurations_supported: z13.record(z13.string(), zCredentialConfigurationSupportedDraft11To16)
   }).passthrough()
 ).pipe(zCredentialIssuerMetadataDraft14Draft15Draft16);
 var zCredentialIssuerMetadataWithDraft11 = zCredentialIssuerMetadataDraft14Draft15Draft16.transform((issuerMetadata) => ({
@@ -897,16 +923,16 @@ var zCredentialIssuerMetadataWithDraft11 = zCredentialIssuerMetadataDraft14Draft
   }))
 })).pipe(
   zCredentialIssuerMetadataDraft14Draft15Draft16.extend({
-    credentials_supported: z12.array(zCredentialConfigurationSupportedDraft16To11)
+    credentials_supported: z13.array(zCredentialConfigurationSupportedDraft16To11)
   })
 );
-var zCredentialIssuerMetadata = z12.union([
+var zCredentialIssuerMetadata = z13.union([
   // First prioritize draft 16/15/14 (and 13)
   zCredentialIssuerMetadataDraft14Draft15Draft16,
   // Then try parsing draft 11 and transform into draft 16
   zCredentialIssuerMetadataDraft11To16
 ]);
-var zCredentialIssuerMetadataWithDraftVersion = z12.union([
+var zCredentialIssuerMetadataWithDraftVersion = z13.union([
   zCredentialIssuerMetadataDraft14Draft15Draft16.transform((credentialIssuerMetadata) => {
     const credentialConfigurations = Object.values(credentialIssuerMetadata.credential_configurations_supported);
     const isDraft15 = credentialConfigurations.some((configuration) => {
@@ -981,7 +1007,12 @@ function getCredentialConfigurationsMatchingRequestFormat({
         return arrayEqualsIgnoreOrder(r.credential_definition.type, c.credential_definition.type);
       }
       if (c.format === "vc+sd-jwt" && r.format === c.format) {
-        return r.vct === c.vct;
+        if (r.vct && c.vct) {
+          return r.vct === c.vct;
+        }
+        if (c.credential_definition && r.credential_definition) {
+          return arrayEqualsIgnoreOrder(r.credential_definition.type, c.credential_definition.type);
+        }
       }
       if (c.format === "mso_mdoc" && r.format === c.format) {
         return r.doctype === c.doctype;
@@ -1133,7 +1164,7 @@ function getCredentialRequestFormatPayloadForCredentialConfigurationId(options)
     options.issuerMetadata.credentialIssuer.credential_configurations_supported,
     options.credentialConfigurationId
   );
-  if (zIs(zSdJwtVcCredentialIssuerMetadataDraft16, credentialConfiguration) || zIs(zSdJwtVcCredentialIssuerMetadataDraft14, credentialConfiguration)) {
+  if (zIs(zLegacySdJwtVcCredentialIssuerMetadataDraft16, credentialConfiguration) || zIs(zLegacySdJwtVcCredentialIssuerMetadataDraft14, credentialConfiguration)) {
     return {
       format: credentialConfiguration.format,
       vct: credentialConfiguration.vct
@@ -1173,9 +1204,17 @@ function getCredentialRequestFormatPayloadForCredentialConfigurationId(options)
   }
   if (zIs(zSdJwtDcCredentialIssuerMetadata, credentialConfiguration)) {
     throw new Openid4vciError(
-      `Credential configuration id '${options.credentialConfigurationId}' with format ${zSdJwtVcFormatIdentifier.value} does not support credential request based on 'format'. Use 'credential_configuration_id' directly.`
+      `Credential configuration id '${options.credentialConfigurationId}' with format ${zLegacySdJwtVcFormatIdentifier.value} does not support credential request based on 'format'. Use 'credential_configuration_id' directly.`
     );
   }
+  if (zIs(zSdJwtW3VcCredentialIssuerMetadata, credentialConfiguration)) {
+    return {
+      format: credentialConfiguration.format,
+      credential_definition: {
+        type: credentialConfiguration.credential_definition.type
+      }
+    };
+  }
   throw new Openid4vciError(
     `Unknown format '${credentialConfiguration.format}' in credential configuration with id '${options.credentialConfigurationId}' for credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}'`
   );
@@ -1190,33 +1229,33 @@ import { ContentType as ContentType2, isResponseContentType, parseWithErrorHandl
 
