@sphereon/oid4vci-client 0.15.2-unstable.8 → 0.16.0

package/dist/functions/AccessTokenUtil.js

@@ -10,8 +10,8 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createJwtBearerClientAssertion = void 0;
+const oid4vc_common_1 = require("@sphereon/oid4vc-common");
 const oid4vci_common_1 = require("@sphereon/oid4vci-common");
-const uuid_1 = require("uuid");
 const ProofOfPossessionBuilder_1 = require("../ProofOfPossessionBuilder");
 const createJwtBearerClientAssertion = (request, opts) => __awaiter(void 0, void 0, void 0, function* () {
     var _a, _b;
@@ -44,7 +44,7 @@ const createJwtBearerClientAssertion = (request, opts) => __awaiter(void 0, void
                 iss: clientId,
                 sub: clientId,
                 aud: credentialIssuer,
-                jti: (0, uuid_1.v4)(),
+                jti: (0, oid4vc_common_1.uuidv4)(),
                 exp: Date.now() / 1000 + 60,
                 iat: Date.now() / 1000 - 60,
             },

package/dist/functions/AccessTokenUtil.js.map

@@ -1 +1 @@
-{"version":3,"file":"AccessTokenUtil.js","sourceRoot":"","sources":["../../lib/functions/AccessTokenUtil.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6DAA8G;AAC9G,+BAA0B;AAE1B,0EAAuE;AAEhE,MAAM,8BAA8B,GAAG,CAC5C,OAAoC,EACpC,IAEC,EACc,EAAE;;IACjB,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAC1C,IAAI,CAAA,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,UAAU,0CAAE,mBAAmB,MAAK,wDAAwD,EAAE,CAAC;QACzG,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QAC/E,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC,CAAC;QACrG,CAAC;aAAM,IAAI,CAAC,GAAG,EAAE,CAAC;YAChB,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC,CAAC;QAC9F,CAAC;aAAM,IAAI,OAAO,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,YAAY,CAAA,KAAK,UAAU,EAAE,CAAC;YAC7D,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAC,CAAC;QACxG,CAAC;aAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC7B,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2EAA2E,CAAC,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,GAAG,GAAQ;YACf,MAAM,EAAE;gBACN,GAAG,EAAE,KAAK;gBACV,GAAG;gBACH,GAAG,EAAE,GAAG,aAAH,GAAG,cAAH,GAAG,GAAI,OAAO;aACpB;YACD,OAAO,EAAE;gBACP,GAAG,EAAE,QAAQ;gBACb,GAAG,EAAE,QAAQ;gBACb,GAAG,EAAE,gBAAgB;gBACrB,GAAG,EAAE,IAAA,SAAE,GAAE;gBACT,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE;gBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE;aAC5B;SACF,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,mDAAwB,CAAC,OAAO,CAAC;YACjD,GAAG;YACH,SAAS,EAAE,aAAa;YACxB,OAAO,EAAE,MAAA,IAAI,CAAC,OAAO,mCAAI,kCAAiB,CAAC,UAAU;YACrD,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,qBAAqB,GAAG,wDAAwD,CAAC;QACzF,OAAO,CAAC,gBAAgB,GAAG,GAAG,CAAC,GAAG,CAAC;IACrC,CAAC;AACH,CAAC,CAAA,CAAC;AA9CW,QAAA,8BAA8B,kCA8CzC"}
+{"version":3,"file":"AccessTokenUtil.js","sourceRoot":"","sources":["../../lib/functions/AccessTokenUtil.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2DAAiD;AACjD,6DAA8G;AAE9G,0EAAuE;AAEhE,MAAM,8BAA8B,GAAG,CAC5C,OAAoC,EACpC,IAEC,EACc,EAAE;;IACjB,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAC1C,IAAI,CAAA,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,UAAU,0CAAE,mBAAmB,MAAK,wDAAwD,EAAE,CAAC;QACzG,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QAC/E,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC,CAAC;QACrG,CAAC;aAAM,IAAI,CAAC,GAAG,EAAE,CAAC;YAChB,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC,CAAC;QAC9F,CAAC;aAAM,IAAI,OAAO,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,YAAY,CAAA,KAAK,UAAU,EAAE,CAAC;YAC7D,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAC,CAAC;QACxG,CAAC;aAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC7B,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2EAA2E,CAAC,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,GAAG,GAAQ;YACf,MAAM,EAAE;gBACN,GAAG,EAAE,KAAK;gBACV,GAAG;gBACH,GAAG,EAAE,GAAG,aAAH,GAAG,cAAH,GAAG,GAAI,OAAO;aACpB;YACD,OAAO,EAAE;gBACP,GAAG,EAAE,QAAQ;gBACb,GAAG,EAAE,QAAQ;gBACb,GAAG,EAAE,gBAAgB;gBACrB,GAAG,EAAE,IAAA,sBAAM,GAAE;gBACb,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE;gBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE;aAC5B;SACF,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,mDAAwB,CAAC,OAAO,CAAC;YACjD,GAAG;YACH,SAAS,EAAE,aAAa;YACxB,OAAO,EAAE,MAAA,IAAI,CAAC,OAAO,mCAAI,kCAAiB,CAAC,UAAU;YACrD,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,qBAAqB,GAAG,wDAAwD,CAAC;QACzF,OAAO,CAAC,gBAAgB,GAAG,GAAG,CAAC,GAAG,CAAC;IACrC,CAAC;AACH,CAAC,CAAA,CAAC;AA9CW,QAAA,8BAA8B,kCA8CzC"}

