@openid4vc/openid4vci 0.3.0-alpha-20251001121503 → 0.3.0-alpha-20251017092354

package/dist/index.mjs

@@ -1,2632 +1,1959 @@
-// src/credential-offer/credential-offer.ts
-import {
-  InvalidFetchResponseError,
-  Oauth2Error,
-  authorizationCodeGrantIdentifier,
-  getAuthorizationServerMetadataFromList,
-  preAuthorizedCodeGrantIdentifier as preAuthorizedCodeGrantIdentifier2
-} from "@openid4vc/oauth2";
-import {
-  ContentType,
-  URL,
-  URLSearchParams,
-  ValidationError,
-  createZodFetcher,
-  encodeToBase64Url,
-  getQueryParams,
-  objectToQueryParams,
-  parseWithErrorHandling
-} from "@openid4vc/utils";
+import { ContentType, URL, URLSearchParams, ValidationError, arrayEqualsIgnoreOrder, createZodFetcher, dateToSeconds, encodeToBase64Url, formatZodError, getGlobalConfig, getQueryParams, isResponseContentType, joinUriParts, objectToQueryParams, parseWithErrorHandling, setGlobalConfig, zHttpsUrl, zInteger, zIs } from "@openid4vc/utils";
+import { InvalidFetchResponseError, Oauth2AuthorizationServer, Oauth2Client, Oauth2ClientAuthorizationChallengeError, Oauth2Error, Oauth2ErrorCodes, Oauth2JwtVerificationError, Oauth2ServerErrorResponseError, authorizationCodeGrantIdentifier, createClientAttestationJwt, decodeJwt, fetchAuthorizationServerMetadata, fetchWellKnownMetadata, getAuthorizationServerMetadataFromList, isJwkInSet, jwtHeaderFromJwtSigner, jwtSignerFromJwt, preAuthorizedCodeGrantIdentifier, resourceRequest, verifyJwt, zAuthorizationServerMetadata, zCompactJwt, zJwk, zJwtHeader, zJwtPayload } from "@openid4vc/oauth2";
+import z from "zod";
 
-// src/version.ts
-var Openid4vciDraftVersion = /* @__PURE__ */ ((Openid4vciDraftVersion2) => {
-  Openid4vciDraftVersion2["Draft16"] = "Draft16";
-  Openid4vciDraftVersion2["Draft15"] = "Draft15";
-  Openid4vciDraftVersion2["Draft14"] = "Draft14";
-  Openid4vciDraftVersion2["Draft11"] = "Draft11";
-  return Openid4vciDraftVersion2;
-})(Openid4vciDraftVersion || {});
+//#region src/version.ts
+let Openid4vciDraftVersion = /* @__PURE__ */ function(Openid4vciDraftVersion$1) {
+	Openid4vciDraftVersion$1["Draft16"] = "Draft16";
+	Openid4vciDraftVersion$1["Draft15"] = "Draft15";
+	Openid4vciDraftVersion$1["Draft14"] = "Draft14";
+	Openid4vciDraftVersion$1["Draft11"] = "Draft11";
+	return Openid4vciDraftVersion$1;
+}({});
 
-// src/credential-offer/z-credential-offer.ts
-import {
-  preAuthorizedCodeGrantIdentifier
-} from "@openid4vc/oauth2";
-import { zHttpsUrl } from "@openid4vc/utils";
-import z from "zod";
-var zTxCode = z.object({
-  input_mode: z.union([z.literal("numeric"), z.literal("text")]).optional(),
-  length: z.number().int().optional(),
-  description: z.string().max(300).optional()
+//#endregion
+//#region src/credential-offer/z-credential-offer.ts
+const zTxCode = z.object({
+	input_mode: z.union([z.literal("numeric"), z.literal("text")]).optional(),
+	length: z.number().int().optional(),
+	description: z.string().max(300).optional()
 }).passthrough();
-var zCredentialOfferGrants = z.object({
-  authorization_code: z.object({
-    issuer_state: z.string().optional(),
-    authorization_server: zHttpsUrl.optional()
-  }).passthrough().optional(),
-  [preAuthorizedCodeGrantIdentifier]: z.object({
-    "pre-authorized_code": z.string(),
-    tx_code: zTxCode.optional(),
-    authorization_server: zHttpsUrl.optional()
-  }).passthrough().optional()
+const zCredentialOfferGrants = z.object({
+	authorization_code: z.object({
+		issuer_state: z.string().optional(),
+		authorization_server: zHttpsUrl.optional()
+	}).passthrough().optional(),
+	[preAuthorizedCodeGrantIdentifier]: z.object({
+		"pre-authorized_code": z.string(),
+		tx_code: zTxCode.optional(),
+		authorization_server: zHttpsUrl.optional()
+	}).passthrough().optional()
 }).passthrough();
-var zCredentialOfferObjectDraft14 = z.object({
-  credential_issuer: zHttpsUrl,
-  credential_configuration_ids: z.array(z.string()),
-  grants: z.optional(zCredentialOfferGrants)
+const zCredentialOfferObjectDraft14 = z.object({
+	credential_issuer: zHttpsUrl,
+	credential_configuration_ids: z.array(z.string()),
+	grants: z.optional(zCredentialOfferGrants)
 }).passthrough();
-var zCredentialOfferObjectDraft11To14 = z.object({
-  credential_issuer: zHttpsUrl,
-  // We don't support the inline offer objects from draft 11
-  credentials: z.array(
-    z.string({ message: "Only string credential identifiers are supported for draft 11 credential offers" })
-  ),
-  grants: z.optional(
-    z.object({
-      // Has extra param in draft 14, but doesn't matter for transform purposes
-      authorization_code: zCredentialOfferGrants.shape.authorization_code,
-      [preAuthorizedCodeGrantIdentifier]: z.object({
-        "pre-authorized_code": z.string(),
-        user_pin_required: z.optional(z.boolean())
-      }).passthrough().optional()
-    })
-  )
-}).passthrough().transform(({ credentials, grants, ...rest }) => {
-  const v14 = {
-    ...rest,
-    credential_configuration_ids: credentials
-  };
-  if (grants) {
-    v14.grants = { ...grants };
-    if (grants[preAuthorizedCodeGrantIdentifier]) {
-      const { user_pin_required, ...restGrants } = grants[preAuthorizedCodeGrantIdentifier];
-      v14.grants[preAuthorizedCodeGrantIdentifier] = {
-        ...restGrants
-      };
-      if (user_pin_required) {
-        v14.grants[preAuthorizedCodeGrantIdentifier].tx_code = {
-          input_mode: "text"
-        };
-      }
-    }
-  }
-  return v14;
+const zCredentialOfferObjectDraft11To14 = z.object({
+	credential_issuer: zHttpsUrl,
+	credentials: z.array(z.string({ message: "Only string credential identifiers are supported for draft 11 credential offers" })),
+	grants: z.optional(z.object({
+		authorization_code: zCredentialOfferGrants.shape.authorization_code,
+		[preAuthorizedCodeGrantIdentifier]: z.object({
+			"pre-authorized_code": z.string(),
+			user_pin_required: z.optional(z.boolean())
+		}).passthrough().optional()
+	}))
+}).passthrough().transform(({ credentials, grants,...rest }) => {
+	const v14 = {
+		...rest,
+		credential_configuration_ids: credentials
+	};
+	if (grants) {
+		v14.grants = { ...grants };
+		if (grants[preAuthorizedCodeGrantIdentifier]) {
+			const { user_pin_required,...restGrants } = grants[preAuthorizedCodeGrantIdentifier];
+			v14.grants[preAuthorizedCodeGrantIdentifier] = { ...restGrants };
+			if (user_pin_required) v14.grants[preAuthorizedCodeGrantIdentifier].tx_code = { input_mode: "text" };
+		}
+	}
+	return v14;
 }).pipe(zCredentialOfferObjectDraft14);
-var zCredentialOfferObject = z.union([
-  // First prioritize draft 14 (and 13)
-  zCredentialOfferObjectDraft14,
-  // Then try parsing draft 11 and transform into draft 14
-  zCredentialOfferObjectDraft11To14
-]);
+const zCredentialOfferObject = z.union([zCredentialOfferObjectDraft14, zCredentialOfferObjectDraft11To14]);
 
-// src/credential-offer/credential-offer.ts
+//#endregion
+//#region src/credential-offer/credential-offer.ts
+/**
+* Resolve a credential offer, optionally fetching it if the credential_offer_uri is provided.
+*/
 async function resolveCredentialOffer(credentialOffer, options) {
-  const parsedQueryParams = getQueryParams(credentialOffer);
-  let credentialOfferParseResult;
-  if (parsedQueryParams.credential_offer_uri) {
-    const fetchWithZod = createZodFetcher(options?.fetch);
-    const { response, result } = await fetchWithZod(
-      zCredentialOfferObject,
-      ContentType.Json,
-      parsedQueryParams.credential_offer_uri
-    );
-    if (!response.ok || !result) {
-      throw new InvalidFetchResponseError(
-        `Fetching credential offer from '${parsedQueryParams.credential_offer_uri}' resulted in an unsuccessful response with status '${response.status}'`,
-        await response.clone().text(),
-        response
-      );
-    }
-    credentialOfferParseResult = result;
-  } else if (parsedQueryParams.credential_offer) {
-    let credentialOfferJson;
-    try {
-      credentialOfferJson = JSON.parse(decodeURIComponent(parsedQueryParams.credential_offer));
-    } catch (error) {
-      throw new Oauth2Error(`Error parsing JSON from 'credential_offer' param in credential offer '${credentialOffer}'`);
-    }
-    credentialOfferParseResult = zCredentialOfferObject.safeParse(credentialOfferJson);
-  } else {
-    throw new Oauth2Error(`Credential offer did not contain either 'credential_offer' or 'credential_offer_uri' param.`);
-  }
-  if (credentialOfferParseResult.error) {
-    throw new ValidationError(
-      `Error parsing credential offer in draft 11, 13 or 14 format extracted from credential offer '${credentialOffer}'`,
-      credentialOfferParseResult.error
-    );
-  }
-  return credentialOfferParseResult.data;
+	const parsedQueryParams = getQueryParams(credentialOffer);
+	let credentialOfferParseResult;
+	if (parsedQueryParams.credential_offer_uri) {
+		const { response, result } = await createZodFetcher(options?.fetch)(zCredentialOfferObject, ContentType.Json, parsedQueryParams.credential_offer_uri);
+		if (!response.ok || !result) throw new InvalidFetchResponseError(`Fetching credential offer from '${parsedQueryParams.credential_offer_uri}' resulted in an unsuccessful response with status '${response.status}'`, await response.clone().text(), response);
+		credentialOfferParseResult = result;
+	} else if (parsedQueryParams.credential_offer) {
+		let credentialOfferJson;
+		try {
+			credentialOfferJson = JSON.parse(decodeURIComponent(parsedQueryParams.credential_offer));
+		} catch (_error) {
+			throw new Oauth2Error(`Error parsing JSON from 'credential_offer' param in credential offer '${credentialOffer}'`);
+		}
+		credentialOfferParseResult = zCredentialOfferObject.safeParse(credentialOfferJson);
+	} else throw new Oauth2Error(`Credential offer did not contain either 'credential_offer' or 'credential_offer_uri' param.`);
+	if (credentialOfferParseResult.error) throw new ValidationError(`Error parsing credential offer in draft 11, 13 or 14 format extracted from credential offer '${credentialOffer}'`, credentialOfferParseResult.error);
+	return credentialOfferParseResult.data;
 }
 function determineAuthorizationServerForCredentialOffer(options) {
-  const authorizationServers = options.issuerMetadata.credentialIssuer.authorization_servers;
-  let authorizationServer;
-  if (options.grantAuthorizationServer) {
-    authorizationServer = options.grantAuthorizationServer;
-    if (!authorizationServers) {
-      throw new Oauth2Error(
-        `Credential offer grant contains 'authorization_server' with value '${options.grantAuthorizationServer}' but credential issuer metadata does not have an 'authorization_servers' property to match the value against.`
-      );
-    }
-    if (!authorizationServers.includes(authorizationServer)) {
-      throw new Oauth2Error(
-        `Credential offer grant contains 'authorization_server' with value '${options.grantAuthorizationServer}' but credential issuer metadata does not include this authorization server. Available 'authorization_server' values are ${authorizationServers.join(", ")}.`
-      );
-    }
-  } else if (!authorizationServers) {
-    authorizationServer = options.issuerMetadata.credentialIssuer.credential_issuer;
-  } else {
-    if (authorizationServers.length === 0) {
-      throw new Oauth2Error(`Credential issuer metadata has 'authorization_servers' value with length of 0`);
-    }
-    if (authorizationServers.length > 1) {
-      throw new Oauth2Error(
-        `Credential issuer metadata has 'authorization_server' with multiple entries, but the credential offer grant did not specify which authorization server to use.`
-      );
-    }
-    authorizationServer = authorizationServers[0];
-  }
-  return authorizationServer;
+	const authorizationServers = options.issuerMetadata.credentialIssuer.authorization_servers;
+	let authorizationServer;
+	if (options.grantAuthorizationServer) {
+		authorizationServer = options.grantAuthorizationServer;
+		if (!authorizationServers) throw new Oauth2Error(`Credential offer grant contains 'authorization_server' with value '${options.grantAuthorizationServer}' but credential issuer metadata does not have an 'authorization_servers' property to match the value against.`);
+		if (!authorizationServers.includes(authorizationServer)) throw new Oauth2Error(`Credential offer grant contains 'authorization_server' with value '${options.grantAuthorizationServer}' but credential issuer metadata does not include this authorization server. Available 'authorization_server' values are ${authorizationServers.join(", ")}.`);
+	} else if (!authorizationServers) authorizationServer = options.issuerMetadata.credentialIssuer.credential_issuer;
+	else {
+		if (authorizationServers.length === 0) throw new Oauth2Error(`Credential issuer metadata has 'authorization_servers' value with length of 0`);
+		if (authorizationServers.length > 1) throw new Oauth2Error(`Credential issuer metadata has 'authorization_server' with multiple entries, but the credential offer grant did not specify which authorization server to use.`);
+		authorizationServer = authorizationServers[0];
+	}
+	return authorizationServer;
 }
 async function createCredentialOffer(options) {
-  const {
-    [preAuthorizedCodeGrantIdentifier2]: preAuthorizedCodeGrant,
-    [authorizationCodeGrantIdentifier]: authorizationCodeGrant,
-    ...restGrants
-  } = options.grants;
-  const grants = { ...restGrants };
-  if (authorizationCodeGrant) {
-    determineAuthorizationServerForCredentialOffer({
-      issuerMetadata: options.issuerMetadata,
-      grantAuthorizationServer: authorizationCodeGrant.authorization_server
-    });
-    grants[authorizationCodeGrantIdentifier] = authorizationCodeGrant;
-  }
-  if (preAuthorizedCodeGrant) {
-    determineAuthorizationServerForCredentialOffer({
-      issuerMetadata: options.issuerMetadata,
-      grantAuthorizationServer: preAuthorizedCodeGrant.authorization_server
-    });
-    grants[preAuthorizedCodeGrantIdentifier2] = {
-      ...preAuthorizedCodeGrant,
-      "pre-authorized_code": preAuthorizedCodeGrant["pre-authorized_code"] ?? encodeToBase64Url(await options.callbacks.generateRandom(32))
-    };
-    const txCode = grants[preAuthorizedCodeGrantIdentifier2].tx_code;
-    if (txCode && options.issuerMetadata.originalDraftVersion === "Draft11" /* Draft11 */) {
-      grants[preAuthorizedCodeGrantIdentifier2].user_pin_required = txCode !== void 0;
-    }
-  }
-  const idsNotInMetadata = options.credentialConfigurationIds.filter(
-    (id) => options.issuerMetadata.credentialIssuer.credential_configurations_supported[id] === void 0
-  );
-  if (idsNotInMetadata.length > 0) {
-    throw new Oauth2Error(
-      `Credential configuration ids ${idsNotInMetadata} not found in the credential issuer metadata 'credential_configurations_supported'. Available ids are ${Object.keys(options.issuerMetadata.credentialIssuer.credential_configurations_supported).join(", ")}.`
-    );
-  }
-  const credentialOfferScheme = options.credentialOfferScheme ?? "openid-credential-offer://";
-  const credentialOfferObject = parseWithErrorHandling(zCredentialOfferObject, {
-    credential_issuer: options.issuerMetadata.credentialIssuer.credential_issuer,
-    credential_configuration_ids: options.credentialConfigurationIds,
-    grants,
-    ...options.additionalPayload
-  });
-  if (options.issuerMetadata.originalDraftVersion === "Draft11" /* Draft11 */) {
-    credentialOfferObject.credentials = credentialOfferObject.credential_configuration_ids;
-  }
-  const url = new URL(credentialOfferScheme);
-  url.search = `?${new URLSearchParams([
-    ...url.searchParams.entries(),
-    ...objectToQueryParams({
-      credential_offer_uri: options.credentialOfferUri,
-      // Only add credential_offer is uri is undefined
-      credential_offer: options.credentialOfferUri ? void 0 : credentialOfferObject
-    }).entries()
-  ]).toString()}`;
-  return {
-    credentialOffer: url.toString(),
-    credentialOfferObject
-  };
+	const { [preAuthorizedCodeGrantIdentifier]: preAuthorizedCodeGrant, [authorizationCodeGrantIdentifier]: authorizationCodeGrant,...restGrants } = options.grants;
+	const grants = { ...restGrants };
+	if (authorizationCodeGrant) {
+		determineAuthorizationServerForCredentialOffer({
+			issuerMetadata: options.issuerMetadata,
+			grantAuthorizationServer: authorizationCodeGrant.authorization_server
+		});
+		grants[authorizationCodeGrantIdentifier] = authorizationCodeGrant;
+	}
+	if (preAuthorizedCodeGrant) {
+		determineAuthorizationServerForCredentialOffer({
+			issuerMetadata: options.issuerMetadata,
+			grantAuthorizationServer: preAuthorizedCodeGrant.authorization_server
+		});
+		grants[preAuthorizedCodeGrantIdentifier] = {
+			...preAuthorizedCodeGrant,
+			"pre-authorized_code": preAuthorizedCodeGrant["pre-authorized_code"] ?? encodeToBase64Url(await options.callbacks.generateRandom(32))
+		};
+		const txCode = grants[preAuthorizedCodeGrantIdentifier].tx_code;
+		if (txCode && options.issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft11) grants[preAuthorizedCodeGrantIdentifier].user_pin_required = txCode !== void 0;
+	}
+	const idsNotInMetadata = options.credentialConfigurationIds.filter((id) => options.issuerMetadata.credentialIssuer.credential_configurations_supported[id] === void 0);
+	if (idsNotInMetadata.length > 0) throw new Oauth2Error(`Credential configuration ids ${idsNotInMetadata} not found in the credential issuer metadata 'credential_configurations_supported'. Available ids are ${Object.keys(options.issuerMetadata.credentialIssuer.credential_configurations_supported).join(", ")}.`);
+	const credentialOfferScheme = options.credentialOfferScheme ?? "openid-credential-offer://";
+	const credentialOfferObject = parseWithErrorHandling(zCredentialOfferObject, {
+		credential_issuer: options.issuerMetadata.credentialIssuer.credential_issuer,
+		credential_configuration_ids: options.credentialConfigurationIds,
+		grants,
+		...options.additionalPayload
+	});
+	if (options.issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft11) credentialOfferObject.credentials = credentialOfferObject.credential_configuration_ids;
+	const url = new URL(credentialOfferScheme);
+	url.search = `?${new URLSearchParams([...url.searchParams.entries(), ...objectToQueryParams({
+		credential_offer_uri: options.credentialOfferUri,
+		credential_offer: options.credentialOfferUri ? void 0 : credentialOfferObject
+	}).entries()]).toString()}`;
+	return {
+		credentialOffer: url.toString(),
+		credentialOfferObject
+	};
 }
 
-// src/index.ts
-import { getGlobalConfig, setGlobalConfig } from "@openid4vc/utils";
-
-// src/credential-request/credential-request-configurations.ts
-import { arrayEqualsIgnoreOrder } from "@openid4vc/utils";
-
-// src/metadata/credential-issuer/credential-issuer-metadata.ts
-import { Oauth2Error as Oauth2Error2, fetchWellKnownMetadata } from "@openid4vc/oauth2";
-import { joinUriParts } from "@openid4vc/utils";
-
-// src/metadata/credential-issuer/z-credential-issuer-metadata.ts
-import { zCompactJwt } from "@openid4vc/oauth2";
-import { zHttpsUrl as zHttpsUrl2 } from "@openid4vc/utils";
-import z13 from "zod";
-
-// src/formats/credential/mso-mdoc/z-mso-mdoc.ts
-import z5 from "zod";
-
-// src/metadata/credential-issuer/z-claims-description.ts
-import z2 from "zod";
-var zCredentialConfigurationSupportedClaimsDescriptionDraft14 = z2.object({
-  mandatory: z2.boolean().optional(),
-  value_type: z2.string().optional(),
-  display: z2.array(
-    z2.object({
-      name: z2.string().optional(),
-      locale: z2.string().optional()
-    }).passthrough()
-  ).optional()
+//#endregion
+//#region src/metadata/credential-issuer/z-claims-description.ts
+const zCredentialConfigurationSupportedClaimsDescriptionDraft14 = z.object({
+	mandatory: z.boolean().optional(),
+	value_type: z.string().optional(),
+	display: z.array(z.object({
+		name: z.string().optional(),
+		locale: z.string().optional()
+	}).passthrough()).optional()
 }).passthrough();
-var zCredentialConfigurationSupportedClaimsDraft14 = z2.record(
-  z2.string(),
-  z2.union([
-    zCredentialConfigurationSupportedClaimsDescriptionDraft14,
-    z2.lazy(() => zCredentialConfigurationSupportedClaimsDraft14)
-  ])
-);
-var zClaimsDescriptionPath = z2.array(z2.union([z2.string(), z2.number().int().nonnegative(), z2.null()])).nonempty();
-var zMsoMdocClaimsDescriptionPath = z2.tuple([z2.string(), z2.string()], {
-  message: "mso_mdoc claims description path MUST be an array with exactly two string elements, pointing to the namespace and element identifier within an mdoc credential"
-});
-var zIssuerMetadataClaimsDescription = z2.object({
-  path: zClaimsDescriptionPath,
-  mandatory: z2.boolean().optional(),
-  display: z2.array(
-    z2.object({
-      name: z2.string().optional(),
-      locale: z2.string().optional()
-    }).passthrough()
-  ).optional()
+const zCredentialConfigurationSupportedClaimsDraft14 = z.record(z.string(), z.union([zCredentialConfigurationSupportedClaimsDescriptionDraft14, z.lazy(() => zCredentialConfigurationSupportedClaimsDraft14)]));
+const zClaimsDescriptionPath = z.array(z.union([
+	z.string(),
+	z.number().int().nonnegative(),
+	z.null()
+])).nonempty();
+const zMsoMdocClaimsDescriptionPath = z.tuple([z.string(), z.string()], { message: "mso_mdoc claims description path MUST be an array with exactly two string elements, pointing to the namespace and element identifier within an mdoc credential" });
+const zIssuerMetadataClaimsDescription = z.object({
+	path: zClaimsDescriptionPath,
+	mandatory: z.boolean().optional(),
+	display: z.array(z.object({
+		name: z.string().optional(),
+		locale: z.string().optional()
+	}).passthrough()).optional()
 }).passthrough();
-var zMsoMdocIssuerMetadataClaimsDescription = zIssuerMetadataClaimsDescription.extend({
-  path: zMsoMdocClaimsDescriptionPath
-});
+const zMsoMdocIssuerMetadataClaimsDescription = zIssuerMetadataClaimsDescription.extend({ path: zMsoMdocClaimsDescriptionPath });
 
-// src/metadata/credential-issuer/z-credential-configuration-supported-common.ts
-import z4 from "zod";
-
-// src/key-attestation/z-key-attestation.ts
-import { zJwk, zJwtHeader, zJwtPayload } from "@openid4vc/oauth2";
-import { zInteger } from "@openid4vc/utils";
-import z3 from "zod";
-var zKeyAttestationJwtHeader = z3.object({
-  ...zJwtHeader.shape,
-  typ: z3.literal("keyattestation+jwt").or(
-    // Draft 16
-    z3.literal("key-attestation+jwt")
-  )
-}).passthrough().refine(({ kid, jwk }) => jwk === void 0 || kid === void 0, {
-  message: `Both 'jwk' and 'kid' are defined. Only one is allowed`
-}).refine(({ trust_chain, kid }) => !trust_chain || !kid, {
-  message: `When 'trust_chain' is provided, 'kid' is required`
-});
-var zIso18045 = z3.enum(["iso_18045_high", "iso_18045_moderate", "iso_18045_enhanced-basic", "iso_18045_basic"]);
-var zIso18045OrStringArray = z3.array(z3.union([zIso18045, z3.string()]));
-var zKeyAttestationJwtPayload = z3.object({
-  ...zJwtPayload.shape,
-  iat: zInteger,
-  attested_keys: z3.array(zJwk),
-  key_storage: z3.optional(zIso18045OrStringArray),
-  user_authentication: z3.optional(zIso18045OrStringArray),
-  certification: z3.optional(z3.string().url())
+//#endregion
+//#region src/key-attestation/z-key-attestation.ts
+const zKeyAttestationJwtHeader = z.object({
+	...zJwtHeader.shape,
+	typ: z.literal("keyattestation+jwt").or(z.literal("key-attestation+jwt"))
+}).passthrough().refine(({ kid, jwk }) => jwk === void 0 || kid === void 0, { message: `Both 'jwk' and 'kid' are defined. Only one is allowed` }).refine(({ trust_chain, kid }) => !trust_chain || !kid, { message: `When 'trust_chain' is provided, 'kid' is required` });
+const zIso18045 = z.enum([
+	"iso_18045_high",
+	"iso_18045_moderate",
+	"iso_18045_enhanced-basic",
+	"iso_18045_basic"
+]);
+const zIso18045OrStringArray = z.array(z.union([zIso18045, z.string()]));
+const zKeyAttestationJwtPayload = z.object({
+	...zJwtPayload.shape,
+	iat: zInteger,
+	attested_keys: z.array(zJwk),
+	key_storage: z.optional(zIso18045OrStringArray),
+	user_authentication: z.optional(zIso18045OrStringArray),
+	certification: z.optional(z.string().url())
 }).passthrough();
-var zKeyAttestationJwtPayloadForUse = (use) => z3.object({
-  ...zKeyAttestationJwtPayload.shape,
-  // REQUIRED when used as proof_type.attesation directly
-  nonce: use === "proof_type.attestation" ? z3.string({
-    message: `Nonce must be defined when key attestation is used as 'proof_type.attestation' directly`
-  }) : z3.optional(z3.string()),
-  // REQUIRED when used within header of proof_type.jwt
-  exp: use === "proof_type.jwt" ? zInteger : z3.optional(zInteger)
+const zKeyAttestationJwtPayloadForUse = (use) => z.object({
+	...zKeyAttestationJwtPayload.shape,
+	nonce: use === "proof_type.attestation" ? z.string({ message: `Nonce must be defined when key attestation is used as 'proof_type.attestation' directly` }) : z.optional(z.string()),
+	exp: use === "proof_type.jwt" ? zInteger : z.optional(zInteger)
 }).passthrough();
 