 // src/credential-request/z-credential-request.ts
 import { zJwk as zJwk3 } from "@openid4vc/oauth2";
-import z16 from "zod";
+import z17 from "zod";
 
 // src/credential-request/z-credential-request-common.ts
 import { zJwk as zJwk2 } from "@openid4vc/oauth2";
-import z15 from "zod";
+import z16 from "zod";
 
 // src/formats/proof-type/jwt/z-jwt-proof-type.ts
 import { zCompactJwt as zCompactJwt2, zJwtHeader as zJwtHeader2, zJwtPayload as zJwtPayload2 } from "@openid4vc/oauth2";
 import { zHttpsUrl as zHttpsUrl3, zInteger as zInteger2 } from "@openid4vc/utils";
-import z13 from "zod";
-var zJwtProofTypeIdentifier = z13.literal("jwt");
+import z14 from "zod";
+var zJwtProofTypeIdentifier = z14.literal("jwt");
 var jwtProofTypeIdentifier = zJwtProofTypeIdentifier.value;
-var zCredentialRequestProofJwt = z13.object({
+var zCredentialRequestProofJwt = z14.object({
   proof_type: zJwtProofTypeIdentifier,
   jwt: zCompactJwt2
 });
 var zCredentialRequestJwtProofTypeHeader = zJwtHeader2.merge(
-  z13.object({
-    key_attestation: z13.optional(zCompactJwt2),
-    typ: z13.literal("openid4vci-proof+jwt")
+  z14.object({
+    key_attestation: z14.optional(zCompactJwt2),
+    typ: z14.literal("openid4vci-proof+jwt")
   })
 ).passthrough().refine(({ kid, jwk }) => jwk === void 0 || kid === void 0, {
   message: `Both 'jwk' and 'kid' are defined. Only one is allowed`
 }).refine(({ trust_chain, kid }) => !trust_chain || !kid, {
   message: `When 'trust_chain' is provided, 'kid' is required`
 });
-var zCredentialRequestJwtProofTypePayload = z13.object({
+var zCredentialRequestJwtProofTypePayload = z14.object({
   ...zJwtPayload2.shape,
   aud: zHttpsUrl3,
   iat: zInteger2
@@ -1224,40 +1263,40 @@ var zCredentialRequestJwtProofTypePayload = z13.object({
 
 // src/formats/proof-type/attestation/z-attestation-proof-type.ts
 import { zCompactJwt as zCompactJwt3 } from "@openid4vc/oauth2";
-import z14 from "zod";
-var zAttestationProofTypeIdentifier = z14.literal("attestation");
+import z15 from "zod";
+var zAttestationProofTypeIdentifier = z15.literal("attestation");
 var attestationProofTypeIdentifier = zAttestationProofTypeIdentifier.value;
-var zCredentialRequestProofAttestation = z14.object({
+var zCredentialRequestProofAttestation = z15.object({
   proof_type: zAttestationProofTypeIdentifier,
   attestation: zCompactJwt3
 });
 var zCredentialRequestAttestationProofTypePayload = zKeyAttestationJwtPayloadForUse("proof_type.attestation");
 