package/dist/functions/dpopUtil.d.ts

@@ -0,0 +1,10 @@
+import { OpenIDResponse } from 'oid4vci-common';
+export type RetryRequestWithDPoPNonce = {
+    ok: true;
+    dpopNonce: string;
+} | {
+    ok: false;
+};
+export declare function shouldRetryTokenRequestWithDPoPNonce(response: OpenIDResponse<unknown, unknown>): RetryRequestWithDPoPNonce;
+export declare function shouldRetryResourceRequestWithDPoPNonce(response: OpenIDResponse<unknown, unknown>): RetryRequestWithDPoPNonce;
+//# sourceMappingURL=dpopUtil.d.ts.map

package/dist/functions/dpopUtil.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dpopUtil.d.ts","sourceRoot":"","sources":["../../lib/functions/dpopUtil.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,MAAM,yBAAyB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC;AAExF,wBAAgB,oCAAoC,CAAC,QAAQ,EAAE,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,yBAAyB,CAW1H;AAED,wBAAgB,uCAAuC,CAAC,QAAQ,EAAE,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,yBAAyB,CAgB7H"}

package/dist/functions/dpopUtil.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.shouldRetryTokenRequestWithDPoPNonce = shouldRetryTokenRequestWithDPoPNonce;
+exports.shouldRetryResourceRequestWithDPoPNonce = shouldRetryResourceRequestWithDPoPNonce;
+const oid4vc_common_1 = require("@sphereon/oid4vc-common");
+function shouldRetryTokenRequestWithDPoPNonce(response) {
+    if (!response.errorBody || response.errorBody.error !== oid4vc_common_1.dpopTokenRequestNonceError) {
+        return { ok: false };
+    }
+    const dPoPNonce = response.origResponse.headers.get('DPoP-Nonce');
+    if (!dPoPNonce) {
+        throw new Error('Missing required DPoP-Nonce header.');
+    }
+    return { ok: true, dpopNonce: dPoPNonce };
+}
+function shouldRetryResourceRequestWithDPoPNonce(response) {
+    if (!response.errorBody || response.origResponse.status !== 401) {
+        return { ok: false };
+    }
+    const wwwAuthenticateHeader = response.origResponse.headers.get('WWW-Authenticate');
+    if (!(wwwAuthenticateHeader === null || wwwAuthenticateHeader === void 0 ? void 0 : wwwAuthenticateHeader.includes(oid4vc_common_1.dpopTokenRequestNonceError))) {
+        return { ok: false };
+    }
+    const dPoPNonce = response.origResponse.headers.get('DPoP-Nonce');
+    if (!dPoPNonce) {
+        throw new Error('Missing required DPoP-Nonce header.');
+    }
+    return { ok: true, dpopNonce: dPoPNonce };
+}
+//# sourceMappingURL=dpopUtil.js.map

package/dist/functions/dpopUtil.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dpopUtil.js","sourceRoot":"","sources":["../../lib/functions/dpopUtil.ts"],"names":[],"mappings":";;AAKA,oFAWC;AAED,0FAgBC;AAlCD,2DAAqE;AAKrE,SAAgB,oCAAoC,CAAC,QAA0C;IAC7F,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC,KAAK,KAAK,0CAA0B,EAAE,CAAC;QACnF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAClE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAC5C,CAAC;AAED,SAAgB,uCAAuC,CAAC,QAA0C;IAChG,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,MAAM,qBAAqB,GAAG,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACpF,IAAI,CAAC,CAAA,qBAAqB,aAArB,qBAAqB,uBAArB,qBAAqB,CAAE,QAAQ,CAAC,0CAA0B,CAAC,CAAA,EAAE,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAClE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAC5C,CAAC"}

package/dist/functions/notifications.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notifications.d.ts","sourceRoot":"","sources":["../../lib/functions/notifications.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,mBAAmB,EAAE,kBAAkB,EAAQ,MAAM,0BAA0B,CAAC;AAEpH,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAGnE,wBAAsB,gBAAgB,CACpC,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,CAAC,EACrD,OAAO,EAAE,mBAAmB,EAC5B,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,kBAAkB,CAAC,CAsB7B"}
+{"version":3,"file":"notifications.d.ts","sourceRoot":"","sources":["../../lib/functions/notifications.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,mBAAmB,EAAE,kBAAkB,EAAQ,MAAM,0BAA0B,CAAC;AAEpH,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAGnE,wBAAsB,gBAAgB,CACpC,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,CAAC,EACrD,OAAO,EAAE,mBAAmB,EAC5B,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,kBAAkB,CAAC,CAoB7B"}

package/dist/functions/notifications.js

@@ -14,7 +14,7 @@ const oid4vci_common_1 = require("@sphereon/oid4vci-common");
 const types_1 = require("../types");
 function sendNotification(credentialRequestOpts, request, accessToken) {
     return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b, _c;
+        var _a;
         types_1.LOG.info(`Sending status notification event '${request.event}' for id ${request.notification_id}`);
         if (!credentialRequestOpts.notificationEndpoint) {
             throw Error(`Cannot send notification when no notification endpoint is provided`);
@@ -24,10 +24,10 @@ function sendNotification(credentialRequestOpts, request, accessToken) {
         const error = ((_a = response.errorBody) === null || _a === void 0 ? void 0 : _a.error) !== undefined;
         const result = {
             error,
-            response: error ? yield ((_b = response.errorBody) === null || _b === void 0 ? void 0 : _b.json()) : undefined,
+            response: error ? response.errorBody : undefined,
         };
         if (error) {
-            types_1.LOG.warning(`Notification endpoint returned an error for event '${request.event}' and id ${request.notification_id}: ${yield ((_c = response.errorBody) === null || _c === void 0 ? void 0 : _c.json())}`);
+            types_1.LOG.warning(`Notification endpoint returned an error for event '${request.event}' and id ${request.notification_id}: ${response.errorBody}`);
         }
         else {
             types_1.LOG.debug(`Notification endpoint returned success for event '${request.event}' and id ${request.notification_id}`);