-// src/metadata/credential-issuer/z-credential-configuration-supported-common.ts
-var zCredentialConfigurationSupportedDisplayEntry = z4.object({
-  name: z4.string(),
-  locale: z4.string().optional(),
-  logo: z4.object({
-    // FIXME: make required again, but need to support draft 11 first
-    uri: z4.string().optional(),
-    alt_text: z4.string().optional()
-  }).passthrough().optional(),
-  description: z4.string().optional(),
-  background_color: z4.string().optional(),
-  background_image: z4.object({
-    // TODO: should be required, but paradym's metadata is wrong here.
-    uri: z4.string().optional()
-  }).passthrough().optional(),
-  text_color: z4.string().optional()
+//#endregion
+//#region src/metadata/credential-issuer/z-credential-configuration-supported-common.ts
+const zCredentialConfigurationSupportedDisplayEntry = z.object({
+	name: z.string(),
+	locale: z.string().optional(),
+	logo: z.object({
+		uri: z.string().optional(),
+		alt_text: z.string().optional()
+	}).passthrough().optional(),
+	description: z.string().optional(),
+	background_color: z.string().optional(),
+	background_image: z.object({ uri: z.string().optional() }).passthrough().optional(),
+	text_color: z.string().optional()
 }).passthrough();
-var zCredentialConfigurationSupportedCommonCredentialMetadata = z4.object({
-  display: z4.array(zCredentialConfigurationSupportedDisplayEntry).optional()
-});
-var zCredentialConfigurationSupportedCommon = z4.object({
-  format: z4.string(),
-  scope: z4.string().optional(),
-  cryptographic_binding_methods_supported: z4.array(z4.string()).optional(),
-  credential_signing_alg_values_supported: z4.array(z4.string()).or(z4.array(z4.number())).optional(),
-  proof_types_supported: z4.record(
-    z4.union([z4.literal("jwt"), z4.literal("attestation"), z4.string()]),
-    z4.object({
-      proof_signing_alg_values_supported: z4.array(z4.string()),
-      key_attestations_required: z4.object({
-        key_storage: zIso18045OrStringArray.optional(),
-        user_authentication: zIso18045OrStringArray.optional()
-      }).passthrough().optional()
-    })
-  ).optional(),
-  credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.optional(),
-  // For typing purposes. Can be removed once we drop support for draft <= 15.
-  claims: z4.optional(z4.never())
+const zCredentialConfigurationSupportedCommonCredentialMetadata = z.object({ display: z.array(zCredentialConfigurationSupportedDisplayEntry).optional() });
+const zCredentialConfigurationSupportedCommon = z.object({
+	format: z.string(),
+	scope: z.string().optional(),
+	cryptographic_binding_methods_supported: z.array(z.string()).optional(),
+	credential_signing_alg_values_supported: z.array(z.string()).or(z.array(z.number())).optional(),
+	proof_types_supported: z.record(z.union([
+		z.literal("jwt"),
+		z.literal("attestation"),
+		z.string()
+	]), z.object({
+		proof_signing_alg_values_supported: z.array(z.string()),
+		key_attestations_required: z.object({
+			key_storage: zIso18045OrStringArray.optional(),
+			user_authentication: zIso18045OrStringArray.optional()
+		}).passthrough().optional()
+	})).optional(),
+	credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.optional(),
+	claims: z.optional(z.never())
 }).passthrough();
-var zCredentialConfigurationSupportedCommonDraft15 = z4.object({
-  format: z4.string(),
-  scope: z4.string().optional(),
-  cryptographic_binding_methods_supported: z4.array(z4.string()).optional(),
-  credential_signing_alg_values_supported: z4.array(z4.string()).or(z4.array(z4.number())).optional(),
-  proof_types_supported: z4.record(
-    z4.union([z4.literal("jwt"), z4.literal("attestation"), z4.string()]),
-    z4.object({
-      proof_signing_alg_values_supported: z4.array(z4.string()),
-      key_attestations_required: z4.object({
-        key_storage: zIso18045OrStringArray.optional(),
-        user_authentication: zIso18045OrStringArray.optional()
-      }).passthrough().optional()
-    })
-  ).optional(),
-  display: z4.array(zCredentialConfigurationSupportedDisplayEntry).optional(),
-  // For typing purposes.
-  credential_metadata: z4.optional(z4.never())
+const zCredentialConfigurationSupportedCommonDraft15 = z.object({
+	format: z.string(),
+	scope: z.string().optional(),
+	cryptographic_binding_methods_supported: z.array(z.string()).optional(),
+	credential_signing_alg_values_supported: z.array(z.string()).or(z.array(z.number())).optional(),
+	proof_types_supported: z.record(z.union([
+		z.literal("jwt"),
+		z.literal("attestation"),
+		z.string()
+	]), z.object({
+		proof_signing_alg_values_supported: z.array(z.string()),
+		key_attestations_required: z.object({
+			key_storage: zIso18045OrStringArray.optional(),
+			user_authentication: zIso18045OrStringArray.optional()
+		}).passthrough().optional()
+	})).optional(),
+	display: z.array(zCredentialConfigurationSupportedDisplayEntry).optional(),
+	credential_metadata: z.optional(z.never())
 }).passthrough();
 
-// src/formats/credential/mso-mdoc/z-mso-mdoc.ts
-var zMsoMdocFormatIdentifier = z5.literal("mso_mdoc");
-var zMsoMdocCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
-  format: zMsoMdocFormatIdentifier,
-  doctype: z5.string(),
-  credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({
-    claims: z5.array(zMsoMdocIssuerMetadataClaimsDescription).optional()
-  }).optional()
+//#endregion
+//#region src/formats/credential/mso-mdoc/z-mso-mdoc.ts
+const zMsoMdocFormatIdentifier = z.literal("mso_mdoc");
+const zMsoMdocCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
+	format: zMsoMdocFormatIdentifier,
+	doctype: z.string(),
+	credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({ claims: z.array(zMsoMdocIssuerMetadataClaimsDescription).optional() }).optional()
 });
-var zMsoMdocCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
-  format: zMsoMdocFormatIdentifier,
-  doctype: z5.string(),
-  claims: z5.array(zMsoMdocIssuerMetadataClaimsDescription).optional()
+const zMsoMdocCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
+	format: zMsoMdocFormatIdentifier,
+	doctype: z.string(),
+	claims: z.array(zMsoMdocIssuerMetadataClaimsDescription).optional()
 });
-var zMsoMdocCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
-  format: zMsoMdocFormatIdentifier,
-  doctype: z5.string(),
-  claims: zCredentialConfigurationSupportedClaimsDraft14.optional(),
-  order: z5.optional(z5.array(z5.string()))
+const zMsoMdocCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
+	format: zMsoMdocFormatIdentifier,
+	doctype: z.string(),
+	claims: zCredentialConfigurationSupportedClaimsDraft14.optional(),
+	order: z.optional(z.array(z.string()))
 });
-var zMsoMdocCredentialRequestFormatDraft14 = z5.object({
-  format: zMsoMdocFormatIdentifier,
-  doctype: z5.string(),
-  // Format based request is removed in Draft 15, so only old claims syntax supported.
-  claims: zCredentialConfigurationSupportedClaimsDraft14.optional()
+const zMsoMdocCredentialRequestFormatDraft14 = z.object({
+	format: zMsoMdocFormatIdentifier,
+	doctype: z.string(),
+	claims: zCredentialConfigurationSupportedClaimsDraft14.optional()
 });
 
-// src/formats/credential/sd-jwt-vc/z-sd-jwt-vc.ts
-import z6 from "zod";
-var zLegacySdJwtVcFormatIdentifier = z6.literal("vc+sd-jwt");
-var zLegacySdJwtVcCredentialIssuerMetadataDraft16 = zCredentialConfigurationSupportedCommon.extend({
-  vct: z6.string(),
-  format: zLegacySdJwtVcFormatIdentifier,
-  order: z6.optional(z6.array(z6.string())),
-  credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({
-    claims: z6.array(zIssuerMetadataClaimsDescription).optional()
-  }).optional(),
-  credential_definition: z6.optional(z6.never())
-});
-var zLegacySdJwtVcCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
-  vct: z6.string(),
-  format: zLegacySdJwtVcFormatIdentifier,
-  claims: z6.optional(zCredentialConfigurationSupportedClaimsDraft14),
-  order: z6.optional(z6.array(z6.string())),
-  credential_definition: z6.optional(z6.never())
+//#endregion
+//#region src/formats/credential/sd-jwt-dc/z-sd-jwt-dc.ts
+const zSdJwtDcFormatIdentifier = z.literal("dc+sd-jwt");
+const zSdJwtDcCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
+	vct: z.string(),
+	format: zSdJwtDcFormatIdentifier,
+	credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({ claims: z.array(zIssuerMetadataClaimsDescription).optional() }).optional()
 });
-var zLegacySdJwtVcCredentialRequestFormatDraft14 = z6.object({
-  format: zLegacySdJwtVcFormatIdentifier,
-  vct: z6.string(),
-  claims: z6.optional(zCredentialConfigurationSupportedClaimsDraft14),
-  credential_definition: z6.optional(z6.never())
+const zSdJwtDcCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
+	vct: z.string(),
+	format: zSdJwtDcFormatIdentifier,
+	claims: z.array(zIssuerMetadataClaimsDescription).optional()
 });
 
-// src/formats/credential/sd-jwt-dc/z-sd-jwt-dc.ts
-import z7 from "zod";
-var zSdJwtDcFormatIdentifier = z7.literal("dc+sd-jwt");
-var zSdJwtDcCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
-  vct: z7.string(),
-  format: zSdJwtDcFormatIdentifier,
-  credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({
-    claims: z7.array(zIssuerMetadataClaimsDescription).optional()
-  }).optional()
+//#endregion
+//#region src/formats/credential/sd-jwt-vc/z-sd-jwt-vc.ts
+/**
+* @deprecated format has been deprecated in favor of "dc+sd-jwt" since Draft 23
+* of the OpenID for Verifiable Presentations specification. Please update your
+* implementations accordingly.
+*/
+const zLegacySdJwtVcFormatIdentifier = z.literal("vc+sd-jwt");
+/**
+* @deprecated format has been deprecated in favor of "dc+sd-jwt" since Draft 23
+* of the OpenID for Verifiable Presentations specification. Please update your
+* implementations accordingly.
+*/
+const zLegacySdJwtVcCredentialIssuerMetadataDraft16 = zCredentialConfigurationSupportedCommon.extend({
+	vct: z.string(),
+	format: zLegacySdJwtVcFormatIdentifier,
+	order: z.optional(z.array(z.string())),
+	credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({ claims: z.array(zIssuerMetadataClaimsDescription).optional() }).optional(),
+	credential_definition: z.optional(z.never())
 });
-var zSdJwtDcCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
-  vct: z7.string(),
-  format: zSdJwtDcFormatIdentifier,
-  claims: z7.array(zIssuerMetadataClaimsDescription).optional()
+/**
+* @deprecated format has been deprecated in favor of "dc+sd-jwt" since Draft 23
+* of the OpenID for Verifiable Presentations specification. Please update your
+* implementations accordingly.
+*/
+const zLegacySdJwtVcCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
+	vct: z.string(),
+	format: zLegacySdJwtVcFormatIdentifier,
+	claims: z.optional(zCredentialConfigurationSupportedClaimsDraft14),
+	order: z.optional(z.array(z.string())),
+	credential_definition: z.optional(z.never())
+});
+/**
+* @deprecated format has been deprecated in favor of "dc+sd-jwt" since Draft 23
+* of the OpenID for Verifiable Presentations specification. Please update your
+* implementations accordingly.
+*/
+const zLegacySdJwtVcCredentialRequestFormatDraft14 = z.object({
+	format: zLegacySdJwtVcFormatIdentifier,
+	vct: z.string(),
+	claims: z.optional(zCredentialConfigurationSupportedClaimsDraft14),
+	credential_definition: z.optional(z.never())
 });
 
-// src/formats/credential/w3c-vc/z-w3c-ldp-vc.ts
-import z9 from "zod";
-
-// src/formats/credential/w3c-vc/z-w3c-vc-common.ts
-import z8 from "zod";
-var zCredentialSubjectLeafTypeDraft14 = z8.object({
-  mandatory: z8.boolean().optional(),
-  value_type: z8.string().optional(),
-  display: z8.array(
-    z8.object({
-      name: z8.string().optional(),
-      locale: z8.string().optional()
-    }).passthrough()
-  ).optional()
+//#endregion
+//#region src/formats/credential/w3c-vc/z-w3c-vc-common.ts
+const zCredentialSubjectLeafTypeDraft14 = z.object({
+	mandatory: z.boolean().optional(),
+	value_type: z.string().optional(),
+	display: z.array(z.object({
+		name: z.string().optional(),
+		locale: z.string().optional()
+	}).passthrough()).optional()
 }).passthrough();
-var zClaimValueSchemaDraft14 = z8.union([
-  z8.array(z8.any()),
-  z8.record(z8.string(), z8.any()),
-  zCredentialSubjectLeafTypeDraft14
+const zClaimValueSchemaDraft14 = z.union([
+	z.array(z.any()),
+	z.record(z.string(), z.any()),
+	zCredentialSubjectLeafTypeDraft14
 ]);
-var zW3cVcCredentialSubjectDraft14 = z8.record(z8.string(), zClaimValueSchemaDraft14);
-var zW3cVcJsonLdCredentialDefinition = z8.object({
-  "@context": z8.array(z8.string()),
-  type: z8.array(z8.string()).nonempty()
+const zW3cVcCredentialSubjectDraft14 = z.record(z.string(), zClaimValueSchemaDraft14);
+const zW3cVcJsonLdCredentialDefinition = z.object({
+	"@context": z.array(z.string()),
+	type: z.array(z.string()).nonempty()
 }).passthrough();
-var zW3cVcJsonLdCredentialDefinitionDraft14 = zW3cVcJsonLdCredentialDefinition.extend({
-  credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
-});
+const zW3cVcJsonLdCredentialDefinitionDraft14 = zW3cVcJsonLdCredentialDefinition.extend({ credentialSubject: zW3cVcCredentialSubjectDraft14.optional() });
 
-// src/formats/credential/w3c-vc/z-w3c-ldp-vc.ts
-var zLdpVcFormatIdentifier = z9.literal("ldp_vc");
-var zLdpVcCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
-  format: zLdpVcFormatIdentifier,
-  credential_definition: zW3cVcJsonLdCredentialDefinition,
-  credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({
-    claims: z9.array(zIssuerMetadataClaimsDescription).optional()
-  }).optional()
+//#endregion
+//#region src/formats/credential/w3c-vc/z-w3c-jwt-vc-json.ts
+const zJwtVcJsonFormatIdentifier = z.literal("jwt_vc_json");
+const zJwtVcJsonCredentialDefinition = z.object({ type: z.array(z.string()).nonempty() }).passthrough();
+const zJwtVcJsonCredentialDefinitionDraft14 = zJwtVcJsonCredentialDefinition.extend({ credentialSubject: zW3cVcCredentialSubjectDraft14.optional() });
+const zJwtVcJsonCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
+	format: zJwtVcJsonFormatIdentifier,
+	credential_definition: zJwtVcJsonCredentialDefinition,
+	credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({ claims: z.array(zIssuerMetadataClaimsDescription).optional() }).optional()
 });
-var zLdpVcCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
-  format: zLdpVcFormatIdentifier,
-  credential_definition: zW3cVcJsonLdCredentialDefinition,
-  claims: z9.array(zIssuerMetadataClaimsDescription).optional()
+const zJwtVcJsonCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
+	format: zJwtVcJsonFormatIdentifier,
+	credential_definition: zJwtVcJsonCredentialDefinition,
+	claims: z.array(zIssuerMetadataClaimsDescription).optional()
 });
-var zLdpVcCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
-  format: zLdpVcFormatIdentifier,
-  credential_definition: zW3cVcJsonLdCredentialDefinitionDraft14,
-  order: z9.array(z9.string()).optional()
+const zJwtVcJsonCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
+	format: zJwtVcJsonFormatIdentifier,
+	credential_definition: zJwtVcJsonCredentialDefinitionDraft14,
+	order: z.array(z.string()).optional()
 });
-var zLdpVcCredentialIssuerMetadataDraft11 = z9.object({
-  order: z9.array(z9.string()).optional(),
-  format: zLdpVcFormatIdentifier,
-  // Credential definition was spread on top level instead of a separatey property in v11
-  // As well as using types instead of type
-  "@context": z9.array(z9.string()),
-  types: z9.array(z9.string()),
-  credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
+const zJwtVcJsonCredentialIssuerMetadataDraft11 = z.object({
+	format: zJwtVcJsonFormatIdentifier,
+	order: z.array(z.string()).optional(),
+	types: z.array(z.string()),
+	credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
 }).passthrough();
-var zLdpVcCredentialIssuerMetadataDraft11To14 = zLdpVcCredentialIssuerMetadataDraft11.transform(
-  ({ "@context": context, types, credentialSubject, ...rest }) => ({
-    ...rest,
-    credential_definition: {
-      "@context": context,
-      type: types,
-      // Prevent weird typing issue with optional vs undefined
-      ...credentialSubject ? { credentialSubject } : {}
-    }
-  })
-);
-var zLdpVcCredentialIssuerMetadataDraft14To11 = zLdpVcCredentialIssuerMetadataDraft14.passthrough().transform(({ credential_definition: { type, ...credentialDefinition }, ...rest }) => ({
-  ...rest,
-  ...credentialDefinition,
-  types: type
-})).pipe(zLdpVcCredentialIssuerMetadataDraft11);
-var zLdpVcCredentialRequestFormatDraft14 = z9.object({
-  format: zLdpVcFormatIdentifier,
-  credential_definition: zW3cVcJsonLdCredentialDefinitionDraft14
+const zJwtVcJsonCredentialIssuerMetadataDraft11To14 = zJwtVcJsonCredentialIssuerMetadataDraft11.transform(({ types, credentialSubject,...rest }) => ({
+	...rest,
+	credential_definition: {
+		type: types,
+		...credentialSubject ? { credentialSubject } : {}
+	}
+}));
+const zJwtVcJsonCredentialIssuerMetadataDraft14To11 = zJwtVcJsonCredentialIssuerMetadataDraft14.passthrough().transform(({ credential_definition: { type,...credentialDefinition },...rest }) => ({
+	...rest,
+	types: type,
+	...credentialDefinition
+})).pipe(zJwtVcJsonCredentialIssuerMetadataDraft11);
+const zJwtVcJsonCredentialRequestFormatDraft14 = z.object({
+	format: zJwtVcJsonFormatIdentifier,
+	credential_definition: zJwtVcJsonCredentialDefinition
 });
-var zLdpVcCredentialRequestDraft11 = z9.object({
-  format: zLdpVcFormatIdentifier,
-  credential_definition: z9.object({
-    "@context": z9.array(z9.string()),
-    // credential_definition was using types instead of type in v11
-    types: z9.array(z9.string()),
-    credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
-  })
+const zJwtVcJsonCredentialRequestDraft11 = z.object({
+	format: zJwtVcJsonFormatIdentifier,
+	types: z.array(z.string()),
+	credentialSubject: z.optional(zW3cVcCredentialSubjectDraft14)
 }).passthrough();
-var zLdpVcCredentialRequestDraft11To14 = zLdpVcCredentialRequestDraft11.transform(
-  ({ credential_definition: { types, ...restCredentialDefinition }, ...rest }) => ({
-    ...rest,
-    credential_definition: {
-      ...restCredentialDefinition,
-      type: types
-    }
-  })
-);
-var zLdpVcCredentialRequestDraft14To11 = zLdpVcCredentialRequestFormatDraft14.passthrough().transform(({ credential_definition: { type, ...restCredentialDefinition }, ...rest }) => ({
-  ...rest,
-  credential_definition: {
-    ...restCredentialDefinition,
-    types: type
-  }
-})).pipe(zLdpVcCredentialRequestDraft11);
+const zJwtVcJsonCredentialRequestDraft11To14 = zJwtVcJsonCredentialRequestDraft11.transform(({ types, credentialSubject,...rest }) => {
+	return {
+		...rest,
+		credential_definition: {
+			type: types,
+			...credentialSubject ? { credentialSubject } : {}
+		}
+	};
+});
+const zJwtVcJsonCredentialRequestDraft14To11 = zJwtVcJsonCredentialRequestFormatDraft14.passthrough().transform(({ credential_definition: { type,...credentialDefinition },...rest }) => ({
+	...rest,
+	types: type,
+	...credentialDefinition
+})).pipe(zJwtVcJsonCredentialRequestDraft11);
 
-// src/formats/credential/w3c-vc/z-w3c-jwt-vc-json-ld.ts
-import z10 from "zod";
-var zJwtVcJsonLdFormatIdentifier = z10.literal("jwt_vc_json-ld");
-var zJwtVcJsonLdCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
-  format: zJwtVcJsonLdFormatIdentifier,
-  credential_definition: zW3cVcJsonLdCredentialDefinition,
-  credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({
-    claims: z10.array(zIssuerMetadataClaimsDescription).optional()
-  }).optional()
+//#endregion
+//#region src/formats/credential/w3c-vc/z-w3c-jwt-vc-json-ld.ts
+const zJwtVcJsonLdFormatIdentifier = z.literal("jwt_vc_json-ld");
+const zJwtVcJsonLdCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
+	format: zJwtVcJsonLdFormatIdentifier,
+	credential_definition: zW3cVcJsonLdCredentialDefinition,
+	credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({ claims: z.array(zIssuerMetadataClaimsDescription).optional() }).optional()
 });
-var zJwtVcJsonLdCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
-  format: zJwtVcJsonLdFormatIdentifier,
-  credential_definition: zW3cVcJsonLdCredentialDefinition,
-  claims: z10.array(zIssuerMetadataClaimsDescription).optional()
+const zJwtVcJsonLdCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
+	format: zJwtVcJsonLdFormatIdentifier,
+	credential_definition: zW3cVcJsonLdCredentialDefinition,
+	claims: z.array(zIssuerMetadataClaimsDescription).optional()
 });
-var zJwtVcJsonLdCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
-  format: zJwtVcJsonLdFormatIdentifier,
-  credential_definition: zW3cVcJsonLdCredentialDefinitionDraft14,
-  order: z10.optional(z10.array(z10.string()))
+const zJwtVcJsonLdCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
+	format: zJwtVcJsonLdFormatIdentifier,
+	credential_definition: zW3cVcJsonLdCredentialDefinitionDraft14,
+	order: z.optional(z.array(z.string()))
 });
-var zJwtVcJsonLdCredentialIssuerMetadataDraft11 = z10.object({
-  order: z10.array(z10.string()).optional(),
-  format: zJwtVcJsonLdFormatIdentifier,
-  // Credential definition was spread on top level instead of a separatey property in v11
-  // As well as using types instead of type
-  "@context": z10.array(z10.string()),
-  types: z10.array(z10.string()),
-  credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
+const zJwtVcJsonLdCredentialIssuerMetadataDraft11 = z.object({
+	order: z.array(z.string()).optional(),
+	format: zJwtVcJsonLdFormatIdentifier,
+	"@context": z.array(z.string()),
+	types: z.array(z.string()),
+	credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
 }).passthrough();
-var zJwtVcJsonLdCredentialIssuerMetadataDraft11To14 = zJwtVcJsonLdCredentialIssuerMetadataDraft11.transform(
-  ({ "@context": context, types, credentialSubject, ...rest }) => ({
-    ...rest,
-    credential_definition: {
-      "@context": context,
-      type: types,
-      // Prevent weird typing issue with optional vs undefined
-      ...credentialSubject ? { credentialSubject } : {}
-    }
-  })
-);
-var zJwtVcJsonLdCredentialIssuerMetadataDraft14To11 = zJwtVcJsonLdCredentialIssuerMetadataDraft14.passthrough().transform(({ credential_definition: { type, ...credentialDefinition }, ...rest }) => ({
-  ...rest,
-  ...credentialDefinition,
-  types: type
+const zJwtVcJsonLdCredentialIssuerMetadataDraft11To14 = zJwtVcJsonLdCredentialIssuerMetadataDraft11.transform(({ "@context": context, types, credentialSubject,...rest }) => ({
+	...rest,
+	credential_definition: {
+		"@context": context,
+		type: types,
+		...credentialSubject ? { credentialSubject } : {}
+	}
+}));
+const zJwtVcJsonLdCredentialIssuerMetadataDraft14To11 = zJwtVcJsonLdCredentialIssuerMetadataDraft14.passthrough().transform(({ credential_definition: { type,...credentialDefinition },...rest }) => ({
+	...rest,
+	...credentialDefinition,
+	types: type
 })).pipe(zJwtVcJsonLdCredentialIssuerMetadataDraft11);
-var zJwtVcJsonLdCredentialRequestFormatDraft14 = z10.object({
-  format: zJwtVcJsonLdFormatIdentifier,
-  credential_definition: zW3cVcJsonLdCredentialDefinition
+const zJwtVcJsonLdCredentialRequestFormatDraft14 = z.object({
+	format: zJwtVcJsonLdFormatIdentifier,
+	credential_definition: zW3cVcJsonLdCredentialDefinition
 });
-var zJwtVcJsonLdCredentialRequestDraft11 = z10.object({
-  format: zJwtVcJsonLdFormatIdentifier,
-  credential_definition: z10.object({
-    "@context": z10.array(z10.string()),
-    // credential_definition was using types instead of type in v11
-    types: z10.array(z10.string()),
-    credentialSubject: z10.optional(zW3cVcCredentialSubjectDraft14)
-  }).passthrough()
+const zJwtVcJsonLdCredentialRequestDraft11 = z.object({
+	format: zJwtVcJsonLdFormatIdentifier,
+	credential_definition: z.object({
+		"@context": z.array(z.string()),
+		types: z.array(z.string()),
+		credentialSubject: z.optional(zW3cVcCredentialSubjectDraft14)
+	}).passthrough()
 }).passthrough();
-var zJwtVcJsonLdCredentialRequestDraft11To14 = zJwtVcJsonLdCredentialRequestDraft11.transform(
-  ({ credential_definition: { types, ...restCredentialDefinition }, ...rest }) => ({
-    ...rest,
-    credential_definition: {
-      ...restCredentialDefinition,
-      type: types
-    }
-  })
-);
-var zJwtVcJsonLdCredentialRequestDraft14To11 = zJwtVcJsonLdCredentialRequestFormatDraft14.passthrough().transform(({ credential_definition: { type, ...restCredentialDefinition }, ...rest }) => ({
-  ...rest,
-  credential_definition: {
-    ...restCredentialDefinition,
-    types: type
-  }
+const zJwtVcJsonLdCredentialRequestDraft11To14 = zJwtVcJsonLdCredentialRequestDraft11.transform(({ credential_definition: { types,...restCredentialDefinition },...rest }) => ({
+	...rest,
+	credential_definition: {
+		...restCredentialDefinition,
+		type: types
+	}
+}));
+const zJwtVcJsonLdCredentialRequestDraft14To11 = zJwtVcJsonLdCredentialRequestFormatDraft14.passthrough().transform(({ credential_definition: { type,...restCredentialDefinition },...rest }) => ({
+	...rest,
+	credential_definition: {
+		...restCredentialDefinition,
+		types: type
+	}
 })).pipe(zJwtVcJsonLdCredentialRequestDraft11);
 