 // src/credential-request/z-credential-request-common.ts
-var zCredentialRequestProofCommon = z15.object({
-  proof_type: z15.string()
+var zCredentialRequestProofCommon = z16.object({
+  proof_type: z16.string()
 }).passthrough();
 var allCredentialRequestProofs = [zCredentialRequestProofJwt, zCredentialRequestProofAttestation];
-var zCredentialRequestProof = z15.union([
+var zCredentialRequestProof = z16.union([
   zCredentialRequestProofCommon,
-  z15.discriminatedUnion("proof_type", allCredentialRequestProofs)
+  z16.discriminatedUnion("proof_type", allCredentialRequestProofs)
 ]);
-var zCredentialRequestProofsCommon = z15.record(z15.string(), z15.array(z15.unknown()));
-var zCredentialRequestProofs = z15.object({
-  [zJwtProofTypeIdentifier.value]: z15.optional(z15.array(zCredentialRequestProofJwt.shape.jwt)),
-  [zAttestationProofTypeIdentifier.value]: z15.optional(z15.array(zCredentialRequestProofAttestation.shape.attestation))
+var zCredentialRequestProofsCommon = z16.record(z16.string(), z16.array(z16.unknown()));
+var zCredentialRequestProofs = z16.object({
+  [zJwtProofTypeIdentifier.value]: z16.optional(z16.array(zCredentialRequestProofJwt.shape.jwt)),
+  [zAttestationProofTypeIdentifier.value]: z16.optional(z16.array(zCredentialRequestProofAttestation.shape.attestation))
 });
-var zCredentialRequestCommon = z15.object({
+var zCredentialRequestCommon = z16.object({
   proof: zCredentialRequestProof.optional(),
-  proofs: z15.optional(
-    z15.intersection(zCredentialRequestProofsCommon, zCredentialRequestProofs).refine((proofs) => Object.values(proofs).length === 1, {
+  proofs: z16.optional(
+    z16.intersection(zCredentialRequestProofsCommon, zCredentialRequestProofs).refine((proofs) => Object.values(proofs).length === 1, {
       message: `The 'proofs' object in a credential request should contain exactly one attribute`
     })
   ),
-  credential_response_encryption: z15.object({
+  credential_response_encryption: z16.object({
     jwk: zJwk2,
-    alg: z15.string(),
-    enc: z15.string()
+    alg: z16.string(),
+    enc: z16.string()
   }).passthrough().optional()
 }).passthrough().refine(({ proof, proofs }) => !(proof !== void 0 && proofs !== void 0), {
   message: `Both 'proof' and 'proofs' are defined. Only one is allowed`
@@ -1265,50 +1304,51 @@ var zCredentialRequestCommon = z15.object({
 