package/dist/functions/notifications.js.map

@@ -1 +1 @@
-{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../../lib/functions/notifications.ts"],"names":[],"mappings":";;;;;;;;;;;AAKA,4CA0BC;AA/BD,6DAAoH;AAGpH,oCAA+B;AAE/B,SAAsB,gBAAgB,CACpC,qBAAqD,EACrD,OAA4B,EAC5B,WAAoB;;;QAEpB,WAAG,CAAC,IAAI,CAAC,sCAAsC,OAAO,CAAC,KAAK,YAAY,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;QACnG,IAAI,CAAC,qBAAqB,CAAC,oBAAoB,EAAE,CAAC;YAChD,MAAM,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,aAAX,WAAW,cAAX,WAAW,GAAI,qBAAqB,CAAC,KAAK,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAI,EAA4B,qBAAqB,CAAC,oBAAoB,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,oBACrH,CAAC,KAAK,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EACpC,CAAC;QACH,MAAM,KAAK,GAAG,CAAA,MAAA,QAAQ,CAAC,SAAS,0CAAE,KAAK,MAAK,SAAS,CAAC;QACtD,MAAM,MAAM,GAAG;YACb,KAAK;YACL,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA,MAAA,QAAQ,CAAC,SAAS,0CAAE,IAAI,EAAE,CAAA,CAAC,CAAC,CAAC,SAAS;SAC/D,CAAC;QACF,IAAI,KAAK,EAAE,CAAC;YACV,WAAG,CAAC,OAAO,CACT,sDAAsD,OAAO,CAAC,KAAK,YAAY,OAAO,CAAC,eAAe,KAAK,MAAM,CAAA,MAAA,QAAQ,CAAC,SAAS,0CAAE,IAAI,EAAE,CAAA,EAAE,CAC9I,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,WAAG,CAAC,KAAK,CAAC,qDAAqD,OAAO,CAAC,KAAK,YAAY,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;QACrH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CAAA"}
+{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../../lib/functions/notifications.ts"],"names":[],"mappings":";;;;;;;;;;;AAKA,4CAwBC;AA7BD,6DAAoH;AAGpH,oCAA+B;AAE/B,SAAsB,gBAAgB,CACpC,qBAAqD,EACrD,OAA4B,EAC5B,WAAoB;;;QAEpB,WAAG,CAAC,IAAI,CAAC,sCAAsC,OAAO,CAAC,KAAK,YAAY,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;QACnG,IAAI,CAAC,qBAAqB,CAAC,oBAAoB,EAAE,CAAC;YAChD,MAAM,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,aAAX,WAAW,cAAX,WAAW,GAAI,qBAAqB,CAAC,KAAK,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAI,EAA4B,qBAAqB,CAAC,oBAAoB,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,oBACrH,CAAC,KAAK,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EACpC,CAAC;QACH,MAAM,KAAK,GAAG,CAAA,MAAA,QAAQ,CAAC,SAAS,0CAAE,KAAK,MAAK,SAAS,CAAC;QACtD,MAAM,MAAM,GAAG;YACb,KAAK;YACL,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;SACjD,CAAC;QACF,IAAI,KAAK,EAAE,CAAC;YACV,WAAG,CAAC,OAAO,CAAC,sDAAsD,OAAO,CAAC,KAAK,YAAY,OAAO,CAAC,eAAe,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/I,CAAC;aAAM,CAAC;YACN,WAAG,CAAC,KAAK,CAAC,qDAAqD,OAAO,CAAC,KAAK,YAAY,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;QACrH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CAAA"}

package/dist/index.d.ts

@@ -19,6 +19,5 @@ export * from './MetadataClientV1_0_11';
 export * from './OpenID4VCIClient';
 export * from './OpenID4VCIClientV1_0_13';
 export * from './OpenID4VCIClientV1_0_11';
-export * from './IssuerSessionClient';
 export * from './ProofOfPossessionBuilder';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../lib/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,eAAO,MAAM,GAAG,EAAE,aAAa,CAAC,MAAM,CAA8C,CAAC;AAErF,cAAc,qBAAqB,CAAC;AACpC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,kCAAkC,CAAC;AACjD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,kCAAkC,CAAC;AACjD,cAAc,kCAAkC,CAAC;AACjD,cAAc,yCAAyC,CAAC;AACxD,cAAc,yCAAyC,CAAC;AACxD,cAAc,aAAa,CAAC;AAC5B,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../lib/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,eAAO,MAAM,GAAG,EAAE,aAAa,CAAC,MAAM,CAA8C,CAAC;AAErF,cAAc,qBAAqB,CAAC;AACpC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,kCAAkC,CAAC;AACjD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,kCAAkC,CAAC;AACjD,cAAc,kCAAkC,CAAC;AACjD,cAAc,yCAAyC,CAAC;AACxD,cAAc,yCAAyC,CAAC;AACxD,cAAc,aAAa,CAAC;AAC5B,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC"}