-// src/formats/credential/w3c-vc/z-w3c-jwt-vc-json.ts
-import z11 from "zod";
-var zJwtVcJsonFormatIdentifier = z11.literal("jwt_vc_json");
-var zJwtVcJsonCredentialDefinition = z11.object({
-  type: z11.array(z11.string()).nonempty()
-}).passthrough();
-var zJwtVcJsonCredentialDefinitionDraft14 = zJwtVcJsonCredentialDefinition.extend({
-  credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
-});
-var zJwtVcJsonCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
-  format: zJwtVcJsonFormatIdentifier,
-  credential_definition: zJwtVcJsonCredentialDefinition,
-  credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({
-    claims: z11.array(zIssuerMetadataClaimsDescription).optional()
-  }).optional()
+//#endregion
+//#region src/formats/credential/w3c-vc/z-w3c-ldp-vc.ts
+const zLdpVcFormatIdentifier = z.literal("ldp_vc");
+const zLdpVcCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
+	format: zLdpVcFormatIdentifier,
+	credential_definition: zW3cVcJsonLdCredentialDefinition,
+	credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({ claims: z.array(zIssuerMetadataClaimsDescription).optional() }).optional()
 });
-var zJwtVcJsonCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
-  format: zJwtVcJsonFormatIdentifier,
-  credential_definition: zJwtVcJsonCredentialDefinition,
-  claims: z11.array(zIssuerMetadataClaimsDescription).optional()
+const zLdpVcCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
+	format: zLdpVcFormatIdentifier,
+	credential_definition: zW3cVcJsonLdCredentialDefinition,
+	claims: z.array(zIssuerMetadataClaimsDescription).optional()
 });
-var zJwtVcJsonCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
-  format: zJwtVcJsonFormatIdentifier,
-  credential_definition: zJwtVcJsonCredentialDefinitionDraft14,
-  order: z11.array(z11.string()).optional()
+const zLdpVcCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
+	format: zLdpVcFormatIdentifier,
+	credential_definition: zW3cVcJsonLdCredentialDefinitionDraft14,
+	order: z.array(z.string()).optional()
 });
-var zJwtVcJsonCredentialIssuerMetadataDraft11 = z11.object({
-  format: zJwtVcJsonFormatIdentifier,
-  order: z11.array(z11.string()).optional(),
-  // Credential definition was spread on top level instead of a separatey property in v11
-  // As well as using types instead of type
-  types: z11.array(z11.string()),
-  credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
+const zLdpVcCredentialIssuerMetadataDraft11 = z.object({
+	order: z.array(z.string()).optional(),
+	format: zLdpVcFormatIdentifier,
+	"@context": z.array(z.string()),
+	types: z.array(z.string()),
+	credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
 }).passthrough();
-var zJwtVcJsonCredentialIssuerMetadataDraft11To14 = zJwtVcJsonCredentialIssuerMetadataDraft11.transform(
-  ({ types, credentialSubject, ...rest }) => ({
-    ...rest,
-    credential_definition: {
-      type: types,
-      // Prevent weird typing issue with optional vs undefined
-      ...credentialSubject ? { credentialSubject } : {}
-    }
-  })
-);
-var zJwtVcJsonCredentialIssuerMetadataDraft14To11 = zJwtVcJsonCredentialIssuerMetadataDraft14.passthrough().transform(({ credential_definition: { type, ...credentialDefinition }, ...rest }) => ({
-  ...rest,
-  types: type,
-  ...credentialDefinition
-})).pipe(zJwtVcJsonCredentialIssuerMetadataDraft11);
-var zJwtVcJsonCredentialRequestFormatDraft14 = z11.object({
-  format: zJwtVcJsonFormatIdentifier,
-  credential_definition: zJwtVcJsonCredentialDefinition
+const zLdpVcCredentialIssuerMetadataDraft11To14 = zLdpVcCredentialIssuerMetadataDraft11.transform(({ "@context": context, types, credentialSubject,...rest }) => ({
+	...rest,
+	credential_definition: {
+		"@context": context,
+		type: types,
+		...credentialSubject ? { credentialSubject } : {}
+	}
+}));
+const zLdpVcCredentialIssuerMetadataDraft14To11 = zLdpVcCredentialIssuerMetadataDraft14.passthrough().transform(({ credential_definition: { type,...credentialDefinition },...rest }) => ({
+	...rest,
+	...credentialDefinition,
+	types: type
+})).pipe(zLdpVcCredentialIssuerMetadataDraft11);
+const zLdpVcCredentialRequestFormatDraft14 = z.object({
+	format: zLdpVcFormatIdentifier,
+	credential_definition: zW3cVcJsonLdCredentialDefinitionDraft14
 });
-var zJwtVcJsonCredentialRequestDraft11 = z11.object({
-  format: zJwtVcJsonFormatIdentifier,
-  // Credential definition was spread on top level instead of a separatey property in v11
-  // As well as using types instead of type
-  types: z11.array(z11.string()),
-  credentialSubject: z11.optional(zW3cVcCredentialSubjectDraft14)
+const zLdpVcCredentialRequestDraft11 = z.object({
+	format: zLdpVcFormatIdentifier,
+	credential_definition: z.object({
+		"@context": z.array(z.string()),
+		types: z.array(z.string()),
+		credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
+	})
 }).passthrough();
-var zJwtVcJsonCredentialRequestDraft11To14 = zJwtVcJsonCredentialRequestDraft11.transform(
-  ({ types, credentialSubject, ...rest }) => {
-    return {
-      ...rest,
-      credential_definition: {
-        type: types,
-        // Prevent weird typing issue with optional vs undefined
-        ...credentialSubject ? { credentialSubject } : {}
-      }
-    };
-  }
-);
-var zJwtVcJsonCredentialRequestDraft14To11 = zJwtVcJsonCredentialRequestFormatDraft14.passthrough().transform(({ credential_definition: { type, ...credentialDefinition }, ...rest }) => ({
-  ...rest,
-  types: type,
-  ...credentialDefinition
-})).pipe(zJwtVcJsonCredentialRequestDraft11);
+const zLdpVcCredentialRequestDraft11To14 = zLdpVcCredentialRequestDraft11.transform(({ credential_definition: { types,...restCredentialDefinition },...rest }) => ({
+	...rest,
+	credential_definition: {
+		...restCredentialDefinition,
+		type: types
+	}
+}));
+const zLdpVcCredentialRequestDraft14To11 = zLdpVcCredentialRequestFormatDraft14.passthrough().transform(({ credential_definition: { type,...restCredentialDefinition },...rest }) => ({
+	...rest,
+	credential_definition: {
+		...restCredentialDefinition,
+		types: type
+	}
+})).pipe(zLdpVcCredentialRequestDraft11);
 
-// src/formats/credential/w3c-vc/z-w3c-sd-jwt-vc.ts
-import z12 from "zod";
-var zSdJwtW3VcFormatIdentifier = z12.literal("vc+sd-jwt");
-var zSdJwtW3VcCredentialDefinition = z12.object({
-  type: z12.array(z12.string()).nonempty()
-}).passthrough();
-var zSdJwtW3VcCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
-  format: zSdJwtW3VcFormatIdentifier,
-  credential_definition: zSdJwtW3VcCredentialDefinition,
-  credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({
-    claims: z12.array(zIssuerMetadataClaimsDescription).optional()
-  }).optional(),
-  // FIXME(vc+sd-jwt): remove when dropping support for legacy vc+sd-jwt. Allows type narrowing.
-  vct: z12.optional(z12.never())
+//#endregion
+//#region src/formats/credential/w3c-vc/z-w3c-sd-jwt-vc.ts
+const zSdJwtW3VcFormatIdentifier = z.literal("vc+sd-jwt");
+const zSdJwtW3VcCredentialDefinition = z.object({ type: z.array(z.string()).nonempty() }).passthrough();
+const zSdJwtW3VcCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
+	format: zSdJwtW3VcFormatIdentifier,
+	credential_definition: zSdJwtW3VcCredentialDefinition,
+	credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({ claims: z.array(zIssuerMetadataClaimsDescription).optional() }).optional(),
+	vct: z.optional(z.never())
 });
-var zSdJwtW3VcCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
-  format: zSdJwtW3VcFormatIdentifier,
-  credential_definition: zSdJwtW3VcCredentialDefinition,
-  claims: z12.array(zIssuerMetadataClaimsDescription).optional(),
-  // FIXME(vc+sd-jwt): remove when dropping support for legacy vc+sd-jwt. Allows type narrowing.
-  vct: z12.optional(z12.never())
+const zSdJwtW3VcCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
+	format: zSdJwtW3VcFormatIdentifier,
+	credential_definition: zSdJwtW3VcCredentialDefinition,
+	claims: z.array(zIssuerMetadataClaimsDescription).optional(),
+	vct: z.optional(z.never())
 });
-var zSdJwtW3VcCredentialRequestFormatDraft14 = z12.object({
-  format: zSdJwtW3VcFormatIdentifier,
-  credential_definition: zSdJwtW3VcCredentialDefinition,
-  // FIXME(vc+sd-jwt): remove when dropping support for legacy vc+sd-jwt. Allows type narrowing.
-  vct: z12.optional(z12.never())
+const zSdJwtW3VcCredentialRequestFormatDraft14 = z.object({
+	format: zSdJwtW3VcFormatIdentifier,
+	credential_definition: zSdJwtW3VcCredentialDefinition,
+	vct: z.optional(z.never())
 });
 
-// src/metadata/credential-issuer/z-credential-issuer-metadata.ts
-var allCredentialIssuerMetadataFormats = [
-  zSdJwtDcCredentialIssuerMetadata,
-  zMsoMdocCredentialIssuerMetadata,
-  zJwtVcJsonLdCredentialIssuerMetadata,
-  zLdpVcCredentialIssuerMetadata,
-  zJwtVcJsonCredentialIssuerMetadata,
-  zSdJwtW3VcCredentialIssuerMetadata,
-  zSdJwtW3VcCredentialIssuerMetadataDraft15,
-  zLegacySdJwtVcCredentialIssuerMetadataDraft16,
-  zSdJwtDcCredentialIssuerMetadataDraft15,
-  zMsoMdocCredentialIssuerMetadataDraft15,
-  zJwtVcJsonLdCredentialIssuerMetadataDraft15,
-  zLdpVcCredentialIssuerMetadataDraft15,
-  zJwtVcJsonCredentialIssuerMetadataDraft15,
-  zMsoMdocCredentialIssuerMetadataDraft14,
-  zLegacySdJwtVcCredentialIssuerMetadataDraft14,
-  zJwtVcJsonLdCredentialIssuerMetadataDraft14,
-  zLdpVcCredentialIssuerMetadataDraft14,
-  zJwtVcJsonCredentialIssuerMetadataDraft14
+//#endregion
+//#region src/metadata/credential-issuer/z-credential-issuer-metadata.ts
+const allCredentialIssuerMetadataFormats = [
+	zSdJwtDcCredentialIssuerMetadata,
+	zMsoMdocCredentialIssuerMetadata,
+	zJwtVcJsonLdCredentialIssuerMetadata,
+	zLdpVcCredentialIssuerMetadata,
+	zJwtVcJsonCredentialIssuerMetadata,
+	zSdJwtW3VcCredentialIssuerMetadata,
+	zSdJwtW3VcCredentialIssuerMetadataDraft15,
+	zLegacySdJwtVcCredentialIssuerMetadataDraft16,
+	zSdJwtDcCredentialIssuerMetadataDraft15,
+	zMsoMdocCredentialIssuerMetadataDraft15,
+	zJwtVcJsonLdCredentialIssuerMetadataDraft15,
+	zLdpVcCredentialIssuerMetadataDraft15,
+	zJwtVcJsonCredentialIssuerMetadataDraft15,
+	zMsoMdocCredentialIssuerMetadataDraft14,
+	zLegacySdJwtVcCredentialIssuerMetadataDraft14,
+	zJwtVcJsonLdCredentialIssuerMetadataDraft14,
+	zLdpVcCredentialIssuerMetadataDraft14,
+	zJwtVcJsonCredentialIssuerMetadataDraft14
 ];
-var allCredentialIssuerMetadataFormatIdentifiers = allCredentialIssuerMetadataFormats.map(
-  (format) => format.shape.format.value
-);
-var zCredentialConfigurationSupportedWithFormats = z13.union([zCredentialConfigurationSupportedCommon, zCredentialConfigurationSupportedCommonDraft15]).transform((data, ctx) => {
-  if (!allCredentialIssuerMetadataFormatIdentifiers.includes(data.format)) return data;
-  const validators = allCredentialIssuerMetadataFormats.filter(
-    (formatValidator) => formatValidator.shape.format.value === data.format
-  );
-  const result = z13.object({}).passthrough().and(
-    validators.length > 1 ? z13.union(
-      validators
-    ) : validators[0]
-  ).safeParse(data);
-  if (result.success) {
-    return result.data;
-  }
-  for (const issue of result.error.issues) {
-    ctx.addIssue(issue);
-  }
-  return z13.NEVER;
+const allCredentialIssuerMetadataFormatIdentifiers = allCredentialIssuerMetadataFormats.map((format) => format.shape.format.value);
+const zCredentialConfigurationSupportedWithFormats = z.union([zCredentialConfigurationSupportedCommon, zCredentialConfigurationSupportedCommonDraft15]).transform((data, ctx) => {
+	if (!allCredentialIssuerMetadataFormatIdentifiers.includes(data.format)) return data;
+	const validators = allCredentialIssuerMetadataFormats.filter((formatValidator) => formatValidator.shape.format.value === data.format);
+	const result = z.object({}).passthrough().and(validators.length > 1 ? z.union(validators) : validators[0]).safeParse(data);
+	if (result.success) return result.data;
+	for (const issue of result.error.issues) ctx.addIssue(issue);
+	return z.NEVER;
 });
-var zCredentialIssuerMetadataDisplayEntry = z13.object({
-  name: z13.string().optional(),
-  locale: z13.string().optional(),
-  logo: z13.object({
-    // FIXME: make required again, but need to support draft 11 first
-    uri: z13.string().optional(),
-    alt_text: z13.string().optional()
-  }).passthrough().optional()
+const zCredentialIssuerMetadataDisplayEntry = z.object({
+	name: z.string().optional(),
+	locale: z.string().optional(),
+	logo: z.object({
+		uri: z.string().optional(),
+		alt_text: z.string().optional()
+	}).passthrough().optional()
 }).passthrough();
-var zCredentialIssuerMetadataDraft14Draft15Draft16 = z13.object({
-  credential_issuer: zHttpsUrl2,
-  authorization_servers: z13.array(zHttpsUrl2).optional(),
-  credential_endpoint: zHttpsUrl2,
-  deferred_credential_endpoint: zHttpsUrl2.optional(),
-  notification_endpoint: zHttpsUrl2.optional(),
-  // Added after draft 14, but needed for proper
-  nonce_endpoint: zHttpsUrl2.optional(),
-  credential_response_encryption: z13.object({
-    alg_values_supported: z13.array(z13.string()),
-    enc_values_supported: z13.array(z13.string()),
-    encryption_required: z13.boolean()
-  }).passthrough().optional(),
-  batch_credential_issuance: z13.object({
-    batch_size: z13.number().positive()
-  }).passthrough().optional(),
-  signed_metadata: zCompactJwt.optional(),
-  display: z13.array(zCredentialIssuerMetadataDisplayEntry).optional(),
-  credential_configurations_supported: z13.record(z13.string(), zCredentialConfigurationSupportedWithFormats)
+const zCredentialIssuerMetadataDraft14Draft15Draft16 = z.object({
+	credential_issuer: zHttpsUrl,
+	authorization_servers: z.array(zHttpsUrl).optional(),
+	credential_endpoint: zHttpsUrl,
+	deferred_credential_endpoint: zHttpsUrl.optional(),
+	notification_endpoint: zHttpsUrl.optional(),
+	nonce_endpoint: zHttpsUrl.optional(),
+	credential_response_encryption: z.object({
+		alg_values_supported: z.array(z.string()),
+		enc_values_supported: z.array(z.string()),
+		encryption_required: z.boolean()
+	}).passthrough().optional(),
+	batch_credential_issuance: z.object({ batch_size: z.number().positive() }).passthrough().optional(),
+	signed_metadata: zCompactJwt.optional(),
+	display: z.array(zCredentialIssuerMetadataDisplayEntry).optional(),
+	credential_configurations_supported: z.record(z.string(), zCredentialConfigurationSupportedWithFormats)
 }).passthrough();
-var zCredentialConfigurationSupportedDraft11To16 = z13.object({
-  id: z13.string().optional(),
-  format: z13.string(),
-  cryptographic_suites_supported: z13.array(z13.string()).optional(),
-  display: z13.array(
-    z13.object({
-      logo: z13.object({
-        url: z13.string().url().optional()
-      }).passthrough().optional(),
-      background_image: z13.object({
-        url: z13.string().url().optional()
-      }).passthrough().optional()
-    }).passthrough()
-  ).optional(),
-  claims: z13.any().optional()
-}).passthrough().transform(({ cryptographic_suites_supported, display, claims, id, ...rest }) => ({
-  ...rest,
-  ...cryptographic_suites_supported ? { credential_signing_alg_values_supported: cryptographic_suites_supported } : {},
-  ...claims || display ? {
-    credential_metadata: {
-      ...claims ? { claims } : {},
-      ...display ? {
-        display: display.map(({ logo, background_image, ...displayRest }) => ({
-          ...displayRest,
-          // url became uri and also required
-          // so if there's no url in the logo, we remove the whole logo object
-          ...logo?.url ? {
-            // TODO: we should add the other params from logo as well
-            logo: {
-              uri: logo.url
-            }
-          } : {},
-          // TODO: we should add the other params from background_image as well
-          // url became uri and also required
-          // so if there's no url in the background_image, we remove the whole logo object
-          ...background_image?.url ? {
-            background_image: {
-              uri: background_image.url
-            }
-          } : {}
-        }))
-      } : {}
-    }
-  } : {}
+const zCredentialConfigurationSupportedDraft11To16 = z.object({
+	id: z.string().optional(),
+	format: z.string(),
+	cryptographic_suites_supported: z.array(z.string()).optional(),
+	display: z.array(z.object({
+		logo: z.object({ url: z.string().url().optional() }).passthrough().optional(),
+		background_image: z.object({ url: z.string().url().optional() }).passthrough().optional()
+	}).passthrough()).optional(),
+	claims: z.any().optional()
+}).passthrough().transform(({ cryptographic_suites_supported, display, claims, id,...rest }) => ({
+	...rest,
+	...cryptographic_suites_supported ? { credential_signing_alg_values_supported: cryptographic_suites_supported } : {},
+	...claims || display ? { credential_metadata: {
+		...claims ? { claims } : {},
+		...display ? { display: display.map(({ logo, background_image,...displayRest }) => ({
+			...displayRest,
+			...logo?.url ? { logo: { uri: logo.url } } : {},
+			...background_image?.url ? { background_image: { uri: background_image.url } } : {}
+		})) } : {}
+	} } : {}
 })).transform((data, ctx) => {
-  const formatSpecificTransformations = {
-    [zLdpVcFormatIdentifier.value]: zLdpVcCredentialIssuerMetadataDraft11To14,
-    [zJwtVcJsonFormatIdentifier.value]: zJwtVcJsonCredentialIssuerMetadataDraft11To14,
-    [zJwtVcJsonLdFormatIdentifier.value]: zJwtVcJsonLdCredentialIssuerMetadataDraft11To14
-  };
-  if (!Object.keys(formatSpecificTransformations).includes(data.format)) return data;
-  const schema = formatSpecificTransformations[data.format];
-  const result = schema.safeParse(data);
-  if (result.success) return result.data;
-  for (const issue of result.error.issues) {
-    ctx.addIssue(issue);
-  }
-  return z13.NEVER;
+	const formatSpecificTransformations = {
+		[zLdpVcFormatIdentifier.value]: zLdpVcCredentialIssuerMetadataDraft11To14,
+		[zJwtVcJsonFormatIdentifier.value]: zJwtVcJsonCredentialIssuerMetadataDraft11To14,
+		[zJwtVcJsonLdFormatIdentifier.value]: zJwtVcJsonLdCredentialIssuerMetadataDraft11To14
+	};
+	if (!Object.keys(formatSpecificTransformations).includes(data.format)) return data;
+	const result = formatSpecificTransformations[data.format].safeParse(data);
+	if (result.success) return result.data;
+	for (const issue of result.error.issues) ctx.addIssue(issue);
+	return z.NEVER;
 }).pipe(zCredentialConfigurationSupportedWithFormats);
-var zCredentialConfigurationSupportedDraft16To15 = zCredentialConfigurationSupportedWithFormats.transform(
-  ({ credential_metadata, ...rest }) => ({
-    ...credential_metadata,
-    ...rest
-  })
-);
-var zCredentialConfigurationSupportedDraft16To11 = zCredentialConfigurationSupportedDraft16To15.and(
-  z13.object({
-    id: z13.string()
-  }).passthrough()
-).transform(({ id, credential_signing_alg_values_supported, display, proof_types_supported, scope, ...rest }) => ({
-  ...rest,
-  ...credential_signing_alg_values_supported ? { cryptographic_suites_supported: credential_signing_alg_values_supported } : {},
-  ...display ? {
-    display: display.map(({ logo, background_image, ...displayRest }) => {
-      const { uri: logoUri, ...logoRest } = logo ?? {};
-      const { uri: backgroundImageUri, ...backgroundImageRest } = background_image ?? {};
-      return {
-        ...displayRest,
-        // draft 11 uses url, draft 13/14 uses uri
-        ...logoUri ? { logo: { url: logoUri, ...logoRest } } : {},
-        // draft 11 uses url, draft 13/14 uses uri
-        ...backgroundImageUri ? { logo: { url: backgroundImageUri, ...backgroundImageRest } } : {}
-      };
-    })
-  } : {},
-  id
-})).pipe(
-  z13.union([
-    zLdpVcCredentialIssuerMetadataDraft14To11,
-    zJwtVcJsonCredentialIssuerMetadataDraft14To11,
-    zJwtVcJsonLdCredentialIssuerMetadataDraft14To11,
-    // To handle unrecognized formats and not error immediately we allow the common format as well
-    // but they can't use any of the format identifiers that have a specific transformation. This way if a format is
-    // has a transformation it NEEDS to use the format specific transformation, and otherwise we fall back to the common validation
-    z13.object({
-      format: z13.string().refine(
-        (input) => ![
-          zLdpVcFormatIdentifier.value,
-          zJwtVcJsonFormatIdentifier.value,
-          zJwtVcJsonLdFormatIdentifier.value
-        ].includes(input)
-      )
-    }).passthrough()
-  ])
-);
-var zCredentialIssuerMetadataDraft11To16 = z13.object({
-  authorization_server: z13.string().optional(),
-  credentials_supported: z13.array(
-    z13.object({
-      id: z13.string().optional()
-    }).passthrough()
-  )
-}).passthrough().transform(({ authorization_server, credentials_supported, ...rest }) => {
-  return {
-    ...rest,
-    ...authorization_server ? { authorization_servers: [authorization_server] } : {},
-    // Go from array to map but keep v11 structure
-    credential_configurations_supported: Object.fromEntries(
-      credentials_supported.map((supported) => supported.id ? [supported.id, supported] : void 0).filter((i) => i !== void 0)
-    )
-  };
-}).pipe(
-  z13.object({
-    // Update from v11 structure to v14 structure
-    credential_configurations_supported: z13.record(z13.string(), zCredentialConfigurationSupportedDraft11To16)
-  }).passthrough()
-).pipe(zCredentialIssuerMetadataDraft14Draft15Draft16);
-var zCredentialIssuerMetadataWithDraft11 = zCredentialIssuerMetadataDraft14Draft15Draft16.transform((issuerMetadata) => ({
-  ...issuerMetadata,
-  ...issuerMetadata.authorization_servers ? { authorization_server: issuerMetadata.authorization_servers[0] } : {},
-  credentials_supported: Object.entries(issuerMetadata.credential_configurations_supported).map(([id, value]) => ({
-    ...value,
-    id
-  }))
-})).pipe(
-  zCredentialIssuerMetadataDraft14Draft15Draft16.extend({
-    credentials_supported: z13.array(zCredentialConfigurationSupportedDraft16To11)
-  })
-);
-var zCredentialIssuerMetadata = z13.union([
-  // First prioritize draft 16/15/14 (and 13)
-  zCredentialIssuerMetadataDraft14Draft15Draft16,
-  // Then try parsing draft 11 and transform into draft 16
-  zCredentialIssuerMetadataDraft11To16
-]);
-var zCredentialIssuerMetadataWithDraftVersion = z13.union([
-  zCredentialIssuerMetadataDraft14Draft15Draft16.transform((credentialIssuerMetadata) => {
-    const credentialConfigurations = Object.values(credentialIssuerMetadata.credential_configurations_supported);
-    const isDraft15 = credentialConfigurations.some((configuration) => {
-      const knownConfiguration = configuration;
-      if (knownConfiguration.format === zSdJwtDcFormatIdentifier.value) return true;
-      if (Array.isArray(knownConfiguration.claims)) return true;
-      if (Object.values(knownConfiguration.proof_types_supported ?? {}).some(
-        (proofType) => proofType.key_attestations_required !== void 0
-      ))
-        return true;
-      return false;
-    });
-    const isDraft16 = credentialConfigurations.some((configuration) => {
-      return configuration.credential_metadata;
-    });
-    return {
-      credentialIssuerMetadata,
-      originalDraftVersion: isDraft16 ? "Draft16" /* Draft16 */ : isDraft15 ? "Draft15" /* Draft15 */ : "Draft14" /* Draft14 */
-    };
-  }),
-  // Then try parsing draft 11 and transform into draft 14
-  zCredentialIssuerMetadataDraft11To16.transform((credentialIssuerMetadata) => ({
-    credentialIssuerMetadata,
-    originalDraftVersion: "Draft11" /* Draft11 */
-  }))
-]);
+const zCredentialConfigurationSupportedDraft16To11 = zCredentialConfigurationSupportedWithFormats.transform(({ credential_metadata,...rest }) => ({
+	...credential_metadata,
+	...rest
+})).and(z.object({ id: z.string() }).passthrough()).transform(({ id, credential_signing_alg_values_supported, display, proof_types_supported, scope,...rest }) => ({
+	...rest,
+	...credential_signing_alg_values_supported ? { cryptographic_suites_supported: credential_signing_alg_values_supported } : {},
+	...display ? { display: display.map(({ logo, background_image,...displayRest }) => {
+		const { uri: logoUri,...logoRest } = logo ?? {};
+		const { uri: backgroundImageUri,...backgroundImageRest } = background_image ?? {};
+		return {
+			...displayRest,
+			...logoUri ? { logo: {
+				url: logoUri,
+				...logoRest
+			} } : {},
+			...backgroundImageUri ? { logo: {
+				url: backgroundImageUri,
+				...backgroundImageRest
+			} } : {}
+		};
+	}) } : {},
+	id
+})).pipe(z.union([
+	zLdpVcCredentialIssuerMetadataDraft14To11,
+	zJwtVcJsonCredentialIssuerMetadataDraft14To11,
+	zJwtVcJsonLdCredentialIssuerMetadataDraft14To11,
+	z.object({ format: z.string().refine((input) => ![
+		zLdpVcFormatIdentifier.value,
+		zJwtVcJsonFormatIdentifier.value,
+		zJwtVcJsonLdFormatIdentifier.value
+	].includes(input)) }).passthrough()
+]));
+const zCredentialIssuerMetadataDraft11To16 = z.object({
+	authorization_server: z.string().optional(),
+	credentials_supported: z.array(z.object({ id: z.string().optional() }).passthrough())
+}).passthrough().transform(({ authorization_server, credentials_supported,...rest }) => {
+	return {
+		...rest,
+		...authorization_server ? { authorization_servers: [authorization_server] } : {},
+		credential_configurations_supported: Object.fromEntries(credentials_supported.map((supported) => supported.id ? [supported.id, supported] : void 0).filter((i) => i !== void 0))
+	};
+}).pipe(z.object({ credential_configurations_supported: z.record(z.string(), zCredentialConfigurationSupportedDraft11To16) }).passthrough()).pipe(zCredentialIssuerMetadataDraft14Draft15Draft16);
+const zCredentialIssuerMetadataWithDraft11 = zCredentialIssuerMetadataDraft14Draft15Draft16.transform((issuerMetadata) => ({
+	...issuerMetadata,
+	...issuerMetadata.authorization_servers ? { authorization_server: issuerMetadata.authorization_servers[0] } : {},
+	credentials_supported: Object.entries(issuerMetadata.credential_configurations_supported).map(([id, value]) => ({
+		...value,
+		id
+	}))
+})).pipe(zCredentialIssuerMetadataDraft14Draft15Draft16.extend({ credentials_supported: z.array(zCredentialConfigurationSupportedDraft16To11) }));
+const zCredentialIssuerMetadata = z.union([zCredentialIssuerMetadataDraft14Draft15Draft16, zCredentialIssuerMetadataDraft11To16]);
+const zCredentialIssuerMetadataWithDraftVersion = z.union([zCredentialIssuerMetadataDraft14Draft15Draft16.transform((credentialIssuerMetadata) => {
+	const credentialConfigurations = Object.values(credentialIssuerMetadata.credential_configurations_supported);
+	const isDraft15 = credentialConfigurations.some((configuration) => {
+		const knownConfiguration = configuration;
+		if (knownConfiguration.format === zSdJwtDcFormatIdentifier.value) return true;
+		if (Array.isArray(knownConfiguration.claims)) return true;
+		if (Object.values(knownConfiguration.proof_types_supported ?? {}).some((proofType) => proofType.key_attestations_required !== void 0)) return true;
+		return false;
+	});
+	return {
+		credentialIssuerMetadata,
+		originalDraftVersion: credentialConfigurations.some((configuration) => {
+			return configuration.credential_metadata;
+		}) ? Openid4vciDraftVersion.Draft16 : isDraft15 ? Openid4vciDraftVersion.Draft15 : Openid4vciDraftVersion.Draft14
+	};
+}), zCredentialIssuerMetadataDraft11To16.transform((credentialIssuerMetadata) => ({
+	credentialIssuerMetadata,
+	originalDraftVersion: Openid4vciDraftVersion.Draft11
+}))]);
 