 // src/credential-request/z-credential-request.ts
 var allCredentialRequestFormats = [
-  zSdJwtVcCredentialRequestFormatDraft14,
+  zSdJwtW3VcCredentialRequestFormatDraft14,
   zMsoMdocCredentialRequestFormatDraft14,
   zLdpVcCredentialRequestFormatDraft14,
   zJwtVcJsonLdCredentialRequestFormatDraft14,
-  zJwtVcJsonCredentialRequestFormatDraft14
+  zJwtVcJsonCredentialRequestFormatDraft14,
+  zLegacySdJwtVcCredentialRequestFormatDraft14
 ];
 var allCredentialRequestFormatIdentifiers = allCredentialRequestFormats.map(
   (format) => format.shape.format.value
 );
-var zCredentialRequestCredentialConfigurationId = z16.object({
-  credential_configuration_id: z16.string(),
-  format: z16.never({ message: "'format' cannot be defined when 'credential_configuration_id' is set." }).optional(),
-  credential_identifier: z16.never({ message: "'credential_identifier' cannot be defined when 'credential_configuration_id' is set." }).optional()
+var zCredentialRequestCredentialConfigurationId = z17.object({
+  credential_configuration_id: z17.string(),
+  format: z17.never({ message: "'format' cannot be defined when 'credential_configuration_id' is set." }).optional(),
+  credential_identifier: z17.never({ message: "'credential_identifier' cannot be defined when 'credential_configuration_id' is set." }).optional()
 });
-var zAuthorizationDetailsCredentialRequest = z16.object({
-  credential_identifier: z16.string(),
-  credential_configuration_id: z16.never({ message: "'credential_configuration_id' cannot be defined when 'credential_identifier' is set." }).optional(),
+var zAuthorizationDetailsCredentialRequest = z17.object({
+  credential_identifier: z17.string(),
+  credential_configuration_id: z17.never({ message: "'credential_configuration_id' cannot be defined when 'credential_identifier' is set." }).optional(),
   // Cannot be present if credential identifier is present
-  format: z16.never({ message: "'format' cannot be defined when 'credential_identifier' is set." }).optional()
+  format: z17.never({ message: "'format' cannot be defined when 'credential_identifier' is set." }).optional()
 });
-var zCredentialRequestFormat = z16.object({
-  format: z16.string(),
-  credential_identifier: z16.never({ message: "'credential_identifier' cannot be defined when 'format' is set." }).optional(),
-  credential_configuration_id: z16.never({ message: "'credential_configuration_id' cannot be defined when 'format' is set." }).optional()
+var zCredentialRequestFormat = z17.object({
+  format: z17.string(),
+  credential_identifier: z17.never({ message: "'credential_identifier' cannot be defined when 'format' is set." }).optional(),
+  credential_configuration_id: z17.never({ message: "'credential_configuration_id' cannot be defined when 'format' is set." }).optional()
 }).passthrough();
 var zCredentialRequestDraft14WithFormat = zCredentialRequestCommon.and(zCredentialRequestFormat).transform((data, ctx) => {
   if (!allCredentialRequestFormatIdentifiers.includes(
     data.format
   ))
     return data;
-  const result = z16.object({}).passthrough().and(z16.discriminatedUnion("format", allCredentialRequestFormats)).safeParse(data);
+  const result = z17.object({}).passthrough().and(z17.union(allCredentialRequestFormats)).safeParse(data);
   if (result.success) {
     return result.data;
   }
   for (const issue of result.error.issues) {
     ctx.addIssue(issue);
   }
-  return z16.NEVER;
+  return z17.NEVER;
 });
-var zCredentialRequestDraft15 = z16.union([
+var zCredentialRequestDraft15 = z17.union([
   zCredentialRequestCommon.and(zAuthorizationDetailsCredentialRequest),
   zCredentialRequestCommon.and(zCredentialRequestCredentialConfigurationId)
 ]);
-var zCredentialRequestDraft14 = z16.union([
+var zCredentialRequestDraft14 = z17.union([
   zCredentialRequestDraft14WithFormat,
   zCredentialRequestCommon.and(zAuthorizationDetailsCredentialRequest)
 ]);
@@ -1325,7 +1365,7 @@ var zCredentialRequestDraft11To14 = zCredentialRequestCommon.and(zCredentialRequ
   for (const issue of result.error.issues) {
     ctx.addIssue(issue);
   }
-  return z16.NEVER;
+  return z17.NEVER;
 }).pipe(zCredentialRequestDraft14);
 var zCredentialRequestDraft14To11 = zCredentialRequestDraft14.refine(
   (data) => data.credential_identifier === void 0,
@@ -1343,27 +1383,27 @@ var zCredentialRequestDraft14To11 = zCredentialRequestDraft14.refine(
   for (const issue of result.error.issues) {
     ctx.addIssue(issue);
   }
-  return z16.NEVER;
+  return z17.NEVER;
 });
-var zCredentialRequest = z16.union([
+var zCredentialRequest = z17.union([
   zCredentialRequestDraft15,
   zCredentialRequestDraft14,
   zCredentialRequestDraft11To14
 ]);
-var zDeferredCredentialRequest = z16.object({
-  transaction_id: z16.string().nonempty(),
-  credential_response_encryption: z16.object({
+var zDeferredCredentialRequest = z17.object({
+  transaction_id: z17.string().nonempty(),
+  credential_response_encryption: z17.object({
     jwk: zJwk3,
-    alg: z16.string(),
-    enc: z16.string()
+    alg: z17.string(),
+    enc: z17.string()
   }).passthrough().optional()
 });
 