package/dist/index.js

@@ -36,6 +36,5 @@ __exportStar(require("./MetadataClientV1_0_11"), exports);
 __exportStar(require("./OpenID4VCIClient"), exports);
 __exportStar(require("./OpenID4VCIClientV1_0_13"), exports);
 __exportStar(require("./OpenID4VCIClientV1_0_11"), exports);
-__exportStar(require("./IssuerSessionClient"), exports);
 __exportStar(require("./ProofOfPossessionBuilder"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../lib/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAAuD;AAG1C,QAAA,GAAG,GAA0B,4BAAW,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;AAErF,sDAAoC;AACpC,6DAA2C;AAC3C,4DAA0C;AAC1C,mEAAiD;AACjD,4DAA0C;AAC1C,0DAAwC;AACxC,iEAA+C;AAC/C,iEAA+C;AAC/C,mEAAiD;AACjD,mEAAiD;AACjD,0EAAwD;AACxD,0EAAwD;AACxD,8CAA4B;AAC5B,mDAAiC;AACjC,0DAAwC;AACxC,0DAAwC;AACxC,qDAAmC;AACnC,4DAA0C;AAC1C,4DAA0C;AAC1C,wDAAsC;AACtC,6DAA2C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../lib/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAAuD;AAG1C,QAAA,GAAG,GAA0B,4BAAW,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;AAErF,sDAAoC;AACpC,6DAA2C;AAC3C,4DAA0C;AAC1C,mEAAiD;AACjD,4DAA0C;AAC1C,0DAAwC;AACxC,iEAA+C;AAC/C,iEAA+C;AAC/C,mEAAiD;AACjD,mEAAiD;AACjD,0EAAwD;AACxD,0EAAwD;AACxD,8CAA4B;AAC5B,mDAAiC;AACjC,0DAAwC;AACxC,0DAAwC;AACxC,qDAAmC;AACnC,4DAA0C;AAC1C,4DAA0C;AAC1C,6DAA2C"}

package/lib/AccessTokenClient.ts

@@ -1,3 +1,4 @@
+import { createDPoP, CreateDPoPClientOpts, getCreateDPoPOptions } from '@sphereon/oid4vc-common';
 import {
   AccessTokenRequest,
   AccessTokenRequestOpts,
@@ -6,6 +7,7 @@ import {
   AuthorizationServerOpts,
   AuthzFlowType,
   convertJsonToURI,
+  DPoPResponseParams,
   EndpointMetadata,
   formPost,
   getIssuerFromCredentialOfferPayload,
@@ -24,11 +26,12 @@ import { ObjectUtils } from '@sphereon/ssi-types';
 
 import { MetadataClientV1_0_13 } from './MetadataClientV1_0_13';
 import { createJwtBearerClientAssertion } from './functions';
+import { shouldRetryTokenRequestWithDPoPNonce } from './functions/dpopUtil';
 import { LOG } from './types';
 
 export class AccessTokenClient {
-  public async acquireAccessToken(opts: AccessTokenRequestOpts): Promise<OpenIDResponse<AccessTokenResponse>> {
-    const { asOpts, pin, codeVerifier, code, redirectUri, metadata } = opts;
+  public async acquireAccessToken(opts: AccessTokenRequestOpts): Promise<OpenIDResponse<AccessTokenResponse, DPoPResponseParams>> {
+    const { asOpts, pin, codeVerifier, code, redirectUri, metadata, createDPoPOpts } = opts;
 
     const credentialOffer = opts.credentialOffer ? await assertedUniformCredentialOffer(opts.credentialOffer) : undefined;
     const pinMetadata: TxCodeAndPinRequired | undefined = credentialOffer && this.getPinMetadata(credentialOffer.credential_offer);
@@ -59,6 +62,7 @@ export class AccessTokenClient {
       metadata,
       asOpts,
       issuerOpts,
+      createDPoPOpts: createDPoPOpts,
     });
   }
 
@@ -68,13 +72,15 @@ export class AccessTokenClient {
     metadata,
     asOpts,
     issuerOpts,
+    createDPoPOpts,
   }: {
     accessTokenRequest: AccessTokenRequest;
     pinMetadata?: TxCodeAndPinRequired;
     metadata?: EndpointMetadata;
     asOpts?: AuthorizationServerOpts;
     issuerOpts?: IssuerOpts;
-  }): Promise<OpenIDResponse<AccessTokenResponse>> {
+    createDPoPOpts?: CreateDPoPClientOpts;
+  }): Promise<OpenIDResponse<AccessTokenResponse, DPoPResponseParams>> {
     this.validate(accessTokenRequest, pinMetadata);
 
     const requestTokenURL = AccessTokenClient.determineTokenURL({
@@ -87,10 +93,34 @@ export class AccessTokenClient {
           : undefined,
     });
 
-    return this.sendAuthCode(requestTokenURL, accessTokenRequest);
+    const useDpop = createDPoPOpts?.dPoPSigningAlgValuesSupported && createDPoPOpts.dPoPSigningAlgValuesSupported.length > 0;
+    let dPoP = useDpop ? await createDPoP(getCreateDPoPOptions(createDPoPOpts, requestTokenURL)) : undefined;
+
+    let response = await this.sendAuthCode(requestTokenURL, accessTokenRequest, dPoP ? { headers: { dpop: dPoP } } : undefined);
+
+    let nextDPoPNonce = createDPoPOpts?.jwtPayloadProps.nonce;
+    const retryWithNonce = shouldRetryTokenRequestWithDPoPNonce(response);
+    if (retryWithNonce.ok && createDPoPOpts) {
+      createDPoPOpts.jwtPayloadProps.nonce = retryWithNonce.dpopNonce;
+
+      dPoP = await createDPoP(getCreateDPoPOptions(createDPoPOpts, requestTokenURL));
+      response = await this.sendAuthCode(requestTokenURL, accessTokenRequest, dPoP ? { headers: { dpop: dPoP } } : undefined);
+      const successDPoPNonce = response.origResponse.headers.get('DPoP-Nonce');
+
+      nextDPoPNonce = successDPoPNonce ?? retryWithNonce.dpopNonce;
+    }
+
+    if (response.successBody && createDPoPOpts && response.successBody.token_type !== 'DPoP') {
+      throw new Error('Invalid token type returned. Expected DPoP. Received: ' + response.successBody.token_type);
+    }
+
+    return {
+      ...response,
+      params: { ...(nextDPoPNonce && { dpop: { dpopNonce: nextDPoPNonce } }) },
+    };
   }
 