-// src/metadata/credential-issuer/credential-issuer-metadata.ts
-var wellKnownCredentialIssuerSuffix = ".well-known/openid-credential-issuer";
+//#endregion
+//#region src/metadata/credential-issuer/credential-issuer-metadata.ts
+const wellKnownCredentialIssuerSuffix = ".well-known/openid-credential-issuer";
+/**
+* @inheritdoc {@link fetchWellKnownMetadata}
+*/
 async function fetchCredentialIssuerMetadata(credentialIssuer, fetch) {
-  const wellKnownMetadataUrl = joinUriParts(credentialIssuer, [wellKnownCredentialIssuerSuffix]);
-  const result = await fetchWellKnownMetadata(wellKnownMetadataUrl, zCredentialIssuerMetadataWithDraftVersion, fetch);
-  if (result && result.credentialIssuerMetadata.credential_issuer !== credentialIssuer) {
-    throw new Oauth2Error2(
-      `The 'credential_issuer' parameter '${result.credentialIssuerMetadata.credential_issuer}' in the well known credential issuer metadata at '${wellKnownMetadataUrl}' does not match the provided credential issuer '${credentialIssuer}'.`
-    );
-  }
-  return result;
+	const wellKnownMetadataUrl = joinUriParts(credentialIssuer, [wellKnownCredentialIssuerSuffix]);
+	const result = await fetchWellKnownMetadata(wellKnownMetadataUrl, zCredentialIssuerMetadataWithDraftVersion, fetch);
+	if (result && result.credentialIssuerMetadata.credential_issuer !== credentialIssuer) throw new Oauth2Error(`The 'credential_issuer' parameter '${result.credentialIssuerMetadata.credential_issuer}' in the well known credential issuer metadata at '${wellKnownMetadataUrl}' does not match the provided credential issuer '${credentialIssuer}'.`);
+	return result;
 }
+/**
+* Extract credential configuration supported entries where the `format` is known to this
+* library. Should be ran only after verifying the credential issuer metadata structure, so
+* we can be certain that if the `format` matches the other format specific requirements are also met.
+*
+* Validation is done when resolving issuer metadata, or when calling `createIssuerMetadata`.
+*/
 function extractKnownCredentialConfigurationSupportedFormats(credentialConfigurationsSupported) {
-  return Object.fromEntries(
-    Object.entries(credentialConfigurationsSupported).filter(
-      (entry) => allCredentialIssuerMetadataFormatIdentifiers.includes(entry[1].format)
-    )
-  );
+	return Object.fromEntries(Object.entries(credentialConfigurationsSupported).filter((entry) => allCredentialIssuerMetadataFormatIdentifiers.includes(entry[1].format)));
 }
 function getCredentialConfigurationSupportedById(credentialConfigurations, credentialConfigurationId) {
-  const configuration = credentialConfigurations[credentialConfigurationId];
-  if (!configuration) {
-    throw new Oauth2Error2(
-      `Credential configuration with id '${credentialConfigurationId}' not found in credential configurations supported.`
-    );
-  }
-  return configuration;
+	const configuration = credentialConfigurations[credentialConfigurationId];
+	if (!configuration) throw new Oauth2Error(`Credential configuration with id '${credentialConfigurationId}' not found in credential configurations supported.`);
+	return configuration;
 }
 
-// src/credential-request/credential-request-configurations.ts
-function getCredentialConfigurationsMatchingRequestFormat({
-  requestFormat,
-  credentialConfigurations
-}) {
-  const knownCredentialConfigurations = extractKnownCredentialConfigurationSupportedFormats(credentialConfigurations);
-  return Object.fromEntries(
-    Object.entries(knownCredentialConfigurations).filter(([, credentialConfiguration]) => {
-      if (credentialConfiguration.format !== requestFormat.format) return false;
-      const r = requestFormat;
-      const c = credentialConfiguration;
-      if ((c.format === "ldp_vc" || c.format === "jwt_vc_json-ld") && r.format === c.format) {
-        return arrayEqualsIgnoreOrder(r.credential_definition.type, c.credential_definition.type) && arrayEqualsIgnoreOrder(r.credential_definition["@context"], c.credential_definition["@context"]);
-      }
-      if (c.format === "jwt_vc_json" && r.format === c.format) {
-        return arrayEqualsIgnoreOrder(r.credential_definition.type, c.credential_definition.type);
-      }
-      if (c.format === "vc+sd-jwt" && r.format === c.format) {
-        if (r.vct && c.vct) {
-          return r.vct === c.vct;
-        }
-        if (c.credential_definition && r.credential_definition) {
-          return arrayEqualsIgnoreOrder(r.credential_definition.type, c.credential_definition.type);
-        }
-      }
-      if (c.format === "mso_mdoc" && r.format === c.format) {
-        return r.doctype === c.doctype;
-      }
-      return false;
-    })
-  );
+//#endregion
+//#region src/credential-request/credential-request-configurations.ts
+function getCredentialConfigurationsMatchingRequestFormat({ requestFormat, credentialConfigurations }) {
+	const knownCredentialConfigurations = extractKnownCredentialConfigurationSupportedFormats(credentialConfigurations);
+	return Object.fromEntries(Object.entries(knownCredentialConfigurations).filter(([, credentialConfiguration]) => {
+		if (credentialConfiguration.format !== requestFormat.format) return false;
+		const r = requestFormat;
+		const c = credentialConfiguration;
+		if ((c.format === "ldp_vc" || c.format === "jwt_vc_json-ld") && r.format === c.format) return arrayEqualsIgnoreOrder(r.credential_definition.type, c.credential_definition.type) && arrayEqualsIgnoreOrder(r.credential_definition["@context"], c.credential_definition["@context"]);
+		if (c.format === "jwt_vc_json" && r.format === c.format) return arrayEqualsIgnoreOrder(r.credential_definition.type, c.credential_definition.type);
+		if (c.format === "vc+sd-jwt" && r.format === c.format) {
+			if (r.vct && c.vct) return r.vct === c.vct;
+			if (c.credential_definition && r.credential_definition) return arrayEqualsIgnoreOrder(r.credential_definition.type, c.credential_definition.type);
+		}
+		if (c.format === "mso_mdoc" && r.format === c.format) return r.doctype === c.doctype;
+		return false;
+	}));
 }
 
-// src/error/Openid4vciError.ts
+//#endregion
+//#region src/error/Openid4vciError.ts
 var Openid4vciError = class extends Error {
-  constructor(message, options) {
-    const errorMessage = message ?? "Unknown error occured.";
-    const causeMessage = options?.cause instanceof Error ? ` ${options.cause.message}` : options?.cause ? ` ${options?.cause}` : "";
-    super(`${errorMessage}${causeMessage}`);
-    this.cause = options?.cause;
-  }
+	constructor(message, options) {
+		const errorMessage = message ?? "Unknown error occured.";
+		const causeMessage = options?.cause instanceof Error ? ` ${options.cause.message}` : options?.cause ? ` ${options?.cause}` : "";
+		super(`${errorMessage}${causeMessage}`);
+		this.cause = options?.cause;
+	}
 };
 
-// src/error/Openid4vciRetrieveCredentialsError.ts
-import { formatZodError } from "@openid4vc/utils";
+//#endregion
+//#region src/error/Openid4vciRetrieveCredentialsError.ts
 var Openid4vciRetrieveCredentialsError = class extends Openid4vciError {
-  constructor(message, response, responseText) {
-    const errorData = response.credentialResponseResult?.data ?? response.credentialErrorResponseResult?.data ?? (response.credentialResponseResult?.error ? formatZodError(response.credentialResponseResult.error) : void 0) ?? responseText;
-    super(`${message}
-${JSON.stringify(errorData, null, 2)}`);
-    this.response = response;
-  }
+	constructor(message, response, responseText) {
+		const errorData = response.credentialResponseResult?.data ?? response.credentialErrorResponseResult?.data ?? (response.credentialResponseResult?.error ? formatZodError(response.credentialResponseResult.error) : void 0) ?? responseText;
+		super(`${message}\n${JSON.stringify(errorData, null, 2)}`);
+		this.response = response;
+	}
 };
 
-// src/error/Openid4vciSendNotificationError.ts
+//#endregion
+//#region src/error/Openid4vciSendNotificationError.ts
 var Openid4vciSendNotificationError = class extends Openid4vciError {
-  constructor(message, response) {
-    super(message);
-    this.response = response;
-  }
+	constructor(message, response) {
+		super(message);
+		this.response = response;
+	}
 };
 
-// src/key-attestation/key-attestation.ts
-import { decodeJwt, jwtHeaderFromJwtSigner } from "@openid4vc/oauth2";
-import { jwtSignerFromJwt, verifyJwt } from "@openid4vc/oauth2";
-import { dateToSeconds, parseWithErrorHandling as parseWithErrorHandling2 } from "@openid4vc/utils";
+//#endregion
+//#region src/key-attestation/key-attestation.ts
 async function createKeyAttestationJwt(options) {
-  const header = parseWithErrorHandling2(zKeyAttestationJwtHeader, {
-    ...jwtHeaderFromJwtSigner(options.signer),
-    typ: "keyattestation+jwt"
-  });
-  const payload = parseWithErrorHandling2(zKeyAttestationJwtPayloadForUse(options.use), {
-    iat: dateToSeconds(options.issuedAt),
-    exp: options.expiresAt ? dateToSeconds(options.expiresAt) : void 0,
-    nonce: options.nonce,
-    attested_keys: options.attestedKeys,
-    user_authentication: options.userAuthentication,
-    key_storage: options.keyStorage,
-    certification: options.certification,
-    ...options.additionalPayload
-  });
-  const { jwt } = await options.callbacks.signJwt(options.signer, { header, payload });
-  return jwt;
+	const header = parseWithErrorHandling(zKeyAttestationJwtHeader, {
+		...jwtHeaderFromJwtSigner(options.signer),
+		typ: "keyattestation+jwt"
+	});
+	const payload = parseWithErrorHandling(zKeyAttestationJwtPayloadForUse(options.use), {
+		iat: dateToSeconds(options.issuedAt),
+		exp: options.expiresAt ? dateToSeconds(options.expiresAt) : void 0,
+		nonce: options.nonce,
+		attested_keys: options.attestedKeys,
+		user_authentication: options.userAuthentication,
+		key_storage: options.keyStorage,
+		certification: options.certification,
+		...options.additionalPayload
+	});
+	const { jwt } = await options.callbacks.signJwt(options.signer, {
+		header,
+		payload
+	});
+	return jwt;
 }
 function parseKeyAttestationJwt({ keyAttestationJwt, use }) {
-  return decodeJwt({
-    jwt: keyAttestationJwt,
-    headerSchema: zKeyAttestationJwtHeader,
-    payloadSchema: zKeyAttestationJwtPayloadForUse(use)
-  });
+	return decodeJwt({
+		jwt: keyAttestationJwt,
+		headerSchema: zKeyAttestationJwtHeader,
+		payloadSchema: zKeyAttestationJwtPayloadForUse(use)
+	});
 }
 async function verifyKeyAttestationJwt(options) {
-  const { header, payload } = parseKeyAttestationJwt({ keyAttestationJwt: options.keyAttestationJwt, use: options.use });
-  const now = options.now?.getTime() ?? Date.now();
-  if (options.nonceExpiresAt && now > options.nonceExpiresAt.getTime()) {
-    throw new Openid4vciError("Nonce used for key attestation jwt expired");
-  }
-  const { signer } = await verifyJwt({
-    compact: options.keyAttestationJwt,
-    header,
-    payload,
-    signer: jwtSignerFromJwt({ header, payload }),
-    verifyJwtCallback: options.callbacks.verifyJwt,
-    errorMessage: "Error verifiying key attestation jwt",
-    expectedNonce: options.expectedNonce,
-    now: options.now
-  });
-  return {
-    header,
-    payload,
-    signer
-  };
+	const { header, payload } = parseKeyAttestationJwt({
+		keyAttestationJwt: options.keyAttestationJwt,
+		use: options.use
+	});
+	const now = options.now?.getTime() ?? Date.now();
+	if (options.nonceExpiresAt && now > options.nonceExpiresAt.getTime()) throw new Openid4vciError("Nonce used for key attestation jwt expired");
+	const { signer } = await verifyJwt({
+		compact: options.keyAttestationJwt,
+		header,
+		payload,
+		signer: jwtSignerFromJwt({
+			header,
+			payload
+		}),
+		verifyJwtCallback: options.callbacks.verifyJwt,
+		errorMessage: "Error verifiying key attestation jwt",
+		expectedNonce: options.expectedNonce,
+		now: options.now
+	});
+	return {
+		header,
+		payload,
+		signer
+	};
 }
 
-// src/metadata/credential-issuer/credential-configurations.ts
-import { Oauth2Error as Oauth2Error3 } from "@openid4vc/oauth2";
-import { ValidationError as ValidationError2 } from "@openid4vc/utils";
+//#endregion
+//#region src/metadata/credential-issuer/credential-configurations.ts
 function extractScopesForCredentialConfigurationIds(options) {
-  const scopes = /* @__PURE__ */ new Set();
-  for (const credentialConfigurationId of options.credentialConfigurationIds) {
-    const credentialConfiguration = options.issuerMetadata.credentialIssuer.credential_configurations_supported[credentialConfigurationId];
-    if (!credentialConfiguration) {
-      throw new Oauth2Error3(
-        `Credential configuration with id '${credentialConfigurationId}' not found in metadata from credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}'`
-      );
-    }
-    const scope = credentialConfiguration.scope;
-    if (scope) scopes.add(scope);
-    else if (!scope && options.throwOnConfigurationWithoutScope) {
-      throw new Oauth2Error3(
-        `Credential configuration with id '${credentialConfigurationId}' does not have a 'scope' configured, and 'throwOnConfigurationWithoutScope' was enabled.`
-      );
-    }
-  }
-  return scopes.size > 0 ? Array.from(scopes) : void 0;
+	const scopes = /* @__PURE__ */ new Set();
+	for (const credentialConfigurationId of options.credentialConfigurationIds) {
+		const credentialConfiguration = options.issuerMetadata.credentialIssuer.credential_configurations_supported[credentialConfigurationId];
+		if (!credentialConfiguration) throw new Oauth2Error(`Credential configuration with id '${credentialConfigurationId}' not found in metadata from credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}'`);
+		const scope = credentialConfiguration.scope;
+		if (scope) scopes.add(scope);
+		else if (!scope && options.throwOnConfigurationWithoutScope) throw new Oauth2Error(`Credential configuration with id '${credentialConfigurationId}' does not have a 'scope' configured, and 'throwOnConfigurationWithoutScope' was enabled.`);
+	}
+	return scopes.size > 0 ? Array.from(scopes) : void 0;
 }
+/**
+* Transforms draft 11 credentials supported syntax to credential configurations supported
+*
+* @throws if a credentials supported entry without id is passed
+* @throws if a credentials supported entry with invalid structure or format specific properties is passed
+*/
 function credentialsSupportedToCredentialConfigurationsSupported(credentialsSupported) {
-  const credentialConfigurationsSupported = {};
-  for (let index = 0; index < credentialsSupported.length; index++) {
-    const credentialSupported = credentialsSupported[index];
-    if (!credentialSupported.id) {
-      throw new Openid4vciError(
-        `Credential supported at index '${index}' does not have an 'id' property. Credential configuration requires the 'id' property as key`
-      );
-    }
-    const parseResult = zCredentialConfigurationSupportedDraft11To16.safeParse(credentialSupported);
-    if (!parseResult.success) {
-      throw new ValidationError2(
-        `Error transforming credential supported with id '${credentialSupported.id}' to credential configuration supported format`,
-        parseResult.error
-      );
-    }
-    credentialConfigurationsSupported[credentialSupported.id] = parseResult.data;
-  }
-  return credentialConfigurationsSupported;
+	const credentialConfigurationsSupported = {};
+	for (let index = 0; index < credentialsSupported.length; index++) {
+		const credentialSupported = credentialsSupported[index];
+		if (!credentialSupported.id) throw new Openid4vciError(`Credential supported at index '${index}' does not have an 'id' property. Credential configuration requires the 'id' property as key`);
+		const parseResult = zCredentialConfigurationSupportedDraft11To16.safeParse(credentialSupported);
+		if (!parseResult.success) throw new ValidationError(`Error transforming credential supported with id '${credentialSupported.id}' to credential configuration supported format`, parseResult.error);
+		credentialConfigurationsSupported[credentialSupported.id] = parseResult.data;
+	}
+	return credentialConfigurationsSupported;
 }
 
-// src/Openid4vciClient.ts
-import {
-  Oauth2Client,
-  Oauth2ClientAuthorizationChallengeError,
-  Oauth2Error as Oauth2Error7,
-  Oauth2ErrorCodes as Oauth2ErrorCodes2,
-  authorizationCodeGrantIdentifier as authorizationCodeGrantIdentifier2,
-  getAuthorizationServerMetadataFromList as getAuthorizationServerMetadataFromList2,
-  preAuthorizedCodeGrantIdentifier as preAuthorizedCodeGrantIdentifier3
-} from "@openid4vc/oauth2";
-
-// src/credential-request/format-payload.ts
-import { zIs } from "@openid4vc/utils";
+//#endregion
+//#region src/credential-request/format-payload.ts
 function getCredentialRequestFormatPayloadForCredentialConfigurationId(options) {
-  const credentialConfiguration = getCredentialConfigurationSupportedById(
-    options.issuerMetadata.credentialIssuer.credential_configurations_supported,
-    options.credentialConfigurationId
-  );
-  if (zIs(zLegacySdJwtVcCredentialIssuerMetadataDraft16, credentialConfiguration) || zIs(zLegacySdJwtVcCredentialIssuerMetadataDraft14, credentialConfiguration)) {
-    return {
-      format: credentialConfiguration.format,
-      vct: credentialConfiguration.vct
-    };
-  }
-  if (zIs(zMsoMdocCredentialIssuerMetadata, credentialConfiguration) || zIs(zMsoMdocCredentialIssuerMetadataDraft14, credentialConfiguration)) {
-    return {
-      format: credentialConfiguration.format,
-      doctype: credentialConfiguration.doctype
-    };
-  }
-  if (zIs(zLdpVcCredentialIssuerMetadata, credentialConfiguration) || zIs(zLdpVcCredentialIssuerMetadataDraft14, credentialConfiguration)) {
-    return {
-      format: credentialConfiguration.format,
-      credential_definition: {
-        "@context": credentialConfiguration.credential_definition["@context"],
-        type: credentialConfiguration.credential_definition.type
-      }
-    };
-  }
-  if (zIs(zJwtVcJsonLdCredentialIssuerMetadata, credentialConfiguration) || zIs(zJwtVcJsonLdCredentialIssuerMetadataDraft14, credentialConfiguration)) {
-    return {
-      format: credentialConfiguration.format,
-      credential_definition: {
-        "@context": credentialConfiguration.credential_definition["@context"],
-        type: credentialConfiguration.credential_definition.type
-      }
-    };
-  }
-  if (zIs(zJwtVcJsonCredentialIssuerMetadata, credentialConfiguration) || zIs(zJwtVcJsonCredentialIssuerMetadataDraft14, credentialConfiguration)) {
-    return {
-      format: credentialConfiguration.format,
-      credential_definition: {
-        type: credentialConfiguration.credential_definition.type
-      }
-    };
-  }
-  if (zIs(zSdJwtDcCredentialIssuerMetadata, credentialConfiguration)) {
-    throw new Openid4vciError(
-      `Credential configuration id '${options.credentialConfigurationId}' with format ${zLegacySdJwtVcFormatIdentifier.value} does not support credential request based on 'format'. Use 'credential_configuration_id' directly.`
-    );
-  }
-  if (zIs(zSdJwtW3VcCredentialIssuerMetadata, credentialConfiguration)) {
-    return {
-      format: credentialConfiguration.format,
-      credential_definition: {
-        type: credentialConfiguration.credential_definition.type
-      }
-    };
-  }
-  throw new Openid4vciError(
-    `Unknown format '${credentialConfiguration.format}' in credential configuration with id '${options.credentialConfigurationId}' for credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}'`
-  );
+	const credentialConfiguration = getCredentialConfigurationSupportedById(options.issuerMetadata.credentialIssuer.credential_configurations_supported, options.credentialConfigurationId);
+	if (zIs(zLegacySdJwtVcCredentialIssuerMetadataDraft16, credentialConfiguration) || zIs(zLegacySdJwtVcCredentialIssuerMetadataDraft14, credentialConfiguration)) return {
+		format: credentialConfiguration.format,
+		vct: credentialConfiguration.vct
+	};
+	if (zIs(zMsoMdocCredentialIssuerMetadata, credentialConfiguration) || zIs(zMsoMdocCredentialIssuerMetadataDraft14, credentialConfiguration)) return {
+		format: credentialConfiguration.format,
+		doctype: credentialConfiguration.doctype
+	};
+	if (zIs(zLdpVcCredentialIssuerMetadata, credentialConfiguration) || zIs(zLdpVcCredentialIssuerMetadataDraft14, credentialConfiguration)) return {
+		format: credentialConfiguration.format,
+		credential_definition: {
+			"@context": credentialConfiguration.credential_definition["@context"],
+			type: credentialConfiguration.credential_definition.type
+		}
+	};
+	if (zIs(zJwtVcJsonLdCredentialIssuerMetadata, credentialConfiguration) || zIs(zJwtVcJsonLdCredentialIssuerMetadataDraft14, credentialConfiguration)) return {
+		format: credentialConfiguration.format,
+		credential_definition: {
+			"@context": credentialConfiguration.credential_definition["@context"],
+			type: credentialConfiguration.credential_definition.type
+		}
+	};
+	if (zIs(zJwtVcJsonCredentialIssuerMetadata, credentialConfiguration) || zIs(zJwtVcJsonCredentialIssuerMetadataDraft14, credentialConfiguration)) return {
+		format: credentialConfiguration.format,
+		credential_definition: { type: credentialConfiguration.credential_definition.type }
+	};
+	if (zIs(zSdJwtDcCredentialIssuerMetadata, credentialConfiguration)) throw new Openid4vciError(`Credential configuration id '${options.credentialConfigurationId}' with format ${zLegacySdJwtVcFormatIdentifier.value} does not support credential request based on 'format'. Use 'credential_configuration_id' directly.`);
+	if (zIs(zSdJwtW3VcCredentialIssuerMetadata, credentialConfiguration)) return {
+		format: credentialConfiguration.format,
+		credential_definition: { type: credentialConfiguration.credential_definition.type }
+	};
+	throw new Openid4vciError(`Unknown format '${credentialConfiguration.format}' in credential configuration with id '${options.credentialConfigurationId}' for credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}'`);
 }
 