 // src/credential-request/z-credential-response.ts
-import z18 from "zod";
+import z19 from "zod";
 
 // ../oauth2/src/common/z-oauth2-error.ts
-import z17 from "zod";
+import z18 from "zod";
 var Oauth2ErrorCodes = /* @__PURE__ */ ((Oauth2ErrorCodes4) => {
   Oauth2ErrorCodes4["ServerError"] = "server_error";
   Oauth2ErrorCodes4["InvalidTarget"] = "invalid_target";
@@ -1403,49 +1443,49 @@ var Oauth2ErrorCodes = /* @__PURE__ */ ((Oauth2ErrorCodes4) => {
   Oauth2ErrorCodes4["WalletUnavailable"] = "wallet_unavailable";
   return Oauth2ErrorCodes4;
 })(Oauth2ErrorCodes || {});
-var zOauth2ErrorResponse = z17.object({
-  error: z17.union([z17.nativeEnum(Oauth2ErrorCodes), z17.string()]),
-  error_description: z17.string().optional(),
-  error_uri: z17.string().optional()
+var zOauth2ErrorResponse = z18.object({
+  error: z18.union([z18.nativeEnum(Oauth2ErrorCodes), z18.string()]),
+  error_description: z18.string().optional(),
+  error_uri: z18.string().optional()
 }).passthrough();
 
 // src/credential-request/z-credential-response.ts
-var zCredentialEncoding = z18.union([z18.string(), z18.record(z18.string(), z18.any())]);
-var zBaseCredentialResponse = z18.object({
-  credentials: z18.optional(z18.array(zCredentialEncoding)),
-  interval: z18.number().int().positive().optional(),
-  notification_id: z18.string().optional()
+var zCredentialEncoding = z19.union([z19.string(), z19.record(z19.string(), z19.any())]);
+var zBaseCredentialResponse = z19.object({
+  credentials: z19.optional(z19.array(zCredentialEncoding)),
+  interval: z19.number().int().positive().optional(),
+  notification_id: z19.string().optional()
 }).passthrough();
 var zCredentialResponse = zBaseCredentialResponse.extend({
-  credential: z18.optional(zCredentialEncoding),
-  transaction_id: z18.string().optional(),
-  c_nonce: z18.string().optional(),
-  c_nonce_expires_in: z18.number().int().optional()
+  credential: z19.optional(zCredentialEncoding),
+  transaction_id: z19.string().optional(),
+  c_nonce: z19.string().optional(),
+  c_nonce_expires_in: z19.number().int().optional()
 }).passthrough().superRefine((value, ctx) => {
   const { credential, credentials, transaction_id, interval, notification_id } = value;
   if ([credential, credentials, transaction_id].filter((i) => i !== void 0).length !== 1) {
     ctx.addIssue({
-      code: z18.ZodIssueCode.custom,
+      code: z19.ZodIssueCode.custom,
       message: `Exactly one of 'credential', 'credentials', or 'transaction_id' MUST be defined.`
     });
   }
   if (transaction_id && !interval) {
     ctx.addIssue({
-      code: z18.ZodIssueCode.custom,
+      code: z19.ZodIssueCode.custom,
       message: `'interval' MUST be defined when 'transaction_id' is defined.`
     });
   }
   if (notification_id && !(credentials || credential)) {
     ctx.addIssue({
-      code: z18.ZodIssueCode.custom,
+      code: z19.ZodIssueCode.custom,
       message: `'notification_id' MUST NOT be defined when 'credential' or 'credentials' are not defined.`
     });
   }
 });
-var zCredentialErrorResponse = z18.object({
+var zCredentialErrorResponse = z19.object({
   ...zOauth2ErrorResponse.shape,
-  c_nonce: z18.string().optional(),
-  c_nonce_expires_in: z18.number().int().optional()
+  c_nonce: z19.string().optional(),
+  c_nonce_expires_in: z19.number().int().optional()
 }).passthrough();
 var zDeferredCredentialResponse = zBaseCredentialResponse.refine(
   (value) => {
@@ -1598,7 +1638,7 @@ async function retrieveDeferredCredentials(options) {
       deferredCredentialErrorResponseResult
     };
   }
-  const deferredCredentialResponseResult = isResponseContentType(ContentType2.Json, resourceResponse.response) ? zCredentialResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
+  const deferredCredentialResponseResult = isResponseContentType(ContentType2.Json, resourceResponse.response) ? zDeferredCredentialResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
   if (!deferredCredentialResponseResult?.success) {
     return {
       ...resourceResponse,
@@ -1747,10 +1787,10 @@ import { ContentType as ContentType3, ValidationError as ValidationError3, creat
 