-  public async createAccessTokenRequest(opts: AccessTokenRequestOpts): Promise<AccessTokenRequest> {
+  public async createAccessTokenRequest(opts: Omit<AccessTokenRequestOpts, 'createDPoPOpts'>): Promise<AccessTokenRequest> {
     const { asOpts, pin, codeVerifier, code, redirectUri } = opts;
     // eslint-disable-next-line @typescript-eslint/ban-ts-comment
     // @ts-ignore
@@ -222,8 +252,14 @@ export class AccessTokenClient {
     }
   }
 
-  private async sendAuthCode(requestTokenURL: string, accessTokenRequest: AccessTokenRequest): Promise<OpenIDResponse<AccessTokenResponse>> {
-    return await formPost(requestTokenURL, convertJsonToURI(accessTokenRequest, { mode: JsonURIMode.X_FORM_WWW_URLENCODED }));
+  private async sendAuthCode(
+    requestTokenURL: string,
+    accessTokenRequest: AccessTokenRequest,
+    opts?: { headers?: Record<string, string> },
+  ): Promise<OpenIDResponse<AccessTokenResponse, DPoPResponseParams>> {
+    return await formPost(requestTokenURL, convertJsonToURI(accessTokenRequest, { mode: JsonURIMode.X_FORM_WWW_URLENCODED }), {
+      customHeaders: opts?.headers ? opts.headers : undefined,
+    });
   }
 
   public static determineTokenURL({

package/lib/AccessTokenClientV1_0_11.ts

@@ -1,3 +1,4 @@
+import { createDPoP, CreateDPoPClientOpts, getCreateDPoPOptions } from '@sphereon/oid4vc-common';
 import {
   AccessTokenRequest,
   AccessTokenRequestOpts,
@@ -8,6 +9,7 @@ import {
   convertJsonToURI,
   CredentialOfferV1_0_11,
   CredentialOfferV1_0_13,
+  DPoPResponseParams,
   EndpointMetadata,
   formPost,
   getIssuerFromCredentialOfferPayload,
@@ -27,12 +29,13 @@ import Debug from 'debug';
 
 import { MetadataClientV1_0_13 } from './MetadataClientV1_0_13';
 import { createJwtBearerClientAssertion } from './functions';
+import { shouldRetryTokenRequestWithDPoPNonce } from './functions/dpopUtil';
 
 const debug = Debug('sphereon:oid4vci:token');
 
 export class AccessTokenClientV1_0_11 {
-  public async acquireAccessToken(opts: AccessTokenRequestOpts): Promise<OpenIDResponse<AccessTokenResponse>> {
-    const { asOpts, pin, codeVerifier, code, redirectUri, metadata } = opts;
+  public async acquireAccessToken(opts: AccessTokenRequestOpts): Promise<OpenIDResponse<AccessTokenResponse, DPoPResponseParams>> {
+    const { asOpts, pin, codeVerifier, code, redirectUri, metadata, createDPoPOpts } = opts;
 
     const credentialOffer = opts.credentialOffer ? await assertedUniformCredentialOffer(opts.credentialOffer) : undefined;
     const isPinRequired = credentialOffer && this.isPinRequiredValue(credentialOffer.credential_offer);
@@ -63,6 +66,7 @@ export class AccessTokenClientV1_0_11 {
       metadata,
       asOpts,
       issuerOpts,
+      createDPoPOpts,
     });
   }
 
@@ -71,6 +75,7 @@ export class AccessTokenClientV1_0_11 {
     isPinRequired,
     metadata,
     asOpts,
+    createDPoPOpts,
     issuerOpts,
   }: {
     accessTokenRequest: AccessTokenRequest;
@@ -78,7 +83,8 @@ export class AccessTokenClientV1_0_11 {
     metadata?: EndpointMetadata;
     asOpts?: AuthorizationServerOpts;
     issuerOpts?: IssuerOpts;
-  }): Promise<OpenIDResponse<AccessTokenResponse>> {
+    createDPoPOpts?: CreateDPoPClientOpts;
+  }): Promise<OpenIDResponse<AccessTokenResponse, DPoPResponseParams>> {
     this.validate(accessTokenRequest, isPinRequired);
 
     const requestTokenURL = AccessTokenClientV1_0_11.determineTokenURL({
@@ -91,10 +97,34 @@ export class AccessTokenClientV1_0_11 {
           : undefined,
     });
 
-    return this.sendAuthCode(requestTokenURL, accessTokenRequest);
+    const useDpop = createDPoPOpts?.dPoPSigningAlgValuesSupported && createDPoPOpts.dPoPSigningAlgValuesSupported.length > 0;
+    let dPoP = useDpop ? await createDPoP(getCreateDPoPOptions(createDPoPOpts, requestTokenURL)) : undefined;
+
+    let response = await this.sendAuthCode(requestTokenURL, accessTokenRequest, dPoP ? { headers: { dpop: dPoP } } : undefined);
+
+    let nextDPoPNonce = createDPoPOpts?.jwtPayloadProps.nonce;
+    const retryWithNonce = shouldRetryTokenRequestWithDPoPNonce(response);
+    if (retryWithNonce.ok && createDPoPOpts) {
+      createDPoPOpts.jwtPayloadProps.nonce = retryWithNonce.dpopNonce;
+
+      dPoP = await createDPoP(getCreateDPoPOptions(createDPoPOpts, requestTokenURL));
+      response = await this.sendAuthCode(requestTokenURL, accessTokenRequest, dPoP ? { headers: { dpop: dPoP } } : undefined);
+      const successDPoPNonce = response.origResponse.headers.get('DPoP-Nonce');
+
+      nextDPoPNonce = successDPoPNonce ?? retryWithNonce.dpopNonce;
+    }
+
+    if (response.successBody && createDPoPOpts && response.successBody.token_type !== 'DPoP') {
+      throw new Error('Invalid token type returned. Expected DPoP. Received: ' + response.successBody.token_type);
+    }
+
+    return {
+      ...response,
+      params: { ...(nextDPoPNonce && { dpop: { dpopNonce: nextDPoPNonce } }) },
+    };
   }
 