-// src/credential-request/retrieve-credentials.ts
-import {
-  Oauth2Error as Oauth2Error4,
-  resourceRequest
-} from "@openid4vc/oauth2";
-import { ContentType as ContentType2, isResponseContentType, parseWithErrorHandling as parseWithErrorHandling3 } from "@openid4vc/utils";
-
-// src/credential-request/z-credential-request.ts
-import { zJwk as zJwk3 } from "@openid4vc/oauth2";
-import z17 from "zod";
-
-// src/credential-request/z-credential-request-common.ts
-import { zJwk as zJwk2 } from "@openid4vc/oauth2";
-import z16 from "zod";
-
-// src/formats/proof-type/jwt/z-jwt-proof-type.ts
-import { zCompactJwt as zCompactJwt2, zJwtHeader as zJwtHeader2, zJwtPayload as zJwtPayload2 } from "@openid4vc/oauth2";
-import { zHttpsUrl as zHttpsUrl3, zInteger as zInteger2 } from "@openid4vc/utils";
-import z14 from "zod";
-var zJwtProofTypeIdentifier = z14.literal("jwt");
-var jwtProofTypeIdentifier = zJwtProofTypeIdentifier.value;
-var zCredentialRequestProofJwt = z14.object({
-  proof_type: zJwtProofTypeIdentifier,
-  jwt: zCompactJwt2
+//#endregion
+//#region src/formats/proof-type/attestation/z-attestation-proof-type.ts
+const zAttestationProofTypeIdentifier = z.literal("attestation");
+const attestationProofTypeIdentifier = zAttestationProofTypeIdentifier.value;
+const zCredentialRequestProofAttestation = z.object({
+	proof_type: zAttestationProofTypeIdentifier,
+	attestation: zCompactJwt
 });
-var zCredentialRequestJwtProofTypeHeader = zJwtHeader2.merge(
-  z14.object({
-    key_attestation: z14.optional(zCompactJwt2),
-    typ: z14.literal("openid4vci-proof+jwt")
-  })
-).passthrough().refine(({ kid, jwk }) => jwk === void 0 || kid === void 0, {
-  message: `Both 'jwk' and 'kid' are defined. Only one is allowed`
-}).refine(({ trust_chain, kid }) => !trust_chain || !kid, {
-  message: `When 'trust_chain' is provided, 'kid' is required`
-});
-var zCredentialRequestJwtProofTypePayload = z14.object({
-  ...zJwtPayload2.shape,
-  aud: zHttpsUrl3,
-  iat: zInteger2
-}).passthrough();
+const zCredentialRequestAttestationProofTypePayload = zKeyAttestationJwtPayloadForUse("proof_type.attestation");
 
-// src/formats/proof-type/attestation/z-attestation-proof-type.ts
-import { zCompactJwt as zCompactJwt3 } from "@openid4vc/oauth2";
-import z15 from "zod";
-var zAttestationProofTypeIdentifier = z15.literal("attestation");
-var attestationProofTypeIdentifier = zAttestationProofTypeIdentifier.value;
-var zCredentialRequestProofAttestation = z15.object({
-  proof_type: zAttestationProofTypeIdentifier,
-  attestation: zCompactJwt3
+//#endregion
+//#region src/formats/proof-type/jwt/z-jwt-proof-type.ts
+const zJwtProofTypeIdentifier = z.literal("jwt");
+const jwtProofTypeIdentifier = zJwtProofTypeIdentifier.value;
+const zCredentialRequestProofJwt = z.object({
+	proof_type: zJwtProofTypeIdentifier,
+	jwt: zCompactJwt
 });
-var zCredentialRequestAttestationProofTypePayload = zKeyAttestationJwtPayloadForUse("proof_type.attestation");
-
-// src/credential-request/z-credential-request-common.ts
-var zCredentialRequestProofCommon = z16.object({
-  proof_type: z16.string()
+const zCredentialRequestJwtProofTypeHeader = zJwtHeader.merge(z.object({
+	key_attestation: z.optional(zCompactJwt),
+	typ: z.literal("openid4vci-proof+jwt")
+})).passthrough().refine(({ kid, jwk }) => jwk === void 0 || kid === void 0, { message: `Both 'jwk' and 'kid' are defined. Only one is allowed` }).refine(({ trust_chain, kid }) => !trust_chain || !kid, { message: `When 'trust_chain' is provided, 'kid' is required` });
+const zCredentialRequestJwtProofTypePayload = z.object({
+	...zJwtPayload.shape,
+	aud: zHttpsUrl,
+	iat: zInteger
 }).passthrough();
-var allCredentialRequestProofs = [zCredentialRequestProofJwt, zCredentialRequestProofAttestation];
-var zCredentialRequestProof = z16.union([
-  zCredentialRequestProofCommon,
-  z16.discriminatedUnion("proof_type", allCredentialRequestProofs)
-]);
-var zCredentialRequestProofsCommon = z16.record(z16.string(), z16.array(z16.unknown()));
-var zCredentialRequestProofs = z16.object({
-  [zJwtProofTypeIdentifier.value]: z16.optional(z16.array(zCredentialRequestProofJwt.shape.jwt)),
-  [zAttestationProofTypeIdentifier.value]: z16.optional(z16.array(zCredentialRequestProofAttestation.shape.attestation))
-});
-var zCredentialRequestCommon = z16.object({
-  proof: zCredentialRequestProof.optional(),
-  proofs: z16.optional(
-    z16.intersection(zCredentialRequestProofsCommon, zCredentialRequestProofs).refine((proofs) => Object.values(proofs).length === 1, {
-      message: `The 'proofs' object in a credential request should contain exactly one attribute`
-    })
-  ),
-  credential_response_encryption: z16.object({
-    jwk: zJwk2,
-    alg: z16.string(),
-    enc: z16.string()
-  }).passthrough().optional()
-}).passthrough().refine(({ proof, proofs }) => !(proof !== void 0 && proofs !== void 0), {
-  message: `Both 'proof' and 'proofs' are defined. Only one is allowed`
+
+//#endregion
+//#region src/credential-request/z-credential-request-common.ts
+const zCredentialRequestProofCommon = z.object({ proof_type: z.string() }).passthrough();
+const allCredentialRequestProofs = [zCredentialRequestProofJwt, zCredentialRequestProofAttestation];
+const zCredentialRequestProof = z.union([zCredentialRequestProofCommon, z.discriminatedUnion("proof_type", allCredentialRequestProofs)]);
+const zCredentialRequestProofsCommon = z.record(z.string(), z.array(z.unknown()));
+const zCredentialRequestProofs = z.object({
+	[zJwtProofTypeIdentifier.value]: z.optional(z.array(zCredentialRequestProofJwt.shape.jwt)),
+	[zAttestationProofTypeIdentifier.value]: z.optional(z.array(zCredentialRequestProofAttestation.shape.attestation))
 });
+const zCredentialRequestCommon = z.object({
+	proof: zCredentialRequestProof.optional(),
+	proofs: z.optional(z.intersection(zCredentialRequestProofsCommon, zCredentialRequestProofs).refine((proofs) => Object.values(proofs).length === 1, { message: `The 'proofs' object in a credential request should contain exactly one attribute` })),
+	credential_response_encryption: z.object({
+		jwk: zJwk,
+		alg: z.string(),
+		enc: z.string()
+	}).passthrough().optional()
+}).passthrough().refine(({ proof, proofs }) => !(proof !== void 0 && proofs !== void 0), { message: `Both 'proof' and 'proofs' are defined. Only one is allowed` });
 
-// src/credential-request/z-credential-request.ts
-var allCredentialRequestFormats = [
-  zSdJwtW3VcCredentialRequestFormatDraft14,
-  zMsoMdocCredentialRequestFormatDraft14,
-  zLdpVcCredentialRequestFormatDraft14,
-  zJwtVcJsonLdCredentialRequestFormatDraft14,
-  zJwtVcJsonCredentialRequestFormatDraft14,
-  zLegacySdJwtVcCredentialRequestFormatDraft14
+//#endregion
+//#region src/credential-request/z-credential-request.ts
+const allCredentialRequestFormats = [
+	zSdJwtW3VcCredentialRequestFormatDraft14,
+	zMsoMdocCredentialRequestFormatDraft14,
+	zLdpVcCredentialRequestFormatDraft14,
+	zJwtVcJsonLdCredentialRequestFormatDraft14,
+	zJwtVcJsonCredentialRequestFormatDraft14,
+	zLegacySdJwtVcCredentialRequestFormatDraft14
 ];
-var allCredentialRequestFormatIdentifiers = allCredentialRequestFormats.map(
-  (format) => format.shape.format.value
-);
-var zCredentialRequestCredentialConfigurationId = z17.object({
-  credential_configuration_id: z17.string(),
-  format: z17.never({ message: "'format' cannot be defined when 'credential_configuration_id' is set." }).optional(),
-  credential_identifier: z17.never({ message: "'credential_identifier' cannot be defined when 'credential_configuration_id' is set." }).optional()
+const allCredentialRequestFormatIdentifiers = allCredentialRequestFormats.map((format) => format.shape.format.value);
+const zCredentialRequestCredentialConfigurationId = z.object({
+	credential_configuration_id: z.string(),
+	format: z.never({ message: "'format' cannot be defined when 'credential_configuration_id' is set." }).optional(),
+	credential_identifier: z.never({ message: "'credential_identifier' cannot be defined when 'credential_configuration_id' is set." }).optional()
 });
-var zAuthorizationDetailsCredentialRequest = z17.object({
-  credential_identifier: z17.string(),
-  credential_configuration_id: z17.never({ message: "'credential_configuration_id' cannot be defined when 'credential_identifier' is set." }).optional(),
-  // Cannot be present if credential identifier is present
-  format: z17.never({ message: "'format' cannot be defined when 'credential_identifier' is set." }).optional()
+const zAuthorizationDetailsCredentialRequest = z.object({
+	credential_identifier: z.string(),
+	credential_configuration_id: z.never({ message: "'credential_configuration_id' cannot be defined when 'credential_identifier' is set." }).optional(),
+	format: z.never({ message: "'format' cannot be defined when 'credential_identifier' is set." }).optional()
 });
-var zCredentialRequestFormat = z17.object({
-  format: z17.string(),
-  credential_identifier: z17.never({ message: "'credential_identifier' cannot be defined when 'format' is set." }).optional(),
-  credential_configuration_id: z17.never({ message: "'credential_configuration_id' cannot be defined when 'format' is set." }).optional()
+const zCredentialRequestFormat = z.object({
+	format: z.string(),
+	credential_identifier: z.never({ message: "'credential_identifier' cannot be defined when 'format' is set." }).optional(),
+	credential_configuration_id: z.never({ message: "'credential_configuration_id' cannot be defined when 'format' is set." }).optional()
 }).passthrough();
-var zCredentialRequestDraft14WithFormat = zCredentialRequestCommon.and(zCredentialRequestFormat).transform((data, ctx) => {
-  if (!allCredentialRequestFormatIdentifiers.includes(
-    data.format
-  ))
-    return data;
-  const result = z17.object({}).passthrough().and(z17.union(allCredentialRequestFormats)).safeParse(data);
-  if (result.success) {
-    return result.data;
-  }
-  for (const issue of result.error.issues) {
-    ctx.addIssue(issue);
-  }
-  return z17.NEVER;
+const zCredentialRequestDraft14WithFormat = zCredentialRequestCommon.and(zCredentialRequestFormat).transform((data, ctx) => {
+	if (!allCredentialRequestFormatIdentifiers.includes(data.format)) return data;
+	const result = z.object({}).passthrough().and(z.union(allCredentialRequestFormats)).safeParse(data);
+	if (result.success) return result.data;
+	for (const issue of result.error.issues) ctx.addIssue(issue);
+	return z.NEVER;
 });
-var zCredentialRequestDraft15 = z17.union([
-  zCredentialRequestCommon.and(zAuthorizationDetailsCredentialRequest),
-  zCredentialRequestCommon.and(zCredentialRequestCredentialConfigurationId)
-]);
-var zCredentialRequestDraft14 = z17.union([
-  zCredentialRequestDraft14WithFormat,
-  zCredentialRequestCommon.and(zAuthorizationDetailsCredentialRequest)
-]);
-var zCredentialRequestDraft11To14 = zCredentialRequestCommon.and(zCredentialRequestFormat).transform((data, ctx) => {
-  const formatSpecificTransformations = {
-    [zLdpVcFormatIdentifier.value]: zLdpVcCredentialRequestDraft11To14,
-    [zJwtVcJsonFormatIdentifier.value]: zJwtVcJsonCredentialRequestDraft11To14,
-    [zJwtVcJsonLdFormatIdentifier.value]: zJwtVcJsonLdCredentialRequestDraft11To14
-  };
-  if (!Object.keys(formatSpecificTransformations).includes(data.format)) return data;
-  const schema = formatSpecificTransformations[data.format];
-  const result = schema.safeParse(data);
-  if (result.success) return result.data;
-  for (const issue of result.error.issues) {
-    ctx.addIssue(issue);
-  }
-  return z17.NEVER;
+const zCredentialRequestDraft15 = z.union([zCredentialRequestCommon.and(zAuthorizationDetailsCredentialRequest), zCredentialRequestCommon.and(zCredentialRequestCredentialConfigurationId)]);
+const zCredentialRequestDraft14 = z.union([zCredentialRequestDraft14WithFormat, zCredentialRequestCommon.and(zAuthorizationDetailsCredentialRequest)]);
+const zCredentialRequestDraft11To14 = zCredentialRequestCommon.and(zCredentialRequestFormat).transform((data, ctx) => {
+	const formatSpecificTransformations = {
+		[zLdpVcFormatIdentifier.value]: zLdpVcCredentialRequestDraft11To14,
+		[zJwtVcJsonFormatIdentifier.value]: zJwtVcJsonCredentialRequestDraft11To14,
+		[zJwtVcJsonLdFormatIdentifier.value]: zJwtVcJsonLdCredentialRequestDraft11To14
+	};
+	if (!Object.keys(formatSpecificTransformations).includes(data.format)) return data;
+	const result = formatSpecificTransformations[data.format].safeParse(data);
+	if (result.success) return result.data;
+	for (const issue of result.error.issues) ctx.addIssue(issue);
+	return z.NEVER;
 }).pipe(zCredentialRequestDraft14);
-var zCredentialRequestDraft14To11 = zCredentialRequestDraft14.refine(
-  (data) => data.credential_identifier === void 0,
-  `'credential_identifier' is not supported in OpenID4VCI draft 11`
-).transform((data, ctx) => {
-  const formatSpecificTransformations = {
-    [zLdpVcFormatIdentifier.value]: zLdpVcCredentialRequestDraft14To11,
-    [zJwtVcJsonFormatIdentifier.value]: zJwtVcJsonCredentialRequestDraft14To11,
-    [zJwtVcJsonLdFormatIdentifier.value]: zJwtVcJsonLdCredentialRequestDraft14To11
-  };
-  if (!Object.keys(formatSpecificTransformations).includes(data.format)) return data;
-  const schema = formatSpecificTransformations[data.format];
-  const result = schema.safeParse(data);
-  if (result.success) return result.data;
-  for (const issue of result.error.issues) {
-    ctx.addIssue(issue);
-  }
-  return z17.NEVER;
+const zCredentialRequestDraft14To11 = zCredentialRequestDraft14.refine((data) => data.credential_identifier === void 0, `'credential_identifier' is not supported in OpenID4VCI draft 11`).transform((data, ctx) => {
+	const formatSpecificTransformations = {
+		[zLdpVcFormatIdentifier.value]: zLdpVcCredentialRequestDraft14To11,
+		[zJwtVcJsonFormatIdentifier.value]: zJwtVcJsonCredentialRequestDraft14To11,
+		[zJwtVcJsonLdFormatIdentifier.value]: zJwtVcJsonLdCredentialRequestDraft14To11
+	};
+	if (!Object.keys(formatSpecificTransformations).includes(data.format)) return data;
+	const result = formatSpecificTransformations[data.format].safeParse(data);
+	if (result.success) return result.data;
+	for (const issue of result.error.issues) ctx.addIssue(issue);
+	return z.NEVER;
 });
-var zCredentialRequest = z17.union([
-  zCredentialRequestDraft15,
-  zCredentialRequestDraft14,
-  zCredentialRequestDraft11To14
+const zCredentialRequest = z.union([
+	zCredentialRequestDraft15,
+	zCredentialRequestDraft14,
+	zCredentialRequestDraft11To14
 ]);
-var zDeferredCredentialRequest = z17.object({
-  transaction_id: z17.string().nonempty(),
-  credential_response_encryption: z17.object({
-    jwk: zJwk3,
-    alg: z17.string(),
-    enc: z17.string()
-  }).passthrough().optional()
+const zDeferredCredentialRequest = z.object({
+	transaction_id: z.string().nonempty(),
+	credential_response_encryption: z.object({
+		jwk: zJwk,
+		alg: z.string(),
+		enc: z.string()
+	}).passthrough().optional()
 });
 
-// src/credential-request/z-credential-response.ts
-import z19 from "zod";
-
-// ../oauth2/src/common/z-oauth2-error.ts
-import z18 from "zod";
-var Oauth2ErrorCodes = /* @__PURE__ */ ((Oauth2ErrorCodes4) => {
-  Oauth2ErrorCodes4["ServerError"] = "server_error";
-  Oauth2ErrorCodes4["InvalidTarget"] = "invalid_target";
-  Oauth2ErrorCodes4["InvalidRequest"] = "invalid_request";
-  Oauth2ErrorCodes4["InvalidToken"] = "invalid_token";
-  Oauth2ErrorCodes4["InsufficientScope"] = "insufficient_scope";
-  Oauth2ErrorCodes4["InvalidGrant"] = "invalid_grant";
-  Oauth2ErrorCodes4["InvalidClient"] = "invalid_client";
-  Oauth2ErrorCodes4["UnauthorizedClient"] = "unauthorized_client";
-  Oauth2ErrorCodes4["UnsupportedGrantType"] = "unsupported_grant_type";
-  Oauth2ErrorCodes4["InvalidScope"] = "invalid_scope";
-  Oauth2ErrorCodes4["InvalidDpopProof"] = "invalid_dpop_proof";
-  Oauth2ErrorCodes4["UseDpopNonce"] = "use_dpop_nonce";
-  Oauth2ErrorCodes4["RedirectToWeb"] = "redirect_to_web";
-  Oauth2ErrorCodes4["InvalidSession"] = "invalid_session";
-  Oauth2ErrorCodes4["InsufficientAuthorization"] = "insufficient_authorization";
-  Oauth2ErrorCodes4["InvalidCredentialRequest"] = "invalid_credential_request";
-  Oauth2ErrorCodes4["CredentialRequestDenied"] = "credential_request_denied";
-  Oauth2ErrorCodes4["InvalidProof"] = "invalid_proof";
-  Oauth2ErrorCodes4["InvalidNonce"] = "invalid_nonce";
-  Oauth2ErrorCodes4["InvalidEncryptionParameters"] = "invalid_encryption_parameters";
-  Oauth2ErrorCodes4["UnknownCredentialConfiguration"] = "unknown_credential_configuration";
-  Oauth2ErrorCodes4["UnknownCredentialIdentifier"] = "unknown_credential_identifier";
-  Oauth2ErrorCodes4["InvalidTransactionId"] = "invalid_transaction_id";
-  Oauth2ErrorCodes4["UnsupportedCredentialType"] = "unsupported_credential_type";
-  Oauth2ErrorCodes4["UnsupportedCredentialFormat"] = "unsupported_credential_format";
-  Oauth2ErrorCodes4["InvalidRequestUri"] = "invalid_request_uri";
-  Oauth2ErrorCodes4["InvalidRequestObject"] = "invalid_request_object";
-  Oauth2ErrorCodes4["RequestNotSupported"] = "request_not_supported";
-  Oauth2ErrorCodes4["RequestUriNotSupported"] = "request_uri_not_supported";
-  Oauth2ErrorCodes4["VpFormatsNotSupported"] = "vp_formats_not_supported";
-  Oauth2ErrorCodes4["AccessDenied"] = "access_denied";
-  Oauth2ErrorCodes4["InvalidPresentationDefinitionUri"] = "invalid_presentation_definition_uri";
-  Oauth2ErrorCodes4["InvalidPresentationDefinitionReference"] = "invalid_presentation_definition_reference";
-  Oauth2ErrorCodes4["InvalidRequestUriMethod"] = "invalid_request_uri_method";
-  Oauth2ErrorCodes4["InvalidTransactionData"] = "invalid_transaction_data";
-  Oauth2ErrorCodes4["WalletUnavailable"] = "wallet_unavailable";
-  return Oauth2ErrorCodes4;
-})(Oauth2ErrorCodes || {});
-var zOauth2ErrorResponse = z18.object({
-  error: z18.union([z18.nativeEnum(Oauth2ErrorCodes), z18.string()]),
-  error_description: z18.string().optional(),
-  error_uri: z18.string().optional()
+//#endregion
+//#region ../oauth2/src/common/z-oauth2-error.ts
+let Oauth2ErrorCodes$1 = /* @__PURE__ */ function(Oauth2ErrorCodes$2) {
+	Oauth2ErrorCodes$2["ServerError"] = "server_error";
+	Oauth2ErrorCodes$2["InvalidTarget"] = "invalid_target";
+	Oauth2ErrorCodes$2["InvalidRequest"] = "invalid_request";
+	Oauth2ErrorCodes$2["InvalidToken"] = "invalid_token";
+	Oauth2ErrorCodes$2["InsufficientScope"] = "insufficient_scope";
+	Oauth2ErrorCodes$2["InvalidGrant"] = "invalid_grant";
+	Oauth2ErrorCodes$2["InvalidClient"] = "invalid_client";
+	Oauth2ErrorCodes$2["UnauthorizedClient"] = "unauthorized_client";
+	Oauth2ErrorCodes$2["UnsupportedGrantType"] = "unsupported_grant_type";
+	Oauth2ErrorCodes$2["InvalidScope"] = "invalid_scope";
+	Oauth2ErrorCodes$2["InvalidDpopProof"] = "invalid_dpop_proof";
+	Oauth2ErrorCodes$2["UseDpopNonce"] = "use_dpop_nonce";
+	Oauth2ErrorCodes$2["RedirectToWeb"] = "redirect_to_web";
+	Oauth2ErrorCodes$2["InvalidSession"] = "invalid_session";
+	Oauth2ErrorCodes$2["InsufficientAuthorization"] = "insufficient_authorization";
+	Oauth2ErrorCodes$2["InvalidCredentialRequest"] = "invalid_credential_request";
+	Oauth2ErrorCodes$2["CredentialRequestDenied"] = "credential_request_denied";
+	Oauth2ErrorCodes$2["InvalidProof"] = "invalid_proof";
+	Oauth2ErrorCodes$2["InvalidNonce"] = "invalid_nonce";
+	Oauth2ErrorCodes$2["InvalidEncryptionParameters"] = "invalid_encryption_parameters";
+	Oauth2ErrorCodes$2["UnknownCredentialConfiguration"] = "unknown_credential_configuration";
+	Oauth2ErrorCodes$2["UnknownCredentialIdentifier"] = "unknown_credential_identifier";
+	Oauth2ErrorCodes$2["InvalidTransactionId"] = "invalid_transaction_id";
+	Oauth2ErrorCodes$2["UnsupportedCredentialType"] = "unsupported_credential_type";
+	Oauth2ErrorCodes$2["UnsupportedCredentialFormat"] = "unsupported_credential_format";
+	Oauth2ErrorCodes$2["InvalidRequestUri"] = "invalid_request_uri";
+	Oauth2ErrorCodes$2["InvalidRequestObject"] = "invalid_request_object";
+	Oauth2ErrorCodes$2["RequestNotSupported"] = "request_not_supported";
+	Oauth2ErrorCodes$2["RequestUriNotSupported"] = "request_uri_not_supported";
+	Oauth2ErrorCodes$2["VpFormatsNotSupported"] = "vp_formats_not_supported";
+	Oauth2ErrorCodes$2["AccessDenied"] = "access_denied";
+	Oauth2ErrorCodes$2["InvalidPresentationDefinitionUri"] = "invalid_presentation_definition_uri";
+	Oauth2ErrorCodes$2["InvalidPresentationDefinitionReference"] = "invalid_presentation_definition_reference";
+	Oauth2ErrorCodes$2["InvalidRequestUriMethod"] = "invalid_request_uri_method";
+	Oauth2ErrorCodes$2["InvalidTransactionData"] = "invalid_transaction_data";
+	Oauth2ErrorCodes$2["WalletUnavailable"] = "wallet_unavailable";
+	return Oauth2ErrorCodes$2;
+}({});
+const zOauth2ErrorResponse = z.object({
+	error: z.union([z.nativeEnum(Oauth2ErrorCodes$1), z.string()]),
+	error_description: z.string().optional(),
+	error_uri: z.string().optional()
 }).passthrough();
 
-// src/credential-request/z-credential-response.ts
-var zCredentialEncoding = z19.union([z19.string(), z19.record(z19.string(), z19.any())]);
-var zBaseCredentialResponse = z19.object({
-  credentials: z19.union([
-    // Draft >= 15
-    z19.array(z19.object({ credential: zCredentialEncoding })),
-    // Draft < 15
-    z19.array(zCredentialEncoding)
-  ]).optional(),
-  interval: z19.number().int().positive().optional(),
-  notification_id: z19.string().optional()
+//#endregion
+//#region src/credential-request/z-credential-response.ts
+const zCredentialEncoding = z.union([z.string(), z.record(z.string(), z.any())]);
+const zBaseCredentialResponse = z.object({
+	credentials: z.union([z.array(z.object({ credential: zCredentialEncoding })), z.array(zCredentialEncoding)]).optional(),
+	interval: z.number().int().positive().optional(),
+	notification_id: z.string().optional()
 }).passthrough();
-var zCredentialResponse = zBaseCredentialResponse.extend({
-  credential: z19.optional(zCredentialEncoding),
-  transaction_id: z19.string().optional(),
-  c_nonce: z19.string().optional(),
-  c_nonce_expires_in: z19.number().int().optional()
+const zCredentialResponse = zBaseCredentialResponse.extend({
+	credential: z.optional(zCredentialEncoding),
+	transaction_id: z.string().optional(),
+	c_nonce: z.string().optional(),
+	c_nonce_expires_in: z.number().int().optional()
 }).passthrough().superRefine((value, ctx) => {
-  const { credential, credentials, transaction_id, interval, notification_id } = value;
-  if ([credential, credentials, transaction_id].filter((i) => i !== void 0).length !== 1) {
-    ctx.addIssue({
-      code: z19.ZodIssueCode.custom,
-      message: `Exactly one of 'credential', 'credentials', or 'transaction_id' MUST be defined.`
-    });
-  }
-  if (transaction_id && !interval) {
-    ctx.addIssue({
-      code: z19.ZodIssueCode.custom,
-      message: `'interval' MUST be defined when 'transaction_id' is defined.`
-    });
-  }
-  if (notification_id && !(credentials || credential)) {
-    ctx.addIssue({
-      code: z19.ZodIssueCode.custom,
-      message: `'notification_id' MUST NOT be defined when 'credential' or 'credentials' are not defined.`
-    });
-  }
+	const { credential, credentials, transaction_id, interval, notification_id } = value;
+	if ([
+		credential,
+		credentials,
+		transaction_id
+	].filter((i) => i !== void 0).length !== 1) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		message: `Exactly one of 'credential', 'credentials', or 'transaction_id' MUST be defined.`
+	});
+	if (transaction_id && !interval) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		message: `'interval' MUST be defined when 'transaction_id' is defined.`
+	});
+	if (notification_id && !(credentials || credential)) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		message: `'notification_id' MUST NOT be defined when 'credential' or 'credentials' are not defined.`
+	});
 });
-var zCredentialErrorResponse = z19.object({
-  ...zOauth2ErrorResponse.shape,
-  c_nonce: z19.string().optional(),
-  c_nonce_expires_in: z19.number().int().optional()
+const zCredentialErrorResponse = z.object({
+	...zOauth2ErrorResponse.shape,
+	c_nonce: z.string().optional(),
+	c_nonce_expires_in: z.number().int().optional()
 }).passthrough();
-var zDeferredCredentialResponse = zBaseCredentialResponse.refine(
-  (value) => {
-    const { credentials, interval } = value;
-    return [credentials, interval].filter((i) => i !== void 0).length === 1;
-  },
-  {
-    message: `Exactly one of 'credentials' or 'interval' MUST be defined.`
-  }
-);
+const zDeferredCredentialResponse = zBaseCredentialResponse.refine((value) => {
+	const { credentials, interval } = value;
+	return [credentials, interval].filter((i) => i !== void 0).length === 1;
+}, { message: `Exactly one of 'credentials' or 'interval' MUST be defined.` });
 