 // src/nonce/z-nonce.ts
 import { zInteger as zInteger3 } from "@openid4vc/utils";
-import z19 from "zod";
-var zNonceResponse = z19.object({
-  c_nonce: z19.string(),
-  c_nonce_expires_in: z19.optional(zInteger3)
+import z20 from "zod";
+var zNonceResponse = z20.object({
+  c_nonce: z20.string(),
+  c_nonce_expires_in: z20.optional(zInteger3)
 }).passthrough();
 
 // src/nonce/nonce-request.ts
@@ -1793,15 +1833,15 @@ import {
 import { ContentType as ContentType4, isResponseContentType as isResponseContentType2, parseWithErrorHandling as parseWithErrorHandling7 } from "@openid4vc/utils";
 
 // src/notification/z-notification.ts
-import z20 from "zod";
-var zNotificationEvent = z20.enum(["credential_accepted", "credential_failure", "credential_deleted"]);
-var zNotificationRequest = z20.object({
-  notification_id: z20.string(),
+import z21 from "zod";
+var zNotificationEvent = z21.enum(["credential_accepted", "credential_failure", "credential_deleted"]);
+var zNotificationRequest = z21.object({
+  notification_id: z21.string(),
   event: zNotificationEvent,
-  event_description: z20.optional(z20.string())
+  event_description: z21.optional(z21.string())
 }).passthrough();
-var zNotificationErrorResponse = z20.object({
-  error: z20.enum(["invalid_notification_id", "invalid_notification_request"])
+var zNotificationErrorResponse = z21.object({
+  error: z21.enum(["invalid_notification_id", "invalid_notification_request"])
 }).passthrough();
 
 // src/notification/notification.ts
@@ -2276,7 +2316,7 @@ function createDeferredCredentialResponse(options) {
 
 // src/credential-request/parse-credential-request.ts
 import { parseWithErrorHandling as parseWithErrorHandling9 } from "@openid4vc/utils";
-import z21 from "zod";
+import z22 from "zod";
 function parseCredentialRequest(options) {
   const credentialRequest = parseWithErrorHandling9(
     zCredentialRequest,
@@ -2288,7 +2328,7 @@ function parseCredentialRequest(options) {
   if (knownProofs.success) {
     proofs = knownProofs.data;
   }
-  const knownProof = z21.union(allCredentialRequestProofs).safeParse(credentialRequest.proof);
+  const knownProof = z22.union(allCredentialRequestProofs).safeParse(credentialRequest.proof);
   if (knownProof.success && knownProof.data.proof_type === jwtProofTypeIdentifier) {
     proofs = { [jwtProofTypeIdentifier]: [knownProof.data.jwt] };
   } else if (knownProof.success && knownProof.data.proof_type === attestationProofTypeIdentifier) {
@@ -2322,7 +2362,7 @@ function parseCredentialRequest(options) {
     return {
       // Removes all claims that are not specific to this format
       format: parseWithErrorHandling9(
-        z21.union(allCredentialRequestFormats),
+        z22.union(allCredentialRequestFormats),
         credentialRequest,
         "Unable to validate format specific properties from credential request"
       ),