-  public async createAccessTokenRequest(opts: AccessTokenRequestOpts): Promise<AccessTokenRequest> {
+  public async createAccessTokenRequest(opts: Omit<AccessTokenRequestOpts, 'createDPoPOpts'>): Promise<AccessTokenRequest> {
     const { asOpts, pin, codeVerifier, code, redirectUri } = opts;
     const credentialOfferRequest = opts.credentialOffer
       ? await toUniformCredentialOfferRequest(opts.credentialOffer as CredentialOfferV1_0_11 | CredentialOfferV1_0_13)
@@ -204,8 +234,14 @@ export class AccessTokenClientV1_0_11 {
     }
   }
 
-  private async sendAuthCode(requestTokenURL: string, accessTokenRequest: AccessTokenRequest): Promise<OpenIDResponse<AccessTokenResponse>> {
-    return await formPost(requestTokenURL, convertJsonToURI(accessTokenRequest, { mode: JsonURIMode.X_FORM_WWW_URLENCODED }));
+  private async sendAuthCode(
+    requestTokenURL: string,
+    accessTokenRequest: AccessTokenRequest,
+    opts?: { headers?: Record<string, string> },
+  ): Promise<OpenIDResponse<AccessTokenResponse>> {
+    return await formPost(requestTokenURL, convertJsonToURI(accessTokenRequest, { mode: JsonURIMode.X_FORM_WWW_URLENCODED }), {
+      customHeaders: opts?.headers ? opts.headers : undefined,
+    });
   }
 
   public static determineTokenURL({

package/lib/AuthorizationCodeClient.ts

@@ -114,7 +114,7 @@ export const createAuthorizationRequestUrl = async ({
   const client_id = clientId ?? authorizationRequest.clientId;
 
   // Authorization server metadata takes precedence
-  const authorizationMetadata = endpointMetadata.authorizationServerMetadata ?? endpointMetadata.credentialIssuerMetadata
+  const authorizationMetadata = endpointMetadata.authorizationServerMetadata ?? endpointMetadata.credentialIssuerMetadata;
 
   let { authorizationDetails } = authorizationRequest;
   const parMode = authorizationMetadata?.require_pushed_authorization_requests
@@ -182,7 +182,6 @@ export const createAuthorizationRequestUrl = async ({
   }
   const parEndpoint = authorizationMetadata?.pushed_authorization_request_endpoint;
 
-
   let queryObj: Record<string, any> | PushedAuthorizationResponse = {
     response_type: ResponseType.AUTH_CODE,
     ...(!pkce.disabled && {

package/lib/AuthorizationCodeClientV1_0_11.ts

@@ -40,7 +40,7 @@ export const createAuthorizationRequestUrlV1_0_11 = async ({
 
   const parMode = endpointMetadata?.credentialIssuerMetadata?.require_pushed_authorization_requests
     ? PARMode.REQUIRE
-    : authorizationRequest.parMode ?? PARMode.AUTO;
+    : (authorizationRequest.parMode ?? PARMode.AUTO);
   // Scope and authorization_details can be used in the same authorization request
   // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-rar-23#name-relationship-to-scope-param
   if (!scope && !authorizationDetails) {

package/lib/CredentialRequestClient.ts

@@ -1,7 +1,9 @@
+import { createDPoP, CreateDPoPClientOpts, getCreateDPoPOptions } from '@sphereon/oid4vc-common';
 import {
   acquireDeferredCredential,
   CredentialRequestV1_0_13,
   CredentialResponse,
+  DPoPResponseParams,
   getCredentialRequestForVersion,
   getUniformFormat,
   isDeferredCredentialResponse,
@@ -21,6 +23,7 @@ import Debug from 'debug';
 import { CredentialRequestClientBuilderV1_0_11 } from './CredentialRequestClientBuilderV1_0_11';
 import { CredentialRequestClientBuilderV1_0_13 } from './CredentialRequestClientBuilderV1_0_13';
 import { ProofOfPossessionBuilder } from './ProofOfPossessionBuilder';
+import { shouldRetryResourceRequestWithDPoPNonce } from './functions/dpopUtil';
 
 const debug = Debug('sphereon:oid4vci:credential');
 
@@ -89,7 +92,8 @@ export class CredentialRequestClient {
     context?: string[];
     format?: CredentialFormat | OID4VCICredentialFormat;
     subjectIssuance?: ExperimentalSubjectIssuance;
-  }): Promise<OpenIDResponse<CredentialResponse> & { access_token: string }> {
+    createDPoPOpts?: CreateDPoPClientOpts;
+  }): Promise<OpenIDResponse<CredentialResponse, DPoPResponseParams> & { access_token: string }> {
     const { credentialIdentifier, credentialTypes, proofInput, format, context, subjectIssuance } = opts;
 
     const request = await this.createCredentialRequest({
@@ -101,12 +105,13 @@ export class CredentialRequestClient {
       credentialIdentifier,
       subjectIssuance,
     });
-    return await this.acquireCredentialsUsingRequest(request);
+    return await this.acquireCredentialsUsingRequest(request, opts.createDPoPOpts);
   }
 