-// src/credential-request/retrieve-credentials.ts
+//#endregion
+//#region src/credential-request/retrieve-credentials.ts
 async function retrieveCredentialsWithCredentialConfigurationId(options) {
-  if (options.issuerMetadata.originalDraftVersion !== "Draft15" /* Draft15 */ && options.issuerMetadata.originalDraftVersion !== "Draft16" /* Draft16 */) {
-    throw new Openid4vciError(
-      "Requesting credentials based on credential configuration ID is not supported in OpenID4VCI below draft 15. Make sure to provide the format and format specific claims in the request."
-    );
-  }
-  getCredentialConfigurationSupportedById(
-    options.issuerMetadata.credentialIssuer.credential_configurations_supported,
-    options.credentialConfigurationId
-  );
-  const credentialRequest = {
-    ...options.additionalRequestPayload,
-    credential_configuration_id: options.credentialConfigurationId,
-    proof: options.proof,
-    proofs: options.proofs
-  };
-  return retrieveCredentials({
-    callbacks: options.callbacks,
-    credentialRequest,
-    issuerMetadata: options.issuerMetadata,
-    accessToken: options.accessToken,
-    dpop: options.dpop
-  });
+	if (options.issuerMetadata.originalDraftVersion !== Openid4vciDraftVersion.Draft15 && options.issuerMetadata.originalDraftVersion !== Openid4vciDraftVersion.Draft16) throw new Openid4vciError("Requesting credentials based on credential configuration ID is not supported in OpenID4VCI below draft 15. Make sure to provide the format and format specific claims in the request.");
+	getCredentialConfigurationSupportedById(options.issuerMetadata.credentialIssuer.credential_configurations_supported, options.credentialConfigurationId);
+	const credentialRequest = {
+		...options.additionalRequestPayload,
+		credential_configuration_id: options.credentialConfigurationId,
+		proof: options.proof,
+		proofs: options.proofs
+	};
+	return retrieveCredentials({
+		callbacks: options.callbacks,
+		credentialRequest,
+		issuerMetadata: options.issuerMetadata,
+		accessToken: options.accessToken,
+		dpop: options.dpop
+	});
 }
 async function retrieveCredentialsWithFormat(options) {
-  if (options.issuerMetadata.originalDraftVersion === "Draft15" /* Draft15 */ || options.issuerMetadata.originalDraftVersion === "Draft16" /* Draft16 */) {
-    throw new Openid4vciError(
-      "Requesting credentials based on format is not supported in OpenID4VCI draft 15. Provide the credential configuration id directly in the request."
-    );
-  }
-  const credentialRequest = {
-    ...options.formatPayload,
-    ...options.additionalRequestPayload,
-    proof: options.proof,
-    proofs: options.proofs
-  };
-  return retrieveCredentials({
-    callbacks: options.callbacks,
-    credentialRequest,
-    issuerMetadata: options.issuerMetadata,
-    accessToken: options.accessToken,
-    dpop: options.dpop
-  });
+	if (options.issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft15 || options.issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft16) throw new Openid4vciError("Requesting credentials based on format is not supported in OpenID4VCI draft 15. Provide the credential configuration id directly in the request.");
+	const credentialRequest = {
+		...options.formatPayload,
+		...options.additionalRequestPayload,
+		proof: options.proof,
+		proofs: options.proofs
+	};
+	return retrieveCredentials({
+		callbacks: options.callbacks,
+		credentialRequest,
+		issuerMetadata: options.issuerMetadata,
+		accessToken: options.accessToken,
+		dpop: options.dpop
+	});
 }
+/**
+* internal method
+*/
 async function retrieveCredentials(options) {
-  const credentialEndpoint = options.issuerMetadata.credentialIssuer.credential_endpoint;
-  let credentialRequest = parseWithErrorHandling3(
-    zCredentialRequest,
-    options.credentialRequest,
-    "Error validating credential request"
-  );
-  if (credentialRequest.proofs) {
-    const { batch_credential_issuance } = options.issuerMetadata.credentialIssuer;
-    if (options.issuerMetadata.originalDraftVersion === "Draft11" /* Draft11 */) {
-      throw new Oauth2Error4(
-        `Credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}' does not support batch credential issuance using the 'proofs' request property. Only 'proof' is supported.`
-      );
-    }
-    const proofs = Object.values(credentialRequest.proofs)[0];
-    if (proofs.length > (batch_credential_issuance?.batch_size ?? 1)) {
-      throw new Oauth2Error4(
-        `Credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}' supports batch issuance, but the max batch size is '${batch_credential_issuance?.batch_size ?? 1}'. A total of '${proofs.length}' proofs were provided.`
-      );
-    }
-  }
-  if (options.issuerMetadata.originalDraftVersion === "Draft11" /* Draft11 */) {
-    credentialRequest = parseWithErrorHandling3(
-      zCredentialRequestDraft14To11,
-      credentialRequest,
-      `Error transforming credential request from ${"Draft14" /* Draft14 */} to ${"Draft11" /* Draft11 */}`
-    );
-  }
-  const resourceResponse = await resourceRequest({
-    dpop: options.dpop,
-    accessToken: options.accessToken,
-    callbacks: options.callbacks,
-    url: credentialEndpoint,
-    requestOptions: {
-      method: "POST",
-      headers: {
-        "Content-Type": ContentType2.Json
-      },
-      body: JSON.stringify(credentialRequest)
-    }
-  });
-  if (!resourceResponse.ok) {
-    const credentialErrorResponseResult = isResponseContentType(ContentType2.Json, resourceResponse.response) ? zCredentialErrorResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
-    return {
-      ...resourceResponse,
-      credentialErrorResponseResult
-    };
-  }
-  const credentialResponseResult = isResponseContentType(ContentType2.Json, resourceResponse.response) ? zCredentialResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
-  if (!credentialResponseResult?.success) {
-    return {
-      ...resourceResponse,
-      ok: false,
-      credentialResponseResult
-    };
-  }
-  return {
-    ...resourceResponse,
-    credentialResponse: credentialResponseResult.data
-  };
+	const credentialEndpoint = options.issuerMetadata.credentialIssuer.credential_endpoint;
+	let credentialRequest = parseWithErrorHandling(zCredentialRequest, options.credentialRequest, "Error validating credential request");
+	if (credentialRequest.proofs) {
+		const { batch_credential_issuance } = options.issuerMetadata.credentialIssuer;
+		if (options.issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft11) throw new Oauth2Error(`Credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}' does not support batch credential issuance using the 'proofs' request property. Only 'proof' is supported.`);
+		const proofs = Object.values(credentialRequest.proofs)[0];
+		if (proofs.length > (batch_credential_issuance?.batch_size ?? 1)) throw new Oauth2Error(`Credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}' supports batch issuance, but the max batch size is '${batch_credential_issuance?.batch_size ?? 1}'. A total of '${proofs.length}' proofs were provided.`);
+	}
+	if (options.issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft11) credentialRequest = parseWithErrorHandling(zCredentialRequestDraft14To11, credentialRequest, `Error transforming credential request from ${Openid4vciDraftVersion.Draft14} to ${Openid4vciDraftVersion.Draft11}`);
+	const resourceResponse = await resourceRequest({
+		dpop: options.dpop,
+		accessToken: options.accessToken,
+		callbacks: options.callbacks,
+		url: credentialEndpoint,
+		requestOptions: {
+			method: "POST",
+			headers: { "Content-Type": ContentType.Json },
+			body: JSON.stringify(credentialRequest)
+		}
+	});
+	if (!resourceResponse.ok) {
+		const credentialErrorResponseResult = isResponseContentType(ContentType.Json, resourceResponse.response) ? zCredentialErrorResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
+		return {
+			...resourceResponse,
+			credentialErrorResponseResult
+		};
+	}
+	const credentialResponseResult = isResponseContentType(ContentType.Json, resourceResponse.response) ? zCredentialResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
+	if (!credentialResponseResult?.success) return {
+		...resourceResponse,
+		ok: false,
+		credentialResponseResult
+	};
+	return {
+		...resourceResponse,
+		credentialResponse: credentialResponseResult.data
+	};
 }
 async function retrieveDeferredCredentials(options) {
-  const credentialEndpoint = options.issuerMetadata.credentialIssuer.deferred_credential_endpoint;
-  if (!credentialEndpoint) {
-    throw new Openid4vciError(
-      `Credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}' does not support deferred credential retrieval.`
-    );
-  }
-  const deferredCredentialRequest = parseWithErrorHandling3(
-    zDeferredCredentialRequest,
-    {
-      transaction_id: options.transactionId,
-      ...options.additionalRequestPayload
-    },
-    "Error validating deferred credential request"
-  );
-  const resourceResponse = await resourceRequest({
-    dpop: options.dpop,
-    accessToken: options.accessToken,
-    callbacks: options.callbacks,
-    url: credentialEndpoint,
-    requestOptions: {
-      method: "POST",
-      headers: {
-        "Content-Type": ContentType2.Json
-      },
-      body: JSON.stringify(deferredCredentialRequest)
-    }
-  });
-  if (!resourceResponse.ok) {
-    const deferredCredentialErrorResponseResult = isResponseContentType(ContentType2.Json, resourceResponse.response) ? zCredentialErrorResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
-    return {
-      ...resourceResponse,
-      deferredCredentialErrorResponseResult
-    };
-  }
-  const deferredCredentialResponseResult = isResponseContentType(ContentType2.Json, resourceResponse.response) ? zDeferredCredentialResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
-  if (!deferredCredentialResponseResult?.success) {
-    return {
-      ...resourceResponse,
-      ok: false,
-      deferredCredentialResponseResult
-    };
-  }
-  return {
-    ...resourceResponse,
-    deferredCredentialResponse: deferredCredentialResponseResult.data
-  };
+	const credentialEndpoint = options.issuerMetadata.credentialIssuer.deferred_credential_endpoint;
+	if (!credentialEndpoint) throw new Openid4vciError(`Credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}' does not support deferred credential retrieval.`);
+	const deferredCredentialRequest = parseWithErrorHandling(zDeferredCredentialRequest, {
+		transaction_id: options.transactionId,
+		...options.additionalRequestPayload
+	}, "Error validating deferred credential request");
+	const resourceResponse = await resourceRequest({
+		dpop: options.dpop,
+		accessToken: options.accessToken,
+		callbacks: options.callbacks,
+		url: credentialEndpoint,
+		requestOptions: {
+			method: "POST",
+			headers: { "Content-Type": ContentType.Json },
+			body: JSON.stringify(deferredCredentialRequest)
+		}
+	});
+	if (!resourceResponse.ok) {
+		const deferredCredentialErrorResponseResult = isResponseContentType(ContentType.Json, resourceResponse.response) ? zCredentialErrorResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
+		return {
+			...resourceResponse,
+			deferredCredentialErrorResponseResult
+		};
+	}
+	const deferredCredentialResponseResult = isResponseContentType(ContentType.Json, resourceResponse.response) ? zDeferredCredentialResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
+	if (!deferredCredentialResponseResult?.success) return {
+		...resourceResponse,
+		ok: false,
+		deferredCredentialResponseResult
+	};
+	return {
+		...resourceResponse,
+		deferredCredentialResponse: deferredCredentialResponseResult.data
+	};
 }
 
-// src/formats/proof-type/jwt/jwt-proof-type.ts
-import { decodeJwt as decodeJwt2, isJwkInSet, jwtHeaderFromJwtSigner as jwtHeaderFromJwtSigner2 } from "@openid4vc/oauth2";
-import { jwtSignerFromJwt as jwtSignerFromJwt2, verifyJwt as verifyJwt2 } from "@openid4vc/oauth2";
-import { dateToSeconds as dateToSeconds2, parseWithErrorHandling as parseWithErrorHandling4 } from "@openid4vc/utils";
+//#endregion
+//#region src/formats/proof-type/jwt/jwt-proof-type.ts
 async function createCredentialRequestJwtProof(options) {
-  const header = parseWithErrorHandling4(zCredentialRequestJwtProofTypeHeader, {
-    ...jwtHeaderFromJwtSigner2(options.signer),
-    key_attestation: options.keyAttestationJwt,
-    typ: "openid4vci-proof+jwt"
-  });
-  const payload = parseWithErrorHandling4(zCredentialRequestJwtProofTypePayload, {
-    nonce: options.nonce,
-    aud: options.credentialIssuer,
-    iat: dateToSeconds2(options.issuedAt),
-    iss: options.clientId
-  });
-  const { jwt, signerJwk } = await options.callbacks.signJwt(options.signer, { header, payload });
-  if (options.keyAttestationJwt) {
-    const decodedKeyAttestation = decodeJwt2({
-      jwt: options.keyAttestationJwt,
-      headerSchema: zKeyAttestationJwtHeader,
-      payloadSchema: zKeyAttestationJwtPayload
-    });
-    const isSigedWithAttestedKey = await isJwkInSet({
-      jwk: signerJwk,
-      jwks: decodedKeyAttestation.payload.attested_keys,
-      callbacks: options.callbacks
-    });
-    if (!isSigedWithAttestedKey) {
-      throw new Openid4vciError(
-        `Credential request jwt proof is not signed with a key in the 'key_attestation' jwt payload 'attested_keys'`
-      );
-    }
-  }
-  return jwt;
+	const header = parseWithErrorHandling(zCredentialRequestJwtProofTypeHeader, {
+		...jwtHeaderFromJwtSigner(options.signer),
+		key_attestation: options.keyAttestationJwt,
+		typ: "openid4vci-proof+jwt"
+	});
+	const payload = parseWithErrorHandling(zCredentialRequestJwtProofTypePayload, {
+		nonce: options.nonce,
+		aud: options.credentialIssuer,
+		iat: dateToSeconds(options.issuedAt),
+		iss: options.clientId
+	});
+	const { jwt, signerJwk } = await options.callbacks.signJwt(options.signer, {
+		header,
+		payload
+	});
+	if (options.keyAttestationJwt) {
+		if (!await isJwkInSet({
+			jwk: signerJwk,
+			jwks: decodeJwt({
+				jwt: options.keyAttestationJwt,
+				headerSchema: zKeyAttestationJwtHeader,
+				payloadSchema: zKeyAttestationJwtPayload
+			}).payload.attested_keys,
+			callbacks: options.callbacks
+		})) throw new Openid4vciError(`Credential request jwt proof is not signed with a key in the 'key_attestation' jwt payload 'attested_keys'`);
+	}
+	return jwt;
 }
 async function verifyCredentialRequestJwtProof(options) {
-  const { header, payload } = decodeJwt2({
-    jwt: options.jwt,
-    headerSchema: zCredentialRequestJwtProofTypeHeader,
-    payloadSchema: zCredentialRequestJwtProofTypePayload
-  });
-  const now = options.now?.getTime() ?? Date.now();
-  if (options.nonceExpiresAt && now > options.nonceExpiresAt.getTime()) {
-    throw new Openid4vciError("Nonce used for credential request proof expired");
-  }
-  const { signer } = await verifyJwt2({
-    compact: options.jwt,
-    header,
-    payload,
-    signer: jwtSignerFromJwt2({ header, payload }),
-    verifyJwtCallback: options.callbacks.verifyJwt,
-    errorMessage: "Error verifiying credential request proof jwt.",
-    expectedNonce: options.expectedNonce,
-    expectedAudience: options.credentialIssuer,
-    expectedIssuer: options.clientId,
-    now: options.now
-  });
-  let keyAttestationResult = void 0;
-  if (header.key_attestation) {
-    keyAttestationResult = await verifyKeyAttestationJwt({
-      callbacks: options.callbacks,
-      keyAttestationJwt: header.key_attestation,
-      use: "proof_type.jwt"
-    });
-    const isSigedWithAttestedKey = await isJwkInSet({
-      jwk: signer.publicJwk,
-      jwks: keyAttestationResult.payload.attested_keys,
-      callbacks: options.callbacks
-    });
-    if (!isSigedWithAttestedKey) {
-      throw new Openid4vciError(
-        `Credential request jwt proof is not signed with a key in the 'key_attestation' jwt payload 'attested_keys'`
-      );
-    }
-  }
-  return {
-    header,
-    payload,
-    signer,
-    keyAttestation: keyAttestationResult
-  };
+	const { header, payload } = decodeJwt({
+		jwt: options.jwt,
+		headerSchema: zCredentialRequestJwtProofTypeHeader,
+		payloadSchema: zCredentialRequestJwtProofTypePayload
+	});
+	const now = options.now?.getTime() ?? Date.now();
+	if (options.nonceExpiresAt && now > options.nonceExpiresAt.getTime()) throw new Openid4vciError("Nonce used for credential request proof expired");
+	const { signer } = await verifyJwt({
+		compact: options.jwt,
+		header,
+		payload,
+		signer: jwtSignerFromJwt({
+			header,
+			payload
+		}),
+		verifyJwtCallback: options.callbacks.verifyJwt,
+		errorMessage: "Error verifiying credential request proof jwt.",
+		expectedNonce: options.expectedNonce,
+		expectedAudience: options.credentialIssuer,
+		expectedIssuer: options.clientId,
+		now: options.now
+	});
+	let keyAttestationResult;
+	if (header.key_attestation) {
+		keyAttestationResult = await verifyKeyAttestationJwt({
+			callbacks: options.callbacks,
+			keyAttestationJwt: header.key_attestation,
+			use: "proof_type.jwt"
+		});
+		if (!await isJwkInSet({
+			jwk: signer.publicJwk,
+			jwks: keyAttestationResult.payload.attested_keys,
+			callbacks: options.callbacks
+		})) throw new Openid4vciError(`Credential request jwt proof is not signed with a key in the 'key_attestation' jwt payload 'attested_keys'`);
+	}
+	return {
+		header,
+		payload,
+		signer,
+		keyAttestation: keyAttestationResult
+	};
 }
 
-// src/metadata/fetch-issuer-metadata.ts
-import {
-  Oauth2Error as Oauth2Error5,
-  fetchAuthorizationServerMetadata,
-  zAuthorizationServerMetadata
-} from "@openid4vc/oauth2";
-import { parseWithErrorHandling as parseWithErrorHandling5 } from "@openid4vc/utils";
+//#endregion
+//#region src/metadata/fetch-issuer-metadata.ts
 async function resolveIssuerMetadata(credentialIssuer, options) {
-  const allowAuthorizationMetadataFromCredentialIssuerMetadata = options?.allowAuthorizationMetadataFromCredentialIssuerMetadata ?? true;
-  const credentialIssuerMetadataWithDraftVersion = await fetchCredentialIssuerMetadata(credentialIssuer, options?.fetch);
-  if (!credentialIssuerMetadataWithDraftVersion) {
-    throw new Oauth2Error5(`Well known credential issuer metadata for issuer '${credentialIssuer}' not found.`);
-  }
-  const { credentialIssuerMetadata, originalDraftVersion } = credentialIssuerMetadataWithDraftVersion;
-  const authorizationServers = credentialIssuerMetadata.authorization_servers ?? [credentialIssuer];
-  const authoriationServersMetadata = [];
-  for (const authorizationServer of authorizationServers) {
-    if (options?.restrictToAuthorizationServers && !options.restrictToAuthorizationServers.includes(authorizationServer)) {
-      continue;
-    }
-    let authorizationServerMetadata = await fetchAuthorizationServerMetadata(authorizationServer, options?.fetch);
-    if (!authorizationServerMetadata && authorizationServer === credentialIssuer && allowAuthorizationMetadataFromCredentialIssuerMetadata) {
-      authorizationServerMetadata = parseWithErrorHandling5(
-        zAuthorizationServerMetadata,
-        {
-          token_endpoint: credentialIssuerMetadata.token_endpoint,
-          issuer: credentialIssuer
-        },
-        `Well known authorization server metadata for authorization server '${authorizationServer}' not found, and could also not extract required values from the credential issuer metadata as a fallback.`
-      );
-    }
-    if (!authorizationServerMetadata) {
-      throw new Oauth2Error5(
-        `Well known openid configuration or authorization server metadata for authorization server '${authorizationServer}' not found.`
-      );
-    }
-    authoriationServersMetadata.push(authorizationServerMetadata);
-  }
-  return {
-    originalDraftVersion,
-    credentialIssuer: credentialIssuerMetadata,
-    authorizationServers: authoriationServersMetadata
-  };
+	const allowAuthorizationMetadataFromCredentialIssuerMetadata = options?.allowAuthorizationMetadataFromCredentialIssuerMetadata ?? true;
+	const credentialIssuerMetadataWithDraftVersion = await fetchCredentialIssuerMetadata(credentialIssuer, options?.fetch);
+	if (!credentialIssuerMetadataWithDraftVersion) throw new Oauth2Error(`Well known credential issuer metadata for issuer '${credentialIssuer}' not found.`);
+	const { credentialIssuerMetadata, originalDraftVersion } = credentialIssuerMetadataWithDraftVersion;
+	const authorizationServers = credentialIssuerMetadata.authorization_servers ?? [credentialIssuer];
+	const authoriationServersMetadata = [];
+	for (const authorizationServer of authorizationServers) {
+		if (options?.restrictToAuthorizationServers && !options.restrictToAuthorizationServers.includes(authorizationServer)) continue;
+		let authorizationServerMetadata = await fetchAuthorizationServerMetadata(authorizationServer, options?.fetch);
+		if (!authorizationServerMetadata && authorizationServer === credentialIssuer && allowAuthorizationMetadataFromCredentialIssuerMetadata) authorizationServerMetadata = parseWithErrorHandling(zAuthorizationServerMetadata, {
+			token_endpoint: credentialIssuerMetadata.token_endpoint,
+			issuer: credentialIssuer
+		}, `Well known authorization server metadata for authorization server '${authorizationServer}' not found, and could also not extract required values from the credential issuer metadata as a fallback.`);
+		if (!authorizationServerMetadata) throw new Oauth2Error(`Well known openid configuration or authorization server metadata for authorization server '${authorizationServer}' not found.`);
+		authoriationServersMetadata.push(authorizationServerMetadata);
+	}
+	return {
+		originalDraftVersion,
+		credentialIssuer: credentialIssuerMetadata,
+		authorizationServers: authoriationServersMetadata
+	};
 }
 
-// src/nonce/nonce-request.ts
-import { InvalidFetchResponseError as InvalidFetchResponseError2 } from "@openid4vc/oauth2";
-import { ContentType as ContentType3, ValidationError as ValidationError3, createZodFetcher as createZodFetcher2, parseWithErrorHandling as parseWithErrorHandling6 } from "@openid4vc/utils";
-
-// src/nonce/z-nonce.ts
-import { zInteger as zInteger3 } from "@openid4vc/utils";
-import z20 from "zod";
-var zNonceResponse = z20.object({
-  c_nonce: z20.string(),
-  c_nonce_expires_in: z20.optional(zInteger3)
+//#endregion
+//#region src/nonce/z-nonce.ts
+const zNonceResponse = z.object({
+	c_nonce: z.string(),
+	c_nonce_expires_in: z.optional(zInteger)
 }).passthrough();
 
-// src/nonce/nonce-request.ts
+//#endregion
+//#region src/nonce/nonce-request.ts
+/**
+* Request a nonce from the `nonce_endpoint`
+*
+* @throws Openid4vciError - if no `nonce_endpoint` is configured in the issuer metadata
+* @throws InvalidFetchResponseError - if the nonce endpoint did not return a successful response
+* @throws ValidationError - if validating the nonce response failed
+*/
 async function requestNonce(options) {
-  const fetchWithZod = createZodFetcher2(options?.fetch);
-  const nonceEndpoint = options.issuerMetadata.credentialIssuer.nonce_endpoint;
-  if (!nonceEndpoint) {
-    throw new Openid4vciError(
-      `Credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}' does not have a nonce endpoint.`
-    );
-  }
-  const { response, result } = await fetchWithZod(zNonceResponse, ContentType3.Json, nonceEndpoint, {
-    method: "POST"
-  });
-  if (!response.ok || !result) {
-    throw new InvalidFetchResponseError2(
-      `Requesting nonce from '${nonceEndpoint}' resulted in an unsuccessful response with status '${response.status}'`,
-      await response.clone().text(),
-      response
-    );
-  }
-  if (!result.success) {
-    throw new ValidationError3("Error parsing nonce response", result.error);
-  }
-  return result.data;
+	const fetchWithZod = createZodFetcher(options?.fetch);
+	const nonceEndpoint = options.issuerMetadata.credentialIssuer.nonce_endpoint;
+	if (!nonceEndpoint) throw new Openid4vciError(`Credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}' does not have a nonce endpoint.`);
+	const { response, result } = await fetchWithZod(zNonceResponse, ContentType.Json, nonceEndpoint, { method: "POST" });
+	if (!response.ok || !result) throw new InvalidFetchResponseError(`Requesting nonce from '${nonceEndpoint}' resulted in an unsuccessful response with status '${response.status}'`, await response.clone().text(), response);
+	if (!result.success) throw new ValidationError("Error parsing nonce response", result.error);
+	return result.data;
 }
 function createNonceResponse(options) {
-  return parseWithErrorHandling6(zNonceResponse, {
-    c_nonce: options.cNonce,
-    c_nonce_expires_in: options.cNonceExpiresIn,
-    ...options.additionalPayload
-  });
+	return parseWithErrorHandling(zNonceResponse, {
+		c_nonce: options.cNonce,
+		c_nonce_expires_in: options.cNonceExpiresIn,
+		...options.additionalPayload
+	});
 }
 
-// src/notification/notification.ts
-import {
-  Oauth2Error as Oauth2Error6,
-  resourceRequest as resourceRequest2
-} from "@openid4vc/oauth2";
-import { ContentType as ContentType4, isResponseContentType as isResponseContentType2, parseWithErrorHandling as parseWithErrorHandling7 } from "@openid4vc/utils";
-
-// src/notification/z-notification.ts
-import z21 from "zod";
-var zNotificationEvent = z21.enum(["credential_accepted", "credential_failure", "credential_deleted"]);
-var zNotificationRequest = z21.object({
-  notification_id: z21.string(),
-  event: zNotificationEvent,
-  event_description: z21.optional(z21.string())
-}).passthrough();
-var zNotificationErrorResponse = z21.object({
-  error: z21.enum(["invalid_notification_id", "invalid_notification_request"])
+//#endregion
+//#region src/notification/z-notification.ts
+const zNotificationEvent = z.enum([
+	"credential_accepted",
+	"credential_failure",
+	"credential_deleted"
+]);
+const zNotificationRequest = z.object({
+	notification_id: z.string(),
+	event: zNotificationEvent,
+	event_description: z.optional(z.string())
 }).passthrough();
+const zNotificationErrorResponse = z.object({ error: z.enum(["invalid_notification_id", "invalid_notification_request"]) }).passthrough();
 