   public async acquireCredentialsUsingRequest(
     uniformRequest: UniformCredentialRequest,
-  ): Promise<OpenIDResponse<CredentialResponse> & { access_token: string }> {
+    createDPoPOpts?: CreateDPoPClientOpts,
+  ): Promise<OpenIDResponse<CredentialResponse, DPoPResponseParams> & { access_token: string }> {
     if (this.version() < OpenId4VCIVersion.VER_1_0_13) {
       throw new Error('Versions below v1.0.13 (draft 13) are not supported by the V13 credential request client.');
     }
@@ -119,9 +124,33 @@ export class CredentialRequestClient {
     debug(`Acquiring credential(s) from: ${credentialEndpoint}`);
     debug(`request\n: ${JSON.stringify(request, null, 2)}`);
     const requestToken: string = this.credentialRequestOpts.token;
-    let response = (await post(credentialEndpoint, JSON.stringify(request), { bearerToken: requestToken })) as OpenIDResponse<CredentialResponse> & {
+
+    let dPoP = createDPoPOpts ? await createDPoP(getCreateDPoPOptions(createDPoPOpts, credentialEndpoint, { accessToken: requestToken })) : undefined;
+
+    let response = (await post(credentialEndpoint, JSON.stringify(request), {
+      bearerToken: requestToken,
+      customHeaders: { ...(dPoP && { dpop: dPoP }) },
+    })) as OpenIDResponse<CredentialResponse> & {
       access_token: string;
     };
+
+    let nextDPoPNonce = createDPoPOpts?.jwtPayloadProps.nonce;
+    const retryWithNonce = shouldRetryResourceRequestWithDPoPNonce(response);
+    if (retryWithNonce.ok && createDPoPOpts) {
+      createDPoPOpts.jwtPayloadProps.nonce = retryWithNonce.dpopNonce;
+      dPoP = await createDPoP(getCreateDPoPOptions(createDPoPOpts, credentialEndpoint, { accessToken: requestToken }));
+
+      response = (await post(credentialEndpoint, JSON.stringify(request), {
+        bearerToken: requestToken,
+        customHeaders: { ...(createDPoPOpts && { dpop: dPoP }) },
+      })) as OpenIDResponse<CredentialResponse> & {
+        access_token: string;
+      };
+
+      const successDPoPNonce = response.origResponse.headers.get('DPoP-Nonce');
+      nextDPoPNonce = successDPoPNonce ?? retryWithNonce.dpopNonce;
+    }
+
     this._isDeferred = isDeferredCredentialResponse(response);
     if (this.isDeferred() && this.credentialRequestOpts.deferredCredentialAwait && response.successBody) {
       response = await this.acquireDeferredCredential(response.successBody, { bearerToken: this.credentialRequestOpts.token });
@@ -134,7 +163,11 @@ export class CredentialRequestClient {
       }
     }
     debug(`Credential endpoint ${credentialEndpoint} response:\r\n${JSON.stringify(response, null, 2)}`);
-    return response;
+
+    return {
+      ...response,
+      params: { ...(nextDPoPNonce && { dpop: { dpopNonce: nextDPoPNonce } }) },
+    };
   }
 
   public async acquireDeferredCredential(

package/lib/CredentialRequestClientV1_0_11.ts

@@ -1,6 +1,8 @@
+import { createDPoP, CreateDPoPClientOpts, getCreateDPoPOptions } from '@sphereon/oid4vc-common';
 import {
   acquireDeferredCredential,
   CredentialResponse,
+  DPoPResponseParams,
   getCredentialRequestForVersion,
   getUniformFormat,
   isDeferredCredentialResponse,
@@ -20,6 +22,7 @@ import Debug from 'debug';
 import { buildProof } from './CredentialRequestClient';
 import { CredentialRequestClientBuilderV1_0_11 } from './CredentialRequestClientBuilderV1_0_11';
 import { ProofOfPossessionBuilder } from './ProofOfPossessionBuilder';
+import { shouldRetryResourceRequestWithDPoPNonce } from './functions/dpopUtil';
 
 const debug = Debug('sphereon:oid4vci:credential');
 
@@ -64,16 +67,18 @@ export class CredentialRequestClientV1_0_11 {
     credentialTypes?: string | string[];
     context?: string[];
     format?: CredentialFormat | OID4VCICredentialFormat;
-  }): Promise<OpenIDResponse<CredentialResponse> & { access_token: string }> {
+    createDPoPOpts?: CreateDPoPClientOpts;
+  }): Promise<OpenIDResponse<CredentialResponse, DPoPResponseParams> & { access_token: string }> {
     const { credentialTypes, proofInput, format, context } = opts;
 
     const request = await this.createCredentialRequest({ proofInput, credentialTypes, context, format, version: this.version() });
-    return await this.acquireCredentialsUsingRequest(request);
+    return await this.acquireCredentialsUsingRequest(request, opts.createDPoPOpts);
   }
 
   public async acquireCredentialsUsingRequest(
     uniformRequest: UniformCredentialRequest,
-  ): Promise<OpenIDResponse<CredentialResponse> & { access_token: string }> {
+    createDPoPOpts?: CreateDPoPClientOpts,
+  ): Promise<OpenIDResponse<CredentialResponse, DPoPResponseParams> & { access_token: string }> {
     const request = getCredentialRequestForVersion(uniformRequest, this.version());
     const credentialEndpoint: string = this.credentialRequestOpts.credentialEndpoint;
     if (!isValidURL(credentialEndpoint)) {
@@ -83,9 +88,33 @@ export class CredentialRequestClientV1_0_11 {
     debug(`Acquiring credential(s) from: ${credentialEndpoint}`);
     debug(`request\n: ${JSON.stringify(request, null, 2)}`);
     const requestToken: string = this.credentialRequestOpts.token;
-    let response = (await post(credentialEndpoint, JSON.stringify(request), { bearerToken: requestToken })) as OpenIDResponse<CredentialResponse> & {
+
+    let dPoP = createDPoPOpts ? await createDPoP(getCreateDPoPOptions(createDPoPOpts, credentialEndpoint, { accessToken: requestToken })) : undefined;
+
+    let response = (await post(credentialEndpoint, JSON.stringify(request), {
+      bearerToken: requestToken,
+      customHeaders: { ...(createDPoPOpts && { dpop: dPoP }) },
+    })) as OpenIDResponse<CredentialResponse> & {
       access_token: string;
     };
+
+    let nextDPoPNonce = createDPoPOpts?.jwtPayloadProps.nonce;
+    const retryWithNonce = shouldRetryResourceRequestWithDPoPNonce(response);
+    if (retryWithNonce.ok && createDPoPOpts) {
+      createDPoPOpts.jwtPayloadProps.nonce = retryWithNonce.dpopNonce;
+      dPoP = await createDPoP(getCreateDPoPOptions(createDPoPOpts, credentialEndpoint, { accessToken: requestToken }));
+
+      response = (await post(credentialEndpoint, JSON.stringify(request), {
+        bearerToken: requestToken,
+        customHeaders: { ...(createDPoPOpts && { dpop: dPoP }) },
+      })) as OpenIDResponse<CredentialResponse> & {
+        access_token: string;
+      };
+
+      const successDPoPNonce = response.origResponse.headers.get('DPoP-Nonce');
+      nextDPoPNonce = successDPoPNonce ?? retryWithNonce.dpopNonce;
+    }
+
     this._isDeferred = isDeferredCredentialResponse(response);
     if (this.isDeferred() && this.credentialRequestOpts.deferredCredentialAwait && response.successBody) {
       response = await this.acquireDeferredCredential(response.successBody, { bearerToken: this.credentialRequestOpts.token });
@@ -93,7 +122,11 @@ export class CredentialRequestClientV1_0_11 {
     response.access_token = requestToken;
 