-// src/notification/notification.ts
+//#endregion
+//#region src/notification/notification.ts
 async function sendNotification(options) {
-  const notificationEndpoint = options.issuerMetadata.credentialIssuer.notification_endpoint;
-  if (!notificationEndpoint) {
-    throw new Oauth2Error6(
-      `Credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}' does not have a notification endpiont configured.`
-    );
-  }
-  const notificationRequest = parseWithErrorHandling7(
-    zNotificationRequest,
-    {
-      event: options.notification.event,
-      notification_id: options.notification.notificationId,
-      event_description: options.notification.eventDescription
-    },
-    "Error validating notification request"
-  );
-  const resourceResponse = await resourceRequest2({
-    dpop: options.dpop,
-    accessToken: options.accessToken,
-    callbacks: options.callbacks,
-    url: notificationEndpoint,
-    requestOptions: {
-      method: "POST",
-      headers: {
-        "Content-Type": ContentType4.Json
-      },
-      body: JSON.stringify(notificationRequest)
-    }
-  });
-  if (!resourceResponse.ok) {
-    const notificationErrorResponseResult = isResponseContentType2(ContentType4.Json, resourceResponse.response) ? zNotificationErrorResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
-    return {
-      ...resourceResponse,
-      notificationErrorResponseResult
-    };
-  }
-  return resourceResponse;
+	const notificationEndpoint = options.issuerMetadata.credentialIssuer.notification_endpoint;
+	if (!notificationEndpoint) throw new Oauth2Error(`Credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}' does not have a notification endpiont configured.`);
+	const notificationRequest = parseWithErrorHandling(zNotificationRequest, {
+		event: options.notification.event,
+		notification_id: options.notification.notificationId,
+		event_description: options.notification.eventDescription
+	}, "Error validating notification request");
+	const resourceResponse = await resourceRequest({
+		dpop: options.dpop,
+		accessToken: options.accessToken,
+		callbacks: options.callbacks,
+		url: notificationEndpoint,
+		requestOptions: {
+			method: "POST",
+			headers: { "Content-Type": ContentType.Json },
+			body: JSON.stringify(notificationRequest)
+		}
+	});
+	if (!resourceResponse.ok) {
+		const notificationErrorResponseResult = isResponseContentType(ContentType.Json, resourceResponse.response) ? zNotificationErrorResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
+		return {
+			...resourceResponse,
+			notificationErrorResponseResult
+		};
+	}
+	return resourceResponse;
 }
 
-// src/Openid4vciClient.ts
-var AuthorizationFlow = /* @__PURE__ */ ((AuthorizationFlow2) => {
-  AuthorizationFlow2["Oauth2Redirect"] = "Oauth2Redirect";
-  AuthorizationFlow2["PresentationDuringIssuance"] = "PresentationDuringIssuance";
-  return AuthorizationFlow2;
-})(AuthorizationFlow || {});
+//#endregion
+//#region src/Openid4vciClient.ts
+let AuthorizationFlow = /* @__PURE__ */ function(AuthorizationFlow$1) {
+	AuthorizationFlow$1["Oauth2Redirect"] = "Oauth2Redirect";
+	AuthorizationFlow$1["PresentationDuringIssuance"] = "PresentationDuringIssuance";
+	return AuthorizationFlow$1;
+}({});
 var Openid4vciClient = class {
-  constructor(options) {
-    this.options = options;
-    this.oauth2Client = new Oauth2Client({
-      callbacks: this.options.callbacks
-    });
-  }
-  getKnownCredentialConfigurationsSupported(credentialIssuerMetadata) {
-    return extractKnownCredentialConfigurationSupportedFormats(
-      credentialIssuerMetadata.credential_configurations_supported
-    );
-  }
-  /**
-   * Resolve a credential offer into a credential offer object, handling both
-   * 'credential_offer' and 'credential_offer_uri' params.
-   */
-  async resolveCredentialOffer(credentialOffer) {
-    return resolveCredentialOffer(credentialOffer, {
-      fetch: this.options.callbacks.fetch
-    });
-  }
-  async resolveIssuerMetadata(credentialIssuer) {
-    return resolveIssuerMetadata(credentialIssuer, {
-      fetch: this.options.callbacks.fetch
-    });
-  }
-  /**
-   * Retrieve an authorization code for a presentation during issuance session
-   *
-   * This can only be called if an authorization challenge was performed before and returned a
-   * `presentation` parameter along with an `auth_session`. If the presentation response included
-   * an `presentation_during_issuance_session` parameter it MUST be included in this request as well.
-   */
-  async retrieveAuthorizationCodeUsingPresentation(options) {
-    if (!options.credentialOffer.grants?.[authorizationCodeGrantIdentifier2]) {
-      throw new Oauth2Error7(`Provided credential offer does not include the 'authorization_code' grant.`);
-    }
-    const authorizationCodeGrant = options.credentialOffer.grants[authorizationCodeGrantIdentifier2];
-    const authorizationServer = determineAuthorizationServerForCredentialOffer({
-      issuerMetadata: options.issuerMetadata,
-      grantAuthorizationServer: authorizationCodeGrant.authorization_server
-    });
-    const authorizationServerMetadata = getAuthorizationServerMetadataFromList2(
-      options.issuerMetadata.authorizationServers,
-      authorizationServer
-    );
-    const oauth2Client = new Oauth2Client({ callbacks: this.options.callbacks });
-    const { authorizationChallengeResponse, dpop } = await oauth2Client.sendAuthorizationChallengeRequest({
-      authorizationServerMetadata,
-      authSession: options.authSession,
-      presentationDuringIssuanceSession: options.presentationDuringIssuanceSession,
-      dpop: options.dpop
-    });
-    return { authorizationChallengeResponse, dpop };
-  }
-  /**
-   * Initiates authorization for credential issuance. It handles the following cases:
-   * - Authorization Challenge
-   * - Pushed Authorization Request
-   * - Regular Authorization url
-   *
-   * In case the authorization challenge request returns an error with `insufficient_authorization`
-   * with a `presentation` field it means the authorization server expects presentation of credentials
-   * before issuance of credentials. If this is the case, the value in `presentation` should be treated
-   * as an openid4vp authorization request and submitted to the verifier. Once the presentation response
-   * has been submitted, the RP will respond with a `presentation_during_issuance_session` parameter.
-   * Together with the `auth_session` parameter returned in this call you can retrieve an `authorization_code`
-   * using
-   */
-  async initiateAuthorization(options) {
-    if (!options.credentialOffer.grants?.[authorizationCodeGrantIdentifier2]) {
-      throw new Oauth2Error7(`Provided credential offer does not include the 'authorization_code' grant.`);
-    }
-    const authorizationCodeGrant = options.credentialOffer.grants[authorizationCodeGrantIdentifier2];
-    const authorizationServer = determineAuthorizationServerForCredentialOffer({
-      issuerMetadata: options.issuerMetadata,
-      grantAuthorizationServer: authorizationCodeGrant.authorization_server
-    });
-    const authorizationServerMetadata = getAuthorizationServerMetadataFromList2(
-      options.issuerMetadata.authorizationServers,
-      authorizationServer
-    );
-    const oauth2Client = new Oauth2Client({ callbacks: this.options.callbacks });
-    try {
-      const result = await oauth2Client.initiateAuthorization({
-        clientId: options.clientId,
-        pkceCodeVerifier: options.pkceCodeVerifier,
-        redirectUri: options.redirectUri,
-        scope: options.scope,
-        additionalRequestPayload: {
-          ...options.additionalRequestPayload,
-          issuer_state: options.credentialOffer?.grants?.authorization_code?.issuer_state
-        },
-        dpop: options.dpop,
-        resource: options.issuerMetadata.credentialIssuer.credential_issuer,
-        authorizationServerMetadata
-      });
-      return {
-        ...result,
-        authorizationFlow: "Oauth2Redirect" /* Oauth2Redirect */,
-        authorizationServer: authorizationServerMetadata.issuer
-      };
-    } catch (error) {
-      if (error instanceof Oauth2ClientAuthorizationChallengeError && error.errorResponse.error === Oauth2ErrorCodes2.InsufficientAuthorization && error.errorResponse.presentation) {
-        if (!error.errorResponse.auth_session) {
-          throw new Openid4vciError(
-            `Expected 'auth_session' to be defined with authorization challenge response error '${error.errorResponse.error}' and 'presentation' parameter`
-          );
-        }
-        return {
-          authorizationFlow: "PresentationDuringIssuance" /* PresentationDuringIssuance */,
-          openid4vpRequestUrl: error.errorResponse.presentation,
-          authSession: error.errorResponse.auth_session,
-          authorizationServer: authorizationServerMetadata.issuer
-        };
-      }
-      throw error;
-    }
-  }
-  /**
-   * Convenience method around {@link Oauth2Client.createAuthorizationRequestUrl}
-   * but specifically focused on a credential offer
-   */
-  async createAuthorizationRequestUrlFromOffer(options) {
-    if (!options.credentialOffer.grants?.[authorizationCodeGrantIdentifier2]) {
-      throw new Oauth2Error7(`Provided credential offer does not include the 'authorization_code' grant.`);
-    }
-    const authorizationCodeGrant = options.credentialOffer.grants[authorizationCodeGrantIdentifier2];
-    const authorizationServer = determineAuthorizationServerForCredentialOffer({
-      issuerMetadata: options.issuerMetadata,
-      grantAuthorizationServer: authorizationCodeGrant.authorization_server
-    });
-    const authorizationServerMetadata = getAuthorizationServerMetadataFromList2(
-      options.issuerMetadata.authorizationServers,
-      authorizationServer
-    );
-    const { authorizationRequestUrl, pkce, dpop } = await this.oauth2Client.createAuthorizationRequestUrl({
-      authorizationServerMetadata,
-      clientId: options.clientId,
-      additionalRequestPayload: {
-        ...options.additionalRequestPayload,
-        issuer_state: options.credentialOffer?.grants?.authorization_code?.issuer_state
-      },
-      resource: options.issuerMetadata.credentialIssuer.credential_issuer,
-      redirectUri: options.redirectUri,
-      scope: options.scope,
-      pkceCodeVerifier: options.pkceCodeVerifier,
-      dpop: options.dpop
-    });
-    return {
-      authorizationRequestUrl,
-      pkce,
-      dpop,
-      authorizationServer: authorizationServerMetadata.issuer
-    };
-  }
-  /**
-   * Convenience method around {@link Oauth2Client.retrievePreAuthorizedCodeAccessToken}
-   * but specifically focused on a credential offer
-   */
-  async retrievePreAuthorizedCodeAccessTokenFromOffer({
-    credentialOffer,
-    issuerMetadata,
-    additionalRequestPayload,
-    txCode,
-    dpop
-  }) {
-    if (!credentialOffer.grants?.[preAuthorizedCodeGrantIdentifier3]) {
-      throw new Oauth2Error7(`The credential offer does not contain the '${preAuthorizedCodeGrantIdentifier3}' grant.`);
-    }
-    if (credentialOffer.grants[preAuthorizedCodeGrantIdentifier3].tx_code && !txCode) {
-      throw new Oauth2Error7(
-        `Retrieving access token requires a 'tx_code' in the request, but the 'txCode' parameter was not provided.`
-      );
-    }
-    const preAuthorizedCode = credentialOffer.grants[preAuthorizedCodeGrantIdentifier3]["pre-authorized_code"];
-    const authorizationServer = determineAuthorizationServerForCredentialOffer({
-      grantAuthorizationServer: credentialOffer.grants[preAuthorizedCodeGrantIdentifier3].authorization_server,
-      issuerMetadata
-    });
-    const authorizationServerMetadata = getAuthorizationServerMetadataFromList2(
-      issuerMetadata.authorizationServers,
-      authorizationServer
-    );
-    const result = await this.oauth2Client.retrievePreAuthorizedCodeAccessToken({
-      authorizationServerMetadata,
-      preAuthorizedCode,
-      txCode,
-      resource: issuerMetadata.credentialIssuer.credential_issuer,
-      additionalRequestPayload,
-      dpop
-    });
-    return {
-      ...result,
-      authorizationServer
-    };
-  }
-  /**
-   * Convenience method around {@link Oauth2Client.retrieveAuthorizationCodeAccessTokenFrom}
-   * but specifically focused on a credential offer
-   */
-  async retrieveAuthorizationCodeAccessTokenFromOffer({
-    issuerMetadata,
-    additionalRequestPayload,
-    credentialOffer,
-    authorizationCode,
-    pkceCodeVerifier,
-    redirectUri,
-    dpop
-  }) {
-    if (!credentialOffer.grants?.[authorizationCodeGrantIdentifier2]) {
-      throw new Oauth2Error7(`The credential offer does not contain the '${authorizationCodeGrantIdentifier2}' grant.`);
-    }
-    const authorizationServer = determineAuthorizationServerForCredentialOffer({
-      grantAuthorizationServer: credentialOffer.grants[authorizationCodeGrantIdentifier2].authorization_server,
-      issuerMetadata
-    });
-    const authorizationServerMetadata = getAuthorizationServerMetadataFromList2(
-      issuerMetadata.authorizationServers,
-      authorizationServer
-    );
-    const result = await this.oauth2Client.retrieveAuthorizationCodeAccessToken({
-      authorizationServerMetadata,
-      authorizationCode,
-      pkceCodeVerifier,
-      additionalRequestPayload,
-      dpop,
-      redirectUri,
-      resource: issuerMetadata.credentialIssuer.credential_issuer
-    });
-    return {
-      ...result,
-      authorizationServer
-    };
-  }
-  /**
-   * Request a nonce to be used in credential request proofs from the `nonce_endpoint`
-   *
-   * @throws Openid4vciError - if no `nonce_endpoint` is configured in the issuer metadata
-   * @throws InvalidFetchResponseError - if the nonce endpoint did not return a successful response
-   * @throws ValidationError - if validating the nonce response failed
-   */
-  async requestNonce(options) {
-    return requestNonce({
-      ...options,
-      fetch: this.options.callbacks.fetch
-    });
-  }
-  /**
-   * Creates the jwt proof payload and header to be included in a credential request.
-   */
-  async createCredentialRequestJwtProof(options) {
-    const credentialConfiguration = options.issuerMetadata.credentialIssuer.credential_configurations_supported[options.credentialConfigurationId];
-    if (!credentialConfiguration) {
-      throw new Openid4vciError(
-        `Credential configuration with '${options.credentialConfigurationId}' not found in 'credential_configurations_supported' from credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}'`
-      );
-    }
-    if (credentialConfiguration.proof_types_supported) {
-      if (!credentialConfiguration.proof_types_supported.jwt) {
-        throw new Openid4vciError(
-          `Credential configuration with id '${options.credentialConfigurationId}' does not support the 'jwt' proof type.`
-        );
-      }
-      if (!credentialConfiguration.proof_types_supported.jwt.proof_signing_alg_values_supported.includes(
-        options.signer.alg
-      )) {
-        throw new Openid4vciError(
-          `Credential configuration with id '${options.credentialConfigurationId}' does not support the '${options.signer.alg}' alg for 'jwt' proof type.`
-        );
-      }
-      if (credentialConfiguration.proof_types_supported.jwt.key_attestations_required && !options.keyAttestationJwt) {
-        throw new Openid4vciError(
-          `Credential configuration with id '${options.credentialConfigurationId}' requires key attestations for 'jwt' proof type but no 'keyAttestationJwt' was provided`
-        );
-      }
-    }
-    const jwt = await createCredentialRequestJwtProof({
-      credentialIssuer: options.issuerMetadata.credentialIssuer.credential_issuer,
-      signer: options.signer,
-      clientId: options.clientId,
-      issuedAt: options.issuedAt,
-      nonce: options.nonce,
-      keyAttestationJwt: options.keyAttestationJwt,
-      callbacks: this.options.callbacks
-    });
-    return {
-      jwt
-    };
-  }
-  /**
-   * @throws Openid4vciRetrieveCredentialsError - if an unsuccessful response or the response couldn't be parsed as credential response
-   * @throws ValidationError - if validation of the credential request failed
-   * @throws Openid4vciError - if the `credentialConfigurationId` couldn't be found, or if the the format specific request couldn't be constructed
-   */
-  async retrieveCredentials({
-    issuerMetadata,
-    proof,
-    proofs,
-    credentialConfigurationId,
-    additionalRequestPayload,
-    accessToken,
-    dpop
-  }) {
-    let credentialResponse;
-    if (issuerMetadata.originalDraftVersion === "Draft15" /* Draft15 */ || issuerMetadata.originalDraftVersion === "Draft16" /* Draft16 */) {
-      credentialResponse = await retrieveCredentialsWithCredentialConfigurationId({
-        accessToken,
-        credentialConfigurationId,
-        issuerMetadata,
-        additionalRequestPayload,
-        proof,
-        proofs,
-        callbacks: this.options.callbacks,
-        dpop
-      });
-    } else {
-      const formatPayload = getCredentialRequestFormatPayloadForCredentialConfigurationId({
-        credentialConfigurationId,
-        issuerMetadata
-      });
-      credentialResponse = await retrieveCredentialsWithFormat({
-        accessToken,
-        formatPayload,
-        issuerMetadata,
-        additionalRequestPayload,
-        proof,
-        proofs,
-        callbacks: this.options.callbacks,
-        dpop
-      });
-    }
-    if (!credentialResponse.ok) {
-      throw new Openid4vciRetrieveCredentialsError(
-        `Error retrieving credentials from '${issuerMetadata.credentialIssuer.credential_issuer}'`,
-        credentialResponse,
-        await credentialResponse.response.clone().text()
-      );
-    }
-    return credentialResponse;
-  }
-  /**
-   * @throws Openid4vciRetrieveCredentialsError - if an unsuccessful response or the response couldn't be parsed as credential response
-   * @throws ValidationError - if validation of the credential request failed
-   */
-  async retrieveDeferredCredentials(options) {
-    const credentialResponse = await retrieveDeferredCredentials({
-      ...options,
-      callbacks: this.options.callbacks
-    });
-    if (!credentialResponse.ok) {
-      throw new Openid4vciRetrieveCredentialsError(
-        `Error retrieving deferred credentials from '${options.issuerMetadata.credentialIssuer.credential_issuer}'`,
-        credentialResponse,
-        await credentialResponse.response.clone().text()
-      );
-    }
-    return credentialResponse;
-  }
-  /**
-   * @throws Openid4vciSendNotificationError - if an unsuccessful response
-   * @throws ValidationError - if validation of the notification request failed
-   */
-  async sendNotification({
-    issuerMetadata,
-    notification,
-    additionalRequestPayload,
-    accessToken,
-    dpop
-  }) {
-    const notificationResponse = await sendNotification({
-      accessToken,
-      issuerMetadata,
-      additionalRequestPayload,
-      callbacks: this.options.callbacks,
-      dpop,
-      notification
-    });
-    if (!notificationResponse.ok) {
-      throw new Openid4vciSendNotificationError(
-        `Error sending notification to '${issuerMetadata.credentialIssuer.credential_issuer}'`,
-        notificationResponse
-      );
-    }
-    return notificationResponse;
-  }
+	constructor(options) {
+		this.options = options;
+		this.oauth2Client = new Oauth2Client({ callbacks: this.options.callbacks });
+	}
+	getKnownCredentialConfigurationsSupported(credentialIssuerMetadata) {
+		return extractKnownCredentialConfigurationSupportedFormats(credentialIssuerMetadata.credential_configurations_supported);
+	}
+	/**
+	* Resolve a credential offer into a credential offer object, handling both
+	* 'credential_offer' and 'credential_offer_uri' params.
+	*/
+	async resolveCredentialOffer(credentialOffer) {
+		return resolveCredentialOffer(credentialOffer, { fetch: this.options.callbacks.fetch });
+	}
+	async resolveIssuerMetadata(credentialIssuer) {
+		return resolveIssuerMetadata(credentialIssuer, { fetch: this.options.callbacks.fetch });
+	}
+	/**
+	* Retrieve an authorization code for a presentation during issuance session
+	*
+	* This can only be called if an authorization challenge was performed before and returned a
+	* `presentation` parameter along with an `auth_session`. If the presentation response included
+	* an `presentation_during_issuance_session` parameter it MUST be included in this request as well.
+	*/
+	async retrieveAuthorizationCodeUsingPresentation(options) {
+		if (!options.credentialOffer.grants?.[authorizationCodeGrantIdentifier]) throw new Oauth2Error(`Provided credential offer does not include the 'authorization_code' grant.`);
+		const authorizationCodeGrant = options.credentialOffer.grants[authorizationCodeGrantIdentifier];
+		const authorizationServer = determineAuthorizationServerForCredentialOffer({
+			issuerMetadata: options.issuerMetadata,
+			grantAuthorizationServer: authorizationCodeGrant.authorization_server
+		});
+		const authorizationServerMetadata = getAuthorizationServerMetadataFromList(options.issuerMetadata.authorizationServers, authorizationServer);
+		const { authorizationChallengeResponse, dpop } = await new Oauth2Client({ callbacks: this.options.callbacks }).sendAuthorizationChallengeRequest({
+			authorizationServerMetadata,
+			authSession: options.authSession,
+			presentationDuringIssuanceSession: options.presentationDuringIssuanceSession,
+			dpop: options.dpop
+		});
+		return {
+			authorizationChallengeResponse,
+			dpop
+		};
+	}
+	/**
+	* Initiates authorization for credential issuance. It handles the following cases:
+	* - Authorization Challenge
+	* - Pushed Authorization Request
+	* - Regular Authorization url
+	*
+	* In case the authorization challenge request returns an error with `insufficient_authorization`
+	* with a `presentation` field it means the authorization server expects presentation of credentials
+	* before issuance of credentials. If this is the case, the value in `presentation` should be treated
+	* as an openid4vp authorization request and submitted to the verifier. Once the presentation response
+	* has been submitted, the RP will respond with a `presentation_during_issuance_session` parameter.
+	* Together with the `auth_session` parameter returned in this call you can retrieve an `authorization_code`
+	* using
+	*/
+	async initiateAuthorization(options) {
+		if (!options.credentialOffer.grants?.[authorizationCodeGrantIdentifier]) throw new Oauth2Error(`Provided credential offer does not include the 'authorization_code' grant.`);
+		const authorizationCodeGrant = options.credentialOffer.grants[authorizationCodeGrantIdentifier];
+		const authorizationServer = determineAuthorizationServerForCredentialOffer({
+			issuerMetadata: options.issuerMetadata,
+			grantAuthorizationServer: authorizationCodeGrant.authorization_server
+		});
+		const authorizationServerMetadata = getAuthorizationServerMetadataFromList(options.issuerMetadata.authorizationServers, authorizationServer);
+		const oauth2Client = new Oauth2Client({ callbacks: this.options.callbacks });
+		try {
+			return {
+				...await oauth2Client.initiateAuthorization({
+					clientId: options.clientId,
+					pkceCodeVerifier: options.pkceCodeVerifier,
+					redirectUri: options.redirectUri,
+					scope: options.scope,
+					additionalRequestPayload: {
+						...options.additionalRequestPayload,
+						issuer_state: options.credentialOffer?.grants?.authorization_code?.issuer_state
+					},
+					dpop: options.dpop,
+					resource: options.issuerMetadata.credentialIssuer.credential_issuer,
+					authorizationServerMetadata
+				}),
+				authorizationFlow: AuthorizationFlow.Oauth2Redirect,
+				authorizationServer: authorizationServerMetadata.issuer
+			};
+		} catch (error) {
+			if (error instanceof Oauth2ClientAuthorizationChallengeError && error.errorResponse.error === Oauth2ErrorCodes.InsufficientAuthorization && error.errorResponse.presentation) {
+				if (!error.errorResponse.auth_session) throw new Openid4vciError(`Expected 'auth_session' to be defined with authorization challenge response error '${error.errorResponse.error}' and 'presentation' parameter`);
+				return {
+					authorizationFlow: AuthorizationFlow.PresentationDuringIssuance,
+					openid4vpRequestUrl: error.errorResponse.presentation,
+					authSession: error.errorResponse.auth_session,
+					authorizationServer: authorizationServerMetadata.issuer
+				};
+			}
+			throw error;
+		}
+	}
+	/**
+	* Convenience method around {@link Oauth2Client.createAuthorizationRequestUrl}
+	* but specifically focused on a credential offer
+	*/
+	async createAuthorizationRequestUrlFromOffer(options) {
+		if (!options.credentialOffer.grants?.[authorizationCodeGrantIdentifier]) throw new Oauth2Error(`Provided credential offer does not include the 'authorization_code' grant.`);
+		const authorizationCodeGrant = options.credentialOffer.grants[authorizationCodeGrantIdentifier];
+		const authorizationServer = determineAuthorizationServerForCredentialOffer({
+			issuerMetadata: options.issuerMetadata,
+			grantAuthorizationServer: authorizationCodeGrant.authorization_server
+		});
+		const authorizationServerMetadata = getAuthorizationServerMetadataFromList(options.issuerMetadata.authorizationServers, authorizationServer);
+		const { authorizationRequestUrl, pkce, dpop } = await this.oauth2Client.createAuthorizationRequestUrl({
+			authorizationServerMetadata,
+			clientId: options.clientId,
+			additionalRequestPayload: {
+				...options.additionalRequestPayload,
+				issuer_state: options.credentialOffer?.grants?.authorization_code?.issuer_state
+			},
+			resource: options.issuerMetadata.credentialIssuer.credential_issuer,
+			redirectUri: options.redirectUri,
+			scope: options.scope,
+			pkceCodeVerifier: options.pkceCodeVerifier,
+			dpop: options.dpop
+		});
+		return {
+			authorizationRequestUrl,
+			pkce,
+			dpop,
+			authorizationServer: authorizationServerMetadata.issuer
+		};
+	}
+	/**
+	* Convenience method around {@link Oauth2Client.retrievePreAuthorizedCodeAccessToken}
+	* but specifically focused on a credential offer
+	*/
+	async retrievePreAuthorizedCodeAccessTokenFromOffer({ credentialOffer, issuerMetadata, additionalRequestPayload, txCode, dpop }) {
+		if (!credentialOffer.grants?.[preAuthorizedCodeGrantIdentifier]) throw new Oauth2Error(`The credential offer does not contain the '${preAuthorizedCodeGrantIdentifier}' grant.`);
+		if (credentialOffer.grants[preAuthorizedCodeGrantIdentifier].tx_code && !txCode) throw new Oauth2Error(`Retrieving access token requires a 'tx_code' in the request, but the 'txCode' parameter was not provided.`);
+		const preAuthorizedCode = credentialOffer.grants[preAuthorizedCodeGrantIdentifier]["pre-authorized_code"];
+		const authorizationServer = determineAuthorizationServerForCredentialOffer({
+			grantAuthorizationServer: credentialOffer.grants[preAuthorizedCodeGrantIdentifier].authorization_server,
+			issuerMetadata
+		});
+		const authorizationServerMetadata = getAuthorizationServerMetadataFromList(issuerMetadata.authorizationServers, authorizationServer);
+		return {
+			...await this.oauth2Client.retrievePreAuthorizedCodeAccessToken({
+				authorizationServerMetadata,
+				preAuthorizedCode,
+				txCode,
+				resource: issuerMetadata.credentialIssuer.credential_issuer,
+				additionalRequestPayload,
+				dpop
+			}),
+			authorizationServer
+		};
+	}
+	/**
+	* Convenience method around {@link Oauth2Client.retrieveAuthorizationCodeAccessTokenFrom}
+	* but specifically focused on a credential offer
+	*/
+	async retrieveAuthorizationCodeAccessTokenFromOffer({ issuerMetadata, additionalRequestPayload, credentialOffer, authorizationCode, pkceCodeVerifier, redirectUri, dpop }) {
+		if (!credentialOffer.grants?.[authorizationCodeGrantIdentifier]) throw new Oauth2Error(`The credential offer does not contain the '${authorizationCodeGrantIdentifier}' grant.`);
+		const authorizationServer = determineAuthorizationServerForCredentialOffer({
+			grantAuthorizationServer: credentialOffer.grants[authorizationCodeGrantIdentifier].authorization_server,
+			issuerMetadata
+		});
+		const authorizationServerMetadata = getAuthorizationServerMetadataFromList(issuerMetadata.authorizationServers, authorizationServer);
+		return {
+			...await this.oauth2Client.retrieveAuthorizationCodeAccessToken({
+				authorizationServerMetadata,
+				authorizationCode,
+				pkceCodeVerifier,
+				additionalRequestPayload,
+				dpop,
+				redirectUri,
+				resource: issuerMetadata.credentialIssuer.credential_issuer
+			}),
+			authorizationServer
+		};
+	}
+	/**
+	* Request a nonce to be used in credential request proofs from the `nonce_endpoint`
+	*
+	* @throws Openid4vciError - if no `nonce_endpoint` is configured in the issuer metadata
+	* @throws InvalidFetchResponseError - if the nonce endpoint did not return a successful response
+	* @throws ValidationError - if validating the nonce response failed
+	*/
+	async requestNonce(options) {
+		return requestNonce({
+			...options,
+			fetch: this.options.callbacks.fetch
+		});
+	}
+	/**
+	* Creates the jwt proof payload and header to be included in a credential request.
+	*/
+	async createCredentialRequestJwtProof(options) {
+		const credentialConfiguration = options.issuerMetadata.credentialIssuer.credential_configurations_supported[options.credentialConfigurationId];
+		if (!credentialConfiguration) throw new Openid4vciError(`Credential configuration with '${options.credentialConfigurationId}' not found in 'credential_configurations_supported' from credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}'`);
+		if (credentialConfiguration.proof_types_supported) {
+			if (!credentialConfiguration.proof_types_supported.jwt) throw new Openid4vciError(`Credential configuration with id '${options.credentialConfigurationId}' does not support the 'jwt' proof type.`);
+			if (!credentialConfiguration.proof_types_supported.jwt.proof_signing_alg_values_supported.includes(options.signer.alg)) throw new Openid4vciError(`Credential configuration with id '${options.credentialConfigurationId}' does not support the '${options.signer.alg}' alg for 'jwt' proof type.`);
+			if (credentialConfiguration.proof_types_supported.jwt.key_attestations_required && !options.keyAttestationJwt) throw new Openid4vciError(`Credential configuration with id '${options.credentialConfigurationId}' requires key attestations for 'jwt' proof type but no 'keyAttestationJwt' was provided`);
+		}
+		return { jwt: await createCredentialRequestJwtProof({
+			credentialIssuer: options.issuerMetadata.credentialIssuer.credential_issuer,
+			signer: options.signer,
+			clientId: options.clientId,
+			issuedAt: options.issuedAt,
+			nonce: options.nonce,
+			keyAttestationJwt: options.keyAttestationJwt,
+			callbacks: this.options.callbacks
+		}) };
+	}
+	/**
+	* @throws Openid4vciRetrieveCredentialsError - if an unsuccessful response or the response couldn't be parsed as credential response
+	* @throws ValidationError - if validation of the credential request failed
+	* @throws Openid4vciError - if the `credentialConfigurationId` couldn't be found, or if the the format specific request couldn't be constructed
+	*/
+	async retrieveCredentials({ issuerMetadata, proof, proofs, credentialConfigurationId, additionalRequestPayload, accessToken, dpop }) {
+		let credentialResponse;
+		if (issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft15 || issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft16) credentialResponse = await retrieveCredentialsWithCredentialConfigurationId({
+			accessToken,
+			credentialConfigurationId,
+			issuerMetadata,
+			additionalRequestPayload,
+			proof,
+			proofs,
+			callbacks: this.options.callbacks,
+			dpop
+		});
+		else credentialResponse = await retrieveCredentialsWithFormat({
+			accessToken,
+			formatPayload: getCredentialRequestFormatPayloadForCredentialConfigurationId({
+				credentialConfigurationId,
+				issuerMetadata
+			}),
+			issuerMetadata,
+			additionalRequestPayload,
+			proof,
+			proofs,
+			callbacks: this.options.callbacks,
+			dpop
+		});
+		if (!credentialResponse.ok) throw new Openid4vciRetrieveCredentialsError(`Error retrieving credentials from '${issuerMetadata.credentialIssuer.credential_issuer}'`, credentialResponse, await credentialResponse.response.clone().text());
+		return credentialResponse;
+	}
+	/**
+	* @throws Openid4vciRetrieveCredentialsError - if an unsuccessful response or the response couldn't be parsed as credential response
+	* @throws ValidationError - if validation of the credential request failed
+	*/
+	async retrieveDeferredCredentials(options) {
+		const credentialResponse = await retrieveDeferredCredentials({
+			...options,
+			callbacks: this.options.callbacks
+		});
+		if (!credentialResponse.ok) throw new Openid4vciRetrieveCredentialsError(`Error retrieving deferred credentials from '${options.issuerMetadata.credentialIssuer.credential_issuer}'`, credentialResponse, await credentialResponse.response.clone().text());
+		return credentialResponse;
+	}
+	/**
+	* @throws Openid4vciSendNotificationError - if an unsuccessful response
+	* @throws ValidationError - if validation of the notification request failed
+	*/
+	async sendNotification({ issuerMetadata, notification, additionalRequestPayload, accessToken, dpop }) {
+		const notificationResponse = await sendNotification({
+			accessToken,
+			issuerMetadata,
+			additionalRequestPayload,
+			callbacks: this.options.callbacks,
+			dpop,
+			notification
+		});
+		if (!notificationResponse.ok) throw new Openid4vciSendNotificationError(`Error sending notification to '${issuerMetadata.credentialIssuer.credential_issuer}'`, notificationResponse);
+		return notificationResponse;
+	}
 };
 
-// src/Openid4vciIssuer.ts
-import {
-  Oauth2AuthorizationServer,
-  Oauth2ErrorCodes as Oauth2ErrorCodes3,
-  Oauth2JwtVerificationError,
-  Oauth2ServerErrorResponseError
-} from "@openid4vc/oauth2";
-import { ValidationError as ValidationError4, parseWithErrorHandling as parseWithErrorHandling11 } from "@openid4vc/utils";
-
-// src/credential-request/credential-response.ts
-import { parseWithErrorHandling as parseWithErrorHandling8 } from "@openid4vc/utils";
+//#endregion
+//#region src/credential-request/credential-response.ts
 function createCredentialResponse(options) {
-  return parseWithErrorHandling8(zCredentialResponse, {
-    c_nonce: options.cNonce,
-    c_nonce_expires_in: options.cNonceExpiresInSeconds,
-    credential: options.credential,
-    credentials: options.credentials,
-    notification_id: options.notificationId,
-    transaction_id: options.transactionId,
-    interval: options.interval,
-    // NOTE `format` is removed in draft 13. For now if a format was requested
-    // we just always return it in the response as well.
-    format: options.credentialRequest.format?.format,
-    ...options.additionalPayload
-  });
+	return parseWithErrorHandling(zCredentialResponse, {
+		c_nonce: options.cNonce,
+		c_nonce_expires_in: options.cNonceExpiresInSeconds,
+		credential: options.credential,
+		credentials: options.credentials,
+		notification_id: options.notificationId,
+		transaction_id: options.transactionId,
+		interval: options.interval,
+		format: options.credentialRequest.format?.format,
+		...options.additionalPayload
+	});
 }
 function createDeferredCredentialResponse(options) {
-  return parseWithErrorHandling8(zDeferredCredentialResponse, {
-    credentials: options.credentials,
-    notification_id: options.notificationId,
-    interval: options.interval,
-    ...options.additionalPayload
-  });
+	return parseWithErrorHandling(zDeferredCredentialResponse, {
+		credentials: options.credentials,
+		notification_id: options.notificationId,
+		interval: options.interval,
+		...options.additionalPayload
+	});
 }
 
-// src/credential-request/parse-credential-request.ts
-import { parseWithErrorHandling as parseWithErrorHandling9 } from "@openid4vc/utils";
-import z22 from "zod";
+//#endregion
+//#region src/credential-request/parse-credential-request.ts
 function parseCredentialRequest(options) {
-  const credentialRequest = parseWithErrorHandling9(
-    zCredentialRequest,
-    options.credentialRequest,
-    "Error validating credential request"
-  );
-  let proofs = void 0;
-  const knownProofs = zCredentialRequestProofs.strict().safeParse(credentialRequest.proofs);
-  if (knownProofs.success) {
-    proofs = knownProofs.data;
-  }
-  const knownProof = z22.union(allCredentialRequestProofs).safeParse(credentialRequest.proof);
-  if (knownProof.success && knownProof.data.proof_type === jwtProofTypeIdentifier) {
-    proofs = { [jwtProofTypeIdentifier]: [knownProof.data.jwt] };
-  } else if (knownProof.success && knownProof.data.proof_type === attestationProofTypeIdentifier) {
-    proofs = { [attestationProofTypeIdentifier]: [knownProof.data.attestation] };
-  }
-  if (credentialRequest.credential_configuration_id) {
-    getCredentialConfigurationSupportedById(
-      options.issuerMetadata.credentialIssuer.credential_configurations_supported,
-      credentialRequest.credential_configuration_id
-    );
-    const credentialConfigurations = extractKnownCredentialConfigurationSupportedFormats(
-      options.issuerMetadata.credentialIssuer.credential_configurations_supported
-    );
-    return {
-      credentialConfiguration: credentialConfigurations[credentialRequest.credential_configuration_id],
-      credentialConfigurationId: credentialRequest.credential_configuration_id,
-      credentialRequest,
-      proofs
-    };
-  }
-  if (credentialRequest.credential_identifier) {
-    return {
-      credentialIdentifier: credentialRequest.credential_identifier,
-      credentialRequest,
-      proofs
-    };
-  }
-  if (credentialRequest.format && allCredentialRequestFormatIdentifiers.includes(
-    credentialRequest.format
-  )) {
-    return {
-      // Removes all claims that are not specific to this format
-      format: parseWithErrorHandling9(
-        z22.union(allCredentialRequestFormats),
-        credentialRequest,
-        "Unable to validate format specific properties from credential request"
-      ),
-      credentialRequest,
-      proofs
-    };
-  }
-  return {
-    credentialRequest,
-    proofs
-  };
+	const credentialRequest = parseWithErrorHandling(zCredentialRequest, options.credentialRequest, "Error validating credential request");
+	let proofs;
+	const knownProofs = zCredentialRequestProofs.strict().safeParse(credentialRequest.proofs);
+	if (knownProofs.success) proofs = knownProofs.data;
+	const knownProof = z.union(allCredentialRequestProofs).safeParse(credentialRequest.proof);
+	if (knownProof.success && knownProof.data.proof_type === jwtProofTypeIdentifier) proofs = { [jwtProofTypeIdentifier]: [knownProof.data.jwt] };
+	else if (knownProof.success && knownProof.data.proof_type === attestationProofTypeIdentifier) proofs = { [attestationProofTypeIdentifier]: [knownProof.data.attestation] };
+	if (credentialRequest.credential_configuration_id) {
+		getCredentialConfigurationSupportedById(options.issuerMetadata.credentialIssuer.credential_configurations_supported, credentialRequest.credential_configuration_id);
+		return {
+			credentialConfiguration: extractKnownCredentialConfigurationSupportedFormats(options.issuerMetadata.credentialIssuer.credential_configurations_supported)[credentialRequest.credential_configuration_id],
+			credentialConfigurationId: credentialRequest.credential_configuration_id,
+			credentialRequest,
+			proofs
+		};
+	}
+	if (credentialRequest.credential_identifier) return {
+		credentialIdentifier: credentialRequest.credential_identifier,
+		credentialRequest,
+		proofs
+	};
+	if (credentialRequest.format && allCredentialRequestFormatIdentifiers.includes(credentialRequest.format)) return {
+		format: parseWithErrorHandling(z.union(allCredentialRequestFormats), credentialRequest, "Unable to validate format specific properties from credential request"),
+		credentialRequest,
+		proofs
+	};
+	return {
+		credentialRequest,
+		proofs
+	};
 }
 
-// src/credential-request/parse-deferred-credential-request.ts
-import { parseWithErrorHandling as parseWithErrorHandling10 } from "@openid4vc/utils";
+//#endregion
+//#region src/credential-request/parse-deferred-credential-request.ts
 function parseDeferredCredentialRequest(options) {
-  const deferredCredentialRequest = parseWithErrorHandling10(
-    zDeferredCredentialRequest,
-    options.deferredCredentialRequest,
-    "Error validating credential request"
-  );
-  return {
-    deferredCredentialRequest
-  };
+	return { deferredCredentialRequest: parseWithErrorHandling(zDeferredCredentialRequest, options.deferredCredentialRequest, "Error validating credential request") };
 }
 
-// src/formats/proof-type/attestation/attestation-proof-type.ts
+//#endregion
+//#region src/formats/proof-type/attestation/attestation-proof-type.ts
 async function verifyCredentialRequestAttestationProof(options) {
-  const verificationResult = await verifyKeyAttestationJwt({
-    ...options,
-    use: "proof_type.attestation"
-  });
-  return verificationResult;
+	return await verifyKeyAttestationJwt({
+		...options,
+		use: "proof_type.attestation"
+	});
 }
 
-// src/Openid4vciIssuer.ts
+//#endregion
+//#region src/Openid4vciIssuer.ts
 var Openid4vciIssuer = class {
-  constructor(options) {
-    this.options = options;
-  }
-  getCredentialIssuerMetadataDraft11(credentialIssuerMetadata) {
-    return parseWithErrorHandling11(zCredentialIssuerMetadataWithDraft11, credentialIssuerMetadata);
-  }
-  getKnownCredentialConfigurationsSupported(credentialIssuerMetadata) {
-    return extractKnownCredentialConfigurationSupportedFormats(
-      credentialIssuerMetadata.credential_configurations_supported
-    );
-  }
-  /**
-   * Create issuer metadata and validates the structure is correct
-   */
-  createCredentialIssuerMetadata(credentialIssuerMetadata) {
-    return parseWithErrorHandling11(
-      zCredentialIssuerMetadata,
-      credentialIssuerMetadata,
-      "Error validating credential issuer metadata"
-    );
-  }
-  async createCredentialOffer(options) {
-    return createCredentialOffer({
-      callbacks: this.options.callbacks,
-      credentialConfigurationIds: options.credentialConfigurationIds,
-      grants: options.grants,
-      issuerMetadata: options.issuerMetadata,
-      additionalPayload: options.additionalPayload,
-      credentialOfferScheme: options.credentialOfferScheme,
-      credentialOfferUri: options.credentialOfferUri
-    });
-  }
-  /**
-   * @throws Oauth2ServerErrorResponseError - if verification of the jwt failed. You can extract
-   *  the credential error response from this.
-   */
-  async verifyCredentialRequestJwtProof(options) {
-    try {
-      return await verifyCredentialRequestJwtProof({
-        callbacks: this.options.callbacks,
-        credentialIssuer: options.issuerMetadata.credentialIssuer.credential_issuer,
-        expectedNonce: options.expectedNonce,
-        nonceExpiresAt: options.nonceExpiresAt,
-        jwt: options.jwt,
-        clientId: options.clientId,
-        now: options.now
-      });
-    } catch (error) {
-      throw new Oauth2ServerErrorResponseError(
-        {
-          error: Oauth2ErrorCodes3.InvalidProof,
-          error_description: (
-            // TODO: error should have a internalErrorMessage and a publicErrorMessage
-            error instanceof Oauth2JwtVerificationError || error instanceof Openid4vciError ? error.message : "Invalid proof"
-          )
-        },
-        {
-          internalMessage: "Error verifying credential request proof jwt",
-          cause: error
-        }
-      );
-    }
-  }
-  /**
-   * @throws Oauth2ServerErrorResponseError - if verification of the key attestation failed. You can extract
-   *  the credential error response from this.
-   */
-  async verifyCredentialRequestAttestationProof(options) {
-    try {
-      return await verifyCredentialRequestAttestationProof({
-        callbacks: this.options.callbacks,
-        expectedNonce: options.expectedNonce,
-        keyAttestationJwt: options.keyAttestationJwt,
-        nonceExpiresAt: options.nonceExpiresAt,
-        now: options.now
-      });
-    } catch (error) {
-      throw new Oauth2ServerErrorResponseError(
-        {
-          error: Oauth2ErrorCodes3.InvalidProof,
-          error_description: (
-            // TODO: error should have a internalErrorMessage and a publicErrorMessage
-            error instanceof Oauth2JwtVerificationError || error instanceof Openid4vciError ? error.message : "Invalid proof"
-          )
-        },
-        {
-          internalMessage: "Error verifying credential request proof attestation",
-          cause: error
-        }
-      );
-    }
-  }
-  /**
-   * @throws Oauth2ServerErrorResponseError - when validation of the credential request fails
-   *  You can extract the credential error response from this.
-   */
-  parseCredentialRequest(options) {
-    try {
-      return parseCredentialRequest(options);
-    } catch (error) {
-      throw new Oauth2ServerErrorResponseError(
-        {
-          error: Oauth2ErrorCodes3.InvalidCredentialRequest,
-          error_description: (
-            // TODO: error should have a internalErrorMessage and a publicErrorMessage
-            error instanceof ValidationError4 ? error.message : "Invalid request"
-          )
-        },
-        {
-          internalMessage: "Error verifying credential request proof jwt",
-          cause: error
-        }
-      );
-    }
-  }
-  /**
-   * @throws Oauth2ServerErrorResponseError - when validation of the deferred credential request fails
-   */
-  parseDeferredCredentialRequest(options) {
-    try {
-      return parseDeferredCredentialRequest(options);
-    } catch (error) {
-      throw new Oauth2ServerErrorResponseError(
-        {
-          error: Oauth2ErrorCodes3.InvalidCredentialRequest,
-          error_description: error instanceof ValidationError4 ? error.message : "Invalid request"
-        },
-        {
-          internalMessage: "Error parsing deferred credential request",
-          cause: error
-        }
-      );
-    }
-  }
-  /**
-   * @throws ValidationError - when validation of the credential response fails
-   */
-  createCredentialResponse(options) {
-    return createCredentialResponse(options);
-  }
-  /**
-   * @throws ValidationError - when validation of the credential response fails
-   */
-  createDeferredCredentialResponse(options) {
-    return createDeferredCredentialResponse(options);
-  }
-  /**
-   * @throws ValidationError - when validation of the nonce response fails
-   */
-  createNonceResponse(options) {
-    return createNonceResponse(options);
-  }
-  async verifyWalletAttestation(options) {
-    return new Oauth2AuthorizationServer({
-      callbacks: this.options.callbacks
-    }).verifyClientAttestation(options);
-  }
+	constructor(options) {
+		this.options = options;
+	}
+	getCredentialIssuerMetadataDraft11(credentialIssuerMetadata) {
+		return parseWithErrorHandling(zCredentialIssuerMetadataWithDraft11, credentialIssuerMetadata);
+	}
+	getKnownCredentialConfigurationsSupported(credentialIssuerMetadata) {
+		return extractKnownCredentialConfigurationSupportedFormats(credentialIssuerMetadata.credential_configurations_supported);
+	}
+	/**
+	* Create issuer metadata and validates the structure is correct
+	*/
+	createCredentialIssuerMetadata(credentialIssuerMetadata) {
+		return parseWithErrorHandling(zCredentialIssuerMetadata, credentialIssuerMetadata, "Error validating credential issuer metadata");
+	}
+	async createCredentialOffer(options) {
+		return createCredentialOffer({
+			callbacks: this.options.callbacks,
+			credentialConfigurationIds: options.credentialConfigurationIds,
+			grants: options.grants,
+			issuerMetadata: options.issuerMetadata,
+			additionalPayload: options.additionalPayload,
+			credentialOfferScheme: options.credentialOfferScheme,
+			credentialOfferUri: options.credentialOfferUri
+		});
+	}
+	/**
+	* @throws Oauth2ServerErrorResponseError - if verification of the jwt failed. You can extract
+	*  the credential error response from this.
+	*/
+	async verifyCredentialRequestJwtProof(options) {
+		try {
+			return await verifyCredentialRequestJwtProof({
+				callbacks: this.options.callbacks,
+				credentialIssuer: options.issuerMetadata.credentialIssuer.credential_issuer,
+				expectedNonce: options.expectedNonce,
+				nonceExpiresAt: options.nonceExpiresAt,
+				jwt: options.jwt,
+				clientId: options.clientId,
+				now: options.now
+			});
+		} catch (error) {
+			throw new Oauth2ServerErrorResponseError({
+				error: Oauth2ErrorCodes.InvalidProof,
+				error_description: error instanceof Oauth2JwtVerificationError || error instanceof Openid4vciError ? error.message : "Invalid proof"
+			}, {
+				internalMessage: "Error verifying credential request proof jwt",
+				cause: error
+			});
+		}
+	}
+	/**
+	* @throws Oauth2ServerErrorResponseError - if verification of the key attestation failed. You can extract
+	*  the credential error response from this.
+	*/
+	async verifyCredentialRequestAttestationProof(options) {
+		try {
+			return await verifyCredentialRequestAttestationProof({
+				callbacks: this.options.callbacks,
+				expectedNonce: options.expectedNonce,
+				keyAttestationJwt: options.keyAttestationJwt,
+				nonceExpiresAt: options.nonceExpiresAt,
+				now: options.now
+			});
+		} catch (error) {
+			throw new Oauth2ServerErrorResponseError({
+				error: Oauth2ErrorCodes.InvalidProof,
+				error_description: error instanceof Oauth2JwtVerificationError || error instanceof Openid4vciError ? error.message : "Invalid proof"
+			}, {
+				internalMessage: "Error verifying credential request proof attestation",
+				cause: error
+			});
+		}
+	}
+	/**
+	* @throws Oauth2ServerErrorResponseError - when validation of the credential request fails
+	*  You can extract the credential error response from this.
+	*/
+	parseCredentialRequest(options) {
+		try {
+			return parseCredentialRequest(options);
+		} catch (error) {
+			throw new Oauth2ServerErrorResponseError({
+				error: Oauth2ErrorCodes.InvalidCredentialRequest,
+				error_description: error instanceof ValidationError ? error.message : "Invalid request"
+			}, {
+				internalMessage: "Error verifying credential request proof jwt",
+				cause: error
+			});
+		}
+	}
+	/**
+	* @throws Oauth2ServerErrorResponseError - when validation of the deferred credential request fails
+	*/
+	parseDeferredCredentialRequest(options) {
+		try {
+			return parseDeferredCredentialRequest(options);
+		} catch (error) {
+			throw new Oauth2ServerErrorResponseError({
+				error: Oauth2ErrorCodes.InvalidCredentialRequest,
+				error_description: error instanceof ValidationError ? error.message : "Invalid request"
+			}, {
+				internalMessage: "Error parsing deferred credential request",
+				cause: error
+			});
+		}
+	}
+	/**
+	* @throws ValidationError - when validation of the credential response fails
+	*/
+	createCredentialResponse(options) {
+		return createCredentialResponse(options);
+	}
+	/**
+	* @throws ValidationError - when validation of the credential response fails
+	*/
+	createDeferredCredentialResponse(options) {
+		return createDeferredCredentialResponse(options);
+	}
+	/**
+	* @throws ValidationError - when validation of the nonce response fails
+	*/
+	createNonceResponse(options) {
+		return createNonceResponse(options);
+	}
+	async verifyWalletAttestation(options) {
+		return new Oauth2AuthorizationServer({ callbacks: this.options.callbacks }).verifyClientAttestation(options);
+	}
 };
 
-// src/Openid4vciWalletProvider.ts
-import {
-  createClientAttestationJwt
-} from "@openid4vc/oauth2";
+//#endregion
+//#region src/Openid4vciWalletProvider.ts
 var Openid4vciWalletProvider = class {
-  constructor(options) {
-    this.options = options;
-  }
-  async createWalletAttestationJwt(options) {
-    const additionalPayload = options.additionalPayload ? {
-      wallet_name: options.walletName,
-      wallet_link: options.walletLink,
-      ...options.additionalPayload
-    } : {
-      wallet_name: options.walletName,
-      wallet_link: options.walletLink
-    };
-    return await createClientAttestationJwt({
-      ...options,
-      callbacks: this.options.callbacks,
-      additionalPayload
-    });
-  }
-  async createKeyAttestationJwt(options) {
-    return await createKeyAttestationJwt({
-      callbacks: this.options.callbacks,
-      ...options
-    });
-  }
-};
-export {
-  AuthorizationFlow,
-  Openid4vciClient,
-  Openid4vciDraftVersion,
-  Openid4vciError,
-  Openid4vciIssuer,
-  Openid4vciRetrieveCredentialsError,
-  Openid4vciSendNotificationError,
-  Openid4vciWalletProvider,
-  createKeyAttestationJwt,
-  credentialsSupportedToCredentialConfigurationsSupported,
-  determineAuthorizationServerForCredentialOffer,
-  extractScopesForCredentialConfigurationIds,
-  getCredentialConfigurationsMatchingRequestFormat,
-  getGlobalConfig,
-  parseKeyAttestationJwt,
-  setGlobalConfig,
-  verifyKeyAttestationJwt
+	constructor(options) {
+		this.options = options;
+	}
+	async createWalletAttestationJwt(options) {
+		const additionalPayload = options.additionalPayload ? {
+			wallet_name: options.walletName,
+			wallet_link: options.walletLink,
+			...options.additionalPayload
+		} : {
+			wallet_name: options.walletName,
+			wallet_link: options.walletLink
+		};
+		return await createClientAttestationJwt({
+			...options,
+			callbacks: this.options.callbacks,
+			additionalPayload
+		});
+	}
+	async createKeyAttestationJwt(options) {
+		return await createKeyAttestationJwt({
+			callbacks: this.options.callbacks,
+			...options
+		});
+	}
 };
+
+//#endregion
+export { AuthorizationFlow, Openid4vciClient, Openid4vciDraftVersion, Openid4vciError, Openid4vciIssuer, Openid4vciRetrieveCredentialsError, Openid4vciSendNotificationError, Openid4vciWalletProvider, createKeyAttestationJwt, credentialsSupportedToCredentialConfigurationsSupported, determineAuthorizationServerForCredentialOffer, extractScopesForCredentialConfigurationIds, getCredentialConfigurationsMatchingRequestFormat, getGlobalConfig, parseKeyAttestationJwt, setGlobalConfig, verifyKeyAttestationJwt };
 //# sourceMappingURL=index.mjs.map