     debug(`Credential endpoint ${credentialEndpoint} response:\r\n${JSON.stringify(response, null, 2)}`);
-    return response;
+
+    return {
+      ...response,
+      params: { ...(nextDPoPNonce && { dpop: { dpopNonce: nextDPoPNonce } }) },
+    };
   }
 
   public async acquireDeferredCredential(

package/lib/MetadataClientV1_0_13.ts

@@ -50,7 +50,6 @@ export class MetadataClientV1_0_13 {
     let credential_endpoint: string | undefined;
     let deferred_credential_endpoint: string | undefined;
     let authorization_endpoint: string | undefined;
-    let session_endpoint: string | undefined;
     let authorizationServerType: AuthorizationServerType = 'OID4VCI';
     let authorization_servers: string[] = [issuer];
     const oid4vciResponse = await MetadataClientV1_0_13.retrieveOpenID4VCIServerMetadata(issuer, { errorOnNotFound: false }); // We will handle errors later, given we will also try other metadata locations
@@ -158,16 +157,11 @@ export class MetadataClientV1_0_13 {
       credentialIssuerMetadata = authMetadata as CredentialIssuerMetadataV1_0_13;
     }
     debug(`Issuer ${issuer} token endpoint ${token_endpoint}, credential endpoint ${credential_endpoint}`);
-
-    if(credentialIssuerMetadata?.session_endpoint !== undefined) {
-      session_endpoint = credentialIssuerMetadata.session_endpoint
-    }
     return {
       issuer,
       token_endpoint,
       credential_endpoint,
       deferred_credential_endpoint,
-      session_endpoint,
       authorization_server: authorization_servers[0],
       authorization_endpoint,
       authorizationServerType,

package/lib/OpenID4VCIClient.ts

@@ -1,3 +1,4 @@
+import { JWK } from '@sphereon/oid4vc-common';
 import {
   AccessTokenResponse,
   Alg,
@@ -22,8 +23,7 @@ import {
   getIssuerFromCredentialOfferPayload,
   getSupportedCredentials,
   getTypesFromCredentialSupported,
-  getTypesFromObject, IssuerSessionResponse,
-  JWK,
+  getTypesFromObject,
   KID_JWK_X5C_ERROR,
   NotificationRequest,
   NotificationResult,
@@ -31,7 +31,7 @@ import {
   OpenId4VCIVersion,
   PKCEOpts,
   ProofOfPossessionCallbacks,
-  toAuthorizationResponsePayload
+  toAuthorizationResponsePayload,
 } from '@sphereon/oid4vci-common';
 import { CredentialFormat } from '@sphereon/ssi-types';
 import Debug from 'debug';
@@ -49,7 +49,6 @@ import { OpenID4VCIClientStateV1_0_11 } from './OpenID4VCIClientV1_0_11';
 import { OpenID4VCIClientStateV1_0_13 } from './OpenID4VCIClientV1_0_13';
 import { ProofOfPossessionBuilder } from './ProofOfPossessionBuilder';
 import { generateMissingPKCEOpts, sendNotification } from './functions';
-import { acquireIssuerSessionId } from './IssuerSessionClient';
 
 const debug = Debug('sphereon:oid4vci');
 
@@ -362,16 +361,6 @@ export class OpenID4VCIClient {
     return this.accessTokenResponse;
   }
 
-  public async acquireIssuerSessionId() : Promise<IssuerSessionResponse | undefined> {
-    if(!this._state.endpointMetadata) {
-      return Promise.reject('endpointMetadata no loaded, retrieveServerMetadata()')
-    }
-    if(!('session_endpoint' in this._state.endpointMetadata) || !this._state.endpointMetadata.session_endpoint) {
-      return undefined
-    }
-    return acquireIssuerSessionId({sessionEndpoint: this._state.endpointMetadata.session_endpoint})
-  }
-
   public async acquireCredentials({
     credentialTypes,
     context,
@@ -560,7 +549,7 @@ export class OpenID4VCIClient {
   issuerSupportedFlowTypes(): AuthzFlowType[] {
     return (
       this.credentialOffer?.supportedFlows ??
-      (this._state.endpointMetadata?.credentialIssuerMetadata?.authorization_endpoint ?? this._state.endpointMetadata?.authorization_server
+      ((this._state.endpointMetadata?.credentialIssuerMetadata?.authorization_endpoint ?? this._state.endpointMetadata?.authorization_server)
         ? [AuthzFlowType.AUTHORIZATION_CODE_FLOW]
         : [])
     );